@frontera-sdk/cli 1.52.27 → 1.52.29

package/src/local/local-secrets.ts

@@ -0,0 +1,306 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { parse as parseYaml } from 'yaml'
+
+import type { LocalProject } from './local-project'
+import type { LocalCredentials } from './local-state'
+
+/** A project file's text, or '' when it cannot be read. */
+export function readProjectText(project: LocalProject, file: string): string {
+  try {
+    return readFileSync(join(project.root, file), 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+/** A project file's YAML or JSON document, or null when it cannot be read. */
+export function readProjectDoc(project: LocalProject, file: string): unknown {
+  try {
+    return parseYaml(readProjectText(project, file))
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Secrets a project needs on the local runtime, by name (design §8: secrets
+ * come down as placeholders, as Vercel's do; their values never do).
+ *
+ * A Function names its secrets as `secret:NAME` grants and a workflow names
+ * them in its HTTP steps' and webhook trigger's `auth`; both are in the files
+ * already. A Plugin's header and secret settings come down declared and empty
+ * (`""`), and each is filled on the local runtime from a workspace secret named
+ * after the Plugin and the setting (`acme-crm` + `Authorization` →
+ * `ACME_CRM_AUTHORIZATION`). A person sets every one the same way, with
+ * `frontera secret set NAME` in the project folder, and `local dev` says
+ * "Needs a value for NAME" until they have.
+ */
+
+/** Headers that carry no credential: the platform shows their values, so a pull keeps them (`auto-vault.ts`). */
+export const NON_SECRET_HEADERS = new Set(['content-type', 'accept', 'accept-encoding', 'accept-language', 'user-agent', 'x-workspace-id'])
+
+/** Config keys that hold a credential, by name (the pull's long-standing rule). */
+export const SECRETISH = /key|token|secret|password|authorization|bearer|cookie/i
+
+/** A value the platform masked on read. */
+export const MASKED = /^(\*+|•+)$/
+
+/** The local secret that fills a Plugin's setting: `acme-crm` + `Authorization` → `ACME_CRM_AUTHORIZATION`. */
+export function pluginSecretName(plugin: string, field: string): string {
+  const name = `${plugin}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '')
+  return /^[A-Z]/.test(name) ? name : `PLUGIN_${name}`
+}
+
+/** The `secret:NAME` grants a Function's source names. */
+export function functionSecretNames(source: string): string[] {
+  return [...new Set([...source.matchAll(/['"`]secret:([A-Z][A-Z0-9_]*)['"`]/g)].map((m) => m[1]!))].sort()
+}
+
+/** The secrets a workflow's HTTP steps and webhook trigger name in their `auth`, at any depth. */
+export function workflowSecretNames(doc: unknown): string[] {
+  const out = new Set<string>()
+  const visit = (v: unknown) => {
+    if (Array.isArray(v)) return v.forEach(visit)
+    if (!v || typeof v !== 'object') return
+    for (const [k, x] of Object.entries(v as Record<string, unknown>)) {
+      if (k === 'auth' && x && typeof x === 'object' && typeof (x as { secret?: unknown }).secret === 'string') out.add((x as { secret: string }).secret)
+      visit(x)
+    }
+  }
+  visit(doc)
+  return [...out].sort()
+}
+
+/** A Plugin setting declared empty in its file: a header or a config key, and the local secret that fills it. */
+export interface PluginSecretInput {
+  field: string
+  header: boolean
+  secret: string
+}
+
+/** The settings a Plugin file declares empty, to be filled from local secrets. */
+export function pluginSecretInputs(plugin: string, config: Record<string, unknown>): PluginSecretInput[] {
+  const out: PluginSecretInput[] = []
+  const headers = config.headers
+  if (headers && typeof headers === 'object' && !Array.isArray(headers)) {
+    for (const [h, v] of Object.entries(headers as Record<string, unknown>)) {
+      if (v === '' && !NON_SECRET_HEADERS.has(h.toLowerCase())) out.push({ field: h, header: true, secret: pluginSecretName(plugin, h) })
+    }
+  }
+  for (const [k, v] of Object.entries(config)) {
+    if (k !== 'headers' && k !== 'policy' && v === '' && SECRETISH.test(k)) out.push({ field: k, header: false, secret: pluginSecretName(plugin, k) })
+  }
+  return out
+}
+
+/** The config to send: each of `inputs` filled with a reference to its local secret (`{{vault.NAME}}`). */
+export function fillPluginSecrets(config: Record<string, unknown>, inputs: PluginSecretInput[]): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...config }
+  if (out.headers && typeof out.headers === 'object') out.headers = { ...(out.headers as Record<string, unknown>) }
