envless-env 0.0.1

data/lib/envless/env/update_notice.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Envless
+  module Env
+    module UpdateNotice
+      HOST = "rubygems.org"
+      PATH = "/api/v1/versions/envless-env/latest.json"
+      CHANGELOG = "https://envless.cloud/docs/pull/ruby#changelog"
+      TIMEOUT = 2
+      LOCK = Mutex.new
+
+      class << self
+        def check
+          Thread.new { announce(latest) } if claim
+          nil
+        end
+
+        def claim
+          LOCK.synchronize do
+            if @checked || disabled?
+              false
+            else
+              @checked = true
+            end
+          end
+        end
+
+        def disabled?
+          !ENV.fetch(Settings::ENV_VARS[:DISABLE_UPDATE_NOTICE], "").empty? || !$stdout.tty?
+        end
+
+        def latest
+          response = Net::HTTP.start(HOST, 443, use_ssl: true, open_timeout: TIMEOUT, read_timeout: TIMEOUT,
+            write_timeout: TIMEOUT) { |http| http.request_get(PATH) }
+          return nil unless response.is_a?(Net::HTTPSuccess)
+
+          version = JSON.parse(response.body.to_s)["version"]
+          version.is_a?(String) ? version : nil
+        rescue
+          nil
+        end
+
+        def announce(latest)
+          return unless latest && newer?(latest, VERSION)
+
+          warn format(Messages::UPDATE_AVAILABLE, latest:, current: VERSION, changelog: CHANGELOG)
+        end
+
+        def newer?(candidate, current)
+          left = parts(candidate)
+          right = parts(current)
+          return false if left.nil? || right.nil?
+
+          (left <=> right) == 1
+        end
+
+        def parts(value)
+          numbers = value.strip.delete_prefix("v").split(".").map { |part| Integer(part, 10, exception: false) }
+          (numbers.size == 3 && numbers.none?(&:nil?)) ? numbers.compact : nil
+        end
+      end
+    end
+  end
+end

data/lib/envless/env/values.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Envless
+  module Env
+    class Values
+      UNSET = Object.new.freeze
+      READABLE = /\A[A-Z][A-Za-z0-9_]*\z/
+
+      include Serialisation
+
+      def initialize(store, optional: false, client: false)
+        @store = store
+        @optional = optional
+        @client = client
+        freeze
+      end
+
+      def [](name)
+        key = name.to_s
+        raise NotLoadedError, Messages::NOT_LOADED unless @store.readable?
+        return absent(key) unless @store.has?(key)
+        raise ServerOnlyError, key unless visible?(key)
+
+        Coerce.call(@store.raw(key).to_s, @store.meta_of(key)[:type])
+      end
+
+      def []=(_name, _value)
+        raise ReadOnlyError
+      end
+
+      def fetch(name, default = UNSET)
+        key = name.to_s
+        return self[key] if key?(key)
+        return yield(key) if block_given?
+        return default unless default.equal?(UNSET)
+
+        raise MissingVariableError, key
+      end
+
+      def key?(name)
+        key = name.to_s
+        @store.readable? && @store.has?(key) && visible?(key)
+      end
+
+      def keys
+        @store.keys.select { |name| visible?(name) }
+      end
+
+      def optional
+        Values.new(@store, optional: true, client: @client)
+      end
+
+      def client
+        Values.new(@store, optional: @optional, client: true)
+      end
+
+      def client?
+        @client
+      end
+
+      def optional?
+        @optional
+      end
+
+      def method_missing(name, *arguments, &block)
+        text = name.to_s
+        return self[text] if arguments.empty? && block.nil? && READABLE.match?(text)
+        raise ReadOnlyError if text.end_with?("=") && READABLE.match?(text.chomp("="))
+
+        super
+      end
+
+      def respond_to_missing?(name, include_private = false)
+        (READABLE.match?(name.to_s) && key?(name)) || super
+      end
+
+      private
+
+      def visible?(name)
+        !@client || @store.meta_of(name)[:visibility] == Settings::VISIBILITY[:CLIENT]
+      end
+
+      def absent(key)
+        return nil if @optional
+
+        raise MissingVariableError, key
+      end
+    end
+  end
+end

data/lib/envless/env/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Envless
+  module Env
+    VERSION = "0.0.1"
+  end
+end

