@axinom/mosaic-cli 0.14.2-rc.8 → 0.15.0-rc.0

package/src/commands/apply-templates/apply-templates.ts

@@ -0,0 +1,494 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/* eslint-disable no-console */
+import { Chalk, cyanBright, gray, green, red, white, yellow } from 'chalk';
+import * as Diff from 'diff';
+import * as envfile from 'envfile';
+import * as fs from 'fs';
+import { copyFileSync, existsSync, readFileSync, writeFileSync } from 'fs';
+import * as glob from 'glob';
+import * as path from 'path';
+import * as readline from 'readline';
+import * as yargs from 'yargs';
+import { CommandModule } from 'yargs';
+import { BitwardenVault, Vault } from './bitwarden-vault';
+
+export interface ApplyTemplatesOptions {
+  only: string;
+  yes: boolean;
+  no: boolean;
+  verbose: boolean;
+  replace: boolean;
+  bitwardenUrl: string | undefined;
+}
+
+export interface DiffResult {
+  result: 'created' | 'same' | 'different' | 'differentLayout';
+  diff: Diff.Change[];
+}
+
+export const applyTemplates: CommandModule<unknown, ApplyTemplatesOptions> = {
+  command: 'apply-templates',
+  describe:
+    'Creates a local copy of each *.template file. ' +
+    'A diff and confirmation prompt will be displayed before any changes are made.\n' +
+    '\n' +
+    'Env (.env) files have special treatment... the value for each key defined in the target file will be kept in these cases:\n' +
+    ' a. A value for the key is not defined, or is blank, in the template\n' +
+    ' b. The value in the template looks like <a_{placeholder}>\n' +
+    ' c. The line from the template is included in the .env file and commented out\n' +
+    '\n' +
+    'When a .env file is created from a template, an extra line will be prefixed in the form "#@TEMPLATE = {template-file}". ' +
+    'This directive will then be used to match the output file to the original template even after renaming the output file. ' +
+    'This simplifies management of .env files when multiple template files are provided for alternative environments.',
+  builder: (yargs) =>
+    yargs
+      .option('only', {
+        alias: 'o',
+        describe:
+          'A glob where files should be searched within.\n(Note: the script will attach "/*.template" to the given value)',
+        string: true,
+        default: '**',
+      })
+      .option('yes', {
+        alias: ['y'],
+        describe:
+          'The script will overwrite files without prompting for user confirmation.',
+        default: false,
+        boolean: true,
+      })
+      .option('no', {
+        alias: 'n',
+        type: 'boolean',
+        describe: 'The script will not overwrite any files.',
+        default: false,
+        boolean: true,
+      })
+      .option('verbose', {
+        alias: 'v',
+        type: 'boolean',
+        describe: 'List all files and show all diff lines.',
+        default: false,
+        boolean: true,
+      })
+      .option('replace', {
+        type: 'boolean',
+        describe:
+          'Replace all files reverting to template values. WARNING: this is destructive!',
+        default: false,
+        boolean: true,
+      })
+      .option('bitwardenUrl', {
+        type: 'string',
+        describe:
+          'URL of a Bitwarden server to use as a source to resolve placeholders in the template. ' +
+          'Bitwarden CLI must be installed as a dev dependency, and the vault unlocked (see: https://bitwarden.com/help/cli/). ' +
+          "Placeholders must be in the form: <BITWARDEN_{itemName::fieldName}> where fieldname can be 'username', 'password', or the name of a custom field.",
+        default: undefined,
+        hidden: true,
+      }),
+  handler: compareTemplates,
+};
+
+/**
+ * Represents a mapping between a config template and target file.
+ */
+export class ConfigTransform {
+  constructor(
+    public readonly template: string,
+    public readonly target: string,
+  ) {
+    this.targetExists = existsSync(this.target);
+  }
+
+  readonly targetExists: boolean;
+
+  compare(_: boolean, __: boolean): DiffResult {
+    const templateContent = readFileSync(this.template).toString();
+    const targetContent = readFileSync(this.target).toString();
+    const diff = Diff.diffLines(targetContent, templateContent);
+    const changes = diff.filter((d) => d.added || d.removed);
+    return {
+      result: changes.length ? 'different' : 'same',
+      diff,
+    };
+  }
+
+  writeTarget(): void {
+    copyFileSync(this.template, this.target);
+  }
+}
+
+/**
+ * Represents a mapping between a .env config template and target file.
