encrypt_env 1.1.5 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16d031a8da5dcdc509f7248f688d4f9741273a042478210c3840a8e9effa25ce
-  data.tar.gz: 59f6115add313d8989dda0a31c0c4427bda3ccb5b5f0890eeb3ea01d188da46e
+  metadata.gz: 31ee9ab6595f4b030378dbab20064c2a6fbaf78703ceb8d673b6a937d21c5ab0
+  data.tar.gz: b4e53740a417b02fe1b4920609f11b9fedb9d1913b70ab7c0593f67b3599a994
 SHA512:
-  metadata.gz: db4b7762c832b2d5227faec889ba424b9319d670dd7f99ba2bcdd78421bd438627e06c70dda68005f275e35b23e80489995572ce1a13b23cef3815c926bcfbac
-  data.tar.gz: '098cdbf938ce9e556eae215f81fc92e5986bbc35f40ae855075ef7ddf1e95acfdee53fe743f75a98902e6b1d77ad0b34041a45d9451fb6c1833fa0577877cc32'
+  metadata.gz: de90b6a660b19c26bde561133ac8816c06c3b87bb8d3cda02c3ba8cafaf3063e5b4937b50376de233da2a060339cc92a04e4ff8af811e23794a31daf5d75af4d
+  data.tar.gz: 2515b17576ab29ff0a71414c100e23e974029c7c4dccc04c43def34eb761e06cdbbeb7fdac0bd912950b7f7c4b9c4b8c12b0ea690f3459d294f51b070ba9fa0e

data/bin/encrypt_env

@@ -11,13 +11,21 @@ if action == 'setup'
   EncryptEnv.setup
   exit 0
 elsif action == 'show'
-  EncryptEnv.show
+  if argv[0]
+    EncryptEnv.show(argv[0])
+  else
+    EncryptEnv.show
+  end
   exit 0
 elsif action == 'all'
-  EncryptEnv.show_all
+  EncryptEnv.show('all')
   exit 0
 elsif action == 'edit'
-  EncryptEnv.edit
+  if argv[0]
+    EncryptEnv.edit(argv[0])
+  else
+    EncryptEnv.edit
+  end
   exit 0
 elsif ['help', '--help', '-h'].include?(action)
   puts <<~HELP

data/lib/encrypt_env.rb

@@ -8,126 +8,200 @@ require 'tempfile'
 require 'json'
 
 # gem 'encrypt_env'
+# rubocop:disable Metrics/ClassLength
+# rubocop:disable Metrics/MethodLength
 class EncryptEnv
-  private_class_method def self.master_key
-    key = File.read("#{@path_root}/config/master.key").strip
-    [key].pack('H*')
+  private_class_method def self.define_option
+    puts "Options to 'encrypt secrets.yml' file"
+    puts '1. Generate only one master.key and one encrypted file for all environment'
+    puts '2. Generate master.key and encrypted file for each environment'
+
+    loop do
+      @opt = gets.chomp.to_i
+      break if @opt == 1 || @opt == 2
+
+      puts "Please enter '1' or '2'!"
+    end
+
+    puts "Your option is #{@opt}"
+  end
+
+  private_class_method def self.load_curr_opt
+    if File.file?("#{Dir.pwd}/config/secrets.yml.enc")
+      @opt = 1
+    elsif Dir["#{Dir.pwd}/config/secrets_*.yml.enc"].length.positive?
+      @opt = 2
+    else
+      puts 'You must setup first to encrypt file!'
+      exit
+    end
+  end
+
+  private_class_method def self.current_env
+    unless defined?(Rails)
+      env = `rails r "print Rails.env"`
+      return env
+    end
+    Rails.env
+  end
+
+  private_class_method def self.check_key_existence(env = nil)
+    file_name = env.nil? ? 'master.key' : "master_#{env}.key"
+    return if File.file?("#{Dir.pwd}/config/#{file_name}")
+    # return if Dir["#{Dir.pwd}/config/master_*.key"].length.positive? && @opt == 2
+    return if ENV.key?('MASTER_KEY')
+
+    puts 'Please provide master key!'
+    exit
+  end
+
+  private_class_method def self.load_master_key(env = nil)
+    check_key_existence(env)
+    file_path = env ? "#{Dir.pwd}/config/master_#{env}.key" : "#{Dir.pwd}/config/master.key"
+    key = File.file?(file_path) ? File.read(file_path).strip : ENV['MASTER_KEY']
+    @master_key = [key].pack('H*')
   end
 
