Secrets Manager Client

A lightweight TypeScript package for securely managing sensitive secrets with built-in protection against accidental exposure. The SecretsManagerClient class interacts with a secrets API, while the SecureSecret class handles individual secrets safely. Features

Secure Secret Handling:

Automatically clears secrets from memory after use to prevent leaks. Automatic Masking: Masks all console outputs to avoid exposing secrets. Type-Safe: Full TypeScript support for reliable development. API Integration: Securely retrieves secrets with support for async/sync operations. Robust Error Handling: Clear error messages for API failures and invalid inputs. Hashing Support: Compute SHA-256 hashes of secrets securely. Tenant-Based API Access: Constructs API URLs using tenant as a subdomain (e.g., https://tenant.wrapup.live/).

License

This project is licensed under the MIT License. See the LICENSE file for details. Installation Install the package via npm: npm install secrets-manager-client

Prerequisites

Axios: Required for HTTP requests. JavaScript Runtime: Must support crypto.subtle (e.g., Node.js or modern browsers).

Getting Started

Initialize the Client Create a SecretsManagerClient instance by providing the tenant and optionally the base domain and protocol (defaults to localhost:3000 and http): import { SecretsManagerClient } from 'secrets-manager-client';

const client = new SecretsManagerClient('my-tenant');

Retrieve and Use a Secret

Use the useSecret method to securely retrieve and process a secret. The tenant is passed during client initialization and included in the API request body: await client.useSecret('secret-id', 'secret-key', async (secureSecret) => { const secretValue = secureSecret.getValue(); console.log('Using secret:', secureSecret.getMaskedValue()); // Outputs: *************** // Perform operations with secretValue });

Execute Callbacks with Secrets

Run asynchronous or synchronous callbacks with secrets: // Asynchronous callback const result = await client.executeWithSecret('secret-id', 'secret-key', async (secret) => { return Processed: ${secret}; }); console.log(result); // Masked output: Processed: ***************

// Synchronous callback const syncResult = await client.executeWithSecretSync('secret-id', 'secret-key', (secret) => { return Processed: ${secret}; }); console.log(syncResult); // Masked output: Processed: ***************

Log Secret Structure

Safely log a secret's structure without exposing its value: await client.logSecretStructure('secret-id', 'secret-key'); // Output: Secret Structure (masked): ***************

Make API Calls with Secrets

Send a secret to an API endpoint securely: const secret = new SecureSecret('my-secret-value'); const response = await secret.useInApiCall('https://api-endpoint.com', { Authorization: 'Bearer token' }); console.log('API response:', response); // Masked output

Security Features

Automatic Secret Clearing: Secrets are wiped from memory after use. Console Output Masking: Prevents accidental secret exposure in logs. Secure API Communication: Uses tenant-based subdomains (e.g., https://tenant.wrapup.live/), includes X-Protect: no-debug header, and enforces a 5-second timeout. Type Checking: Ensures secrets are valid strings or objects with a value property.

Error Handling

The package provides clear error messages for:

Invalid inputs (e.g., missing id, secretKey, or tenant). API request failures (e.g., timeouts, invalid responses). Unavailable secrets (e.g., already consumed or cleared).

Example:

try { const client = new SecretsManagerClient('my-tenant'); await client.useSecret('', 'secret-key', async () => {}); } catch (error) { console.error(error.message); // Output: Invalid id or secretKey provided }