@dotenvx/dotenvx 2.2.1 → 2.3.0

package/src/cli/commands/armor.js

@@ -3,7 +3,7 @@ const Session = require('./../../db/session')
 
 function configureArmorCommand (armor) {
   armor
-    .description('move private keys off-device')
+    .description('move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
     .allowUnknownOption()
     .argument('[command]', 'dotenvx-armor command')
     .argument('[args...]', 'dotenvx-armor command arguments')
@@ -66,6 +66,24 @@ function configureArmorCommand (armor) {
     .option('--token <token>', 'set token')
     .action(moveAction)
 
+  // dotenvx armor login
+  const loginAction = require('./../actions/login')
+  armor
+    .command('login')
+    .description('log in to Dotenvx Armor')
+    .allowUnknownOption()
+    .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+    .action(loginAction)
+
+  // dotenvx armor logout
+  const logoutAction = require('./../actions/logout')
+  armor
+    .command('logout')
+    .description('log out of Dotenvx Armor')
+    .allowUnknownOption()
+    .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+    .action(logoutAction)
+
   return armor
 }
 

package/src/cli/commands/lock.js

@@ -0,0 +1,27 @@
+function configureLockCommand (lock) {
+  lock
+    .description('lock private keys with a local passphrase')
+    .action(function () {
+      this.help()
+    })
+
+  const upAction = require('./../actions/lock/up')
+  lock
+    .command('up')
+    .description('lock key in .env.keys')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+    .action(upAction)
+
+  const downAction = require('./../actions/lock/down')
+  lock
+    .command('down')
+    .description('unlock key in .env.keys')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+    .action(downAction)
+
+  return lock
+}
+
+module.exports = configureLockCommand

package/src/cli/commands/{keychain.js → native.js}

@@ -1,43 +1,43 @@
-function configureKeychainCommand (keychain) {
-  keychain
-    .description('store private keys in macOS Keychain')
+function configureNativeCommand (native) {
+  native
+    .description('move private keys into your OS secret store (macOS Keychain supported)')
     .action(function () {
       this.help()
     })
 
   const upAction = require('./../actions/keychain/up')
-  keychain
+  native
     .command('up')
-    .description('store key in macOS Keychain')
+    .description('store key in OS secret store')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(upAction)
 
   const downAction = require('./../actions/keychain/down')
-  keychain
+  native
     .command('down')
-    .description('move key from macOS Keychain to .env.keys')
+    .description('move key from OS secret store to .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(downAction)
 
   const pushAction = require('./../actions/keychain/push')
-  keychain
+  native
     .command('push')
-    .description('push key to macOS Keychain from .env.keys')
+    .description('push key to OS secret store from .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(pushAction)
 
   const pullAction = require('./../actions/keychain/pull')
-  keychain
+  native
     .command('pull')
-    .description('pull key from macOS Keychain into .env.keys')
+    .description('pull key from OS secret store into .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(pullAction)
 
-  return keychain
+  return native
 }
 
-module.exports = configureKeychainCommand
+module.exports = configureNativeCommand

package/src/cli/dotenvx.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /* c8 ignore start */
-const { Command, Option } = require('commander')
+const { Command } = require('commander')
 const program = new Command()
 
 const { setLogLevel, logger } = require('../shared/logger')
@@ -73,8 +73,7 @@ program.command('run')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/run').apply(this, args)
@@ -97,8 +96,7 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/get').apply(this, args)
@@ -118,8 +116,7 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/set').apply(this, args)
@@ -136,8 +133,7 @@ program.command('encrypt')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/encrypt').apply(this, args)
@@ -151,8 +147,7 @@ program.command('decrypt')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
     this.envs = envs
@@ -167,8 +162,7 @@ program.command('keypair')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
@@ -231,7 +225,7 @@ program.command('doctor', { hidden: true })
     return require('./actions/doctor').apply(this, args)
   })
 
-// dotenvx login
+// dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')
   .allowUnknownOption()
@@ -240,7 +234,7 @@ program.command('login', { hidden: true })
     return require('./actions/login').apply(this, args)
   })
 
-// dotenvx logout
+// dotenvx logout (compatibility alias for dotenvx armor logout)
 program.command('logout', { hidden: true })
   .description('log out of connected security features')
   .allowUnknownOption()
@@ -268,13 +262,15 @@ program.command('help [command]')
 // dotenvx armor
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
-program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
-program.addHelpText('after', '  logout                   log out of connected security features')
-program.addHelpText('after', '  keychain                 ⌥ move private keys into macOS Keychain')
+program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
+program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 
-// dotenvx keychain
-require('./commands/keychain')(program.command('keychain', { hidden: true }))
+// dotenvx native
+require('./commands/native')(program.command('native', { hidden: true }))
+
+// dotenvx lock
+require('./commands/lock')(program.command('lock', { hidden: true }))
 
