mirror of
https://github.com/hanzokms/node-sdk.git
synced 2026-10-30 20:30:26 +00:00
zeekayandHanzo Dev
a1e811c5c3
Every call in this SDK went to Infisical routes -- /api/v3/secrets/raw,
/api/v1/folders, /api/v2/workspace, /api/v1/dynamic-secrets, /api/v1/kms/keys.
kms.hanzo.ai runs luxfi/kms, which has NEVER served any of them.
The break stayed invisible because older server builds embedded a console SPA
under a root catch-all that answered every unmatched path with 200 text/html:
a wrong URL came back as a JSON decode error deep in the caller, not as a 404,
so it read like a parsing bug rather than a nonexistent endpoint. Server 1.12.8
removed the catch-all. Those paths now return honest JSON 404s -- verified live,
{"message":"not found","path":"/api/v3/secrets/raw"} -- so the SDK is visibly
broken, and this is the fix.
The canonical surface is the WHOLE secrets API; there is nothing else:
POST /v1/kms/auth/login {clientId, clientSecret}
GET /v1/kms/orgs/{org}/secrets?path=&env= -> {"names": [...]}
GET /v1/kms/orgs/{org}/secrets/{path}/{name}?env= -> {"secret":{"value"}}
POST /v1/kms/orgs/{org}/secrets {path, name, env, value}
DELETE /v1/kms/orgs/{org}/secrets/{path}/{name}?env=
So the SDK is now shaped like the server instead of like the fork it came from:
- One upsert. createSecret + updateSecret collapse into put(): the server has a
single POST for both, and aiming two methods at one route would misdescribe
what the store does.
- No versions. get() throws on a `version` option. Silently serving the current
value for a versioned read hands the caller a different secret than it asked
for.
- No folders / projects / environments / dynamic-secrets / tags / PITR. Those
routes map to nothing, so the clients, types and schemas are deleted rather
than left pointing at 404s. AWS-IAM login and token-renew go with them,
taking the entire AWS SigV4 dependency stack; zod went with the dynamic-secret
schemas. axios is the only runtime dependency left.
- `org` is a new required input -- constructor `org`, else KMS_ORG, else
"hanzo". Every secret route is org-scoped and the bearer's IAM owner claim
must resolve to it.
- /v1/kms/keys/* is deliberately NOT bound. It exists, but it is MPC validator
key-set management (generate/list/get/sign/rotate) -- a different contract
from the Infisical KMS-keys surface this SDK wrapped. kms() is gone rather
than guessed at.
Escaping: the server unescapes the trailing path and splits it at its LAST
slash into (path, name), so each segment is escaped individually and joined
with literal separators; encodeURIComponent over the joined string collapses
"a/b/C" into one opaque %2F-laden segment. For the same reason a name
containing "/" and an empty path are refused at the boundary -- POST would
accept both (they travel in the JSON body) and store a secret that GET and
DELETE could never address again.
Tests: a node:test contract suite (no new deps) drives the SDK over a real
socket against a stub that mirrors the Go handlers -- last-slash split,
env-required write, JSON 404s. Two guards keep the old paths from coming back:
no recorded request URL may contain "/api/", and no file in lib/ may either.
Proven by mutation: restoring /api/v3/secrets/raw fails 12 of 14 tests, and
escaping the joined path string fails 4.
4.0.6 -> 4.0.7.
Co-authored-by: Hanzo Dev <[email protected]>
46 lines
1.1 KiB
JSON
46 lines
1.1 KiB
JSON
{
|
|
"name": "@hanzo/kms-sdk",
|
|
"version": "4.0.7",
|
|
"main": "./lib/index.js",
|
|
"private": false,
|
|
"files": [
|
|
"lib"
|
|
],
|
|
"scripts": {
|
|
"build": "tsup src/index.ts --out-dir lib --dts --format cjs,esm --tsconfig tsconfig.json --no-splitting",
|
|
"test": "npm run build && node --test test/*.test.js"
|
|
},
|
|
"keywords": [
|
|
"hanzo",
|
|
"kms",
|
|
"secrets",
|
|
"sdk",
|
|
"typescript"
|
|
],
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/hanzoai/kms-node-sdk.git"
|
|
},
|
|
"author": "Hanzo AI Inc. <[email protected]>",
|
|
"license": "BSD-3-Clause",
|
|
"description": "The Hanzo KMS SDK provides a convenient way to programmatically interact with the Hanzo KMS API.",
|
|
"devDependencies": {
|
|
"@types/node": "^22.5.1",
|
|
"tsc": "^2.0.4",
|
|
"tsup": "^8.2.4",
|
|
"typescript": "^5.5.4"
|
|
},
|
|
"dependencies": {
|
|
"axios": "^1.11.0"
|
|
},
|
|
"directories": {
|
|
"lib": "lib",
|
|
"test": "test"
|
|
},
|
|
"types": "./lib/index.d.ts",
|
|
"bugs": {
|
|
"url": "https://github.com/hanzoai/kms-node-sdk/issues"
|
|
},
|
|
"homepage": "https://github.com/hanzoai/kms-node-sdk#readme"
|
|
}
|