data/lib/envless/env.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "monitor"
+require "net/http"
+require "time"
+require "envless/sdk"
+
+%w[
+  version settings messages errors files binding credentials target keyring api cache cache_writer decryptor
+  injected store environment_writer update_notice loader coerce serialisation values override isolated crypto
+].each { |name| require_relative "env/#{name}" }
+
+module Envless
+  module Env
+    ENCRYPTION_PARAMETERS = Envless::ENCRYPTION_PARAMETERS
+    STORE = Store.new
+    LOADER = Loader.new(STORE, EnvironmentWriter.new)
+    VALUES = Values.new(STORE)
+
+    extend Crypto
+
+    class << self
+      def load(revalidate: false)
+        LOADER.load(revalidate:)
+      end
+
+      def values
+        VALUES
+      end
+
+      def optional
+        VALUES.optional
+      end
+
+      def client
+        VALUES.client
+      end
+
+      def override(values)
+        layer = values.to_h { |name, value| [name.to_s, value.to_s] }.freeze
+        STORE.push(layer)
+        return Override.new(STORE, layer) unless block_given?
+
+        begin
+          yield
+        ensure
+          STORE.pop(layer)
+        end
+      end
+
+      def fetch_environment(token:, project:, environment:, product: nil, passphrase: nil, key: nil, workspace_id: nil,
+        endpoint: nil, adapter: nil)
+        Isolated.call(token:, project:, environment:, product:, passphrase:, key:, workspace_id:, endpoint:, adapter:)
+      end
+    end
+  end
+
+  def self.env
+    Env::VALUES
+  end
+end

data/sig/envless/env/loading.rbs

@@ -0,0 +1,84 @@
+module Envless
+  module Env
+    class Binding < Data
+      attr_reader workspace: String
+      attr_reader product: String?
+      attr_reader project: String
+      attr_reader environments: Array[String]
+
+      def self.new: (workspace: String, product: String?, project: String, environments: Array[String]) -> Binding
+      def self.read: (?String directory) -> Binding?
+      def self.listed?: (untyped environments) -> bool
+    end
+
+    class Target < Data
+      attr_reader workspace: String?
+      attr_reader product: String?
+      attr_reader project: String
+      attr_reader environment: String
+
+      def self.new: (workspace: String?, product: String?, project: String, environment: String) -> Target
+      def self.resolve: (?Binding? binding) -> Target
+    end
+
+    class Keyring
+      PINNED: Regexp
+      DEFAULT_ITERATIONS: Integer
+
+      @key: Envless::WorkspaceKey
+      @passphrase: String?
+      @workspace_id: String?
+
+      def self.from_environment: (Api api) -> Keyring
+      def self.imported: (String raw) -> Keyring
+      def self.derived: (String passphrase, String? workspace_id) -> Keyring
+      def initialize: (Envless::WorkspaceKey key, ?passphrase: String?, ?workspace_id: String?) -> void
+      def decrypt: (String value) -> String
+    end
+
+    class Api
+      FAILURES: Array[singleton(StandardError)]
+
+      @client: Envless::Client
+
+      def initialize: (String token, ?endpoint: String?, ?adapter: Envless::_Adapter?) -> void
+      def workspace_id: () -> String?
+      def variables: (Target target) -> Array[variable]
+      def close: () -> nil
+    end
+
+    module Cache
+      def self?.path: (Target target) -> String?
+      def self?.sanitize: (String slug) -> String
+      def self?.read: (Target target) -> { variables: Array[variable], cached_at: String }?
+      def self?.entry_of: (untyped entry) -> variable?
+      def self?.fresh?: (String cached_at, ?Time now) -> bool
+    end
+
+    module CacheWriter
+      def self?.write: (Target target, Array[variable] variables, ?Time now) -> void
+      def self?.payload: (Target target, Array[variable] variables, Time now) -> Hash[Symbol, untyped]
+      def self?.replace: (String location, String content) -> void
+    end
+
+    module Decryptor
+      class Outcome < Data
+        attr_reader entries: Array[[String, String]]?
+        attr_reader failed: String?
+
+        def self.new: (entries: Array[[String, String]]?, failed: String?) -> Outcome
+      end
+
+      FAILURES: Array[singleton(StandardError)]
+
+      def self?.call: (Array[variable] variables, Keyring keyring) -> Outcome
+      def self?.attempt: (Keyring keyring, String value) -> String?
+    end
+
+    module Isolated
+      def self?.call: (token: String, project: String, environment: String, ?product: String?, ?passphrase: String?, ?key: String?, ?workspace_id: String?, ?endpoint: String?, ?adapter: Envless::_Adapter?) -> Hash[String, String]
+      def self?.decrypted: (Api api, Keyring keyring, String? product, String project, String environment) -> Hash[String, String]
+      def self?.keyring_of: (Api api, String? passphrase, String? key, String? workspace_id) -> Keyring
+    end
+  end
+end

