localvault 1.6.2 → 1.8.0

data/lib/localvault/vault.rb

@@ -1,5 +1,6 @@
 require "json"
 require "shellwords"
+require_relative "env_projection"
 
 module LocalVault
   # Encrypted key-value store backed by a single JSON blob.
@@ -143,44 +144,15 @@ module LocalVault
     # @example
     #   vault.export_env(project: "myapp")
     #   # => "export DB_URL=postgres%3A//..."
-    def export_env(project: nil, on_skip: nil)
-      secrets = all
-      if project
-        group = secrets[project]
-        return "" unless group.is_a?(Hash)
-        group.filter_map do |k, v|
-          if shell_safe_key?(k)
-            "export #{k}=#{Shellwords.escape(v.to_s)}"
-          else
-            on_skip&.call(k)
-            nil
-          end
-        end.join("\n")
-      else
-        secrets.flat_map do |k, v|
-          if v.is_a?(Hash)
-            unless shell_safe_key?(k)
-              on_skip&.call(k)
-              next []
-            end
-            v.filter_map do |sk, sv|
-              if shell_safe_key?(sk)
-                "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}"
-              else
-                on_skip&.call("#{k}.#{sk}")
-                nil
-              end
-            end
-          else
-            if shell_safe_key?(k)
-              ["export #{k}=#{Shellwords.escape(v.to_s)}"]
-            else
-              on_skip&.call(k)
-              []
-            end
-          end
-        end.join("\n")
-      end
+    def export_env(project: nil, on_skip: nil, only: nil, except: nil, map: nil, profile: nil)
+      EnvProjection.entries(all,
+        project: project,
+        only: only,
+        except: except,
+        map: map,
+        profile: profile,
+        on_skip: on_skip
+      ).map { |entry| "export #{entry.env_name}=#{Shellwords.escape(entry.value)}" }.join("\n")
     end
 
     # Returns a flat hash suitable for env injection.
@@ -195,40 +167,16 @@ module LocalVault
     # @example
     #   vault.env_hash(project: "myapp")
     #   # => {"DB_URL" => "postgres://...", "SECRET" => "abc"}
-    def env_hash(project: nil, on_skip: nil)
-      secrets = all
-      if project
-        group = secrets[project]
-        return {} unless group.is_a?(Hash)
-        group.each_with_object({}) do |(k, v), h|
-          if shell_safe_key?(k)
-            h[k] = v.to_s
-          else
-            on_skip&.call(k)
-          end
-        end
-      else
-        secrets.each_with_object({}) do |(k, v), h|
-          if v.is_a?(Hash)
-            unless shell_safe_key?(k)
-              on_skip&.call(k)
-              next
-            end
-            v.each do |sk, sv|
-              if shell_safe_key?(sk)
-                h["#{k.upcase}__#{sk}"] = sv.to_s
-              else
-                on_skip&.call("#{k}.#{sk}")
-              end
-            end
-          else
-            if shell_safe_key?(k)
-              h[k] = v.to_s
-            else
-              on_skip&.call(k)
-            end
-          end
-        end
+    def env_hash(project: nil, on_skip: nil, only: nil, except: nil, map: nil, profile: nil)
+      EnvProjection.entries(all,
+        project: project,
+        only: only,
+        except: except,
+        map: map,
+        profile: profile,
+        on_skip: on_skip
+      ).each_with_object({}) do |entry, hash|
+        hash[entry.env_name] = entry.value
       end
     end
 