 // dotenvx armor
 require('./commands/armor')(program.command('armor', { hidden: true }))

package/src/db/session.js

@@ -226,19 +226,19 @@ class Session {
   //
   login (hostname, id, username, accessToken) {
     if (!hostname) {
-      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
     }
 
     if (!id) {
-      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx armor login]')
     }
 
     if (!username) {
-      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx armor login]')
     }
 
     if (!accessToken) {
-      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
     const store = this.createStore()
@@ -252,15 +252,15 @@ class Session {
 
   logout (hostname, id, accessToken) {
     if (!hostname) {
-      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
     }
 
     if (!id) {
-      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx armor login]')
     }
 
     if (!accessToken) {
-      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
     const store = this.openStore()

package/src/lib/helpers/errors.js

@@ -7,6 +7,7 @@ const ISSUE_BY_CODE = {
   DANGEROUS_DEPENDENCY_HOIST: 'https://github.com/dotenvx/dotenvx/issues/622',
   INVALID_COLOR: 'must be 256 colors',
   INVALID_CONVENTION: 'https://github.com/dotenvx/dotenvx/issues/761',
+  INVALID_PASSPHRASE: 'try again with the correct passphrase',
   INVALID_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/465',
   INVALID_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/756',
   MALFORMED_ENCRYPTED_DATA: 'https://github.com/dotenvx/dotenvx/issues/467',
@@ -157,6 +158,18 @@ class Errors {
     return e
   }
 
+  invalidPassphrase () {
+    const code = 'INVALID_PASSPHRASE'
+    const message = `[${code}] could not unlock ${this.privateKeyName || 'DOTENV_PRIVATE_KEY'} using passphrase`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   malformedEncryptedData () {
     const code = 'MALFORMED_ENCRYPTED_DATA'
     const message = `[${code}] could not decrypt ${this.key} because encrypted data appears malformed`

package/src/lib/helpers/executeDynamic.js

@@ -42,20 +42,6 @@ function armorBanner () {
 }
 
 function dynamicAttempts (command, forwardedArgs) {
-  if (command === 'vlt') {
-    return [
-      ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs]
-    ]
-  }
-
-  if (command === 'ops') {
-    return [
-      ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs]
-    ]
-  }
-
   return [[`dotenvx-${command}`, forwardedArgs]]
 }
 
@@ -85,11 +71,7 @@ function executeDynamic (program, command, rawArgs) {
   }
 
   if (result.error) {
-    if (command === 'vlt') {
-      console.log(armorBanner())
-    } else if (command === 'ops') {
-      console.log(armorBanner())
-    } else if (command === 'armor') {
+    if (command === 'armor') {
       console.log(armorBanner())
     } else {
       logger.info(`error: unknown command '${command}'`)

package/src/lib/main.d.ts

@@ -180,20 +180,12 @@ export interface DotenvConfigOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').config({ noKeychain: true })
+   * @example require('@dotenvx/dotenvx').config({ noNative: true })
    */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').config({ noOps: true })
-   */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 
@@ -271,20 +263,12 @@ export interface SetOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noKeychain: true })
+   * @example require('@dotenvx/dotenvx').set(key, value, { noNative: true })
    */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noOps: true })
-   */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 
@@ -364,20 +348,12 @@ export interface GetOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noKeychain: true })
-   */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noOps: true })
+   * @example require('@dotenvx/dotenvx').get('KEY', { noNative: true })
    */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 

package/src/lib/main.js

@@ -380,11 +380,11 @@ const ls = function (directory, envFile, excludeEnvFile) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noOps === true || (!options.token && sesh.noArmorSync())
+  return options.noArmor === true || (!options.token && sesh.noArmorSync())
 }
 
 function resolveNoKeychain (options = {}) {
-  return options.noKeychain === true || options.keychain === false
+  return options.noNative === true || options.native === false
 }
 
 module.exports = {
@@ -395,7 +395,7 @@ module.exports = {
   set,
   get,
   ls,
-  // expose for libs depending on @dotenvx/dotenvx - like dotenvx-ops
+  // expose for libs depending on @dotenvx/dotenvx
   setLogLevel,
   logger,
   getColor,

package/src/lib/providers/index.js

@@ -46,7 +46,7 @@ function armorProviderForOptions (options) {
 function useKeychain (options) {
   if (process.platform !== 'darwin') return false
   if (process.env.CI) return false
-  return options.noKeychain !== true && options.keychain !== false
+  return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
 
