envless-sdk 0.0.1

data/lib/envless/sdk/resources/webhooks.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Envless
+  module Resources
+    class Webhooks < Resource
+      def list(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil)
+        page(PATHS[:WEBHOOKS], COLLECTIONS[:WEBHOOKS], Listing.of(limit:, offset:, search:, order:, product:), timeout)
+      end
+
+      def list_all(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil)
+        all(PATHS[:WEBHOOKS], COLLECTIONS[:WEBHOOKS], Listing.of(limit:, offset:, search:, order:, product:), timeout)
+      end
+
+      def iterate(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil, &block)
+        each_item(PATHS[:WEBHOOKS], COLLECTIONS[:WEBHOOKS], Listing.of(limit:, offset:, search:, order:, product:),
+          timeout, &block)
+      end
+
+      def get(id, timeout: nil)
+        request(Paths.webhook_path(id), timeout:)
+      end
+
+      def create(body = nil, timeout: nil, **fields)
+        request(PATHS[:WEBHOOKS], method: HTTP_METHODS[:POST], body: body_of(body, fields), timeout:)
+      end
+
+      def update(id, patch = nil, timeout: nil, **fields)
+        request(Paths.webhook_path(id), method: HTTP_METHODS[:PATCH], body: body_of(patch, fields), timeout:)
+      end
+
+      def delete(id, timeout: nil)
+        request(Paths.webhook_path(id), method: HTTP_METHODS[:DELETE], timeout:)
+      end
+
+      def rotate_secret(id, timeout: nil)
+        request("#{Paths.webhook_path(id)}/#{SEGMENTS[:ROTATE]}", method: HTTP_METHODS[:POST], timeout:)
+      end
+
+      def list_event_types(timeout: nil)
+        request(PATHS[:WEBHOOK_EVENT_TYPES], timeout:)
+      end
+    end
+  end
+end

data/lib/envless/sdk/resources/workspace.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Envless
+  module Resources
+    class Workspace < Resource
+      attr_reader :domain
+
+      def initialize(transport)
+        @domain = WorkspaceDomain.new(transport)
+        super
+      end
+
+      def get(timeout: nil)
+        request(PATHS[:WORKSPACE], timeout:)
+      end
+
+      def update(patch = nil, timeout: nil, **fields)
+        request(PATHS[:WORKSPACE], method: HTTP_METHODS[:PATCH], body: body_of(patch, fields), timeout:)
+      end
+
+      def delete(timeout: nil)
+        request(PATHS[:WORKSPACE], method: HTTP_METHODS[:DELETE], timeout:)
+      end
+    end
+  end
+end

data/lib/envless/sdk/resources/workspace_domain.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Envless
+  module Resources
+    class WorkspaceDomain < Resource
+      def get(timeout: nil)
+        domain_of(request(PATHS[:WORKSPACE_DOMAIN], timeout:))
+      end
+
+      def claim(hostname, timeout: nil)
+        domain_of(request(PATHS[:WORKSPACE_DOMAIN], method: HTTP_METHODS[:POST], body: {"hostname" => hostname},
+          timeout:))
+      end
+
+      def verify(reattempt: false, timeout: nil)
+        domain_of(request(PATHS[:WORKSPACE_DOMAIN_VERIFY], method: HTTP_METHODS[:POST],
+          body: {"reattempt" => reattempt == true}, timeout:))
+      end
+
+      def remove(timeout: nil)
+        request(PATHS[:WORKSPACE_DOMAIN], method: HTTP_METHODS[:DELETE], timeout:)
+      end
+
+      private
+
+      def domain_of(data)
+        data.is_a?(Hash) ? data[:domain] : nil
+      end
+    end
+  end
+end

data/lib/envless/sdk/resources/workspaces.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Envless
+  module Resources
+    class Workspaces < Resource
+      def list(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil)
+        page(PATHS[:WORKSPACES], COLLECTIONS[:WORKSPACES], Listing.of(limit:, offset:, search:, order:, product:), timeout)
+      end
+
+      def list_all(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil)
+        all(PATHS[:WORKSPACES], COLLECTIONS[:WORKSPACES], Listing.of(limit:, offset:, search:, order:, product:), timeout)
+      end
+
+      def iterate(limit: nil, offset: nil, search: nil, order: nil, product: nil, timeout: nil, &block)
+        each_item(PATHS[:WORKSPACES], COLLECTIONS[:WORKSPACES], Listing.of(limit:, offset:, search:, order:, product:),
+          timeout, &block)
+      end
+
+      def create(body = nil, timeout: nil, **fields)
+        request(PATHS[:WORKSPACES], method: HTTP_METHODS[:POST], body: body_of(body, fields), timeout:)
+      end
+    end
+  end
+end

