@geekmidas/envkit 1.1.1 → 10.0.0-alpha.0

package/src/__tests__/credentials.integration.spec.ts

@@ -1,239 +0,0 @@
-import { createCipheriv, randomBytes } from 'node:crypto';
-import vm from 'node:vm';
-import { describe, expect, it } from 'vitest';
-
-/**
- * Helper to encrypt secrets (mirrors CLI encryption logic)
- */
-function encryptSecrets(secrets: Record<string, string>) {
-	const masterKey = randomBytes(32);
-	const iv = randomBytes(12);
-	const plaintext = JSON.stringify(secrets);
-
-	const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
-	const ciphertext = Buffer.concat([
-		cipher.update(plaintext, 'utf-8'),
-		cipher.final(),
-	]);
-	const authTag = cipher.getAuthTag();
-	const combined = Buffer.concat([ciphertext, authTag]);
-
-	return {
-		encrypted: combined.toString('base64'),
-		iv: iv.toString('hex'),
-		masterKey: masterKey.toString('hex'),
-	};
-}
-
-/**
- * Simulates the credentials.ts module code that runs at runtime
- */
-const credentialsModuleCode = `
-const { createDecipheriv } = require('node:crypto');
-
-const AUTH_TAG_LENGTH = 16;
-
-function decryptCredentials(encrypted, iv, masterKey) {
-	const key = Buffer.from(masterKey, 'hex');
-	const ivBuffer = Buffer.from(iv, 'hex');
-	const combined = Buffer.from(encrypted, 'base64');
-
-	const ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);
-	const authTag = combined.subarray(-AUTH_TAG_LENGTH);
-
-	const decipher = createDecipheriv('aes-256-gcm', key, ivBuffer);
-	decipher.setAuthTag(authTag);
-
-	const plaintext = Buffer.concat([
-		decipher.update(ciphertext),
-		decipher.final(),
-	]);
-
-	return JSON.parse(plaintext.toString('utf-8'));
-}
-
-// This simulates runtime behavior
-const Credentials = (() => {
-	if (typeof __GKM_ENCRYPTED_CREDENTIALS__ === 'undefined' ||
-		typeof __GKM_CREDENTIALS_IV__ === 'undefined') {
-		return {};
-	}
-
-	const masterKey = process.env.GKM_MASTER_KEY;
-	if (!masterKey) {
-		return {};
-	}
-
-	try {
-		return decryptCredentials(
-			__GKM_ENCRYPTED_CREDENTIALS__,
-			__GKM_CREDENTIALS_IV__,
-			masterKey
-		);
-	} catch (error) {
-		return {};
-	}
-})();
-
-module.exports = { Credentials };
-`;
-
-describe('Credentials runtime integration', () => {
-	it('should decrypt credentials when globals and master key are set', () => {
-		const secrets = {
-			DATABASE_URL: 'postgresql://user:pass@localhost/db',
-			API_KEY: 'sk_test_123456',
-			WEBHOOK_SECRET: 'whsec_abc123',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-
-		// Create a VM context with the build-time injected globals
-		const context = vm.createContext({
-			__GKM_ENCRYPTED_CREDENTIALS__: encrypted,
-			__GKM_CREDENTIALS_IV__: iv,
-			process: {
-				env: {
-					GKM_MASTER_KEY: masterKey,
-				},
-			},
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		// Run the credentials module code
-		vm.runInContext(credentialsModuleCode, context);
-
-		// Get the exported Credentials
-		const { Credentials } = context.module.exports;
-
-		expect(Credentials).toEqual(secrets);
-	});
-
-	it('should return empty object when globals are not defined', () => {
-		const context = vm.createContext({
-			process: { env: {} },
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		vm.runInContext(credentialsModuleCode, context);
-
-		const { Credentials } = context.module.exports;
-		expect(Credentials).toEqual({});
-	});
-
-	it('should return empty object when master key is missing', () => {
-		const secrets = { KEY: 'value' };
-		const { encrypted, iv } = encryptSecrets(secrets);
-
-		const context = vm.createContext({
-			__GKM_ENCRYPTED_CREDENTIALS__: encrypted,
-			__GKM_CREDENTIALS_IV__: iv,
-			process: { env: {} }, // No GKM_MASTER_KEY
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		vm.runInContext(credentialsModuleCode, context);
-
-		const { Credentials } = context.module.exports;
-		expect(Credentials).toEqual({});
-	});
-
-	it('should return empty object when master key is wrong', () => {
-		const secrets = { KEY: 'value' };
-		const { encrypted, iv } = encryptSecrets(secrets);
-
-		const context = vm.createContext({
-			__GKM_ENCRYPTED_CREDENTIALS__: encrypted,
-			__GKM_CREDENTIALS_IV__: iv,
-			process: {
-				env: {
-					GKM_MASTER_KEY: '0'.repeat(64), // Wrong key
-				},
-			},
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		vm.runInContext(credentialsModuleCode, context);
