@coffre/cli 0.1.1 → 0.1.2

package/dist/keys-D9CG_wYV.js

@@ -0,0 +1,64 @@
+import { parseArgs } from "node:util";
+import { randomBytes } from "node:crypto";
+//#region src/keys.ts
+/**
+* Two fresh keys, each 32 random bytes in base64, and an id for the KEK
+* dated to the day, so that a rotation, even one the same month, gets a new
+* one: the vault refuses two KEKs with the same id.
+*/
+function generateKeys(now = /* @__PURE__ */ new Date()) {
+	const key = () => randomBytes(32).toString("base64");
+	return {
+		KEK_ID: `kek-${now.toISOString().slice(0, 10)}`,
+		KEK: key(),
+		AUDIT_CHAIN_KEY: key()
+	};
+}
+/** What each key is for, as comments: `coffre keys` and `coffre setup` both say it. */
+const KEYS_EXPLAINED = `# Two keys, one for each component, so that the app, which faces the
+# network, never holds what decrypts a value:
+#
+#   KEK              the vault's. Decrypts every value, and signs the vault's
+#                    log entries, member rows and checkpoints. Lose it, and
+#                    every value is lost for good.
+#   AUDIT_CHAIN_KEY  the app's. Signs the app's log entries, sessions and
+#                    tokens. Lose it, and everyone is signed out and the log
+#                    stops verifying.
+#   KEK_ID           names the KEK; not secret.
+#
+# Whoever has the KEK and a copy of the database has every value: keep it
+# apart from the backups.
+`;
+/** The keys as a dotenv block, then, as comments, what each is for and where it goes. */
+function formatKeys(keys) {
+	return `KEK_ID=${keys.KEK_ID}
+KEK=${keys.KEK}
+AUDIT_CHAIN_KEY=${keys.AUDIT_CHAIN_KEY}
+
+# Save all three in your password manager now. They are shown once, and
+# coffre keeps no copy.
+#
+${KEYS_EXPLAINED}#
+# On Workers, KEK_ID is a var in vault/wrangler.jsonc, and KEK and
+# AUDIT_CHAIN_KEY are Worker secrets (wrangler secret put). On Node, KEK_ID
+# and KEK go in vault.env, and AUDIT_CHAIN_KEY in server.env.
+#
+# These are for a new deployment. To rotate a deployment's KEK, take only
+# KEK_ID and KEK, and keep the old pair in previousKeks, for what it wrapped
+# and signed. AUDIT_CHAIN_KEY cannot be changed.
+`;
+}
+function keys(args) {
+	const { values } = parseArgs({
+		args,
+		options: { json: {
+			type: "boolean",
+			default: false
+		} },
+		allowPositionals: false
+	});
+	const fresh = generateKeys();
+	process.stdout.write(values.json ? `${JSON.stringify(fresh)}\n` : formatKeys(fresh));
+}
+//#endregion
+export { generateKeys as n, keys as r, KEYS_EXPLAINED as t };