data/sig/envless/env/settings.rbs

@@ -0,0 +1,84 @@
+module Envless
+  module Env
+    module Settings
+      ENV_VARS: { TOKEN: String, KEY: String, PASSPHRASE: String, PRODUCT: String, PROJECT: String, ENV: String, DISABLE_UPDATE_NOTICE: String }
+      MACHINE_TOKEN_PREFIX: String
+      VAR_TYPES: { STRING: String, NUMBER: String, BOOLEAN: String }
+      VISIBILITY: { SERVER: String, CLIENT: String }
+      DEFAULT_TYPE: String
+      DEFAULT_VISIBILITY: String
+      CACHE_MAX_AGE: Integer
+      CACHE_NO_PRODUCT: String
+      CACHE_UNSAFE_CHARACTERS: Regexp
+      CONFIG_DIR: String
+      CONFIG_FILE: String
+      CACHE_DIR: String
+      ENVLESS_FILE: String
+      DIR_MODE: Integer
+      FILE_MODE: Integer
+      PAGE_LIMIT: Integer
+      INJECTED: { NAME: String, TYPE_KEY: String, VISIBILITY_KEY: String }
+      UNSAFE_PROCESS_ENV_NAMES: Array[String]
+      UNSAFE_NAMES: Array[String]
+      USER_AGENT: String
+      LOG_PREFIX: String
+    end
+
+    module Messages
+      TOKEN_MISSING: String
+      TOKEN_NOT_MACHINE: String
+      PROJECT_MISSING: String
+      ENVIRONMENT_MISSING: String
+      KEY_MATERIAL_MISSING: String
+      KEY_INVALID: String
+      WORKSPACE_UNRESOLVED: String
+      FETCH_FAILED: String
+      DECRYPT_FAILED: String
+      NOT_LOADED: String
+      MISSING_VARIABLE: String
+      READ_ONLY: String
+      SERVER_ONLY: String
+      NOT_SERIALISABLE: String
+      UNSAFE_REFUSED: String
+      UNWRITABLE: String
+      ISOLATED_NO_TOKEN: String
+      ISOLATED_NO_TARGET: String
+      ISOLATED_NO_KEY_MATERIAL: String
+      ISOLATED_NO_WORKSPACE: String
+      ISOLATED_DECRYPT_FAILED: String
+      UPDATE_AVAILABLE: String
+    end
+
+    module Files
+      def self?.json: (String path) -> Hash[String, untyped]?
+      def self?.home: () -> String?
+      def self?.config_dir: () -> String?
+      def self?.text?: (untyped value) -> bool
+      def self?.variable: (String name) -> String?
+      def self?.utf8: (String text) -> String
+    end
+
+    module Credentials
+      def self?.token: () -> String?
+      def self?.machine_token: () -> String
+    end
+
+    module UpdateNotice
+      HOST: String
+      PATH: String
+      CHANGELOG: String
+      TIMEOUT: Integer
+      LOCK: Thread::Mutex
+
+      self.@checked: bool
+
+      def self.check: () -> nil
+      def self.claim: () -> bool
+      def self.disabled?: () -> bool
+      def self.latest: () -> String?
+      def self.announce: (String? latest) -> void
+      def self.newer?: (String candidate, String current) -> bool
+      def self.parts: (String value) -> Array[Integer]?
+    end
+  end
+end