data/lib/envless/sdk/results.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Envless
+  Page = Data.define(:items, :pagination)
+
+  class Page
+    def has_more?
+      Wire.truthy?(pagination[:hasMore])
+    end
+
+    def total_count
+      pagination[:totalCount]
+    end
+  end
+
+  ProductAccessPage = Data.define(:items, :pagination, :is_private)
+
+  class ProductAccessPage
+    def private?
+      is_private
+    end
+
+    def has_more?
+      Wire.truthy?(pagination[:hasMore])
+    end
+
+    def total_count
+      pagination[:totalCount]
+    end
+  end
+
+  Validation = Data.define(:valid, :error)
+
+  class Validation
+    def valid?
+      valid
+    end
+  end
+
+  RotationIssue = Data.define(:scope, :id, :field, :reason)
+
+  RotationResult = Data.define(:variables, :version_entries, :skipped, :failures)
+end

data/lib/envless/sdk/retry_policy.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Envless
+  module RetryPolicy
+    MILLISECONDS = 1000.0
+
+    module_function
+
+    def retry_after_of(header)
+      header.nil? ? Float::NAN : Numbers.js_number(header)
+    end
+
+    def delay(status, verb, attempt, max_retries, retry_after)
+      return nil if attempt >= max_retries
+      return nil unless Constants::RETRYABLE_STATUSES.include?(status) && Constants::RETRYABLE_METHODS.include?(verb)
+
+      asked = retry_after.finite? && retry_after.positive?
+      wait = asked ? retry_after * MILLISECONDS : (1 << (attempt + 1)) * Constants::RETRY[:BASE_BACKOFF_MS]
+
+      [wait, Constants::RETRY[:MAX_BACKOFF_MS]].min / MILLISECONDS
+    end
+
+    def settle(verb, attempt, max_retries, response)
+      envelope = Envelope.read(response.status, response.reason, response.body)
+      return Reply.new(data: envelope[:data]) if Envelope.success?(response.status, envelope)
+
+      retry_after = retry_after_of(response.header(Constants::HEADER_KEYS[:RETRY_AFTER]))
+      wait = delay(response.status, verb, attempt, max_retries, retry_after)
+      raise Envelope.api_error(response.status, response.headers, envelope, retry_after) if wait.nil?
+
+      wait
+    end
+  end
+
+  Reply = Data.define(:data)
+end

data/lib/envless/sdk/rotation/entry_rotator.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Envless
+  module Rotation
+    class EntryRotator
+      SCOPE = Constants::ROTATION_SCOPES[:VERSION_ENTRY]
+      FIELDS = Constants::ROTATION_FIELDS
+
+      def initialize(client, ring, ledger, scope, product)
+        @client = client
+        @ring = ring
+        @ledger = ledger
+        @scope = scope
+        @product = product
+      end
+
+      def rotate(batch)
+        rewritten = batch.filter_map { |entry| attempt(entry) }
+        rewritten.empty? ? 0 : write(rewritten)
+      end
+
+      private
+
+      def attempt(entry)
+        rotated(entry)
+      rescue => error
+        @ledger.failed(SCOPE, Ledger.identifier(entry), error)
+        nil
+      end
+
+      def write(rewritten)
+        project, environment = @scope
+        result = @client.versions.reencrypt_entries(project, environment, rewritten, product: @product)
+        updated = result.is_a?(Hash) ? result[:updated] : nil
+        updated.is_a?(Integer) ? updated : 0
+      rescue => error
+        rewritten.each { |written| @ledger.failed(SCOPE, written[:id], error) }
+        0
+      end
+
+      def rotated(entry)
+        id = Ledger.identifier(entry)
+        value = entry[:value]
+        return strand(entry, id) unless Wire.truthy?(value) && @ledger.rotatable?(SCOPE, id, FIELDS[:VALUE], value)
+
+        sealed = @ring.rotate(value)
+        default = entry[:defaultValue]
+        rotatable = Wire.truthy?(default) && @ledger.rotatable?(SCOPE, id, FIELDS[:DEFAULT_VALUE], default)
+
+        {id:, value: sealed, defaultValue: rotatable ? @ring.rotate(default) : nil}
+      end
+
+      def strand(entry, id)
+        default = entry[:defaultValue]
+        field = FIELDS[:DEFAULT_VALUE]
+        @ledger.stranded(SCOPE, id, field) if Wire.truthy?(default) && @ledger.rotatable?(SCOPE, id, field, default)
+        nil
+      end
+    end
+  end
+end