package/dist/main.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
+import { r as keys } from "./keys-D9CG_wYV.js";
+import { i as isRole, r as assignableToEnvironment, t as ROLES } from "./access-CO1kGjWW.js";
 import { parseArgs, promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { randomBytes } from "node:crypto";
 //#region src/init.ts
 const KINDS = ["workers", "node"];
 /** Where a template lives: in the package when published, else in the repository. */
@@ -69,67 +70,6 @@ function init(kind, target, version) {
 	return written;
 }
 //#endregion
-//#region src/keys.ts
-/**
-* Three fresh keys, each 32 random bytes in base64, and an id for the KEK
-* dated to the day, so that a rotation, even one the same month, gets a new
-* one: the vault refuses two KEKs with the same id.
-*/
-function generateKeys(now = /* @__PURE__ */ new Date()) {
-	const key = () => randomBytes(32).toString("base64");
-	return {
-		KEK_ID: `kek-${now.toISOString().slice(0, 10)}`,
-		KEK: key(),
-		SIGNING_KEY: key(),
-		AUDIT_CHAIN_KEY: key()
-	};
-}
-/** The keys as a dotenv block, then, as comments, what each is for and where it goes. */
-function formatKeys(keys) {
-	return `KEK_ID=${keys.KEK_ID}
-KEK=${keys.KEK}
-SIGNING_KEY=${keys.SIGNING_KEY}
-AUDIT_CHAIN_KEY=${keys.AUDIT_CHAIN_KEY}
-
-# Save all four in your password manager now. They are shown once, and
-# coffre keeps no copy.
-#
-# The vault gets KEK_ID, KEK and SIGNING_KEY; the app gets AUDIT_CHAIN_KEY.
-# They are kept apart so that the app, which faces the network, never holds
-# what decrypts a value: whoever has the KEK and a copy of the database has
-# every value.
-#
-#   KEK              decrypts every value. Lose it, and every value is lost.
-#   SIGNING_KEY      signs the vault's log entries, checkpoints and member
-#                    rows. Lose it, and the log stops verifying and every
-#                    member is refused.
-#   AUDIT_CHAIN_KEY  signs the app's log entries, sessions and tokens. Lose
-#                    it, and the log stops verifying and everyone is signed
-#                    out.
-#   KEK_ID           names the KEK; not secret.
-#
-# On Workers, KEK_ID is a var in vault/wrangler.jsonc, and the other three are
-# Worker secrets (wrangler secret put). On Node, they go in vault.env and
-# server.env.
-#
-# These are for a new deployment. To rotate a deployment's KEK, take only
-# KEK_ID and KEK, and keep the old pair in previousKeks: its SIGNING_KEY and
-# AUDIT_CHAIN_KEY cannot be changed.
-`;
-}
-function keys(args) {
-	const { values } = parseArgs({
-		args,
-		options: { json: {
-			type: "boolean",
-			default: false
-		} },
-		allowPositionals: false
-	});
-	const fresh = generateKeys();
-	process.stdout.write(values.json ? `${JSON.stringify(fresh)}\n` : formatKeys(fresh));
-}
-//#endregion
 //#region src/instance.ts
 const MODES = ["signin", "cloudflare"];
 function emptyStore() {
@@ -528,79 +468,6 @@ async function planImport(coffre, path, entries) {
 	};
 }
 //#endregion
-//#region ../core/dist/access.js
-/**
-* Who may do what: seven permissions and the six roles that bundle them.
-*
-* Deliberately constants and not tables or a policy language. A grant names
-* one role for one member on one place, and a check is a lookup in this file,
-* so authorisation stays something you can read end to end.
-*/
-const PERMISSIONS = [
-	"secret.read",
-	"secret.write",
-	"secret.archive",
-	"audit.read",
-	"environment.manage",
-	"grant.manage",
-	"project.manage"
-];
-/**
-* Permissions that only make sense on a project. Granting
-* `environment.manage` on one environment would be incoherent: what it
-* authorises is creating that environment's siblings.
-*/
-const PROJECT_ONLY_PERMISSIONS = [
-	"environment.manage",
-	"grant.manage",
-	"project.manage"
-];
-const ROLES = {
-	viewer: {
-		name: "Viewer",
-		description: "Read secret values.",
-		permissions: ["secret.read"]
-	},
-	developer: {
-		name: "Developer",
-		description: "Read and write secrets.",
-		permissions: ["secret.read", "secret.write"]
-	},
-	maintainer: {
-		name: "Maintainer",
-		description: "Read, write and retire secrets, and manage environments.",
-		permissions: [
-			"secret.read",
-			"secret.write",
-			"secret.archive",
-			"environment.manage"
-		]
-	},
-	"access-manager": {
-		name: "Access manager",
-		description: "Manage who has access. Cannot read secret values.",
-		permissions: ["grant.manage"]
-	},
-	auditor: {
-		name: "Auditor",
-		description: "Read the audit log. Cannot read secret values.",
-		permissions: ["audit.read"]
-	},
-	owner: {
-		name: "Owner",
-		description: "Everything, including reading secret values.",
-		permissions: [...PERMISSIONS]
-	}
-};
-Object.keys(ROLES);
-function isRole(value) {
-	return Object.hasOwn(ROLES, value);
-}
-/** Roles that hold a project-only permission can only be granted on a project. */
-function assignableToEnvironment(role) {
-	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
-}
-//#endregion
 //#region ../core/dist/dotenv.js
 const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 function parseDotenv(input) {
@@ -1593,7 +1460,10 @@ const USAGE = `coffre - secrets, with an audit log
   New deployment
     coffre init --workers [<dir>]           two Cloudflare Workers: the app and its vault
     coffre init --node [<dir>]              a Node server, and its vault beside it
-    coffre keys [--json]                    its three keys and the KEK's id, made here and shown once
+    coffre setup [--reset-passwords] [--json]
+                                            its database logins, migrations and keys, in one go,
+                                            shown once (the connection string is asked for)
+    coffre keys [--json]                    its keys and the KEK's id alone, made here and shown once
 
   Session
     coffre login [<url>] [--no-browser]     sign in, and make <url> the current instance
@@ -1645,6 +1515,9 @@ switch (command) {
 	case "keys":
 		keys(rest);
 		break;
+	case "setup":
+		await (await import("./setup-DPHVyr2N.js")).setup(rest);
+		break;
 	case "login":
 		await login(rest);
 		break;