@dotenvx/dotenvx 1.71.2 → 1.72.0

package/src/db/session.js

@@ -1,9 +1,139 @@
+const fs = require('fs')
+const path = require('path')
+const Conf = require('conf')
+const dotenv = require('dotenv')
+const envPaths = require('env-paths')
+
 const Armor = require('./../lib/extensions/armor')
+const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const { logger } = require('./../shared/logger')
 
+const ARMOR = {
+  HOSTNAME: 'DOTENVX_ARMOR_HOSTNAME',
+  USER: 'DOTENVX_ARMOR_USER',
+  USERNAME: 'DOTENVX_ARMOR_USERNAME',
+  TOKEN: 'DOTENVX_ARMOR_TOKEN',
+  ON: 'DOTENVX_ARMOR_ON',
+  VERSION: 'DOTENVX_ARMOR_VERSION',
+  VERSION_LAST_CHECK: 'DOTENVX_ARMOR_VERSION_LAST_CHECK'
+}
+
 class Session {
   constructor () {
     this.armor = new Armor()
+    this._store = null
+  }
+
+  _configPath () {
+    const cwd = process.env.DOTENVX_CONFIG || this._defaultConfigCwd()
+    return path.resolve(cwd, '.env')
+  }
+
+  _defaultConfigCwd () {
+    return envPaths('dotenvx', { suffix: '' }).config
+  }
+
+  _configExists () {
+    return fs.existsSync(this._configPath())
+  }
+
+  _newStore () {
+    return new Conf({
+      cwd: process.env.DOTENVX_CONFIG || undefined,
+      projectName: 'dotenvx',
+      configName: '.env',
+      projectSuffix: '',
+      fileExtension: '',
+      serialize: function (json) {
+        return jsonToEnv(json)
+      },
+      // Convert .env format to an object
+      deserialize: function (env) {
+        return dotenv.parse(env)
+      }
+    })
+  }
+
+  createStore () {
+    if (!this._store) this._store = this._newStore()
+    return this._store
+  }
+
+  openStore () {
+    if (!this._store && !this._configExists()) {
+      return null
+    }
+
+    if (!this._store) this._store = this._newStore()
+    return this._store
+  }
+
+  get store () {
+    return this.openStore()
+  }
+
+  status () {
+    // if logged in
+    if (this.username() && this.token() && this.on()) {
+      return 'on'
+    }
+
+    return 'off'
+  }
+
+  //
+  // Get
+  //
+  readSetting (key) {
+    const store = this.openStore()
+    if (!store) return undefined
+
+    return store.get(ARMOR[key])
+  }
+
+  hostname () {
+    return this.readSetting('HOSTNAME') || 'https://armor.dotenvx.com'
+  }
+
+  username () {
+    return this.readSetting('USERNAME') || undefined
+  }
+
+  token () {
+    return this.readSetting('TOKEN') || undefined
+  }
+
+  devicePublicKey () {
+    const Device = require('./device')
+    return new Device().publicKey()
+  }
+
+  path () {
+    return this._store ? this._store.path : this._configPath()
+  }
+
+  on () {
+    return (this.readSetting('ON') || 'true') === 'true'
+  }
+
+  off () {
+    return (this.readSetting('ON') || 'true') === 'false'
+  }
+
+  async systemInformation () {
+    const si = require('systeminformation')
+    const system = await si.system()
+    const osInfo = await si.osInfo()
+
+    return {
+      system_uuid: system.uuid,
+      os_platform: osInfo.platform,
+      os_arch: osInfo.arch
+    }
+  }
+
+  async notifyUpdate () {
+    // native login keeps this lightweight; sidecar commands still handle full update messaging
   }
 
