localvault 1.12.3 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6798f21f6875910fa68c5300a929b4c18e757a9c03251cd71d46bb46e6cd85b7
-  data.tar.gz: a40a445f7d92baad0645bc9ab2f2a900bda43d09a657e07735c565bb5f705f01
+  metadata.gz: 2f77c11508eef73c90760e5a927201f6735a16d836e6890161e89a497e28d917
+  data.tar.gz: 15400be786d2ba53112d1b6b48a1de5bd0518903e5578c859677ec68320f2b8b
 SHA512:
-  metadata.gz: 45cf703a841eedc73c9b77ac19a92059075dd914c4c1075ff79beca784b61fce4396ffbf51b206315f55c6179c44270d3238a6174c479bc1a2e9e1e9bf4e34d7
-  data.tar.gz: 661933cfaa2a6f1a69a5459f0e87580912178e1faeeff0becf7823e4fbb007fa63fad8cfa2f7a05d363146309e20ef1ad4b316143d94a541ba1efb78ae3aa340
+  metadata.gz: c8fcd7235f9e330cdf7cf2c17528849f7b64b4388e865351ab53c1758b3390d32dd638c2c21e7ba24ff18e7d9c63e7c5e0bd2c66efa87792380d9d8ef12b61b7
+  data.tar.gz: c8491e0b0fcb2e588080496254b4fa04195859ad81d7ce66c38d4e13116d20374fa9f96668cc18cf8dc2a0830affb58ea59df84ed6eb1531c817942f364c54e3

data/lib/localvault/cli/rails_import.rb

@@ -0,0 +1,58 @@
+module LocalVault
+  class CLI
+    # Finds a Rails app's credentials keys so they can be stored in the vault
+    # and injected as RAILS_MASTER_KEY instead of living in a file.
+    #
+    # Reads only. Removing the key files is the operator's call — this reports
+    # what is still on disk and leaves it alone.
+    class RailsImport
+      Key = Struct.new(:environment, :path, :vault_key, :value, keyword_init: true)
+
+      MASTER_KEY_PATH = "config/master.key".freeze
+      CREDENTIALS_PATH = "config/credentials.yml.enc".freeze
+
+      def initialize(root = Dir.pwd)
+        @root = root
+      end
+
+      def rails_app?
+        File.exist?(File.join(@root, CREDENTIALS_PATH)) ||
+          File.exist?(File.join(@root, MASTER_KEY_PATH)) ||
+          Dir.exist?(File.join(@root, "config/credentials"))
+      end
+
+      # Every key file this app has: the default master key plus one per
+      # environment (config/credentials/production.key).
+      def keys
+        [master_key, *environment_keys].compact
+      end
+
+      private
+
+      def master_key
+        path = File.join(@root, MASTER_KEY_PATH)
+        return nil unless File.exist?(path)
+
+        value = File.read(path).strip
+        return nil if value.empty?
+
+        Key.new(environment: nil, path: MASTER_KEY_PATH, vault_key: "rails.master_key", value: value)
+      end
+
+      def environment_keys
+        Dir.glob(File.join(@root, "config/credentials/*.key")).sort.filter_map do |path|
+          environment = File.basename(path, ".key")
+          value = File.read(path).strip
+          next if value.empty?
+
+          Key.new(
+            environment: environment,
+            path: "config/credentials/#{environment}.key",
+            vault_key: "rails.#{environment}_key",
+            value: value
+          )
+        end
+      end
+    end
+  end
+end

data/lib/localvault/cli.rb

@@ -116,14 +116,14 @@ module LocalVault
     # disappearing from help.
     HELP_SECTIONS = [
       ["GETTING STARTED",                                       %w[login config init demo]],
-      ["SECRETS",                                               %w[set get show reveal groups list delete import env exec]],
+      ["SECRETS",                                               %w[set get show reveal groups list delete import env exec rails]],
       ["VAULT MANAGEMENT",                                      %w[vaults switch rekey unlock lock reset rename copy]],
       ["SYNC  (requires localvault login)",                     %w[sync]],
       ["TEAM SHARING  (requires localvault login)",             %w[dashboard verify add remove team]],
       ["KEYS  (X25519 identity for vault sharing)",             %w[keys identity]],
       ["AI / MCP",                                              %w[install-mcp mcp guard]],
       ["LEGACY SHARING  (pre-v1.2 direct share, still works)",  %w[keygen share receive revoke]],
-      ["OTHER",                                                 %w[logout version doctor help]]
+      ["OTHER",                                                 %w[logout version doctor upgrade help]]
     ].freeze
 
