@catladder/cli 0.0.0-next-aea5d3ad → 0.0.0-next-2b60440e

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-next-aea5d3ad",
+  "version": "0.0.0-next-2b60440e",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/commands/index.ts

@@ -14,6 +14,10 @@ export { commandOpenEnv } from "./project/commandOpenEnv";
 export { commandOpenGit } from "./project/commandOpenGit";
 export { commandCloudSqlProxy } from "./project/commandCloudSqlProxy";
 export { commandConfigSecrets } from "./project/commandConfigSecrets";
+export { commandSecretsPull } from "./project/secrets/commandSecretsPull";
+export { commandSecretsPush } from "./project/secrets/commandSecretsPush";
+export { commandSecretsSet } from "./project/secrets/commandSecretsSet";
+export { commandSecretsList } from "./project/secrets/commandSecretsList";
 export { commandSecretsClearBackups } from "./project/commandSecretsClearBackups";
 export { commandSecretsSyncGithub } from "./project/commandSecretsSyncGithub";
 export { commandOpenLogs } from "./project/commandOpenLogs";

package/src/commands/project/commandConfigSecrets.ts

@@ -1,31 +1,92 @@
+import { stripIndents } from "common-tags";
 import { defineCommand } from "../../core/defineCommand";
-import { projectConfigSecrets } from "../../apps/cli/commands/project/commandConfigSecrets";
-import { envAndComponents } from "../../apps/cli/commands/project/utils/autocompletions";
+import { editAsFile } from "../../utils/editAsFile";
+import { delay } from "../../utils/promise";
+import {
+  buildSecretsDocument,
+  checkSecretsDocument,
+  collectSecretsWrites,
+  writeSecretsAndMirror,
+} from "./secrets/document";
+import {
+  formatScope,
+  getScopedSecretKeys,
+  resolveSecretsScope,
+  secretsScopeChoices,
+} from "./secrets/scope";
+import { parseKeysInput } from "./secrets/parseKeysInput";
 
-// This command delegates to the existing implementation which uses
-// editAsFile (opens editor) and has retry loops with confirm prompts.
-// Full migration to CommandIO would require reworking the editor flow,
-// so for now we bridge it.
 export const commandConfigSecrets = defineCommand({
   name: "project config-secrets",
-  description: "setup/update secrets stored in pass",
+  description: "setup/update secrets in the vault via your editor",
   group: "project",
   inputs: {
     envComponent: {
       type: "string",
-      message: "environment:component",
+      message: "scope: env:component, env:, :component or empty for everything",
       positional: true,
       required: false,
-      choices: async () => envAndComponents(),
+      choices: async () => secretsScopeChoices(),
+    },
+    key: {
+      type: "string",
+      message: "only edit these secrets (comma-separated keys)",
+      required: false,
     },
   },
   execute: async (ctx) => {
     const envComponent = await ctx.get("envComponent");
-    // Bridge: the existing implementation accepts CommandInstance-like
-    // objects for logging and prompting. Since it uses this.prompt()
-    // internally (not ctx.prompt), we pass ctx which satisfies the
-    // IO interface for logging. The interactive prompts inside
-    // projectConfigSecrets will need a deeper migration later.
-    await projectConfigSecrets(ctx, envComponent);
+    const keys = parseKeysInput(await ctx.get("key"));
+
+    if (!ctx.interactive) {
+      throw new Error(
+        "project config-secrets opens an editor and needs an interactive terminal — " +
+          "use `project secrets-pull`, `project secrets-push` or `project secrets-set` instead",
+      );
+    }
+
+    const scope = await resolveSecretsScope(envComponent);
+    const scoped = await getScopedSecretKeys(scope, keys);
+
+    let document = await buildSecretsDocument(ctx, scoped);
+    let hasErrors = true;
+    while (hasErrors) {
+      document = await editAsFile(
+        document,
+        stripIndents`
+        Please fill in all secrets for:
+
+        ${formatScope(scoped)}
+
+        `,
+      );
+      const problems = checkSecretsDocument(document, scoped, {
+        requireComplete: true,
+      });
+      hasErrors = problems.length > 0;
+      if (hasErrors) {
+        ctx.log("");
+        ctx.log("😿 Oh no! There is something wrong:");
+        ctx.log("");
+        problems.forEach((problem) => ctx.log(problem));
+        ctx.log("");
+
+        await delay(1000);
+        const shouldContinue = await ctx.confirm("Try again? 🤔");
+        if (!shouldContinue) {
+          throw new Error("abort");
+        }
+      }
+    }
+
+    const { writes, skipped } = collectSecretsWrites(document, scoped);
+    if (skipped.length > 0) {
+      ctx.log("");
+      ctx.log("⏭️ these secrets are still unset and will not be written:");
+      skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+    }
+    await writeSecretsAndMirror(ctx, writes);
+    ctx.log("done! 😻");
+    ctx.log("");
   },
 });

