Mailer-16: feat: add secrets invoke from aws secrets

package.json

@@ -40,6 +40,7 @@
     "registry": "https://npm.pkg.github.com"
   },
   "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.583.0",
     "axios": "^1.7.2",
     "ejs": "^3.1.10"
   }

src/config/aws.config.ts

@@ -0,0 +1,8 @@
+import type { AwsRegion } from '../strategies/secretStrategies/secrets';
+
+const awsConfig = {
+  region: process.env.AWS_REGION as AwsRegion,
+  secretManagerName: process.env.SECRET_MANAGER_NAME as string
+};
+
+export default awsConfig;

src/config/mail.config.ts

@@ -1,8 +1,30 @@
-export default {
-  from: process.env.MAIL_FROM_ADDRESS,
-  name: process.env.MAIL_FROM_NAME,
-  mailServer: {
-    host: process.env.MAIL_SERVER_HOST || '',
-    password: process.env.MAIL_PASSWORD || ''
+import getSecret from '../strategies/secretStrategies/secretStrategy';
+import storageProvider, {
+  MAIL_CONFIG_KEYS
+} from '../providers/awsConfigStorage.provider';
+
+const getMailConfig = async () => {
+  if (!storageProvider.size) {
+    const [from, name, host, password] = await Promise.all(
+      Object.keys(MAIL_CONFIG_KEYS).map(getSecret)
+    );
+
+    storageProvider.set(MAIL_CONFIG_KEYS.MAIL_FROM_ADDRESS, from);
+    storageProvider.set(MAIL_CONFIG_KEYS.MAIL_FROM_NAME, name);
+    storageProvider.set(MAIL_CONFIG_KEYS.MAIL_SERVER_HOST, host);
+    storageProvider.set(MAIL_CONFIG_KEYS.MAIL_PASSWORD, password);
   }
+
+  const mailConfig = {
+    from: storageProvider.get(MAIL_CONFIG_KEYS.MAIL_FROM_ADDRESS),
+    name: storageProvider.get(MAIL_CONFIG_KEYS.MAIL_FROM_NAME),
+    mailServer: {
+      host: storageProvider.get(MAIL_CONFIG_KEYS.MAIL_SERVER_HOST),
+      password: storageProvider.get(MAIL_CONFIG_KEYS.MAIL_PASSWORD)
+    }
+  };
+
+  return mailConfig;
 };
+
+export default getMailConfig;

src/providers/awsConfigStorage.provider.ts

@@ -0,0 +1,10 @@
+export const MAIL_CONFIG_KEYS = {
+  MAIL_FROM_ADDRESS: 'MAIL_FROM_ADDRESS' as const,
+  MAIL_FROM_NAME: 'MAIL_FROM_NAME' as const,
+  MAIL_SERVER_HOST: 'MAIL_SERVER_HOST' as const,
+  MAIL_PASSWORD: 'MAIL_PASSWORD' as const
+};
+
+type MAIL_CONFIG_KEYS = keyof typeof MAIL_CONFIG_KEYS;
+
+export default new Map<MAIL_CONFIG_KEYS, string>();

src/services/mail.ts

@@ -3,7 +3,7 @@ import { render } from 'ejs';
 
 import en from '../lang/en';
 
-import mailConfig from '../config/mail.config';
+import getMailConfig from '../config/mail.config';
 
 import { sendMail } from './mailServer';
 
@@ -82,7 +82,7 @@ class Mail {
     return this;
   }
 
-  send() {
+  async send() {
     if (!this.mailNode.to.length) {
       throw new Error(en.error.mail.to);
     }
@@ -91,6 +91,8 @@ class Mail {
       throw new Error(en.error.mail.subject);
     }
 
+    const mailConfig = await getMailConfig();
+
     if (!this.mailNode.fromAddress) {
       this.from(mailConfig.from, mailConfig.name);
     }

src/services/mailServer.ts

@@ -1,6 +1,6 @@
 import axios from 'axios';
 
-import mailConfig from '../config/mail.config';
+import getMailConfig from '../config/mail.config';
 
 import type { IMailNode } from './mail';
 
