dotenv-vault 0.3.3 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8ab8101dc628ec297e5db57935ab4f3cba02140125730dc153817090e4d4ea1
-  data.tar.gz: 12f52b1034404d78f29b2f5ccb73966e97c638ba54d0a8de38f53d2c86139e2f
+  metadata.gz: e49a9658a64cd656eee7128b70ef2f501e84f5101aafb3aaf54f7de400f0013f
+  data.tar.gz: de8dd440fdaf111b979706f62c27298f9ab7dc5c2f7ec3e875bde992c87c789d
 SHA512:
-  metadata.gz: ec457fde8f33493026d739c3032e22e48d30ba58b36be1638a97eedfb748cda39cafb443d95980778bbb9357c53f752a2f45a96d856585c59a9f63e395e506b4
-  data.tar.gz: cef3ee646ffbd151d32b74dce32dd588c2e346710231f0cef8ac054e2b442ab4d9a37a67e56718b232d14f210db0a55fcbdadf0ae40e8c24307f8a5b8cfa3c79
+  metadata.gz: 6f3529e9e8db857b8c6d439c81ccdde7baeb56852b3e5e5edf0f0e7e1c58e7b8589375022d755d239cc73fb6a5d2146fa468304ce7c2155827a02d956fcd1f9f
+  data.tar.gz: 6b081b51531f776a1136701cb840665959dea167a753a7943cd54679c7693a5b52372a91492ca7ea27aaf6710d95b2c2e9cc485882c41fb6803d7fb33dce0581

data/Gemfile.lock

@@ -1,11 +1,12 @@
 PATH
   remote: .
   specs:
-    dotenv-vault (0.3.3)
+    dotenv-vault (0.4.1)
       dotenv
-    dotenv-vault-rails (0.3.3)
+      lockbox
+    dotenv-vault-rails (0.4.1)
       dotenv-rails
-      dotenv-vault (= 0.3.3)
+      dotenv-vault (= 0.4.1)
 
 GEM
   remote: https://rubygems.org/
@@ -40,6 +41,7 @@ GEM
     erubi (1.11.0)
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
+    lockbox (1.0.0)
     loofah (2.19.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)

data/dotenv-vault.gemspec

@@ -26,6 +26,7 @@ Gem::Specification.new "dotenv-vault" do |spec|
   spec.require_paths = ["lib"]
 
 	spec.add_dependency "dotenv"
+	spec.add_dependency "lockbox"
 
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec"

data/lib/dotenv-vault/rails.rb

@@ -1,3 +1,4 @@
+require "dotenv-rails"
 require "dotenv-vault"
 
 # Fix for rake tasks loading in development
@@ -16,7 +17,7 @@ if defined?(Rake.application)
   end
 end
 
-DotenvVault.instrumenter = ActiveSupport::Notifications
+Dotenv.instrumenter = ActiveSupport::Notifications
 
 # Watch all loaded env files with Spring
 begin
@@ -30,34 +31,13 @@ rescue LoadError, ArgumentError
 end
 
 module DotenvVault
-  class Railtie < Rails::Railtie
+  class Railtie < ::Dotenv::Railtie
     def load
-      Dotenv.load(*dotenv_files)
+      DotenvVault.load(*dotenv_files)
     end
 
     def overload
-      Dotenv.overload(*dotenv_files)
+      DotenvVault.overload(*dotenv_files)
     end
-
-    def root
-      Rails.root || Pathname.new(ENV["RAILS_ROOT"] || Dir.pwd)
-    end
-
-    def self.load
-      instance.load
-    end
-
-    private
-
-    def dotenv_files
-      [
-        root.join(".env.#{Rails.env}.local"),
-        (root.join(".env.local") unless Rails.env.test?),
-        root.join(".env.#{Rails.env}"),
-        root.join(".env")
-      ].compact
-    end
-
-    config.before_configuration { load }
   end
 end

data/lib/dotenv-vault/version.rb

@@ -1,3 +1,3 @@
 module DotenvVault
-  VERSION = "0.3.3"
+  VERSION = "0.4.1"
 end

data/lib/dotenv-vault.rb

@@ -1,8 +1,15 @@
 require "dotenv"
+require "lockbox"
 require "dotenv-vault/version"
 
 module DotenvVault
-  class Error < StandardError; end
+  class NotFoundDotenvKey < ArgumentError; end
+  class NotFoundDotenvEnvironment < ArgumentError; end
+  class NotFoundDotenvVault < ArgumentError; end
+  class InvalidDotenvKey < ArgumentError; end
+  class DecryptionFailed < StandardError; end
+
+  include ::Dotenv
 
   class << self
     attr_accessor :instrumenter
@@ -11,27 +18,47 @@ module DotenvVault
   module_function
 
   def load(*filenames)
-    Dotenv.load(*filenames)
+    if using_vault?
+      load_vault(*filenames)
+    else
+      Dotenv.load(*filenames) # fallback
+    end
   end
 