+  for (const input of inputs) {
+    const ref = `{{vault.${input.secret}}}`
+    if (input.header) (out.headers as Record<string, unknown>)[input.field] = ref
+    else out[input.field] = ref
+  }
+  return out
+}
+
+/** One line of the build: an adaptation the person resolves by setting the secret. */
+export function needsValueLine(name: string, who: string): string {
+  return `  warning: Needs a value for ${name} (${who}): set it with \`frontera secret set ${name}\` in this folder`
+}
+
+/** The build's lines for the secrets `names` that the local runtime has no value for. */
+export async function missingSecretLines(names: string[], who: string, serviceUrl: string, creds: LocalCredentials): Promise<string[]> {
+  if (!names.length) return []
+  const have = await localSecretNames(serviceUrl, creds)
+  if (!have) return []
+  return names.filter((n) => !have.has(n)).map((n) => needsValueLine(n, who))
+}
+
+/** The secret names the local runtime holds (never their values); `null` when it could not say. */
+export async function localSecretNames(serviceUrl: string, creds: LocalCredentials): Promise<Set<string> | null> {
+  if (!creds.workspaceKey || !creds.workspaceId) return null
+  try {
+    const res = await fetch(new URL(`/v1/workspaces/${encodeURIComponent(creds.workspaceId)}/secrets`, serviceUrl), {
+      headers: { authorization: `Bearer ${creds.workspaceKey}` },
+    })
+    if (!res.ok) return null
+    const body = (await res.json()) as { data?: Array<{ name?: string }> } | Array<{ name?: string }>
+    const rows = Array.isArray(body) ? body : (body.data ?? [])
+    return new Set(rows.flatMap((r) => (typeof r.name === 'string' ? [r.name] : [])))
+  } catch {
+    return null
+  }
+}
+
+/**
+ * A Plugin file as a push sends it: every header, key-like setting and
+ * environment value empty, as the pull writes them. The platform keeps its
+ * own; a value typed into the file stays on this computer (and is said so).
+ */
+export function withoutSecrets(text: string): { text: string; notes: string[] } {
+  let doc: Record<string, unknown>
+  try {
+    doc = JSON.parse(text) as Record<string, unknown>
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return { text, notes: [] }
+  } catch {
+    return { text, notes: [] }
+  }
+  const kept: string[] = []
+  const blank = (where: string, value: unknown): unknown => {
+    if (value && typeof value === 'object' && !Array.isArray(value)) return Object.fromEntries(Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, blank(`${where} ${k}`, v)]))
+    if (value !== '' && value !== null && value !== undefined) kept.push(where)
+    return ''
+  }
+  const out: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(doc)) {
+    if (k === 'headers' && v && typeof v === 'object' && !Array.isArray(v)) {
+      // A header that carries no credential keeps its value, as the pull keeps it.
+      out[k] = Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([h, x]) => [h, NON_SECRET_HEADERS.has(h.toLowerCase()) && typeof x === 'string' ? x : blank(`header ${h}`, x)]))
+    }
+    else if (k === 'env' && v && typeof v === 'object' && !Array.isArray(v)) out[k] = blank('env', v)
+    else if (SECRETISH.test(k) && k !== 'policy') out[k] = blank(k, v)
+    else out[k] = v
+  }
+  if (!kept.length) return { text, notes: [] }
+  return {
+    text: `${JSON.stringify(out, null, 2)}\n`,
+    notes: [`Not proposed, as secrets never are: the value${kept.length === 1 ? '' : 's'} of ${kept.join(', ')}; the platform keeps its own (here, set ${kept.length === 1 ? 'it' : 'them'} with \`frontera secret set\`)`],
+  }
+}
+
+/** Whether a project file is a Plugin's, whose secret values are this computer's own. */
+export const isPluginFile = (path: string) => /^mcp\/[^/]+\.plugin\.json$/.test(path)
+
+/**
+ * A Plugin file as the workspace and this project compare it: its secret
+ * values (a header, a key-like setting, an environment value) empty, as the
+ * pull writes them. A value set here is this computer's configuration, so a
+ * header set only locally does not make the Plugin read as changed here.
+ */
+export function comparableText(path: string, text: string, base: string | null = null): string {
+  if (!isPluginFile(path)) return text
+  const blanked = blankedInPlace(text)
+  return base !== null && sameBesideSecrets(text, base) ? base : blanked
+}
+
+/**
+ * Whether a Plugin file here is the base's but for this computer's secrets:
+ * a secret value set here (where the base has it empty, or has no such
+ * header at all), and key order. Then it compares as the base does.
