dotenv-vault 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a75c615d4948134bc23799924f8f1b5784024f84215fc561d92b6acb81fde35d
-  data.tar.gz: bad69794d2daf690dfb4d5362af5ef1cdf9e617b9e6685fcbc74e196db474c63
+  metadata.gz: 43532f3eb3ddc9a9b407131c2961446cf58664e34e5bcc763efc516d9b0143cb
+  data.tar.gz: b0a76f6e83ddd50fd3525976fffe0c09c759a91286120266ca7396e3b636095c
 SHA512:
-  metadata.gz: 5b50a15ed04b0feb1109df7f816b1158b95317d79e3b82f8a284c53909d8e36257f7721f66449230208de25cd614225678c513817c70b915f83019d7a564ce5f
-  data.tar.gz: eb6e961c7dee465f749316cb57afb4615bdc7c35427fb00cfe85b7b2059a4c8e4ac3bf3770c199e8c635a3aa28584c4cf733cc140a35cdc0b7b8325cc0bed08c
+  metadata.gz: e01b952fbf0d9de42f8cb35a7ab622ba95bfb85bb53685712340500524c472895d01c42d3c22ff16796526b29b7c6584777b2170629b0f093fd3188ee907da25
+  data.tar.gz: cdabb9c5af4aa7ecfdc3797fa91cc15452497b85184c25709fa3e853adcadc826c2a1aaf01526a8ff0c86a93d3576179e7f5fc7c37d4913647f7aef0e95c4fcb

data/Gemfile.lock

@@ -1,11 +1,12 @@
 PATH
   remote: .
   specs:
-    dotenv-vault (0.3.2)
+    dotenv-vault (0.4.0)
       dotenv
-    dotenv-vault-rails (0.3.2)
+      lockbox
+    dotenv-vault-rails (0.4.0)
       dotenv-rails
-      dotenv-vault (= 0.3.2)
+      dotenv-vault (= 0.4.0)
 
 GEM
   remote: https://rubygems.org/
@@ -40,6 +41,7 @@ GEM
     erubi (1.11.0)
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
+    lockbox (1.0.0)
     loofah (2.19.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)

data/dotenv-vault.gemspec

@@ -26,6 +26,7 @@ Gem::Specification.new "dotenv-vault" do |spec|
   spec.require_paths = ["lib"]
 
 	spec.add_dependency "dotenv"
+	spec.add_dependency "lockbox"
 
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec"

data/lib/dotenv-vault/rails.rb

@@ -1,4 +1,4 @@
-require "dotenv-rails"
+require "dotenv-vault"
 
 # Fix for rake tasks loading in development
 #
@@ -16,7 +16,7 @@ if defined?(Rake.application)
   end
 end
 
-DotenvVault.instrumenter = ActiveSupport::Notifications
+Dotenv.instrumenter = ActiveSupport::Notifications
 
 # Watch all loaded env files with Spring
 begin
@@ -30,34 +30,13 @@ rescue LoadError, ArgumentError
 end
 
 module DotenvVault
-  class Railtie < Rails::Railtie
+  class Railtie < ::Dotenv::Railtie
     def load
-      Dotenv.load(*dotenv_files)
+      DotenvVault.load(*dotenv_files)
     end
 
     def overload
-      Dotenv.overload(*dotenv_files)
+      DotenvVault.overload(*dotenv_files)
     end
-
-    def root
-      Rails.root || Pathname.new(ENV["RAILS_ROOT"] || Dir.pwd)
-    end
-
-    def self.load
-      instance.load
-    end
-
-    private
-
-    def dotenv_files
-      [
-        root.join(".env.#{Rails.env}.local"),
-        (root.join(".env.local") unless Rails.env.test?),
-        root.join(".env.#{Rails.env}"),
-        root.join(".env")
-      ].compact
-    end
-
-    config.before_configuration { load }
   end
 end

data/lib/dotenv-vault/version.rb

@@ -1,3 +1,3 @@
 module DotenvVault
-  VERSION = "0.3.2"
+  VERSION = "0.4.0"
 end

data/lib/dotenv-vault.rb

@@ -1,8 +1,15 @@
 require "dotenv"
+require "lockbox"
 require "dotenv-vault/version"
 
 module DotenvVault
-  class Error < StandardError; end
+  class NotFoundDotenvKey < ArgumentError; end
+  class NotFoundDotenvEnvironment < ArgumentError; end
+  class NotFoundDotenvVault < ArgumentError; end
+  class InvalidDotenvKey < ArgumentError; end
+  class DecryptionFailed < StandardError; end
+
+  include ::Dotenv
 
   class << self
     attr_accessor :instrumenter
@@ -11,27 +18,47 @@ module DotenvVault
   module_function
 
   def load(*filenames)
-    Dotenv.load(*filenames)
+    if using_vault?
+      load_vault(*filenames)
+    else
+      Dotenv.load(*filenames) # fallback
+    end
   end
 
