Add "delete secret" command (so I can clean up mispelled keys)

apps/cli/src/cli-controller/secrets.ts

@@ -13,6 +13,15 @@ export const addSecretCommands = (ctx: Context, cli: Command) => {
     })
     .description('secrets management commands');
 
+  cmd
+    .command('delete')
+    .description('delete a secret')
+    .argument('<string>', 'secret key name')
+    .action(async (key: string) => {
+      const vault = await getSecretsVault(ctx.file);
+      await commands.deleteSecret(vault, key);
+    });
+
   cmd
     .command('get')
     .description('get a secret value')

packages/secrets/src/commands/delete-secret.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+
+import { createInMemorySecretsVault } from '../lib';
+import { getSecretKeyList } from './get-secret-key-list';
+import { deleteSecret } from './delete-secret';
+
+const getTestVault = (vaultData: any) => {
+  const result = createInMemorySecretsVault(JSON.stringify(vaultData));
+  if (result.success) {
+    return result.data;
+  } else {
+    throw new Error('Error creating in-memory test vault');
+  }
+};
+
+describe('delete-secret command', () => {
+  it('removes key', async () => {
+    const vault = getTestVault({
+      'secret-key-1': 'value-1',
+    });
+    await deleteSecret(vault, 'secret-key-1');
+    expect(await vault.getSecretKeys()).toEqual([]);
+  });
+
+  it('silently handles non-existent keys', async () => {
+    const vault = getTestVault({});
+    await deleteSecret(vault, 'secret-key-1');
+    expect(await vault.getSecretKeys()).toEqual([]);
+  });
+});

packages/secrets/src/commands/delete-secret.ts

@@ -0,0 +1,5 @@
+import type { SecretKey, SecretsVault } from '../lib/types';
+
+export const deleteSecret = async (vault: SecretsVault, key: SecretKey) => {
+  return await vault.deleteSecret(key);
+};

packages/secrets/src/commands/index.ts

@@ -1,3 +1,4 @@
+export { deleteSecret } from './delete-secret';
 export { getSecret } from './get-secret';
 export { getSecrets } from './get-secrets';
 export { getSecretKeyList } from './get-secret-key-list';

packages/secrets/src/lib/adapters/aws-param-store.ts

@@ -1,16 +1,31 @@
 import {
-  SSMClient,
-  GetParameterCommand,
-  GetParametersCommand,
-  PutParameterCommand,
+  DeleteParameterCommand,
   DescribeParametersCommand,
   DescribeParametersCommandOutput,
+  GetParameterCommand,
+  GetParametersCommand,
   ParameterNotFound,
+  PutParameterCommand,
+  SSMClient,
 } from '@aws-sdk/client-ssm';
 
 import type { SecretKey, SecretMap, SecretValue, SecretsVault } from '../types';
 
 export class AWSParameterStoreSecretsVault implements SecretsVault {
+  async deleteSecret(key: SecretKey) {
+    const client = new SSMClient();
+    try {
+      await client.send(
+        new DeleteParameterCommand({
+          Name: key,
+        })
+      );
+      console.log(`Secret "${key}" deleted successfully.`);
+    } catch (error) {
+      console.warn('Skipped deleting parameter due to error:', error);
+    }
+  }
+
   async getSecret(key: SecretKey) {
     const client = new SSMClient();
 

packages/secrets/src/lib/adapters/in-memory.ts

@@ -3,6 +3,10 @@ import type { SecretMap, SecretsVault } from '../types';
 export class InMemorySecretsVault implements SecretsVault {
   constructor(private secretMap: SecretMap) {}
 
+  async deleteSecret(key: string) {
+    delete this.secretMap[key];
+  }
+
   async getSecret(key: string) {
     return this.secretMap[key];
   }

packages/secrets/src/lib/types.ts

@@ -26,6 +26,7 @@ export const getSecretMapFromJsonString = (
 };
 
 export interface SecretsVault {
+  deleteSecret(key: SecretKey): Promise<void>;
   getSecret(key: SecretKey): Promise<SecretValue>;
   getSecrets(keys: SecretKey[]): Promise<SecretMap>;
   setSecret(key: SecretKey, value: SecretValue): Promise<void>;