Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
git-service-adapter
Advanced tools
A configurable plug-and-play wrapper around the GitHub v3 API that allows applications to leverage GitHub as a remote configuration storage service.
Git Service Adapter is a configurable plug-and-play module that allows applications to leverage GitHub as a remote configuration storage container. Essentially, Git Service Adapter functions as a wrapper around the GitHub v3 API. It is intended as an intermediary tool for applications migrating towards true cloud-based remote configuration. Advantage of remote configuration are discussed elsewhere.
The intended use of this package is through a service or "bot" user account. It is recommended that this account not be connected to any third-party applications and, of course, that only private repositories be provisioned. A Personal Access Token is required. The token must have read permissions for repositories, files, and--if you intend to access repositories stored within connected organizations--organizations. It is up to development teams to determine least-privilege principles and manage token-cycling.
Note: It is up to you to determine whether or not Git Service Adapter is an appropriate tool for your application. While utilization allows for the separation of environment configurations from your codebase (GOOD), GitHub repositories are not specifically designed with this use-case in mind. With appropriate precautions (such as--but not limited to--those described above), however, it provides a serviceable option to quickly get up-and-running with remote configurations. As a disclaimer, use at your own discretion.
Git Service Adapter can be installed using the package manager of your choosing. The example command below uses yarn.
$ yarn add git-service-adapter
Git Service Adapter ships with both CommonJS and ES6 compatibility out-of-the-box.
While it accepts arguments for all other parameters (except NODE_ENV
, which is only read internally through process.env
), arguments can be omitted in favour of allowing Git Service Adapter to read its own configuration variables from process.env
directly. It is up to you to balance verbosity with readability. The following variables are available:
GIT_SERVICE_ACCESS_TOKEN=<your_bot_account_access_token>
GIT_USERNAME=<your_bot_account_username>
GIT_ORG=<your_org>
GIT_REPO=<your_config_repo>
GIT_FILE=<your_remote_config_file_name>
NODE_ENV=<env>
In keeping with convention, please note that if NODE_ENV
is not set to 'development'
, a production environment will be assumed in order to help prevent errors as well as to moderate logging behaviors securely.
import ServiceAdapter from 'git-service-adapter';
const adapter = new ServiceAdapter({
token: process.env.GIT_SERVICE_ACCESS_TOKEN,
username: process.env.GIT_USERNAME,
fileName: process.env.GIT_FILE,
organization: process.env.GIT_ORG,
repository: process.env.GIT_REPO,
pollInterval: 1000 * 60 * 5,
mute: false,
local: false,
verbose: true,
timeoutFn: setTimeout
});
establishConnection()
:await adapter.establishConnection();
pollInterval
is specified):const emitter = adapter.emitter;
configUpdated
event listener (optional: see #4):emitter.addListener('configUpdated', someFunction);
fetchConfigFile()
(useful for asynchronously awaiting result for first-time config load, or wherever a pollInterval
is not specified):const initialConfig = await adapter.fetchConfigFile();
Name | Default | Description |
---|---|---|
fileName? | process.env.GIT_FILE | The name of the configuration file in the remote repository. Argument is optional, however a value is required if one cannot be read from process.env . |
local? | false | Indicates whether a file should be read from the local environment. A file named local.json must be included at the root of the project directory with the required environment variables stored inside. Make sure you .gitignore this file! |
organization? | process.env.GIT_ORG | The name of the organization storing the remote repository and configuration file. This argument is truly optional -- if not included, it is assumed that the configs are stored in a repository directly on the service account. |
pollInterval? | undefined | An optional argument used to provide the interval at which Git Service Adapter should check the configuration repository. Argument should be provided in milliseconds. If no argument is provided, polling does not occur. If an argument is provided, polling is initiated automatically. |
repository? | process.env.GIT_REPO | The name of the remote repository. Argument is optional, however a value is required if one cannot be read from process.env . |
setTimeout? | setTimeout (default NodeJs timeout function) | Optional custom timeout function. Due to historic buggy behaviors of the native NodeJS timeout function, users have the option of writing or wrapping a timeout function from another language if necessary. If no pollInterval is set, poll-loop will not trigger regardless of whether or not a custom function is passed. |
token? | process.env.GIT_SERVICE_ACCESS_TOKEN | The Personal Access Token of the service account. Argument is optional, however a value is required if one cannot be read from process.env . |
username? | process.env.GIT_USERNAME | The name of the service account. Argument is optional, however a value is required if one cannot be read from process.env . |
verbose? | false | Toggles whether or not retrieved configurations should be logged to console. This happens independently of mute . If process.env.NODE_ENV is not explicitly set to 'development' , this argument will be ignored to prevent accidental secret leakage. |
Upon instantiation, ServiceAdapter
performs very basic validation, ensuring that the required fields have either been passed as arguments or are readable from process.env
.
In local development, missing arguments will not result in an error, however a warning message will be displayed.
If process.env.NODE_ENV
is not explicitly set to 'development'
, missing essential arguments will result in a thrown error. This is done to prevent app start-up whenever there is an issue with environment configs.
ServiceAdapter.prototype.establishConnection()
An asynchronous method used to verify a working connection with the remote configuration repository. If called, this method will establish a connection with the remote repository regardless of whether or not the local
flag is set to true
. In both success and failure, this method logs to console if mute
is set to false
.
In addition to logging to the console, method will return a Boolean
value, allowing user to provide custom handling in the event that establishing a connection is unsuccessful.
Please note that this method does not open a connection in the form of a stream, but rather hits the endpoint once to ensure that the adapter is able to connect to the appropriate repository with valid credentials.
None
Boolean
(true
or false
)
ServiceAdapter.prototype.fetchConfigFile()
An asynchronous method used to manually retrieve configuration. This method must be called to kick-start automatic configuration retrieval. Can be called even when pollInterval
is set. Use this method to await retrieval of initial configurations upon app startup.
This method does not allows for arguments to be passed. If for some reason multiple repositories need to be accessed (i.e. a base configuration and then environmental configurations -- not at all recommended, but a possibility: in general it is best to keep a unified set of configurations per environment), you should use multiple ServiceAdapter
instances, and handle responses accordingly in your application.
If there is an error fetching the remote configuration, method will return false
to allow for error custom error handling. If the mute
flag is set to false
, a message will be logged to console. If a pollInterval
is passed, failure will not break the loop.
None
Success: Response in JavaScript Object
format
Failure: false
ServiceAdapter.prototype.printConnection()
A method used to log connection details. The following are outputted to console: username
, repository
, organization
, fileName
. Useful for debugging, or to log connection at app initialization. Ignores both verbose
and mute
flags, and is agnostic of production / development environments.
None
none
ServiceAdapter.prototype.togglePollLoop()
Polling behavior can be toggled on and off by passing true
or false
to this method. The default state is true
. If for whatever reason no polling behavior is desired, this function should be called before fetchConfigFile()
. Method will ignore non-boolean arguments.
If mute
is set to false
, this method will log to the console.
mode
: Boolean
None
configUpdated
This event is emitted under the following conditions:
local.json
file.Listen to this event to respond to configuration changes within your application. See Basic Usage for an example.
If you encounter any problems, please open an issue! If you would like to contribute features or functionality, feel free to submit a pull request. Feature requests also accepted.
The following items will receive priority:
FAQs
A configurable plug-and-play wrapper around the GitHub v3 API that allows applications to leverage GitHub as a remote configuration storage service.
We found that git-service-adapter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.