@dotenvx/dotenvx 2.1.5 → 2.2.1

package/src/lib/services/keychainUp.js

@@ -0,0 +1,81 @@
+const { execFileSync } = require('child_process')
+
+const keynames = require('../conventions/keynames')
+const readEnvKey = require('../helpers/readEnvKey')
+const removeEnvKey = require('../helpers/removeEnvKey')
+const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+
+const SECURITY_BIN = '/usr/bin/security'
+const SERVICE = 'dotenvx'
+
+function addGenericPassword (publicKey, label, privateKey) {
+  try {
+    execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
+  } catch {
+    throw new Error('failed to save private key to macOS Keychain')
+  }
+}
+
+class KeychainUp {
+  constructor (envFile = '.env', envKeysFile = '.env.keys') {
+    this.envFile = envFile
+    this.envKeysFile = envKeysFile
+  }
+
+  run () {
+    const envFile = this.envFile
+    const envKeysFile = this.envKeysFile
+
+    const {
+      publicKeyName,
+      privateKeyName
+    } = keynames(envFile)
+
+    const publicKey = readEnvKey(publicKeyName, envFile, { strict: true, ignore: ['MISSING_PRIVATE_KEY'] })
+    const label = `dotenvx (${armoredKeyDisplay(publicKey)})`
+    let existingPrivateKey
+
+    try {
+      existingPrivateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+    } catch {}
+
+    const privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: !existingPrivateKey })
+
+    if (existingPrivateKey) {
+      if (!privateKey) {
+        return {
+          changed: false,
+          label,
+          privateKeyName,
+          privateKeyValue: existingPrivateKey,
+          publicKeyValue: publicKey
+        }
+      }
+
+      if (existingPrivateKey === privateKey) {
+        const result = removeEnvKey(privateKeyName, envKeysFile)
+
+        return {
+          changed: result.changed,
+          label,
+          privateKeyName,
+          privateKeyValue: privateKey,
+          publicKeyValue: publicKey
+        }
+      }
+    }
+
+    addGenericPassword(publicKey, label, privateKey)
+    removeEnvKey(privateKeyName, envKeysFile)
+
+    return {
+      changed: true,
+      label,
+      privateKeyName,
+      privateKeyValue: privateKey,
+      publicKeyValue: publicKey
+    }
+  }
+}
+
+module.exports = KeychainUp

package/src/lib/transforms/decrypt.js

@@ -22,7 +22,7 @@ async function decrypt (options = {}) {
   const ik = options.ik
   const ek = options.ek
   const fk = options.fk
-  const provider = options.noArmor ? null : await providers(options)
+  const provider = await providers(options)
 
   const processedEnvs = []
   const changedFilepaths = []

package/src/lib/transforms/set.js

@@ -36,6 +36,7 @@ async function setTransform (options = {}) {
   const value = options.value
   const fk = options.fk || '.env.keys'
   let noArmor = options.noArmor // key storage selector below
+  const noKeychain = options.noKeychain
   const noCreate = options.noCreate
   const noEncrypt = !options.encrypt || isPlainKey(key)
 
@@ -149,7 +150,8 @@ async function setTransform (options = {}) {
           envs: [env],
           all: true,
           envKeysFile: fk,
-          noArmor
+          noArmor,
+          noKeychain
         })
 
         const before = parsed[key]