fastify-secrets-gcp

v2.2.1

Fastify secrets plugin for Google cloud platform secrets manager For more information about how to use this package see README

Latest version published 1 year ago

License: Apache-2.0

NPM

GitHub

Package Health Score

68 / 100

security
No known security issues
popularity
Limited
maintenance
Sustainable
community
Active

Explore Similar Packages

Security

No known security issues

All security vulnerabilities belong to production dependencies of direct and indirect packages.

Security and license risk for significant versions

All Versions

Version				Vulnerabilities	License Risk
2.2.1	\|	10/2023	Popular	0 C 0 H 0 M 0 L	0 H 0 M 0 L
2.1.1	\|	05/2023		0 C 0 H 0 M 0 L	0 H 0 M 0 L
1.0.1	\|	10/2020		0 C 0 H 0 M 0 L	0 H 0 M 0 L

License

Apache-2.0

Security Policy

Is your project affected by vulnerabilities?

Scan your projects for vulnerabilities. Fix quickly with automated fixes. Get started with Snyk for free.

Get started free

Popularity

Limited

Weekly Downloads (269)

GitHub Stars: 5
Forks: 3
Contributors: 20

Direct Usage Popularity

The npm package fastify-secrets-gcp receives a total of 269 downloads a week. As such, we scored fastify-secrets-gcp popularity level to be Limited.

Based on project statistics from the GitHub repository for the npm package fastify-secrets-gcp, we found that it has been starred 5 times.

Downloads are calculated as moving averages for a period of the last 12 months, excluding weekends and known missing data points.

Community

Active

Readme.md: Yes
Contributing.md: Yes
Code of Conduct: Yes
Contributors: 20
Funding: No

With more than 10 contributors for the fastify-secrets-gcp repository, this is possibly a sign for a growing and inviting community.

Embed Package Health Score Badge

Maintenance

Sustainable

Commit Frequency

Open Issues: 0
Open PR: 3
Last Release: 1 year ago
Last Commit: 11 days ago

Further analysis of the maintenance status of fastify-secrets-gcp based on released npm versions cadence, the repository activity, and other data points determined that its maintenance is Sustainable.

An important project maintenance signal to consider for fastify-secrets-gcp is that it hasn't seen any new versions released to npm in the past 12 months, and could be considered as a discontinued project, or that which receives low attention from its maintainers.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Keep your project healthy

Check your package.json

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Node.js Compatibility: >= 12.13.0

Age: 4 years
Dependencies: 2 Direct
Versions: 8
Install Size: 17.9 kB
Dist-tags: 1
# of Files: 17
Maintainers: 5
TS Typings: No

fastify-secrets-gcp has more than a single and default latest tag published for the npm package. This means, there may be other tags available for this package, such as next to indicate future releases, or stable to indicate stable releases.

Readme

Fastify Secrets Gcp

Fastify secrets plugin for Google cloud platform secrets manager

Installation

npm install --save fastify-secrets-gcp

Usage

Get permissions to access gcp secrets manager

In order to be able to read from gcp secrets manager you will need some permissions. You will also probably manage permissions in different ways in local dev and production environment.

Local dev environment

In general you may want to use a different secrets manager on your local machine (i.e. fastify-secrets-env to read secrets from env variables).

If you want run fastify-secrets-gcp in the local environment too you will need to follow these steps:

Create a GCP Service Account
Grant the new service account at least the role of "Secret Manager Secret Accessor"
Create key for the account
Download the key in json format
(optional) Place the key in the root of your project (make sure to add it to .gitignore to avoid commiting it)
Set the env variable GOOGLE_APPLICATION_CREDENTIALS to the absolute path of the downloaded key
You're ready to run your app

Production environment (on Cloud Run)

If you already have a custom Service Account for your service Clour Run you will need to give it access to Secrets Manager. Otherwise you will need to create a new custom Service Account with access to Secrets Manager and assign it to Cloud Run.

In any case you will need to grant the "Secret Manager Secret Accessor" role.

Add plugin to your fastify instance

const FastifySecrets = require('fastify-secrets-gcp')

fastify.register(FastifySecrets, {
  secrets: {
    dbPassword: 'projects/PROJECT-ID/secrets/SECRET-ID/versions/latest'
  }
})

Access you secrets

await fastify.ready()

console.log(fastify.secrets.dbPassword) // content of projects/PROJECT-ID/secrets/SECRET-ID/versions/latest

Plugin options

The plugin only expect the secrets object in the options.

It is a map of keys and resource ids for the secrets. fastify-secrets-gcp will decorate the fastify server with a secrets object where keys will be the same keys of the options and the value will be the content of the secret as fetched from GCP Secrets Manager

Contributing

See CONTRIBUTING.md

License

fastify-secrets-gcp dependencies

@google-cloud/secret-manager fastify-secrets-core

fastify-secrets-gcp development dependencies

eslint eslint-config-prettier eslint-config-standard eslint-plugin-import eslint-plugin-n eslint-plugin-prettier eslint-plugin-promise eslint-plugin-standard fastify husky lint-staged prettier proxyquire sinon tap uuid

FAQs

What is fastify-secrets-gcp?

Fastify secrets plugin for Google cloud platform secrets manager. Visit Snyk Advisor to see a full health score report for fastify-secrets-gcp, including popularity, security, maintenance & community analysis.

Is fastify-secrets-gcp popular?

The npm package fastify-secrets-gcp receives a total of 269 weekly downloads. As such, fastify-secrets-gcp popularity was classified as limited. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is fastify-secrets-gcp well maintained?

We found indications that fastify-secrets-gcp maintenance is sustainable demonstrating some project activity. We saw a total of 20 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is fastify-secrets-gcp safe to use?

The npm package fastify-secrets-gcp was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 8 November-2024, at 08:19 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP

Package Health Score

Explore Similar Packages

Security and license risk for significant versions

Is your project affected by vulnerabilities?

Weekly Downloads (269)

Direct Usage Popularity

Embed Package Health Score Badge

Commit Frequency

Keep your project healthy

Check your package.json

Snyk Vulnerability Scanner

Readme

Fastify Secrets Gcp

Installation

Usage

Get permissions to access gcp secrets manager

Local dev environment

Production environment (on Cloud Run)

Add plugin to your fastify instance

Access you secrets

Plugin options

Contributing

License

fastify-secrets-gcp dependencies

fastify-secrets-gcp development dependencies

FAQs

What is fastify-secrets-gcp?

Is fastify-secrets-gcp popular?

Is fastify-secrets-gcp well maintained?

Is fastify-secrets-gcp safe to use?

Build a secure application checklist

Select a recommended open source package

Scan your app for vulnerabilities

Source Code

Open Source

Container

Config

Fix identified vulnerabilities

Monitor for new issues