@catladder/cli 0.0.0-main-2355fd7c → 0.0.0-main-018e2dee

package/src/localAccess/keyFiles.ts

@@ -0,0 +1,126 @@
+import type { Config } from "@catladder/pipeline";
+import {
+  getLocalAccessGcpSecretName,
+  getSecretVarName,
+} from "@catladder/pipeline";
+import { mkdir, readdir, rm, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { join } from "path";
+import type { IO } from "../core/types";
+import { writePrivateFile } from "../utils/writePrivateFile";
+import {
+  getDeclaredLocalAccessCredentialsEnvVars,
+  getDeclaredLocalAccessEnvs,
+} from "./declared";
+import { getProjectRootPath } from "../git/gitProjectInformation";
+
+const sanitize = (s: string) => s.replace(/[^A-Za-z0-9]+/g, "_");
+
+/** file name of a component/env key, relative to the local access folder */
+export const getLocalAccessKeyFileName = (env: string, componentName: string) =>
+  `gcp-${sanitize(env)}-${sanitize(componentName)}.json`;
+
+/**
+ * env var exposing the key file path. Deliberately NOT
+ * GOOGLE_APPLICATION_CREDENTIALS: the key must only be used where a
+ * command opts in (isolated gcloud config, or a declared
+ * `credentialsEnvVar`), never by ADC implicitly.
+ */
+export const getLocalAccessKeyFileVarName = (env: string) =>
+  `CATLADDER_LOCAL_ACCESS_GCP_${sanitize(env).toUpperCase()}_KEY_FILE`;
+
+// inside .catladder/, which ignores itself (see vault/cache.ts)
+const getFolder = async () =>
+  join(await getProjectRootPath(), ".catladder", "local-access");
+
+/**
+ * env vars pointing at the key files that exist for the component
+ * (only paths, no secrets): one per env, plus the declared
+ * `credentialsEnvVar` names
+ */
+export const getLocalAccessKeyFileVars = async (
+  config: Config,
+  componentName: string,
+): Promise<Record<string, string>> => {
+  const folder = await getFolder();
+  const getPath = (env: string) =>
+    join(folder, getLocalAccessKeyFileName(env, componentName));
+  return Object.fromEntries(
+    [
+      ...getDeclaredLocalAccessEnvs(config, componentName).map(
+        (env): [string, string] => [
+          getLocalAccessKeyFileVarName(env),
+          getPath(env),
+        ],
+      ),
+      ...Object.entries(
+        getDeclaredLocalAccessCredentialsEnvVars(config, componentName),
+      ).map(([name, env]): [string, string] => [name, getPath(env)]),
+    ].filter(([, path]) => existsSync(path)),
+  );
+};
+
+/**
+ * writes the stored local access service account keys to gitignored
+ * files (mode 0600) and removes files of declarations that are gone.
+ * A no-op without any declaration (nothing is created). Never throws:
+ * a vault that cannot be reached or an invalid declaration (reported by
+ * `project doctor`) must not break catenv.
+ *
+ * The key is only read through the cache; if setup rotated it on another
+ * machine, refresh with `catenv --vault-mode refresh`.
+ */
+export const writeLocalAccessKeyFiles = async (io: IO, config: Config) => {
+  const wanted = Object.keys(config.components).flatMap((componentName) =>
+    getDeclaredLocalAccessEnvs(config, componentName).map((env) => ({
+      env,
+      componentName,
+      secretName: getSecretVarName(
+        "local",
+        componentName,
+        getLocalAccessGcpSecretName(env),
+      ),
+      fileName: getLocalAccessKeyFileName(env, componentName),
+    })),
+  );
+
+  const folder = await getFolder();
+  if (wanted.length === 0 && !existsSync(folder)) return;
+
+  try {
+    const secrets =
+      wanted.length > 0
+        ? await (
+            await io.getVaultManager()
+          ).readSecrets(
+            wanted.map((w) => w.secretName),
+            io,
+          )
+        : {};
+    await mkdir(folder, { recursive: true, mode: 0o700 });
+    // the parent folder ignores itself
+    await writeFile(join(folder, "..", ".gitignore"), "*\n");
+
+    const written = new Set<string>();
+    for (const { secretName, fileName, env, componentName } of wanted) {
+      const key = secrets[secretName];
+      if (!key) {
+        io.log(
+          `⚠️ no local access key for ${env}:${componentName} in the secret store — run \`catladder project setup\` (or \`catenv --vault-mode refresh\` if it was set up on another machine)`,
+        );
+        continue;
+      }
+      const path = join(folder, fileName);
+      await writePrivateFile(path, key);
+      written.add(fileName);
+    }
+
+    for (const file of await readdir(folder)) {
+      if (!written.has(file)) {
+        await rm(join(folder, file), { force: true });
+      }
+    }
+  } catch (e) {
+    io.log(`⚠️ could not write local access keys: ${e.message}`);
+  }
+};

