@lsmacedo/envres 0.0.1

package/README.md

@@ -0,0 +1,38 @@
+# envres
+
+Resolve environment variable references from the macOS keychain and run a command with the real secrets injected.
+
+Set a variable's value to an `envres/<service>` reference instead of a plaintext secret. `envres` rewrites it to the keychain secret (`security find-generic-password -s <service> -w`) just before running your command. Variables without the prefix pass through untouched.
+
+## Installation
+
+```sh
+npm i -g envres
+```
+
+## Usage
+
+```sh
+envres run [--env-file <path>] -- <command> [args...]
+```
+
+Reference secrets in your shell profile, then alias the command that needs them:
+
+```sh
+export ARTIFACTORY_TOKEN="envres/artifactory-token"
+alias npm='envres run -- npm'
+```
+
+Now `npm install` runs with `ARTIFACTORY_TOKEN` resolved from the keychain.
+
+Load references from a `.env` file too (the file is never modified; its values override the environment):
+
+```sh
+envres run --env-file .env -- npm install
+```
+
+```sh
+# .env
+ARTIFACTORY_TOKEN=envres/artifactory-token
+NPM_TOKEN=envres/npm-token
+```

package/envres

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+#
+# envres — resolve environment variable references from a secret backend
+# (currently the macOS keychain) and run a command with them injected.
+#
+# Set an env var's value to a reference, e.g. in your shell profile:
+#
+#   export ARTIFACTORY_TOKEN="envres/artifactory-token"
+#
+# Then wrap the command that needs the real secret:
+#
+#   alias npm='envres run -- npm'
+#
+# When you run `npm install`, envres rewrites ARTIFACTORY_TOKEN to the output
+# of `security find-generic-password -s artifactory-token -w` before exec'ing
+# the wrapped command. Vars without the prefix pass through untouched.
+#
+# --env-file <path> additionally loads KEY=value lines from a .env file into the
+# command's environment, resolving any `envres/`-prefixed values the same way.
+# The file is read-only; its values override the existing environment.
+
+set -euo pipefail
+
+PREFIX="envres/"
+
+usage() {
+  cat <<'EOF'
+usage: envres run [--env-file <path>] -- <command> [args...]
+
+  Resolves environment variables whose value is "envres/<service>" by
+  replacing them with `security find-generic-password -s <service> -w`,
+  then executes <command>.
+
+  --env-file <path>  Also load KEY=value lines from <path> into the command's
+                     environment (resolving envres/ values). Values from the
+                     file override the existing environment. The file is never
+                     modified.
+
+example:
+  alias npm='envres run -- npm'
+  envres run --env-file .env -- npm install
+EOF
+}
+
+resolve_secret() {
+  local service="$1"
+  if ! security find-generic-password -s "$service" -w 2>/dev/null; then
+    echo "envres: no keychain entry for service '$service'" >&2
+    return 1
+  fi
+}
+
+# Load KEY=value lines from a .env file, exporting each into the environment.
+# Values are exported verbatim (including any envres/ prefix); resolve_env
+# performs keychain substitution afterward over the merged environment.
+load_env_file() {
+  local file="$1" line key value
+  if [[ ! -r "$file" ]]; then
+    echo "envres: cannot read env file '$file'" >&2
+    return 1
+  fi
+
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line#"${line%%[![:space:]]*}"}" # trim leading whitespace
+    [[ -z "$line" || "$line" == "#"* ]] && continue
+    [[ "$line" == "export "* ]] && line="${line#export }"
+    [[ "$line" == *=* ]] || continue
+
+    key="${line%%=*}"
+    value="${line#*=}"
+
+    if [[ ! "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+      echo "envres: skipping invalid key '$key' in '$file'" >&2
+      continue
+    fi
+
+    if [[ "$value" == \"*\" || "$value" == \'*\' ]]; then
+      value="${value:1:${#value}-2}" # strip one pair of surrounding quotes
+    else
+      value="${value%"${value##*[![:space:]]}"}" # trim trailing whitespace
+    fi
+
+    export "$key=$value"
+  done <"$file"
+}
+
+resolve_env() {
+  local name value service secret
+  while IFS= read -r name; do
+    value="${!name-}"
+    [[ "$value" == "$PREFIX"* ]] || continue
+
+    service="${value#"$PREFIX"}"
+    if [[ -z "$service" ]]; then
+      echo "envres: $name has empty service reference ('$value')" >&2
+      return 1
+    fi
+
+    if ! secret="$(resolve_secret "$service")"; then
+      echo "envres: failed to resolve $name from keychain" >&2
+      return 1
+    fi
+
+    export "$name=$secret"
+  done < <(compgen -e)
+}
+
+main() {
+  if [[ $# -eq 0 ]]; then
+    usage >&2
+    exit 2
+  fi
+
+  case "$1" in
+  -h | --help)
+    usage
+    exit 0
+    ;;
+  run)
+    shift
+    ;;
+  *)
+    echo "envres: unknown subcommand '$1'" >&2
+    usage >&2
+    exit 2
+    ;;
+  esac
+
+  local env_file=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+    --env-file)
+      env_file="${2-}"
+      if [[ -z "$env_file" ]]; then
+        echo "envres: --env-file requires a path" >&2
+        exit 2
+      fi
+      shift 2
+      ;;
+    --env-file=*)
+      env_file="${1#--env-file=}"
+      shift
+      ;;
+    --)
+      shift
+      break
+      ;;
+    -*)
+      echo "envres: unknown option '$1'" >&2
+      usage >&2
+      exit 2
+      ;;
+    *)
+      break
+      ;;
+    esac
+  done
+
+  if [[ $# -eq 0 ]]; then
+    echo "envres: no command given" >&2
+    usage >&2
+    exit 2
+  fi
+
+  if [[ -n "$env_file" ]]; then
+    load_env_file "$env_file" || exit 2
+  fi
+
+  resolve_env
+  exec "$@"
+}
+
+main "$@"

package/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@lsmacedo/envres",
+  "bin": "./envres",
+  "version": "0.0.1",
+  "description": "Resolve environment variable references from the macOS keychain and run a command with them injected.",
+  "license": "ISC",
+  "author": "lsmacedo"
+}