Add AWS+MySQL Rotator Agent

agent-core/lib/index.ts

@@ -1,12 +1,16 @@
 import https from "https";
 import * as jose from "jose";
 import { z } from "zod";
-import { AgentError, jsonifyError } from "./utils";
-import { RequestSchema, Request, Response, RequestHandler } from "./models";
+import { AgentError, jsonifyError } from "./utils.js";
+import { RequestSchema, Request, Response, RequestHandler } from "./models.js";
 
 export { AgentError, Request, Response, RequestHandler };
 
-export type ProcessRequestOptions = { overrideKeySetURL?: string };
+export type JWKSOption = { type: "remote"; url: string } | { type: "local"; keySet: Record<string, unknown> };
+
+export type ProcessRequestOptions = {
+  overrideKeySet?: JWKSOption;
+};
 
 const MAX_ABS_REQUEST_AGE_MS = 30 * 1000; // 30 seconds
 
@@ -20,12 +24,17 @@ async function verifySignature(signature: string, options: ProcessRequestOptions
 
   z.enum(["ES512"]).parse(decodedHeader.alg);
 
-  const keySet = jose.createRemoteJWKSet(
-    new URL(options.overrideKeySetURL ?? "https://keys.doppler.com/secret-agents/jwks.json"),
-    {
+  const keySetOption = options.overrideKeySet ?? { type: "remote", url: "https://keys.doppler.com/secret-agents/jwks.json" };
+
+  let keySet;
+  if (keySetOption.type === "remote") {
+    keySet = jose.createRemoteJWKSet(new URL("https://keys.doppler.com/secret-agents/jwks.json"), {
       agent: new https.Agent({ minVersion: "TLSv1.3" }),
-    }
-  );
+    });
+  } else {
+    keySet = jose.createLocalJWKSet(keySetOption.keySet as unknown as jose.JSONWebKeySet);
+  }
+
   return await jose.compactVerify(signature, keySet);
 }
 

apps/aws-mysql-rotator/Dockerfile

@@ -0,0 +1,38 @@
+FROM node:16-alpine as build
+
+WORKDIR /usr/src/app
+
+# Copy package files and install all dependencies
+COPY ./package*.json ./
+COPY ./agent-core/package*.json ./agent-core/
+COPY ./rotators/mysql/package*.json ./rotators/mysql/
+COPY ./utils/aws/package*.json ./utils/aws/
+COPY ./apps/aws-mysql-rotator/package*.json ./apps/aws-mysql-rotator/
+RUN npm install --workspace apps/aws-mysql-rotator
+
+# Copy sources
+COPY ./tsconfig* ./
+COPY ./agent-core ./agent-core
+COPY ./rotators/mysql ./rotators/mysql
+COPY ./utils/aws ./utils/aws
+COPY ./apps/aws-mysql-rotator ./apps/aws-mysql-rotator
+
+# Build dependencies and app
+RUN npm --prefix ./agent-core run build
+RUN npm --prefix ./rotators/mysql run build
+RUN npm --prefix ./utils/aws run build
+RUN npm --prefix ./apps/aws-mysql-rotator run build
+
+# Remove node_modules to be reinstalled later
+RUN rm -r node_modules
+
+FROM public.ecr.aws/lambda/nodejs:16
+
+WORKDIR ${LAMBDA_TASK_ROOT}
+
+COPY --from=build /usr/src/app .
+
+# Only install production dependencies
+RUN npm clean-install --production
+
+CMD [ "apps/aws-mysql-rotator/dist/app.handler" ]  

apps/aws-mysql-rotator/app.ts

@@ -0,0 +1,13 @@
+import { JWKSOption, processRequest } from "agent-core";
+import mysqlHandler from "mysql-rotator";
+import { fetchS3KeySet } from "aws-utils";
+
+export async function handler(event: { body: string }) {
+  let keySetOption: JWKSOption;
+  if (process.env.OVERRIDE_KEY_SET) {
+    keySetOption = { type: "local", keySet: JSON.parse(process.env.OVERRIDE_KEY_SET) };
+  } else {
+    keySetOption = { type: "local", keySet: await fetchS3KeySet(process.env.OVERRIDE_KEY_SET_S3_BUCKET) };
+  }
+  return await processRequest(event.body, mysqlHandler, { overrideKeySet: keySetOption });
+}

apps/aws-mysql-rotator/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "aws-mysql-rotator",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "",
+  "main": "dist/app.js",
+  "types": "dist/app.d.ts",
+  "engines": {
+    "node": "16.x"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "typescript": "^4.6.4"
+  },
+  "dependencies": {
+    "agent-core": "*",
+    "mysql-rotator": "*",
+    "aws-utils": "*"
+  }
+}

apps/aws-mysql-rotator/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist"
+  },
+  "references": [{ "path": "../../agent-core" }, { "path": "../../rotators/mysql" }, { "path": "../../utils/aws" }]
+}

apps/http-postgres-rotator/Dockerfile

@@ -32,4 +32,4 @@ COPY --from=build /usr/src/app .
 # Only install production dependencies
 RUN npm install --production
 
-CMD [ "node", "--experimental-specifier-resolution=node", "./apps/http-postgres-rotator/dist/index.js" ]
+CMD [ "node", "./apps/http-postgres-rotator/dist/index.js" ]

apps/http-postgres-rotator/index.ts

@@ -7,7 +7,9 @@ app.use(express.text());
 app.use(express.text({ limit: "50kb" }));
 
 app.post("/", async (req, res) => {
-  const response = await processRequest(req.body, postgresHandler, { overrideKeySetURL: process.env.OVERRIDE_KEY_SET_URL });
+  const response = await processRequest(req.body, postgresHandler, {
+    overrideKeySet: process.env.OVERRIDE_KEY_SET_URL ? { type: "remote", url: process.env.OVERRIDE_KEY_SET_URL } : undefined,
+  });
   res.send(response);
 });