feat(data-plane): add signed managed writer bindings

services/external-data-plane/src/config.mjs

@@ -1,14 +1,54 @@
 import { readFileSync } from "node:fs";
+import {
+  loadManagedProvisionerPublicKeyFile,
+  validateManagedProvisionerAudience,
+  validateManagedProvisionerIdentity,
+} from "./managed-provisioner-auth.mjs";
 
 export function readConfig(env = process.env) {
   const provisionerApiEnabled = boolean(env.EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED, false);
+  const managedProvisionerApiEnabled = boolean(env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED, false);
+  const managedProvisionerMaxSkewSeconds = integer(
+    env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_MAX_SKEW_SECONDS,
+    60,
+    5,
+    300,
+  );
   const config = {
     port: integer(env.PORT, 18106, 1, 65535),
     databaseUrl: required(env.EXTERNAL_DATA_PLANE_DATABASE_URL, "EXTERNAL_DATA_PLANE_DATABASE_URL"),
     databasePoolSize: integer(env.EXTERNAL_DATA_PLANE_DATABASE_POOL_SIZE, 10, 1, 50),
     internalAccessToken: optional(env.NODEDC_INTERNAL_ACCESS_TOKEN),
     provisionerApiEnabled,
+    managedProvisionerApiEnabled,
     provisionerAccessToken: provisionerApiEnabled ? secretFile(env.EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE) : "",
+    managedProvisionerPublicKey: managedProvisionerApiEnabled
+      ? loadManagedProvisionerPublicKeyFile(env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE)
+      : null,
+    managedProvisionerServiceId: managedProvisionerApiEnabled
+      ? validateManagedProvisionerIdentity(
+        required(env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID, "EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID"),
+        "service_id",
+      )
+      : "",
+    managedProvisionerKeyId: managedProvisionerApiEnabled
+      ? validateManagedProvisionerIdentity(
+        required(env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID, "EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID"),
+        "key_id",
+      )
+      : "",
+    managedProvisionerAudience: managedProvisionerApiEnabled
+      ? validateManagedProvisionerAudience(
+        required(env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE, "EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE"),
+      )
+      : "",
+    managedProvisionerMaxSkewMs: managedProvisionerMaxSkewSeconds * 1000,
+    managedProvisionerReplayCacheMaxEntries: integer(
+      env.EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_REPLAY_CACHE_MAX_ENTRIES,
+      10_000,
+      100,
+      100_000,
+    ),
     rawRetentionDays: integer(env.EXTERNAL_DATA_PLANE_RAW_RETENTION_DAYS, 14, 1, 3650),
     maxBatchBytes: integer(env.EXTERNAL_DATA_PLANE_MAX_BATCH_BYTES, 5 * 1024 * 1024, 1024, 50 * 1024 * 1024),
     maxFactsPerPublish: integer(env.EXTERNAL_DATA_PLANE_MAX_FACTS_PER_PUBLISH, 5000, 1, 100_000),