secrets.ts

import { readFileSync } from "node:fs";

/** Env pairs: direct value or `*_FILE` path (Docker/K8s secret mounts). */
export const SECRET_ENV_PAIRS = [
  ["NVD_API_KEY", "NVD_API_KEY_FILE"],
  ["GITHUB_TOKEN", "GITHUB_TOKEN_FILE"],
  ["DEEPL_API_KEY", "DEEPL_API_KEY_FILE"],
  ["ALERT_WEBHOOK_URL", "ALERT_WEBHOOK_URL_FILE"],
  ["API_SECRET", "API_SECRET_FILE"],
] as const;

export type SecretEnvKey = (typeof SECRET_ENV_PAIRS)[number][0];

export function readSecret(envKey: string, fileKey: string): string | undefined {
  const filePath = process.env[fileKey]?.trim();
  if (filePath) {
    return readFileSync(filePath, "utf8").trim() || undefined;
  }
  const direct = process.env[envKey]?.trim();
  return direct || undefined;
}

/** Load secrets from mounted files into `process.env` before the app reads them. */
export function hydrateSecretsFromFiles(): void {
  for (const [envKey, fileKey] of SECRET_ENV_PAIRS) {
    const filePath = process.env[fileKey]?.trim();
    if (!filePath) continue;

    let value: string;
    try {
      value = readFileSync(filePath, "utf8").trim();
    } catch (err) {
      const message = err instanceof Error ? err.message : "read failed";
      throw new Error(`Cannot read ${fileKey} (${filePath}): ${message}`, { cause: err });
    }

    if (value) process.env[envKey] = value;
  }
}

export function hasSecret(envKey: SecretEnvKey): boolean {
  return Boolean(readSecret(envKey, `${envKey}_FILE`));
}