@dotenvx/dotenvx 0.38.0 → 0.40.0

package/src/lib/services/precommit.js

@@ -3,7 +3,9 @@ const fs = require('fs')
 const ignore = require('ignore')
 
 const pluralize = require('./../helpers/pluralize')
+const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const InstallPrecommitHook = require('./../helpers/installPrecommitHook')
+const MISSING_GITIGNORE = '.env.keys' // by default only ignore .env.keys. all other .env* files COULD be included - as long as they are encrypted
 
 class Precommit {
   constructor (options = {}) {
@@ -22,16 +24,20 @@ class Precommit {
       }
     } else {
       const warnings = []
+      let successMessage = 'success'
+      let gitignore = MISSING_GITIGNORE
 
       // 1. check for .gitignore file
       if (!fs.existsSync('.gitignore')) {
-        const error = new Error('.gitignore missing')
-        error.help = '? add it with [touch .gitignore]'
-        throw error
+        const warning = new Error('.gitignore missing')
+        warning.help = '? add it with [touch .gitignore]'
+        warnings.push(warning)
+      } else {
+        gitignore = fs.readFileSync('.gitignore').toString()
       }
 
       // 2. check .env* files against .gitignore file
-      const ig = ignore().add(fs.readFileSync('.gitignore').toString())
+      const ig = ignore().add(gitignore)
       const files = fs.readdirSync(process.cwd())
       const dotenvFiles = files.filter(file => file.match(/^\.env(\..+)?$/))
       dotenvFiles.forEach(file => {
@@ -44,14 +50,19 @@ class Precommit {
           }
         } else {
           if (file !== '.env.example' && file !== '.env.vault') {
-            const error = new Error(`${file} not properly gitignored`)
-            error.help = `? add ${file} to .gitignore with [echo ".env*" >> .gitignore]`
-            throw error
+            const src = fs.readFileSync(file).toString()
+            const encrypted = isFullyEncrypted(src)
+
+            // if contents are encrypted don't raise an error
+            if (!encrypted) {
+              const error = new Error(`${file} not encrypted (or not gitignored)`)
+              error.help = `? encrypt it with [dotenvx protect -f ${file}] or add ${file} to .gitignore with [echo ".env*" >> .gitignore]`
+              throw error
+            }
           }
         }
       })
 
-      let successMessage = 'success'
       if (warnings.length > 0) {
         successMessage = `success (with ${pluralize('warning', warnings.length)})`
       }

package/src/lib/services/sets.js

@@ -1,7 +1,10 @@
 const fs = require('fs')
 const path = require('path')
 
+const dotenv = require('dotenv')
+
 const findOrCreatePublicKey = require('./../helpers/findOrCreatePublicKey')
+const guessPrivateKeyName = require('./../helpers/guessPrivateKeyName')
 const encryptValue = require('./../helpers/encryptValue')
 const replace = require('./../helpers/replace')
 
@@ -14,39 +17,57 @@ class Sets {
     this.envFile = envFile
     this.encrypt = encrypt
 
-    this.publicKey = null
     this.processedEnvFiles = []
-    this.settableFilepaths = new Set()
+    this.changedFilepaths = new Set()
+    this.unchangedFilepaths = new Set()
   }
 
   run () {
     const envFilepaths = this._envFilepaths()
     for (const envFilepath of envFilepaths) {
+      const filepath = path.resolve(envFilepath)
+
       const row = {}
       row.key = this.key
-      row.filepath = envFilepath
       row.value = this.value
+      row.filepath = filepath
+      row.envFilepath = envFilepath
+      row.changed = false
 
-      const filepath = path.resolve(envFilepath)
       try {
         let value = this.value
         let src = fs.readFileSync(filepath, { encoding: ENCODING })
+        row.originalValue = dotenv.parse(src)[row.key] || null
+
         if (this.encrypt) {
           const envKeysFilepath = path.join(path.dirname(filepath), '.env.keys')
           const {
+            envSrc,
             publicKey,
-            envSrc
+            privateKey,
+            privateKeyAdded
           } = findOrCreatePublicKey(filepath, envKeysFilepath)
           src = envSrc // overwrite the original read (because findOrCreatePublicKey) rewrite to it
           value = encryptValue(value, publicKey)
-          row.encryptedValue = value // useful
+
+          row.changed = true // track change
+          row.encryptedValue = value
           row.publicKey = publicKey
+          row.privateKey = privateKey
+          row.privateKeyAdded = privateKeyAdded
+          row.privateKeyName = guessPrivateKeyName(filepath)
         }
 
