feat: adds file system-supported version and updates appropriate exports (#4)

JacobNWolf · web-flow · commit 85b10cef9c7c · 2025-03-23T13:48:04.000-05:00
Adds the `secrets-file` module to support places where the file system is supported and updates default export and `no-fs` export to support both environments. 

Additionally, makes formatting changes to tests files and adds appropriate Vitest mocks to mock the file system using `memfs`.
diff --git a/.secrets/.secrets.enc.js b/.secrets/.secrets.enc.js
@@ -0,0 +1,3 @@
+This file was auto-generated by @jacobwolf/gitops-secrets
+const CIPHER_TEXT = undefined;
+module.exports = { CIPHER_TEXT };
diff --git a/__mocks__/.secrets.enc.js b/__mocks__/.secrets.enc.js
@@ -0,0 +1,3 @@
+module.exports = {
+   loadSecrets: () => ({ key: 'loaded-value' }),
+};
diff --git a/__mocks__/fs.cjs b/__mocks__/fs.cjs
@@ -0,0 +1,2 @@
+const { fs } = require('memfs');
+module.exports = { ...fs, default: fs };
diff --git a/__mocks__/fs/promises.cjs b/__mocks__/fs/promises.cjs
@@ -0,0 +1,2 @@
+const { fs } = require('memfs');
+module.exports = fs.promises;
diff --git a/__mocks__/secrets.js b/__mocks__/secrets.js
@@ -0,0 +1,5 @@
+module.exports = {
+   encrypt: vi.fn().mockResolvedValue('encrypted-content'),
+   decrypt: vi.fn().mockResolvedValue('{"key":"decrypted-value"}'),
+   mergeSecrets: vi.fn(),
+};
diff --git a/biome.json b/biome.json
@@ -8,7 +8,7 @@
    },
    "files": {
       "ignoreUnknown": false,
-      "include": ["src/**/*"]
+      "include": ["src/**/*", "tests/**/*", "__mocks__/**/*"]
    },
    "formatter": {
       "enabled": true,
diff --git a/package.json b/package.json
@@ -37,6 +37,7 @@
       "@types/node": "^22.13.11",
       "husky": "^9.1.7",
       "lint-staged": "^15.5.0",
+      "memfs": "^4.17.0",
       "msw": "^2.7.3",
       "tsup": "^8.4.0",
       "typescript": "^5.8.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/index.ts b/src/index.ts
@@ -1,5 +1,11 @@
-async function main() {
-   console.log('Hello, world!');
-}
+import * as doppler from './providers/doppler';
+import * as secrets from './secrets';
+import * as secretsFiles from './secrets-files';
 