@@ -20,6 +20,8 @@ export const createPayload = (payload: IMailNode) => {
 };
 
 export const sendMail = async (payload: IMailNode) => {
+  const mailConfig = await getMailConfig();
+
   return await http.post(mailConfig.mailServer.host, createPayload(payload), {
     headers: {
       'x-api-key': mailConfig.mailServer.password

src/strategies/secretStrategies/awsSecretStrategy.ts

@@ -0,0 +1,34 @@
+import { SecretsManager } from '@aws-sdk/client-secrets-manager';
+
+import awsConfig from '../../config/aws.config';
+import { IMailerSecretKey, IMailerSecretKeys } from './secrets';
+
+/**
+ * Fetches secrets from AWS Secret Manager.
+ */
+async function fetchSecrets(): Promise<Record<IMailerSecretKey, string>> {
+  const client = new SecretsManager({
+    region: awsConfig.region
+  });
+
+  const data = await client.getSecretValue({
+    SecretId: awsConfig.secretManagerName
+  });
+
+  try {
+    return JSON.parse(data.SecretString || '');
+  } catch {
+    throw new Error('Invalid secret string');
+  }
+}
+
+/**
+ * Get the secret value from the AWS Secret Manager.
+ */
+async function getSecrets(key: IMailerSecretKey) {
+  const awsSecretValues = await fetchSecrets();
+
+  return awsSecretValues[key] || '';
+}
+
+export { getSecrets };

src/strategies/secretStrategies/envSecretStrategy.ts

@@ -0,0 +1,7 @@
+import type { IMailerSecretKey, IMailerSecretKeys } from './secrets';
+
+function getSecrets(key: IMailerSecretKey): IMailerSecretKeys[typeof key] {
+  return process.env[key] || '';
+}
+
+export { getSecrets };

src/strategies/secretStrategies/secretStrategy.ts

@@ -0,0 +1,21 @@
+import * as AwsSecret from './awsSecretStrategy';
+import * as EnvSecret from './envSecretStrategy';
+import type { IMailerSecretKey, IMailerSecretKeys } from './secrets';
+
+async function getSecret(
+  key: IMailerSecretKey
+): Promise<IMailerSecretKeys[IMailerSecretKey]> {
+  const awsSecret = AwsSecret.getSecrets(key);
+
+  if (awsSecret) {
+    return awsSecret;
+  }
+
+  const envSecret = EnvSecret.getSecrets(key);
+
+  if (envSecret) {
+    return envSecret;
+  }
+}
+
+export default getSecret;

src/strategies/secretStrategies/secrets.ts

@@ -0,0 +1,38 @@
+export type AwsRegion =
+  | 'us-east-2' // US East (Ohio)
+  | 'us-east-1' // US East (N. Virginia)
+  | 'us-west-1' // US West (N. California)
+  | 'us-west-2' // US West (Oregon)
+  | 'af-south-1' // Africa (Cape Town)
+  | 'ap-east-1' // Asia Pacific (Hong Kong)
+  | 'ap-south-1' // Asia Pacific (Mumbai)
+  | 'ap-northeast-3' // Asia Pacific (Osaka)
+  | 'ap-northeast-2' // Asia Pacific (Seoul)
+  | 'ap-southeast-1' // Asia Pacific (Singapore)
+  | 'ap-southeast-2' // Asia Pacific (Sydney)
+  | 'ap-northeast-1' // Asia Pacific (Tokyo)
+  | 'ca-central-1' // Canada (Central)
+  | 'eu-central-1' // Europe (Frankfurt)
+  | 'eu-west-1' // Europe (Ireland)
+  | 'eu-west-2' // Europe (London)
+  | 'eu-south-1' // Europe (Milan)
+  | 'eu-west-3' // Europe (Paris)
+  | 'eu-north-1' // Europe (Stockholm)
+  | 'me-south-1' // Middle East (Bahrain)
+  | 'sa-east-1' // South America (Sao Paulo)
+  | 'us-gov-east-1' // AWS GovCloud (US-East)
+  | 'us-gov-west-1'; // AWS GovCloud (US-West)
+
+export interface IMailerSecretKeys {
+  MAIL_FROM_ADDRESS: string;
+  MAIL_FROM_NAME: string;
+  MAIL_SERVER_HOST: string;
+  MAIL_PASSWORD: string;
+}
+
+export interface IAwsCredentials {
+  AWS_REGION: AwsRegion;
+  SECRET_MANAGER_NAME: string;
+}
+
+export type IMailerSecretKey = keyof IMailerSecretKeys;