Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
@vrbo/determination
Advanced tools
Configuration resolver. @vrbo/determination
loads a JSON configuration file, resolving against criteria using confidence and shortstop protocol handlers.
In addition, @vrbo/determination
supports javascript style comments in your JSON using shush.
Note: @vrbo/determination
borrows heavily from confit, but prefers confidence
for resolving environment as well as other criteria for filtering.
const Determination = require('@vrbo/determination');
Determination.create(options)
options
(Object) - an options object containing:
config
(String | Object) - required, either a path to a JSON configuration file or an object.basedir
(String) - optional path used for resolving relative imports within configs. If config is a file, it defaults to the config file's directory. If config is an object, it defaults to process.cwd()
.criteria
(Object) - optional resolution criteria. See confidence. Minimally will always contain process.env
under the key env
.protocols
(Object) - optional mapping of protocols for shortstop. Protocols are bound with context config
, where config
is the configuration being resolved. Obviously this doesn't work with arrow functions.defaults
(Object | String) - optional default pre-resolved configuration values.overrides
(Object | String) - optional override pre-resolved configuration values.resolver.resolve([callback])
callback
(Function) - an optional callback.callback
is not provided.const Determination = require('@vrbo/determination');
const Path = require('path');
const Handlers = require('shortstop-handlers');
const config = Path.join('.', 'config', 'config.json');
const resolver = Determination.create({
config,
protocols: {
require: Handlers.require(Path.dirname(config))
}
});
resolver.resolve((error, config) => {
// config.get
// config.set
});
get(string: key)
- returns the value for the given key
, where a dot-delimited key
may traverse the configuration store.set(string: key, any: value)
- sets the given value
on the given key
, where dot-delimited key
may traverse the configuration store.merge(object: value)
- merges the given value
into the configuration store.use(object: store)
- merges the given store
into the configuration store.data
- accessor for a clone of the underlying store data (modifying this will not modify store).config.set('some.key.name', 'value');
config.merge({
some: {
key: {
other: 'another value',
},
},
});
config.get('some.key.other'); // 'another value'
Two protocol handlers are enabled by default:
import:path
- merges the contents of a given file, supporting comments (unlike require
).config:key
- copies the value under the given key (supporting dot-delimited) to the key it is declared on.An example of utilizing a custom protocol handler is below. This takes advantage of the context bound to the handler.
config.json
{
"thing1": "one",
"thing2": "two",
"things": "eval:${thing1} and ${thing2}"
}
and
const Determination = require('@vrbo/determination');
const VM = require('vm');
const protocols = {
eval(expression) {
return VM.runInNewContext('`' + expression + '`', this);
}
};
Determination.create({ config: Path.join(__dirname, './config.json'), protocols }).resolve((error, config) => {
config.get('things'); // "one and two"
});
Configuration file contents are resolved in the following order:
defaults
against protocols
.defaults
with config
.config
against protocols
.overrides
against protocols
.overrides
into config
.config
against config:
protocol.FAQs
Configuration resolver using confidence and shortstop.
We found that @vrbo/determination demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.