-main();
+export const providers = { doppler };
+
+export default {
+   ...secrets,
+   ...secretsFiles,
+   providers,
+};
diff --git a/src/no-fs.ts b/src/no-fs.ts
@@ -0,0 +1,14 @@
+import * as doppler from './providers/doppler';
+import * as secrets from './secrets';
+
+const noFs = {
+   ...secrets,
+   providers: {
+      doppler,
+   },
+};
+
+export default noFs;
+
+export * from './secrets';
+export const providers = { doppler };
diff --git a/src/secrets-files.ts b/src/secrets-files.ts
@@ -0,0 +1,101 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import * as secrets from './secrets';
+import { EnvTarget } from './types';
+
+const SECRETS_FOLDER = path.join(__dirname, '../.secrets');
+const DEFAULT_JS_PATH = path.join(SECRETS_FOLDER, '.secrets.enc.js');
+const DEFAULT_JSON_PATH = path.join(SECRETS_FOLDER, '.secrets.enc.json');
+
+if (!fs.existsSync(SECRETS_FOLDER)) {
+   fs.mkdirSync(SECRETS_FOLDER, { recursive: true });
+}
+
+/**
+ * Encapsulate encrypted secrets in a JS module for easy runtime access.
+ * Use {options.path} to output module locally for when package level storage or non-literal imports are disallowed.
+ * Use {options.cipherTextOnly} to limit the JS file to only exporting `CIPHER_TEXT`.
+ * @param {<Record<string, any>>} payload
+ * @param {{path: string | null, cipherTextOnly: boolean}} options
+ */
+// biome-ignore lint/suspicious/noExplicitAny: Want to keep this flexible
+async function build(payload: Record<string, any>, options = { path: null as string | null, cipherTextOnly: false }) {
+   const cipherText = await secrets.encrypt(JSON.stringify(payload));
+   const filePath = options.path ? path.resolve(options.path) : DEFAULT_JS_PATH;
+   const packageType = process.env.npm_package_type === 'module' ? 'esm' : 'cjs';
+   const format = filePath === DEFAULT_JS_PATH ? 'cjs' : packageType;
+   const lines = ['This file was auto-generated by @jacobwolf/gitops-secrets'];
+
+   if (format === 'esm') {
+      if (!options.cipherTextOnly) {
+         lines.push(`import secrets from '@jacobwolf/gitops-secrets/no-fs';`);
+         lines.push(`const CIPHER_TEXT = ${JSON.stringify(cipherText)};`);
+         lines.push('const loadSecrets = () => secrets.loadSecretsFromCipher(CIPHER_TEXT);');
+         lines.push('export { CIPHER_TEXT, loadSecrets };');
+      } else {
+         lines.push(`const CIPHER_TEXT = ${JSON.stringify(cipherText)};`);
+         lines.push('export { CIPHER_TEXT };');
+      }
+   }
+
+   if (format === 'cjs') {
+      if (!options.cipherTextOnly) {
+         lines.push(`const secrets = require('@jacobwolf/gitops-secrets/no-fs');`);
+         lines.push(`const CIPHER_TEXT = ${JSON.stringify(cipherText)};`);
+         lines.push('const loadSecrets = () => secrets.loadSecretsFromCipher(CIPHER_TEXT);');
+         lines.push('module.exports = { CIPHER_TEXT, loadSecrets };');
+      } else {
+         lines.push(`const CIPHER_TEXT = ${JSON.stringify(cipherText)};`);
+         lines.push('module.exports = { CIPHER_TEXT };');
+      }
+   }
+
+   writeFile(filePath, lines.join('\n'));
+}
+
+/**
+ * Encrypt JSON-serializable payload to a static file.
+ * @param {<Record<string, any>>} payload
+ * @param {{path: string | null}} [options={path: null}]
+ */
+// biome-ignore lint/suspicious/noExplicitAny: Want to keep this flexible
+async function encryptToFile(payload: Record<string, any>, options = { path: null as string | null }) {
+   const cipherText = await secrets.encrypt(JSON.stringify(payload));
+   const filePath = options.path ? path.resolve(options.path) : DEFAULT_JSON_PATH;
+   writeFile(filePath, cipherText);
+}
+
+/**
+ * Decrypt JSON payload to object with option to merge with process.env.
+ * @param {string} filePath
+ * @returns
+ */
+async function decryptFromFile(filePath: string) {
+   const newFilePath = filePath ? path.resolve(filePath) : DEFAULT_JSON_PATH;
+
+   try {
+      const cipherText = fs.readFileSync(newFilePath, { encoding: 'utf-8' });
+      const decryptedText = await secrets.decrypt(cipherText);
+      const payload = JSON.parse(decryptedText);
+      return {
+         ...payload,
+         mergeSecrets: () => secrets.mergeSecrets(payload, EnvTarget.PROCESS),
+      };
+   } catch (error) {
+      throw new Error(`Failed to decrypt file ${newFilePath}: ${error}`);
+   }
+}
+
+function writeFile(filePath: string, fileContents: string) {
+   try {
+      fs.writeFileSync(filePath, fileContents, { encoding: 'utf-8' });
+   } catch (error) {
+      throw new Error(`Failed to write file ${filePath}: ${error}`);
+   }
+}
+
+function loadSecrets() {
+   return require(DEFAULT_JS_PATH).loadSecrets();
+}
+
+export { build, encryptToFile, decryptFromFile, loadSecrets };
diff --git a/src/secrets.ts b/src/secrets.ts
@@ -123,6 +123,13 @@ async function decrypt(ciphertext: string): Promise<string> {
  * @returns {EnvObject} - The environment object
  */
 function getEnvObject(target: EnvTarget): EnvObject {
+   if (typeof import.meta === 'undefined') {
+      if (typeof process !== 'undefined' && process.env) {
+         return process.env;
+      }
+      throw new Error('process.env is not available in this environment');
+   }
+
    switch (target) {
       case EnvTarget.PROCESS:
          if (typeof process !== 'undefined' && process.env) {
@@ -134,7 +141,6 @@ function getEnvObject(target: EnvTarget): EnvObject {
             return import.meta.env;
          }
          throw new Error('import.meta.env is not available in this environment');
-
       default:
          throw new Error(`Unsupported environment target: ${target}`);
    }
@@ -150,10 +156,19 @@ function getEnvObject(target: EnvTarget): EnvObject {
 function mergeSecrets(payload: Record<string, string>, target: EnvTarget): EnvObject {
    const envObject = getEnvObject(target);
 
+   if (typeof import.meta === 'undefined') {
+      if (typeof process !== 'undefined' && process.env) {
+         for (const [key, value] of Object.entries(payload)) {
+            process.env[key] = value;
+         }
+      }
+      return envObject;
+   }
+
    for (const [key, value] of Object.entries(payload)) {
       if (target === EnvTarget.PROCESS && typeof process !== 'undefined') {
          process.env[key] = value;
-      } else if (target === EnvTarget.IMPORT_META) {
+      } else if (target === EnvTarget.IMPORT_META && typeof import.meta !== 'undefined') {
          import.meta.env[key] = value;
       }
    }
diff --git a/tests/providers/doppler.test.ts b/tests/providers/doppler.test.ts
diff --git a/tests/secrets-files.test.ts b/tests/secrets-files.test.ts
diff --git a/tests/secrets.test.ts b/tests/secrets.test.ts

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+This file was auto-generated by @jacobwolf/gitops-secrets`
	`2`	`+const CIPHER_TEXT = undefined;`
	`3`	`+module.exports = { CIPHER_TEXT };`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+module.exports = {`
	`2`	`+ loadSecrets: () => ({ key: 'loaded-value' }),`
	`3`	`+};`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+const { fs } = require('memfs');`
	`2`	`+module.exports = { ...fs, default: fs };`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+const { fs } = require('memfs');`
	`2`	`+module.exports = fs.promises;`