<commit_before>require "securerandom"
require "yaml"

class Secrets

  KMS_KEYRING = "keyring"

  SECRETS_DIR = "secrets"
  VALUES_DIR = "values"

  SECRETS_FILE = "secrets.yaml"

  FORBIDDEN_SECRETS = ["project_id", "serviceaccount_key", "default_dir", "secrets_dir", "values_dir", "env"]

  # This method is looking for SECRETS_FILE files in module directories (modules/*), which should have the following structure:
  #
  # secrets:
  #  - module_secret
  #  - module_another_secret
  #  - module_and_one_more_secret
  # encryption_key: default
  #
  # Attribute "encryption_key" is optional – if not present, module name will be used as Key name
  # After collecting, it returns the Hash with collected secrets, where the keys are KMS Encryption Keys and the values are
  # lists of individual credentials (e.g. couchdb_password) managed with that KMS Encryption Key
  #
  # We advice to use prefix with module name for every secret (e.g. couchdb_admin_password instead of just <PASSWORD>_password)
  # to avoid collisions, since secrets scope is global
  def self.collect_secrets()
    ENV['TF_VAR_keyring_name'] = Secrets::KMS_KEYRING

    encryption_keys = []
    collected_secrets = {}
    secrets_to_modules = {}

    Dir["../../modules/**/#{Secrets::SECRETS_FILE}"].each do |module_secrets_file|
      module_name = File.basename(File.dirname(module_secrets_file))
      module_secrets = YAML.load(File.read(module_secrets_file))

      encryption_key = module_secrets['encryption_key'] ? module_secrets['encryption_key'] : module_name
      encryption_keys << %Q|"#{encryption_key}"|

      if collected_secrets[encryption_key]
        collected_secrets[encryption_key].concat(module_secrets['secrets'])
      else
        collected_secrets[encryption_key] = module_secrets['secrets']
      end
      module_secrets['secrets'].each do |secret_name|
        if Secrets::FORBIDDEN_SECRETS.include? secret_name
          raise "ERROR: Can not use secret with name '#{secret_name}' for module '#{module_name}'!\n \
            Secret name '#{secret_name}' is forbidden!"
        elsif secrets_to_modules.include? secret_name
          raise "ERROR: Can not use secret with name '#{secret_name}' for module '#{module_name}'!\n \
            Secret '#{secret_name}' is already in use by module '#{secrets_to_modules[secret_name]}'!"
        end
        ENV["TF_VAR_#{secret_name}"] = ""<commit_msg>Updating Secrets constant name<commit_after>require "securerandom"
require "yaml"

class Secrets

  KMS_KEYRING = "keyring"

  SECRETS_DIR = "secrets"
  VALUES_DIR = "values"

  SECRETS_FILE = "secrets.yaml"

  FORBIDDEN_SECRET_NAMES = ["project_id", "serviceaccount_key", "default_dir", "secrets_dir", "values_dir", "env"]

  # This method is looking for SECRETS_FILE files in module directories (modules/*), which should have the following structure:
  #
  # secrets:
  #  - module_secret
  #  - module_another_secret
  #  - module_and_one_more_secret
  # encryption_key: default
  #
  # Attribute "encryption_key" is optional – if not present, module name will be used as Key name
  # After collecting, it returns the Hash with collected secrets, where the keys are KMS Encryption Keys and the values are
  # lists of individual credentials (e.g. couchdb_password) managed with that KMS Encryption Key
  #
  # We advice to use prefix with module name for every secret (e.g. couchdb_admin_password instead of just admin_password)
  # to avoid collisions, since secrets scope is global
  def self.collect_secrets()
    ENV['TF_VAR_keyring_name'] = Secrets::KMS_KEYRING

    encryption_keys = []
    collected_secrets = {}
    secrets_to_modules = {}

    Dir["../../modules/**/#{Secrets::SECRETS_FILE}"].each do |module_secrets_file|
      module_name = File.basename(File.dirname(module_secrets_file))
      module_secrets = YAML.load(File.read(module_secrets_file))

      encryption_key = module_secrets['encryption_key'] ? module_secrets['encryption_key'] : module_name
      encryption_keys << %Q|"#{encryption_key}"|

      if collected_secrets[encryption_key]
        collected_secrets[encryption_key].concat(module_secrets['secrets'])
      else
        collected_secrets[encryption_key] = module_secrets['secrets']
      end
      module_secrets['secrets'].each do |secret_name|
        if Secrets::FORBIDDEN_SECRET_NAMES.include? secret_name
          raise "ERROR: Can not use secret with name '#{secret_name}' for module '#{module_name}'!\n \
            Secret name '#{secret_name}' is forbidden!"
        elsif secrets_to_modules.include? secret_name
          raise "ERROR: Can not use secret with name '#{secret_name}' for module '#{module_name}'!\n \
            Secret '#{secret_name}' is already in use by module '#{secrets_to_modules[secret_name]}'!"
        end
        ENV["TF_VAR_#{secret_name}"] = ""
{'fraction_non_alphanumeric': 0.10314830157415078, 'fraction_numerical': 0.0, 'mean_word_length': 4.051255230125523, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '481455', 'n_tokens_mistral': 1557, 'n_tokens_neox': 1492, 'n_words': 389}