@purpleschool/infisical-env 0.1.0 → 0.1.2

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@purpleschool/infisical-env",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "bin": {
-    "purple-env": "./src/cli.js"
+    "infisical-env": "src/cli.js"
   },
+  "files": [
+    "src/cli.js"
+  ],
   "scripts": {
     "start": "node ./src/cli.js"
   },

package/src/cli.js

@@ -16,348 +16,348 @@ const DEFAULT_INFISICAL_BASE_URL = "https://secret.purplecode.ru";
 const DEFAULT_INFISICAL_CLIENT_ID = "f3e0d60c-a602-4296-bd03-3be228e89165";
 
 async function main() {
-  try {
-    const args = process.argv.slice(2);
-    if (args.includes("--help") || args.includes("-h")) {
-      printHelp();
-      return;
-    }
-
-    const repoRoot = findRepoRoot(process.cwd());
-    const packageJson = readJson(path.join(repoRoot, "package.json"));
-
-    const projectId = resolveInfisicalProject(packageJson);
-    const envName = await resolveEnvName(args);
+    try {
+        const args = process.argv.slice(2);
+        if (args.includes("--help") || args.includes("-h")) {
+            printHelp();
+            return;
+        }
 
-    const deploymentPath = resolveDeploymentPath(repoRoot);
-    const envRefs = collectEnvRefs(deploymentPath);
+        const repoRoot = findRepoRoot(process.cwd());
+        const packageJson = readJson(path.join(repoRoot, "package.json"));
 
-    if (envRefs.length === 0) {
-      throw new Error(`No env refs found in ${deploymentPath}`);
-    }
+        const projectId = resolveInfisicalProject(packageJson);
+        const envName = await resolveEnvName(args);
 
-    const values = await resolveEnvValues({
-      projectId,
-      envName,
-      envRefs,
-      repoRoot,
-    });
+        const deploymentPath = resolveDeploymentPath(repoRoot);
+        const envRefs = collectEnvRefs(deploymentPath);
 
-    const envFilePath = path.join(repoRoot, ".env");
-    const lines = values.map((item) => `${item.name}=${item.value}`);
-    fs.writeFileSync(envFilePath, lines.join(os.EOL), "utf8");
+        if (envRefs.length === 0) {
+            throw new Error(`No env refs found in ${deploymentPath}`);
+        }
 
-    console.log(pc.green(`.env written to ${envFilePath}`));
-  } catch (err) {
-    console.error(pc.red(formatError(err)));
-    console.error(pc.yellow("Run with --help for usage."));
-    process.exit(1);
-  }
+        const values = await resolveEnvValues({
+            projectId,
+            envName,
+            envRefs,
+            repoRoot,
+        });
+
+        const envFilePath = path.join(repoRoot, ".env");
+        const lines = values.map((item) => `${item.name}=${item.value}`);
+        fs.writeFileSync(envFilePath, lines.join(os.EOL), "utf8");
+
+        console.log(pc.green(`.env written to ${envFilePath}`));
+    } catch (err) {
+        console.error(pc.red(formatError(err)));
+        console.error(pc.yellow("Run with --help for usage."));
+        process.exit(1);
+    }
 }
 
 function printHelp() {
-  console.log(
-    [
-      pc.bold("Usage:"),
-      "  purple-env [--env stage|stage-2]",
-      "",
-      pc.bold("Options:"),
-      "  --env <name>   Environment name (stage or stage-2)",
-      "  -h, --help     Show this help",
-      "",
-      pc.bold("Environment variables:"),
-      "  INFISICAL_CLIENT_SECRET   Required (machine identity secret)",
-      "  INFISICAL_CLIENT_ID       Optional override",
-      "  INFISICAL_BASE_URL        Optional override (default https://secret.purplecode.ru)",
-      "  INFISICAL_MOCK_PATH       Optional mock json path for offline testing",
-    ].join(os.EOL)
-  );
+    console.log(
+        [
+            pc.bold("Usage:"),
+            "  infisical-env [--env stage|stage-2]",
+            "",
+            pc.bold("Options:"),
+            "  --env <name>   Environment name (stage or stage-2)",
+            "  -h, --help     Show this help",
+            "",
+            pc.bold("Environment variables:"),
+            "  INFISICAL_CLIENT_SECRET   Required (machine identity secret)",
+            "  INFISICAL_CLIENT_ID       Optional override",
+            "  INFISICAL_BASE_URL        Optional override (default https://secret.purplecode.ru)",
+            "  INFISICAL_MOCK_PATH       Optional mock json path for offline testing",
+        ].join(os.EOL)
+    );
 }
 
 function findRepoRoot(startDir) {
-  let current = startDir;
-  while (true) {
-    const candidate = path.join(current, "package.json");
-    if (fs.existsSync(candidate)) {
-      return current;
-    }
-    const parent = path.dirname(current);
-    if (parent === current) {
-      throw new Error("package.json not found in any parent directory");
+    let current = startDir;
+    while (true) {
+        const candidate = path.join(current, "package.json");
+        if (fs.existsSync(candidate)) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            throw new Error("package.json not found in any parent directory");
+        }
+        current = parent;
     }
-    current = parent;
-  }
 }
 
 function readJson(filePath) {
-  const raw = fs.readFileSync(filePath, "utf8");
-  return JSON.parse(raw);
+    const raw = fs.readFileSync(filePath, "utf8");
+    return JSON.parse(raw);
 }
 
 function resolveInfisicalProject(packageJson) {
-  const name = typeof packageJson.name === "string" ? packageJson.name.toLowerCase() : "";
-  if (name.includes("rugpt")) {
-    return "48854e39-7129-4786-87ac-cfcce296991c";
-  }
-  if (name.includes("studdy")) {
-    return "b4b0abbd-f8e6-428a-a296-6289369ca8dd";
-  }
-  if (name.includes("multisite")) {
-    return "6531c08b-45e0-4d75-a8ab-08d14d0387bf";
-  }
-  throw new Error(
-    "Unable to resolve Infisical project from package.json name. Expected name to include rugpt, studdy, or multisite."
-  );
+    const name = typeof packageJson.name === "string" ? packageJson.name.toLowerCase() : "";
+    if (name.includes("rugpt")) {
+        return "48854e39-7129-4786-87ac-cfcce296991c";
+    }
+    if (name.includes("studdy") || name.includes('student-works')) {
+        return "b4b0abbd-f8e6-428a-a296-6289369ca8dd";
+    }
+    if (name.includes("multisite")) {
+        return "6531c08b-45e0-4d75-a8ab-08d14d0387bf";
+    }
+    throw new Error(
+        "Unable to resolve Infisical project from package.json name. Expected name to include rugpt, studdy, or multisite."
+    );
 }
 
 async function resolveEnvName(args) {
-  const flagValue = parseEnvFlag(args);
-  if (flagValue) {
-    return validateEnv(flagValue);
-  }
-  return promptEnv();
+    const flagValue = parseEnvFlag(args);
+    if (flagValue) {
+        return validateEnv(flagValue);
+    }
+    return promptEnv();
 }
 
 function parseEnvFlag(args) {
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = args[i];
-    if (arg === "--env") {
-      return args[i + 1] || "";
-    }
-    if (arg.startsWith("--env=")) {
-      return arg.slice("--env=".length);
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--env") {
+            return args[i + 1] || "";
+        }
+        if (arg.startsWith("--env=")) {
+            return arg.slice("--env=".length);
+        }
     }
-  }
-  return "";
+    return "";
 }
 
 function validateEnv(value) {
-  if (!ALLOWED_ENVS.includes(value)) {
-    throw new Error(`Invalid environment \"${value}\". Allowed: ${ALLOWED_ENVS.join(", ")}`);
-  }
-  return value;
+    if (!ALLOWED_ENVS.includes(value)) {
+        throw new Error(`Invalid environment \"${value}\". Allowed: ${ALLOWED_ENVS.join(", ")}`);
+    }
+    return value;
 }
 
 async function promptEnv() {
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  try {
-    console.log(pc.bold("Select environment:"));
-    ALLOWED_ENVS.forEach((name, idx) => {
-      console.log(`${idx + 1}. ${name}`);
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
     });
-    const answer = await rl.question("Enter number: ");
-    const index = Number(answer.trim()) - 1;
-    if (!Number.isInteger(index) || index < 0 || index >= ALLOWED_ENVS.length) {
-      throw new Error("Invalid environment selection");
+
+    try {
+        console.log(pc.bold("Select environment:"));
+        ALLOWED_ENVS.forEach((name, idx) => {
+            console.log(`${idx + 1}. ${name}`);
+        });
+        const answer = await rl.question("Enter number: ");
+        const index = Number(answer.trim()) - 1;
+        if (!Number.isInteger(index) || index < 0 || index >= ALLOWED_ENVS.length) {
+            throw new Error("Invalid environment selection");
+        }
+        return ALLOWED_ENVS[index];
+    } finally {
+        rl.close();
     }
-    return ALLOWED_ENVS[index];
-  } finally {
-    rl.close();
-  }
 }
 
 function resolveDeploymentPath(repoRoot) {
-  const candidates = [
-    path.join(repoRoot, ".kube", "deployment.yml"),
-    path.join(repoRoot, ".kube", "deployment.yaml"),
-    path.join(repoRoot, "deployment.yml"),
-    path.join(repoRoot, "deployment.yaml"),
-  ];
-
-  for (const candidate of candidates) {
-    if (fs.existsSync(candidate)) {
-      return candidate;
+    const candidates = [
+        path.join(repoRoot, ".kube", "deployment.yml"),
+        path.join(repoRoot, ".kube", "deployment.yaml"),
+        path.join(repoRoot, "deployment.yml"),
+        path.join(repoRoot, "deployment.yaml"),
+    ];
+
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
     }
-  }
 
-  throw new Error("Deployment file not found. Expected .kube/deployment.yml or .kube/deployment.yaml");
+    throw new Error("Deployment file not found. Expected .kube/deployment.yml or .kube/deployment.yaml");
 }
 
 function collectEnvRefs(deploymentPath) {
-  const raw = fs.readFileSync(deploymentPath, "utf8");
-  const docs = YAML.parseAllDocuments(raw);
-  const refs = [];
-
-  for (const doc of docs) {
-    const data = doc.toJSON();
-    const containers = data?.spec?.template?.spec?.containers || [];
-    for (const container of containers) {
-      const envList = container?.env || [];
-      for (const envItem of envList) {
-        const name = envItem?.name;
-        const secretKeyRef = envItem?.valueFrom?.secretKeyRef;
-        const folder = secretKeyRef?.name;
-        const key = secretKeyRef?.key;
-        if (name && folder && key) {
-          refs.push({ name, folder, key });
+    const raw = fs.readFileSync(deploymentPath, "utf8");
+    const docs = YAML.parseAllDocuments(raw);
+    const refs = [];
+
+    for (const doc of docs) {
+        const data = doc.toJSON();
+        const containers = data?.spec?.template?.spec?.containers || [];
+        for (const container of containers) {
+            const envList = container?.env || [];
+            for (const envItem of envList) {
+                const name = envItem?.name;
+                const secretKeyRef = envItem?.valueFrom?.secretKeyRef;
+                const folder = secretKeyRef?.name;
+                const key = secretKeyRef?.key;
+                if (name && folder && key) {
+                    refs.push({ name, folder, key });
+                }
+            }
         }
-      }
     }
-  }
 
-  return refs;
+    return refs;
 }
 
 async function resolveEnvValues({ projectId, envName, envRefs, repoRoot }) {
-  const mockPath = process.env.INFISICAL_MOCK_PATH;
-  if (mockPath) {
-    return resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot });
-  }
-
-  const clientId = process.env.INFISICAL_CLIENT_ID || DEFAULT_INFISICAL_CLIENT_ID;
-  const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
-    throw new Error(
-      "Missing Infisical credentials. Set INFISICAL_CLIENT_SECRET or use INFISICAL_MOCK_PATH."
-    );
-  }
+    const mockPath = process.env.INFISICAL_MOCK_PATH;
+    if (mockPath) {
+        return resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot });
+    }
 
-  const baseUrl = normalizeBaseUrl(process.env.INFISICAL_BASE_URL || DEFAULT_INFISICAL_BASE_URL);
-  const accessToken = await loginUniversalAuth({ baseUrl, clientId, clientSecret });
+    const clientId = process.env.INFISICAL_CLIENT_ID || DEFAULT_INFISICAL_CLIENT_ID;
+    const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+        throw new Error(
+            "Missing Infisical credentials. Set INFISICAL_CLIENT_SECRET or use INFISICAL_MOCK_PATH."
+        );
+    }
+
+    const baseUrl = normalizeBaseUrl(process.env.INFISICAL_BASE_URL || DEFAULT_INFISICAL_BASE_URL);
+    const accessToken = await loginUniversalAuth({ baseUrl, clientId, clientSecret });
 
