@dotenvx/dotenvx 1.72.0 → 1.73.1

package/src/lib/api/postArmorPull.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorPull {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/pull`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorPull

package/src/lib/api/postArmorPush.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorPush {
+  constructor (hostname, token, devicePublicKey, privateKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.privateKey = privateKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const privateKey = this.privateKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/push`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      private_key: privateKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorPush

package/src/lib/api/postArmorUp.js

@@ -0,0 +1,51 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorUp {
+  constructor (hostname, token, devicePublicKey, publicKey, privateKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.privateKey = privateKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const privateKey = this.privateKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/up`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      private_key: privateKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorUp

package/src/lib/api/postKeypair.js

@@ -0,0 +1,60 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostKeypair {
+  constructor (hostname, token, devicePublicKey, publicKey, team, metadata, grantToken) {
+    this.hostname = hostname || 'https://armor.dotenvx.com'
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+    this.metadata = metadata
+    this.grantToken = grantToken
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const url = `${this.hostname}/api/keypair`
+    const body = {
+      device_public_key: this.devicePublicKey,
+      cli_version: packageJson.version
+    }
+
+    if (this.publicKey) {
+      body.public_key = this.publicKey
+    }
+
+    if (this.team) {
+      body.team = this.team
+    }
+
+    if (this.metadata && Object.keys(this.metadata).length > 0) {
+      body.metadata = this.metadata
+    }
+
+    if (this.grantToken) {
+      body.grant_token = this.grantToken
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostKeypair

package/src/lib/helpers/armoredKeyDisplay.js

@@ -0,0 +1,10 @@
+function armoredKeyDisplay (publicKey) {
+  if (!publicKey) return ''
+
+  const prefix = String(publicKey).slice(0, 6).toUpperCase()
+  if (prefix.length <= 3) return prefix
+
+  return `${prefix.slice(0, 3)} ${prefix.slice(3)}`
+}
+
+module.exports = armoredKeyDisplay

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -1,20 +1,41 @@
-const Armor = require('../../extensions/armor')
+const Session = require('../../../db/session')
+const ArmorKeypair = require('../../services/armorKeypair')
+const sanitizeCommandForMetadata = require('../sanitizeCommandForMetadata')
+
+function metadataFromOptions (options) {
+  if (options.metadata) return options.metadata
+  if (!options.command) return undefined
+
+  return JSON.stringify({
+    command: sanitizeCommandForMetadata(options.command)
+  })
+}
 
 async function armorKeypair (existingPublicKey, options = {}) {
-  const keypairOptions = {
-    token: options.token,
-    envFilepath: options.envFilepath,
-    command: options.command
+  const sesh = new Session()
+  const token = options.token || sesh.token()
+  if (!token) {
+    return {
+      publicKey: undefined,
+      privateKey: undefined
+    }
   }
 
-  const kp = await new Armor().keypair(existingPublicKey, keypairOptions)
-
-  const publicKey = kp.public_key
-  const privateKey = kp.private_key
+  const json = await new ArmorKeypair(
+    options.hostname || sesh.hostname(),
+    token,
+    sesh.devicePublicKey(),
+    existingPublicKey,
+    {
+      envFile: options.envFilepath,
+      team: options.team,
+      metadata: metadataFromOptions(options)
+    }
+  ).run()
 
   return {
-    publicKey,
-    privateKey
+    publicKey: json.public_key,
+    privateKey: json.private_key
   }
 }
 

package/src/lib/helpers/cryptography/armorKeypairSync.js

@@ -1,13 +1,54 @@
-const Armor = require('../../extensions/armor')
+const path = require('path')
+const childProcess = require('child_process')
 
