localvault 1.13.0 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa374ffc862a0591ab2936ea836ea4f04e96d3d86acd3591fb1b57ed91ea1253
-  data.tar.gz: f8ac6c6bd7e329d395801741f1c9e61f121339d5f05d013623faa6e2f7d255e0
+  metadata.gz: 2f77c11508eef73c90760e5a927201f6735a16d836e6890161e89a497e28d917
+  data.tar.gz: 15400be786d2ba53112d1b6b48a1de5bd0518903e5578c859677ec68320f2b8b
 SHA512:
-  metadata.gz: 3cfb2aaccbfb4c0fc8882d6115dc3ca7ab8802f060601f3083ec9d1c36f76b1688ea2649eea70edaaf18d463f87e35605311a7a5492094f1e22d70326771b1ae
-  data.tar.gz: 874a4be548a5f7498d9fa520be60485f762df2f4ebe2e4612816b16617bf072cb1c735f73375ace33638c73d309d0a86c294095ea1c777ccfc57a3b9666b1eca
+  metadata.gz: c8fcd7235f9e330cdf7cf2c17528849f7b64b4388e865351ab53c1758b3390d32dd638c2c21e7ba24ff18e7d9c63e7c5e0bd2c66efa87792380d9d8ef12b61b7
+  data.tar.gz: c8491e0b0fcb2e588080496254b4fa04195859ad81d7ce66c38d4e13116d20374fa9f96668cc18cf8dc2a0830affb58ea59df84ed6eb1531c817942f364c54e3

data/lib/localvault/cli/rails_import.rb

@@ -0,0 +1,58 @@
+module LocalVault
+  class CLI
+    # Finds a Rails app's credentials keys so they can be stored in the vault
+    # and injected as RAILS_MASTER_KEY instead of living in a file.
+    #
+    # Reads only. Removing the key files is the operator's call — this reports
+    # what is still on disk and leaves it alone.
+    class RailsImport
+      Key = Struct.new(:environment, :path, :vault_key, :value, keyword_init: true)
+
+      MASTER_KEY_PATH = "config/master.key".freeze
+      CREDENTIALS_PATH = "config/credentials.yml.enc".freeze
+
+      def initialize(root = Dir.pwd)
+        @root = root
+      end
+
+      def rails_app?
+        File.exist?(File.join(@root, CREDENTIALS_PATH)) ||
+          File.exist?(File.join(@root, MASTER_KEY_PATH)) ||
+          Dir.exist?(File.join(@root, "config/credentials"))
+      end
+
+      # Every key file this app has: the default master key plus one per
+      # environment (config/credentials/production.key).
+      def keys
+        [master_key, *environment_keys].compact
+      end
+
+      private
+
+      def master_key
+        path = File.join(@root, MASTER_KEY_PATH)
+        return nil unless File.exist?(path)
+
+        value = File.read(path).strip
+        return nil if value.empty?
+
+        Key.new(environment: nil, path: MASTER_KEY_PATH, vault_key: "rails.master_key", value: value)
+      end
+
+      def environment_keys
+        Dir.glob(File.join(@root, "config/credentials/*.key")).sort.filter_map do |path|
+          environment = File.basename(path, ".key")
+          value = File.read(path).strip
+          next if value.empty?
+
+          Key.new(
+            environment: environment,
+            path: "config/credentials/#{environment}.key",
+            vault_key: "rails.#{environment}_key",
+            value: value
+          )
+        end
+      end
+    end
+  end
+end

data/lib/localvault/cli.rb

@@ -116,7 +116,7 @@ module LocalVault
     # disappearing from help.
     HELP_SECTIONS = [
       ["GETTING STARTED",                                       %w[login config init demo]],
-      ["SECRETS",                                               %w[set get show reveal groups list delete import env exec]],
+      ["SECRETS",                                               %w[set get show reveal groups list delete import env exec rails]],
       ["VAULT MANAGEMENT",                                      %w[vaults switch rekey unlock lock reset rename copy]],
       ["SYNC  (requires localvault login)",                     %w[sync]],
       ["TEAM SHARING  (requires localvault login)",             %w[dashboard verify add remove team]],
@@ -807,6 +807,7 @@ module LocalVault
     require_relative "cli/sync"
     require_relative "cli/guard"
     require_relative "cli/identity_cmd"
+    require_relative "cli/rails_import"
 
     # Thor 1.5 injects a `tree` command into every class. Inside a namespace it
     # lists under a name that isn't even callable (`identity_command tree`), and
@@ -1649,6 +1650,67 @@ module LocalVault
       end
     end
 
