init push

scripts/inject-secrets.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage:
+# ./scripts/inject-secrets.sh local
+# ./scripts/inject-secrets.sh staging
+# ./scripts/inject-secrets.sh prod
+
+ENV=${1:-local}
+OUTPUT_PATH=${2:-/tmp/config.generated.json}
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+TEMPLATE="$REPO_ROOT/config/$ENV/config.json"
+
+echo "==> Environment: $ENV"
+echo "==> Template: $TEMPLATE"
+echo "==> Output: $OUTPUT_PATH"
+
+# ■■ Validate template exists ■■
+if [ ! -f "$TEMPLATE" ]; then
+  echo "ERROR: Config template not found at $TEMPLATE"
+  exit 1
+fi
+
+# ■■ Load secrets ■■
+if [ "$ENV" = "local" ]; then
+  ENV_FILE="$REPO_ROOT/.env.local"
+
+  if [ ! -f "$ENV_FILE" ]; then
+    echo "ERROR: .env.local not found. Copy .env.local.example and fill in your values."
+    exit 1
+  fi
+
+  echo "==> Loading local env from $ENV_FILE"
+
+  set -a
+  source "$ENV_FILE"
+  set +a
+
+else
+  echo "==> Fetching secrets from AWS Secrets Manager"
+
+  AWS_ARGS=(
+    secretsmanager get-secret-value
+    --secret-id "$ENV/fm-be/config"
+    --query SecretString
+    --output text
+  )
+
+  if [ -n "${AWS_ENDPOINT_URL:-}" ]; then
+    echo "==> Using custom AWS endpoint: $AWS_ENDPOINT_URL"
+    AWS_ARGS+=(--endpoint-url "$AWS_ENDPOINT_URL")
+  fi
+
+  SECRET=$(aws "${AWS_ARGS[@]}")
+
+  eval "$(echo "$SECRET" | jq -r 'to_entries | .[] | "export \(.key)=\(.value)"')"
+fi
+
+# ■■ Extract required variables from template ■■
+REQUIRED_VARS=$(grep -o '\${[A-Z0-9_]\+}' "$TEMPLATE" | tr -d '${}' | sort -u)
+
+echo "==> Validating required variables..."
+
+MISSING=()
+EMPTY=()
+
+for var in $REQUIRED_VARS; do
+  if [ -z "${!var+set}" ]; then
+    MISSING+=("$var")
+  elif [ -z "${!var}" ]; then
+    EMPTY+=("$var")
+  fi
+done
+
+if [ ${#MISSING[@]} -gt 0 ]; then
+  echo "ERROR: The following variables are not set at all:"
+  for v in "${MISSING[@]}"; do
+    echo " - $v"
+  done
+  exit 1
+fi
+
+if [ ${#EMPTY[@]} -gt 0 ]; then
+  echo "WARNING: The following variables are set but empty:"
+  for v in "${EMPTY[@]}"; do
+    echo " - $v"
+  done
+fi
+
+echo "==> All required variables are set"
+
+# ■■ Safe substitution (only replace known vars) ■■
+VARS=$(printf '${%s} ' $REQUIRED_VARS)
+
+envsubst "$VARS" < "$TEMPLATE" > "$OUTPUT_PATH"
+
+echo "==> Config generated at $OUTPUT_PATH"
+
+# ■■ Validate JSON ■■
+if ! jq empty "$OUTPUT_PATH" 2>/dev/null; then
+  echo "ERROR: Generated config is not valid JSON"
+  echo "==> jq diagnostics:"
+  jq empty "$OUTPUT_PATH" || true
+  rm -f "$OUTPUT_PATH"
+  exit 1
+fi
+
+echo "==> JSON validation passed"
+
+echo "==> Done."