-function armorKeypairSync (existingPublicKey, options = {}) {
-  const kp = new Armor().keypairSync(existingPublicKey, options)
-  const publicKey = kp.public_key
-  const privateKey = kp.private_key
+const EXEC_TIMEOUT = 5 * 60 * 1000
+
+function cliPath () {
+  return path.resolve(__dirname, '../../../cli/dotenvx.js')
+}
+
+function execEnv () {
+  const env = { ...process.env }
+  env._TAPJS_PROCESSINFO_COVERAGE_ = '0'
+
+  if (env.NODE_OPTIONS && env.NODE_OPTIONS.includes('@tapjs/processinfo')) {
+    const nodeOptions = env.NODE_OPTIONS
+      .split(/\s+/)
+      .filter((option) => !option.includes('@tapjs/processinfo'))
+      .join(' ')
+      .trim()
+
+    if (nodeOptions) {
+      env.NODE_OPTIONS = nodeOptions
+    } else {
+      delete env.NODE_OPTIONS
+    }
+  }
+
+  return env
+}
+
+function armorKeypairSync (_existingPublicKey, options = {}) {
+  const args = [cliPath(), 'keypair', '--format', 'json']
+  if (options.envFilepath) args.push('-f', options.envFilepath)
+
+  let keypairs = {}
+  try {
+    keypairs = JSON.parse(childProcess.execFileSync(process.execPath, args, {
+      env: execEnv(),
+      stdio: ['inherit', 'pipe', 'inherit'],
+      timeout: EXEC_TIMEOUT
+    }).toString().trim())
+  } catch (_error) {
+    keypairs = {}
+  }
+
+  const publicKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PUBLIC_KEY' || key.startsWith('DOTENV_PUBLIC_KEY_'))
+  const privateKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PRIVATE_KEY' || key.startsWith('DOTENV_PRIVATE_KEY_'))
 
   return {
-    publicKey,
-    privateKey
+    publicKey: keypairs[publicKeyName],
+    privateKey: keypairs[privateKeyName]
   }
 }
 

package/src/lib/helpers/cryptography/provision.js

@@ -2,7 +2,7 @@ const mutateSrc = require('./mutateSrc')
 const mutateKeysSrc = require('./mutateKeysSrc')
 const armorKeypair = require('./armorKeypair')
 const localKeypair = require('./localKeypair')
-const { keyNames } = require('../keyResolution')
+const { keyNamesForEnvFile } = require('../keyResolution')
 
 async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage, command }) {
   noArmor = noArmor !== false
@@ -10,7 +10,7 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, s
     noArmor = await selectKeyStorage() !== 'armored'
   }
 
-  const { publicKeyName, privateKeyName } = keyNames(envFilepath)
+  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
 
   let publicKey
   let privateKey

package/src/lib/helpers/cryptography/provisionSync.js

@@ -2,11 +2,11 @@ const mutateSrc = require('./mutateSrc')
 const mutateKeysSrcSync = require('./mutateKeysSrcSync')
 const armorKeypairSync = require('./armorKeypairSync')
 const localKeypair = require('./localKeypair')
-const { keyNames } = require('../keyResolution')
+const { keyNamesForEnvFile } = require('../keyResolution')
 
 function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor, command }) {
   noArmor = noArmor !== false
-  const { publicKeyName, privateKeyName } = keyNames(envFilepath)
+  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
 
   let publicKey
   let privateKey

package/src/lib/helpers/keyResolution/index.js

@@ -1,5 +1,5 @@
 module.exports = {
-  keyNames: require('./keyNames'),
+  keyNamesForEnvFile: require('./keyNamesForEnvFile'),
   keyValues: require('./keyValues'),
   keyValuesSync: require('./keyValuesSync'),
   keyValuesFromEnvSrc: require('./keyValuesFromEnvSrc'),

package/src/lib/helpers/keyResolution/{keyNames.js → keyNamesForEnvFile.js}

@@ -1,7 +1,7 @@
 const canonicalEnvFilename = require('./../canonicalEnvFilename')
 const environment = require('./../envResolution/environment')
 
-function keyNames (filepath) {
+function keyNamesForEnvFile (filepath) {
   const filename = canonicalEnvFilename(filepath)
 
