@dotenvx/dotenvx 1.75.0 → 2.0.0

package/src/cli/actions/rotate.js

@@ -1,87 +0,0 @@
-const fsx = require('./../../lib/helpers/fsx')
-const { logger } = require('./../../shared/logger')
-
-const Rotate = require('./../../lib/services/rotate')
-
-const catchAndLog = require('../../lib/helpers/catchAndLog')
-const createSpinner = require('../../lib/helpers/createSpinner')
-const Session = require('../../db/session')
-const normalizeArmorOptions = require('./normalizeArmorOptions')
-
-async function rotate () {
-  const options = normalizeArmorOptions(this.opts())
-  const spinner = await createSpinner({ ...options, text: 'rotating', frames: ['⟳', '⤾', '⥁'] })
-
-  logger.debug(`options: ${JSON.stringify(options)}`)
-
-  const envs = this.envs
-  const sesh = new Session()
-  const noArmor = options.armor === false || (await sesh.noArmor())
-
-  // stdout - should not have a try so that exit codes can surface to stdout
-  if (options.stdout) {
-    if (spinner) spinner.stop()
-    const {
-      processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
-      command: process.argv.slice(2)
-    }).run()
-    if (spinner) spinner.stop()
-    for (const processedEnv of processedEnvs) {
-      console.log(processedEnv.envSrc)
-      if (processedEnv.localPrivateKeyAdded) {
-        console.log('')
-        console.log(processedEnv.envKeysSrc)
-      }
-    }
-    process.exit(0) // exit early
-  } else {
-    try {
-      if (spinner) spinner.stop()
-      const {
-        processedEnvs,
-        changedFilepaths,
-        unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
-        command: process.argv.slice(2)
-      }).run()
-
-      for (const processedEnv of processedEnvs) {
-        logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        if (processedEnv.error) {
-          logger.warn(processedEnv.error.messageWithHelp)
-        } else if (processedEnv.changed) {
-          await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
-          if (processedEnv.localPrivateKeyAdded) {
-            await fsx.writeFileX(processedEnv.envKeysFilepath, processedEnv.envKeysSrc)
-          }
-
-          logger.verbose(`rotated ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        } else {
-          logger.verbose(`no change ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        }
-      }
-
-      if (spinner) spinner.stop()
-      if (changedFilepaths.length > 0) {
-        const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
-
-        let msg = `⟳ rotated (${changedFilepaths.join(',')})`
-        if (remoteKeyAddedEnv) {
-          msg += ' · armored ⛨'
-        }
-        logger.success(msg)
-      } else if (unchangedFilepaths.length > 0) {
-        logger.info(`○ no change (${unchangedFilepaths})`)
-      } else {
-        // do nothing - scenario when no .env files found
-      }
-    } catch (error) {
-      if (spinner) spinner.stop()
-      catchAndLog(error)
-      process.exit(1)
-    }
-  }
-}
-
-module.exports = rotate

package/src/lib/helpers/append.js

@@ -1,61 +0,0 @@
-const quotes = require('./quotes')
-const dotenvParse = require('./dotenvParse')
-const escapeForRegex = require('./escapeForRegex')
-const escapeDollarSigns = require('./escapeDollarSigns')
-
-function append (src, key, appendValue) {
-  let output
-  let newPart = ''
-
-  const parsed = dotenvParse(src, true, true) // skip expanding \n and skip converting \r\n
-  const _quotes = quotes(src)
-  if (Object.prototype.hasOwnProperty.call(parsed, key)) {
-    const quote = _quotes[key]
-    const originalValue = parsed[key]
-
-    newPart += `${key}=${quote}${originalValue},${appendValue}${quote}`
-
-    const escapedOriginalValue = escapeForRegex(originalValue)
-
-    // conditionally enforce end of line
-    let enforceEndOfLine = ''
-    if (escapedOriginalValue === '') {
-      enforceEndOfLine = '$' // EMPTY scenario
-    }
-
-    const currentPart = new RegExp(
-      '^' + // start of line
-      '(\\s*)?' + // spaces
-      '(export\\s+)?' + // export
-      key + // KEY
-      '\\s*=\\s*' + // spaces (KEY = value)
-      '["\'`]?' + // open quote
-      escapedOriginalValue + // escaped value
-      '["\'`]?' + // close quote
-      enforceEndOfLine
-      ,
-      'gm' // (g)lobal (m)ultiline
-    )
-
-    const saferInput = escapeDollarSigns(newPart) // cleanse user inputted capture groups ($1, $2 etc)
-
-    // $1 preserves spaces
-    // $2 preserves export
-    output = src.replace(currentPart, `$1$2${saferInput}`)
-  } else {
-    newPart += `${key}="${appendValue}"`
-
-    // append
-    if (src.endsWith('\n')) {
-      newPart = newPart + '\n'
-    } else {
-      newPart = '\n' + newPart
-    }
-
-    output = src + newPart
-  }
-
-  return output
-}
-
-module.exports = append

