npm - @elding/cli - Versions diffs - 0.8.0 → 0.8.1 - Mend

@elding/cli 0.8.0 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/commands/init.js CHANGED Viewed

@@ -35,28 +35,28 @@ async function init() {
         console.log(chalk.yellow("Aucun set trouvé. Créez-en un sur le vault."));
         process.exit(0);
     }
-    // Étape 1 : choisir l'organisation (sauf s'il n'y en a qu'une)
+    // Étape 1 : choisir l'organisation (toujours, pour une approche projet cohérente)
     const orgs = [...new Map(sets.map((s) => [s.workspaceId, s.workspaceName])).entries()];
-    let workspaceId = orgs[0][0];
-    if (orgs.length > 1) {
-        const ans = await inquirer.prompt([
-            {
-                type: "list",
-                name: "workspaceId",
-                message: "Quelle organisation ?",
-                choices: orgs.map(([id, name]) => ({ name: (0, terminal_js_1.safeText)(name), value: id })),
-            },
-        ]);
-        workspaceId = ans.workspaceId;
-    }
-    // Étape 2 : choisir le set parmi ceux de l'org
+    const { workspaceId } = await inquirer.prompt([
+        {
+            type: "select",
+            name: "workspaceId",
+            message: "Quelle organisation ?",
+            choices: orgs.map(([id, name]) => ({ name: (0, terminal_js_1.safeText)(name), value: id })),
+        },
+    ]);
+    // Étape 2 : choisir le set parmi ceux de l'org (env affiché en français)
+    const ENV_LABELS = { DEV: "Dev", STAGING: "Staging", PROD: "Prod" };
     const orgSets = sets.filter((s) => s.workspaceId === workspaceId);
     const { setId } = await inquirer.prompt([
         {
-            type: "list",
+            type: "select",
             name: "setId",
             message: "Quel set utiliser pour ce projet ?",
-            choices: orgSets.map((s) => ({ name: (0, terminal_js_1.safeText)(s.name), value: s.id })),
+            choices: orgSets.map((s) => {
+                const env = s.environment ? ENV_LABELS[s.environment] : undefined;
+                return { name: env ? `${(0, terminal_js_1.safeText)(s.name)} (${env})` : (0, terminal_js_1.safeText)(s.name), value: s.id };
+            }),
         },
     ]);
     const selected = orgSets.find((s) => s.id === setId);
@@ -69,5 +69,4 @@ async function init() {
     (0, config_js_1.writeProject)(project);
     (0, config_js_1.trustProject)(project);
     console.log(chalk.green(`✓ Set "${(0, terminal_js_1.safeText)(selected.name)}" (${(0, terminal_js_1.safeText)(selected.workspaceName)}) configuré dans .elding.json`));
-    console.log(chalk.dim("Ajoutez .elding.json à votre .gitignore si besoin."));
 }

package/dist/commands/login.js CHANGED Viewed

@@ -42,8 +42,19 @@ async function login() {
                     "Referrer-Policy": "no-referrer",
                     "Cache-Control": "no-store",
                 });
-                res.end(`<!DOCTYPE html><html><head><meta charset="utf-8"><script>history.replaceState(null,"","/")</script></head><body style="font-family:sans-serif;padding:2rem">
-          <p><strong>Authentification réussie.</strong> Vous pouvez fermer cet onglet.</p>
+                res.end(`<!DOCTYPE html><html lang="fr"><head><meta charset="utf-8"><title>Elding</title><script>history.replaceState(null,"","/")</script><style>
+          *{margin:0;padding:0;box-sizing:border-box}
+          html,body{height:100%}
+          body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#fff;color:#000;display:flex;align-items:center;justify-content:center;text-align:center}
+          .wrap{display:flex;flex-direction:column;align-items:center;gap:.75rem;padding:2rem}
+          h1{font-size:2.25rem;font-weight:600;letter-spacing:-.02em}
+          p{font-size:1rem;color:#6b7280}
+        </style></head><body>
+          <div class="wrap">
+            <h1>Tout est prêt, codez l'esprit tranquille</h1>
+            <p>Vous êtes connecté à Elding.</p>
+            <p>Vous pouvez maintenant fermer cette fenêtre.</p>
+          </div>
         </body></html>`);
                 clearTimeout(timeout);
                 server.close();

package/dist/index.js CHANGED Viewed

@@ -18,7 +18,7 @@ const program = new commander_1.Command();
 program
     .name("elding")
     .description("Elding CLI — secrets depuis le vault, zéro .env")
-    .version("0.3.0");
+    .version("0.8.1");
 program
     .command("login")
     .description("Authentifier le CLI via le navigateur")