package/src/commands/project/secrets/__tests__/document.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, it } from "vitest";
+import {
+  FILL_ME,
+  checkSecretsDocument,
+  collectSecretsWrites,
+} from "../document";
+import { parseKeysInput } from "../parseKeysInput";
+import type { ScopedSecretKeys } from "../scope";
+
+const scoped: ScopedSecretKeys = [
+  { env: "dev", componentName: "web", keys: ["API_KEY", "SMTP_PASSWORD"] },
+  { env: "prod", componentName: "web", keys: ["API_KEY", "SMTP_PASSWORD"] },
+  { env: "dev", componentName: "worker", keys: ["QUEUE_TOKEN"] },
+];
+
+describe("checkSecretsDocument", () => {
+  it("accepts a complete document", () => {
+    const problems = checkSecretsDocument(
+      {
+        web: {
+          dev: { API_KEY: "a", SMTP_PASSWORD: "b" },
+          prod: { API_KEY: "c", SMTP_PASSWORD: "d" },
+        },
+        worker: { dev: { QUEUE_TOKEN: "e" } },
+      },
+      scoped,
+      { requireComplete: true },
+    );
+    expect(problems).toEqual([]);
+  });
+
+  it("accepts a partial document when completeness is not required", () => {
+    const problems = checkSecretsDocument(
+      { web: { prod: { API_KEY: "rotated" } } },
+      scoped,
+      { requireComplete: false },
+    );
+    expect(problems).toEqual([]);
+  });
+
+  it("reports missing keys when completeness is required", () => {
+    const problems = checkSecretsDocument(
+      { web: { prod: { API_KEY: "rotated" } } },
+      scoped,
+      { requireComplete: true },
+    );
+    expect(problems).toEqual([
+      '"dev:web": "API_KEY" has not been provided',
+      '"dev:web": "SMTP_PASSWORD" has not been provided',
+      '"prod:web": "SMTP_PASSWORD" has not been provided',
+      '"dev:worker": "QUEUE_TOKEN" has not been provided',
+    ]);
+  });
+
+  it("rejects undeclared keys, components and envs", () => {
+    const problems = checkSecretsDocument(
+      {
+        web: {
+          dev: { TYPO_KEY: "a" },
+          stage: { API_KEY: "b" },
+        },
+        api: { dev: { API_KEY: "c" } },
+      },
+      scoped,
+      { requireComplete: false },
+    );
+    expect(problems).toEqual([
+      '"dev:web": "TYPO_KEY" is not declared in the config (or filtered out by --key)',
+      '"stage:web" is not in this scope — remove it or widen the scope',
+      '"api" is not a component in this scope — remove it or widen the scope',
+    ]);
+  });
+});
+
+describe("collectSecretsWrites", () => {
+  it("collects only provided values and skips placeholders", () => {
+    const { writes, skipped } = collectSecretsWrites(
+      {
+        web: {
+          dev: { API_KEY: "a", SMTP_PASSWORD: FILL_ME },
+          prod: { API_KEY: null as unknown as string },
+        },
+        worker: { dev: {} },
+      },
+      scoped,
+    );
+    expect(writes).toEqual([
+      { env: "dev", componentName: "web", secrets: { API_KEY: "a" } },
+    ]);
+    expect(skipped).toEqual(["dev:web SMTP_PASSWORD", "prod:web API_KEY"]);
+  });
+
+  it("keeps objects and empty strings as values", () => {
+    const { writes, skipped } = collectSecretsWrites(
+      { web: { dev: { API_KEY: "", SMTP_PASSWORD: { user: "a" } } } },
+      scoped,
+    );
+    expect(writes).toEqual([
+      {
+        env: "dev",
+        componentName: "web",
+        secrets: { API_KEY: "", SMTP_PASSWORD: { user: "a" } },
+      },
+    ]);
+    expect(skipped).toEqual([]);
+  });
+});
+
+describe("parseKeysInput", () => {
+  it("splits and trims comma-separated keys", () => {
+    expect(parseKeysInput("API_KEY, SMTP_PASSWORD ,")).toEqual([
+      "API_KEY",
+      "SMTP_PASSWORD",
+    ]);
+  });
+
+  it("returns undefined for empty input", () => {
+    expect(parseKeysInput(undefined)).toBeUndefined();
+    expect(parseKeysInput("")).toBeUndefined();
+    expect(parseKeysInput(" , ")).toBeUndefined();
+  });
+});