   // .env
@@ -21,4 +21,4 @@ function keyNames (filepath) {
   }
 }
 
-module.exports = keyNames
+module.exports = keyNamesForEnvFile

package/src/lib/helpers/keyResolution/keyValues.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const fsx = require('./../fsx')
 const dotenvParse = require('./../dotenvParse')
-const keyNames = require('./keyNames')
+const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKey = require('./readFileKey')
 const armorKeypair = require('../cryptography/armorKeypair')
@@ -35,7 +35,7 @@ async function invertForPrivateKeyName (filepath) {
 async function keyValues (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
-  const names = keyNames(filepath)
+  const names = keyNamesForEnvFile(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const fsx = require('./../fsx')
 const dotenvParse = require('./../dotenvParse')
-const keyNames = require('./keyNames')
+const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKeySync = require('./readFileKeySync')
 const armorKeypairSync = require('../cryptography/armorKeypairSync')
@@ -35,7 +35,7 @@ function invertForPrivateKeyName (filepath) {
 function keyValuesSync (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
-  const names = keyNames(filepath)
+  const names = keyNamesForEnvFile(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 

package/src/lib/helpers/keypairMetadata.js

@@ -0,0 +1,77 @@
+const path = require('path')
+const fs = require('fs')
+const execa = require('execa')
+const dotenvParse = require('./dotenvParse')
+const canonicalEnvFilename = require('./canonicalEnvFilename')
+const environment = require('./envResolution/environment')
+const sanitizeCommandForMetadata = require('./sanitizeCommandForMetadata')
+
+function compact (object) {
+  return Object.entries(object).reduce((acc, [key, value]) => {
+    if (value !== undefined && value !== null && value !== '') {
+      acc[key] = value
+    }
+
+    return acc
+  }, {})
+}
+
+function commandFromMetadata (metadata) {
+  try {
+    const parsed = JSON.parse(metadata)
+    return parsed && parsed.command ? sanitizeCommandForMetadata(parsed.command) : parsed && parsed.command
+  } catch (_error) {
+    return null
+  }
+}
+
+function gitRoot () {
+  try {
+    return execa.sync('git', ['rev-parse', '--show-toplevel']).stdout.toString().trim()
+  } catch (_error) {
+    return null
+  }
+}
+
+function normalizeFilepath (envFile) {
+  const root = gitRoot()
+  const filepath = path.resolve(envFile)
+
+  if (root) {
+    return path.relative(root, filepath).replace(/\\/g, '/')
+  }
+
+  return path.relative(process.cwd(), filepath).replace(/\\/g, '/')
+}
+
+function projectName () {
+  return path.basename(gitRoot() || process.cwd())
+}
+
+function envKeys (envFile) {
+  let src
+  try {
+    src = fs.readFileSync(envFile)
+  } catch (_error) {
+    return null
+  }
+
+  const parsed = dotenvParse(src)
+
+  if (!parsed || Object.keys(parsed).length === 0) return null
+
+  return Object.keys(parsed)
+}
+
+function keypairMetadata (envFile = '.env', metadata = undefined) {
+  return compact({
+    filepath: normalizeFilepath(envFile),
+    filename: canonicalEnvFilename(envFile),
+    environment: environment(envFile),
+    project_name: projectName(),
+    keys: envKeys(envFile),
+    command: commandFromMetadata(metadata)
+  })
+}
+
+module.exports = keypairMetadata

package/src/lib/helpers/readEnvKey.js

@@ -0,0 +1,31 @@
+const fs = require('fs')
+const dotenvParse = require('./dotenvParse')
+const Errors = require('./errors')
+
+function ignored (error, options) {
+  return (options.ignore || []).includes(error.code)
+}
+
+function readEnvKey (key, filepath, options = {}) {
+  let src
+  try {
+    src = fs.readFileSync(filepath)
+  } catch (_error) {
+    const error = new Errors({ envFilepath: filepath }).missingEnvFile()
+    if (ignored(error, options)) return undefined
+    if (options.strict) throw error
+    return undefined
+  }
+
+  const parsed = dotenvParse(src)
+  const value = parsed[key]
+  if (value === undefined) {
+    const error = new Errors({ key }).missingKey()
+    if (ignored(error, options)) return undefined
+    if (options.strict) throw error
+  }
+
+  return value
+}
+
+module.exports = readEnvKey

