@dotenvx/dotenvx 1.64.0 → 1.65.1

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.64.0",
+  "version": "1.65.1",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/extensions/ops.js

@@ -42,7 +42,7 @@ class Ops {
     if (publicKey) args.push(publicKey)
 
     try {
-      return JSON.parse(await this._exec(binary, args))
+      return JSON.parse(await this._execInteractive(binary, args))
     } catch (_e) {
       return {}
     }
@@ -58,7 +58,7 @@ class Ops {
     if (publicKey) args.push(publicKey)
 
     try {
-      return JSON.parse(this._execSync(binary, args))
+      return JSON.parse(this._execInteractiveSync(binary, args))
     } catch (_e) {
       return {}
     }
@@ -104,6 +104,36 @@ class Ops {
     return childProcess.execFileSync(binary, args).toString().trim()
   }
 
+  _execInteractive (binary, args) {
+    return new Promise((resolve, reject) => {
+      const subprocess = childProcess.spawn(binary, args, {
+        stdio: ['inherit', 'pipe', 'inherit']
+      })
+      let stdout = ''
+
+      subprocess.stdout.on('data', (data) => {
+        stdout += data.toString()
+      })
+      subprocess.on('error', reject)
+      subprocess.on('close', (code) => {
+        if (code !== 0) {
+          reject(new Error(`${binary} ${args.join(' ')} exited with code ${code}`))
+          return
+        }
+
+        resolve(stdout.trim())
+      })
+    })
+  }
+
+  _execInteractiveSync (binary, args) {
+    logger.debug(binary)
+    logger.debug(args)
+    return childProcess.execFileSync(binary, args, {
+      stdio: ['inherit', 'pipe', 'inherit']
+    }).toString().trim()
+  }
+
   async _resolveBinary () {
     if (this._binaryPromise) return this._binaryPromise
 

package/src/lib/helpers/replace.js

@@ -1,55 +1,68 @@
-const quotes = require('./quotes')
 const dotenvParse = require('./dotenvParse')
 const escapeForRegex = require('./escapeForRegex')
-const escapeDollarSigns = require('./escapeDollarSigns')
 
-function replace (src, key, replaceValue) {
-  let output
-  let newPart = ''
+function replaceExistingValue (src, key, originalValue, replaceValue) {
+  const escapedKey = escapeForRegex(key)
+  const escapedOriginalValue = escapeForRegex(originalValue)
 
-  const parsed = dotenvParse(src, true, true) // skip expanding \n and skip converting \r\n
-  const _quotes = quotes(src)
-  if (Object.prototype.hasOwnProperty.call(parsed, key)) {
-    const quote = _quotes[key]
-    newPart += `${key}=${quote}${replaceValue}${quote}`
+  // conditionally enforce end of line
+  let enforceEndOfLine = ''
+  if (escapedOriginalValue === '') {
+    enforceEndOfLine = '$' // EMPTY scenario
+  }
 
-    const originalValue = parsed[key]
-    const escapedOriginalValue = escapeForRegex(originalValue)
+  const currentPart = new RegExp(
+    '^' + // start of line
+    '(\\s*)?' + // spaces
+    '(export\\s+)?' + // export
+    escapedKey + // KEY
+    '\\s*=\\s*' + // spaces (KEY = value)
+    '(["\'`]?)' + // open quote
+    escapedOriginalValue + // escaped value
+    '\\3' + // close quote
+    enforceEndOfLine
+    ,
+    'gm' // (g)lobal (m)ultiline
+  )
 
-    // conditionally enforce end of line
-    let enforceEndOfLine = ''
-    if (escapedOriginalValue === '') {
-      enforceEndOfLine = '$' // EMPTY scenario
+  return src.replace(currentPart, function (match, spaces = '', exportPart = '', quote = '') {
+    let newPart = `${key}=${quote}${replaceValue}${quote}`
 