package/dist/lib/api.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ export declare const BASE_URL: string;
 export type ApiKeySetItem = {
     id: string;
     name: string;
+    environment?: string;
     workspaceId: string;
     workspaceName: string;
 };

package/dist/lib/proxyServer.js CHANGED Viewed

@@ -7,8 +7,11 @@ exports.startProxy = startProxy;
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
+const stream_1 = require("stream");
 const dns_1 = require("dns");
 const crypto_1 = require("crypto");
+const zlib_1 = require("zlib");
+const redact_js_1 = require("./redact.js");
 const PLACEHOLDER = /\{\{([A-Z0-9_]+)\}\}/g;
 const PROXY_TIMEOUT_MS = 60_000;
 const MAX_HOST_LENGTH = 253;
@@ -152,6 +155,8 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
         return null;
     };
     const substitute = (val) => val.replace(PLACEHOLDER, (_, name) => secrets[name] ?? "");
+    // Valeurs de secret a effacer des reponses (anti-echo).
+    const secretValues = Object.values(secrets).filter((v) => typeof v === "string" && v.length >= 8);
     const server = http_1.default.createServer(async (req, res) => {
         const started = Date.now();
         try {
@@ -218,6 +223,8 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
                     continue;
                 if (HOP_BY_HOP_HEADERS.has(lk))
                     continue;
+                if (lk === "accept-encoding")
+                    continue; // force identite : reponse en clair pour la redaction
                 if (typeof v === "string") {
                     rawHeaders[k] = v;
                     headers[k] = substitute(v);
@@ -227,10 +234,13 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
                     headers[k] = v.map(substitute);
                 }
             }
+            // Empeche l'upstream de compresser : sinon impossible de rediger les secrets reflechis.
+            if (secretValues.length > 0)
+                headers["accept-encoding"] = "identity";
             // Streame le corps vers l'upstream sans le bufferiser en mémoire (évite un DoS sur gros upload)
             const hasBody = req.method !== "GET" && req.method !== "HEAD";
             const used = placeholdersIn(rawHeaders);
-            const status = await forwardHttps(req, res, upstream, headers, pinned, hasBody);
+            const status = await forwardHttps(req, res, upstream, headers, pinned, hasBody, secretValues);
             log(req.method ?? "?", targetHost, upstream.pathname, status, Date.now() - started, used, used);
         }
         catch {
@@ -261,16 +271,53 @@ function normalizeAllowedHost(value) {
         return null;
     }
 }
-function filterResponseHeaders(headers) {
+function filterResponseHeaders(headers, secretValues, decodedBody) {
     const out = {};
+    const redacting = secretValues.length > 0;
     for (const [name, value] of Object.entries(headers)) {
-        if (HOP_BY_HOP_HEADERS.has(name.toLowerCase()))
+        const lower = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(lower))
             continue;
-        out[name] = value;
+        if (decodedBody && lower === "content-encoding")
+            continue;
+        if ((redacting || decodedBody) && (lower === "content-md5" || lower === "digest" || lower === "etag"))
+            continue;
+        // La redaction modifie la taille du corps : on laisse Node re-calculer (chunked).
+        if (redacting && lower === "content-length")
+            continue;
+        if (typeof value === "string")
+            out[name] = (0, redact_js_1.redactString)(value, secretValues);
+        else if (Array.isArray(value))
+            out[name] = value.map((v) => (0, redact_js_1.redactString)(v, secretValues));
+        else
+            out[name] = value;
     }
     return out;
 }
-function forwardHttps(req, res, upstream, headers, pinned, hasBody) {
+function responseBodyForRedaction(upstreamRes, shouldRedact) {
+    const raw = upstreamRes.headers["content-encoding"];
+    const encodings = (Array.isArray(raw) ? raw.join(",") : raw ?? "")
+        .toLowerCase()
+        .split(",")
+        .map((v) => v.trim())
+        .filter((v) => v && v !== "identity");
+    if (!shouldRedact || encodings.length === 0)
+        return { stream: upstreamRes, decoded: false };
+    if (encodings.length !== 1)
+        return null;
+    switch (encodings[0]) {
+        case "gzip":
+        case "x-gzip":
+            return { stream: upstreamRes.pipe((0, zlib_1.createGunzip)()), decoded: true };
+        case "deflate":
+            return { stream: upstreamRes.pipe((0, zlib_1.createInflate)()), decoded: true };
+        case "br":
+            return { stream: upstreamRes.pipe((0, zlib_1.createBrotliDecompress)()), decoded: true };
+        default:
+            return null;
+    }
+}
+function forwardHttps(req, res, upstream, headers, pinned, hasBody, secretValues) {
     return new Promise((resolve, reject) => {
         const upstreamHostname = normalizeHostname(upstream.hostname);
         const upstreamReq = https_1.default.request({
@@ -282,15 +329,32 @@ function forwardHttps(req, res, upstream, headers, pinned, hasBody) {
             headers: { ...headers, host: upstream.host },
             servername: net_1.default.isIP(upstreamHostname) ? undefined : upstreamHostname,
             timeout: PROXY_TIMEOUT_MS,
-            lookup: (_hostname, _options, callback) => {
-                callback(null, pinned.address, pinned.family);
+            // Node >=20 (autoSelectFamily) appelle lookup avec { all: true } et
+            // attend un tableau ; sinon la forme simple (address, family).
+            lookup: (_hostname, options, callback) => {
+                if (options && options.all)
+                    callback(null, [{ address: pinned.address, family: pinned.family }]);
+                else
+                    callback(null, pinned.address, pinned.family);
             },
         }, (upstreamRes) => {
             const status = upstreamRes.statusCode ?? 502;
-            res.writeHead(status, filterResponseHeaders(upstreamRes.headers));
-            upstreamRes.pipe(res);
-            upstreamRes.on("end", () => resolve(status));
-            upstreamRes.on("error", reject);
+            const body = responseBodyForRedaction(upstreamRes, secretValues.length > 0);
+            if (!body) {
+                upstreamRes.resume();
+                res.writeHead(502);
+                res.end("unsupported compressed response");
+                resolve(502);
+                return;
+            }
+            res.writeHead(status, filterResponseHeaders(upstreamRes.headers, secretValues, body.decoded));
+            const redactor = (0, redact_js_1.createRedactor)(secretValues);
+            (0, stream_1.pipeline)(body.stream, redactor, res, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(status);
+            });
         });
         upstreamReq.on("timeout", () => upstreamReq.destroy(new Error("upstream timeout")));
         upstreamReq.on("error", reject);