package/src/lib/helpers/removeEnvKey.js

@@ -0,0 +1,50 @@
+const fs = require('fs')
+const path = require('path')
+
+function escapeForRegex (value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function removeEnvKey (key, keysFilepath = '.env.keys') {
+  const resolvedKeysFilepath = path.resolve(keysFilepath)
+
+  if (!fs.existsSync(resolvedKeysFilepath)) {
+    return {
+      changed: false,
+      key,
+      filepath: keysFilepath
+    }
+  }
+
+  const src = fs.readFileSync(resolvedKeysFilepath, 'utf8')
+  const eol = src.includes('\r\n') ? '\r\n' : '\n'
+  const keyPattern = new RegExp(`^\\s*(?:export\\s+)?${escapeForRegex(key)}\\s*=`)
+  const envKeyPattern = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=/
+  const lines = src.length > 0 ? src.split(/\r?\n/) : []
+
+  while (lines.length > 0 && lines[lines.length - 1] === '') {
+    lines.pop()
+  }
+
+  const nextLines = lines.filter((line) => !keyPattern.test(line))
+  const changed = nextLines.length !== lines.length
+
+  if (changed) {
+    const hasRemainingKeys = nextLines.some((line) => envKeyPattern.test(line))
+
+    if (hasRemainingKeys) {
+      const nextSrc = `${nextLines.join(eol)}${eol}`
+      fs.writeFileSync(resolvedKeysFilepath, nextSrc, 'utf8')
+    } else {
+      fs.rmSync(resolvedKeysFilepath, { force: true })
+    }
+  }
+
+  return {
+    changed,
+    key,
+    filepath: keysFilepath
+  }
+}
+
+module.exports = removeEnvKey

package/src/lib/helpers/sanitizeCommandForMetadata.js

@@ -0,0 +1,64 @@
+function commandParts (command) {
+  if (Array.isArray(command)) {
+    return command.map(arg => `${arg}`)
+  }
+
+  const parts = []
+  const src = `${command}`
+  const regex = /"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'|(\S+)/g
+  let match
+
+  while ((match = regex.exec(src)) !== null) {
+    parts.push(match[1] || match[2] || match[3])
+  }
+
+  return parts
+}
+
+function flagName (part) {
+  if (!part.startsWith('--')) return null
+  return part.slice(2).split('=')[0].toLowerCase()
+}
+
+function isSecretFlag (part) {
+  const name = flagName(part)
+  if (!name) return false
+  if (name === 'pass' || name === 'password' || name === 'passphrase' || name === 'pwd') return true
+
+  return name.includes('token') ||
+    name.includes('password') ||
+    name.includes('secret') ||
+    name.includes('api-key') ||
+    name.includes('apikey') ||
+    name.includes('private-key')
+}
+
+function sanitizeCommandForMetadata (command) {
+  const parts = commandParts(command)
+  const sanitized = []
+
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i]
+
+    if (isSecretFlag(part) && part.includes('=')) {
+      const name = part.split('=')[0]
+      sanitized.push(`${name}=[REDACTED]`)
+      continue
+    }
+
+    if (isSecretFlag(part)) {
+      sanitized.push(part)
+      if (i + 1 < parts.length) {
+        sanitized.push('[REDACTED]')
+        i++
+      }
+      continue
+    }
+
+    sanitized.push(part)
+  }
+
+  return sanitized.join(' ')
+}
+
+module.exports = sanitizeCommandForMetadata

package/src/lib/helpers/teamChoicesFromMeta.js

@@ -0,0 +1,8 @@
+function teamChoicesFromMeta (meta) {
+  return meta.organizations.map(org => ({
+    name: org.provider_slug,
+    value: org.provider_slug
+  }))
+}
+
+module.exports = teamChoicesFromMeta