feat(config-service): add centralized configuration service

Author: BigGoodness

microservices/config-service/package-lock.json

@@ -0,0 +1,60 @@
+import { IsBoolean, IsEnum, IsNotEmpty, IsObject, IsOptional, IsString, IsUrl, MaxLength } from 'class-validator';
+import { ConfigKind } from '../entities';
+
+export class CreateEnvironmentDto {
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(50)
+  name: string;
+
+  @IsOptional()
+  @IsString()
+  description?: string;
+}
+
+export class UpsertConfigDto {
+  @IsNotEmpty()
+  value: unknown;
+
+  @IsOptional()
+  @IsEnum(ConfigKind)
+  kind?: ConfigKind;
+
+  @IsOptional()
+  @IsString()
+  description?: string;
+}
+
+export class UpsertSecretDto {
+  @IsString()
+  @IsNotEmpty()
+  value: string;
+}
+
+export class RegisterWebhookDto {
+  @IsString()
+  @IsNotEmpty()
+  service: string;
+
+  @IsString()
+  @IsNotEmpty()
+  environment: string;
+
+  @IsUrl({ require_tld: false })
+  url: string;
+
+  @IsOptional()
+  @IsString()
+  signingSecret?: string;
+}
+
+export class SetWebhookStateDto {
+  @IsBoolean()
+  active: boolean;
+}
+
+export class RollbackDto {
+  @IsString()
+  @IsNotEmpty()
+  actor: string;
+}

microservices/config-service/src/dto/config.dto.ts

@@ -0,0 +1,26 @@
+import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from 'typeorm';
+
+@Entity('config_versions')
+@Index(['resourceType', 'resourceId', 'version'])
+export class ConfigVersion {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ length: 20 })
+  resourceType: 'config' | 'secret';
+
+  @Column('uuid')
+  resourceId: string;
+
+  @Column()
+  version: number;
+
+  @Column({ type: 'jsonb' })
+  snapshot: Record<string, unknown>;
+
+  @Column({ nullable: true })
+  changedBy?: string;
+
+  @CreateDateColumn()
+  createdAt: Date;
+}

microservices/config-service/src/entities/config-version.entity.ts

@@ -0,0 +1,29 @@
+import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn, UpdateDateColumn } from 'typeorm';
+
+@Entity('config_webhooks')
+@Index(['service', 'environment'])
+export class Webhook {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ length: 100 })
+  service: string;
+
+  @Column({ length: 50 })
+  environment: string;
+
+  @Column()
+  url: string;
+
+  @Column({ nullable: true, select: false })
+  signingSecret?: string;
+
+  @Column({ default: true })
+  active: boolean;
+
+  @CreateDateColumn()
+  createdAt: Date;
+
+  @UpdateDateColumn()
+  updatedAt: Date;
+}

microservices/config-service/src/entities/webhook.entity.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { timingSafeEqual } from 'crypto';
+
+@Injectable()
+export class ApiKeyGuard implements CanActivate {
+  constructor(private readonly config: ConfigService) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const expected = this.config.get<string>('CONFIG_API_KEY') || (this.config.get('NODE_ENV') === 'production' ? '' : 'dev-config-key');
+    const supplied = context.switchToHttp().getRequest<{ headers: Record<string, string | undefined> }>().headers['x-config-api-key'] || '';
+    const expectedBuffer = Buffer.from(expected);
+    const suppliedBuffer = Buffer.from(supplied);
+    if (!expected || expectedBuffer.length !== suppliedBuffer.length || !timingSafeEqual(expectedBuffer, suppliedBuffer)) {
+      throw new UnauthorizedException('A valid x-config-api-key header is required');
+    }
+    return true;
+  }
+}

microservices/config-service/src/guards/api-key.guard.ts

@@ -0,0 +1,21 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { AuditLog } from '../entities';
+
+@Injectable()
+export class AuditService {
+  constructor(@InjectRepository(AuditLog) private readonly repository: Repository<AuditLog>) {}
+
+  record(entry: Partial<AuditLog>): Promise<AuditLog> {
+    return this.repository.save(this.repository.create(entry));
+  }
+
+  list(service?: string, environment?: string, limit = 100): Promise<AuditLog[]> {
+    return this.repository.find({
+      where: { ...(service ? { service } : {}), ...(environment ? { environment } : {}) },
+      order: { createdAt: 'DESC' },
+      take: Math.min(Math.max(limit, 1), 500),
+    });
+  }
+}