package/src/commands/project/secrets/commandSecretsList.ts

@@ -0,0 +1,75 @@
+import { getSecretVarName } from "@catladder/pipeline";
+import { defineCommand } from "../../../core/defineCommand";
+import {
+  getScopedSecretKeys,
+  resolveSecretsScope,
+  secretsScopeChoices,
+} from "./scope";
+import { parseKeysInput } from "./parseKeysInput";
+
+export const commandSecretsList = defineCommand({
+  name: "project secrets-list",
+  description:
+    "lists the declared secrets of a scope with their set/unset status (values only with --reveal)",
+  group: "project",
+  inputs: {
+    envComponent: {
+      type: "string",
+      message: "scope: env:component, env:, :component or empty for everything",
+      positional: true,
+      required: false,
+      choices: async () => secretsScopeChoices(),
+    },
+    key: {
+      type: "string",
+      message: "only these secrets (comma-separated keys)",
+      required: false,
+    },
+    reveal: {
+      type: "boolean",
+      message: "also print the secret values",
+      default: false,
+    },
+    check: {
+      type: "boolean",
+      message: "exit with an error when any secret is unset (for CI/agents)",
+      default: false,
+    },
+  },
+  execute: async (ctx) => {
+    const scope = await resolveSecretsScope(await ctx.get("envComponent"));
+    const scoped = await getScopedSecretKeys(
+      scope,
+      parseKeysInput(await ctx.get("key")),
+    );
+    const reveal = await ctx.get("reveal");
+
+    const names = scoped.flatMap(({ env, componentName, keys }) =>
+      keys.map((key) => getSecretVarName(env, componentName, key)),
+    );
+    const values = await (await ctx.getVaultManager()).readSecrets(names, ctx);
+
+    let unsetCount = 0;
+    let setCount = 0;
+    for (const { env, componentName, keys } of scoped) {
+      for (const key of keys) {
+        const value = values[getSecretVarName(env, componentName, key)];
+        if (value === undefined) {
+          unsetCount += 1;
+          ctx.log(`🚨 ${env}:${componentName} ${key} (unset)`);
+        } else {
+          setCount += 1;
+          ctx.log(
+            `✅ ${env}:${componentName} ${key}` + (reveal ? ` = ${value}` : ""),
+          );
+        }
+      }
+    }
+    ctx.log("");
+    ctx.log(`${setCount} set, ${unsetCount} unset`);
+
+    if ((await ctx.get("check")) && unsetCount > 0) {
+      throw new Error(`${unsetCount} secrets are unset`);
+    }
+  },
+});