data/lib/envless/sdk/rotation/key_ring.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Envless
+  module Rotation
+    class KeyRing
+      def initialize(workspace_unique_id, current, following)
+        @workspace = workspace_unique_id
+        @current = current
+        @following = following
+        @opening = {}
+        @sealing = nil
+      end
+
+      def rotate(value)
+        plaintext = Crypto::Cipher.decrypt(opening_key(Crypto::Envelope.parse(value).iterations), value)
+        Crypto::Cipher.encrypt_with_key(sealing_key, plaintext)
+      end
+
+      private
+
+      def opening_key(iterations)
+        @opening[iterations] ||= if iterations.nil?
+          Crypto::Keys.derive_workspace_key(@current, @workspace)
+        else
+          Crypto::Keys.derive_key(@current, Crypto::Keys.workspace_salt(@workspace), iterations)
+        end
+      end
+
+      def sealing_key
+        @sealing ||= Crypto::Keys.derive_workspace_key(@following, @workspace)
+      end
+    end
+  end
+end

data/lib/envless/sdk/rotation/ledger.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Envless
+  module Rotation
+    class Ledger
+      def initialize
+        @skipped = []
+        @failures = []
+      end
+
+      def rotatable?(scope, id, field, value)
+        return true if Crypto::Values.ciphertext?(value)
+
+        @skipped << RotationIssue.new(scope:, id:, field:, reason: Constants::ROTATION_MESSAGES[:NOT_CIPHERTEXT])
+        false
+      end
+
+      def stranded(scope, id, field)
+        @failures << RotationIssue.new(scope:, id:, field:, reason: Constants::ROTATION_MESSAGES[:DEFAULT_STRANDED])
+      end
+
+      def failed(scope, id, error)
+        @failures << RotationIssue.new(scope:, id:, field: nil, reason: error.message)
+      end
+
+      def result(variables, version_entries)
+        RotationResult.new(variables:, version_entries:, skipped: @skipped.dup, failures: @failures.dup)
+      end
+
+      def self.identifier(item)
+        id = item.is_a?(Hash) ? item[:id] : nil
+        id.is_a?(String) ? id : ""
+      end
+    end
+  end
+end

data/lib/envless/sdk/rotation/runner.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Envless
+  module Rotation
+    class Runner
+      def initialize(client:, workspace_unique_id:, from:, to:, project:, environment:, product: nil)
+        ring = KeyRing.new(workspace_unique_id, from, to)
+        @client = client
+        @following = to
+        @scope = [project, environment]
+        @product = product
+        @ledger = Ledger.new
+        @variables = VariableRotator.new(client, ring, @ledger, product)
+        @entries = EntryRotator.new(client, ring, @ledger, @scope, product)
+      end
+
+      def run
+        strength = Crypto::Passphrase.strength(@following)
+        raise ArgumentError, format(CryptoMessages::WEAK_ROTATION, error: strength.error) unless strength.valid?
+
+        project, environment = @scope
+        variables = @client.variables.list_all(project, environment, product: @product)
+        entries = @client.versions.list_all_entries(project, environment, product: @product)
+        batches = entries.each_slice(Constants::REENCRYPT_BATCH_SIZE).to_a
+
+        rotated, version_entries = totals(variables, batches)
+        @ledger.result(rotated, version_entries)
+      end
+
+      private
+
+      def totals(variables, batches)
+        rotated = 0
+        version_entries = 0
+
+        [variables.size, batches.size].max.times do |index|
+          rotated += @variables.rotate(variables.fetch(index)) if index < variables.size
+          version_entries += @entries.rotate(batches.fetch(index)) if index < batches.size
+        end
+
+        [rotated, version_entries]
+      end
+    end
+  end
+end