     # One row per plain command; registered subcommands (sync, team, keys,
@@ -807,6 +807,7 @@ module LocalVault
     require_relative "cli/sync"
     require_relative "cli/guard"
     require_relative "cli/identity_cmd"
+    require_relative "cli/rails_import"
 
     # Thor 1.5 injects a `tree` command into every class. Inside a namespace it
     # lists under a name that isn't even callable (`identity_command tree`), and
@@ -1649,6 +1650,121 @@ module LocalVault
       end
     end
 
+    desc "rails", "Import a Rails app's credentials keys into the vault"
+    long_desc <<~DESC
+      Store this Rails app's credentials keys in the vault so you can run it
+      with no key file on disk. Rails reads ENV["RAILS_MASTER_KEY"] whenever
+      config/master.key is absent, so injecting that one variable is enough.
+
+\x05    localvault rails                  # import config/master.key (and per-env keys)
+\x05    localvault rails --check          # show what would be imported
+
+      Then run your app with the key injected, never written anywhere:
+
+\x05    localvault exec --profile rails -- bin/rails server
+\x05    localvault exec --profile rails -- bin/rails credentials:edit
+
+      For a per-environment key (config/credentials/production.key), map it —
+      Rails reads no variable other than RAILS_MASTER_KEY:
+
+\x05    localvault exec --map rails.production_key=RAILS_MASTER_KEY -- bin/rails console
+
+      Key files are left exactly as they are. Deleting them is your call.
+    DESC
+    method_option :check, type: :boolean, default: false, desc: "List what would be imported without writing"
+    def rails
+      importer = RailsImport.new
+      unless importer.rails_app?
+        abort_with "No Rails app here — expected config/credentials.yml.enc or config/master.key in #{Dir.pwd}"
+        return CommandStatus.error
+      end
+
+      keys = importer.keys
+      if keys.empty?
+        $stdout.puts "No credentials key files found (config/master.key, config/credentials/*.key)."
+        $stdout.puts "Nothing to import — the app may already run from RAILS_MASTER_KEY."
+        return CommandStatus.ok
+      end
+
+      if options[:check]
+        $stdout.puts "Would import into vault '#{options[:vault] || Config.default_vault}':"
+        keys.each { |key| $stdout.puts "  #{key.path}  ->  #{key.vault_key}" }
+        return CommandStatus.ok
+      end
+
+      vault = open_vault!
+      keys.each do |key|
+        vault.set(key.vault_key, key.value)
+        $stdout.puts "Imported #{key.path} -> #{key.vault_key}"
+      end
+
+      $stdout.puts
+      $stdout.puts "Run without a key file on disk:"
+      $stdout.puts "  localvault exec --profile rails -- bin/rails server"
+      keys.select(&:environment).each do |key|
+        $stdout.puts "  localvault exec --map #{key.vault_key}=RAILS_MASTER_KEY -- bin/rails console  # #{key.environment}"
+      end
+
+      $stdout.puts
+      $stdout.puts "Note: the key files are still on disk (#{keys.map(&:path).join(", ")})."
+      $stdout.puts "They keep working until you remove them — that's your call, not ours."
+      CommandStatus.ok
+    end
+
+    desc "upgrade", "Upgrade localvault using whichever method installed it"
+    long_desc <<~DESC
+      Detect how this copy of localvault was installed and run the matching
+      upgrade — Homebrew, RubyGems, or the install script.
+
+\x05    localvault upgrade            # detect and upgrade
+\x05    localvault upgrade --check    # show what would run, change nothing
+
+      If more than one localvault is on PATH, an old copy can shadow the new one
+      and the upgrade looks like it did nothing. This refuses to guess in that
+      case and points you at `localvault doctor`.
+    DESC
+    method_option :check, type: :boolean, default: false, desc: "Print the upgrade command without running it"
+    def upgrade
+      paths = localvault_paths
+      if paths.length > 1
+        $stderr.puts "Error: multiple localvault executables are on PATH:"
+        paths.each_with_index { |path, index| $stderr.puts "  #{index + 1}. #{path}" }
+        $stderr.puts "\nUpgrading now would leave a stale copy shadowing the new one."
+        $stderr.puts "Run `localvault doctor`, remove the copies you don't want, then retry."
+        return CommandStatus.error
+      end
+
+      method, command = upgrade_method_for(paths.first)
+      if method == :unknown
+        $stderr.puts "Error: cannot tell how localvault was installed#{" (#{paths.first})" if paths.first}."
+        $stderr.puts "Upgrade with whichever you used:"
+        $stderr.puts "  brew upgrade inventlist/tap/localvault"
+        $stderr.puts "  gem update localvault"
+        $stderr.puts "  curl -sSL https://inventlist.com/tools/localvault/install.sh | sh"
+        return CommandStatus.error
+      end
+
+      $stdout.puts "Installed via #{method} (#{paths.first})"
+      $stdout.puts "Current version: #{VERSION}"
+      $stdout.puts "Command: #{command}"
+
+      if options[:check]
+        $stdout.puts "\n--check: nothing was run."
+        return CommandStatus.ok
+      end
+
+      $stdout.puts
+      unless system(command)
+        $stderr.puts "\nError: upgrade command failed. Run it yourself to see the full output:"
+        $stderr.puts "  #{command}"
+        return CommandStatus.error
+      end
+
+      $stdout.puts
+      $stdout.puts "Done. Verify with: localvault version"
+      CommandStatus.ok
+    end
+
     def self.exit_on_failure?
       false
     end
@@ -2169,6 +2285,38 @@ module LocalVault
         path.start_with?("/opt/homebrew/bin/", "/usr/local/bin/")
       end
 