package/src/commands/project/secrets/commandSecretsPull.ts

@@ -0,0 +1,55 @@
+import { writeFile } from "fs-extra";
+import { stringify } from "yaml";
+import { defineCommand } from "../../../core/defineCommand";
+import { buildSecretsDocument } from "./document";
+import {
+  getScopedSecretKeys,
+  resolveSecretsScope,
+  secretsScopeChoices,
+} from "./scope";
+import { parseKeysInput } from "./parseKeysInput";
+
+export const commandSecretsPull = defineCommand({
+  name: "project secrets-pull",
+  description:
+    "prints the current secrets of a scope as yaml (unset ones as a placeholder) — edit and feed to secrets-push",
+  group: "project",
+  inputs: {
+    envComponent: {
+      type: "string",
+      message: "scope: env:component, env:, :component or empty for everything",
+      positional: true,
+      required: false,
+      choices: async () => secretsScopeChoices(),
+    },
+    key: {
+      type: "string",
+      message: "only these secrets (comma-separated keys)",
+      required: false,
+    },
+    out: {
+      type: "string",
+      message: "write the yaml to this file instead of stdout",
+      required: false,
+    },
+  },
+  execute: async (ctx) => {
+    const scope = await resolveSecretsScope(await ctx.get("envComponent"));
+    const scoped = await getScopedSecretKeys(
+      scope,
+      parseKeysInput(await ctx.get("key")),
+    );
+    const document = await buildSecretsDocument(ctx, scoped);
+    const yaml = stringify(document, { aliasDuplicateObjects: false });
+
+    const out = await ctx.get("out");
+    if (out) {
+      await writeFile(out, yaml);
+      ctx.log(
+        `wrote secrets to ${out} — ⚠️ contains secret values, don't commit it`,
+      );
+    } else {
+      ctx.log(yaml);
+    }
+  },
+});

package/src/commands/project/secrets/commandSecretsPush.ts

@@ -0,0 +1,100 @@
+import { readFile } from "fs-extra";
+import { parse } from "yaml";
+import { defineCommand } from "../../../core/defineCommand";
+import { readStdin } from "../../../utils/readStdin";
+import type { SecretsDocument } from "./document";
+import {
+  checkSecretsDocument,
+  collectSecretsWrites,
+  writeSecretsAndMirror,
+} from "./document";
+import {
+  getScopedSecretKeys,
+  resolveSecretsScope,
+  secretsScopeChoices,
+} from "./scope";
+import { parseKeysInput } from "./parseKeysInput";
+
+export const commandSecretsPush = defineCommand({
+  name: "project secrets-push",
+  description:
+    "writes secrets from a yaml document (secrets-pull format, --file or stdin) to the vault; may be partial",
+  group: "project",
+  inputs: {
+    envComponent: {
+      type: "string",
+      message: "scope: env:component, env:, :component or empty for everything",
+      positional: true,
+      required: false,
+      choices: async () => secretsScopeChoices(),
+    },
+    key: {
+      type: "string",
+      message: "only write these secrets (comma-separated keys)",
+      required: false,
+    },
+    file: {
+      type: "string",
+      message:
+        "yaml file to push (component → env → key: value); stdin when omitted",
+      required: false,
+    },
+  },
+  execute: async (ctx) => {
+    const scope = await resolveSecretsScope(await ctx.get("envComponent"));
+    const scoped = await getScopedSecretKeys(
+      scope,
+      parseKeysInput(await ctx.get("key")),
+    );
+
+    const file = await ctx.get("file");
+    if (!file && process.stdin.isTTY) {
+      throw new Error(
+        "nothing to push — pass --file <secrets.yml> or pipe yaml (secrets-pull format) to stdin",
+      );
+    }
+    const raw = file
+      ? (await readFile(file)).toString("utf-8")
+      : await readStdin();
+    const document = parse(raw) as SecretsDocument;
+    if (!document || typeof document !== "object") {
+      throw new Error(
+        "the document must be a yaml object: component → env → key: value (see secrets-pull)",
+      );
+    }
+
+    const problems = checkSecretsDocument(document, scoped, {
+      requireComplete: false,
+    });
+    if (problems.length > 0) {
+      throw new Error(
+        "😿 the document does not match the config:\n" +
+          problems.map((problem) => `  - ${problem}`).join("\n"),
+      );
+    }
+
+    const { writes, skipped } = collectSecretsWrites(document, scoped);
+    if (skipped.length > 0) {
+      ctx.log("⏭️ skipping placeholder/empty values:");
+      skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+    }
+    if (writes.length === 0) {
+      ctx.log("no secrets to write 🤷");
+      return;
+    }
+
+    ctx.log("about to write:");
+    writes.forEach(({ env, componentName, secrets }) =>
+      ctx.log(
+        `  - ${env}:${componentName}: ${Object.keys(secrets).join(", ")}`,
+      ),
+    );
+    const confirmed = await ctx.confirm("continue? 🤔");
+    if (!confirmed) {
+      throw new Error("abort");
+    }
+
+    await writeSecretsAndMirror(ctx, writes);
+    ctx.log("done! 😻");
+  },
+});