microservices/config-service/src/services/audit.service.ts

@@ -0,0 +1,12 @@
+import { ConfigService } from '@nestjs/config';
+import { CacheService } from './cache.service';
+
+describe('CacheService', () => {
+  it('stores and invalidates config by prefix', () => {
+    const cache = new CacheService(new ConfigService({ CACHE_TTL_SECONDS: 60 }));
+    cache.set('config:api:dev', { enabled: true });
+    expect(cache.get('config:api:dev')).toEqual({ enabled: true });
+    cache.deleteByPrefix('config:api');
+    expect(cache.get('config:api:dev')).toBeUndefined();
+  });
+});

microservices/config-service/src/services/cache.service.spec.ts

@@ -0,0 +1,41 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService as NestConfigService } from '@nestjs/config';
+
+interface CacheItem<T> {
+  value: T;
+  expiresAt: number;
+}
+
+@Injectable()
+export class CacheService {
+  private readonly entries = new Map<string, CacheItem<unknown>>();
+  private readonly ttlMs: number;
+
+  constructor(config: NestConfigService) {
+    this.ttlMs = Math.max(1, config.get<number>('CACHE_TTL_SECONDS', 60)) * 1000;
+  }
+
+  get<T>(key: string): T | undefined {
+    const item = this.entries.get(key);
+    if (!item) return undefined;
+    if (item.expiresAt <= Date.now()) {
+      this.entries.delete(key);
+      return undefined;
+    }
+    return item.value as T;
+  }
+
+  set<T>(key: string, value: T): void {
+    this.entries.set(key, { value, expiresAt: Date.now() + this.ttlMs });
+  }
+
+  deleteByPrefix(prefix: string): void {
+    for (const key of this.entries.keys()) {
+      if (key.startsWith(prefix)) this.entries.delete(key);
+    }
+  }
+
+  clear(): void {
+    this.entries.clear();
+  }
+}

