@dotenvx/dotenvx 1.71.3 → 1.73.0

package/src/lib/api/postOauthToken.js

@@ -0,0 +1,35 @@
+const { http } = require('../helpers/http')
+const buildOauthError = require('../helpers/buildOauthError')
+
+const OAUTH_CLIENT_ID = 'oac_dotenvxcli'
+
+class PostOauthToken {
+  constructor (hostname, deviceCode) {
+    this.hostname = hostname
+    this.deviceCode = deviceCode
+  }
+
+  async run () {
+    const resp = await http(`${this.hostname}/oauth/token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_id: OAUTH_CLIENT_ID,
+        device_code: this.deviceCode,
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+      })
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildOauthError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostOauthToken

package/src/lib/helpers/armoredKeyDisplay.js

@@ -0,0 +1,10 @@
+function armoredKeyDisplay (publicKey) {
+  if (!publicKey) return ''
+
+  const prefix = String(publicKey).slice(0, 6).toUpperCase()
+  if (prefix.length <= 3) return prefix
+
+  return `${prefix.slice(0, 3)} ${prefix.slice(3)}`
+}
+
+module.exports = armoredKeyDisplay

package/src/lib/helpers/buildApiError.js

@@ -0,0 +1,16 @@
+function buildApiError (statusCode, json) {
+  const code = json.error.code || statusCode.toString()
+  const message = `[${code}] ${json.error.message}`
+  const help = `[${code}] ${json.error.help || JSON.stringify(json)}`
+  const meta = json.error.meta
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.meta = meta
+  error.json = json
+
+  return error
+}
+
+module.exports = buildApiError

package/src/lib/helpers/buildOauthError.js

@@ -0,0 +1,14 @@
+function buildOauthError (statusCode, json) {
+  const code = json.error
+  const message = `[${code}] ${json.error_description}`
+  const help = `[${code}] ${JSON.stringify(json)}`
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.statusCode = statusCode
+
+  return error
+}
+
+module.exports = buildOauthError

package/src/lib/helpers/createSpinner.js

@@ -4,7 +4,7 @@ const FRAME_INTERVAL_MS = 80
 async function createSpinner (options = {}) {
   const stream = process.stderr
   const hasCursorControls = typeof stream.cursorTo === 'function' && typeof stream.clearLine === 'function'
-  const enabled = Boolean(stream.isTTY && hasCursorControls && !options.quiet && !options.verbose && !options.debug)
+  const enabled = Boolean(stream.isTTY && hasCursorControls && options.spinner !== false && !options.quiet && !options.verbose && !options.debug)
   if (!enabled) return null
 
   const text = options.text || 'thinking'

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -1,20 +1,41 @@
-const Armor = require('../../extensions/armor')
+const Session = require('../../../db/session')
+const ArmorKeypair = require('../../services/armorKeypair')
+const sanitizeCommandForMetadata = require('../sanitizeCommandForMetadata')
+
+function metadataFromOptions (options) {
+  if (options.metadata) return options.metadata
+  if (!options.command) return undefined
+
+  return JSON.stringify({
+    command: sanitizeCommandForMetadata(options.command)
+  })
+}
 
 async function armorKeypair (existingPublicKey, options = {}) {
-  const keypairOptions = {
-    token: options.token,
-    envFilepath: options.envFilepath,
-    command: options.command
+  const sesh = new Session()
+  const token = options.token || sesh.token()
+  if (!token) {
+    return {
+      publicKey: undefined,
+      privateKey: undefined
+    }
   }
 
-  const kp = await new Armor().keypair(existingPublicKey, keypairOptions)
-
-  const publicKey = kp.public_key
-  const privateKey = kp.private_key
+  const json = await new ArmorKeypair(
+    options.hostname || sesh.hostname(),
+    token,
+    sesh.devicePublicKey(),
+    existingPublicKey,
+    {
+      envFile: options.envFilepath,
+      team: options.team,
+      metadata: metadataFromOptions(options)
+    }
+  ).run()
 
   return {
-    publicKey,
-    privateKey
+    publicKey: json.public_key,
+    privateKey: json.private_key
   }
 }
 

package/src/lib/helpers/cryptography/armorKeypairSync.js

@@ -1,13 +1,54 @@
-const Armor = require('../../extensions/armor')
+const path = require('path')
+const childProcess = require('child_process')
 