-
-		const { Credentials } = context.module.exports;
-		expect(Credentials).toEqual({});
-	});
-
-	it('should handle complex secrets with special characters', () => {
-		const secrets = {
-			PRIVATE_KEY:
-				'-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----',
-			JSON_CONFIG: '{"key": "value", "nested": {"a": 1}}',
-			UNICODE: '你好世界 🔐',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-
-		const context = vm.createContext({
-			__GKM_ENCRYPTED_CREDENTIALS__: encrypted,
-			__GKM_CREDENTIALS_IV__: iv,
-			process: {
-				env: { GKM_MASTER_KEY: masterKey },
-			},
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		vm.runInContext(credentialsModuleCode, context);
-
-		const { Credentials } = context.module.exports;
-		expect(Credentials).toEqual(secrets);
-	});
-
-	it('should work with EnvironmentParser pattern', () => {
-		const secrets = {
-			DATABASE_URL: 'postgresql://user:pass@localhost/db',
-			PORT: '3000',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-
-		// Simulate: {...process.env, ...Credentials}
-		const processEnv = {
-			NODE_ENV: 'production',
-			HOST: 'localhost',
-		};
-
-		const context = vm.createContext({
-			__GKM_ENCRYPTED_CREDENTIALS__: encrypted,
-			__GKM_CREDENTIALS_IV__: iv,
-			process: {
-				env: {
-					...processEnv,
-					GKM_MASTER_KEY: masterKey,
-				},
-			},
-			require: require,
-			Buffer: Buffer,
-			module: { exports: {} },
-		});
-
-		vm.runInContext(credentialsModuleCode, context);
-
-		const { Credentials } = context.module.exports;
-
-		// Simulate what user code does
-		const combinedEnv = { ...processEnv, ...Credentials };
-
-		expect(combinedEnv).toEqual({
-			NODE_ENV: 'production',
-			HOST: 'localhost',
-			DATABASE_URL: 'postgresql://user:pass@localhost/db',
-			PORT: '3000',
-		});
-	});
-});

package/src/__tests__/credentials.spec.ts

@@ -1,136 +0,0 @@
-import { createCipheriv, randomBytes } from 'node:crypto';
-import { describe, expect, it } from 'vitest';
-import { decryptCredentials } from '../credentials';
-
-/**
- * Helper to encrypt secrets (mirrors CLI encryption logic)
- */
-function encryptSecrets(secrets: Record<string, string>) {
-	const masterKey = randomBytes(32);
-	const iv = randomBytes(12);
-	const plaintext = JSON.stringify(secrets);
-
-	const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
-	const ciphertext = Buffer.concat([
-		cipher.update(plaintext, 'utf-8'),
-		cipher.final(),
-	]);
-	const authTag = cipher.getAuthTag();
-	const combined = Buffer.concat([ciphertext, authTag]);
-
-	return {
-		encrypted: combined.toString('base64'),
-		iv: iv.toString('hex'),
-		masterKey: masterKey.toString('hex'),
-	};
-}
-
-describe('decryptCredentials', () => {
-	it('should decrypt credentials from encrypted payload', () => {
-		const secrets = {
-			DATABASE_URL: 'postgresql://user:pass@localhost/db',
-			API_KEY: 'sk_test_123456',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual(secrets);
-	});
-
-	it('should handle empty secrets', () => {
-		const secrets = {};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual({});
-	});
-
-	it('should handle secrets with special characters', () => {
-		const secrets = {
-			PASSWORD: 'p@ss/word!#$%^&*(){}[]|\\:";\'<>,.?/',
-			WEBHOOK_URL: 'https://api.example.com/webhook?token=abc&verify=true',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual(secrets);
-	});
-
-	it('should handle secrets with unicode characters', () => {
-		const secrets = {
-			MESSAGE: '你好世界 🔐 مرحبا العالم',
-			EMOJI: '🚀💻🔑',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual(secrets);
-	});
-
-	it('should throw with wrong master key', () => {
-		const secrets = { KEY: 'value' };
-		const { encrypted, iv } = encryptSecrets(secrets);
-
-		const wrongKey = '0'.repeat(64);
-
-		expect(() => decryptCredentials(encrypted, iv, wrongKey)).toThrow();
-	});
-
-	it('should throw with wrong IV', () => {
-		const secrets = { KEY: 'value' };
-		const { encrypted, masterKey } = encryptSecrets(secrets);
-
-		const wrongIv = '0'.repeat(24);
-
-		expect(() => decryptCredentials(encrypted, wrongIv, masterKey)).toThrow();
-	});
-
-	it('should throw with tampered ciphertext', () => {
-		const secrets = { KEY: 'value' };
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-
-		const tamperedBuffer = Buffer.from(encrypted, 'base64');
-		tamperedBuffer[0] = tamperedBuffer[0] ^ 0xff;
-		const tampered = tamperedBuffer.toString('base64');
-
-		expect(() => decryptCredentials(tampered, iv, masterKey)).toThrow();
-	});
-
-	it('should handle large number of secrets', () => {
-		const secrets: Record<string, string> = {};
-		for (let i = 0; i < 50; i++) {
-			secrets[`KEY_${i}`] = `value-${i}-${'x'.repeat(50)}`;
-		}
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual(secrets);
-	});
-
-	it('should handle secrets with newlines', () => {
-		const secrets = {
-			PRIVATE_KEY:
-				'-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----',
-			MULTILINE: 'line1\nline2\nline3',
-		};
-
-		const { encrypted, iv, masterKey } = encryptSecrets(secrets);
-		const decrypted = decryptCredentials(encrypted, iv, masterKey);
-
-		expect(decrypted).toEqual(secrets);
-	});
-});
-
-describe('Credentials export', () => {
-	it('should return empty object in development mode (no globals defined)', async () => {
-		// In test environment, __GKM_ENCRYPTED_CREDENTIALS__ is undefined
-		// so Credentials should be an empty object
-		const { Credentials } = await import('../credentials');
-		expect(Credentials).toEqual({});
-	});
-});

package/src/__tests__/formatter.spec.ts

@@ -1,268 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { z } from 'zod/v4';
-import { formatParseError, isDevelopment } from '../formatter';
-
-// Helper to create test issues - casts through unknown because we're creating test fixtures
-// that may include properties like 'received' which vary by issue type
-function createIssue(issue: Record<string, unknown>): z.core.$ZodIssue {
-	return issue as unknown as z.core.$ZodIssue;
-}
-
-describe('formatParseError', () => {
-	it('should format missing variables', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['DATABASE_URL'],
-				message: 'Environment variable "DATABASE_URL": Required',
-			}),
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['JWT_SECRET'],
-				message: 'Environment variable "JWT_SECRET": Required',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		expect(formatted).toContain('Environment Configuration Failed');
-		expect(formatted).toContain('Missing Variables:');
-		expect(formatted).toContain('DATABASE_URL');
-		expect(formatted).toContain('JWT_SECRET');
-		expect(formatted).toContain('Required');
-	});
-
-	it('should format invalid values', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_value',
-				values: ['development', 'staging', 'production'],
-				received: 'invalid',
-				path: ['NODE_ENV'],
-				message:
-					"Invalid enum value. Expected 'development' | 'staging' | 'production', received 'invalid'",
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		expect(formatted).toContain('Environment Configuration Failed');
-		expect(formatted).toContain('Invalid Values:');
-		expect(formatted).toContain('NODE_ENV');
-		expect(formatted).toContain('invalid');
-	});
-
-	it('should handle mixed missing and invalid values', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['DATABASE_URL'],
-				message: 'Environment variable "DATABASE_URL": Required',
-			}),
-			createIssue({
-				code: 'invalid_type',
-				expected: 'number',
-				received: 'string',
-				path: ['PORT'],
-				message: 'Expected number, received string',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		expect(formatted).toContain('Missing Variables:');
-		expect(formatted).toContain('DATABASE_URL');
-		expect(formatted).toContain('Invalid Values:');
-		expect(formatted).toContain('PORT');
-	});
-
-	it('should clean message prefixes', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'number',
-				received: 'string',
-				path: ['PORT'],
-				message:
-					'Environment variable "PORT": Expected number, received string',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		// Should not duplicate "Environment variable" in output
-		expect(formatted).not.toContain(
-			'Environment variable "PORT": Environment variable',
-		);
-		expect(formatted).toContain('Expected number, received string');
-	});
-
-	it('should join nested paths with dot', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['databaseUrl', 'DATABASE_URL'],
-				message: 'Environment variable "DATABASE_URL": Required',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		// Should show the full path joined with '.'
