A list of adapters to load secrets from. Order here matters: all values loaded from the last adapters will override the previous values. Meaning, the first adapter can be used as a "default" value source while all subsequent adapters will override its values.
Protected ReadonlyadaptersA list of adapters to load secrets from. Order here matters: all values loaded from the last adapters will override the previous values. Meaning, the first adapter can be used as a "default" value source while all subsequent adapters will override its values.
ProtectedconsecutiveProtectedcurrentReadonlyisProtectedloadingKeeps track of the last triggered UpdatingSecrets.loadSecrets call to prevent multiple calls of it from overlapping: only one can be running at a time.
ProtectednextProtected ReadonlyoptionsProtected ReadonlyprocessedGet the latest secret values.
Compare a value underComparison to a secret's currently known secret value that was defined
with rotatableSecretShape.
The uncontrolled string to compare to your secrets.
This could be, for example, an API key used by someone else trying to authenticate with your service.
The current value of the secret as obtained by UpdatingSecrets.get.
The latest up-to-date version of the secret's value.
Optionallegacy?: stringThe optional legacy value for the secret. Use for graceful secret rotation.
import {
createUpdatingSecrets,
rotatableSecretShape,
defineSecrets,
StaticSecretsAdapter,
} from 'updating-secrets';
const updatingSecrets = await createUpdatingSecrets(
defineSecrets({
apiKey: {
description: '',
whereToFind: '',
shape: rotatableSecretShape,
},
}),
[
new StaticSecretsAdapter({
apiKey: {
current: 'latest key',
legacy: 'old key',
},
}),
],
);
export async function handleApiRequest(request: Request) {
const apiKey = request.headers.get('apiKey');
if (!apiKey) {
throw new Error('API request missing the required API key.');
} else if (
!updatingSecrets.compareRotatableSecret(apiKey, updatingSecrets.get.apiKey)
) {
throw new Error('Invalid API key.');
}
}
Stop the auto updating and destroy all adapters.
Loads all secrets and populates or updates UpdatingSecrets.get. This must be called and awaited at least once before UpdatingSecrets.get can work, otherwise UpdatingSecrets.get will error out. Consider using createUpdatingSecrets, instead of constructing UpdatingSecrets directly, which automatically handles calling this for the first time.
Only one secret update can be active at a time, so calling this multiple times in quick succession will simply return the same promise of the latest-running update.
ProtectedrunRuns the automatic secret updating timeout.
This class:
Make sure to call and await UpdatingSecrets.loadSecrets at least once before using UpdatingSecrets.get for the first time. Alternatively, consider using createUpdatingSecrets which handles that async setup automatically.