package/src/utils/__tests__/writePrivateFile.test.ts

@@ -0,0 +1,40 @@
+import {
+  chmod,
+  mkdtemp,
+  readFile,
+  readdir,
+  rm,
+  stat,
+  writeFile,
+} from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { writePrivateFile } from "../writePrivateFile";
+
+let dir: string;
+beforeEach(async () => {
+  dir = await mkdtemp(join(tmpdir(), "private-file-test-"));
+});
+afterEach(async () => {
+  await rm(dir, { recursive: true, force: true });
+});
+
+describe("writePrivateFile", () => {
+  it("creates the file with mode 0600", async () => {
+    const path = join(dir, "a.json");
+    await writePrivateFile(path, "secret");
+    expect(await readFile(path, "utf-8")).toBe("secret");
+    expect((await stat(path)).mode & 0o777).toBe(0o600);
+  });
+
+  it("tightens an existing 0644 file and leaves no temp file behind", async () => {
+    const path = join(dir, "a.json");
+    await writeFile(path, "old");
+    await chmod(path, 0o644);
+    await writePrivateFile(path, "new");
+    expect(await readFile(path, "utf-8")).toBe("new");
+    expect((await stat(path)).mode & 0o777).toBe(0o600);
+    expect(await readdir(dir)).toEqual(["a.json"]);
+  });
+});

package/src/utils/writePrivateFile.ts

@@ -0,0 +1,20 @@
+import { chmod, rename, rm, writeFile } from "fs/promises";
+
+/**
+ * writes a file readable by the owner only. Goes through a 0600 temp
+ * file and a rename, so the content is never visible with looser
+ * permissions (writing first and chmod-ing afterwards would leave an
+ * existing 0644 file readable until the chmod).
+ */
+export const writePrivateFile = async (path: string, content: string) => {
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    await writeFile(tmp, content, { mode: 0o600 });
+    // the mode is only applied when the file is created
+    await chmod(tmp, 0o600);
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+};

package/src/vault/BitwardenVault.ts

@@ -142,16 +142,15 @@ export class BitwardenVault implements SecretsVault {
     const notes = stringify({ ...previous, ...secrets });
 
     if (existing) {
-      await runBw(bwSession, [
-        "edit",
-        "item",
-        existing.id,
+      await runBw(
+        bwSession,
+        ["edit", "item", existing.id],
         encodePayload({ ...existing, notes }),
-      ]);
+      );
     } else {
-      await runBw(bwSession, [
-        "create",
-        "item",
+      await runBw(
+        bwSession,
+        ["create", "item"],
         encodePayload({
           type: SECURE_NOTE_TYPE,
           secureNote: { type: 0 },
@@ -164,7 +163,7 @@ export class BitwardenVault implements SecretsVault {
               }
             : {}),
         }),
-      ]);
+      );
     }
   }
 }

package/src/vault/VaultManager.ts

@@ -1,10 +1,12 @@
 import type { Config } from "@catladder/pipeline";
 import {
   getEnvironment,
+  getLocalAccessGcpSecretName,
   getSecretVarName,
   getVaultConfig,
 } from "@catladder/pipeline";
 import type { IO } from "../core/types";
+import { getDeclaredLocalAccessEnvs } from "../localAccess/declared";
 import { BitwardenVault } from "./BitwardenVault";
 import type { CachedSecrets } from "./cache";
 import {
@@ -140,6 +142,19 @@ export class VaultManager {
     }
   }
 
+  /**
+   * updates the local cache only (the vault already holds the values),
+   * "local" env only
+   */
+  async cacheSecrets(
+    env: string,
+    componentName: string,
+    secrets: Record<string, string>,
+  ): Promise<void> {
+    if (env !== CACHED_ENV) return;
+    await updateSecretsCache(this.vault.id, env, componentName, secrets);
+  }
+
   /**
    * the subset of the vault secrets that may be cached: the declared
    * secrets of the "local" env, per component, as a hierarchy
@@ -165,6 +180,19 @@ export class VaultManager {
   }
 
   private async declaredSecretKeys(componentName: string): Promise<string[]> {
+    return [
+      ...(await this.declaredEnvSecretKeys(componentName)),
+      // the local access keys `project setup` provisions are not part
+      // of any env's vars, but belong to the cached local secrets
+      ...getDeclaredLocalAccessEnvs(this.config, componentName).map(
+        getLocalAccessGcpSecretName,
+      ),
+    ];
+  }
+
+  private async declaredEnvSecretKeys(
+    componentName: string,
+  ): Promise<string[]> {
     try {
       const { secretEnvVarKeys, jobOnlyVars } = await getEnvironment({
         config: this.config,