+    desc "rails", "Import a Rails app's credentials keys into the vault"
+    long_desc <<~DESC
+      Store this Rails app's credentials keys in the vault so you can run it
+      with no key file on disk. Rails reads ENV["RAILS_MASTER_KEY"] whenever
+      config/master.key is absent, so injecting that one variable is enough.
+
+\x05    localvault rails                  # import config/master.key (and per-env keys)
+\x05    localvault rails --check          # show what would be imported
+
+      Then run your app with the key injected, never written anywhere:
+
+\x05    localvault exec --profile rails -- bin/rails server
+\x05    localvault exec --profile rails -- bin/rails credentials:edit
+
+      For a per-environment key (config/credentials/production.key), map it —
+      Rails reads no variable other than RAILS_MASTER_KEY:
+
+\x05    localvault exec --map rails.production_key=RAILS_MASTER_KEY -- bin/rails console
+
+      Key files are left exactly as they are. Deleting them is your call.
+    DESC
+    method_option :check, type: :boolean, default: false, desc: "List what would be imported without writing"
+    def rails
+      importer = RailsImport.new
+      unless importer.rails_app?
+        abort_with "No Rails app here — expected config/credentials.yml.enc or config/master.key in #{Dir.pwd}"
+        return CommandStatus.error
+      end
+
+      keys = importer.keys
+      if keys.empty?
+        $stdout.puts "No credentials key files found (config/master.key, config/credentials/*.key)."
+        $stdout.puts "Nothing to import — the app may already run from RAILS_MASTER_KEY."
+        return CommandStatus.ok
+      end
+
+      if options[:check]
+        $stdout.puts "Would import into vault '#{options[:vault] || Config.default_vault}':"
+        keys.each { |key| $stdout.puts "  #{key.path}  ->  #{key.vault_key}" }
+        return CommandStatus.ok
+      end
+
+      vault = open_vault!
+      keys.each do |key|
+        vault.set(key.vault_key, key.value)
+        $stdout.puts "Imported #{key.path} -> #{key.vault_key}"
+      end
+
+      $stdout.puts
+      $stdout.puts "Run without a key file on disk:"
+      $stdout.puts "  localvault exec --profile rails -- bin/rails server"
+      keys.select(&:environment).each do |key|
+        $stdout.puts "  localvault exec --map #{key.vault_key}=RAILS_MASTER_KEY -- bin/rails console  # #{key.environment}"
+      end
+
+      $stdout.puts
+      $stdout.puts "Note: the key files are still on disk (#{keys.map(&:path).join(", ")})."
+      $stdout.puts "They keep working until you remove them — that's your call, not ours."
+      CommandStatus.ok
+    end
+
     desc "upgrade", "Upgrade localvault using whichever method installed it"
     long_desc <<~DESC
       Detect how this copy of localvault was installed and run the matching

data/lib/localvault/env_projection.rb

@@ -17,9 +17,24 @@ module LocalVault
           "AWS_IAM.secret_access_key" => "AWS_SECRET_ACCESS_KEY",
           "AWS_IAM.session_token" => "AWS_SESSION_TOKEN"
         }
+      },
+      # Rails reads its credentials key from ENV["RAILS_MASTER_KEY"] when
+      # config/master.key is absent (railties: encrypted(..., env_key:
+      # "RAILS_MASTER_KEY")), so injecting that one variable is enough to run a
+      # Rails app with no key file on disk.
+      "rails" => {
+        only: ["rails.*"],
+        map: { "rails.master_key" => "RAILS_MASTER_KEY" }
       }
     }.freeze
 
+    # Per-environment credentials (config/credentials/production.key) still have
+    # to arrive as RAILS_MASTER_KEY — Rails reads no other variable. This builds
+    # the mapping for one environment.
+    def self.rails_environment_mapping(environment)
+      { "rails.#{environment}_key" => "RAILS_MASTER_KEY" }
+    end
+
     def self.entries(secrets, project: nil, only: nil, except: nil, map: nil, profile: nil, on_skip: nil)
       profile_config = profile_config(profile)
       selectors = parse_selectors(only) || profile_config[:only]

data/lib/localvault/input_validation.rb

@@ -4,7 +4,7 @@ module LocalVault
 
     SEGMENT_PATTERN = /\A[A-Za-z_][A-Za-z0-9_]*\z/
     VAULT_PATTERN = /\A[A-Za-z0-9][A-Za-z0-9_-]{0,63}\z/
-    PROFILES = %w[aws].freeze
+    PROFILES = %w[aws rails].freeze
 
     module_function
 

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.13.0"
+  VERSION = "1.14.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.14.0
 platform: ruby
 authors:
 - Nauman Tariq
@@ -115,6 +115,7 @@ files:
 - lib/localvault/cli/help_shell.rb
 - lib/localvault/cli/identity_cmd.rb
 - lib/localvault/cli/keys.rb
+- lib/localvault/cli/rails_import.rb
 - lib/localvault/cli/sync.rb
 - lib/localvault/cli/team.rb
 - lib/localvault/cli/team_helpers.rb