19 lines
571 B
JavaScript
19 lines
571 B
JavaScript
import { readFileSync } from 'node:fs';
|
|
|
|
// Resolve a vault_path-style secret reference. v1 supports:
|
|
// env:NAME -> process.env.NAME
|
|
// file:/path -> file contents (trimmed)
|
|
// <raw> -> returned as-is
|
|
// Vaultwarden item-id resolution is a future swap (see spec).
|
|
export function resolveSecret(spec) {
|
|
if (!spec) return null;
|
|
if (spec.startsWith('env:')) {
|
|
return process.env[spec.slice(4)] ?? null;
|
|
}
|
|
if (spec.startsWith('file:')) {
|
|
try { return readFileSync(spec.slice(5), 'utf8').trim(); }
|
|
catch { return null; }
|
|
}
|
|
return spec;
|
|
}
|