data/lib/localvault/vault_resolver.rb

@@ -0,0 +1,92 @@
+require "base64"
+
+module LocalVault
+  module VaultResolver
+    Result = Struct.new(:vault, :active_vault, :active_vault_source, :session_vault, keyword_init: true)
+
+    def self.resolve(name = nil)
+      active_vault, source = active_vault_name(name)
+      session_name, session_key = session_credentials
+
+      if session_name == active_vault && session_key
+        vault = build_vault(active_vault, session_key)
+        return Result.new(vault: vault, active_vault: active_vault, active_vault_source: source, session_vault: session_name) if vault
+      end
+
+      if (master_key = SessionCache.get(active_vault))
+        vault = build_vault(active_vault, master_key)
+        return Result.new(vault: vault, active_vault: active_vault, active_vault_source: source, session_vault: session_name) if vault
+      end
+
+      Result.new(vault: nil, active_vault: active_vault, active_vault_source: source, session_vault: session_name)
+    end
+
+    def self.status(name = nil)
+      result = resolve(name)
+      {
+        "localvault_home" => Config.root_path,
+        "active_vault" => result.active_vault,
+        "active_vault_source" => result.active_vault_source,
+        "session_vault" => result.session_vault,
+        "unlocked_vaults" => unlocked_vault_names,
+        "active_vault_unlocked" => !result.vault.nil?
+      }
+    end
+
+    def self.readiness_status(name = nil)
+      result = resolve(name)
+      {
+        "localvault_home" => Config.root_path,
+        "active_vault" => result.active_vault,
+        "active_vault_source" => result.active_vault_source,
+        "session_vault" => result.session_vault,
+        "active_vault_unlocked" => !result.vault.nil?
+      }
+    end
+
+    def self.active_vault_name(name = nil)
+      return [name, "argument"] if name && !name.empty?
+      return [ENV["LOCALVAULT_VAULT"], "env"] if ENV["LOCALVAULT_VAULT"] && !ENV["LOCALVAULT_VAULT"].empty?
+
+      [Config.default_vault, "config"]
+    end
+
+    def self.session_vault_name
+      session_credentials.first
+    end
+
+    def self.unlocked_vault_names
+      names = []
+      session_name, session_key = session_credentials
+      names << session_name if session_name && session_key && build_vault(session_name, session_key)
+
+      Store.list_vaults.each do |vault_name|
+        next if names.include?(vault_name)
+        names << vault_name if SessionCache.get(vault_name)
+      end
+
+      names.sort
+    end
+
+    def self.session_credentials
+      token = ENV["LOCALVAULT_SESSION"]
+      return [nil, nil] unless token
+
+      decoded = Base64.strict_decode64(token)
+      vault_name, key_b64 = decoded.split(":", 2)
+      return [nil, nil] unless vault_name && key_b64
+
+      [vault_name, Base64.strict_decode64(key_b64)]
+    rescue ArgumentError
+      [nil, nil]
+    end
+
+    def self.build_vault(name, master_key)
+      vault = Vault.new(name: name, master_key: master_key)
+      vault.all
+      vault
+    rescue Crypto::DecryptionError, Store::InvalidVaultName
+      nil
+    end
+  end
+end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.6.2"
+  VERSION = "1.8.0"
 end

data/lib/localvault.rb

@@ -2,6 +2,9 @@ require_relative "localvault/version"
 require_relative "localvault/crypto"
 require_relative "localvault/config"
 require_relative "localvault/store"
+require_relative "localvault/env_projection"
+require_relative "localvault/key_lookup"
+require_relative "localvault/vault_resolver"
 require_relative "localvault/vault"
 require_relative "localvault/identity"
 require_relative "localvault/share_crypto"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.8.0
 platform: ruby
 authors:
 - Nauman Tariq
@@ -108,14 +108,20 @@ files:
 - lib/localvault.rb
 - lib/localvault/api_client.rb
 - lib/localvault/cli.rb
+- lib/localvault/cli/error_presenter.rb
 - lib/localvault/cli/keys.rb
 - lib/localvault/cli/sync.rb
 - lib/localvault/cli/team.rb
 - lib/localvault/cli/team_helpers.rb
 - lib/localvault/config.rb
 - lib/localvault/crypto.rb
+- lib/localvault/env_projection.rb
+- lib/localvault/group_catalog.rb
 - lib/localvault/identity.rb
+- lib/localvault/input_validation.rb
+- lib/localvault/key_lookup.rb
 - lib/localvault/key_slot.rb
+- lib/localvault/mcp/exec_command_builder.rb
 - lib/localvault/mcp/server.rb
 - lib/localvault/mcp/tools.rb
 - lib/localvault/session_cache.rb
@@ -124,6 +130,7 @@ files:
 - lib/localvault/sync_bundle.rb
 - lib/localvault/sync_state.rb
 - lib/localvault/vault.rb
+- lib/localvault/vault_resolver.rb
 - lib/localvault/version.rb
 homepage: https://github.com/inventlist/localvault
 licenses: