konnosDashboard
DefaultEdgeFunctionSecrets.utils.ts92 lines · main
1export interface DefaultEdgeFunctionSecret {
2 name: string
3 description: string
4 // Runtime secrets are set by the Edge Functions runtime per invocation and
5 // are never returned by the secrets API. They should always be shown.
6 isRuntime: boolean
7 isDeprecated?: boolean
8}
9
10export const DEFAULT_EDGE_FUNCTION_SECRETS: DefaultEdgeFunctionSecret[] = [
11 {
12 name: 'BRIVEN_URL',
13 description: 'The API gateway for your Briven project.',
14 isRuntime: false,
15 },
16 {
17 name: 'BRIVEN_DB_URL',
18 description:
19 'The direct PostgreSQL connection URL. Should not be shared with anyone, only use it on the server.',
20 isRuntime: false,
21 },
22 {
23 name: 'BRIVEN_PUBLISHABLE_KEYS',
24 description:
25 'JSON dictionary of publishable API keys. Safe to use in a browser if RLS is enabled.',
26 isRuntime: false,
27 },
28 {
29 name: 'BRIVEN_SECRET_KEYS',
30 description: 'JSON dictionary of secret API keys. Should never be exposed to a browser.',
31 isRuntime: false,
32 },
33 {
34 name: 'BRIVEN_ANON_KEY',
35 description:
36 'Legacy anonymous key. Use BRIVEN_PUBLISHABLE_KEYS issued through JWT Signing Keys instead.',
37 isRuntime: false,
38 isDeprecated: true,
39 },
40 {
41 name: 'BRIVEN_SERVICE_ROLE_KEY',
42 description:
43 'Legacy service role key. Use BRIVEN_SECRET_KEYS issued through JWT Signing Keys instead.',
44 isRuntime: false,
45 isDeprecated: true,
46 },
47 {
48 name: 'BRIVEN_JWKS',
49 description: "JSON Web Key Set used to verify JWTs issued by your project's auth server.",
50 isRuntime: false,
51 },
52 {
53 name: 'SB_REGION',
54 description: 'The region the function was invoked in. Set per request.',
55 isRuntime: true,
56 },
57 {
58 name: 'SB_EXECUTION_ID',
59 description: 'A unique identifier for each function instance. Set per request.',
60 isRuntime: true,
61 },
62 {
63 name: 'DENO_DEPLOYMENT_ID',
64 description: 'The version of the function code. Set when the function is deployed.',
65 isRuntime: true,
66 },
67]
68
69const DEFAULT_EDGE_FUNCTION_SECRET_NAMES = new Set(
70 DEFAULT_EDGE_FUNCTION_SECRETS.map((secret) => secret.name)
71)
72
73// Internal secrets are anything reserved by Briven that the user can't manage:
74// either prefixed with BRIVEN_ (enforced by the API) or in the hardcoded
75// list of default secrets above.
76export const isInternalEdgeFunctionSecret = (name: string) =>
77 /^BRIVEN_/.test(name) || DEFAULT_EDGE_FUNCTION_SECRET_NAMES.has(name)
78
79// Picks the default secrets to display: runtime ones are always shown, static
80// BRIVEN_* ones are filtered to those actually present in the API response.
81// If the API returned none of the static defaults (brand-new project state),
82// fall back to showing the full hardcoded list so the page stays educational.
83export const getVisibleDefaultEdgeFunctionSecrets = (apiSecretNames: Set<string>) => {
84 const staticDefaults = DEFAULT_EDGE_FUNCTION_SECRETS.filter((secret) => !secret.isRuntime)
85 const runtimeDefaults = DEFAULT_EDGE_FUNCTION_SECRETS.filter((secret) => secret.isRuntime)
86
87 const presentStaticDefaults = staticDefaults.filter((secret) => apiSecretNames.has(secret.name))
88 const visibleStaticDefaults =
89 presentStaticDefaults.length > 0 ? presentStaticDefaults : staticDefaults
90
91 return [...visibleStaticDefaults, ...runtimeDefaults]
92}