@coffre/cli 0.1.0 → 0.1.2

package/dist/keys-D9CG_wYV.js

@@ -0,0 +1,64 @@
+import { parseArgs } from "node:util";
+import { randomBytes } from "node:crypto";
+//#region src/keys.ts
+/**
+* Two fresh keys, each 32 random bytes in base64, and an id for the KEK
+* dated to the day, so that a rotation, even one the same month, gets a new
+* one: the vault refuses two KEKs with the same id.
+*/
+function generateKeys(now = /* @__PURE__ */ new Date()) {
+	const key = () => randomBytes(32).toString("base64");
+	return {
+		KEK_ID: `kek-${now.toISOString().slice(0, 10)}`,
+		KEK: key(),
+		AUDIT_CHAIN_KEY: key()
+	};
+}
+/** What each key is for, as comments: `coffre keys` and `coffre setup` both say it. */
+const KEYS_EXPLAINED = `# Two keys, one for each component, so that the app, which faces the
+# network, never holds what decrypts a value:
+#
+#   KEK              the vault's. Decrypts every value, and signs the vault's
+#                    log entries, member rows and checkpoints. Lose it, and
+#                    every value is lost for good.
+#   AUDIT_CHAIN_KEY  the app's. Signs the app's log entries, sessions and
+#                    tokens. Lose it, and everyone is signed out and the log
+#                    stops verifying.
+#   KEK_ID           names the KEK; not secret.
+#
+# Whoever has the KEK and a copy of the database has every value: keep it
+# apart from the backups.
+`;
+/** The keys as a dotenv block, then, as comments, what each is for and where it goes. */
+function formatKeys(keys) {
+	return `KEK_ID=${keys.KEK_ID}
+KEK=${keys.KEK}
+AUDIT_CHAIN_KEY=${keys.AUDIT_CHAIN_KEY}
+
+# Save all three in your password manager now. They are shown once, and
+# coffre keeps no copy.
+#
+${KEYS_EXPLAINED}#
+# On Workers, KEK_ID is a var in vault/wrangler.jsonc, and KEK and
+# AUDIT_CHAIN_KEY are Worker secrets (wrangler secret put). On Node, KEK_ID
+# and KEK go in vault.env, and AUDIT_CHAIN_KEY in server.env.
+#
+# These are for a new deployment. To rotate a deployment's KEK, take only
+# KEK_ID and KEK, and keep the old pair in previousKeks, for what it wrapped
+# and signed. AUDIT_CHAIN_KEY cannot be changed.
+`;
+}
+function keys(args) {
+	const { values } = parseArgs({
+		args,
+		options: { json: {
+			type: "boolean",
+			default: false
+		} },
+		allowPositionals: false
+	});
+	const fresh = generateKeys();
+	process.stdout.write(values.json ? `${JSON.stringify(fresh)}\n` : formatKeys(fresh));
+}
+//#endregion
+export { generateKeys as n, keys as r, KEYS_EXPLAINED as t };

package/dist/main.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { r as keys } from "./keys-D9CG_wYV.js";
+import { i as isRole, r as assignableToEnvironment, t as ROLES } from "./access-CO1kGjWW.js";
 import { parseArgs, promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -466,79 +468,6 @@ async function planImport(coffre, path, entries) {
 	};
 }
 //#endregion
-//#region ../core/dist/access.js
-/**
-* Who may do what: seven permissions and the six roles that bundle them.
-*
-* Deliberately constants and not tables or a policy language. A grant names
-* one role for one member on one place, and a check is a lookup in this file,
-* so authorisation stays something you can read end to end.
-*/
-const PERMISSIONS = [
-	"secret.read",
-	"secret.write",
-	"secret.archive",
-	"audit.read",
-	"environment.manage",
-	"grant.manage",
-	"project.manage"
-];
-/**
-* Permissions that only make sense on a project. Granting
-* `environment.manage` on one environment would be incoherent: what it
-* authorises is creating that environment's siblings.
-*/
-const PROJECT_ONLY_PERMISSIONS = [
-	"environment.manage",
-	"grant.manage",
-	"project.manage"
-];
-const ROLES = {
-	viewer: {
-		name: "Viewer",
-		description: "Read secret values.",
-		permissions: ["secret.read"]
-	},
-	developer: {
-		name: "Developer",
-		description: "Read and write secrets.",
-		permissions: ["secret.read", "secret.write"]
-	},
-	maintainer: {
-		name: "Maintainer",
-		description: "Read, write and retire secrets, and manage environments.",
-		permissions: [
-			"secret.read",
-			"secret.write",
-			"secret.archive",
-			"environment.manage"
-		]
-	},
-	"access-manager": {
-		name: "Access manager",
-		description: "Manage who has access. Cannot read secret values.",
-		permissions: ["grant.manage"]
-	},
-	auditor: {
-		name: "Auditor",
-		description: "Read the audit log. Cannot read secret values.",
-		permissions: ["audit.read"]
-	},
-	owner: {
-		name: "Owner",
-		description: "Everything, including reading secret values.",
-		permissions: [...PERMISSIONS]
-	}
-};
-Object.keys(ROLES);
-function isRole(value) {
-	return Object.hasOwn(ROLES, value);
-}
-/** Roles that hold a project-only permission can only be granted on a project. */
-function assignableToEnvironment(role) {
-	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
-}
-//#endregion
 //#region ../core/dist/dotenv.js
 const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 function parseDotenv(input) {
@@ -1531,6 +1460,10 @@ const USAGE = `coffre - secrets, with an audit log
   New deployment
     coffre init --workers [<dir>]           two Cloudflare Workers: the app and its vault
     coffre init --node [<dir>]              a Node server, and its vault beside it
+    coffre setup [--reset-passwords] [--json]
+                                            its database logins, migrations and keys, in one go,
+                                            shown once (the connection string is asked for)
+    coffre keys [--json]                    its keys and the KEK's id alone, made here and shown once
 
   Session
     coffre login [<url>] [--no-browser]     sign in, and make <url> the current instance
@@ -1579,6 +1512,12 @@ switch (command) {
 	case "init":
 		initProject(rest);
 		break;
+	case "keys":
+		keys(rest);
+		break;
+	case "setup":
+		await (await import("./setup-DPHVyr2N.js")).setup(rest);
+		break;
 	case "login":
 		await login(rest);
 		break;