Merge pull request #293 from JTKaduma/feat/secret-management

feat: add dev env and more

Author: jhayniffy

backend/.env.example

@@ -71,9 +71,14 @@ GraphQL is exposed at `/api/graphql`.
 ```bash
 cd backend
 npm i
+npm run env:example:generate
 npm run start:dev
 ```
 
+Environment configuration is defined in [`src/config/env.definitions.ts`](/home/json/Desktop/Drips/niff-Stellar-shurance/backend/src/config/env.definitions.ts). Update that file first, then regenerate [`backend/.env.example`](/home/json/Desktop/Drips/niff-Stellar-shurance/backend/.env.example) with `npm run env:example:generate`.
+
+Secrets guidance and rotation procedures live in [`docs/ops/secrets-management-runbook.md`](/home/json/Desktop/Drips/niff-Stellar-shurance/docs/ops/secrets-management-runbook.md). Generate a fresh JWT signing key with `npm run secrets:generate:jwt`.
+
 ## Deployment
 Docker: `make docker-up`
 

backend/README.md

@@ -31,7 +31,10 @@
     "seed": "ts-node src/database/seed.ts",
     "db:reset": "docker-compose down -v && docker-compose up -d",
     "error-catalog:check": "ts-node scripts/check-error-codes.ts",
-    "error-catalog:export": "ts-node scripts/export-error-catalog.ts"
+    "error-catalog:export": "ts-node scripts/export-error-catalog.ts",
+    "env:example:generate": "ts-node scripts/generate-env-example.ts",
+    "env:example:check": "ts-node scripts/check-env-example.ts",
+    "secrets:generate:jwt": "ts-node scripts/generate-jwt-key.ts"
   },
   "dependencies": {
     "@apollo/server": "^4.13.0",

backend/package.json

@@ -0,0 +1,14 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import { renderEnvExample } from '../src/config/env.definitions';
+
+const envExamplePath = join(__dirname, '..', '.env.example');
+const expected = renderEnvExample();
+const actual = readFileSync(envExamplePath, 'utf8');
+
+if (actual !== expected) {
+  console.error('.env.example is out of date. Run `npm run env:example:generate` in backend/.');
+  process.exit(1);
+}
+
+console.log('.env.example is up to date.');

backend/scripts/check-env-example.ts

@@ -0,0 +1,7 @@
+import { writeFileSync } from 'fs';
+import { join } from 'path';
+import { renderEnvExample } from '../src/config/env.definitions';
+
+const outputPath = join(__dirname, '..', '.env.example');
+writeFileSync(outputPath, renderEnvExample(), 'utf8');
+console.log(`Wrote ${outputPath}`);

backend/scripts/generate-env-example.ts

@@ -0,0 +1,28 @@
+import { randomBytes } from 'crypto';
+import { chmodSync, writeFileSync } from 'fs';
+import { resolve } from 'path';
+
+const args = process.argv.slice(2);
+const outputFlagIndex = args.indexOf('--output');
+const outputPath =
+  outputFlagIndex >= 0 && args[outputFlagIndex + 1]
+    ? resolve(args[outputFlagIndex + 1])
+    : null;
+
+const key = randomBytes(64).toString('base64url');
+const timestamp = new Date().toISOString();
+const payload = [
+  '# Generated JWT signing key',
+  `# Generated at: ${timestamp}`,
+  '# Store this value in your secrets manager, not in git.',
+  `JWT_SECRET=${key}`,
+  '',
+].join('\n');
+
+if (outputPath) {
+  writeFileSync(outputPath, payload, { encoding: 'utf8', mode: 0o600 });
+  chmodSync(outputPath, 0o600);
+  console.log(`Wrote JWT key material to ${outputPath} with mode 600`);
+} else {
+  process.stdout.write(payload);
+}

backend/scripts/generate-jwt-key.ts

@@ -1,4 +1,9 @@
-import { redactHeaders, redactBody } from '../../common/logger/app-logger.service';
+import {
+  redactHeaders,
+  redactBody,
+  redactMessageText,
+  redactValue,
+} from '../../common/logger/app-logger.service';
 