 function useArmor (options, noArmor) {

package/src/lib/services/keychainPull.js

@@ -29,7 +29,7 @@ class KeychainPull {
     try {
       privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
     } catch {
-      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx keychain up]`)
+      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
     }
 
     const result = upsertEnvKey(privateKeyName, privateKey, envKeysFile)

package/src/lib/services/lockDown.js

@@ -0,0 +1,157 @@
+const fs = require('fs')
+const { derive, publickeys, scan } = require('@dotenvx/primitives')
+
+const Errors = require('../helpers/errors')
+const upsertEnvKey = require('../helpers/upsertEnvKey')
+
+function latestValues (parsed) {
+  const result = {}
+
+  for (const [key, values] of Object.entries(parsed)) {
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
+
+function lockedCandidates (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const candidates = []
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+    if (!privateKey.startsWith('locked:')) continue
+
+    const parts = privateKey.split(':')
+    if (parts.length < 3) continue
+
+    candidates.push({
+      privateKeyName,
+      lockedPrivateKeyValue: privateKey,
+      publicKeyValue: parts[1]
+    })
+  }
+
+  return candidates
+}
+
+function privateKeyring (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const keyring = {}
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+    if (privateKey.startsWith('locked:')) continue
+
+    try {
+      const publicKey = derive(privateKey)
+      keyring[publicKey] = { privateKeyName, privateKeyValue: privateKey }
+    } catch {}
+  }
+
+  return keyring
+}
+
+class LockDown {
+  constructor (envFile = '.env', envKeysFile = '.env.keys') {
+    this.envFile = envFile
+    this.envKeysFile = envKeysFile
+  }
+
+  lockedCandidates () {
+    const keysSrc = fs.readFileSync(this.envKeysFile, 'utf8')
+    const candidates = lockedCandidates(keysSrc)
+
+    if (candidates.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return candidates
+  }
+
+  plan () {
+    const envSrc = fs.readFileSync(this.envFile, 'utf8')
+    const keysSrc = fs.readFileSync(this.envKeysFile, 'utf8')
+    const publicKeyValues = publickeys(envSrc)
+    const lockedByPublicKey = {}
+    const plaintextByPublicKey = privateKeyring(keysSrc)
+    const locked = []
+    const alreadyUnlocked = []
+
+    for (const lockedPrivateKey of lockedCandidates(keysSrc)) {
+      lockedByPublicKey[lockedPrivateKey.publicKeyValue] = lockedPrivateKey
+    }
+
+    for (const publicKey of publicKeyValues) {
+      const lockedPrivateKey = lockedByPublicKey[publicKey]
+      if (lockedPrivateKey) {
+        locked.push(lockedPrivateKey)
+        continue
+      }
+
+      const privateKey = plaintextByPublicKey[publicKey]
+      if (privateKey) {
+        alreadyUnlocked.push({
+          changed: false,
+          privateKeyName: privateKey.privateKeyName,
+          privateKeyValue: privateKey.privateKeyValue,
+          lockedPrivateKeyValue: undefined,
+          publicKeyValue: publicKey
+        })
+      }
+    }
+
+    if (locked.length < 1 && alreadyUnlocked.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return { locked, alreadyUnlocked }
+  }
+
+  run (unlockPrivateKey) {
+    const { locked, alreadyUnlocked } = this.plan()
+    const results = [...alreadyUnlocked]
+
+    if (locked.length > 0 && !unlockPrivateKey) {
+      throw new Error('missing unlock private key function')
+    }
+
+    for (const lockedPrivateKey of locked) {
+      let privateKeyValue
+
+      try {
+        privateKeyValue = unlockPrivateKey(lockedPrivateKey.lockedPrivateKeyValue)
+      } catch (error) {
+        throw new Errors({ privateKeyName: lockedPrivateKey.privateKeyName }).invalidPassphrase()
+      }
+
+      const publicKeyValue = derive(privateKeyValue)
+
+      if (publicKeyValue !== lockedPrivateKey.publicKeyValue) continue
+
+      const result = upsertEnvKey(lockedPrivateKey.privateKeyName, privateKeyValue, this.envKeysFile)
+
+      results.push({
+        changed: result.changed,
+        privateKeyName: lockedPrivateKey.privateKeyName,
+        privateKeyValue,
+        lockedPrivateKeyValue: lockedPrivateKey.lockedPrivateKeyValue,
+        publicKeyValue
+      })
+    }
+
+    if (results.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return {
+      changed: results.some(result => result.changed),
+      results
+    }
+  }
+}
+
+module.exports = LockDown
+module.exports.lockedCandidates = lockedCandidates