+ */
+export class EnvConfigTransform extends ConfigTransform {
+  constructor(template: string, target: string, bitwardenVault?: Vault) {
+    super(template, target);
+    this.bitwardenVault = bitwardenVault;
+  }
+
+  readonly bitwardenVault?: Vault;
+  private newContent?: string;
+
+  private readTemplate(): string {
+    const content = readFileSync(this.template).toString();
+    return this.bitwardenVault === undefined
+      ? content
+      : content.replace(
+          /<BITWARDEN_\{([^}]*)\}[^>]*>/g,
+          (match: string, identifier: string) => {
+            if (!identifier.includes('::')) {
+              console.warn(
+                yellow(
+                  `WARNING: Bitwarden placeholder in unsupported format: ${match} in ${this.template}.`,
+                ),
+              );
+              return match;
+            }
+            const [name, fieldName] = identifier.split('::', 2);
+            const value = this.bitwardenVault?.getValue(name, fieldName);
+            if (value === undefined && !this.bitwardenVault?.error) {
+              console.warn(
+                yellow(
+                  `WARNING: A value was not found in Bitwarden for placeholder ${match} in ${this.template}.`,
+                ),
+              );
+            }
+            return value ?? match;
+          },
+        );
+  }
+
+  private mergeContent(templateContent: string, targetContent: string): string {
+    const vars = envfile.parse(templateContent);
+    const targetVars = envfile.parse(targetContent);
+    let mergedContent = templateContent;
+    let additionalContent = '';
+    for (const [k, v] of Object.entries(targetVars)) {
+      // if key is not in template, then append target value to merged content
+      if (!(k in vars)) {
+        additionalContent += `\n${envfile.stringify({ [k]: v })}`;
+      } else if (vars[k] !== v) {
+        const commentRegex = new RegExp(`(?<=(\n|^))#${k}=`);
+        const commented = targetContent.match(commentRegex);
+        // use target value if template value looks like a placeholder
+        // use target value if key is also included as a comment
+        if (isPlaceholder(vars[k]) || vars[k] === '' || commented) {
+          // keep commented template value (updated with current template value)
+          const commentPrefix =
+            commented && !mergedContent.match(commentRegex)
+              ? '#' + envfile.stringify({ [k]: vars[k] })
+              : '';
+          mergedContent = mergedContent.replace(
+            new RegExp(`(?<=(\n|^))${k}=.*?(\r?\n|$)`),
+            commentPrefix + envfile.stringify({ [k]: vars[k], [k]: v }),
+          );
+        }
+      }
+    }
+    if (additionalContent !== '') {
+      mergedContent += `\n\n# Additional keys (not in template)${additionalContent}`;
+    }
+    return mergedContent;
+  }
+
+  compare(replace: boolean, verbose: boolean): DiffResult {
+    const templateContent = this.readTemplate();
+    const targetContent = readFileSync(this.target).toString();
+    this.newContent = replace
+      ? templateContent
+      : this.mergeContent(templateContent, targetContent);
+
+    // set the #@TARGET prefix line
+    this.newContent = setDefinedTemplate(
+      this.newContent,
+      path.basename(this.template),
+    );
+
+    const changed = this.newContent !== targetContent;
+    let diff = [] as Diff.Change[];
+    if (changed) {
+      // diff of sorted variable def lines
+      diff = Diff.diffLines(
+        envfile.stringify(orderByKey(envfile.parse(targetContent))),
+        envfile.stringify(orderByKey(envfile.parse(this.newContent))),
+      ).filter((d) => d.added || d.removed);
+    }
+    const result = !changed
+      ? 'same'
+      : diff.length > 0
+      ? 'different'
+      : 'differentLayout';
+    if (result !== 'same' && verbose) {
+      // full diff of all lines
+      diff = Diff.diffLines(targetContent, this.newContent);
+    }
+    return { result, diff };
+  }
+
+  writeTarget(): void {
+    writeFileSync(
+      this.target,
+      this.newContent ??
