@jondotsoy/envs 0.1.9-alpha.0 → 0.1.9-alpha.1

package/envs.js

@@ -17,11 +17,17 @@ function dotenvProblem(key, text) {
   if (!/^[\w.-]+$/.test(key)) {
     return "the name is not a valid variable name (only letters, digits, `_`, `.` and `-`)";
   }
+  if (text.includes("'") && text.includes('"') && text.includes("`")) {
+    return "the value has single, double and backtick quotes at once, so no .env quoting can hold it as is";
+  }
   if (/[\r\n]/.test(text)) {
     return "the value has a line break, which a .env file cannot hold safely (write it on one line, with `\\n` escapes if the application expects them)";
   }
   return;
 }
+function hasSecretPattern(text) {
+  return SECRET_PATTERNS.some(([pattern]) => pattern.test(text));
+}
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
@@ -130,13 +136,10 @@ var init_lint_rules = __esm(() => {
     },
     {
       id: "open-permissions",
-      description: "values.yml or the history is readable by other users.",
-      check: (ctx) => [
-        { file: valuesFile, mode: ctx.valuesMode },
-        ...ctx.hasHistory ? [{ file: historyFile, mode: ctx.historyMode }] : []
-      ].filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ file, mode }) => ({
-        location: file,
-        message: `${file.slice(".envs/".length)} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${file}\`.`
+      description: "values.yml, the history or a worktree's .env is readable by other users.",
+      check: (ctx) => envFiles(ctx).filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ location, mode }) => ({
+        location,
+        message: `${location.replace(/^\.envs\//, "")} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${location}\`.`
       }))
     },
     {
@@ -890,9 +893,13 @@ function parseValue(value) {
   return value;
 }
 function formatDotenvValue(value) {
-  if (value !== "" && !/[\s#"'\\$]/.test(value))
+  if (value !== "" && !/[\s#"'`\\$]/.test(value))
     return value;
-  return value.includes('"') ? `'${value}'` : `"${value}"`;
+  if (!value.includes('"') && !/\\[nr]/.test(value))
+    return `"${value}"`;
+  if (!value.includes("'"))
+    return `'${value}'`;
+  return `\`${value}\``;
 }
 function updateDotenv(text, entries, remove = new Set) {
   const pending = new Map(Object.entries(entries));
@@ -1142,7 +1149,9 @@ async function pushLocked(ctx, only) {
     }
     for (const key of orphans)
       removals.set(key, [...removals.get(key) ?? [], label]);
-    await writeFile(join2(path, ".env"), updateDotenv(current, entries, orphans), { mode: 384 });
+    const dotenvPath = join2(path, ".env");
+    await writeFile(dotenvPath, updateDotenv(current, entries, orphans), { mode: 384 });
+    await chmod(dotenvPath, 384).catch(() => {});
   }
   for (const [line, names] of changes) {
     ctx.log(yellow(`\u21BB ${line} \u2192 ${names.join(", ")}`));
@@ -1544,7 +1553,7 @@ Commands:
   history Manage the history (history redact: remove secrets in clear from an existing history)
   config  Read or change .envs/config.yml (config set <key> <value>, config get [key], config delete <key>)
   help    Show this help message
-`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value), displayValue = (name, value) => isMaskedKey(name) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value) || hasSecretPattern(value), displayValue = (name, value) => isMaskedKey(name) || hasSecretPattern(value) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
   cwd: process.cwd(),
   log: (message) => console.log(message),
   error: (message) => console.error(message),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jondotsoy/envs",
-  "version": "0.1.9-alpha.0",
+  "version": "0.1.9-alpha.1",
   "license": "MIT",
   "author": {
     "name": "Jonathan Delgado",