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -1,42 +0,0 @@
-const Session = require('../../../db/session')
-const ArmorKeypair = require('../../services/armorKeypair')
-const sanitizeCommandForMetadata = require('../sanitizeCommandForMetadata')
-
-function metadataFromOptions (options) {
-  if (options.metadata) return options.metadata
-  if (!options.command) return undefined
-
-  return JSON.stringify({
-    command: sanitizeCommandForMetadata(options.command)
-  })
-}
-
-async function armorKeypair (existingPublicKey, options = {}) {
-  const sesh = new Session()
-  const token = options.token || sesh.token()
-  if (!token) {
-    return {
-      publicKey: undefined,
-      privateKey: undefined
-    }
-  }
-
-  const json = await new ArmorKeypair(
-    options.hostname || sesh.hostname(),
-    token,
-    sesh.devicePublicKey(),
-    existingPublicKey,
-    {
-      envFile: options.envFilepath,
-      team: options.team,
-      metadata: metadataFromOptions(options)
-    }
-  ).run()
-
-  return {
-    publicKey: json.public_key,
-    privateKey: json.private_key
-  }
-}
-
-module.exports = armorKeypair

package/src/lib/helpers/cryptography/armorKeypairSync.js

@@ -1,55 +0,0 @@
-const path = require('path')
-const childProcess = require('child_process')
-
-const EXEC_TIMEOUT = 5 * 60 * 1000
-
-function cliPath () {
-  return path.resolve(__dirname, '../../../cli/dotenvx.js')
-}
-
-function execEnv () {
-  const env = { ...process.env }
-  env._TAPJS_PROCESSINFO_COVERAGE_ = '0'
-
-  if (env.NODE_OPTIONS && env.NODE_OPTIONS.includes('@tapjs/processinfo')) {
-    const nodeOptions = env.NODE_OPTIONS
-      .split(/\s+/)
-      .filter((option) => !option.includes('@tapjs/processinfo'))
-      .join(' ')
-      .trim()
-
-    if (nodeOptions) {
-      env.NODE_OPTIONS = nodeOptions
-    } else {
-      delete env.NODE_OPTIONS
-    }
-  }
-
-  return env
-}
-
-function armorKeypairSync (_existingPublicKey, options = {}) {
-  const args = [cliPath(), 'keypair', '--format', 'json']
-  if (options.envFilepath) args.push('-f', options.envFilepath)
-
-  let keypairs = {}
-  try {
-    keypairs = JSON.parse(childProcess.execFileSync(process.execPath, args, {
-      env: execEnv(),
-      stdio: ['inherit', 'pipe', 'inherit'],
-      timeout: EXEC_TIMEOUT
-    }).toString().trim())
-  } catch (_error) {
-    keypairs = {}
-  }
-
-  const publicKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PUBLIC_KEY' || key.startsWith('DOTENV_PUBLIC_KEY_'))
-  const privateKeyName = Object.keys(keypairs).find((key) => key === 'DOTENV_PRIVATE_KEY' || key.startsWith('DOTENV_PRIVATE_KEY_'))
-
-  return {
-    publicKey: keypairs[publicKeyName],
-    privateKey: keypairs[privateKeyName]
-  }
-}
-
-module.exports = armorKeypairSync

package/src/lib/helpers/cryptography/encryptValue.js

@@ -1,7 +0,0 @@
-const { encrypt } = require('@dotenvx/primitives')
-
-function encryptValue (value, publicKey) {
-  return encrypt(publicKey, value)
-}
-
-module.exports = encryptValue

package/src/lib/helpers/cryptography/localKeypair.js

@@ -1,14 +0,0 @@
-const { derive, keypair } = require('@dotenvx/primitives')
-
-function localKeypair (existingPrivateKey) {
-  if (existingPrivateKey) {
-    return {
-      publicKey: derive(existingPrivateKey),
-      privateKey: existingPrivateKey
-    }
-  }
-
-  return keypair()
-}
-
-module.exports = localKeypair