package/src/commands/project/secrets/commandSecretsSet.ts

@@ -0,0 +1,102 @@
+import { readFile } from "fs-extra";
+import { defineCommand } from "../../../core/defineCommand";
+import type { IO } from "../../../core/types";
+import { readStdin } from "../../../utils/readStdin";
+import type { SecretsWrite } from "./document";
+import { writeSecretsAndMirror } from "./document";
+import {
+  getScopedSecretKeys,
+  resolveSecretsScope,
+  secretsScopeChoices,
+} from "./scope";
+
+const resolveValue = async (
+  io: IO,
+  value: string | undefined,
+  valueFile: string | undefined,
+): Promise<string> => {
+  if (valueFile) {
+    // a trailing newline is almost never part of the secret
+    return (await readFile(valueFile)).toString("utf-8").replace(/\n$/, "");
+  }
+  if (value !== undefined) {
+    return value;
+  }
+  if (!process.stdin.isTTY) {
+    return (await readStdin()).replace(/\n$/, "");
+  }
+  return io.promptDirect({
+    name: "value",
+    type: "string",
+    message: "value",
+  });
+};
+
+export const commandSecretsSet = defineCommand({
+  name: "project secrets-set",
+  description:
+    "sets one secret — in one env (dev:web), one env everywhere (dev:), or all envs of a component (:web); value via --value, --value-file or stdin",
+  group: "project",
+  inputs: {
+    envComponent: {
+      type: "string",
+      message: "scope: env:component, env:, or :component",
+      positional: true,
+      choices: async () => secretsScopeChoices(),
+    },
+    key: {
+      type: "string",
+      message: "which secret?",
+      positional: true,
+      choices: async (ctx) => {
+        const scope = await resolveSecretsScope(await ctx.get("envComponent"));
+        const scoped = await getScopedSecretKeys(scope);
+        return [...new Set(scoped.flatMap(({ keys }) => keys))];
+      },
+    },
+    value: {
+      type: "string",
+      message:
+        "the secret value (prefer --value-file or stdin over shell history)",
+      required: false,
+    },
+    valueFile: {
+      type: "string",
+      message: "read the secret value from this file",
+      required: false,
+    },
+  },
+  execute: async (ctx) => {
+    const scope = await resolveSecretsScope(await ctx.get("envComponent"));
+    const key = await ctx.get("key");
+    // drops env/component pairs where the key is not declared and
+    // throws when it is declared nowhere in the scope
+    const scoped = await getScopedSecretKeys(scope, [key]);
+    const value = await resolveValue(
+      ctx,
+      await ctx.get("value"),
+      await ctx.get("valueFile"),
+    );
+
+    const targets = scoped.map(
+      ({ env, componentName }) => `${env}:${componentName}`,
+    );
+    ctx.log(`setting ${key} in: ${targets.join(", ")}`);
+    if (targets.length > 1) {
+      const confirmed = await ctx.confirm(
+        `write the same value to ${targets.length} environments? 🤔`,
+      );
+      if (!confirmed) {
+        throw new Error("abort");
+      }
+    }
+
+    const writes: SecretsWrite[] = scoped.map(({ env, componentName }) => ({
+      env,
+      componentName,
+      secrets: { [key]: value },
+    }));
+    await writeSecretsAndMirror(ctx, writes);
+    ctx.log("done! 😻");
+  },
+});