Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@innotrade/enapso-config
Advanced tools
ENAPSO Config helps you easily manage your application configuration in enterprise environments.
It enables you to ...
Just import the @innotrade/enapso-config
package as follows:
npm i @innotrade/enapso-config --save
Just require the @innotrade/enapso-config
package as follows:
require('@innotrade/enapso-config');
The .env
file in the project's root folder just requires a single reference to the configuration file in the form:
ENAPSO_CONFIG_FILE = [path_to_config_file]
You can either specify an absolute path to your configuration file:
ENAPSO_CONFIG_FILE=/System/Volumes/Data/git/enapso-config/config/enapso-config-demo.js
Alternatively you can specify the path using the ${AppRoot}
variable:
ENAPSO_CONFIG_FILE=${AppRoot}/config/enapso-config-demo.js
ENAPSO_CONFIG_FILE = ${AppRoot}/config/[app]-[user]-[system].js
ENAPSO_CONFIG_FILE = ${AppRoot}/config/CompanyApp-AlexanderSchulze-MacBookHomeOffice.js
and use it where ever you need, with fields or as entire object:
console.log(encfg.getApplicationString());
console.log(encfg.getCopyrightString());
const instance = new mynamespace.MyClass(
{
appName: config.generator.appName,
modelName: 'hardcoded'
},
config
);
Especially in enterprise environments, ENAPSO Config simplifies your application configuration management by inheriting common settings from higher levels like company or department level down to user or machine level. Settings on company or department level only need to be declared once and not on each and every user's machine(s). New settings in common levels are automatically shared with each user, changes in common configurations are applied to local environments if not yet explicitly specified. This massively reduces maintenance efforts and potential issues in your application due to missing configuration settings.
Out of the box, we provide three levels of configuration: Company, Department and User/Machine. Of course, you can easily extend that e.g. by introducing a new BusinessUnit level and even separating the user from the machine configuration in case users develop on multiple machines. In more simple enviroment, you also can reduce the levels by e.g. limiting the structure to just contain company and application level. ENAPSO Config can easily be used according to you specific environment and use cases.
EnapsoConfig
+-- RootConfig
+-- CompanyConfig
+-- DepartmentConfig
+-- User/MachineConfig
The EnapsoConfig class contains the methods to load, access and maintain configuration. This is ENAPSO Config internal and you usually you do not put any configuration data inside this class or maintain it manually.
The RootConfig class is intended to contain abstract or rudimentary default configuration on vendor or platform level. Usually, here you do usually not maintain any configuration related to company business unit, department, developer or machine level.
In this class you configure your configuration settings across the entire company. For instance, this includes your company name and address, contact data and your homepage, your legal and social media information.
In the out-of-the-box package of ENAPSO the DepartmentConfig class is a direct descendant from CompanyConfig. In case your enterprise structure requires a differentation by business unit you can easily introduce such. Just provide a new BusinessUnitConfig class following the same pattern like the company configuration class, extend that class from CompanyConfig and extend the DepartmentConfig from the new BusinessUnitConfig class instead of CompanyConfig.
EnapsoConfig
+-- RootConfig
+-- CompanyConfig
+-- BusinessUnitConfig
+-- DepartmentConfig
+-- User/MachineConfig
In the user configuration you usually add your username, e.g. for automated authentication. Please be aware that passwords, api keys or other sensitve data never should be maintained in configuration files that are shared with others, e.g. in source control repositories like git. If you want to manage credentials in your configuration you can easily set their values by using a reference to process.env.VARIABLE instead of hard coding them in the source code.
EnapsoConfig
+-- RootConfig
+-- CompanyConfig
+-- DepartmentConfig
+-- User
+-- MachineConfig
Do not hard code sensitive data directly in the configuration file but reference to a environment variable.
class EnapsoConfigDemoConfig extends DepartmentConfig {
constructor(data) {
super(data);
:
this.myAccessToken = process.env.MY_PERSONAL_ACCESS_TOKEN;
}
}
Doing so, enables you to read the sensitive value from the configuration in the same like they were hard coded:
// accessing sensitive data from environment variables
const myAccessToken = encfg.getConfig(
'myAccessToken',
'[no access token configured]'
);
console.log('Accessing sensitive data from env variables: ' + myAccessToken);
In case the environment variable is not set, as a developer, you will not get any notification.
If you want to get notified, you can wrap the reference by a call to this.getEnvVar
like this:
this.myAccessToken = this.getEnvVar(process.env.MY_PERSONAL_ACCESS_TOKEN);
FAQs
ENAPSO Enterprise Configuration Management
We found that @innotrade/enapso-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.