Azure Secrets Exposure

// VULNERABLE - Hardcoded Azure credentials
const { DefaultAzureCredential, ClientSecretCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");

// Never hardcode these!
const TENANT_ID = "72f988bf-86f1-41af-91ab-2d7cd011eb47";
const CLIENT_ID = "ad7e1c3a-c8ae-4bc5-b461-f495c6c5b1a2";
const CLIENT_SECRET = "8Q~.vR3fakeSecretHereXAMPLE123456";

// Hardcoded storage account key
const STORAGE_CONNECTION_STRING = "DefaultEndpointsProtocol=https;AccountName=mystorageaccount;AccountKey=lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0JQV4f9WhvYgPxCPKH8SOQPSXQJmYL5xYFsx2cXtwFakeKey==;EndpointSuffix=core.windows.net";

// Hardcoded CosmosDB key
const cosmosConfig = {
    endpoint: "https://myaccount.documents.azure.com:443/",
    key: "C0sm0sDBFakeKeyHereXAMPLEKEY123456789==",
    database: "production"
};

const credential = new ClientSecretCredential(TENANT_ID, CLIENT_ID, CLIENT_SECRET);

// SECURE - Using managed identity and Key Vault
const { DefaultAzureCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");

// Use managed identity (no credentials needed)
const credential = new DefaultAzureCredential();

// Retrieve secrets from Key Vault
const keyVaultUrl = process.env.KEY_VAULT_URL;
const secretClient = new SecretClient(keyVaultUrl, credential);

async function getStorageConnectionString() {
    const secret = await secretClient.getSecret("storage-connection-string");
    return secret.value;
}

async function getCosmosDBConfig() {
    const endpoint = process.env.COSMOS_ENDPOINT;
    const keySecret = await secretClient.getSecret("cosmos-key");
    
    return {
        endpoint: endpoint,
        key: keySecret.value,
        database: process.env.DATABASE_NAME
    };
}

// Use environment variables for non-sensitive config
const config = {
    tenantId: process.env.AZURE_TENANT_ID,
    subscriptionId: process.env.AZURE_SUBSCRIPTION_ID
};