@marvalt/digivalt-core 0.2.17 → 0.2.22

package/template/scripts/deploy-secrets.js

@@ -3,31 +3,45 @@ import path from 'path';
 import { execSync } from 'child_process';
 
 /**
- * 🚀 DigiVAlt Cloudflare Secrets Deployer
- * 
- * Automates the synchronization of local .env.local variables 
- * securely straight into your Cloudflare Pages environment 
- * using Wrangler bulk secret injection.
+ * DigiValt Cloudflare Pages secrets deployer
+ *
+ * Reads .env and .env.local, uploads allowed keys via wrangler pages secret bulk.
+ * Run: node scripts/deploy-secrets.js
+ * Dry run: node scripts/deploy-secrets.js --dry-run
  */
 
+const dryRun = process.argv.includes('--dry-run');
+
 const secrets = {};
-/** Keys we never push from .env / .env.local (local dev or set manually on Cloudflare Pages). */
+
+/** Local-only or non-Pages keys — never bulk-uploaded. */
 const excludedKeys = new Set([
   'NODE_ENV',
+  'NPM_TOKEN',
   'VITE_IS_LOVABLE',
   'VITE_LOCAL_DEVELOPMENT',
   'VITE_AUTH_MODE',
   'VITE_DEFAULT_MAX_ITEMS',
 ]);
 
-// VITE_SEO_* are often public (verification meta, titles); allow upload when teams store them as Pages secrets.
-// TURNSTILE_SECRET_KEY is server-only (Pages Functions), not a VITE_ prefix.
+/**
+ * Allow DigiValt build/runtime variables (see digivalt-core bin/env-example-fragments.cjs).
+ * All VITE_* except excludedKeys; plus Node/generator alias names without VITE_ prefix.
+ */
 const allowedPatterns = [
   /^CLOUDFLARE_/,
   /^CF_ACCESS_/,
   /^TURNSTILE_/,
-  /^VITE_SEO_/,
-  /^VITE_(WORDPRESS|WP|GF|GRAVITY_FORMS|FRONTEND|FRONTENDS|MAUTIC|SUITECRM|SUPABASE|CLOUDFLARE|AUTH|TURNSTILE|CHATWOOT|THEME|GOOGLE_|FACEBOOK_|LINKEDIN_)/,
+  /^ALLOWED_ORIGINS$/,
+  /^SITE_URL$/,
+  /^WORDPRESS_/,
+  /^WP_/,
+  /^GF_/,
+  /^GRAVITY_FORMS_/,
+  /^MAUTIC_/,
+  /^SUITECRM_/,
+  /^GOOGLE_REVIEWS_/,
+  /^VITE_/,
 ];
 
 const isAllowedSecretKey = (key) => allowedPatterns.some((pattern) => pattern.test(key));
@@ -35,7 +49,7 @@ const isAllowedSecretKey = (key) => allowedPatterns.some((pattern) => pattern.te
 const parseEnvFile = (filePath) => {
   if (!fs.existsSync(filePath)) return;
 
-  console.log(`🔍 Parsing ${path.basename(filePath)} secrets...`);
+  console.log(`🔍 Parsing ${path.basename(filePath)}...`);
   const rawEnv = fs.readFileSync(filePath, 'utf8');
 
   rawEnv.split('\n').forEach((line) => {
@@ -49,12 +63,12 @@ const parseEnvFile = (filePath) => {
     let value = match[2].trim();
 
     if (excludedKeys.has(key)) {
-      console.log(`⚠️ Skipping ${key} (DigiVAlt: excluded from Cloudflare bulk upload)`);
+      console.log(`⚠️ Skipping ${key} (excluded from Cloudflare bulk upload)`);
       return;
     }
 
     if (!isAllowedSecretKey(key)) {
-      console.log(`⚠️ Skipping ${key} (not in DigiVAlt allowlist)`);
+      console.log(`⚠️ Skipping ${key} (not in DigiValt allowlist)`);
       return;
     }
 
@@ -78,57 +92,57 @@ parseEnvFile(localEnvPath);
 
 const secretCount = Object.keys(secrets).length;
 if (secretCount === 0) {
-  console.error('❌ No allowed DigiVAlt environment variables were found in .env or .env.local.');
+  console.error('❌ No allowed environment variables were found in .env or .env.local.');
   process.exit(1);
 }
 
+console.log(`📋 ${secretCount} key(s) ready: ${Object.keys(secrets).sort().join(', ')}`);
+
+if (dryRun) {
+  console.log('✅ Dry run complete (nothing uploaded).');
+  process.exit(0);
+}
+
 const tmpJsonPath = path.resolve(process.cwd(), '.tmp-cloudflare-secrets.json');
 fs.writeFileSync(tmpJsonPath, JSON.stringify(secrets, null, 2));
 
 try {
   console.log(`🚀 Uploading ${secretCount} secrets to Cloudflare Pages...`);
-  
-  // Extract Cloudflare Account ID directly from the parsed environment variables!
+
   const accountId = secrets['CLOUDFLARE_ACCOUNT_ID'] || secrets['VITE_CLOUDFLARE_ACCOUNT_ID'] || '';
-  
-  // Try to read the Cloudflare project name from wrangler.toml
+
   const tomlPath = path.resolve(process.cwd(), 'wrangler.toml');
   let projectName = '';
-  
+
   if (fs.existsSync(tomlPath)) {
     const tomlContent = fs.readFileSync(tomlPath, 'utf8');
-    
-    // Parse Project Name
     const nameMatch = tomlContent.match(/^name\s*=\s*["']([^"']+)["']/m);
     if (nameMatch) projectName = nameMatch[1];
-    
-    if (projectName) console.log(`📦 Targeted Cloudflare Project: ${projectName}`);
-    if (accountId) console.log(`🏢 Targeted Cloudflare Account: ${accountId}`);
+
+    if (projectName) console.log(`📦 Target Cloudflare project: ${projectName}`);
+    if (accountId) console.log(`🏢 Target Cloudflare account: ${accountId}`);
   }
-  
+
   if (!projectName) {
     throw new Error('Could not determine the Cloudflare Pages project name from wrangler.toml.');
   }
 
   let cmd = `npx wrangler pages secret bulk .tmp-cloudflare-secrets.json`;
   cmd += ` --project-name ${projectName}`;
-    
-  // Execute Wrangler natively with the Account ID passed through the strict environment scope
+
   const env = { ...process.env };
   if (accountId) {
     env.CLOUDFLARE_ACCOUNT_ID = accountId;
   }
-  
+
   execSync(cmd, { stdio: 'inherit', env });
   console.log('✅ All secrets deployed successfully to Cloudflare!');
-  
 } catch (error) {
   console.error('❌ Failed to push secrets to Cloudflare.');
   console.error('Ensure you are logged into Wrangler (`npx wrangler login`) and the project exists.');
   console.error(error instanceof Error ? error.message : error);
   process.exitCode = 1;
 } finally {
-  // Always rigorously clean up the temporary plaintext JSON file for security
   if (fs.existsSync(tmpJsonPath)) {
     fs.unlinkSync(tmpJsonPath);
     console.log('🧹 Cleaned up temporary credentials payload.');