   # same as `load`, but raises Errno::ENOENT if any files don't exist
   def load!(*filenames)
-    Dotenv.load!(*filenames)
+    if using_vault?
+      load_vault(*filenames)
+    else
+      Dotenv.load!(*filenames)
+    end
   end
 
   # same as `load`, but will override existing values in `ENV`
   def overload(*filenames)
-    Dotenv.overload(*filenames)
+    if using_vault?
+      overload_vault(*filenames)
+    else
+      Dotenv.overload(*filenames)
+    end
   end
 
   # same as `overload`, but raises Errno:ENOENT if any files don't exist
   def overload!(*filenames)
-    Dotenv.overload!(*filenames)
+    if using_vault?
+      overload_vault(*filenames)
+    else
+      Dotenv.overload!(*filenames)
+    end
   end
 
   # returns a hash of parsed key/value pairs but does not modify ENV
   def parse(*filenames)
-    Dotenv.parse(*filenames)
+    if using_vault?
+      parse_vault(*filenames)
+    else
+      Dotenv.parse(*filenames)
+    end
   end
 
   # Internal: Helper to expand list of filenames.
@@ -52,4 +79,75 @@ module DotenvVault
   def ignoring_nonexistent_files
     Dotenv.ignoring_nonexistent_files
   end
+
+  # Vault: Load from .env.vault
+  #
+  # Decrypts and loads to ENV
+  def load_vault(*filenames)
+    parsed = parse_vault(*filenames)
+    
+    # Set ENV
+    parsed.each { |k, v| ENV[k] ||= v }
+
+    { parsed: parsed }
+  end
+
+  # Vault: Overload from .env.vault
+  #
+  # Decrypts and overloads to ENV
+  def overload_vault(*filenames)
+    parsed = parse_vault(*filenames)
+    
+    # Set ENV
+    parsed.each { |k, v| ENV[k] = v }
+
+    { parsed: parsed }
+  end
+
+  def parse_vault(*filenames)
+    # Warn the developer unless both are set
+    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(ENV["DOTENV_KEY"])
+    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot find ENV['DOTENV_ENVIRONMENT']" unless present?(ENV["DOTENV_ENVIRONMENT"])
+
+    # Locate .env.vault
+    vault_path = ".env.vault"
+    raise NotFoundDotenvVault, "NotFoundDotenvVault: Cannot find .env.vault at ${vaultPath}" unless File.file?(vault_path)
+
+    # Parse .env.vault
+    parsed = Dotenv.parse(vault_path)
+
+    # Get ciphertext
+    environment_key = "DOTENV_VAULT_#{ENV["DOTENV_ENVIRONMENT"].upcase}"
+    ciphertext = parsed[environment_key] # DOTENV_VAULT_PRODUCTION
+    raise NotFoundDotenvEnvironment, "NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate #{environment_key} in .env.vault" unless ciphertext
+
+    # Decrypt ciphertext
+    decrypted = decrypt(ciphertext)
+
+    # Parse decrypted .env string
+    Dotenv::Parser.call(decrypted, true)
+  end
+
+  def using_vault?
+    present?(ENV["DOTENV_ENVIRONMENT"]) && present?(ENV["DOTENV_KEY"])
+  end
+
+  def present?(str)
+    !(str.nil? || str.empty?)
+  end
+
+  def decrypt(ciphertext)
+    raise NotFoundDotenvKey, "NOT_FOUND_DOTENV_KEY: Cannot find ENV['DOTENV_KEY']" unless present?(ENV["DOTENV_KEY"])
+
+    key = ENV["DOTENV_KEY"][-64..-1] # last 64 characters. allows for passing keys with preface like key_*****
+
+    raise InvalidDotenvKey, "INVALID_DOTENV_KEY: It must be 64 characters long (or more)" unless key.to_s.length == 64
+
+    lockbox = Lockbox.new(key: key, encode: true)
+    begin
+      lockbox.decrypt(ciphertext)
+    rescue Lockbox::Error
+      raise DecryptionFailed, "DECRYPTION_FAILED: Please check your DOTENV_KEY"
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dotenv-vault
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.1
 platform: ruby
 authors:
 - motdotla
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-09-15 00:00:00.000000000 Z
+date: 2022-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: lockbox
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement