@geekmidas/cli 9.0.2 → 10.0.0-alpha.0

package/src/secrets/storage.ts

@@ -1,337 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { basename, join } from 'node:path';
-import { getOrCreateKey, readKey } from './keystore';
-import type { EmbeddableSecrets, StageSecrets } from './types';
-
-/** Default secrets directory relative to project root */
-const SECRETS_DIR = '.gkm/secrets';
-
-/** AES-256-GCM configuration */
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12; // 96 bits for GCM
-const AUTH_TAG_LENGTH = 16; // 128 bits
-
-/** Encrypted secrets file structure */
-interface EncryptedSecretsFile {
-	/** Version for future format changes */
-	version: 1;
-	/** Base64 encoded encrypted data (ciphertext + auth tag) */
-	encrypted: string;
-	/** Hex encoded IV */
-	iv: string;
-}
-
-/**
- * Get the secrets directory path.
- */
-export function getSecretsDir(cwd = process.cwd()): string {
-	return join(cwd, SECRETS_DIR);
-}
-
-/**
- * Get the secrets file path for a stage.
- */
-export function getSecretsPath(stage: string, cwd = process.cwd()): string {
-	return join(getSecretsDir(cwd), `${stage}.json`);
-}
-
-/**
- * Check if secrets exist for a stage.
- */
-export function secretsExist(stage: string, cwd = process.cwd()): boolean {
-	return existsSync(getSecretsPath(stage, cwd));
-}
-
-/**
- * Initialize an empty StageSecrets object for a stage.
- */
-export function initStageSecrets(stage: string): StageSecrets {
-	const now = new Date().toISOString();
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: {},
-		urls: {},
-		custom: {},
-	};
-}
-
-/**
- * Encrypt secrets using a key.
- */
-function encryptSecretsData(
-	secrets: StageSecrets,
-	keyHex: string,
-): EncryptedSecretsFile {
-	const key = Buffer.from(keyHex, 'hex');
-	const iv = randomBytes(IV_LENGTH);
-
-	// Serialize secrets to JSON
-	const plaintext = JSON.stringify(secrets);
-
-	// Encrypt
-	const cipher = createCipheriv(ALGORITHM, key, iv);
-	const ciphertext = Buffer.concat([
-		cipher.update(plaintext, 'utf-8'),
-		cipher.final(),
-	]);
-
-	// Get auth tag
-	const authTag = cipher.getAuthTag();
-
-	// Combine ciphertext + auth tag
-	const combined = Buffer.concat([ciphertext, authTag]);
-
-	return {
-		version: 1,
-		encrypted: combined.toString('base64'),
-		iv: iv.toString('hex'),
-	};
-}
-
-/**
- * Decrypt secrets using a key.
- */
-function decryptSecretsData(
-	data: EncryptedSecretsFile,
-	keyHex: string,
-): StageSecrets {
-	const key = Buffer.from(keyHex, 'hex');
-	const ivBuffer = Buffer.from(data.iv, 'hex');
-	const combined = Buffer.from(data.encrypted, 'base64');
-
-	// Split ciphertext and auth tag
-	const ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);
-	const authTag = combined.subarray(-AUTH_TAG_LENGTH);
-
-	// Decrypt
-	const decipher = createDecipheriv(ALGORITHM, key, ivBuffer);
-	decipher.setAuthTag(authTag);
-
-	const plaintext = Buffer.concat([
-		decipher.update(ciphertext),
-		decipher.final(),
-	]);
-
-	return JSON.parse(plaintext.toString('utf-8')) as StageSecrets;
-}
-
-/**
- * Read secrets for a stage (encrypted).
- * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key
- *
- * @returns StageSecrets or null if not found
- */
-export async function readStageSecrets(
-	stage: string,
-	cwd = process.cwd(),
-): Promise<StageSecrets | null> {
-	const path = getSecretsPath(stage, cwd);
-
-	if (!existsSync(path)) {
-		return null;
-	}
-
-	const content = await readFile(path, 'utf-8');
-	const data = JSON.parse(content);
-
-	// Check if this is an encrypted file (has version field)
-	if (data.version === 1 && data.encrypted && data.iv) {
-		const projectName = basename(cwd);
-		const key = await readKey(stage, projectName);
-
-		if (!key) {
-			throw new Error(
-				`Decryption key not found for stage "${stage}". ` +
-					`Expected key at: ~/.gkm/${projectName}/${stage}.key`,
-			);
-		}
-
-		return decryptSecretsData(data as EncryptedSecretsFile, key);
-	}
-
-	// Legacy: unencrypted format (for backwards compatibility)
-	return data as StageSecrets;
-}
-
-/**
- * Write secrets for a stage (encrypted).
- * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key
- */
-export async function writeStageSecrets(
-	secrets: StageSecrets,
-	cwd = process.cwd(),
-): Promise<void> {
-	const dir = getSecretsDir(cwd);
-	const path = getSecretsPath(secrets.stage, cwd);
-	const projectName = basename(cwd);
-
-	// Ensure directory exists
-	await mkdir(dir, { recursive: true });
-
-	// Get or create encryption key
-	const key = await getOrCreateKey(secrets.stage, projectName);
-
-	// Encrypt and write
-	const encrypted = encryptSecretsData(secrets, key);
-	await writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');
-}
-
-/**
- * Convert StageSecrets to embeddable format (flat key-value pairs).
- * This is what gets encrypted and embedded in the bundle.
- */
-export function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {
-	return {
-		...secrets.urls,
-		...secrets.custom,
-		// Also include individual service credentials if needed
-		...(secrets.services.postgres && {
-			POSTGRES_USER: secrets.services.postgres.username,
-			POSTGRES_PASSWORD: secrets.services.postgres.password,
-			POSTGRES_DB: secrets.services.postgres.database ?? 'app',
-			POSTGRES_HOST: secrets.services.postgres.host,
-			POSTGRES_PORT: String(secrets.services.postgres.port),
-		}),
-		...(secrets.services.redis && {
-			REDIS_PASSWORD: secrets.services.redis.password,
-			REDIS_HOST: secrets.services.redis.host,
-			REDIS_PORT: String(secrets.services.redis.port),
-		}),
-		...(secrets.services.rabbitmq && {
-			RABBITMQ_USER: secrets.services.rabbitmq.username,
-			RABBITMQ_PASSWORD: secrets.services.rabbitmq.password,
-			RABBITMQ_HOST: secrets.services.rabbitmq.host,
-			RABBITMQ_PORT: String(secrets.services.rabbitmq.port),
-			RABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',
-		}),
-		...(secrets.services.minio && {
-			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
-			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
-			STORAGE_BUCKET: secrets.services.minio.bucket ?? 'app',
-			STORAGE_REGION: 'eu-west-1',
-			STORAGE_FORCE_PATH_STYLE: 'true',
-		}),
-		...(secrets.services.mailpit && {
-			SMTP_HOST: secrets.services.mailpit.host,
-			SMTP_PORT: String(secrets.services.mailpit.port),
-			SMTP_USER: secrets.services.mailpit.username,
-			SMTP_PASS: secrets.services.mailpit.password,
-			SMTP_SECURE: 'false',
-			MAIL_FROM: 'noreply@localhost',
-		}),
-		...(secrets.services.localstack && {
-			AWS_ACCESS_KEY_ID:
-				secrets.services.localstack.accessKeyId ??
-				secrets.services.localstack.username,
-			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
-			AWS_REGION: secrets.services.localstack.region ?? 'us-east-1',
-			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`,
-		}),
-		...(secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password,
-		}),
-	};
-}
-
-/**
- * Update a custom secret in the secrets file.
- */
-export async function setCustomSecret(
-	stage: string,
-	key: string,
-	value: string,
-	cwd = process.cwd(),
-): Promise<StageSecrets> {
-	const secrets = await readStageSecrets(stage, cwd);
-
-	if (!secrets) {
-		throw new Error(
-			`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`,
-		);
-	}
-
-	const updated: StageSecrets = {
-		...secrets,
-		updatedAt: new Date().toISOString(),
-		custom: {
-			...secrets.custom,
-			[key]: value,
-		},
-	};
-
-	await writeStageSecrets(updated, cwd);
-	return updated;
-}
-
-/**
- * Mask a password for display (show first 4 and last 2 chars).
- */
-export function maskPassword(password: string): string {
-	if (password.length <= 8) {
-		return '********';
-	}
-	return `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;
-}
-
-/**
- * Result of environment variable validation.
- */
-export interface EnvValidationResult {
-	/** Whether all required environment variables are present */
-	valid: boolean;
-	/** List of missing environment variable names */
-	missing: string[];
-	/** List of environment variables that are provided */
-	provided: string[];
-	/** List of environment variables that were required */
-	required: string[];
-}
-
-/**
- * Validate that all required environment variables are present in secrets.
- *
- * @param requiredVars - Array of environment variable names required by the application
- * @param secrets - Stage secrets to validate against
- * @returns Validation result with missing and provided variables
- *
- * @example
- * ```typescript
- * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
- * const secrets = await readStageSecrets('production');
- * const result = validateEnvironmentVariables(required, secrets);
- *
- * if (!result.valid) {
- *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
- * }
- * ```
- */
-export function validateEnvironmentVariables(
-	requiredVars: string[],
-	secrets: StageSecrets,
-): EnvValidationResult {
-	const embeddable = toEmbeddableSecrets(secrets);
-	const availableVars = new Set(Object.keys(embeddable));
-
-	const missing: string[] = [];
-	const provided: string[] = [];
-
-	for (const varName of requiredVars) {
-		if (availableVars.has(varName)) {
-			provided.push(varName);
-		} else {
-			missing.push(varName);
-		}
-	}
-
-	return {
-		valid: missing.length === 0,
-		missing: missing.sort(),
-		provided: provided.sort(),
-		required: [...requiredVars].sort(),
-	};
-}

package/src/secrets/sync.ts

@@ -1,136 +0,0 @@
-/**
- * Secrets Sync via AWS SSM Parameter Store
- *
- * Stores and retrieves encrypted StageSecrets as SecureString parameters.
- * Reuses the SSM infrastructure from the state provider.
- *
- * Parameter naming: /gkm/{workspaceName}/{stage}/secrets
- */
-
-import {
-	GetParameterCommand,
-	ParameterNotFound,
-	PutParameterCommand,
-	SSMClient,
-	type SSMClientConfig,
-} from '@aws-sdk/client-ssm';
-import type { SSMStateConfig } from '../deploy/StateProvider.js';
-import type { NormalizedWorkspace } from '../workspace/types.js';
-import type { StageSecrets } from './types.js';
-
-/**
- * Get the SSM parameter name for secrets.
- */
-function getSecretsParameterName(workspaceName: string, stage: string): string {
-	return `/gkm/${workspaceName}/${stage}/secrets`;
-}
-
-/**
- * Create an SSM client from workspace state config.
- */
-function createSSMClient(config: SSMStateConfig): SSMClient {
-	const clientConfig: SSMClientConfig = {
-		region: config.region,
-	};
-
-	if (config.profile) {
-		const { fromIni } = require('@aws-sdk/credential-providers');
-		clientConfig.credentials = fromIni({ profile: config.profile });
-	}
-
-	return new SSMClient(clientConfig);
-}
-
-/**
- * Push secrets to SSM Parameter Store.
- *
- * Stores the full StageSecrets object as a SecureString parameter.
- */
-export async function pushSecrets(
-	stage: string,
-	workspace: NormalizedWorkspace,
-): Promise<void> {
-	const config = workspace.state;
-	if (!config || config.provider !== 'ssm') {
-		throw new Error(
-			'SSM state provider not configured. Add state: { provider: "ssm", region: "..." } to gkm.config.ts.',
-		);
-	}
-
-	if (!workspace.name) {
-		throw new Error(
-			'Workspace name is required for SSM secrets sync. Set "name" in gkm.config.ts.',
-		);
-	}
-
-	const client = createSSMClient(config as SSMStateConfig);
-	const parameterName = getSecretsParameterName(workspace.name, stage);
-
-	const { readStageSecrets } = await import('./storage.js');
-	const secrets = await readStageSecrets(stage, workspace.root);
-
-	if (!secrets) {
-		throw new Error(
-			`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`,
-		);
-	}
-
-	await client.send(
-		new PutParameterCommand({
-			Name: parameterName,
-			Value: JSON.stringify(secrets),
-			Type: 'SecureString',
-			Overwrite: true,
-			Description: `GKM secrets for ${workspace.name}/${stage}`,
-		}),
-	);
-}
-
-/**
- * Pull secrets from SSM Parameter Store.