-  private_class_method def self.data_decrypt(raw_data)
+  private_class_method def self.generate_keys
+    if @opt == 1
+      key = OpenSSL::Random.random_bytes(16)
+      File.open("#{Dir.pwd}/config/master.key", 'w') { |file| file.write(key.unpack('H*')[0]) }
+    else
+      to_hash_type(@content_to_encrypt).each_key do |env|
+        next if env == 'default'
+
+        key = OpenSSL::Random.random_bytes(16)
+        File.open("#{Dir.pwd}/config/master_#{env}.key", 'w') { |file| file.write(key.unpack('H*')[0]) }
+      end
+    end
+  end
+
+  private_class_method def self.load_content_to_encrypt
+    secret_file = File.expand_path("#{Dir.pwd}/config/secrets.yml")
+    @content_to_encrypt = File.read(secret_file)
+  end
+
+  private_class_method def self.to_hash_type(raw_data)
+    HashWithIndifferentAccess.new(YAML.load(raw_data, aliases: true))
+  end
+
+  private_class_method def self.load_encrypted_data(env = nil)
+    file_path = env ? "#{Dir.pwd}/config/secrets_#{env}.yml.enc" : "#{Dir.pwd}/config/secrets.yml.enc"
+    hex_string = File.read(file_path)
+    raw_data = [hex_string].pack('H*')
+
     encrypted = raw_data.slice(0, raw_data.length - 28)
     iv = raw_data.slice(raw_data.length - 28, 12)
     tag = raw_data.slice(raw_data.length - 16, 16)
     { encrypted: encrypted, iv: iv, tag: tag }
   end
 
-  private_class_method def self.encrypt(content)
+  private_class_method def self.encrypt(content, typ = nil)
+    file_path = typ ? "#{Dir.pwd}/config/secrets_#{typ}.yml.enc" : "#{Dir.pwd}/config/secrets.yml.enc"
     cipher = OpenSSL::Cipher.new('aes-128-gcm')
     cipher.encrypt
-    cipher.key = master_key
+    cipher.key = @master_key
     iv = cipher.random_iv
     cipher.auth_data = ''
     encrypted = cipher.update(content) + cipher.final
     tag = cipher.auth_tag
     hex_string = (encrypted + iv + tag).unpack('H*')[0]
-    File.open("#{@path_root}/config/secrets.yml.enc", 'w') { |file| file.write(hex_string) }
+    File.open(file_path, 'w') { |file| file.write(hex_string) }
   end
 
-  private_class_method def self.decrypt
+  private_class_method def self.decrypt(env = nil)
+    load_master_key(env)
+
     decipher = OpenSSL::Cipher.new('aes-128-gcm')
     decipher.decrypt
-    hex_string = File.read("#{@path_root}/config/secrets.yml.enc")
-    data = data_decrypt([hex_string].pack('H*'))
+    data = load_encrypted_data(env)
     encrypted = data[:encrypted]
-    decipher.key = master_key
+    decipher.key = @master_key
     decipher.iv = data[:iv]
     decipher.auth_tag = data[:tag]
     decipher.auth_data = ''
 
-    decipher.update(encrypted) + decipher.final
+    @raw_decrypted = decipher.update(encrypted) + decipher.final
+    @decrypted = to_hash_type(@raw_decrypted)
+  # Catch error if master key is wrong
+  rescue OpenSSL::Cipher::CipherError
+    puts 'Master key is wrong!'
+    exit
   end
 