-function armorKeypairSync (existingPublicKey, options = {}) {
-  const kp = new Armor().keypairSync(existingPublicKey, options)
-  const publicKey = kp.public_key
-  const privateKey = kp.private_key
+const EXEC_TIMEOUT = 5 * 60 * 1000
+
+function cliPath () {
+  return path.resolve(__dirname, '../../../cli/dotenvx.js')
+}
+
+function execEnv () {
+  const env = { ...process.env }
+  env._TAPJS_PROCESSINFO_COVERAGE_ = '0'
+
+  if (env.NODE_OPTIONS && env.NODE_OPTIONS.includes('@tapjs/processinfo')) {
+    const nodeOptions = env.NODE_OPTIONS
+      .split(/\s+/)
+      .filter((option) => !option.includes('@tapjs/processinfo'))
+      .join(' ')
+      .trim()
+
+    if (nodeOptions) {
+      env.NODE_OPTIONS = nodeOptions
+    } else {
+      delete env.NODE_OPTIONS
+    }
+  }
+
+  return env
+}
+
+function armorKeypairSync (_existingPublicKey, options = {}) {
+  const args = [cliPath(), 'keypair', '--format', 'json']
+  if (options.envFilepath) args.push('-f', options.envFilepath)
+
+  let keypairs = {}
+  try {
+    keypairs = JSON.parse(childProcess.execFileSync(process.execPath, args, {
+      env: execEnv(),
+      stdio: ['inherit', 'pipe', 'inherit'],
+      timeout: EXEC_TIMEOUT
+    }).toString().trim())
+  } catch (_error) {
+    keypairs = {}
+  }
+
+  const publicKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PUBLIC_KEY' || key.startsWith('DOTENV_PUBLIC_KEY_'))
+  const privateKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PRIVATE_KEY' || key.startsWith('DOTENV_PRIVATE_KEY_'))
 
   return {
-    publicKey,
-    privateKey
+    publicKey: keypairs[publicKeyName],
+    privateKey: keypairs[privateKeyName]
   }
 }
 

package/src/lib/helpers/cryptography/provision.js

@@ -2,7 +2,7 @@ const mutateSrc = require('./mutateSrc')
 const mutateKeysSrc = require('./mutateKeysSrc')
 const armorKeypair = require('./armorKeypair')
 const localKeypair = require('./localKeypair')
-const { keyNames } = require('../keyResolution')
+const { keyNamesForEnvFile } = require('../keyResolution')
 
 async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage, command }) {
   noArmor = noArmor !== false
@@ -10,7 +10,7 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, s
     noArmor = await selectKeyStorage() !== 'armored'
   }
 
-  const { publicKeyName, privateKeyName } = keyNames(envFilepath)
+  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
 
   let publicKey
   let privateKey

package/src/lib/helpers/cryptography/provisionSync.js

@@ -2,11 +2,11 @@ const mutateSrc = require('./mutateSrc')
 const mutateKeysSrcSync = require('./mutateKeysSrcSync')
 const armorKeypairSync = require('./armorKeypairSync')
 const localKeypair = require('./localKeypair')
-const { keyNames } = require('../keyResolution')
+const { keyNamesForEnvFile } = require('../keyResolution')
 
 function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor, command }) {
   noArmor = noArmor !== false
-  const { publicKeyName, privateKeyName } = keyNames(envFilepath)
+  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
 
   let publicKey
   let privateKey

package/src/lib/helpers/decryptDeviceValue.js

@@ -0,0 +1,10 @@
+const { decrypt } = require('eciesjs')
+
+function decryptDeviceValue (value, privateKey) {
+  const secret = Buffer.from(privateKey, 'hex')
+  const ciphertext = Buffer.from(value, 'base64')
+
+  return decrypt(secret, ciphertext).toString()
+}
+
+module.exports = decryptDeviceValue

package/src/lib/helpers/encryptDeviceValue.js

@@ -0,0 +1,9 @@
+const { encrypt } = require('eciesjs')
+
+function encryptDeviceValue (value, publicKey) {
+  const ciphertext = encrypt(publicKey, Buffer.from(value))
+
+  return Buffer.from(ciphertext, 'hex').toString('base64')
+}
+
+module.exports = encryptDeviceValue

package/src/lib/helpers/formatCode.js

@@ -0,0 +1,11 @@
+function formatCode (str) {
+  const parts = []
+
+  for (let i = 0; i < str.length; i += 4) {
+    parts.push(str.substring(i, i + 4))
+  }
+
+  return parts.join('-')
+}
+
+module.exports = formatCode

package/src/lib/helpers/http.js

@@ -0,0 +1,7 @@
+const { request } = require('undici')
+
+async function http (url, opts = {}) {
+  return await request(url, opts)
+}
+
+module.exports = { http }

package/src/lib/helpers/jsonToEnv.js

@@ -0,0 +1,7 @@
+function jsonToEnv (json) {
+  return Object.entries(json).map(function ([key, value]) {
+    return key + '=' + `"${value}"`
+  }).join('\n')
+}
+
+module.exports = jsonToEnv

package/src/lib/helpers/keyResolution/index.js

@@ -1,5 +1,5 @@
 module.exports = {
-  keyNames: require('./keyNames'),
+  keyNamesForEnvFile: require('./keyNamesForEnvFile'),
   keyValues: require('./keyValues'),
   keyValuesSync: require('./keyValuesSync'),
   keyValuesFromEnvSrc: require('./keyValuesFromEnvSrc'),

package/src/lib/helpers/keyResolution/{keyNames.js → keyNamesForEnvFile.js}

@@ -1,7 +1,7 @@
 const canonicalEnvFilename = require('./../canonicalEnvFilename')
 const environment = require('./../envResolution/environment')
 
-function keyNames (filepath) {
+function keyNamesForEnvFile (filepath) {
   const filename = canonicalEnvFilename(filepath)
 
   // .env
@@ -21,4 +21,4 @@ function keyNames (filepath) {
   }
 }
 
-module.exports = keyNames
+module.exports = keyNamesForEnvFile

package/src/lib/helpers/keyResolution/keyValues.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const fsx = require('./../fsx')
 const dotenvParse = require('./../dotenvParse')
-const keyNames = require('./keyNames')
+const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKey = require('./readFileKey')
 const armorKeypair = require('../cryptography/armorKeypair')
@@ -35,7 +35,7 @@ async function invertForPrivateKeyName (filepath) {
 async function keyValues (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
-  const names = keyNames(filepath)
+  const names = keyNamesForEnvFile(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const fsx = require('./../fsx')
 const dotenvParse = require('./../dotenvParse')
-const keyNames = require('./keyNames')
+const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKeySync = require('./readFileKeySync')
 const armorKeypairSync = require('../cryptography/armorKeypairSync')
@@ -35,7 +35,7 @@ function invertForPrivateKeyName (filepath) {
 function keyValuesSync (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
-  const names = keyNames(filepath)
+  const names = keyNamesForEnvFile(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 