data/lib/envless/sdk/rotation/variable_rotator.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Envless
+  module Rotation
+    class VariableRotator
+      SCOPE = Constants::ROTATION_SCOPES[:VARIABLE]
+      FIELDS = [Constants::ROTATION_FIELDS[:VALUE], Constants::ROTATION_FIELDS[:DEFAULT_VALUE]].freeze
+
+      def initialize(client, ring, ledger, product)
+        @client = client
+        @ring = ring
+        @ledger = ledger
+        @product = product
+      end
+
+      def rotate(variable)
+        rotated(variable)
+      rescue => error
+        @ledger.failed(SCOPE, Ledger.identifier(variable), error)
+        0
+      end
+
+      private
+
+      def rotated(variable)
+        id = Ledger.identifier(variable)
+        patch = FIELDS.filter_map do |field|
+          value = variable[field.to_sym]
+          [field.to_sym, @ring.rotate(value)] if Wire.truthy?(value) && @ledger.rotatable?(SCOPE, id, field, value)
+        end
+        return 0 if patch.empty?
+
+        @client.variables.update_by_id(id, product: @product, **patch.to_h)
+        1
+      end
+    end
+  end
+end

data/lib/envless/sdk/text.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Envless
+  module Text
+    BYTE_ORDER_MARK = ""
+    HTTP_WHITESPACE = " \t\r\n"
+    JS_WHITESPACE = [0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x20, 0xA0, 0x1680, *(0x2000..0x200A).to_a, 0x2028, 0x2029, 0x202F,
+      0x205F, 0x3000, 0xFEFF].pack("U*").freeze
+    JS_TRIM = /\A[#{Regexp.escape(JS_WHITESPACE)}]+|[#{Regexp.escape(JS_WHITESPACE)}]+\z/
+    HTTP_TRIM = /\A[ \t\r\n]+|[ \t\r\n]+\z/
+    TOKEN = /\A[\x21-\x7e]+\z/
+    HEADER_VALUE = /\A[\x20-\x7e]*\z/
+    TRANSCODABLE = [Encoding::UTF_8, Encoding::BINARY, Encoding::US_ASCII].freeze
+
+    module_function
+
+    def utf8(text)
+      converted = if TRANSCODABLE.include?(text.encoding)
+        text.dup.force_encoding(Encoding::UTF_8)
+      else
+        text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
+      end
+
+      converted.valid_encoding? ? converted : converted.scrub
+    end
+
+    def strict(text, name)
+      raise ArgumentError, format(CryptoMessages::TEXT_SHAPE, name:) unless text.is_a?(String)
+
+      converted = TRANSCODABLE.include?(text.encoding) ? text.dup.force_encoding(Encoding::UTF_8) : text.encode(Encoding::UTF_8)
+      raise ArgumentError, format(CryptoMessages::UTF8_SHAPE, name:) unless converted.valid_encoding?
+
+      converted
+    rescue EncodingError
+      raise ArgumentError, format(CryptoMessages::UTF8_SHAPE, name:)
+    end
+
+    def decode(bytes)
+      utf8(bytes.b).delete_prefix(BYTE_ORDER_MARK)
+    end
+
+    def js_trim(text)
+      utf8(text).gsub(JS_TRIM, "")
+    end
+
+    def http_trim(text)
+      utf8(text).gsub(HTTP_TRIM, "")
+    end
+
+    def token?(text)
+      TOKEN.match?(text)
+    end
+
+    def header_value?(text)
+      HEADER_VALUE.match?(text)
+    end
+
+    def utf16_units(text)
+      utf8(text).codepoints.flat_map do |point|
+        next [point] if point < 0x10000
+
+        offset = point - 0x10000
+        [0xD800 + (offset >> 10), 0xDC00 + (offset & 0x3FF)]
+      end
+    end
+
+    def utf16_length(text)
+      utf8(text).codepoints.sum { |point| (point < 0x10000) ? 1 : 2 }
+    end
+  end
+end

