| | | 1 | | import type { SecretClient } from '@azure/keyvault-secrets'; |
| | | 2 | | import { injectable } from 'inversify'; |
| | | 3 | | import { EnvironmentVariable } from '../../domain/EnvironmentVariable.js'; |
| | | 4 | | import { |
| | | 5 | | InvalidArgumentError, |
| | | 6 | | SecretOperationError, |
| | | 7 | | } from '../../domain/errors/DomainErrors.js'; |
| | | 8 | | import type { ISecretProvider } from '../../domain/ports/ISecretProvider.js'; |
| | | 9 | | import { describeError } from '../describeError.js'; |
| | | 10 | | |
| | 9 | 11 | | @injectable() |
| | 9 | 12 | | export class AzureKeyVaultSecretProvider implements ISecretProvider { |
| | | 13 | | private client: SecretClient; |
| | 39 | 14 | | private normalizedNameRegistry = new Map<string, string>(); |
| | | 15 | | |
| | | 16 | | constructor(client: SecretClient) { |
| | 39 | 17 | | this.client = client; |
| | | 18 | | } |
| | | 19 | | |
| | | 20 | | async getSecret(name: string): Promise<string | undefined> { |
| | 27 | 21 | | const secretName = this.resolveSecretName(name); |
| | 27 | 22 | | try { |
| | 27 | 23 | | const secret = await this.client.getSecret(secretName); |
| | 16 | 24 | | return secret?.value ?? undefined; |
| | | 25 | | } catch (error) { |
| | 5 | 26 | | if ( |
| | | 27 | | typeof error === 'object' && |
| | | 28 | | error !== null && |
| | | 29 | | 'statusCode' in error && |
| | | 30 | | error.statusCode === 404 |
| | | 31 | | ) { |
| | 2 | 32 | | return undefined; |
| | | 33 | | } |
| | 3 | 34 | | throw new SecretOperationError( |
| | | 35 | | `${EnvironmentVariable.maskSecretPath(name)}: ${describeError(error)}`, |
| | | 36 | | ); |
| | | 37 | | } |
| | | 38 | | } |
| | | 39 | | |
| | | 40 | | async setSecret(name: string, value: string): Promise<void> { |
| | 9 | 41 | | const secretName = this.resolveSecretName(name); |
| | 9 | 42 | | await this.client.setSecret(secretName, value); |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | /** |
| | | 46 | | * Validates that the secret name meets Azure Key Vault naming constraints. |
| | | 47 | | * @see https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#objects-identifiers- |
| | | 48 | | */ |
| | | 49 | | private validateSecretName(name: string): void { |
| | 36 | 50 | | if (name.trim().length === 0) { |
| | 1 | 51 | | throw new InvalidArgumentError( |
| | | 52 | | 'Invalid secret name: name cannot be empty or whitespace-only.', |
| | | 53 | | ); |
| | | 54 | | } |
| | 35 | 55 | | if (/[^a-zA-Z0-9\-_/]/.test(name)) { |
| | 2 | 56 | | throw new InvalidArgumentError( |
| | | 57 | | `Invalid secret name '${name}': contains characters not allowed` + |
| | | 58 | | ' by Azure Key Vault. Only alphanumeric characters,' + |
| | | 59 | | ' hyphens, slashes, and underscores are accepted.', |
| | | 60 | | ); |
| | | 61 | | } |
| | | 62 | | } |
| | | 63 | | |
| | | 64 | | private resolveSecretName(originalName: string): string { |
| | 36 | 65 | | this.validateSecretName(originalName); |
| | 36 | 66 | | const normalized = this.normalizeSecretName(originalName); |
| | 36 | 67 | | if (normalized.length > 127) { |
| | 1 | 68 | | throw new InvalidArgumentError( |
| | | 69 | | `Invalid secret name '${originalName}': normalized name '${normalized}' exceeds the 127-character limit for Azur |
| | | 70 | | ); |
| | | 71 | | } |
| | 32 | 72 | | const existing = this.normalizedNameRegistry.get(normalized); |
| | 32 | 73 | | if (existing !== undefined && existing !== originalName) { |
| | 3 | 74 | | throw new SecretOperationError( |
| | | 75 | | `Secret name collision: '${originalName}' and '${existing}' ` + |
| | | 76 | | `both normalize to '${normalized}'. Use distinct ` + |
| | | 77 | | 'Key Vault-compatible names in your map file ' + |
| | | 78 | | 'when targeting Azure.', |
| | | 79 | | ); |
| | | 80 | | } |
| | 29 | 81 | | this.normalizedNameRegistry.set(normalized, originalName); |
| | 29 | 82 | | return normalized; |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | // Azure Key Vault secret names: 1-127 chars, alphanumeric + hyphens, start with letter |
| | | 86 | | private normalizeSecretName(name: string): string { |
| | | 87 | | // Remove leading slashes |
| | 33 | 88 | | let normalized = name.replace(/^\/+/, ''); |
| | | 89 | | |
| | | 90 | | // Replace slashes and underscores with hyphens |
| | 33 | 91 | | normalized = normalized.replace(/[/_]/g, '-'); |
| | | 92 | | |
| | | 93 | | // Lowercase to match Azure Key Vault case-insensitivity |
| | 33 | 94 | | normalized = normalized.toLowerCase(); |
| | | 95 | | |
| | | 96 | | // Remove invalid characters |
| | 33 | 97 | | normalized = normalized.replace(/[^a-zA-Z0-9-]/g, ''); |
| | | 98 | | |
| | | 99 | | // Remove consecutive hyphens |
| | 33 | 100 | | normalized = normalized.replace(/-+/g, '-'); |
| | | 101 | | |
| | | 102 | | // Remove leading/trailing hyphens |
| | 33 | 103 | | normalized = normalized.replace(/^-+|-+$/g, ''); |
| | | 104 | | |
| | | 105 | | // Ensure starts with a letter |
| | 33 | 106 | | if (normalized.length > 0 && !/^[a-zA-Z]/.test(normalized)) { |
| | 1 | 107 | | normalized = `secret-${normalized}`; |
| | | 108 | | } |
| | | 109 | | |
| | | 110 | | // Default name if empty |
| | 33 | 111 | | if (normalized.length === 0) { |
| | 0 | 112 | | normalized = 'secret'; |
| | | 113 | | } |
| | | 114 | | |
| | 33 | 115 | | return normalized; |
| | | 116 | | } |
| | | 117 | | } |