import { SecretManagerServiceClient } from "@google-cloud/secret-manager" ; import config from "../../config" ; const SECRET_KEY = `projects/${ config . projectId }/secrets/${ config . encryption . keyPath }` ; const SECRET_KEY_DEFAULT_VERSION = `${ SECRET_KEY }/versions/${ config . encryption . defaultVersion }` ; const getEncryptionKey = async ( ) : Promise < Buffer > => getEncryptionSecret ( SECRET_KEY_DEFAULT_VERSION ) ; export const getAllEncryptionKeys = async ( ) : Promise < Buffer [ ] > => { const secretManagerClient = new SecretManagerServiceClient ( ) ; const [ versions ] = await secretManagerClient . listSecretVersions ( { parent : SECRET_KEY , } ) ; const enabledVersions = versions . filter ( _ => _ . state === "ENABLED" ) ; enabledVersions . sort ( ( a , b ) => isDefaultKey ( `${ a . name }` ) ? - 1 : isDefaultKey ( `${ b . name }` ) ? 1 : 0 ) ; return Promise . all ( enabledVersions . map ( async ( _ ) => getEncryptionSecret ( `${ _ . name }` ) ) ) ; } ; const isDefaultKey = ( _ ) => SECRET_KEY_DEFAULT_VERSION . substring ( SECRET_KEY_DEFAULT_VERSION . length - 2 ) === _ . substring ( _ . length - 2 ) ; async function getEncryptionSecret ( keyPathIncludingVersion ) { const secretManagerClient = new SecretManagerServiceClient ( ) ; console . log ( "getEncryptionSecret:" , `Getting encryption key: ${ keyPathIncludingVersion }` ) ; const [ secret ] = await secretManagerClient . accessSecretVersion ( { name : keyPathIncludingVersion , } ) ; return Buffer . from ( secret . payload . data . toString ( ) , 'base64' ) ; } export default getEncryptionKey ;