   # same as `load`, but raises Errno::ENOENT if any files don't exist
   def load!(*filenames)
-    Dotenv.load!(*filenames)
+    if using_vault?
+      load_vault(*filenames)
+    else
+      Dotenv.load!(*filenames)
+    end
   end
 
   # same as `load`, but will override existing values in `ENV`
   def overload(*filenames)
-    Dotenv.overload(*filenames)
+    if using_vault?
+      overload_vault(*filenames)
+    else
+      Dotenv.overload(*filenames)
+    end
   end
 
   # same as `overload`, but raises Errno:ENOENT if any files don't exist
   def overload!(*filenames)
-    Dotenv.overload!(*filenames)
+    if using_vault?
+      overload_vault(*filenames)
+    else
+      Dotenv.overload!(*filenames)
+    end
   end
 
   # returns a hash of parsed key/value pairs but does not modify ENV
   def parse(*filenames)
-    Dotenv.parse(*filenames)
+    if using_vault?
+      parse_vault(*filenames)
+    else
+      Dotenv.parse(*filenames)
+    end
   end
 
   # Internal: Helper to expand list of filenames.
@@ -52,4 +79,75 @@ module DotenvVault
   def ignoring_nonexistent_files
     Dotenv.ignoring_nonexistent_files
   end
+
+  # Vault: Load from .env.vault
+  #
+  # Decrypts and loads to ENV
+  def load_vault(*filenames)
+    parsed = parse_vault(*filenames)
+    
+    # Set ENV
+    parsed.each { |k, v| ENV[k] ||= v }
+
+    { parsed: parsed }
+  end
+
+  # Vault: Overload from .env.vault
+  #
+  # Decrypts and overloads to ENV
+  def overload_vault(*filenames)
+    parsed = parse_vault(*filenames)
+    
+    # Set ENV
+    parsed.each { |k, v| ENV[k] = v }
+
+    { parsed: parsed }
+  end
+
+  def parse_vault(*filenames)
+    # Warn the developer unless both are set
+    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(ENV["DOTENV_KEY"])
+    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot find ENV['DOTENV_ENVIRONMENT']" unless present?(ENV["DOTENV_ENVIRONMENT"])
+
+    # Locate .env.vault
+    vault_path = ".env.vault"
+    raise NotFoundDotenvVault, "NotFoundDotenvVault: Cannot find .env.vault at ${vaultPath}" unless File.file?(vault_path)
+
+    # Parse .env.vault
+    parsed = Dotenv.parse(vault_path)
+
+    # Get ciphertext
+    environment_key = "DOTENV_VAULT_#{ENV["DOTENV_ENVIRONMENT"].upcase}"
+    ciphertext = parsed[environment_key] # DOTENV_VAULT_PRODUCTION
+    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate #{environment_key} in .env.vault" unless ciphertext
+
+    # Decrypt ciphertext
+    decrypted = decrypt(ciphertext)
+
+    # Parse decrypted .env string
+    Dotenv::Parser.call(decrypted, true)
+  end
+
+  def using_vault?
+    present?(ENV["DOTENV_ENVIRONMENT"]) && present?(ENV["DOTENV_KEY"])
+  end
+
+  def present?(str)
+    !(str.nil? || str.empty?)
+  end
+
+  def decrypt(ciphertext)
+    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(ENV["DOTENV_KEY"])
+
+    key = ENV["DOTENV_KEY"][-64..-1] # last 64 characters. allows for passing keys with preface like key_*****
+
+    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: It must be 64 characters long (or more)" unless key.to_s.length == 64
+
+    lockbox = Lockbox.new(key: key, encode: true)
+    begin
+      lockbox.decrypt(ciphertext)
+    rescue Lockbox::Error
+      raise DecryptionFailed, "DECRYPTION_FAILED: Please check your DOTENV_KEY"
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dotenv-vault
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - motdotla
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-09-15 00:00:00.000000000 Z
+date: 2022-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: lockbox
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement