@mp-lb/arcnet 0.1.0 → 0.2.1

package/src/secrets/secretCommand.ts

@@ -0,0 +1,26 @@
+import { spawnSync } from "node:child_process";
+
+// Never include subprocess output in errors: it may contain plaintext or keys.
+export const secretCommand = (
+  command: string,
+  args: string[],
+  root: string,
+  input?: string,
+  env = process.env,
+): string => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    env,
+    input,
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    maxBuffer: 16 * 1024 * 1024,
+    timeout: 120000,
+  });
+
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `${command} ${args[0] ?? ""} failed; output withheld to protect credentials. Check authentication and permissions.`,
+    );
+  return result.stdout;
+};

package/src/secrets/selectSecrets.ts

@@ -0,0 +1,33 @@
+import type { SecretsConfig } from "./config.js";
+
+export const selectSecrets = (
+  values: Record<string, unknown>,
+  config: SecretsConfig,
+  consumer: string,
+): Record<string, string> => {
+  const mapping = config.consumers[consumer];
+  if (!mapping) throw new Error(`Unknown secrets consumer: ${consumer}.`);
+  return Object.fromEntries(
+    Object.entries(mapping).map(([output, input]) => {
+      const aliases = Array.isArray(input) ? input : [input];
+
+      const found = aliases
+        .filter((name) => Object.hasOwn(values, name))
+        .map((name) => values[name]);
+
+      if (
+        !found.length ||
+        found.some(
+          (value) =>
+            typeof value !== "string" || !value.trim() || value.includes("\0"),
+        )
+      )
+        throw new Error(
+          `Missing or invalid required secret for ${output} (values omitted).`,
+        );
+      if (new Set(found).size !== 1)
+        throw new Error(`Conflicting aliases for ${output} (values omitted).`);
+      return [output, found[0] as string];
+    }),
+  );
+};

package/src/secrets/syncSecrets.ts

@@ -0,0 +1,60 @@
+import { parseForumEncryptedFilePayload } from "@mp-lb/forum-secrets";
+import { createHash } from "node:crypto";
+import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { safeTargetPath } from "../safeTargetPath.js";
+import type { SecretsConfig } from "./config.js";
+import { readRemoteSource } from "./readRemoteSource.js";
+
+export const syncSecrets = (
+  config: SecretsConfig,
+  root: string,
+  file: string,
+) => {
+  const sources = config.sources.map((source) => {
+    const remote = readRemoteSource(source, root);
+
+    try {
+      parseForumEncryptedFilePayload(remote.text);
+    } catch {
+      throw new Error(
+        `Source ${source.name} is not a supported encrypted file.`,
+      );
+    }
+
+    const sha256 = createHash("sha256").update(remote.text).digest("hex");
+
+    // Content-addressed snapshots keep the previous config valid if interrupted.
+    const snapshot = {
+      file: `.arcnet/secrets/${source.name}-${sha256.slice(0, 16)}.json.enc`,
+      fileId: remote.fileId,
+      revision: remote.revision,
+      sha256,
+    };
+
+    const target = safeTargetPath(root, snapshot.file);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, remote.text, { mode: 0o600 });
+    return { ...source, snapshot };
+  });
+
+  const target = safeTargetPath(root, file);
+  mkdirSync(dirname(target), { recursive: true });
+  const temporary = safeTargetPath(root, `${file}.tmp`);
+  writeFileSync(
+    temporary,
+    JSON.stringify({ ...config, sources }, null, 2) + "\n",
+    { mode: 0o600 },
+  );
+
+  renameSync(temporary, target);
+  return {
+    operation: "secrets.sync",
+    sources: sources.map((s) => ({
+      name: s.name,
+      revision: s.snapshot.revision,
+    })),
+    message:
+      "Review and commit the encrypted snapshots and configuration together.",
+  };
+};

package/src/secrets/wireSecretsWorkflows.ts

@@ -0,0 +1,57 @@
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { isMap, isSeq, parseDocument } from "yaml";
+
+export const wireSecretsWorkflows = (
+  folder: string,
+  env: Record<string, string>,
+) => {
+  for (const file of readdirSync(folder).filter((name) =>
+    /\.ya?ml$/.test(name),
+  )) {
+    const path = join(folder, file);
+    const document = parseDocument(readFileSync(path, "utf8"));
+    if (document.errors.length)
+      throw new Error(`Cannot update malformed workflow: ${file}.`);
+    const jobs = document.get("jobs");
+    if (!isMap(jobs)) continue;
+    let changed = false;
+
+    for (const pair of jobs.items) {
+      if (!isMap(pair.value)) continue;
+      const steps = pair.value.get("steps");
+      if (!isSeq(steps)) continue;
+
+      for (const step of steps.items) {
+        if (!isMap(step)) continue;
+        const run = step.get("run");
+        if (
+          typeof run !== "string" ||
+          !/\barcnet\s+(?:env\s+(?:check|run|export)|deploy|preview|inspect|plan)\b/.test(
+            run,
+          )
+        )
+          continue;
+        if (step.has("env") && !isMap(step.get("env")))
+          throw new Error(`Workflow step env must be a mapping: ${file}.`);
+        if (!step.has("env")) step.set("env", document.createNode({}));
+        const mapping = step.get("env");
+        if (!isMap(mapping)) continue;
+
+        for (const [name, value] of Object.entries(env)) {
+          if (mapping.has(name) && mapping.get(name) !== value)
+            throw new Error(
+              `Workflow has a conflicting source-key mapping: ${file} / ${name}.`,
+            );
+
+          if (!mapping.has(name)) {
+            mapping.set(name, value);
+            changed = true;
+          }
+        }
+      }
+    }
+
+    if (changed) writeFileSync(path, document.toString());
+  }
+};