package/src/lib/helpers/cryptography/mutateKeysSrcSync.js

@@ -1,38 +0,0 @@
-const FIRST_TIME_KEYS_SRC = [
-  '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
-  '#/ private decryption keys. DO NOT commit to source control /',
-  '#/     [how it works](https://dotenvx.com/encryption)       /',
-  '#/          ⛨ ARMORED KEYS: `dotenvx armor up`              /',
-  '#/----------------------------------------------------------/'
-].join('\n')
-
-const path = require('path')
-const fsx = require('./../fsx')
-
-function mutateKeysSrcSync ({ envFilepath, keysFilepath, privateKeyName, privateKeyValue }) {
-  const filename = path.basename(envFilepath)
-  const filepath = path.resolve(envFilepath)
-  let resolvedKeysFilepath = path.join(path.dirname(filepath), '.env.keys')
-  if (keysFilepath) {
-    resolvedKeysFilepath = path.resolve(keysFilepath)
-  }
-  const appendPrivateKey = [`# ${filename}`, `${privateKeyName}=${privateKeyValue}`, ''].join('\n')
-
-  let keysSrc = ''
-  if (fsx.existsSync(resolvedKeysFilepath)) {
-    keysSrc = fsx.readFileXSync(resolvedKeysFilepath)
-  }
-  keysSrc = keysSrc.length > 1 ? keysSrc : `${FIRST_TIME_KEYS_SRC}\n`
-  keysSrc = `${keysSrc}\n${appendPrivateKey}`
-
-  fsx.writeFileXSync(resolvedKeysFilepath, keysSrc) // TODO: don't write if armor
-
-  const envKeysFilepath = keysFilepath || path.join(path.dirname(envFilepath), path.basename(resolvedKeysFilepath))
-
-  return {
-    keysSrc,
-    envKeysFilepath
-  }
-}
-
-module.exports = mutateKeysSrcSync

package/src/lib/helpers/cryptography/provision.js

@@ -1,56 +0,0 @@
-const mutateSrc = require('./mutateSrc')
-const mutateKeysSrc = require('./mutateKeysSrc')
-const armorKeypair = require('./armorKeypair')
-const localKeypair = require('./localKeypair')
-const { keyNamesForEnvFile } = require('../keyResolution')
-
-async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage, command }) {
-  noArmor = noArmor !== false
-  if (!noArmor && selectKeyStorage) {
-    noArmor = await selectKeyStorage() !== 'armored'
-  }
-
-  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
-
-  let publicKey
-  let privateKey
-  let keysSrc
-  let envKeysFilepath
-  let localPrivateKeyAdded = false
-  let remotePrivateKeyAdded = false
-
-  if (noArmor) {
-    const kp = localKeypair()
-    publicKey = kp.publicKey
-    privateKey = kp.privateKey
-  } else {
-    const armorOptions = { token, envFilepath, command }
-    const kp = await armorKeypair(undefined, armorOptions)
-    publicKey = kp.publicKey
-    privateKey = kp.privateKey
-  }
-
-  const mutated = mutateSrc({ envSrc, envFilepath, keysFilepath, publicKeyName, publicKeyValue: publicKey })
-  envSrc = mutated.envSrc
-
-  if (noArmor) {
-    const mutated = await mutateKeysSrc({ envFilepath, keysFilepath, privateKeyName, privateKeyValue: privateKey })
-    keysSrc = mutated.keysSrc
-    envKeysFilepath = mutated.envKeysFilepath
-    localPrivateKeyAdded = true
-  } else {
-    remotePrivateKeyAdded = true
-  }
-
-  return {
-    envSrc,
-    keysSrc,
-    publicKey,
-    privateKey,
-    envKeysFilepath,
-    localPrivateKeyAdded,
-    remotePrivateKeyAdded
-  }
-}
-
-module.exports = provision

