feat: adds support for reading from APP_CONFIG_SECRETS_KEY_FILE and APP_CONFIG_SECRETS_PUBLIC_KEY_FILE

Author: joelgallant

app-config-encryption/src/encryption.ts

@@ -140,9 +140,17 @@ export async function loadKey(contents: string | Buffer): Promise<Key> {
   return keys[0];
 }
 
-export async function loadPrivateKey(
-  override: string | Buffer | undefined = process.env.APP_CONFIG_SECRETS_KEY,
-): Promise<Key> {
+export async function loadPrivateKey(override?: string | Buffer): Promise<Key> {
+  if (override === undefined) {
+    if (process.env.APP_CONFIG_SECRETS_KEY) {
+      // eslint-disable-next-line no-param-reassign
+      override = process.env.APP_CONFIG_SECRETS_KEY;
+    } else if (process.env.APP_CONFIG_SECRETS_KEY_FILE) {
+      // eslint-disable-next-line no-param-reassign
+      override = (await fs.readFile(process.env.APP_CONFIG_SECRETS_KEY_FILE)).toString();
+    }
+  }
+
   let key: Key;
 
   if (override) {
@@ -176,9 +184,17 @@ export async function loadPrivateKey(
   return key;
 }
 
-export async function loadPublicKey(
-  override: string | Buffer | undefined = process.env.APP_CONFIG_SECRETS_PUBLIC_KEY,
-): Promise<Key> {
+export async function loadPublicKey(override?: string | Buffer): Promise<Key> {
+  if (override === undefined) {
+    if (process.env.APP_CONFIG_SECRETS_PUBLIC_KEY) {
+      // eslint-disable-next-line no-param-reassign
+      override = process.env.APP_CONFIG_SECRETS_PUBLIC_KEY;
+    } else if (process.env.APP_CONFIG_SECRETS_PUBLIC_KEY_FILE) {
+      // eslint-disable-next-line no-param-reassign
+      override = (await fs.readFile(process.env.APP_CONFIG_SECRETS_PUBLIC_KEY_FILE)).toString();
+    }
+  }
+
   let key: Key;
 
   if (override) {

docs/guide/intro/encryption.md

@@ -105,6 +105,11 @@ This key (public + private) can be added as protected environment variables in y
 - `APP_CONFIG_SECRETS_KEY`
 - `APP_CONFIG_SECRETS_PUBLIC_KEY`
 
+Or, in files referenced by:
+
+- `APP_CONFIG_SECRETS_KEY_FILE`
+- `APP_CONFIG_SECRETS_PUBLIC_KEY_FILE`
+
 The CLI will output both of these with instructions.
 
 ## Implementation Details