now-env - npm Package Compare versions

Comparing version 1.0.2 to 1.1.0

example/now.json

 {
   "env": {
     "NODE_ENV": "production",
-    "TEST": "my-test-env"
+    "TEST": "my-test-env",
+    "SECRET": "@my-secret-key",
+    "SECRET_FAIL": "@this-is-not-defined"
   }
 }

example/package.json

@@ -11,5 +11,6 @@ {
       "NODE_ENV": "production",
-      "TEST": "my-test-env"
+      "TEST": "my-test-env",
+      "SECRET": "@my-secret-key"
     }
   }
 }

index.js

@@ -6,23 +6,42 @@ 'use strict'
 
-const applyEnv = env => Object.keys(env).forEach(key => {
-  process.env[key] = env[key]
-})
+const applyEnv = (env, secrets) => {
+  for (const key in env) {
+    // if the key already exists don't overwrite it
+    if (!process.env[key]) {
+      const value = secrets[env[key]] || env[key]
+      process.env[key] = value
+    }
+  }
+}
 
+const loadSecrets = () => {
+  const SECRET_PATH = resolve('./now-secrets.json')
+  if (existsSync(SECRET_PATH)) {
+    return require(SECRET_PATH)
+  }
+  return {}
+}
+
 const config = () => {
-  const NOW_PATH = resolve('./now.json')
+  // only run this in a non-production environment
+  if (process.env.NODE_ENV !== 'production') {
+    const secrets = loadSecrets()
 
-  if (existsSync(NOW_PATH)) {
-    const nowFile = require(NOW_PATH)
+    const NOW_PATH = resolve('./now.json')
 
-    if (nowFile.env) {
-      return applyEnv(nowFile.env)
+    if (existsSync(NOW_PATH)) {
+      const nowFile = require(NOW_PATH)
+
+      if (nowFile.env) {
+        return applyEnv(nowFile.env, secrets)
+      }
     }
-  }
 
-  const PKG_PATH = resolve('./package.json')
+    const PKG_PATH = resolve('./package.json')
 
-  const pkgFile = require(PKG_PATH)
+    const pkgFile = require(PKG_PATH)
 
-  if (pkgFile.now && pkgFile.now.env) {
-    return applyEnv(pkgFile.now.env)
+    if (pkgFile.now && pkgFile.now.env) {
+      return applyEnv(pkgFile.now.env, secrets)
+    }
   }
@@ -29,0 +48,0 @@ }

package.json

 {
   "name": "now-env",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Use now.sh environment variables in development",
@@ -5,0 +5,0 @@ "keywords": [

README.md

@@ -23,1 +23,8 @@ # now-env
 Because [now.sh](https://now.sh) automatically run your app with the `now.json` environment variables then this module it's not going to do anything in production :)
+
+## Using secrets
+Most probably you will want to use [secret keys](https://zeit.co/docs/features/env-and-secrets#securing-env-variables-using-secrets) in your `now.json` file. This module allow you to use them too without worries in development.
+
+Just create a `now-secrets.json` file with you development secrets, that file can (and most probably) be ignored with Git, then just use `now-env` as usual and it will auto-detect the file and use it to replace your secrets values.
+
+If the file doesn't exists or if your secret key is not defined then it's going to use the key name as value for your environment variable.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

4346

increased by40.83%

Number of package files

9

increased by12.5%

Lines of code

51

increased by75.86%

Number of lines in readme file

30

increased by30.43%

Worsened metrics

Number of low supply chain risk alerts

9

increased by50%

No dependency changes