[DB-19] feat: secretsManager

src/lib/secretsManager/encryptedStorage/AbstractSecretsManagerStorage.ts

@@ -0,0 +1,11 @@
+import { SecretProviderConfig } from "../types";
+
+export abstract class AbstractSecretsManagerStorage {
+  abstract set(_key: string, _data: SecretProviderConfig): Promise<void>;
+
+  abstract get(_key: string): Promise<SecretProviderConfig | null>;
+
+  abstract getAll(): Promise<SecretProviderConfig[]>;
+
+  abstract delete(_key: string): Promise<void>;
+}

src/lib/secretsManager/encryptedStorage/SecretsManagerEncryptedStorage.ts

@@ -0,0 +1,29 @@
+import { AbstractSecretsManagerStorage } from "./AbstractSecretsManagerStorage";
+import { EncryptedElectronStore } from "../../storage/EncryptedElectronStore";
+import { SecretProviderConfig } from "../types";
+
+export class SecretsManagerEncryptedStorage extends AbstractSecretsManagerStorage {
+  private encryptedStore: EncryptedElectronStore;
+
+  constructor(storeName: string) {
+    super();
+    this.encryptedStore = new EncryptedElectronStore(storeName);
+  }
+
+  async set(key: string, data: SecretProviderConfig): Promise<void> {
+    return this.encryptedStore.set<SecretProviderConfig>(key, data);
+  }
+
+  async get(key: string): Promise<SecretProviderConfig | null> {
+    return this.encryptedStore.get<SecretProviderConfig>(key);
+  }
+
+  async getAll(): Promise<SecretProviderConfig[]> {
+    const allData = this.encryptedStore.getAll<SecretProviderConfig>();
+    return Object.values(allData);
+  }
+
+  async delete(key: string): Promise<void> {
+    return this.encryptedStore.delete(key);
+  }
+}

src/lib/secretsManager/providerRegistry/AbstractProviderRegistry.ts

@@ -0,0 +1,25 @@
+import { SecretProviderConfig } from "../types";
+import { AbstractSecretsManagerStorage } from "../encryptedStorage/AbstractSecretsManagerStorage";
+import { AbstractSecretProvider } from "../providerService/AbstractSecretProvider";
+
+export abstract class AbstractProviderRegistry {
+  protected store: AbstractSecretsManagerStorage;
+
+  protected providers: Map<string, AbstractSecretProvider> = new Map();
+
+  constructor(store: AbstractSecretsManagerStorage) {
+    this.store = store;
+  }
+
+  abstract initialize(): Promise<void>;
+
+  abstract getAllProviderConfigs(): Promise<SecretProviderConfig[]>;
+
+  abstract getProviderConfig(_id: string): Promise<SecretProviderConfig | null>;
+
+  abstract setProviderConfig(_config: SecretProviderConfig): Promise<void>;
+
+  abstract deleteProviderConfig(_id: string): Promise<void>;
+
+  abstract getProvider(_providerId: string): AbstractSecretProvider | null;
+}

src/lib/secretsManager/providerRegistry/FileBasedProviderRegistry.ts

@@ -0,0 +1,45 @@
+import { SecretProviderConfig } from "../types";
+import { createProviderInstance } from "../providerService/providerFactory";
+import { AbstractSecretProvider } from "../providerService/AbstractSecretProvider";
+import { AbstractProviderRegistry } from "./AbstractProviderRegistry";
+
+export class FileBasedProviderRegistry extends AbstractProviderRegistry {
+  async initialize(): Promise<void> {
+    await this.initProvidersFromStorage();
+  }
+
+  private async initProvidersFromStorage(): Promise<void> {
+    const configs = await this.getAllProviderConfigs();
+    configs.forEach((config) => {
+      this.providers.set(config.id, createProviderInstance(config));
+    });
+  }
+
+  async getAllProviderConfigs(): Promise<SecretProviderConfig[]> {
+    const allConfigs = this.store.getAll();
+    return allConfigs;
+  }
+
+  async getProviderConfig(id: string): Promise<SecretProviderConfig | null> {
+    try {
+      return await this.store.get(id);
+    } catch (error) {
+      console.error(`Failed to load provider config for id: ${id}`, error);
+      return null;
+    }
+  }
+
+  async setProviderConfig(config: SecretProviderConfig): Promise<void> {
+    await this.store.set(config.id, config);
+    this.providers.set(config.id, createProviderInstance(config));
+  }
+
+  async deleteProviderConfig(id: string): Promise<void> {
+    await this.store.delete(id);
+    this.providers.delete(id);
+  }
+
+  getProvider(providerId: string): AbstractSecretProvider | null {
+    return this.providers.get(providerId) ?? null;
+  }
+}

