vaultez-cli 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5691471c3bf1c3a9c144c9dc7a6a3acb621e786a3ff6c8dda909a37cb840f9cd
-  data.tar.gz: 33fa1a5e4031ec260923526bdb9cc4bc7b99f301fe163cc71407963d92ace921
+  metadata.gz: 824ab321c6ff7b03bd1495461f6c545bc15aa07d596c863e3388fc5d8383622f
+  data.tar.gz: 5417e6a9394622242c58608eddd1186629dc63586fc9ba4545702e1168e8f5f3
 SHA512:
-  metadata.gz: a2a50894e4fbcb228b1d65579d93689ca22740574b917502a1d91664a7cf63def38e047362a06fb30b323be78e95f3e154de1c9ba1d7b03c1ac6ae6aeadb75bb
-  data.tar.gz: 6f59a21a570e06772789c18b52772420427a81c58840e0db1fa7cb6750bc040c1f8eb9366ca536bd4807b831d5d5e5b8bc0d4895465f33838bae53da12d1c43f
+  metadata.gz: 4d06a027b38872fb4b9e02ee827b03589d4ddffa9d8a0fbfca87fe00e71a5e7b64eedd63d48b5dbfcd9f4c5d195f3628bfaec74b4846a463a7b675721695e9e5
+  data.tar.gz: 7808de1486e94c49eb163317f1d488de5e581fe83b1fc5dd9bf804d9d12d7a103401f2a59e6ad6c0ebb68f3b514f8539b4daf05dd7e143f63e905cf1fa435dea

data/lib/vaultez/cli.rb

@@ -12,14 +12,6 @@ module Vaultez
 
     map %w[--version -v] => :__version
 
-    class_option :token, type: :string, banner: "TOKEN",
-                         desc: "Use a project token instead of the saved session"
-
-    def initialize(*args)
-      super
-      ENV["VAULTEZ_TOKEN"] = options[:token] if options[:token]
-    end
-
     desc "login", "Authenticate with email, password, and 2FA code"
     long_desc <<~DESC, wrap: false
       Authenticate with your Vaultez account. You will be prompted for your
@@ -55,14 +47,17 @@ module Vaultez
         vaultez fetch --company="Acme" --project="Backend"
         vaultez fetch --company="Acme" --project="Backend" --secret="DATABASE_URL"
 
-      PROJECT TOKEN (VAULTEZ_TOKEN env var or --token flag):
+      PROJECT TOKEN (VAULTEZ_TOKEN env var):
         When a project token is active, it already knows which project to use.
         No --project flag is needed.
 
         VAULTEZ_TOKEN=vz_... vaultez fetch
-        vaultez fetch --token=vz_... --secret="DATABASE_URL"
+        VAULTEZ_TOKEN=vz_... vaultez fetch --secret="DATABASE_URL"
 
       Project tokens can be created in the Tokens tab of your project settings.
+      Always pass the token via the VAULTEZ_TOKEN environment variable, never
+      as a command-line flag — CLI arguments are visible to other local users
+      via `ps` and get saved in shell history.
     DESC
     option :companies, type: :boolean, desc: "List all your companies"
     option :company,   type: :string,  desc: "Company name"
@@ -103,15 +98,14 @@ module Vaultez
         puts "  help        Show help for any command"
         puts
         puts "Options:"
-        puts "  --token     Use a project token instead of the saved session"
         puts "  --version   Show the installed CLI version"
         puts
         puts "Examples:"
         puts "  vaultez login"
         puts "  vaultez fetch --project=\"Backend\""
         puts "  vaultez fetch --project=\"Backend\" --secret=\"DATABASE_URL\""
-        puts "  vaultez fetch --token=\"vz_...\""
-        puts "  vaultez fetch --token=\"vz_...\" --secret=\"DATABASE_URL\""
+        puts "  VAULTEZ_TOKEN=\"vz_...\" vaultez fetch"
+        puts "  VAULTEZ_TOKEN=\"vz_...\" vaultez fetch --secret=\"DATABASE_URL\""
       end
     end
   end

data/lib/vaultez/client.rb

@@ -51,7 +51,9 @@ module Vaultez
     def request(method, path, body = nil, authenticated: true)
       uri  = URI("#{@api_url}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
-      http.use_ssl = uri.scheme == "https"
+      http.use_ssl      = uri.scheme == "https"
+      http.open_timeout = 10
+      http.read_timeout = 15
 
       req = build_request(method, uri)
       req["Content-Type"] = "application/json"
@@ -65,7 +67,13 @@ module Vaultez
 
       req.body = body.to_json if body
 
-      parse_response(http.request(req))
+      begin
+        response = http.request(req)
+      rescue StandardError => error
+        raise Vaultez::ApiError, "Could not reach the Vaultez API: #{error.message}"
+      end
+
+      parse_response(response)
     end
 
     def build_request(method, uri)

data/lib/vaultez/config.rb

@@ -41,12 +41,30 @@ module Vaultez
 
     def self.read
       return {} unless File.exist?(CONFIG_PATH)
+      tighten_permissions
       YAML.safe_load(File.read(CONFIG_PATH)) || {}
     end
 
     def self.write(data)
-      FileUtils.mkdir_p(File.dirname(CONFIG_PATH))
-      File.write(CONFIG_PATH, data.to_yaml)
+      dir = File.dirname(CONFIG_PATH)
+      FileUtils.mkdir_p(dir, mode: 0o700)
+      # The mode argument to mkdir_p/File.open only applies at creation time,
+      # so explicitly chmod too - this also retroactively tightens a config
+      # directory/file that was created before this fix, which would
+      # otherwise stay world-readable forever (0644/0755 by default umask).
+      File.chmod(0o700, dir)
+      File.open(CONFIG_PATH, File::CREAT | File::TRUNC | File::WRONLY, 0o600) do |f|
+        f.write(data.to_yaml)
+      end
+      File.chmod(0o600, CONFIG_PATH)
+    end
+
+    def self.tighten_permissions
+      dir = File.dirname(CONFIG_PATH)
+      File.chmod(0o700, dir) if File.directory?(dir) && (File.stat(dir).mode & 0o777) != 0o700
+      File.chmod(0o600, CONFIG_PATH) if (File.stat(CONFIG_PATH).mode & 0o777) != 0o600
+    rescue StandardError
+      nil # best-effort; never block a read over a permissions fix
     end
   end
 end

data/lib/vaultez/version.rb

@@ -1,3 +1,3 @@
 module Vaultez
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vaultez-cli
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Nur Ketene