five-bells-shared - npm Package Compare versions

Comparing version 8.3.0 to 8.4.0

lib/config.js

 'use strict'
 
 const url = require('url')
+const tweetnacl = require('tweetnacl')
 
@@ -112,4 +113,35 @@ /**
   }
+
+  /**
+   * Load configuration of this process' keypair.
+   */
+  parseKeyConfig () {
+    this.keys = {}
+    this.keys.ed25519 = {
+      secret: process.env.ED25519_SECRET_KEY,
+      public: process.env.ED25519_PUBLIC_KEY
+    }
+
+    let keyPair
+    if (!this.keys.ed25519.secret) {
+      if (process.env.NODE_ENV === 'production') {
+        throw new Error('No ED25519_SECRET_KEY provided.')
+      }
+      keyPair = tweetnacl.sign.keyPair()
+      this.keys.ed25519.secret = tweetnacl.util.encodeBase64(keyPair.secretKey)
+      this.keys.ed25519.public = tweetnacl.util.encodeBase64(keyPair.publicKey)
+    }
+
+    if (!this.keys.ed25519.public) {
+      if (!keyPair) {
+        keyPair = tweetnacl.sign.keyPair.fromSecretKey(
+          tweetnacl.util.decodeBase64(this.keys.ed25519.secret))
+      }
+      this.keys.ed25519.public =
+        tweetnacl.util.encodeBase64(keyPair.publicKey)
+    }
+
+  }
 }
 
 module.exports = Config

lib/db.js

@@ -8,6 +8,9 @@ 'use strict'
 module.exports = function (Sequelize, log) {
+  if (typeof log === 'object') {
+    log.warn('DEPRECATED: Do not pass a logger to five-bells-shared Database constructor. Instead, please pass it via the logging config option.')
+  }
   return class DB extends Sequelize {
     constructor (uri, options) {
       options = _.merge({
-        logging: log.debug,
+        logging: typeof log === 'object' ? log.debug : false,
         omitNull: true
@@ -27,3 +30,3 @@ }, options)
     sync () {
-      log.info('synchronizing database schema')
+      this.options.logging('synchronizing database schema')
       return super.sync()
@@ -30,0 +33,0 @@ }

package.json

 {
   "name": "five-bells-shared",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "Shared components for Five Bells projects.",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Improved metrics

Total package byte prevSize

1694079

increased by0.22%

Lines of code

2919

increased by1.07%

Worsened metrics

Number of low supply chain risk alerts

7

increased by75%

No dependency changes