-      // if empty quote and consecutive newlines
-      const newlineMatch = src.match(new RegExp(`${key}\\s*=\\s*\n\n`, 'm')) // match any consecutive newline scenario for a blank value
-      if (quote === '' && newlineMatch) {
-        const newlineCount = (newlineMatch[0].match(/\n/g)).length - 1
-        for (let i = 0; i < newlineCount; i++) {
-          newPart += '\n' // re-append the extra newline to preserve user's format choice
-        }
+    // if empty quote and consecutive newlines
+    const newlineMatch = src.match(new RegExp(`${escapedKey}\\s*=\\s*\n\n`, 'm')) // match any consecutive newline scenario for a blank value
+    if (escapedOriginalValue === '' && quote === '' && newlineMatch) {
+      const newlineCount = (newlineMatch[0].match(/\n/g)).length - 1
+      for (let i = 0; i < newlineCount; i++) {
+        newPart += '\n' // re-append the extra newline to preserve user's format choice
       }
     }
 
-    const currentPart = new RegExp(
-      '^' + // start of line
-      '(\\s*)?' + // spaces
-      '(export\\s+)?' + // export
-      key + // KEY
-      '\\s*=\\s*' + // spaces (KEY = value)
-      '["\'`]?' + // open quote
-      escapedOriginalValue + // escaped value
-      '["\'`]?' + // close quote
-      enforceEndOfLine
-      ,
-      'gm' // (g)lobal (m)ultiline
-    )
+    return `${spaces}${exportPart}${newPart}`
+  })
+}
 
-    const saferInput = escapeDollarSigns(newPart) // cleanse user inputted capture groups ($1, $2 etc)
+function replace (src, key, replaceValue) {
+  let output
+  let newPart = ''
+
+  const parsed = dotenvParse(src, true, true, true) // skip expanding \n and skip converting \r\n
+  if (Object.prototype.hasOwnProperty.call(parsed, key)) {
+    const allValues = parsed[key]
+    let duplicateOutput = src
+    const replacements = Array.isArray(replaceValue) ? replaceValue : allValues.map(() => replaceValue)
+    const replacementByValue = new Map()
+
+    allValues.forEach((value, index) => {
+      if (!replacementByValue.has(value)) {
+        replacementByValue.set(value, replacements[index])
+      }
+    })
+
+    for (const [value, replacement] of replacementByValue) {
+      duplicateOutput = replaceExistingValue(duplicateOutput, key, value, replacement)
+    }
 
-    // $1 preserves spaces
-    // $2 preserves export
-    output = src.replace(currentPart, `$1$2${saferInput}`)
+    return duplicateOutput
   } else {
     newPart += `${key}="${replaceValue}"`
 

package/src/lib/services/decrypt.js

@@ -74,7 +74,7 @@ class Decrypt {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc)
+      const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { privateKeyName } = keyNames(envFilepath)
       const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
@@ -83,7 +83,7 @@ class Decrypt {
       row.privateKeyName = privateKeyName
       row.changed = false // track possible changes
 
-      for (const [key, value] of Object.entries(envParsed)) {
+      for (const [key, values] of Object.entries(envParsed)) {
         // key excluded - don't decrypt it
         if (this.exclude(key)) {
           continue
@@ -94,13 +94,20 @@ class Decrypt {
           continue
         }
 
-        const encrypted = isEncrypted(value)
+        const encrypted = values.some(value => isEncrypted(value))
         if (encrypted) {
           row.keys.push(key) // track key(s)
 
-          const decryptedValue = decryptKeyValue(key, value, privateKeyName, privateKeyValue)
+          const decryptedValues = values.map(value => {
+            if (!isEncrypted(value)) {
+              return value
+            }
+
+            return decryptKeyValue(key, value, privateKeyName, privateKeyValue)
+          })
+
           // once newSrc is built write it out
-          envSrc = replace(envSrc, key, decryptedValue)
+          envSrc = replace(envSrc, key, decryptedValues)
 
           row.changed = true // track change
         }

package/src/lib/services/encrypt.js

@@ -91,7 +91,7 @@ class Encrypt {
         row.kitCreated = 'sample'
         row.changed = true
       }
-      const envParsed = dotenvParse(envSrc)
+      const envParsed = dotenvParse(envSrc, false, false, true)
 
       let publicKey
       let privateKey
@@ -122,7 +122,7 @@ class Encrypt {
       row.privateKeyName = privateKeyName
 
       // iterate over all non-encrypted values and encrypt them
-      for (const [key, value] of Object.entries(envParsed)) {
+      for (const [key, values] of Object.entries(envParsed)) {
         // key excluded - don't encrypt it
         if (this.exclude(key)) {
           continue
@@ -133,19 +133,24 @@ class Encrypt {
           continue
         }
 
