Security & Credential Management

import crypto from 'crypto';

function generateWebhookSecret() {
  return crypto.randomBytes(32).toString('base64');
}

async function getAccessToken(customerId, source) {
  // Check in-memory cache first
  const cached = accessTokenCache.get(`${source}:${customerId}`);
  if (cached && cached.expiresAt > Date.now()) {
    return cached.token;
  }

  // Refresh from the refresh token
  const refreshToken = await secretsManager.get(`${source}/${env}/${customerId}/refresh_token`);
  const fresh = await refreshAccessToken(source, refreshToken);

  accessTokenCache.set(`${source}:${customerId}`, {
    token: fresh.access_token,
    expiresAt: Date.now() + fresh.expires_in * 1000,
  });

  // If the refresh returned a new refresh token (some OAuth flows rotate them), store it
  if (fresh.refresh_token && fresh.refresh_token !== refreshToken) {
    await secretsManager.set(`${source}/${env}/${customerId}/refresh_token`, fresh.refresh_token);
  }

  return fresh.access_token;
}

try {
  const token = await getAccessToken(customerId, 'mailchimp');
  await callMailchimp(token, ...);
} catch (err) {
  if (err.code === 'invalid_grant' || err.code === 'unauthorized') {
    await alertCustomer(customerId, 'Mailchimp access has been revoked. Re-authorize to resume sync.');
    await pauseCustomerSync(customerId);
  }
  throw err;
}

// Use a fetch implementation that rejects invalid certificates
// (this is the default for Node.js fetch and most other runtimes;
// don't override it)

// ❌ Bad — logs donor PII
console.log(`Synced contact: ${donor.email} ${donor.firstName} ${donor.lastName}`);

// ✅ Good — logs identifiers only
console.log('Synced contact', {
  virtuous_contact_id: contact.id,
  partner_id: donor.platformId,
});

// ❌ Bad — error path includes the full request body
catch (err) {
  console.error('Request failed', {
    body: requestBody,                       // includes donor PII
    error: err.message,
  });
}