@dotenvx/dotenvx 2.26.0 → 2.27.0

package/src/cli/dotenvx.js

@@ -73,7 +73,6 @@ program.command('run')
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--redact', 'redact injected values except keys ending in _PLAIN', false)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
-  .option('--validate', 'validate against .env.example', false)
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
@@ -224,7 +223,8 @@ program.command('ls')
 
 // dotenvx validate
 program.command('validate')
-  .description('validate .env file(s) against .env.example')
+  .description('validate .env file(s) against Envfile')
+  .option('--strict', 'process.exit(1) on any errors, including missing env files', false)
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
@@ -346,14 +346,19 @@ program.command('help [command]')
 
 // security sections (hidden commands advertised here)
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Better Security:')
+program.addHelpText('after', 'Local Custody:')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
+program.addHelpText('after', '  native                   ⌥ move private keys in/out of your OS secret store')
+program.addHelpText('after', '  1password                □ move private keys in/out of 1Password')
+program.addHelpText('after', '  bitwarden                □ move private keys in/out of Bitwarden')
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'For Security Teams:')
-program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Managed Custody:')
+program.addHelpText('after', '  armor                    ⛨ move private keys in/out of Dotenvx Armor [www.dotenvx.com/armor]')
 program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 
+require('./commands/custody')(program.command('1password', { hidden: true }), '1Password', '../../lib/helpers/onePasswordCustody')
+require('./commands/custody')(program.command('bitwarden', { hidden: true }), 'Bitwarden', '../../lib/helpers/bitwardenCustody')
+
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))
 

package/src/lib/grammars/envfile.peggy

@@ -0,0 +1,98 @@
+Document
+  = _ encrypted:EncryptedDefault? _ entries:((FileBlock / Declaration) _)* {
+      return { encrypted: encrypted === true, declarations: entries.map(item => item[0]).filter(item => !item.file), files: entries.map(item => item[0]).filter(item => item.file) };
+    }
+
+FileBlock
+  = "file" [ \t]+ file:Filename [ \t]+ "do" [ \t]* Comment? Newline _ encrypted:EncryptedDefault? _ declarations:(Declaration _)* "end" [ \t]* Comment? (Newline / !.) {
+      return { file, encrypted, declarations: declarations.map(item => item[0]) };
+    }
+
+Filename "a quoted filename"
+  = '"' value:$([^"\r\n\0]+) '"' { return value; }
+  / "'" value:$([^'\r\n\0]+) "'" { return value; }
+
+EncryptedDefault
+  = "encrypted" [ \t]+ value:Boolean [ \t]* Comment? (Newline / !.) { return value; }
+
+Declaration
+  = "env" [ \t]+ name:Name options:Option* [ \t]* Comment? (Newline / !.) {
+      const declaration = { name };
+      const seen = new Set();
+      for (const option of options) {
+        if (seen.has(option.key)) error(`Duplicate Envfile option: ${option.key}`);
+        if ((option.key === "optional" && seen.has("required")) ||
+            (option.key === "required" && seen.has("optional"))) {
+          error("Cannot combine required and optional in an Envfile declaration");
+        }
+        seen.add(option.key);
+        if (option.key === "optional") declaration.required = !option.value;
+        else declaration[option.key] = option.value;
+      }
+      return declaration;
+    }
+
+Option
+  = [ \t]* "," _ "proxy" [ \t]* ":" _ value:(ProxyOptions / Disabled) { return { key: "proxy", value }; }
+  / [ \t]* "," _ "required" [ \t]* ":" _ value:Boolean { return { key: "required", value }; }
+  / [ \t]* "," _ "optional" [ \t]* ":" _ value:Boolean { return { key: "optional", value }; }
+  / [ \t]* "," _ "encrypted" [ \t]* ":" _ value:Boolean { return { key: "encrypted", value }; }
+  / [ \t]* "," _ "type" [ \t]* ":" _ value:Type { return { key: "type", value }; }
+  / [ \t]* "," _ "enum" [ \t]* ":" _ value:Enum { return { key: "enum", value }; }
+  / [ \t]* "," _ key:("min" / "max") [ \t]* ":" _ value:Integer { return { key, value }; }
+
+Integer "an integer"
+  = value:$([+-]? [0-9]+) { return value; }
+
+Enum
+  = "[" _ first:EnumValue rest:(_ "," _ value:EnumValue { return value; })* _ ","? _ "]" {
+      return [first, ...rest];
+    }
+
+EnumValue
+  = '"' chars:(Escape / [^"\\\r\n])* '"' { return chars.join(""); }
+  / "'" chars:(Escape / [^'\\\r\n])* "'" { return chars.join(""); }
+  / Integer
+
+Escape
+  = "\\" char:["'\\nrt] {
+      return ({ n: "\n", r: "\r", t: "\t" })[char] || char;
+    }
+
+Type "a supported type (integer, boolean, port, url, email, or ip)"
+  = ('"integer"' / "'integer'") { return "integer"; }
+  / ('"boolean"' / "'boolean'") { return "boolean"; }
+  / ('"port"' / "'port'") { return "port"; }
+  / ('"url"' / "'url'") { return "url"; }
+  / ('"email"' / "'email'") { return "email"; }
+  / ('"ip"' / "'ip'") { return "ip"; }
+
+Boolean "true or false"
+  = "true" { return true; }
+  / Disabled
+
+ProxyOptions
+  = "{" _ "domain" [ \t]* ":" _ domain:Destination _ ","? _ "}" { return { domain }; }
+
+Disabled
+  = "false" { return false; }
+
+Destination "a quoted domain"
+  = '"' host:$([A-Za-z0-9.-]+) '"' { return host; }
+  / "'" host:$([A-Za-z0-9.-]+) "'" { return host; }
+
+Name "a quoted variable name"
+  = '"' name:Identifier '"' { return name; }
+  / "'" name:Identifier "'" { return name; }
+
+Identifier
+  = $([A-Za-z_] [A-Za-z0-9_]*)
+
+Comment
+  = "#" [^\r\n]*
+
+Newline
+  = "\r\n" / "\n" / "\r"
+
+_
+  = ([ \t] / Newline / Comment)*

package/src/lib/helpers/bitwardenCustody.js

@@ -159,4 +159,12 @@ async function set (publicKey, privateKey) {
   new Session().createStore().set(`${PREFIX}${publicKey}`, Buffer.from(JSON.stringify(loc)).toString('base64'))
 }
 
-module.exports = { available, configured, get, getSync, set }
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  await authenticate(loc)
+  await run(['delete', 'item', loc.item])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/encryptedSources.js

@@ -0,0 +1,15 @@
+const { scan, encrypted } = require('@dotenvx/primitives')
+
+// Follow actual injection order, so shell overrides and --overload retain their semantics.
+module.exports = function encryptedSources (processedEnvs) {
+  const keys = new Set()
+  for (const row of processedEnvs || []) {
+    const { parsed } = scan(row.src || row.string || '')
+    for (const [key, value] of Object.entries(row.injected || {})) {
+      const original = parsed[key]?.at(-1)
+      if (encrypted(original) && !encrypted(value)) keys.add(key)
+      else keys.delete(key)
+    }
+  }
+  return keys
+}