microservices/config-service/src/services/cache.service.ts

@@ -0,0 +1,110 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { UpsertConfigDto } from '../dto/config.dto';
+import { ConfigEntry, ConfigKind, ConfigVersion } from '../entities';
+import { AuditService } from './audit.service';
+import { CacheService } from './cache.service';
+import { EnvironmentService } from './environment.service';
+import { WebhookService } from './webhook.service';
+
+export interface ResolvedConfiguration {
+  service: string;
+  environment: string;
+  values: Record<string, unknown>;
+  featureFlags: Record<string, unknown>;
+  versions: Record<string, number>;
+  fetchedAt: string;
+}
+
+@Injectable()
+export class ConfigurationService {
+  constructor(
+    @InjectRepository(ConfigEntry) private readonly repository: Repository<ConfigEntry>,
+    @InjectRepository(ConfigVersion) private readonly versionRepository: Repository<ConfigVersion>,
+    private readonly environments: EnvironmentService,
+    private readonly cache: CacheService,
+    private readonly audit: AuditService,
+    private readonly webhooks: WebhookService,
+  ) {}
+
+  async resolve(service: string, environmentName: string): Promise<ResolvedConfiguration> {
+    const cacheKey = this.cacheKey(service, environmentName);
+    const cached = this.cache.get<ResolvedConfiguration>(cacheKey);
+    if (cached) return cached;
+    const environment = await this.environments.get(environmentName);
+    const entries = await this.repository.find({ where: { service, environment: { id: environment.id } }, order: { key: 'ASC' } });
+    const result: ResolvedConfiguration = {
+      service,
+      environment: environment.name,
+      values: {},
+      featureFlags: {},
+      versions: {},
+      fetchedAt: new Date().toISOString(),
+    };
+    for (const entry of entries) {
+      const target = entry.kind === ConfigKind.FEATURE_FLAG ? result.featureFlags : result.values;
+      target[entry.key] = entry.value;
+      result.versions[entry.key] = entry.version;
+    }
+    this.cache.set(cacheKey, result);
+    return result;
+  }
+
+  async upsert(service: string, environmentName: string, key: string, dto: UpsertConfigDto, actor: string): Promise<ConfigEntry> {
+    const environment = await this.environments.get(environmentName);
+    let entry = await this.repository.findOne({ where: { service, environment: { id: environment.id }, key } });
+    if (entry) {
+      entry.value = dto.value;
+      entry.kind = dto.kind ?? entry.kind;
+      entry.description = dto.description ?? entry.description;
+      entry.version += 1;
+    } else {
+      entry = this.repository.create({ service, environment, key, value: dto.value, kind: dto.kind ?? ConfigKind.SETTING, description: dto.description });
+    }
+    const saved = await this.repository.save(entry);
+    await this.versionRepository.save(this.versionRepository.create({
+      resourceType: 'config', resourceId: saved.id, version: saved.version,
+      snapshot: { value: saved.value, kind: saved.kind, description: saved.description }, changedBy: actor,
+    }));
+    this.invalidate(service, environment.name);
+    await this.audit.record({ action: entry.version === 1 ? 'create' : 'update', resourceType: 'config', resourceId: saved.id, actor, service, environment: environment.name, metadata: { key, version: saved.version } });
+    void this.webhooks.publish({ event: 'config.updated', service, environment: environment.name, key, version: saved.version, occurredAt: new Date().toISOString() });
+    return saved;
+  }
+
+  async remove(service: string, environmentName: string, key: string, actor: string): Promise<void> {
+    const environment = await this.environments.get(environmentName);
+    const entry = await this.repository.findOne({ where: { service, environment: { id: environment.id }, key } });
+    if (!entry) throw new NotFoundException(`Configuration ${key} not found`);
+    await this.repository.remove(entry);
+    this.invalidate(service, environment.name);
+    await this.audit.record({ action: 'delete', resourceType: 'config', resourceId: entry.id, actor, service, environment: environment.name, metadata: { key, version: entry.version } });
+    void this.webhooks.publish({ event: 'config.deleted', service, environment: environment.name, key, version: entry.version, occurredAt: new Date().toISOString() });
+  }
+
+  listVersions(resourceId: string): Promise<ConfigVersion[]> {
+    return this.versionRepository.find({ where: { resourceId }, order: { version: 'DESC' } });
+  }
+
+  async rollback(resourceId: string, version: number, actor: string): Promise<ConfigEntry> {
+    const entry = await this.repository.findOne({ where: { id: resourceId } });
+    if (!entry) throw new NotFoundException('Configuration not found');
+    const historical = await this.versionRepository.findOne({ where: { resourceId, version } });
+    if (!historical) throw new NotFoundException(`Version ${version} not found`);
+    const snapshot = historical.snapshot;
+    return this.upsert(entry.service, entry.environment.name, entry.key, {
+      value: snapshot.value,
+      kind: snapshot.kind as ConfigKind,
+      description: snapshot.description as string | undefined,
+    }, actor);
+  }
+
+  private invalidate(service: string, environment: string): void {
+    this.cache.deleteByPrefix(this.cacheKey(service, environment));
+  }
+
+  private cacheKey(service: string, environment: string): string {
+    return `config:${service}:${environment.toLowerCase()}`;
+  }
+}

microservices/config-service/src/services/configuration.service.ts

@@ -0,0 +1,19 @@
+import { ConfigService } from '@nestjs/config';
+import { EncryptionService } from './encryption.service';
+
+describe('EncryptionService', () => {
+  it('encrypts with authenticated encryption and decrypts the value', () => {
+    const config = new ConfigService({ ENCRYPTION_KEY: Buffer.alloc(32, 7).toString('base64'), ENCRYPTION_KEY_VERSION: '2' });
+    const service = new EncryptionService(config);
+    const encrypted = service.encrypt('very-secret');
+    expect(encrypted).not.toContain('very-secret');
+    expect(service.decrypt(encrypted, 2)).toBe('very-secret');
+  });
+
+  it('rejects tampered ciphertext', () => {
+    const config = new ConfigService({ ENCRYPTION_KEY: Buffer.alloc(32, 3).toString('base64') });
+    const service = new EncryptionService(config);
+    const encrypted = service.encrypt('secret');
+    expect(() => service.decrypt(`${encrypted.slice(0, -1)}x`, 1)).toThrow();
+  });
+});