package/src/vault/__tests__/BitwardenVault.test.ts

@@ -27,10 +27,10 @@ const bwContains = (item?: Record<string, unknown>) =>
 
 /** the notes of the `bw edit|create item` payload, parsed back */
 const writtenNotes = () => {
-  const [, args] = runBw.mock.calls[0];
-  const payload = JSON.parse(
-    Buffer.from(args[args.length - 1], "base64").toString("utf-8"),
-  );
+  // the payload goes through stdin (not argv: visible in `ps`)
+  const [, args, input] = runBw.mock.calls[0];
+  expect(args).not.toContain(input);
+  const payload = JSON.parse(Buffer.from(input, "base64").toString("utf-8"));
   return parse(payload.notes);
 };
 

package/src/vault/__tests__/cache.test.ts

@@ -0,0 +1,37 @@
+import { chmod, mkdtemp, mkdir, rm, stat, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let root: string;
+vi.mock("../../git/gitProjectInformation", () => ({
+  getProjectRootPath: async () => root,
+}));
+
+import { readSecretsCache, writeSecretsCache } from "../cache";
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), "cache-test-"));
+});
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true });
+});
+
+describe("secrets cache", () => {
+  it("is written with mode 0600", async () => {
+    await writeSecretsCache("v", { local: { web: { KEY: "value" } } });
+    const mode = (await stat(join(root, ".catladder", "secrets.json"))).mode;
+    expect(mode & 0o777).toBe(0o600);
+    expect((await readSecretsCache())?.secrets.local.web.KEY).toBe("value");
+  });
+
+  it("tightens an existing world-readable cache", async () => {
+    const folder = join(root, ".catladder");
+    await mkdir(folder);
+    const path = join(folder, "secrets.json");
+    await writeFile(path, "{}");
+    await chmod(path, 0o644);
+    await writeSecretsCache("v", { local: { web: { KEY: "value" } } });
+    expect((await stat(path)).mode & 0o777).toBe(0o600);
+  });
+});

package/src/vault/bw.ts

@@ -87,21 +87,46 @@ export const getBwSession = async (
 };
 
 /**
- * runs a bw command with the given session and returns stdout
+ * runs a bw command with the given session and returns stdout.
+ *
+ * `input` is written to stdin: use it for payloads (e.g. the secrets of
+ * `bw create item`), which would otherwise be visible in `ps` and be
+ * echoed by node's "Command failed" error.
  */
 export const runBw = async (
   session: string,
   args: string[],
+  input?: string,
 ): Promise<string> => {
-  const { stdout } = await execFile(
-    "bw",
-    [...args, "--raw", "--nointeraction"],
-    {
-      env: { ...process.env, BW_SESSION: session },
+  const fullArgs = [...args, "--raw", "--nointeraction"];
+  const env = { ...process.env, BW_SESSION: session };
+  if (input === undefined) {
+    const { stdout } = await execFile("bw", fullArgs, {
+      env,
       maxBuffer: 50 * 1024 * 1024,
-    },
-  );
-  return stdout;
+    });
+    return stdout;
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn("bw", fullArgs, {
+      env,
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (data) => (stdout += data.toString("utf-8")));
+    child.stderr.on("data", (data) => (stderr += data.toString("utf-8")));
+    child.on("error", reject);
+    child.on("close", (code) =>
+      code === 0
+        ? resolve(stdout)
+        : reject(new Error(`bw ${args[0]} failed: ${stderr.trim()}`)),
+    );
+    child.stdin.on("error", () => {
+      // bw exiting early closes the pipe, the close handler reports why
+    });
+    child.stdin.end(input);
+  });
 };
 
 export const runBwJson = async <T>(

package/src/vault/cache.ts

@@ -1,5 +1,6 @@
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { join } from "path";
+import { writePrivateFile } from "../utils/writePrivateFile";
 import { getProjectRootPath } from "../git/gitProjectInformation";
 
 /**
@@ -47,7 +48,7 @@ export const writeSecretsCache = async (
   secrets: CachedSecrets,
 ): Promise<void> => {
   const folder = await getCacheFolder();
-  await mkdir(folder, { recursive: true });
+  await mkdir(folder, { recursive: true, mode: 0o700 });
   // the folder ignores itself, so the cache can never be committed
   await writeFile(join(folder, ".gitignore"), "*\n");
   const cache: SecretsCache = {
@@ -55,7 +56,9 @@ export const writeSecretsCache = async (
     updatedAt: new Date().toISOString(),
     secrets,
   };
-  await writeFile(await getCachePath(), JSON.stringify(cache, null, 2));
+  const path = await getCachePath();
+  // may hold key material (local access keys): owner only
+  await writePrivateFile(path, JSON.stringify(cache, null, 2));
 };
 
 /**