+        // set defined template on newly created files:
+        setDefinedTemplate(this.readTemplate(), this.template),
+    );
+  }
+}
+
+/*
+ * Use glob to iterate matching files.
+ */
+function compareTemplates(options: ApplyTemplatesOptions): void {
+  interface Results {
+    created: ConfigTransform[];
+    same: ConfigTransform[];
+    different: ConfigTransform[];
+    differentLayout: ConfigTransform[];
+  }
+  const results: Results = {
+    created: [],
+    same: [],
+    different: [],
+    differentLayout: [],
+  };
+
+  const bitwardenVault =
+    options.bitwardenUrl !== undefined
+      ? new BitwardenVault(options.bitwardenUrl)
+      : undefined;
+
+  const templatesPath = `${options.only}/*.template`;
+  glob(
+    templatesPath,
+    { dot: true, ignore: '**/node_modules/**' },
+    (err, templates) => {
+      if (err) {
+        console.log(err);
+        process.exit(-1);
+      }
+      for (const template of templates) {
+        const isEnv = isEnvFile(path.basename(template));
+        const transforms = isEnv
+          ? getEnvConfigTransforms(template).map(
+              (target) =>
+                new EnvConfigTransform(template, target, bitwardenVault),
+            )
+          : [new ConfigTransform(template, defaultTargetFor(template))];
+        for (const transform of transforms) {
+          const resultKey = transformComparison(
+            transform,
+            options.replace,
+            options.verbose,
+          );
+          results[resultKey].push(transform);
+        }
+      }
+      const total =
+        results.created.length +
+        results.same.length +
+        results.different.length +
+        results.differentLayout.length;
+      console.log(
+        `Found ${total} template file${total !== 1 ? 's' : ''}. ${
+          results.created.length
+        } target file${
+          results.created.length !== 1 ? 's were' : ' was'
+        } created. ${
+          results.different.length + results.differentLayout.length
+        } target file${
+          results.different.length + results.differentLayout.length !== 1
+            ? 's have'
+            : ' has'
+        } changes`,
+      );
+      if (bitwardenVault?.error !== undefined) {
+        console.warn(
+          yellow(
+            `WARNING: Bitwarden placeholders were not resolved. ${bitwardenVault.error}`,
+          ),
+        );
+      }
+      if (results.different.length + results.differentLayout.length !== 0) {
+        promptChanges();
+      }
+    },
+  );
+
+  function promptChanges(): void {
+    if (options.yes) {
+      writeOutputFiles();
+      return;
+    } else if (options.no) {
+      console.log('Changes not applied.');
+      return;
+    }
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    console.log(
+      yellow(
+        "NOTE: To prevent changes to .env files from being overwritten, don't remove or replace the original line but comment it out.",
+      ),
+    );
+    rl.question(
+      cyanBright(`Do you want to apply the changes above? (y/N)\n`),
+      (answer) => {
+        if (answer === 'y') {
+          writeOutputFiles();
+        } else {
+          console.log('Changes not applied.');
+        }
+        rl.close();
+      },
+    );
+  }
+
+  function writeOutputFiles(): void {
+    const transforms = [...results.different, ...results.differentLayout];
+    for (const transform of transforms) {
+      console.log(`Applying ${transform.template} => ${transform.target}`);
+      transform.writeTarget();
+    }
+    console.log(
+      `Changes applied to ${transforms.length} file${
+        transforms.length !== 1 ? 's' : ''
+      }!`,
+    );
+  }
+}
+
+function setDefinedTemplate(targetText: string, templateName: string): string {
+  return `#@TEMPLATE = ${path.basename(templateName)}\n` + targetText;
+}
+
+function getDefinedTemplate(targetText: string): string | undefined {
+  const match = targetText.match(/^#\s*@TEMPLATE\s*=(.+)/);
+  return match ? match[1].trim() : undefined;
+}
+
+export function getEnvConfigTransforms(template: string): string[] {
+  const results: string[] = [];
+  const defaultTarget = defaultTargetFor(template);
+  const dir = path.posix.dirname(defaultTarget);
+  const defaultTargetName = path.posix.basename(defaultTarget);
+  const templateName = path.posix.basename(template);
+  // check all files in the same directory
+  for (const fileName of fs.readdirSync(dir)) {
+    // target must include '.env' and not end with '.template'
+    if (isEnvFile(fileName) && !fileName.endsWith('.template')) {
+      const file = path.posix.join(dir, fileName);
+      const fileText = readFileSync(file).toString();
+      const definedTemplate = getDefinedTemplate(fileText);
+      // file is a valid target if: it defines this template in a directive,
+      // or: its the default target and it has no template directive
+      if (
+        definedTemplate === templateName ||
+        (!definedTemplate && fileName === defaultTargetName)
+      ) {
+        results.push(file);
+      }
+    }
+  }
+  // if no targets were found and the default target doesn't exist then create it
+  if (results.length === 0 && !fs.existsSync(defaultTarget)) {
+    return [defaultTarget];
+  }
+  return results;
+}
+
+/*
+ * Compare a single template and target.