package/src/lib/helpers/cryptography/provisionSync.js

@@ -1,51 +0,0 @@
-const mutateSrc = require('./mutateSrc')
-const mutateKeysSrcSync = require('./mutateKeysSrcSync')
-const armorKeypairSync = require('./armorKeypairSync')
-const localKeypair = require('./localKeypair')
-const { keyNamesForEnvFile } = require('../keyResolution')
-
-function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor, command }) {
-  noArmor = noArmor !== false
-  const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
-
-  let publicKey
-  let privateKey
-  let keysSrc
-  let envKeysFilepath
-  let localPrivateKeyAdded = false
-  let remotePrivateKeyAdded = false
-
-  if (noArmor) {
-    const kp = localKeypair()
-    publicKey = kp.publicKey
-    privateKey = kp.privateKey
-  } else {
-    const kp = armorKeypairSync(undefined, { envFilepath, command })
-    publicKey = kp.publicKey
-    privateKey = kp.privateKey
-  }
-
-  const mutated = mutateSrc({ envSrc, envFilepath, keysFilepath, publicKeyName, publicKeyValue: publicKey })
-  envSrc = mutated.envSrc
-
-  if (noArmor) {
-    const mutated = mutateKeysSrcSync({ envFilepath, keysFilepath, privateKeyName, privateKeyValue: privateKey })
-    keysSrc = mutated.keysSrc
-    envKeysFilepath = mutated.envKeysFilepath
-    localPrivateKeyAdded = true
-  } else {
-    remotePrivateKeyAdded = true
-  }
-
-  return {
-    envSrc,
-    keysSrc,
-    publicKey,
-    privateKey,
-    envKeysFilepath,
-    localPrivateKeyAdded,
-    remotePrivateKeyAdded
-  }
-}
-
-module.exports = provisionSync

package/src/lib/helpers/cryptography/provisionWithPrivateKey.js

@@ -1,26 +0,0 @@
-const Errors = require('./../errors')
-const mutateSrc = require('./mutateSrc')
-const localKeypair = require('./localKeypair')
-
-function provisionWithPrivateKey ({ envSrc, envFilepath, keysFilepath, privateKeyValue, publicKeyValue, publicKeyName }) {
-  const { publicKey, privateKey } = localKeypair(privateKeyValue) // noArmor doesn't matter here since privateKeyValue was already discovered prior (via armor and local) and passed as privateKeyValue
-
-  // if derivation doesn't match what's in the file (or preset in env)
-  if (publicKeyValue && publicKeyValue !== publicKey) {
-    throw new Errors({ publicKey, publicKeyExisting: publicKeyValue }).mispairedPrivateKey()
-  }
-
-  // scenario when encrypting a monorepo second .env file from a prior generated -fk .env.keys file
-  if (!publicKeyValue) {
-    const mutated = mutateSrc({ envSrc, envFilepath, keysFilepath, publicKeyName, publicKeyValue: publicKey })
-    envSrc = mutated.envSrc
-  }
-
-  return {
-    envSrc,
-    publicKey,
-    privateKey
-  }
-}
-
-module.exports = provisionWithPrivateKey

package/src/lib/helpers/dotenvParse.js

@@ -1,55 +0,0 @@
-// historical dotenv.parse - https://github.com/motdotla/dotenv)
-const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg
-
-function dotenvParse (src, skipExpandForDoubleQuotes = false, skipConvertingWindowsNewlines = false, collectAllValues = false) {
-  const obj = {}
-
-  // Convert buffer to string
-  let lines = src.toString()
-
-  // Convert line breaks to same format
-  if (!skipConvertingWindowsNewlines) {
-    lines = lines.replace(/\r\n?/mg, '\n')
-  }
-
-  let match
-  while ((match = LINE.exec(lines)) != null) {
-    const key = match[1]
-
-    // Default undefined or null to empty string
-    let value = (match[2] || '')
-
-    // Remove whitespace
-    value = value.trim()
-
-    // Check if double quoted
-    const maybeQuote = value[0]
-
-    // Remove surrounding quotes
-    value = value.replace(/^(['"`])([\s\S]*)\1$/mg, '$2')
-
-    // Expand newlines if double quoted
-    if (maybeQuote === '"' && !skipExpandForDoubleQuotes) {
-      value = value.replace(/\\n/g, '\n') // newline
-      value = value.replace(/\\r/g, '\r') // carriage return
-      value = value.replace(/\\t/g, '\t') // tabs
-    }
-
-    if (collectAllValues) {
-      // handle scenario where user mistakenly includes plaintext duplicate in .env:
-      //
-      // # .env
-      // HELLO="World"
-      // HELLO="encrypted:1234"
-      obj[key] = obj[key] || []
-      obj[key].push(value)
-    } else {
-      // Add to object
-      obj[key] = value
-    }
-  }
-
-  return obj
-}
-
-module.exports = dotenvParse

package/src/lib/helpers/escapeDollarSigns.js

@@ -1,5 +0,0 @@
-function escapeDollarSigns (str) {
-  return str.replace(/\$/g, '$$$$')
-}
-
-module.exports = escapeDollarSigns