package/src/lib/helpers/keypairMetadata.js

@@ -0,0 +1,77 @@
+const path = require('path')
+const fs = require('fs')
+const execa = require('execa')
+const dotenvParse = require('./dotenvParse')
+const canonicalEnvFilename = require('./canonicalEnvFilename')
+const environment = require('./envResolution/environment')
+const sanitizeCommandForMetadata = require('./sanitizeCommandForMetadata')
+
+function compact (object) {
+  return Object.entries(object).reduce((acc, [key, value]) => {
+    if (value !== undefined && value !== null && value !== '') {
+      acc[key] = value
+    }
+
+    return acc
+  }, {})
+}
+
+function commandFromMetadata (metadata) {
+  try {
+    const parsed = JSON.parse(metadata)
+    return parsed && parsed.command ? sanitizeCommandForMetadata(parsed.command) : parsed && parsed.command
+  } catch (_error) {
+    return null
+  }
+}
+
+function gitRoot () {
+  try {
+    return execa.sync('git', ['rev-parse', '--show-toplevel']).stdout.toString().trim()
+  } catch (_error) {
+    return null
+  }
+}
+
+function normalizeFilepath (envFile) {
+  const root = gitRoot()
+  const filepath = path.resolve(envFile)
+
+  if (root) {
+    return path.relative(root, filepath).replace(/\\/g, '/')
+  }
+
+  return path.relative(process.cwd(), filepath).replace(/\\/g, '/')
+}
+
+function projectName () {
+  return path.basename(gitRoot() || process.cwd())
+}
+
+function envKeys (envFile) {
+  let src
+  try {
+    src = fs.readFileSync(envFile)
+  } catch (_error) {
+    return null
+  }
+
+  const parsed = dotenvParse(src)
+
+  if (!parsed || Object.keys(parsed).length === 0) return null
+
+  return Object.keys(parsed)
+}
+
+function keypairMetadata (envFile = '.env', metadata = undefined) {
+  return compact({
+    filepath: normalizeFilepath(envFile),
+    filename: canonicalEnvFilename(envFile),
+    environment: environment(envFile),
+    project_name: projectName(),
+    keys: envKeys(envFile),
+    command: commandFromMetadata(metadata)
+  })
+}
+
+module.exports = keypairMetadata

package/src/lib/helpers/listenForOpenKey.js

@@ -0,0 +1,46 @@
+function listenForOpenKey (onOpen) {
+  const stdin = process.stdin
+  if (!stdin.isTTY) return () => {}
+
+  const canSetRawMode = typeof stdin.setRawMode === 'function'
+  const wasRawMode = Boolean(stdin.isRaw)
+  let didHandleOpenChoice = false
+
+  const cleanup = () => {
+    stdin.off('data', onData)
+    if (canSetRawMode) stdin.setRawMode(wasRawMode)
+    stdin.pause()
+  }
+
+  const onData = (chunk) => {
+    const key = String(chunk)
+    const lower = key.toLowerCase()
+
+    if (key === '\u0003') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+      return
+    }
+
+    if (key === '\r' || key === '\n' || lower === 'y') {
+      if (!didHandleOpenChoice) {
+        didHandleOpenChoice = true
+        Promise.resolve(onOpen()).catch(() => {})
+      }
+      return
+    }
+
+    if (lower === 'n') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+    }
+  }
+
+  if (canSetRawMode) stdin.setRawMode(true)
+  stdin.resume()
+  stdin.on('data', onData)
+
+  return cleanup
+}
+
+module.exports = listenForOpenKey

package/src/lib/helpers/normalizeToken.js

@@ -0,0 +1,5 @@
+function normalizeToken (token) {
+  return token == null ? '' : token
+}
+
+module.exports = normalizeToken

package/src/lib/helpers/openUrl.js

@@ -0,0 +1,7 @@
+const open = require('open')
+
+async function openUrl (url) {
+  return await open(url, { wait: false })
+}
+
+module.exports = openUrl

package/src/lib/helpers/readEnvKey.js

@@ -0,0 +1,31 @@
+const fs = require('fs')
+const dotenvParse = require('./dotenvParse')
+const Errors = require('./errors')
+
+function ignored (error, options) {
+  return (options.ignore || []).includes(error.code)
+}
+
+function readEnvKey (key, filepath, options = {}) {
+  let src
+  try {
+    src = fs.readFileSync(filepath)
+  } catch (_error) {
+    const error = new Errors({ envFilepath: filepath }).missingEnvFile()
+    if (ignored(error, options)) return undefined
+    if (options.strict) throw error
+    return undefined
+  }
+
+  const parsed = dotenvParse(src)
+  const value = parsed[key]
+  if (value === undefined) {
+    const error = new Errors({ key }).missingKey()
+    if (ignored(error, options)) return undefined
+    if (options.strict) throw error
+  }
+
+  return value
+}
+
+module.exports = readEnvKey