+ * If target file doesn't exist then create it.
+ * If both exist and there are differences, return 'different' and do nothing.
+ */
+export function transformComparison(
+  transform: ConfigTransform,
+  replace: boolean,
+  verbose: boolean,
+): DiffResult['result'] {
+  if (!transform.targetExists) {
+    transform.writeTarget();
+    console.log(
+      `Target file ${transform.target} did not exist and has been created.`,
+    );
+    return 'created';
+  }
+
+  const { result, diff } = transform.compare(replace, verbose);
+  if (result === 'same') {
+    if (verbose) {
+      console.log(gray(`File ${transform.target} has no changes.`));
+    }
+    return result;
+  }
+  console.log(
+    cyanBright(
+      `File ${transform.target} has changes` +
+        (transform.target !== defaultTargetFor(transform.template)
+          ? `. Using template ${path.basename(transform.template)}`
+          : '') +
+        `${verbose ? '' : ' (-v to show full diff)'}:`,
+    ),
+  );
+
+  if (result === 'differentLayout' && !verbose) {
+    console.log(
+      gray(`  (Changes to whitespace, comments and line-order only)`),
+    );
+    return result;
+  }
+
+  logDiffLines(diff);
+  return result;
+}
+
+function logDiffLines(diff: Diff.Change[]): void {
+  for (const part of diff) {
+    let value = part.value;
+    // last line without newline causes formatting issues
+    if (value !== '' && !value.endsWith('\n')) {
+      value += '\n';
+    }
+    const color: Chalk = part.added ? green : part.removed ? red : white;
+    const prefix = part.added ? '+ ' : part.removed ? '- ' : '  ';
+    value = value.replace(/(.*)\n/g, `${prefix}$1\n`);
+    process.stdout.write(color(value));
+  }
+}
+
+function defaultTargetFor(template: string): string {
+  return template.slice(0, -9); // remove ".template"
+}
+
+/*
+ * Determine if the file is a .env file. Matches globs *.env.* & *.env
+ */
+function isEnvFile(file: string): boolean {
+  return file.match(/\.env\b/) ? true : false;
+}
+
+/*
+ * Determine if a value looks like a placeholder
+ */
+function isPlaceholder(value: string): boolean {
+  // placeholders look like: <{aaa}> or <aaa{bbb}>
+  return value.match(/^<[^>]*?\{[^>]*?\}[^>]*?>$/) ? true : false;
+}
+
+/** Orders an object by keys */
+function orderByKey<T>(unordered: Record<string, T>): Record<string, T> {
+  return Object.keys(unordered)
+    .sort()
+    .reduce((obj, key) => {
+      obj[key] = unordered[key];
+      return obj;
+    }, {});
+}
+
+// Dev helper. Script can be run directly with command (without building the lib):
+//  yarn ts-node libs/cli/src/commands/apply-templates/apply-templates.ts apply-templates
+if (require.main === module) {
+  yargs.command(applyTemplates).demandCommand().argv;
+}

package/src/commands/apply-templates/bitwarden-vault.ts

@@ -0,0 +1,130 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/* eslint-disable no-console */
+import { cyanBright, red } from 'chalk';
+import { execSync } from 'child_process';
+
+/** A single item as returned by `bw list items`. */
+interface BitwardenItem {
+  name: string;
+  login?: {
+    username: string;
+    password: string;
+  };
+  fields?: [
+    {
+      name: string;
+      value: string;
+    },
+  ];
+}
+
+/** Interface for a vault which provides values. */
+export interface Vault {
+  error: string | undefined;
+  getValue(name: string, fieldName: string): string | undefined;
+}
+
+/** Represents a Bitwarden vault accessed through Bitwarden CLI commands. */
+export class BitwardenVault implements Vault {
+  constructor(private serverUrl: string | undefined) {
+    this.error = this.sync();
+    if (!this.error) {
+      this.items = this.fetchItems();
+    }
+  }
+  /** If there is an error getting items from the vault this will not be undefined. */
+  public error: string | undefined;
+