src/lib/secretsManager/providerService/AbstractSecretProvider.ts

@@ -0,0 +1,27 @@
+import { CachedSecret, ProviderSpecificConfig, SecretProviderType, SecretReference } from "../types";
+
+export abstract class AbstractSecretProvider {
+  protected cache: Map<string, CachedSecret> = new Map();
+
+  abstract readonly type: SecretProviderType;
+
+  abstract readonly id: string;
+
+  protected config: ProviderSpecificConfig;
+
+  protected abstract getSecretIdentfier(ref: SecretReference): string;
+
+  abstract testConnection(): Promise<boolean>;
+
+  abstract getSecret(ref: SecretReference): Promise<string>;
+
+  abstract getSecrets(): Promise<string[]>;
+
+  abstract setSecret(): Promise<void>;
+
+  abstract setSecrets(): Promise<void>;
+
+  static validateConfig(config: any): boolean {
+    throw new Error("Not implemented");
+  }
+}

src/lib/secretsManager/providerService/awsSecretManagerProvider.ts

@@ -0,0 +1,4 @@
+/* eslint-disable class-methods-use-this */
+import { AbstractSecretProvider } from "./AbstractSecretProvider";
+
+export class AWSSecretsManagerProvider extends AbstractSecretProvider {}

src/lib/secretsManager/providerService/providerFactory.ts

@@ -0,0 +1,14 @@
+import { SecretProviderConfig, SecretProviderType } from "../types";
+import { AWSSecretsManagerProvider } from "./awsSecretManagerProvider";
+import { AbstractSecretProvider } from "./AbstractSecretProvider";
+
+export function createProviderInstance(
+  config: SecretProviderConfig
+): AbstractSecretProvider {
+  switch (config.type) {
+    case SecretProviderType.AWS_SECRETS_MANAGER:
+      return new AWSSecretsManagerProvider(config);
+    default:
+      throw new Error(`Unknown provider type: ${config.type}`);
+  }
+}

src/lib/secretsManager/secretsManager.ts

@@ -0,0 +1,27 @@
+import { SecretProviderConfig } from "./types";
+import { AbstractProviderRegistry } from "./providerRegistry/AbstractProviderRegistry";
+
+export class SecretsManager {
+  private registry: AbstractProviderRegistry;
+
+  constructor(registry: AbstractProviderRegistry) {
+    this.registry = registry;
+  }
+
+  async initialize(): Promise<void> {
+    await this.registry.initialize();
+  }
+
+  async addProviderConfig(config: SecretProviderConfig) {
+    console.log("!!!debug", "addconfig", config);
+    await this.registry.setProviderConfig(config);
+  }
+
+  async removeProviderConfig(id: string) {
+    await this.registry.deleteProviderConfig(id);
+  }
+
+  async getProviderConfig(id: string): Promise<SecretProviderConfig | null> {
+    return this.registry.getProviderConfig(id);
+  }
+}

src/lib/secretsManager/types.ts

@@ -0,0 +1,40 @@
+export enum SecretProviderType {
+  AWS_SECRETS_MANAGER = "aws",
+}
+
+export interface AWSSecretsManagerConfig {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+  sessionToken?: string;
+}
+
+export type ProviderSpecificConfig = AWSSecretsManagerConfig; // | HashicorpVaultConfig | OtherProviderConfig;
+
+export interface SecretProviderConfig {
+  id: string;
+  type: SecretProviderType;
+  name: string;
+  createdAt: number;
+  updatedAt: number;
+  config: ProviderSpecificConfig;
+}
+
+export type AwsSecretReference = {
+  type: SecretProviderType.AWS_SECRETS_MANAGER;
+  nameOrArn: string;
+  version?: string;
+};
+
+export type SecretReference = AwsSecretReference; // | VaultSecretReference; // | OtherProviderSecretReference;
+
+export interface CachedSecret {
+  id: string; // Unique identifier
+  identifier: string; // Secret identifier (name, ARN, or path)
+  value: string; // The actual secret value
+  providerId: string;
+  providerType: SecretProviderType;
+  fetchedAt: number;
+  expiresAt: number;
+  version?: string;
+}