+ */
+function sameBesideSecrets(text: string, base: string): boolean {
+  let ours: Record<string, unknown>
+  let theirs: Record<string, unknown>
+  try {
+    ours = JSON.parse(text) as Record<string, unknown>
+    theirs = JSON.parse(base) as Record<string, unknown>
+  } catch {
+    return false
+  }
+  const obj = (v: unknown) => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : null)
+  const norm = (doc: Record<string, unknown>, other: Record<string, unknown>): unknown => {
+    const out: Record<string, unknown> = {}
+    for (const [k, v] of Object.entries(doc)) {
+      if (k === 'headers' || k === 'env') {
+        const mine = obj(v)
+        if (!mine) {
+          out[k] = v
+          continue
+        }
+        const there = obj(other[k]) ?? {}
+        const kept: Record<string, unknown> = {}
+        for (const [h, x] of Object.entries(mine)) {
+          const secret = k === 'env' || !NON_SECRET_HEADERS.has(h.toLowerCase())
+          // A secret the other side has not got, or has empty: this computer's own.
+          if (secret && (x === '' || !(h in there) || there[h] === '')) continue
+          kept[h] = x
+        }
+        if (Object.keys(kept).length) out[k] = kept
+        continue
+      }
+      if (k !== 'policy' && SECRETISH.test(k) && (v === '' || other[k] === '' || !(k in other))) continue
+      out[k] = v
+    }
+    return out
+  }
+  return JSON.stringify(sortKeys(norm(ours, theirs))) === JSON.stringify(sortKeys(norm(theirs, ours)))
+}
+
+function sortKeys(v: unknown): unknown {
+  if (Array.isArray(v)) return v.map(sortKeys)
+  if (v && typeof v === 'object') return Object.fromEntries(Object.keys(v as Record<string, unknown>).sort().map((k) => [k, sortKeys((v as Record<string, unknown>)[k])]))
+  return v
+}
+
+/**
+ * The file's secret values emptied where they stand, so its layout (and so
+ * its hash, when nothing else changed) is the file's own: a header typed
+ * into a pulled file compares as the file did before. Falls back to the
+ * rewritten document when a value cannot be found as written.
+ */
+function blankedInPlace(text: string): string {
+  const clean = withoutSecrets(text)
+  if (clean.text === text) return text
+  let doc: Record<string, unknown>
+  try {
+    doc = JSON.parse(text) as Record<string, unknown>
+  } catch {
+    return clean.text
+  }
+  const pairs: Array<[string, string]> = []
+  const obj = (v: unknown) => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : null)
+  for (const [h, v] of Object.entries(obj(doc.headers) ?? {})) if (typeof v === 'string' && v && !NON_SECRET_HEADERS.has(h.toLowerCase())) pairs.push([h, v])
+  for (const [k, v] of Object.entries(obj(doc.env) ?? {})) if (typeof v === 'string' && v) pairs.push([k, v])
+  for (const [k, v] of Object.entries(doc)) if (k !== 'policy' && k !== 'headers' && k !== 'env' && SECRETISH.test(k) && typeof v === 'string' && v) pairs.push([k, v])
+  let out = text
+  for (const [key, value] of pairs) {
+    const escape = (s: string) => JSON.stringify(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    out = out.replace(new RegExp(`(${escape(key)}\\s*:\\s*)${escape(value)}`), '$1""')
+  }
+  try {
+    return JSON.stringify(JSON.parse(out)) === JSON.stringify(JSON.parse(clean.text)) ? out : clean.text
+  } catch {
+    return clean.text
+  }
+}
+
+/**
+ * The workspace's Plugin file with this computer's secret values kept: a
+ * header, key-like setting or environment value the workspace leaves empty
+ * keeps the value the file here has. Written by a pull, so taking the
+ * workspace's change never wipes a header set here.
+ */
+export function withLocalSecrets(remote: string, local: string | null): string {
+  if (local === null) return remote
+  let theirs: Record<string, unknown>
+  let ours: Record<string, unknown>
+  try {
+    theirs = JSON.parse(remote) as Record<string, unknown>
+    ours = JSON.parse(local) as Record<string, unknown>
+    if (!theirs || typeof theirs !== 'object' || Array.isArray(theirs) || !ours || typeof ours !== 'object' || Array.isArray(ours)) return remote
+  } catch {
+    return remote
+  }
+  let kept = false
+  const keep = (into: Record<string, unknown>, from: Record<string, unknown>, isSecret: (key: string) => boolean) => {
+    for (const [k, v] of Object.entries(from)) {
+      if (into[k] === '' && typeof v === 'string' && v !== '' && isSecret(k)) {
+        into[k] = v
+        kept = true
+      }
+    }
+  }
+  const obj = (v: unknown) => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : null)
+  const th = obj(theirs.headers)
+  const oh = obj(ours.headers)
+  if (th && oh) keep(th, oh, (h) => !NON_SECRET_HEADERS.has(h.toLowerCase()))
+  const te = obj(theirs.env)
+  const oe = obj(ours.env)
+  if (te && oe) keep(te, oe, () => true)
+  keep(theirs, ours, (k) => k !== 'policy' && k !== 'headers' && k !== 'env' && SECRETISH.test(k))
+  return kept ? `${JSON.stringify(theirs, null, 2)}\n` : remote
+}