   //
@@ -20,6 +150,62 @@ class Session {
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
+
+  //
+  // Set/Delete
+  //
+  login (hostname, id, username, accessToken) {
+    if (!hostname) {
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+    }
+
+    if (!id) {
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+    }
+
+    if (!username) {
+      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx login]')
+    }
+
+    if (!accessToken) {
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+    }
+
+    const store = this.createStore()
+    store.set(ARMOR.USER, id)
+    store.set(ARMOR.USERNAME, username)
+    store.set(ARMOR.TOKEN, accessToken)
+    store.set(ARMOR.HOSTNAME, hostname)
+    store.set(ARMOR.ON, 'true')
+
+    return accessToken
+  }
+
+  logout (hostname, id, accessToken) {
+    if (!hostname) {
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+    }
+
+    if (!id) {
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+    }
+
+    if (!accessToken) {
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+    }
+
+    const store = this.openStore()
+    if (!store) return true
+
+    store.delete(ARMOR.USER)
+    store.delete(ARMOR.USERNAME)
+    store.delete(ARMOR.TOKEN)
+    store.delete(ARMOR.HOSTNAME)
+    store.delete(ARMOR.ON)
+    store.delete(ARMOR.VERSION)
+    store.delete(ARMOR.VERSION_LAST_CHECK)
+    return true
+  }
 }
 
 module.exports = Session

package/src/lib/api/postLogout.js

@@ -0,0 +1,34 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostLogout {
+  constructor (hostname, token) {
+    this.hostname = hostname
+    this.token = token
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const url = `${this.hostname}/api/logout`
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({})
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostLogout

package/src/lib/api/postOauthDeviceCode.js

@@ -0,0 +1,38 @@
+const { http } = require('../helpers/http')
+const buildOauthError = require('../helpers/buildOauthError')
+
+const OAUTH_CLIENT_ID = 'oac_dotenvxcli'
+
+class PostOauthDeviceCode {
+  constructor (hostname, devicePublicKey, systemInformation, dotenvxProjectId = null) {
+    this.hostname = hostname
+    this.devicePublicKey = devicePublicKey
+    this.systemInformation = systemInformation
+    this.dotenvxProjectId = dotenvxProjectId
+  }
+
+  async run () {
+    const resp = await http(`${this.hostname}/oauth/device/code`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_id: OAUTH_CLIENT_ID,
+        device_public_key: this.devicePublicKey,
+        system_information: this.systemInformation,
+        dotenvx_project_id: this.dotenvxProjectId
+      })
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildOauthError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostOauthDeviceCode

package/src/lib/api/postOauthToken.js

@@ -0,0 +1,35 @@
+const { http } = require('../helpers/http')
+const buildOauthError = require('../helpers/buildOauthError')
+
+const OAUTH_CLIENT_ID = 'oac_dotenvxcli'
+
+class PostOauthToken {
+  constructor (hostname, deviceCode) {
+    this.hostname = hostname
+    this.deviceCode = deviceCode
+  }
+
+  async run () {
+    const resp = await http(`${this.hostname}/oauth/token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_id: OAUTH_CLIENT_ID,
+        device_code: this.deviceCode,
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+      })
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildOauthError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostOauthToken

package/src/lib/extensions/armor.js

@@ -43,6 +43,7 @@ class Armor {
     if (options.noSpinner) args.push('--no-spinner')
     if (options.token) args.push('--token', options.token)
     if (options.envFilepath) args.push('-f', options.envFilepath)
+    if (options.command) args.push('--metadata', this._serializeMetadata(options))
     if (publicKey) args.push(publicKey)
 
     try {
@@ -62,6 +63,7 @@ class Armor {
     if (options.noSpinner) args.push('--no-spinner')
     if (options.token) args.push('--token', options.token)
     if (options.envFilepath) args.push('-f', options.envFilepath)
+    if (options.command) args.push('--metadata', this._serializeMetadata(options))
     if (publicKey) args.push(publicKey)
 
     try {
@@ -97,6 +99,17 @@ class Armor {
     }
   }
 
+  _serializeMetadata (options) {
+    return JSON.stringify({
+      command: this._serializeCommand(options.command)
+    })
+  }
+
+  _serializeCommand (command) {
+    if (Array.isArray(command)) return command.map((arg) => `${arg}`).join(' ')
+    return `${command}`
+  }
+
   async _exec (binary, args) {
     const { stdout, stderr } = await execFile(binary, args)
     if (stderr && stderr.length > 0) {