+      # Which installer put this executable here, and how to upgrade it.
+      #
+      # The path alone can't decide: Homebrew and install.sh both land in
+      # /usr/local/bin. Both write a wrapper naming their gem prefix, so read
+      # that instead — a Cellar path means brew, ~/.localvault/runtime means the
+      # install script.
+      UPGRADE_COMMANDS = {
+        brew:   "brew upgrade inventlist/tap/localvault",
+        gem:    "gem update localvault",
+        script: "curl -sSL https://inventlist.com/tools/localvault/install.sh | sh"
+      }.freeze
+
+      def upgrade_method_for(path)
+        method = detect_install_method(path)
+        [method, UPGRADE_COMMANDS[method]]
+      end
+
+      def detect_install_method(path)
+        return :unknown if path.nil?
+        return :brew if File.symlink?(path) && File.readlink(path).include?("/Cellar/")
+
+        wrapper = File.read(path, 2048)
+        return :brew if wrapper.include?("/Cellar/")
+        return :script if wrapper.include?("/.localvault/runtime")
+        return :gem if path.include?("/shims/") || path.include?("/gems/")
+
+        :unknown
+      rescue SystemCallError, ArgumentError
+        # Binary or unreadable: fall back to the one thing the path does tell us.
+        path.include?("/shims/") || path.include?("/gems/") ? :gem : :unknown
+      end
+
       def cursor_settings_path
         File.expand_path("~/.cursor/mcp.json")
       end

data/lib/localvault/env_projection.rb

@@ -17,9 +17,24 @@ module LocalVault
           "AWS_IAM.secret_access_key" => "AWS_SECRET_ACCESS_KEY",
           "AWS_IAM.session_token" => "AWS_SESSION_TOKEN"
         }
+      },
+      # Rails reads its credentials key from ENV["RAILS_MASTER_KEY"] when
+      # config/master.key is absent (railties: encrypted(..., env_key:
+      # "RAILS_MASTER_KEY")), so injecting that one variable is enough to run a
+      # Rails app with no key file on disk.
+      "rails" => {
+        only: ["rails.*"],
+        map: { "rails.master_key" => "RAILS_MASTER_KEY" }
       }
     }.freeze
 
+    # Per-environment credentials (config/credentials/production.key) still have
+    # to arrive as RAILS_MASTER_KEY — Rails reads no other variable. This builds
+    # the mapping for one environment.
+    def self.rails_environment_mapping(environment)
+      { "rails.#{environment}_key" => "RAILS_MASTER_KEY" }
+    end
+
     def self.entries(secrets, project: nil, only: nil, except: nil, map: nil, profile: nil, on_skip: nil)
       profile_config = profile_config(profile)
       selectors = parse_selectors(only) || profile_config[:only]

data/lib/localvault/input_validation.rb

@@ -4,7 +4,7 @@ module LocalVault
 
     SEGMENT_PATTERN = /\A[A-Za-z_][A-Za-z0-9_]*\z/
     VAULT_PATTERN = /\A[A-Za-z0-9][A-Za-z0-9_-]{0,63}\z/
-    PROFILES = %w[aws].freeze
+    PROFILES = %w[aws rails].freeze
 
     module_function
 

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.12.3"
+  VERSION = "1.14.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.12.3
+  version: 1.14.0
 platform: ruby
 authors:
 - Nauman Tariq
@@ -115,6 +115,7 @@ files:
 - lib/localvault/cli/help_shell.rb
 - lib/localvault/cli/identity_cmd.rb
 - lib/localvault/cli/keys.rb
+- lib/localvault/cli/rails_import.rb
 - lib/localvault/cli/sync.rb
 - lib/localvault/cli/team.rb
 - lib/localvault/cli/team_helpers.rb