-  private_class_method def self.path_root
-    @path_root = if defined?(Rails)
-                   Rails.root.to_s
-                 elsif defined?(Bundler)
-                   Bundler.root.to_s
-                 else
-                   Dir.pwd
-                 end
-  end
-
-  def self.setup
-    path_root
-    @secret_file = File.expand_path("#{@path_root}/config/secrets.yml")
-    key = OpenSSL::Random.random_bytes(16)
-    # save key in master.key file
-    File.open("#{@path_root}/config/master.key", 'w') { |file| file.write(key.unpack('H*')[0]) }
-    encrypt(File.read(@secret_file))
-    File.rename(@secret_file, "#{@path_root}/config/secrets.yml.old")
-    system("echo '/config/master.key' >> #{@path_root}/.gitignore")
-    system("echo '/config/secrets.yml.old' >> #{@path_root}/.gitignore")
-    system("echo 'Set up complete!'")
-  end
-
-  def self.edit
-    path_root unless @path_root
-    secrets unless @decrypted
-    Tempfile.create('secrets.yml') do |f|
-      f.write(decrypt)
-      f.flush
-      f.rewind
-      system("vim #{f.path}")
-      encrypt(File.read(f.path))
-      @decrypted = nil
+  private_class_method def self.all_decrypted_object
+    obj = {}
+    env_lst = Dir["#{Dir.pwd}/config/secrets_*.yml.enc"].map do |path|
+      path.scan(/secrets_(.*)\.yml\.enc/).flatten.first
+    end
+    env_lst.each do |e|
+      decrypt(e)
+      obj[e] = @decrypted
     end
+    obj
   end
 
   def self.secrets_all
-    path_root unless @path_root
-    secrets unless @decrypted
+    return all_decrypted_object if @opt == 2
+
+    decrypt
     @decrypted
   end
 
-  def self.secrets
-    @decrypted
+  def self.secrets(env = nil)
+    load_curr_opt unless @opt
+    return secrets_all if env == 'all'
 
-    path_root unless @path_root
-    @decrypted = HashWithIndifferentAccess.new(YAML.load(decrypt, aliases: true))
-    unless defined?(Rails)
-      env = `rails r "print Rails.env"`.to_sym
-      return @decrypted[env] || @decrypted[:default] || @decrypted
+    if @opt == 1
+      decrypt
+      @decrypted[env || current_env]
+    else
+      decrypt(env || current_env)
+      @decrypted
     end
-    @decrypted[Rails.env.to_sym] || @decrypted[:default] || @decrypted
   end
 
-  def self.secrets_production
-    secrets unless @decrypted
-    @decrypted[:production]
-  end
-
-  def self.secrets_development
-    secrets unless @decrypted
-    @decrypted[:development]
-  end
+  def self.setup
+    define_option
+    load_content_to_encrypt
+    generate_keys
+
+    if @opt == 1
+      load_master_key
+      encrypt(@content_to_encrypt)
+    else
+      to_hash_type(@content_to_encrypt).each do |env, value|
+        next if env == 'default'
+
+        load_master_key(env)
+        encrypt(value.to_hash.to_yaml, env)
+      end
+    end
 
-  def self.secrets_test
-    secrets unless @decrypted
-    @decrypted[:test]
+    File.rename("#{Dir.pwd}/config/secrets.yml", "#{Dir.pwd}/config/secrets.yml.old")
+    system("echo '/config/master*.key' >> #{Dir.pwd}/.gitignore")
+    system("echo '/config/secrets.yml.old' >> #{Dir.pwd}/.gitignore")
+    system("echo 'Set up complete!'")
   end
 
-  def self.secrets_staging
-    secrets unless @decrypted
-    @decrypted[:staging]
-  end
+  def self.edit(env = nil)
+    load_curr_opt unless @opt
+    env ||= current_env if @opt == 2
+    return unless decrypt(env)
 
-  def self.show
-    # Pry::ColorPrinter.pp(secrets)
-    jj secrets
+    Tempfile.create("secrets_#{env}.yml") do |f|
+      f.write(@raw_decrypted)
+      f.flush
+      f.rewind
+      system("vim #{f.path}")
+      encrypt(File.read(f.path), env)
+      @decrypted = nil
+    end
   end
 
-  def self.show_all
-    # Pry::ColorPrinter.pp(secrets_all)
-    jj secrets_all
+  def self.show(env = nil)
+    jj secrets(env)
   end
 end
+# rubocop:enable Metrics/ClassLength
+# rubocop:enable Metrics/MethodLength

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: encrypt_env
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.2.0
 platform: ruby
 authors:
 - Nhu Tan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-05 00:00:00.000000000 Z
+date: 2022-08-10 00:00:00.000000000 Z
 dependencies: []
 description: Encrypts and decrypts environment variables
 email: nhutan2001@gmail.com
@@ -39,7 +39,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Ecrypt secrets.yml file