package/src/lib/helpers/buildApiError.js

@@ -0,0 +1,16 @@
+function buildApiError (statusCode, json) {
+  const code = json.error.code || statusCode.toString()
+  const message = `[${code}] ${json.error.message}`
+  const help = `[${code}] ${json.error.help || JSON.stringify(json)}`
+  const meta = json.error.meta
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.meta = meta
+  error.json = json
+
+  return error
+}
+
+module.exports = buildApiError

package/src/lib/helpers/buildOauthError.js

@@ -0,0 +1,14 @@
+function buildOauthError (statusCode, json) {
+  const code = json.error
+  const message = `[${code}] ${json.error_description}`
+  const help = `[${code}] ${JSON.stringify(json)}`
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.statusCode = statusCode
+
+  return error
+}
+
+module.exports = buildOauthError

package/src/lib/helpers/createSpinner.js

@@ -4,7 +4,7 @@ const FRAME_INTERVAL_MS = 80
 async function createSpinner (options = {}) {
   const stream = process.stderr
   const hasCursorControls = typeof stream.cursorTo === 'function' && typeof stream.clearLine === 'function'
-  const enabled = Boolean(stream.isTTY && hasCursorControls && !options.quiet && !options.verbose && !options.debug)
+  const enabled = Boolean(stream.isTTY && hasCursorControls && options.spinner !== false && !options.quiet && !options.verbose && !options.debug)
   if (!enabled) return null
 
   const text = options.text || 'thinking'

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -3,7 +3,8 @@ const Armor = require('../../extensions/armor')
 async function armorKeypair (existingPublicKey, options = {}) {
   const keypairOptions = {
     token: options.token,
-    envFilepath: options.envFilepath
+    envFilepath: options.envFilepath,
+    command: options.command
   }
 
   const kp = await new Armor().keypair(existingPublicKey, keypairOptions)

package/src/lib/helpers/cryptography/provision.js

@@ -4,7 +4,7 @@ const armorKeypair = require('./armorKeypair')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage }) {
+async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage, command }) {
   noArmor = noArmor !== false
   if (!noArmor && selectKeyStorage) {
     noArmor = await selectKeyStorage() !== 'armored'
@@ -24,7 +24,7 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, s
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const armorOptions = { token, envFilepath }
+    const armorOptions = { token, envFilepath, command }
     const kp = await armorKeypair(undefined, armorOptions)
     publicKey = kp.publicKey
     privateKey = kp.privateKey

package/src/lib/helpers/cryptography/provisionSync.js

@@ -4,7 +4,7 @@ const armorKeypairSync = require('./armorKeypairSync')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor }) {
+function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor, command }) {
   noArmor = noArmor !== false
   const { publicKeyName, privateKeyName } = keyNames(envFilepath)
 
@@ -20,7 +20,7 @@ function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor }) {
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const kp = armorKeypairSync(undefined, { envFilepath })
+    const kp = armorKeypairSync(undefined, { envFilepath, command })
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   }

package/src/lib/helpers/decryptDeviceValue.js

@@ -0,0 +1,10 @@
+const { decrypt } = require('eciesjs')
+
+function decryptDeviceValue (value, privateKey) {
+  const secret = Buffer.from(privateKey, 'hex')
+  const ciphertext = Buffer.from(value, 'base64')
+
+  return decrypt(secret, ciphertext).toString()
+}
+
+module.exports = decryptDeviceValue

package/src/lib/helpers/encryptDeviceValue.js

@@ -0,0 +1,9 @@
+const { encrypt } = require('eciesjs')
+
+function encryptDeviceValue (value, publicKey) {
+  const ciphertext = encrypt(publicKey, Buffer.from(value))
+
+  return Buffer.from(ciphertext, 'hex').toString('base64')
+}
+
+module.exports = encryptDeviceValue