data/lib/envless/sdk/transport.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Envless
+  class Transport
+    attr_reader :base_url, :max_retries, :timeout, :user_agent
+
+    def initialize(token:, base_url:, adapter: nil, max_retries: nil, timeout: nil, user_agent: nil,
+      disable_update_notice: false)
+      @token = token
+      @base_url = Urls.valid_base_url(base_url)
+      @max_retries = Options.valid_retries(max_retries)
+      @timeout = timeout.nil? ? Defaults::TIMEOUT : Options.valid_timeout(timeout)
+      @user_agent = Options.user_agent(user_agent)
+      @owned = adapter ? nil : NetHttpAdapter.new
+      @adapter = @owned || Options.adapter(adapter)
+      UpdateNotice.check unless disable_update_notice
+      freeze
+    end
+
+    def request(path, method: Constants::HTTP_METHODS[:GET], query: nil, body: nil, timeout: nil)
+      verb = Options.verb(method)
+      url = Urls.build_url(@base_url, path, query)
+      content = body.nil? ? nil : Wire.encode(body)
+      seconds = timeout.nil? ? @timeout : Options.valid_timeout(timeout)
+      outbound = HttpRequest.new(method: verb, url:, headers: headers(!content.nil?), body: content, timeout: seconds)
+      attempt = 0
+
+      loop do
+        outcome = RetryPolicy.settle(verb, attempt, @max_retries, Exchange.call(@adapter, outbound, seconds, @base_url))
+        return outcome.data if outcome.is_a?(Reply)
+
+        attempt += 1
+        pause(outcome)
+      end
+    end
+
+    def close
+      @owned&.close
+      nil
+    end
+
+    def inspect
+      "#<#{self.class.name} base_url=#{@base_url.inspect}>"
+    end
+
+    private
+
+    def headers(with_body)
+      headers = {
+        Constants::HEADER_KEYS[:AUTHORIZATION] => "Bearer #{@token}",
+        Constants::HEADER_KEYS[:ACCEPT] => Constants::CONTENT_TYPES[:JSON],
+        Constants::HEADER_KEYS[:USER_AGENT] => @user_agent
+      }
+      headers[Constants::HEADER_KEYS[:CONTENT_TYPE]] = Constants::CONTENT_TYPES[:JSON] if with_body
+      headers
+    end
+
+    def pause(seconds)
+      sleep(seconds)
+    end
+  end
+end

data/lib/envless/sdk/update_notice.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Envless
+  module UpdateNotice
+    @checked = false
+    @lock = Mutex.new
+
+    class << self
+      def check
+        return nil unless claim
+
+        Thread.new { announce }
+        nil
+      end
+
+      def claim
+        @lock.synchronize do
+          wanted = !@checked && !disabled?
+          @checked = true
+          wanted
+        end
+      end
+
+      def disabled?
+        !ENV.fetch(Defaults::UPDATE_NOTICE_ENV_DISABLE, "").empty? || !$stdout.tty?
+      rescue IOError, NoMethodError
+        true
+      end
+
+      def announce
+        latest = latest_version
+        warn(notice(latest)) if latest && newer?(latest, VERSION)
+      rescue
+        nil
+      end
+
+      def latest_version
+        seconds = Defaults::UPDATE_NOTICE_TIMEOUT
+        response = Net::HTTP.start(Defaults::UPDATE_NOTICE_HOST, 443, use_ssl: true, open_timeout: seconds,
+          read_timeout: seconds, write_timeout: seconds) { |http| http.request_get(Defaults::UPDATE_NOTICE_PATH) }
+        return nil unless response.is_a?(Net::HTTPSuccess)
+
+        version = JSON.parse(response.body.to_s)["version"]
+        version.is_a?(String) ? version : nil
+      end
+
+      def newer?(candidate, current)
+        left = parts(candidate)
+        right = parts(current)
+        return false if left.nil? || right.nil?
+
+        (left <=> right) == 1
+      end
+
+      def parts(value)
+        numbers = value.to_s.strip.delete_prefix("v").split(".").map { |part| Integer(part, 10, exception: false) }
+        (numbers.size == 3 && numbers.none?(&:nil?)) ? numbers.compact : nil
+      end
+
+      def notice(latest)
+        format(Messages::UPDATE_AVAILABLE, icon: Defaults::UPDATE_NOTICE_ICON, package: Defaults::UPDATE_NOTICE_PACKAGE,
+          latest:, current: VERSION, command: Defaults::UPDATE_NOTICE_COMMAND, changelog: Defaults::UPDATE_NOTICE_CHANGELOG_URL)
+      end
+    end
+  end
+end