src/lib/storage/EncryptedElectronStore.ts

@@ -0,0 +1,103 @@
+import Store from "electron-store";
+import { safeStorage } from "electron";
+
+interface EncryptedStoreSchema {
+  version: number;
+  data: Record<string, any>;
+}
+
+const STORE_VERSION = 1;
+
+/**
+ * Generic encrypted key-value storage using electron-store + Electron's safeStorage.
+ * - OS-level encryption via safeStorage (Keychain/DPAPI/libsecret)
+ *
+ * Storage location: <userData>/storage/<storeName>.txt
+ *
+ */
+export class EncryptedElectronStore {
+  private store: Store<EncryptedStoreSchema>;
+
+  constructor(storeName: string) {
+    if (!safeStorage.isEncryptionAvailable()) {
+      throw new Error(
+        "Encryption is not available on this system. Please ensure your operating system's secure storage is properly configured."
+      );
+    }
+
+    const storeOptions: Store.Options<EncryptedStoreSchema> = {
+      name: storeName,
+      cwd: "storage",
+      watch: true,
+      fileExtension: "txt",
+      serialize: (data) => {
+        const jsonString = JSON.stringify(data);
+        const encrypted = safeStorage.encryptString(jsonString);
+        const base64 = encrypted.toString("base64");
+        return base64;
+      },
+      deserialize: (data) => {
+        const encryptedBuffer = Buffer.from(data, "base64");
+        const decrypted = safeStorage.decryptString(encryptedBuffer);
+        return JSON.parse(decrypted) as EncryptedStoreSchema;
+      },
+      schema: {
+        version: { type: "number" },
+        data: { type: "object", additionalProperties: true },
+      },
+      defaults: {
+        version: STORE_VERSION,
+        data: {},
+      },
+    };
+
+    this.store = new Store<EncryptedStoreSchema>(storeOptions);
+  }
+
+  set<T>(key: string, data: T) {
+    this.store.set(`data.${key}`, data);
+  }
+
+  get<T>(key: string): T | null {
+    const data = this.store.get(`data.${key}`) as T;
+    return data ?? null;
+  }
+
+  getAll<T>(): T {
+    return this.store.get("data") as T;
+  }
+
+  delete(key: string): void {
+    this.store.delete(`data.${key}` as keyof EncryptedStoreSchema);
+  }
+
+  has(key: string): boolean {
+    return this.store.has(`data.${key}` as keyof EncryptedStoreSchema);
+  }
+
+  keys(): string[] {
+    return Object.keys(this.store.get("data"));
+  }
+
+  clear(): void {
+    this.store.set("data", {});
+  }
+
+  /**
+   * Registers a callback for when storage changes.
+   *
+   * @param callback - Function to call when data changes
+   * @returns Unsubscribe function
+   */
+  onChange(callback: (_data: Record<string, string>) => void): () => void {
+    return this.store.onDidChange("data", (newValue) => {
+      if (newValue) {
+        callback(newValue);
+      }
+    });
+  }
+
+  getStore(): Store<EncryptedStoreSchema> {
+    return this.store;
+  }
+}

src/main/events.js

@@ -23,6 +23,9 @@ import { createOrUpdateAxiosInstance } from "./actions/getProxiedAxios";
 // and then build these utilites elsewhere
 // eslint-disable-next-line import/no-cycle
 import createTrayMenu from "./main";
+import { SecretsManager } from "../lib/secretsManager/secretsManager";
+import { FileBasedProviderRegistry } from "../lib/secretsManager/providerRegistry/FileBasedProviderRegistry";
+import { SecretsManagerEncryptedStorage } from "lib/secretsManager/encryptedStorage/SecretsManagerEncryptedStorage";
 
 const getFileCategory = (fileExtension) => {
   switch (fileExtension) {
@@ -269,6 +272,33 @@ export const registerMainProcessEventsForWebAppWindow = (webAppWindow) => {
   ipcMain.handle("helper-server-hit", () => {
     webAppWindow?.send("helper-server-hit");
   });
+
+  let secretsManager = null;
+
+  ipcMain.handle("init-secretsManager", () => {
+    const secretsStore = new SecretsManagerEncryptedStorage("providers");
+    const registry = new FileBasedProviderRegistry(secretsStore);
+    secretsManager = new SecretsManager(registry);
+
+    try {
+      secretsManager.initialize();
+    } catch (err) {
+      console.error("Error initializing Secrets Manager", err);
+    }
+  });
+
+  ipcMain.handle("secretsManager:addProviderConfig", async (event, config) => {
+    await secretsManager.addProviderConfig(config);
+  });
+
+  ipcMain.handle("secretsManager:getProviderConfig", async (event, id) => {
+    const providerConfig = await secretsManager.getProviderConfig(id);
+    console.log("!!!debug", "getConfig", providerConfig);
+  });
+
+  ipcMain.handle("secretsManager:removeProviderConfig", async (event, id) => {
+    await secretsManager.removeProviderConfig(id);
+  });
 };
 
 export const registerMainProcessCommonEvents = () => {