- *
- * @returns StageSecrets or null if no secrets are stored remotely
- */
-export async function pullSecrets(
-	stage: string,
-	workspace: NormalizedWorkspace,
-): Promise<StageSecrets | null> {
-	const config = workspace.state;
-	if (!config || config.provider !== 'ssm') {
-		return null;
-	}
-
-	if (!workspace.name) {
-		return null;
-	}
-
-	const client = createSSMClient(config as SSMStateConfig);
-	const parameterName = getSecretsParameterName(workspace.name, stage);
-
-	try {
-		const response = await client.send(
-			new GetParameterCommand({
-				Name: parameterName,
-				WithDecryption: true,
-			}),
-		);
-
-		if (!response.Parameter?.Value) {
-			return null;
-		}
-
-		return JSON.parse(response.Parameter.Value) as StageSecrets;
-	} catch (error) {
-		if (error instanceof ParameterNotFound) {
-			return null;
-		}
-		throw error;
-	}
-}
-
-/**
- * Check if SSM is configured for the workspace.
- */
-export function isSSMConfigured(workspace: NormalizedWorkspace): boolean {
-	return !!workspace.state && workspace.state.provider === 'ssm';
-}

package/src/secrets/types.ts

@@ -1,70 +0,0 @@
-import type { ComposeServiceName, EventsBackend } from '../types';
-
-/** Credentials for a specific service */
-export interface ServiceCredentials {
-	host: string;
-	port: number;
-	username: string;
-	password: string;
-	/** Database name (for postgres) */
-	database?: string;
-	/** Virtual host (for rabbitmq) */
-	vhost?: string;
-	/** Bucket name (for minio) */
-	bucket?: string;
-	/** Access key ID (for localstack) */
-	accessKeyId?: string;
-	/** Region (for localstack) */
-	region?: string;
-}
-
-/** Stage secrets configuration */
-export interface StageSecrets {
-	/** Stage name (e.g., 'production', 'staging') */
-	stage: string;
-	/** ISO timestamp when secrets were created */
-	createdAt: string;
-	/** ISO timestamp when secrets were last updated */
-	updatedAt: string;
-	/** Event backend type (if events are enabled) */
-	eventsBackend?: EventsBackend;
-	/** Service-specific credentials */
-	services: {
-		postgres?: ServiceCredentials;
-		redis?: ServiceCredentials;
-		rabbitmq?: ServiceCredentials;
-		minio?: ServiceCredentials;
-		mailpit?: ServiceCredentials;
-		localstack?: ServiceCredentials;
-		pgboss?: ServiceCredentials;
-	};
-	/** Generated connection URLs */
-	urls: {
-		DATABASE_URL?: string;
-		REDIS_URL?: string;
-		RABBITMQ_URL?: string;
-		STORAGE_ENDPOINT?: string;
-		SMTP_HOST?: string;
-		SMTP_PORT?: string;
-		EVENT_PUBLISHER_CONNECTION_STRING?: string;
-		EVENT_SUBSCRIBER_CONNECTION_STRING?: string;
-	};
-	/** Custom user-defined secrets */
-	custom: Record<string, string>;
-}
-
-/** Encrypted payload for build-time injection */
-export interface EncryptedPayload {
-	/** Base64 encoded encrypted data (ciphertext + auth tag) */
-	encrypted: string;
-	/** Hex encoded IV */
-	iv: string;
-	/** Hex encoded ephemeral master key (for deployment) */
-	masterKey: string;
-}
-
-/** Secrets that get encrypted and embedded in the bundle */
-export type EmbeddableSecrets = Record<string, string>;
-
-/** Services that support automatic credential generation */
-export type SecretServiceName = ComposeServiceName;

package/src/setup/__tests__/auto-setup.spec.ts

@@ -1,147 +0,0 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { rm } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { readStageSecrets, secretsExist } from '../../secrets/storage.js';
-import type { NormalizedWorkspace } from '../../workspace/types.js';
-import { createFreshWorkspaceSecrets, ensureStageSecrets } from '../index.js';
-
-function createWorkspace(
-	overrides: Partial<NormalizedWorkspace> = {},
-): NormalizedWorkspace {
-	return {
-		name: 'test-project',
-		root: '/tmp/test-project',
-		apps: {