package/src/lib/helpers/formatCode.js

@@ -0,0 +1,11 @@
+function formatCode (str) {
+  const parts = []
+
+  for (let i = 0; i < str.length; i += 4) {
+    parts.push(str.substring(i, i + 4))
+  }
+
+  return parts.join('-')
+}
+
+module.exports = formatCode

package/src/lib/helpers/http.js

@@ -0,0 +1,7 @@
+const { request } = require('undici')
+
+async function http (url, opts = {}) {
+  return await request(url, opts)
+}
+
+module.exports = { http }

package/src/lib/helpers/jsonToEnv.js

@@ -0,0 +1,7 @@
+function jsonToEnv (json) {
+  return Object.entries(json).map(function ([key, value]) {
+    return key + '=' + `"${value}"`
+  }).join('\n')
+}
+
+module.exports = jsonToEnv

package/src/lib/helpers/keyResolution/keyValues.js

@@ -77,6 +77,9 @@ async function keyValues (filepath, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     const kp = await armorKeypair(publicKey, armorOptions)
     privateKey = kp.privateKey
     privateKeySource = 'armor'

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -57,6 +57,9 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     const kp = armorKeypairSync(publicKeyValue, armorOptions)
     privateKeyValue = kp.privateKey
     privateKeySource = 'armor'

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -77,6 +77,9 @@ function keyValuesSync (filepath, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     if (opts.noSpinner) {
       armorOptions.noSpinner = true
     }

package/src/lib/helpers/listenForOpenKey.js

@@ -0,0 +1,46 @@
+function listenForOpenKey (onOpen) {
+  const stdin = process.stdin
+  if (!stdin.isTTY) return () => {}
+
+  const canSetRawMode = typeof stdin.setRawMode === 'function'
+  const wasRawMode = Boolean(stdin.isRaw)
+  let didHandleOpenChoice = false
+
+  const cleanup = () => {
+    stdin.off('data', onData)
+    if (canSetRawMode) stdin.setRawMode(wasRawMode)
+    stdin.pause()
+  }
+
+  const onData = (chunk) => {
+    const key = String(chunk)
+    const lower = key.toLowerCase()
+
+    if (key === '\u0003') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+      return
+    }
+
+    if (key === '\r' || key === '\n' || lower === 'y') {
+      if (!didHandleOpenChoice) {
+        didHandleOpenChoice = true
+        Promise.resolve(onOpen()).catch(() => {})
+      }
+      return
+    }
+
+    if (lower === 'n') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+    }
+  }
+
+  if (canSetRawMode) stdin.setRawMode(true)
+  stdin.resume()
+  stdin.on('data', onData)
+
+  return cleanup
+}
+
+module.exports = listenForOpenKey

package/src/lib/helpers/normalizeToken.js

@@ -0,0 +1,5 @@
+function normalizeToken (token) {
+  return token == null ? '' : token
+}
+
+module.exports = normalizeToken

package/src/lib/helpers/openUrl.js

@@ -0,0 +1,7 @@
+const open = require('open')
+
+async function openUrl (url) {
+  return await open(url, { wait: false })
+}
+
+module.exports = openUrl

package/src/lib/main.d.ts

@@ -179,14 +179,6 @@ export interface DotenvConfigOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').config({ noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *
@@ -270,14 +262,6 @@ export interface SetOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *
@@ -363,14 +347,6 @@ export interface GetOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *

package/src/lib/main.js

@@ -325,7 +325,7 @@ const keypair = function (envFile, key, envKeysFile = null, noArmor = false) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noVlt === true || options.noOps === true || (!options.token && sesh.noArmorSync())
+  return options.noArmor === true || options.noOps === true || (!options.token && sesh.noArmorSync())
 }
 
 module.exports = {

package/src/lib/services/decrypt.js

@@ -25,12 +25,13 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Decrypt {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false, options = {}) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
+    this.command = options.command
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -77,7 +78,11 @@ class Decrypt {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        command: this.command
+      })
 
       row.privateKey = privateKeyValue
       row.privateKeySource = privateKeySource