data/sig/envless/env/state.rbs

@@ -0,0 +1,70 @@
+module Envless
+  module Env
+    module Injected
+      TYPES: Array[String]
+      VISIBILITIES: Array[String]
+
+      def self?.seed: () -> [Hash[String, String], Hash[String, meta]]?
+      def self?.parse: (String raw) -> untyped
+      def self?.meta_of: (untyped entry) -> meta
+    end
+
+    class Store
+      @values: Hash[String, String]
+      @meta: Hash[String, meta]
+      @overrides: Array[Hash[String, String]]
+      @loaded: bool
+      @injected: bool
+      @seeded: bool
+      @lock: Monitor
+
+      def initialize: () -> void
+      def replace: (Hash[String, String] record, Hash[String, meta] meta) -> void
+      def has?: (String name) -> bool
+      def raw: (String name) -> String?
+      def meta_of: (String name) -> meta
+      def keys: () -> Array[String]
+      def readable?: () -> bool
+      def injected?: () -> bool
+      def snapshot: () -> Hash[String, String]
+      def push: (Hash[String, String] layer) -> void
+      def pop: (Hash[String, String] layer) -> nil
+
+      private
+
+      def guarded: [T] () { () -> T } -> T
+      def default_meta: () -> meta
+      def seed: () -> void
+    end
+
+    class EnvironmentWriter
+      @owned: Array[String]
+
+      def initialize: () -> void
+      def write: (Hash[String, String] record) -> void
+
+      private
+
+      def writable?: (String name, String value) -> bool
+      def report: (Array[String] refused, Array[String] unwritable) -> void
+    end
+
+    class Loader
+      @store: Store
+      @writer: EnvironmentWriter
+      @lock: Thread::Mutex
+      @memo: Hash[String, String]?
+
+      def initialize: (Store store, EnvironmentWriter writer) -> void
+      def load: (?revalidate: bool) -> Hash[String, String]
+
+      private
+
+      def fresh: (bool revalidate) -> Hash[String, String]
+      def from_cache: (Target target, Keyring keyring) -> Hash[String, String]?
+      def fetched: (Api api, Target target, Keyring keyring) -> Hash[String, String]
+      def fetch: (Api api, Target target) -> Array[variable]
+      def finish: (Array[[String, String]] entries, Array[variable] sources) -> Hash[String, String]
+    end
+  end
+end

data/sig/envless/env/types.rbs

@@ -0,0 +1,56 @@
+module Envless
+  module Env
+    module Types
+      class Declared
+        RUBY_TYPES: Hash[String, String]
+        LITERAL: Regexp
+
+        attr_reader name: String
+        attr_reader type: String
+        attr_reader visibility: String
+
+        def self.new: (name: String, type: String, visibility: String) -> instance
+        def self.build: (String name, String? type, String? visibility) -> Declared
+        def self.known: (String? value, Hash[Symbol, String] allowed, String fallback) -> String
+        def self.merged: (Array[Declared] declared) -> Array[Declared]
+        def rbs: (bool optional) -> String
+        def client?: () -> bool
+        def method?: () -> bool
+        def literal?: () -> bool
+      end
+
+      module Collect
+        def self?.call: (?project: String?, ?product: String?, ?env: String?) -> Array[Declared]
+        def self?.from_manifest: () -> Array[Declared]?
+        def self?.from_api: (String token, String project, Array[String] slugs, String? product) -> Array[Declared]
+        def self?.declared: (Api api, Target target) -> Array[Declared]
+        def self?.first: (*String? candidates) -> String?
+        def self?.slugs: (String? value) -> Array[String]?
+      end
+
+      module Render
+        HEADER: Array[String]
+        VIEWS: Hash[String, { client: bool, optional: bool, views: Array[String] }]
+        FALLBACK: String
+
+        def self?.call: (Array[Declared] declared) -> String
+        def self?.untyped: (Array[Declared] entries) -> Array[String]
+        def self?.view: (String name, { client: bool, optional: bool, views: Array[String] } view, Array[Declared] entries) -> Array[String]
+        def self?.index: (Array[Declared] entries, bool optional) -> Array[String]
+      end
+
+      module Command
+        OUTPUT: String
+        PREFIX: String
+        USAGE: String
+        RUN_HINT: String
+
+        def self?.call: (Array[String] arguments, ?out: IO, ?err: IO) -> Integer
+        def self?.parse: (Array[String] arguments) -> Hash[Symbol, untyped]
+        def self?.run: (Hash[Symbol, untyped] options, IO out, IO err) -> Integer
+        def self?.write: (String path, String text, Integer count, bool check, IO out, IO err) -> Integer
+        def self?.report: (IO stream, String message, Integer code) -> Integer
+      end
+    end
+  end
+end