 describe('redactHeaders', () => {
   it('redacts Authorization header', () => {
@@ -53,3 +58,34 @@ describe('redactBody', () => {
     expect(redactBody(undefined)).toBeUndefined();
   });
 });
+
+describe('redactValue', () => {
+  it('redacts nested secret-like fields', () => {
+    const redacted = redactValue({
+      jwtSecret: 'super-secret-value',
+      nested: {
+        apiKey: 'another-secret',
+      },
+    });
+
+    expect(redacted).toEqual({
+      jwtSecret: '[REDACTED]',
+      nested: {
+        apiKey: '[REDACTED]',
+      },
+    });
+  });
+});
+
+describe('redactMessageText', () => {
+  it('redacts secret assignments and bearer tokens inside log messages', () => {
+    const redacted = redactMessageText(
+      'JWT_SECRET=my-secret-value authorization=Bearer abc.def.ghi',
+    );
+
+    expect(redacted).not.toContain('my-secret-value');
+    expect(redacted).not.toContain('abc.def.ghi');
+    expect(redacted).toContain('JWT_SECRET=[REDACTED]');
+    expect(redacted).toContain('Bearer [REDACTED]');
+  });
+});

backend/src/__tests__/observability/redaction.spec.ts

@@ -1,9 +1,10 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { NotFoundException } from '@nestjs/common';
-import { RampController } from '../../ramp/ramp.controller';
-import { FeatureFlagsService } from '../../feature-flags/feature-flags.service';
+import { RampController } from '../ramp/ramp.controller';
+import { FeatureFlagsService } from '../feature-flags/feature-flags.service';
 import { Reflector } from '@nestjs/core';
-import { FeatureFlagsGuard } from '../../feature-flags/feature-flags.guard';
+import { FeatureFlagsGuard } from '../feature-flags/feature-flags.guard';
+import { ConfigService } from '@nestjs/config';
 
 describe('RampController', () => {
   let controller: RampController;
@@ -19,6 +20,21 @@ describe('RampController', () => {
       controllers: [RampController],
       providers: [
         { provide: FeatureFlagsService, useValue: mockFlags(flagEnabled) },
+        {
+          provide: ConfigService,
+          useValue: {
+            get: jest.fn((key: string, fallback?: string) => {
+              const values: Record<string, string> = {
+                RAMP_URL: process.env.RAMP_URL ?? '',
+                RAMP_ALLOWED_REGIONS: process.env.RAMP_ALLOWED_REGIONS ?? '',
+                RAMP_UTM_SOURCE: 'niffyinsure',
+                RAMP_UTM_MEDIUM: 'app',
+                RAMP_UTM_CAMPAIGN: 'onramp',
+              };
+              return values[key] ?? fallback;
+            }),
+          },
+        },
         Reflector,
         FeatureFlagsGuard,
       ],

backend/src/__tests__/ramp.test.ts

@@ -3,7 +3,7 @@ import { ConfigModule } from '@nestjs/config';
 import { TerminusModule } from '@nestjs/terminus';
 import { ThrottlerModule, ThrottlerStorage } from '@nestjs/throttler';
 import { APP_GUARD } from '@nestjs/core';
-import { validationSchema } from './config/env.validation';
+import { validateEnvironment } from './config/env.validation';
 import { HealthModule } from './health/health.module';
 import { PrismaModule } from './prisma/prisma.module';
 import { CacheModule } from './cache/cache.module';
@@ -35,9 +35,9 @@ import { IdempotencyMiddleware } from './common/middleware/idempotency.middlewar
     ConfigModule.forRoot({
       isGlobal: true,
       envFilePath: '.env',
-      validationSchema,
+      validate: validateEnvironment,
       validationOptions: {
-        abortEarly: true,
+        abortEarly: false,
       },
     }),
     ThrottlerModule.forRootAsync({

backend/src/app.module.ts

@@ -15,7 +15,7 @@ import { AuthIdentityService } from './auth-identity.service';
       imports: [ConfigModule],
       useFactory: (configService: ConfigService) => ({
         secret: configService.get<string>('JWT_SECRET'),
-        signOptions: { expiresIn: '7d' },
+        signOptions: { expiresIn: configService.get<string>('JWT_EXPIRES_IN', '7d') },
       }),
       inject: [ConfigService],
     }),