package/src/lib/helpers/escapeForRegex.js

@@ -1,5 +0,0 @@
-function escapeForRegex (str) {
-  return str.replace(/[|\\{}()[\]^$+*?.]/g, '\\$&').replace(/-/g, '\\x2d')
-}
-
-module.exports = escapeForRegex

package/src/lib/helpers/evalKeyValue.js

@@ -1,23 +0,0 @@
-const { execSync } = require('child_process')
-const chomp = require('./chomp')
-const Errors = require('./errors')
-
-function evalKeyValue (key, value, processEnv, runningParsed) {
-  // Match everything between the outermost $() using a regex with non-capturing groups
-  const matches = value.match(/\$\(([^)]+(?:\)[^(]*)*)\)/g) || []
-  return matches.reduce((newValue, match) => {
-    const command = match.slice(2, -1) // Extract command by removing $() wrapper
-    let result
-
-    try {
-      result = execSync(command, { env: { ...processEnv, ...runningParsed } }).toString() // execute command (including runningParsed)
-    } catch (e) {
-      throw new Errors({ key, command, message: e.message.trim() }).commandSubstitutionFailed()
-    }
-
-    result = chomp(result) // chomp it
-    return newValue.replace(match, result) // Replace match with result
-  }, value)
-}
-
-module.exports = evalKeyValue

package/src/lib/helpers/isFullyEncrypted.js

@@ -1,27 +0,0 @@
-const { encrypted } = require('@dotenvx/primitives')
-const dotenvParse = require('./dotenvParse')
-const isPublicKey = require('./cryptography/isPublicKey')
-
-function isFullyEncrypted (src) {
-  const parsed = dotenvParse(src, false, false, true) // collect all values
-
-  for (const [key, values] of Object.entries(parsed)) {
-    // handle scenario where user mistakenly includes plaintext duplicate in .env:
-    //
-    // # .env
-    // HELLO="World"
-    // HELLO="encrypted:1234"
-    //
-    // key => [value1, ...]
-    for (const value of values) {
-      const result = encrypted(value) || isPublicKey(key)
-      if (!result) {
-        return false
-      }
-    }
-  }
-
-  return true
-}
-
-module.exports = isFullyEncrypted

package/src/lib/helpers/isIgnoringDotenvKeys.js

@@ -1,19 +0,0 @@
-const fsx = require('./fsx')
-const ignore = require('ignore')
-
-function isIgnoringDotenvKeys () {
-  if (!fsx.existsSync('.gitignore')) {
-    return false
-  }
-
-  const gitignore = fsx.readFileXSync('.gitignore')
-  const ig = ignore(gitignore).add(gitignore)
-
-  if (!ig.ignores('.env.keys')) {
-    return false
-  }
-
-  return true
-}
-
-module.exports = isIgnoringDotenvKeys

package/src/lib/helpers/keyResolution/index.js

@@ -1,16 +0,0 @@
-module.exports = {
-  keyNamesForEnvFile: require('./keyNamesForEnvFile'),
-  keyValues: require('./keyValues'),
-  keyValuesSync: require('./keyValuesSync'),
-  keyValuesFromEnvSrc: require('./keyValuesFromEnvSrc'),
-
-  // private
-  // private keys are resolved via keyValuesSync()
-
-  // other
-  readProcessKey: require('./readProcessKey'),
-  readFileKey: require('./readFileKey'),
-  readFileKeySync: require('./readFileKeySync'),
-  guessPrivateKeyFilename: require('./../guessPrivateKeyFilename'),
-  dotenvPrivateKeyNames: require('./../dotenvPrivateKeyNames')
-}

package/src/lib/helpers/keyResolution/keyNamesForEnvFile.js

@@ -1,24 +0,0 @@
-const canonicalEnvFilename = require('./../canonicalEnvFilename')
-const environment = require('./../envResolution/environment')
-
-function keyNamesForEnvFile (filepath) {
-  const filename = canonicalEnvFilename(filepath)
-
-  // .env
-  if (filename === '.env') {
-    return {
-      publicKeyName: 'DOTENV_PUBLIC_KEY',
-      privateKeyName: 'DOTENV_PRIVATE_KEY'
-    }
-  }
-
-  // .env.ENVIRONMENT
-  const resolvedEnvironment = environment(filename).toUpperCase()
-
-  return {
-    publicKeyName: `DOTENV_PUBLIC_KEY_${resolvedEnvironment}`,
-    privateKeyName: `DOTENV_PRIVATE_KEY_${resolvedEnvironment}`
-  }
-}
-
-module.exports = keyNamesForEnvFile