data/sig/envless/env/values.rbs

@@ -0,0 +1,75 @@
+module Envless
+  module Env
+    module Coerce
+      WHITESPACE: String
+      DECIMAL: Regexp
+      INFINITY: Regexp
+      RADIX: Regexp
+      BASES: Hash[String, Integer]
+      TRUE_VALUES: Array[String]
+
+      def self?.call: (String value, String type) -> value
+      def self?.number: (String value) -> (Integer | Float)
+      def self?.trim: (String text) -> String
+      def self?.radix_number: (String digits, Integer base) -> (Integer | Float)
+      def self?.integral: (Float parsed, String text) -> (Integer | Float)
+    end
+
+    interface _View
+      def client?: () -> bool
+      def optional?: () -> bool
+      def keys: () -> Array[String]
+      def []: (String | Symbol name) -> value?
+    end
+
+    module Serialisation : _View
+      def to_h: () -> Hash[String, value?]
+      def snapshot: () -> Hash[String, value?]
+      def as_json: (*untyped) -> Hash[String, value?]
+      def to_json: (*untyped) -> String
+      def marshal_dump: () -> bot
+      def encode_with: (untyped coder) -> bot
+      def dup: () -> self
+      def clone: (?freeze: bool?) -> self
+      def inspect: () -> String
+      def to_s: () -> String
+    end
+
+    class Values
+      UNSET: Object
+      READABLE: Regexp
+
+      include Serialisation
+
+      @store: Store
+      @optional: bool
+      @client: bool
+
+      def initialize: (Store store, ?optional: bool, ?client: bool) -> void
+      def []: (String | Symbol name) -> value?
+      def []=: (String | Symbol name, untyped value) -> bot
+      def fetch: (String | Symbol name, ?untyped default) ?{ (String) -> untyped } -> untyped
+      def key?: (String | Symbol name) -> bool
+      def keys: () -> Array[String]
+      def optional: () -> Values
+      def client: () -> Values
+      def client?: () -> bool
+      def optional?: () -> bool
+      def method_missing: (Symbol name, *untyped arguments) ?{ (*untyped) -> untyped } -> untyped
+      def respond_to_missing?: (Symbol | String name, ?bool include_private) -> bool
+
+      private
+
+      def visible?: (String name) -> bool
+      def absent: (String key) -> nil
+    end
+
+    class Override
+      @store: Store
+      @layer: Hash[String, String]
+
+      def initialize: (Store store, Hash[String, String] layer) -> void
+      def restore: () -> nil
+    end
+  end
+end

data/sig/envless/env.rbs

@@ -0,0 +1,66 @@
+module Envless
+  def self.env: () -> Env::Values
+
+  module Env
+    VERSION: String
+    ENCRYPTION_PARAMETERS: untyped
+    STORE: Store
+    LOADER: Loader
+    VALUES: Values
+
+    type value = String | Integer | Float | bool
+    type meta = { type: String, visibility: String }
+    type variable = { name: String, value: String, type: String?, visibility: String? }
+
+    extend Crypto
+
+    def self.load: (?revalidate: bool) -> Hash[String, String]
+    def self.values: () -> Values
+    def self.optional: () -> Values
+    def self.client: () -> Values
+    def self.override: (Hash[String | Symbol, untyped] values) -> Override
+                     | [T] (Hash[String | Symbol, untyped] values) { () -> T } -> T
+    def self.fetch_environment: (token: String, project: String, environment: String, ?product: String?, ?passphrase: String?, ?key: String?, ?workspace_id: String?, ?endpoint: String?, ?adapter: Envless::_Adapter?) -> Hash[String, String]
+
+    module Crypto
+      def encrypt: (String plaintext, String passphrase, String workspace_unique_id) -> String
+      def decrypt: (String ciphertext, String passphrase, String workspace_unique_id) -> String
+      def encrypt_with_key: (Envless::WorkspaceKey | String key, String plaintext) -> String
+      def decrypt_with_key: (Envless::WorkspaceKey | String key, String ciphertext) -> String
+      def workspace_key: (String passphrase, String workspace_unique_id) -> Envless::WorkspaceKey
+      def import_workspace_key: (String material) -> Envless::WorkspaceKey
+      def passphrase_strength: (untyped passphrase) -> Envless::Validation
+    end
+
+    class Error < Envless::Error
+    end
+
+    class LoadError < Error
+    end
+
+    class NotLoadedError < Error
+    end
+
+    class VariableError < Error
+      attr_reader variable: String
+
+      def initialize: (String variable, String template) -> void
+    end
+
+    class MissingVariableError < VariableError
+      def initialize: (String variable) -> void
+    end
+
+    class ServerOnlyError < VariableError
+      def initialize: (String variable) -> void
+    end
+
+    class ReadOnlyError < Error
+      def initialize: (?String message) -> void
+    end
+
+    class SerialisationError < Error
+      def initialize: (?String message) -> void
+    end
+  end
+end

data/sig/manifest.yaml

@@ -0,0 +1,2 @@
+dependencies:
+  - name: monitor