package/src/secrets/withDeploymentSecrets.ts

@@ -0,0 +1,83 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { readSecretsConfig } from "./config.js";
+import { loadSecrets } from "./loadSecrets.js";
+import { selectSecrets } from "./selectSecrets.js";
+import { promptPassword } from "./promptPassword.js";
+
+export const withDeploymentSecrets = async <T>(
+  root: string,
+  mode: string | undefined,
+  action: () => T | Promise<T>,
+  usePassword = false,
+  noninteractive = false,
+): Promise<T> => {
+  if (!existsSync(join(root, ".arcnet/secrets.json"))) return action();
+  const config = readSecretsConfig(root);
+  if (
+    process.env.GITHUB_ACTIONS === "true" &&
+    (process.env.GITHUB_REPOSITORY !== config.repository ||
+      process.env.GITHUB_REF !== "refs/heads/main")
+  )
+    throw new Error(
+      "Secrets commands in CI require the configured repository main branch.",
+    );
+  if (usePassword && process.env.GITHUB_ACTIONS === "true")
+    throw new Error("Password decryption is local-only; CI must use file keys.");
+  const password = usePassword ? await promptPassword(noninteractive) : undefined;
+  const pool = await loadSecrets(config, root, process.env, false, password);
+  const selected = selectSecrets(pool, config, "deploy");
+
+  if (mode !== "vercel") {
+    const manifest = parse(readFileSync(join(root, "zap.yaml"), "utf8")) as {
+      deploy?: { services?: Record<string, { env?: string[] }> };
+    };
+
+    const keys = Object.values(manifest.deploy?.services ?? {})
+      .flatMap((service) => service.env ?? [])
+      .filter((key) => !key.includes("="));
+
+    const app = Object.fromEntries(
+      keys
+        .filter((key) => Object.hasOwn(pool, key))
+        .map((key) => {
+          if (typeof pool[key] !== "string")
+            throw new Error(
+              `Invalid application value for ${key} (value omitted).`,
+            );
+          return [key, pool[key]];
+        }),
+    );
+
+    selected.ARCNET_ENV_JSON = JSON.stringify(app);
+  }
+
+  const removed = config.sources
+    .flatMap((source) => [
+      source.keyEnv,
+      ...(source.tokenEnv ? [source.tokenEnv] : []),
+    ])
+    .concat([
+      "DOCTRINE_ENCRYPTION_PASSWORD",
+      "DOCTRINE_TOKEN",
+      "DOCTRINE_RECIPIENT_SECRET",
+    ]);
+
+  const names = new Set([...removed, ...Object.keys(selected)]);
+
+  const previous = Object.fromEntries(
+    [...names].map((key) => [key, process.env[key]]),
+  );
+
+  try {
+    for (const key of removed) delete process.env[key];
+    Object.assign(process.env, selected);
+    return await action();
+  } finally {
+    for (const key of names) {
+      if (previous[key] === undefined) delete process.env[key];
+      else process.env[key] = previous[key];
+    }
+  }
+};

package/src/secrets/writeSecretsWorkflow.ts

@@ -0,0 +1,83 @@
+import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { stringify } from "yaml";
+import { safeTargetPath } from "../safeTargetPath.js";
+import type { SecretsConfig } from "./config.js";
+import { wireSecretsWorkflows } from "./wireSecretsWorkflows.js";
+
+export const writeSecretsWorkflow = (
+  config: SecretsConfig,
+  root: string,
+  configFile: string,
+) => {
+  const path = safeTargetPath(
+    root,
+    ".github/workflows/validate-arcnet-secrets.yaml",
+  );
+
+  const marker =
+    "# Generated by arcnet secrets; configure sources in .arcnet/secrets.json.\n";
+
+  if (existsSync(path) && !readFileSync(path, "utf8").startsWith(marker))
+    throw new Error(
+      "Existing validate-arcnet-secrets.yaml is not ArcNet-managed; move it before continuing.",
+    );
+  if (configFile !== ".arcnet/secrets.json")
+    throw new Error(
+      "Generated CI requires the standard .arcnet/secrets.json location.",
+    );
+  mkdirSync(dirname(path), { recursive: true });
+
+  const env = Object.fromEntries(
+    config.sources
+      .flatMap((source) => [
+        source.keyEnv,
+        ...(!source.snapshot && source.tokenEnv ? [source.tokenEnv] : []),
+      ])
+      .map((key) => [key, `\u0024{{ secrets.${key} }}`]),
+  );
+
+  writeFileSync(
+    path,
+    marker +
+      stringify({
+        name: "Validate ArcNet secrets",
+        on: {
+          workflow_dispatch: {},
+          push: {
+            branches: ["main"],
+            paths: [
+              ".arcnet/**",
+              ".github/workflows/validate-arcnet-secrets.yaml",
+              "package.json",
+              "pnpm-lock.yaml",
+            ],
+          },
+        },
+        permissions: { contents: "read" },
+        jobs: {
+          validate: {
+            if: `github.repository == '${config.repository}' && github.ref == 'refs/heads/main'`,
+            "runs-on": "ubuntu-latest",
+            "timeout-minutes": 10,
+            steps: [
+              {
+                uses: "actions/checkout@v4",
+                with: { "persist-credentials": false },
+              },
+              { uses: "pnpm/action-setup@v4" },
+              { uses: "actions/setup-node@v4", with: { "node-version": 22 } },
+              { run: "pnpm install --frozen-lockfile --ignore-scripts" },
+              {
+                name: "Decrypt, merge and validate selected keys",
+                run: "pnpm exec arcnet env check",
+                env,
+              },
+            ],
+          },
+        },
+      }),
+  );
+
+  wireSecretsWorkflows(dirname(path), env);
+};