feat: authenticate to Redis via AWS ElastiCache secret (Secrets Manager)

[pratapalakshmi]

Context

The silo app (plane-ee/apps/silo) authenticates to AWS ElastiCache by reading an ELASTICACHE_SECRET_ARN, fetching the secret JSON from AWS Secrets Manager, and using the REDIS_AUTH_TOKEN (plus host/port) it contains to connect — refreshing on a timer so rotated tokens are picked up without a restart.

This PR brings the same pattern to iframely so the same AWS secret can be reused. It builds on the existing "Plane fork extension" env-var layer (config.loader.js) and the pluggable Redis cache engine (lib/cache-engines/redis.js).

What changed

• lib/aws-secrets.js (new) — Port of silo's aws-secrets.ts. getSecret(arn, region, forceRefresh) does a TTL-cached GetSecretValueCommand, lazy-importing @aws-sdk/client-secrets-manager so non-AWS deployments never load it.
• lib/cache-engines/redis.js (reworked) — When ELASTICACHE_SECRET_ARN is set, fetches the auth token (and optionally host/port) from Secrets Manager and injects it into the connection options. A .unref()'d background timer re-fetches every AWS_SECRET_CACHE_TTL seconds and rebuilds + swaps the client when the token rotates (handles live rotation despite iframely's single long-lived client). set/get are unchanged.
• package.json — adds @aws-sdk/client-secrets-manager (lazy-imported).
• Docs — config.local.js.SAMPLE, docs/SETUP.md, and the config.loader.js env-var header document the new variables.

Behavior

• Existing config / IFRAMELY_REDIS_HOST/PORT/TLS take precedence for host/port/TLS; only the auth token is always taken from the secret.
• TLS is honored via IFRAMELY_REDIS_TLS, not forced on (differs from silo's always-rediss://).
• Standard + cluster both supported. Cluster injects the token into redisOptions.auth_pass/password (redis-clustr@1.7.0 → node_redis v2).
• Secret-key names are configurable and default to match silo (REDIS_AUTH_TOKEN / REDIS_HOST / REDIS_PORT).
• AWS credentials use the SDK default chain (IRSA / Pod Identity / static keys / IMDS).

New env vars

Var	Purpose	Default
ELASTICACHE_SECRET_ARN	Secrets Manager ARN with Redis creds; enables the feature	(unset)
AWS_REGION	Region for Secrets Manager	us-east-1
AWS_SECRET_CACHE_TTL	Secret cache + refresh interval (seconds)	300
REDIS_AUTH_TOKEN_KEY	JSON key for the auth token	REDIS_AUTH_TOKEN
REDIS_HOST_KEY	JSON key for host	REDIS_HOST
REDIS_PORT_KEY	JSON key for port	REDIS_PORT

Testing

• node --check on all modified files (ESM + top-level await) — clean.
• Confirmed redis-clustr@1.7.0 → node_redis v2 auth key (auth_pass, with password alias) from the published package.
• 13 unit assertions on the buildOptions merge logic (secret-only, config-wins, no-ARN regression, cluster, partial-secret, TLS-not-forced) — all pass.
• Full runtime verification (live Redis + AWS) should be run in the deployment env: regression with no ARN, standard connect with ARN, and rotation by lowering AWS_SECRET_CACHE_TTL.

🤖 Generated with Claude Code