-        const newSrc = replace(src, this.key, value)
-        fs.writeFileSync(filepath, newSrc)
+        if (value !== row.originalValue) {
+          row.envSrc = replace(src, this.key, value)
+
+          this.changedFilepaths.add(envFilepath)
+          row.changed = true
+        } else {
+          row.envSrc = src
 
-        this.settableFilepaths.add(envFilepath)
+          this.unchangedFilepaths.add(envFilepath)
+        }
       } catch (e) {
         if (e.code === 'ENOENT') {
           const error = new Error(`missing ${envFilepath} file (${filepath})`)
@@ -63,7 +84,8 @@ class Sets {
 
     return {
       processedEnvFiles: this.processedEnvFiles,
-      settableFilepaths: [...this.settableFilepaths]
+      changedFilepaths: [...this.changedFilepaths],
+      unchangedFilepaths: [...this.unchangedFilepaths]
     }
   }
 

package/src/lib/services/vaultEncrypt.js

@@ -0,0 +1,118 @@
+const fs = require('fs')
+const path = require('path')
+const dotenv = require('dotenv')
+
+const DotenvKeys = require('./../helpers/dotenvKeys')
+const DotenvVault = require('./../helpers/dotenvVault')
+
+const ENCODING = 'utf8'
+
+const findEnvFiles = require('../helpers/findEnvFiles')
+
+class VaultEncrypt {
+  constructor (directory = '.', envFile) {
+    this.directory = directory
+    this.envFile = envFile || findEnvFiles(directory)
+    // calculated
+    this.envKeysFilepath = path.resolve(this.directory, '.env.keys')
+    this.envVaultFilepath = path.resolve(this.directory, '.env.vault')
+  }
+
+  run () {
+    if (this.envFile.length < 1) {
+      const code = 'MISSING_ENV_FILES'
+      const message = 'no .env* files found'
+      const help = '? add one with [echo "HELLO=World" > .env] and then run [dotenvx vault encrypt]'
+
+      const error = new Error(message)
+      error.code = code
+      error.help = help
+      throw error
+    }
+
+    const parsedDotenvKeys = this._parsedDotenvKeys()
+    const parsedDotenvVaults = this._parsedDotenvVault()
+    const envFilepaths = this._envFilepaths()
+
+    // build filepaths to be passed to DotenvKeys
+    const uniqueEnvFilepaths = new Set()
+    for (const envFilepath of envFilepaths) {
+      const filepath = path.resolve(this.directory, envFilepath)
+      if (!fs.existsSync(filepath)) {
+        const code = 'MISSING_ENV_FILE'
+        const message = `file does not exist at [${filepath}]`
+        const help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx vault encrypt]`
+
+        const error = new Error(message)
+        error.code = code
+        error.help = help
+        throw error
+      }
+
+      uniqueEnvFilepaths.add(filepath)
+    }
+
+    // generate .env.keys string
+    const {
+      dotenvKeys,
+      dotenvKeysFile,
+      addedKeys,
+      existingKeys
+    } = new DotenvKeys([...uniqueEnvFilepaths], parsedDotenvKeys).run()
+
+    // build look up of .env filepaths and their raw content
+    const dotenvFiles = {}
+    for (const filepath of [...uniqueEnvFilepaths]) {
+      const raw = fs.readFileSync(filepath, ENCODING)
+      dotenvFiles[filepath] = raw
+    }
+
+    // generate .env.vault string
+    const {
+      dotenvVaultFile,
+      addedVaults,
+      existingVaults,
+      addedDotenvFilenames
+    } = new DotenvVault(dotenvFiles, dotenvKeys, parsedDotenvVaults).run()
+
+    return {
+      // from DotenvKeys
+      dotenvKeys,
+      dotenvKeysFile,
+      addedKeys,
+      existingKeys,
+      // from DotenvVault
+      dotenvVaultFile,
+      addedVaults,
+      existingVaults,
+      addedDotenvFilenames,
+      envFile: this.envFile
+    }
+  }
+
+  _envFilepaths () {
+    if (!Array.isArray(this.envFile)) {
+      return [this.envFile]
+    }
+
+    return this.envFile
+  }
+
+  _parsedDotenvKeys () {
+    const options = {
+      path: this.envKeysFilepath
+    }
+
+    return dotenv.configDotenv(options).parsed
+  }
+
+  _parsedDotenvVault () {
+    const options = {
+      path: this.envVaultFilepath
+    }
+
+    return dotenv.configDotenv(options).parsed
+  }
+}
+
+module.exports = VaultEncrypt