-		expect(formatted).toContain('databaseUrl.DATABASE_URL');
-	});
-
-	it('should extract env name from message when path is empty', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: [],
-				message: 'Environment variable "API_KEY": Required',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		expect(formatted).toContain('API_KEY');
-	});
-
-	it('should handle colors option false', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['TEST'],
-				message: 'Required',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: false });
-
-		// Should not contain ANSI codes
-		expect(formatted).not.toContain('\x1b[');
-	});
-
-	it('should handle colors option true', () => {
-		const error = new z.ZodError([
-			createIssue({
-				code: 'invalid_type',
-				expected: 'string',
-				received: 'undefined',
-				path: ['TEST'],
-				message: 'Required',
-			}),
-		]);
-
-		const formatted = formatParseError(error, { colors: true });
-
-		// Should contain ANSI codes
-		expect(formatted).toContain('\x1b[');
-	});
-});
-
-describe('isDevelopment', () => {
-	const originalEnv = process.env.NODE_ENV;
-
-	afterEach(() => {
-		if (originalEnv === undefined) {
-			delete process.env.NODE_ENV;
-		} else {
-			process.env.NODE_ENV = originalEnv;
-		}
-	});
-
-	it('should return true when NODE_ENV is undefined', () => {
-		delete process.env.NODE_ENV;
-		expect(isDevelopment()).toBe(true);
-	});
-
-	it('should return true when NODE_ENV is development', () => {
-		process.env.NODE_ENV = 'development';
-		expect(isDevelopment()).toBe(true);
-	});
-
-	it('should return true when NODE_ENV is dev', () => {
-		process.env.NODE_ENV = 'dev';
-		expect(isDevelopment()).toBe(true);
-	});
-
-	it('should return true when NODE_ENV is DEVELOPMENT (case insensitive)', () => {
-		process.env.NODE_ENV = 'DEVELOPMENT';
-		expect(isDevelopment()).toBe(true);
-	});
-
-	it('should return false when NODE_ENV is production', () => {
-		process.env.NODE_ENV = 'production';
-		expect(isDevelopment()).toBe(false);
-	});
-
-	it('should return false when NODE_ENV is staging', () => {
-		process.env.NODE_ENV = 'staging';
-		expect(isDevelopment()).toBe(false);
-	});
-
-	it('should return false when NODE_ENV is test', () => {
-		process.env.NODE_ENV = 'test';
-		expect(isDevelopment()).toBe(false);
-	});
-});
-
-describe('ConfigParser with dev formatting', () => {
-	const originalEnv = process.env.NODE_ENV;
-
-	beforeEach(() => {
-		vi.spyOn(console, 'error').mockImplementation(() => {});
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		if (originalEnv === undefined) {
-			delete process.env.NODE_ENV;
-		} else {
-			process.env.NODE_ENV = originalEnv;
-		}
-	});
-
-	it('should log formatted error in development mode', async () => {
-		process.env.NODE_ENV = 'development';
-
-		const { EnvironmentParser } = await import('../EnvironmentParser');
-		const parser = new EnvironmentParser({});
-		const config = parser.create((get) => ({
-			dbUrl: get('DATABASE_URL').string(),
-		}));
-
-		expect(() => config.parse()).toThrow();
-		expect(console.error).toHaveBeenCalled();
-
-		const errorOutput = (console.error as any).mock.calls[0][0];
-		expect(errorOutput).toContain('Environment Configuration Failed');
-	});
-
-	it('should not log formatted error in production mode', async () => {
-		process.env.NODE_ENV = 'production';
-
-		// Need to reimport to pick up the new NODE_ENV
-		vi.resetModules();
-		const { EnvironmentParser } = await import('../EnvironmentParser');
-
-		const parser = new EnvironmentParser({});
-		const config = parser.create((get) => ({
-			dbUrl: get('DATABASE_URL').string(),
-		}));
-
-		expect(() => config.parse()).toThrow();
-		expect(console.error).not.toHaveBeenCalled();
-	});
-});