-			api: {
-				type: 'backend',
-				port: 3000,
-				root: '/tmp/test-project/apps/api',
-				packageName: '@test/api',
-				routes: './src/endpoints/**/*.ts',
-				dependencies: [],
-			},
-		},
-		services: { db: true },
-		deploy: {},
-		shared: {},
-		secrets: {},
-		...overrides,
-	} as NormalizedWorkspace;
-}
-
-describe('createFreshWorkspaceSecrets', () => {
-	it('generates postgres credentials when db service is enabled', () => {
-		const secrets = createFreshWorkspaceSecrets(
-			'development',
-			createWorkspace(),
-		);
-
-		expect(secrets.stage).toBe('development');
-		expect(secrets.services.postgres).toBeDefined();
-		expect(secrets.services.postgres?.password).toBeTruthy();
-		expect(secrets.urls.DATABASE_URL).toContain('postgresql://');
-	});
-
-	it('generates a randomized password each call', () => {
-		const a = createFreshWorkspaceSecrets('development', createWorkspace());
-		const b = createFreshWorkspaceSecrets('development', createWorkspace());
-
-		expect(a.services.postgres?.password).not.toBe(
-			b.services.postgres?.password,
-		);
-	});
-
-	it('adds single-app custom secrets', () => {
-		const secrets = createFreshWorkspaceSecrets(
-			'development',
-			createWorkspace(),
-		);
-
-		expect(secrets.custom.NODE_ENV).toBe('development');
-		expect(secrets.custom.JWT_SECRET).toBeTruthy();
-	});
-});
-
-describe('ensureStageSecrets', () => {
-	let testDir: string;
-	const originalGkmConfigPath = process.env.GKM_CONFIG_PATH;
-
-	beforeEach(() => {
-		testDir = join(
-			tmpdir(),
-			`gkm-auto-setup-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-		);
-		mkdirSync(testDir, { recursive: true });
-
-		// Minimal single-app workspace config with a db service.
-		writeFileSync(
-			join(testDir, 'gkm.config.ts'),
-			`import { defineWorkspace } from '@geekmidas/cli/config';
-
-export default defineWorkspace({
-  name: 'test-workspace',
-  apps: {
-    api: {
-      type: 'backend',
-      path: 'apps/api',
-      port: 3001,
-      routes: './src/endpoints/**/*.ts',
-      envParser: './src/config/env#envParser',
-      logger: './src/config/logger#logger',
-    },
-  },
-  services: { db: true },
-});
-`,
-		);
-		const apiDir = join(testDir, 'apps', 'api');
-		mkdirSync(apiDir, { recursive: true });
-		writeFileSync(
-			join(apiDir, 'package.json'),
-			JSON.stringify({ name: '@test/api', version: '0.0.1' }),
-		);
-
-		process.env.GKM_CONFIG_PATH = join(testDir, 'gkm.config.ts');
-	});
-
-	afterEach(async () => {
-		if (originalGkmConfigPath === undefined) {
-			delete process.env.GKM_CONFIG_PATH;
-		} else {
-			process.env.GKM_CONFIG_PATH = originalGkmConfigPath;
-		}
-
-		await rm(testDir, { recursive: true, force: true });
-		// writeStageSecrets mints a key at ~/.gkm/{basename(root)}
-		await rm(join(homedir(), '.gkm', basename(testDir)), {
-			recursive: true,
-			force: true,
-		});
-	});
-
-	it('generates a decryptable stage when none exists', async () => {
-		expect(secretsExist('development', testDir)).toBe(false);
-
-		const generated = await ensureStageSecrets('development', testDir);
-
-		expect(generated).toBe(true);
-		expect(secretsExist('development', testDir)).toBe(true);
-
-		// Round-trips through the keystore the same way `gkm test` reads it.
-		const read = await readStageSecrets('development', testDir);
-		expect(read?.services.postgres).toBeDefined();
-	});
-
-	it('is a no-op when secrets already exist', async () => {
-		await ensureStageSecrets('development', testDir);
-		const before = await readStageSecrets('development', testDir);
-
-		const generated = await ensureStageSecrets('development', testDir);
-
-		expect(generated).toBe(false);
-		const after = await readStageSecrets('development', testDir);
-		expect(after).toEqual(before);
-	});
-});