package/dist/lib/redact.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import { Transform } from "stream";
+export declare function createRedactor(secretValues: string[]): Transform;
+export declare function redactString(value: string, secretValues: string[]): string;

package/dist/lib/redact.js ADDED Viewed

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRedactor = createRedactor;
+exports.redactString = redactString;
+const stream_1 = require("stream");
+const REDACTED = Buffer.from("[REDACTED]");
+// Remplace toutes les occurrences de `search` dans `buf` (recherche binaire, ne
+// corrompt pas les corps non-texte : sans correspondance, passthrough inchange).
+function replaceAll(buf, search) {
+    const parts = [];
+    let idx = 0;
+    let found = buf.indexOf(search, idx);
+    if (found === -1)
+        return buf;
+    while (found !== -1) {
+        parts.push(buf.subarray(idx, found), REDACTED);
+        idx = found + search.length;
+        found = buf.indexOf(search, idx);
+    }
+    parts.push(buf.subarray(idx));
+    return Buffer.concat(parts);
+}
+// Transform qui efface les valeurs de secret du flux de reponse avant qu'il
+// atteigne l'app. Tue le cas "domaine qui echo la cle". Gere les coupures de
+// chunk en retenant les (maxLen-1) derniers octets entre deux passes.
+function createRedactor(secretValues) {
+    const values = [...new Set(secretValues)]
+        .filter((v) => v.length >= 8)
+        .map((v) => Buffer.from(v, "utf8"));
+    const maxLen = values.reduce((m, v) => Math.max(m, v.length), 0);
+    let carry = Buffer.alloc(0);
+    const scrub = (b) => {
+        for (const v of values)
+            b = replaceAll(b, v);
+        return b;
+    };
+    return new stream_1.Transform({
+        transform(chunk, _enc, cb) {
+            if (values.length === 0)
+                return cb(null, chunk);
+            const buf = scrub(Buffer.concat([carry, chunk]));
+            const hold = Math.min(buf.length, maxLen - 1);
+            carry = Buffer.from(buf.subarray(buf.length - hold));
+            cb(null, buf.subarray(0, buf.length - hold));
+        },
+        flush(cb) {
+            cb(null, carry);
+        },
+    });
+}
+// Rediger aussi les valeurs de secret dans une chaine (entetes de reponse).
+function redactString(value, secretValues) {
+    let out = value;
+    for (const v of secretValues)
+        if (v.length >= 8)
+            out = out.split(v).join("[REDACTED]");
+    return out;
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@elding/cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Elding CLI — zero .env, secrets from vault",
   "bin": {
     "elding": "dist/index.js"