-        const encrypted = isEncrypted(value) || isPublicKey(key)
+        const encrypted = values.every(value => isEncrypted(value) || isPublicKey(key))
         if (!encrypted) {
           row.keys.push(key) // track key(s)
 
-          let encryptedValue
-          try {
-            encryptedValue = encryptValue(value, publicKey)
-          } catch {
-            throw new Errors({ publicKeyName, publicKey }).invalidPublicKey()
-          }
+          const encryptedValues = values.map(value => {
+            if (isEncrypted(value) || isPublicKey(key)) {
+              return value
+            }
+
+            try {
+              return encryptValue(value, publicKey)
+            } catch {
+              throw new Errors({ publicKeyName, publicKey }).invalidPublicKey()
+            }
+          })
 
           // once newSrc is built write it out
-          envSrc = replace(envSrc, key, encryptedValue)
+          envSrc = replace(envSrc, key, encryptedValues)
 
           row.changed = true // track change
         }

package/src/lib/services/rotate.js

@@ -80,7 +80,7 @@ class Rotate {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc)
+      const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
       const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
@@ -116,7 +116,7 @@ class Rotate {
       envSrc = replace(envSrc, publicKeyName, newPublicKey) // replace publicKey
       row.changed = true // track change
 
-      for (const [key, value] of Object.entries(envParsed)) { // re-encrypt each individual key
+      for (const [key, values] of Object.entries(envParsed)) { // re-encrypt each individual key
         // key excluded - don't re-encrypt it
         if (this.exclude(key)) {
           continue
@@ -127,7 +127,8 @@ class Rotate {
           continue
         }
 
-        if (isEncrypted(value)) { // only re-encrypt those already encrypted
+        const value = [...values].reverse().find(value => isEncrypted(value))
+        if (value) { // only re-encrypt those already encrypted
           row.keys.push(key) // track key(s)
 
           const decryptedValue = decryptKeyValue(key, value, privateKeyName, privateKeyValue) // get decrypted value

package/src/lib/services/sets.js

@@ -29,6 +29,10 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 const detectEncodingSync = require('./../helpers/detectEncodingSync')
 
+function allValuesForKey (envSrc, key) {
+  return dotenvParse(envSrc, false, false, true)[key] || []
+}
+
 class Sets {
   constructor (key, value, envs = [], encrypt = true, envKeysFilepath = null, noOps = false, noCreate = false) {
     this.envs = determine(envs, process.env)
@@ -163,13 +167,14 @@ class Sets {
 
       const goingFromPlainTextToEncrypted = wasPlainText && this.encrypt
       const valueChanged = this.value !== row.originalValue
+      const duplicateKey = allValuesForKey(envSrc, row.key).length > 1
       const shouldPersistSeededPlainValue = seededWithInitialKey && !this.encrypt
 
       if (shouldPersistSeededPlainValue) {
         row.envSrc = envSrc
         this.changedFilepaths.add(envFilepath)
         row.changed = true
-      } else if (goingFromPlainTextToEncrypted || valueChanged) {
+      } else if (goingFromPlainTextToEncrypted || valueChanged || duplicateKey) {
         row.envSrc = replace(envSrc, this.key, row.encryptedValue || this.value)
         this.changedFilepaths.add(envFilepath)
         row.changed = true
@@ -269,13 +274,14 @@ class Sets {
 
       const goingFromPlainTextToEncrypted = wasPlainText && this.encrypt
       const valueChanged = this.value !== row.originalValue
+      const duplicateKey = allValuesForKey(envSrc, row.key).length > 1
       const shouldPersistSeededPlainValue = seededWithInitialKey && !this.encrypt
 
       if (shouldPersistSeededPlainValue) {
         row.envSrc = envSrc
         this.changedFilepaths.add(envFilepath)
         row.changed = true
-      } else if (goingFromPlainTextToEncrypted || valueChanged) {
+      } else if (goingFromPlainTextToEncrypted || valueChanged || duplicateKey) {
         row.envSrc = replace(envSrc, this.key, row.encryptedValue || this.value)
         this.changedFilepaths.add(envFilepath)
         row.changed = true