Merge pull request #29 from vapor-community/secret-manager

Added support for SecretManager API.

Author: Andrewangeta

Package.swift

@@ -17,6 +17,9 @@ let package = Package(
         .library(
             name: "CloudDatastore",
             targets: ["CloudDatastore"]),
+        .library(
+            name: "CloudSecretManager",
+            targets: ["CloudSecretManager"]),
     ],
     dependencies: [
         .package(url: "https://github.com/vapor/vapor.git", from: "4.0.0"),
@@ -44,5 +47,12 @@ let package = Package(
                 .product(name: "GoogleCloudDatastore", package: "google-cloud-kit"),
                 .target(name: "GoogleCloud")
         ]),
+        .target(
+            name: "CloudSecretManager",
+            dependencies: [
+                .product(name: "Vapor", package: "vapor"),
+                .product(name: "GoogleCloudSecretManager", package: "google-cloud-kit"),
+                .target(name: "GoogleCloud")
+        ]),
     ]
 )

Sources/CloudSecretManager/GoogleCloudSecretManagerAPI.swift

@@ -0,0 +1,114 @@
+//
+//  GoogleCloudSecretManagerAPI.swift
+//  
+//
+//  Created by Andrew Edwards on 4/29/21.
+//
+
+import Vapor
+@_exported import SecretManager
+@_exported import GoogleCloud
+
+extension Application.GoogleCloudPlatform {
+    
+    private struct CloudSecretManagerAPIKey: StorageKey {
+        typealias Value = GoogleCloudSecretManagerAPI
+    }
+    
+    private struct CloudSecretManagerConfigurationKey: StorageKey {
+        typealias Value = GoogleCloudSecretManagerConfiguration
+    }
+    
+    private struct CloudSecretManagerHTTPClientKey: StorageKey, LockKey {
+        typealias Value = HTTPClient
+    }
+    
+    public var secretManager: GoogleCloudSecretManagerAPI {
+        get {
+            if let existing = self.application.storage[CloudSecretManagerAPIKey.self] {
+                return existing
+            } else {
+                return .init(application: self.application, eventLoop: self.application.eventLoopGroup.next())
+            }
+        }
+        
+        nonmutating set {
+            self.application.storage[CloudSecretManagerAPIKey.self] = newValue
+        }
+    }
+    
+    public struct GoogleCloudSecretManagerAPI {
+        public let application: Application
+        public let eventLoop: EventLoop
+        
+        /// A client used to interact with the `GoogleCloudSecretManager` API.
+        public var client: GoogleCloudSecretManagerClient {
+            do {
+                let new = try GoogleCloudSecretManagerClient(credentials: self.application.googleCloud.credentials,
+                                                       config: self.configuration,
+                                                       httpClient: self.http,
+                                                       eventLoop: self.eventLoop)
+                return new
+            } catch {
+                fatalError("\(error.localizedDescription)")
+            }
+        }
+        
+        /// The configuration for using `GoogleCloudSecretManager` APIs.
+        public var configuration: GoogleCloudSecretManagerConfiguration {
+            get {
+                if let configuration = application.storage[CloudSecretManagerConfigurationKey.self] {
+                   return configuration
+                } else {
+                    fatalError("Cloud SecretManager configuration has not been set. Use app.googleCloud.secretManager.configuration = ...")
+                }
+            }
+            set {
+                if application.storage[CloudSecretManagerConfigurationKey.self] == nil {
+                    application.storage[CloudSecretManagerConfigurationKey.self] = newValue
+                } else {
+                    fatalError("Attempting to override credentials configuration after being set is not allowed.")
+                }
+            }
+        }
+        
+        /// Custom `HTTPClient` that ignores unclean SSL shutdown.
+        public var http: HTTPClient {
+            if let existing = application.storage[CloudSecretManagerHTTPClientKey.self] {
+                return existing
+            } else {
+                let lock = application.locks.lock(for: CloudSecretManagerHTTPClientKey.self)
+                lock.lock()
+                defer { lock.unlock() }
+                if let existing = application.storage[CloudSecretManagerHTTPClientKey.self] {
+                    return existing
+                }
+                let new = HTTPClient(
+                    eventLoopGroupProvider: .shared(application.eventLoopGroup),
+                    configuration: HTTPClient.Configuration(ignoreUncleanSSLShutdown: true)
+                )
+                application.storage.set(CloudSecretManagerHTTPClientKey.self, to: new) {
+                    try $0.syncShutdown()
+                }
+                return new
+            }
+        }
+    }
+}
+
+extension Request {
+    private struct GoogleCloudSecretManagerKey: StorageKey {
+        typealias Value = GoogleCloudSecretManagerClient
+    }
+    
+    /// A client used to interact with the `GoogleCloudSecretManager` API
+    public var gcSecretManager: GoogleCloudSecretManagerClient {
+        if let existing = application.storage[GoogleCloudSecretManagerKey.self] {
+            return existing.hopped(to: self.eventLoop)
+        } else {
+            let new = Application.GoogleCloudPlatform.GoogleCloudSecretManagerAPI(application: self.application, eventLoop: self.eventLoop).client
+            application.storage[GoogleCloudSecretManagerKey.self] = new
+            return new
+        }
+    }
+}

Sources/CloudSecretManager/README.md

@@ -0,0 +1,46 @@
+# GoogleCloudSecretManagerAPI
+
+## Getting Started
+If you only need to use the [Google Cloud Secret Manager API](https://cloud.google.com/storage/), then this guide will help you get started.
+
+In your `Package.swift` file, make sure you have the following dependencies and targets
+
+```swift
+dependencies: [
+        //...
+        .package(url: "https://github.com/vapor-community/google-cloud.git", from: "1.0.0"),
+    ],
+    targets: [
+        .target(name: "MyAppName", dependencies: [
+            //...
+            .product(name: "CloudSecretManager", package: "google-cloud"),
+        ]),
+    ]
+```
+
+Now you can setup the configuration for any GCP API globally via `Application`.
+
+In `configure.swift`
+
+```swift
+ import CloudSecretManager
+ 
+ app.googleCloud.credentials = try GoogleCloudCredentialsConfiguration(projectId: "myprojectid-12345",
+ credentialsFile: "~/path/to/service-account.json")
+```
+Next we setup the CloudSecretManager API configuration (specific to this API).
+
+```swift
+app.googleCloud.secretManager.configuration = .default()
+```
+
+Now we can start using the GoogleCloudSecretManager API
+There's a handy extension on `Request` that you can use to get access to a secret manager client  via a property named `gcSecretManager`. 
+
+```swift
+
+func getCICDSecrets(_ req: Request) throws -> EventLoopFuture<String> {    
+    req.gcSecretManager.secrets.access("my-secret-name", version: "latest")
+    .map { $0.payload.decodedData! // returns the base64-decoded value of secret }
+}
+```