Security performance
Production operation

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager'; const secretsClient = new SecretsManagerClient({ region: 'ap-northeast-1' }); async function getHubSpotToken() { const command = new GetSecretValueCommand({ SecretId: 'prod/hubspot/access-token', }); const response = await secretsClient.send(command); return JSON.parse(response.SecretString).HUBSPOT_ACCESS_TOKEN; } // Use caching to avoid requesting the secret manager every time let tokenCache = { value: null, fetchedAt: 0 }; const TOKEN_TTL = 10 * 60 * 1000; // 10 minute cache async function getCachedToken() { if (tokenCache.value && Date.now() - tokenCache.fetchedAt < TOKEN_TTL) { return tokenCache.value; } tokenCache.value = await getHubSpotToken(); tokenCache.fetchedAt = Date.now(); return tokenCache.value; }

class HubSpotApiError extends Error { constructor(status, message, body) { super(message); this.status = status; this.body = body; this.name = 'HubSpotApiError'; } get isRetryable() { return [429, 500, 502, 503, 504].includes(this.status); } get isTokenError() { return this.status === 401; } } async function hubspotRequest(fn, { maxRetries = 4, onRetry } = {}) { for (let attempt = 0; attempt < maxRetries; attempt++) { try { return await fn(); } catch (err) { const status = err.response?.status ?? 0; const apiErr = new HubSpotApiError(status, err.message, err.response?.data); if (!apiErr.isRetryable || attempt === maxRetries - 1) { // structured log console.error(JSON.stringify({ level: 'error', service: 'hubspot', status, message: err.message, attempt: attempt + 1, ts: new Date().toISOString(), })); throw apiErr; } const retryAfter = err.response?.headers['retry-after']; const delay = retryAfter ? parseInt(retryAfter) * 1000 : Math.min(Math.pow(2, attempt) * 1000, 32000); // max 32 seconds onRetry?.({ attempt, delay, status }); console.warn(`Retry ${attempt + 1}/${maxRetries} in ${delay}ms (status: ${status})`); await new Promise(r => setTimeout(r, delay)); } } }

import pLimit from 'p-limit'; import Bottleneck from 'bottleneck'; // npm install bottleneck // Limit to 80 requests per 10 seconds with Bottleneck (buffer reserved at 80% of 100) const limiter = new Bottleneck({ reservoir: 80, // initial number of tokens reservoirRefreshAmount: 80, // replenishment amount reservoirRefreshInterval: 10000, // Replenish every 10 seconds maxConcurrent: 5, // Number of concurrent executions minTime: 100, // Minimum interval between requests (ms) }); // rate-limited API call wrapper const rateLimitedCall = (fn) => limiter.schedule(fn); // Usage example: efficiently retrieve 1000 contacts in parallel const fetchWithRateLimit = async (ids) => { const results = await Promise.all( ids.map(id => rateLimitedCall(() => client.crm.contacts.basicApi.getById(id, ['email', 'firstname']) )) ); return results; };

import { createLogger, transports, format } from 'winston'; import { Counter, Histogram } from 'prom-client'; // Prometheus const logger = createLogger({ format: format.combine(format.timestamp(), format.json()), transports: [new transports.Console()], }); // Prometheus metrics definition const apiCallCounter = new Counter({ name: 'hubspot_api_calls_total', help: 'Total HubSpot API calls', labelNames: ['method', 'endpoint', 'status'], }); const apiDurationHistogram = new Histogram({ name: 'hubspot_api_duration_seconds', help: 'HubSpot API call duration', labelNames: ['endpoint'], buckets: [0.1, 0.5, 1, 2, 5], }); // API wrapper with metrics async function trackedApiCall(endpoint, fn) { const endTimer = apiDurationHistogram.startTimer({ endpoint }); try { const result = await fn(); apiCallCounter.inc({ endpoint, status: 'success' }); logger.info({ msg: 'api_call_success', endpoint }); return result; } catch (err) { const status = err.status ?? 'unknown'; apiCallCounter.inc({ endpoint, status: String(status) }); logger.error({ msg: 'api_call_error', endpoint, status, error: err.message }); throw err; } finally { endTimer(); } }

import express from 'express'; const app = express(); // /health — For monitoring the load balancer's health app.get('/health', (req, res) => { res.status(200).json({ status: 'ok', timestamp: new Date().toISOString() }); }); // /readiness — Details including HubSpot connection app.get('/readiness', async (req, res) => { try { // Confirm communication with HubSpot (using lightweight endpoint) await client.crm.properties.coreApi.getAll('contacts'); res.status(200).json({ status: 'ready', hubspot: 'connected' }); } catch (err) { res.status(503).json({ status: 'not_ready', hubspot: 'disconnected', error: err.message }); } }); // /metrics — for Prometheus scrape app.get('/metrics', async (req, res) => { res.set('Content-Type', 'text/plain'); res.send(await register.metrics()); });