+  private readonly items: BitwardenItem[] | undefined;
+
+  /** Get a value from the vault. If the value is not found returns undefined. */
+  public getValue(name: string, fieldName: string): string | undefined {
+    for (const item of this.items ?? []) {
+      if (item.name === name) {
+        if (item.login && fieldName === 'username') {
+          return item.login.username;
+        }
+        if (item.login && fieldName === 'password') {
+          return item.login.password;
+        }
+        if (item.fields) {
+          for (const field of item.fields) {
+            if (field.name === fieldName) {
+              return field.value;
+            }
+          }
+        }
+      }
+    }
+    return undefined;
+  }
+
+  /**
+   * Syncs the Bitwarden vault. Note: this only downloads data.
+   *
+   * We could make this more interactive:
+   * - Get status ('yarn bw status') and parse it
+   * - Set server url automatically if its not set. Fail with error if it is set but different
+   * - Prompt for username & password if not logged in. Login and store session id in memory
+   * - Prompt for password if locked. Unlock and store session id in memory
+   * - Session id can then be passed to `sync` & `list items` commands with --session
+   * Reasons to not do this:
+   * - The script becomes more complex
+   * - Additional security concern of handling password entry
+   * - Password would need to be entered every time the script is run (rather than just once per terminal session)
+   * - Blocker: unlocked status is not reported correctly: https://github.com/bitwarden/clients/issues/2729. This
+   *   makes it really hard to determine the correct course of action.
+   */
+  private sync(): string | undefined {
+    try {
+      execSync(`yarn bw --nointeraction sync`);
+      console.log(`Bitwarden vault synced.`);
+      return undefined;
+    } catch (e) {
+      console.log();
+      // Try to determine what is the issue and provide some direction
+      if (e instanceof Error && e.message.includes('getaddrinfo ENOTFOUND')) {
+        return 'The Bitwarden server could not be found. Do you need to connect to the VPN?';
+      }
+      if (e instanceof Error && e.message.includes('You are not logged in')) {
+        return this.serverUrl !== undefined
+          ? 'You are not logged in. Run command `' +
+              cyanBright(`yarn bw config server ${this.serverUrl}`) +
+              '` to set the server url, then command `' +
+              cyanBright('yarn bw login') +
+              '` and follow the instructions to unlock your vault.'
+          : 'You are not logged in. Run command `' +
+              cyanBright('yarn bw login') +
+              '` and follow the instructions to unlock your vault.';
+      }
+      if (e instanceof Error && e.message.includes('Vault is locked')) {
+        return (
+          'Your vault is locked. Do you need to connect to the VPN? Run command `' +
+          cyanBright('yarn bw unlock') +
+          '` and follow the instructions to unlock your vault.'
+        );
+      }
+      return (
+        'Unexpected error syncing Bitwarden vault. You may need to run command `' +
+        cyanBright('yarn install') +
+        '` to install the Bitwarden CLI otherwise use command `' +
+        cyanBright('yarn bw status') +
+        '` to show the full status.'
+      );
+    }
+  }
+
+  /**
+   * Gets Bitwarden collection items from the vault.
+   */
+  private fetchItems(): BitwardenItem[] {
+    try {
+      const json = execSync('yarn bw --nointeraction list items').toString();
+      return JSON.parse(json) as BitwardenItem[];
+    } catch (e) {
+      console.log();
+      console.error(red('ERROR: Could not list items in the vault.'));
+      process.exit(1);
+    }
+  }
+}

package/src/commands/apply-templates/index.ts

@@ -0,0 +1 @@
+export * from './apply-templates';