package/src/lib/helpers/removeEnvKey.js

@@ -0,0 +1,50 @@
+const fs = require('fs')
+const path = require('path')
+
+function escapeForRegex (value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function removeEnvKey (key, keysFilepath = '.env.keys') {
+  const resolvedKeysFilepath = path.resolve(keysFilepath)
+
+  if (!fs.existsSync(resolvedKeysFilepath)) {
+    return {
+      changed: false,
+      key,
+      filepath: keysFilepath
+    }
+  }
+
+  const src = fs.readFileSync(resolvedKeysFilepath, 'utf8')
+  const eol = src.includes('\r\n') ? '\r\n' : '\n'
+  const keyPattern = new RegExp(`^\\s*(?:export\\s+)?${escapeForRegex(key)}\\s*=`)
+  const envKeyPattern = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=/
+  const lines = src.length > 0 ? src.split(/\r?\n/) : []
+
+  while (lines.length > 0 && lines[lines.length - 1] === '') {
+    lines.pop()
+  }
+
+  const nextLines = lines.filter((line) => !keyPattern.test(line))
+  const changed = nextLines.length !== lines.length
+
+  if (changed) {
+    const hasRemainingKeys = nextLines.some((line) => envKeyPattern.test(line))
+
+    if (hasRemainingKeys) {
+      const nextSrc = `${nextLines.join(eol)}${eol}`
+      fs.writeFileSync(resolvedKeysFilepath, nextSrc, 'utf8')
+    } else {
+      fs.rmSync(resolvedKeysFilepath, { force: true })
+    }
+  }
+
+  return {
+    changed,
+    key,
+    filepath: keysFilepath
+  }
+}
+
+module.exports = removeEnvKey

package/src/lib/helpers/sanitizeCommandForMetadata.js

@@ -0,0 +1,64 @@
+function commandParts (command) {
+  if (Array.isArray(command)) {
+    return command.map(arg => `${arg}`)
+  }
+
+  const parts = []
+  const src = `${command}`
+  const regex = /"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'|(\S+)/g
+  let match
+
+  while ((match = regex.exec(src)) !== null) {
+    parts.push(match[1] || match[2] || match[3])
+  }
+
+  return parts
+}
+
+function flagName (part) {
+  if (!part.startsWith('--')) return null
+  return part.slice(2).split('=')[0].toLowerCase()
+}
+
+function isSecretFlag (part) {
+  const name = flagName(part)
+  if (!name) return false
+  if (name === 'pass' || name === 'password' || name === 'passphrase' || name === 'pwd') return true
+
+  return name.includes('token') ||
+    name.includes('password') ||
+    name.includes('secret') ||
+    name.includes('api-key') ||
+    name.includes('apikey') ||
+    name.includes('private-key')
+}
+
+function sanitizeCommandForMetadata (command) {
+  const parts = commandParts(command)
+  const sanitized = []
+
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i]
+
+    if (isSecretFlag(part) && part.includes('=')) {
+      const name = part.split('=')[0]
+      sanitized.push(`${name}=[REDACTED]`)
+      continue
+    }
+
+    if (isSecretFlag(part)) {
+      sanitized.push(part)
+      if (i + 1 < parts.length) {
+        sanitized.push('[REDACTED]')
+        i++
+      }
+      continue
+    }
+
+    sanitized.push(part)
+  }
+
+  return sanitized.join(' ')
+}
+
+module.exports = sanitizeCommandForMetadata

package/src/lib/helpers/teamChoicesFromMeta.js

@@ -0,0 +1,8 @@
+function teamChoicesFromMeta (meta) {
+  return meta.organizations.map(org => ({
+    name: org.provider_slug,
+    value: org.provider_slug
+  }))
+}
+
+module.exports = teamChoicesFromMeta