Protecting Data

const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager');
const sm = new SecretsManagerClient({});

function cachedSecret(secretId, ttlMs = 5 * 60 * 1000) {
  let value = null, fetchedAt = 0, inflight = null;
  return async function get() {
    if (value && Date.now() - fetchedAt < ttlMs) return value;

    // Shorthand: `inflight ??= expr` is exactly `inflight = inflight ?? expr`,
    // which collapses a thundering herd of concurrent refreshes into one call.
    inflight ??= sm.send(new GetSecretValueCommand({ SecretId: secretId })).then(
      r => { value = JSON.parse(r.SecretString); fetchedAt = Date.now(); inflight = null; return value; },
      e => { inflight = null; if (value) return value; throw e; } // serve stale rather than fail
    );
    return inflight;
  };
}

const dbCreds = cachedSecret(process.env.DB_SECRET_ARN);

async function connect() {
  // Read at connect time, not at boot. Rotation changes the password while the
  // process is alive; a credential captured once in a module-level const is the
  // reason your service dies four hours after a successful rotation.
  const { username, password } = await dbCreds();
  return pool.connect({ user: username, password });
}

// An erasure request, handled in three parts because deleting the row is only one.
const { ScheduleKeyDeletionCommand } = require('@aws-sdk/client-kms');

async function eraseSubject(subjectId) {
  // 1. The copies you own and can write to.
  await db.none('DELETE FROM profiles WHERE subject_id = $1', [subjectId]);

  // 2. The per-subject data key. Once destroyed, every ciphertext copy of that
  //    subject's fields is undecryptable: last month's backup, the warehouse
  //    extract, the WORM archive. You cannot rewrite those; you do not need to.
  await kms.send(new ScheduleKeyDeletionCommand({
    KeyId: await keyArnFor(subjectId),
    PendingWindowInDays: 7   // 7 is the minimum, 30 the maximum — deletion is never instant
  }));

  // 3. The derived copies, by hand, because nothing fans the delete out for you.
  await Promise.all([
    redis.del(`profile:${subjectId}`),
    search.deleteDocument({ index: 'profiles', id: subjectId }),
    warehouse.enqueueTombstone(subjectId)  // last night's export already shipped
  ]);
}

// Personal data escapes through logs far more often than through the database:
// one `log.info({ req })` and a header lands in a third-party log search index.
const pino = require('pino');

const log = pino({
  redact: {
    paths: [
      'req.headers.authorization',
      'req.headers.cookie',
      'body.password',
      'body.national_id',
      'user.email',
      '*.card_number'          // any parent object, but exactly one level deep:
                               // body.card_number yes, body.payment.card_number no
    ],
    censor: '[redacted]'
  }
});

// Redact centrally, not per call site: call sites are written by people who do
// not know what is in the object they are passing.
log.info({ tenant: req.user.tenant, route: '/checkout', ms: 142, status: 402 }, 'payment declined');

// What is left is still everything you need to debug: tenant, route, latency,
// outcome. If you need the identity, log the subject id and join it later.