-  return fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs });
+    return fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs });
 }
 
 function resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot }) {
-  const absPath = path.isAbsolute(mockPath) ? mockPath : path.join(repoRoot, mockPath);
-  if (!fs.existsSync(absPath)) {
-    throw new Error(`Mock file not found: ${absPath}`);
-  }
-  const data = readJson(absPath);
-  const projectData = data?.projects?.[projectId];
-  if (!projectData) {
-    throw new Error(`Project not found in mock: ${projectId}`);
-  }
-  const envData = projectData?.[envName];
-  if (!envData) {
-    throw new Error(`Environment not found in mock: ${envName}`);
-  }
-
-  return envRefs.map((ref) => {
-    const folderData = envData?.[ref.folder];
-    const value = folderData?.[ref.key];
-    if (value === undefined || value === null) {
-      throw new Error(`Missing value for ${ref.folder}.${ref.key}`);
+    const absPath = path.isAbsolute(mockPath) ? mockPath : path.join(repoRoot, mockPath);
+    if (!fs.existsSync(absPath)) {
+        throw new Error(`Mock file not found: ${absPath}`);
+    }
+    const data = readJson(absPath);
+    const projectData = data?.projects?.[projectId];
+    if (!projectData) {
+        throw new Error(`Project not found in mock: ${projectId}`);
+    }
+    const envData = projectData?.[envName];
+    if (!envData) {
+        throw new Error(`Environment not found in mock: ${envName}`);
     }
-    return { name: ref.name, value: String(value) };
-  });
+
+    return envRefs.map((ref) => {
+        const folderData = envData?.[ref.folder];
+        const value = folderData?.[ref.key];
+        if (value === undefined || value === null) {
+            throw new Error(`Missing value for ${ref.folder}.${ref.key}`);
+        }
+        return { name: ref.name, value: String(value) };
+    });
 }
 
 function formatError(err) {
-  if (err instanceof Error) {
-    return err.message;
-  }
-  return String(err);
+    if (err instanceof Error) {
+        return err.message;
+    }
+    return String(err);
 }
 
 function normalizeBaseUrl(value) {
-  return value.replace(/\/+$/, "");
+    return value.replace(/\/+$/, "");
 }
 
 async function loginUniversalAuth({ baseUrl, clientId, clientSecret }) {
-  const url = `${baseUrl}/api/v1/auth/universal-auth/login`;
-  const body = new URLSearchParams();
-  body.set("clientId", clientId);
-  body.set("clientSecret", clientSecret);
-
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-    },
-    body,
-  });
-
-  if (!res.ok) {
-    const text = await safeReadText(res);
-    throw new Error(`Infisical login failed (${res.status}). ${text}`);
-  }
-
-  const data = await res.json();
-  if (!data?.accessToken) {
-    throw new Error("Infisical login response missing accessToken.");
-  }
-  return data.accessToken;
+    const url = `${baseUrl}/api/v1/auth/universal-auth/login`;
+    const body = new URLSearchParams();
+    body.set("clientId", clientId);
+    body.set("clientSecret", clientSecret);
+
+    const res = await fetch(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+
+    if (!res.ok) {
+        const text = await safeReadText(res);
+        throw new Error(`Infisical login failed (${res.status}). ${text}`);
+    }
+
+    const data = await res.json();
+    if (!data?.accessToken) {
+        throw new Error("Infisical login response missing accessToken.");
+    }
+    return data.accessToken;
 }
 
 async function fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs }) {
-  const refsByFolder = new Map();
-  for (const ref of envRefs) {
-    if (!refsByFolder.has(ref.folder)) {
-      refsByFolder.set(ref.folder, []);
-    }
-    refsByFolder.get(ref.folder).push(ref);
-  }
-
-  const secretCache = new Map();
-  for (const [folder, refs] of refsByFolder.entries()) {
-    const secretPath = folder.startsWith("/") ? folder : `/${folder}`;
-    const secrets = await listSecrets({
-      baseUrl,
-      accessToken,
-      projectId,
-      envName,
-      secretPath,
-    });
-    const map = new Map();
-    for (const item of secrets) {
-      if (item?.secretKey != null) {
-        map.set(item.secretKey, item.secretValue);
-      }
+    const refsByFolder = new Map();
+    for (const ref of envRefs) {
+        if (!refsByFolder.has(ref.folder)) {
+            refsByFolder.set(ref.folder, []);
+        }
+        refsByFolder.get(ref.folder).push(ref);
     }
-    secretCache.set(folder, map);
 
-    for (const ref of refs) {
-      if (!map.has(ref.key)) {
-        throw new Error(`Missing value for ${folder}.${ref.key} in environment ${envName}`);
-      }
+    const secretCache = new Map();
+    for (const [folder, refs] of refsByFolder.entries()) {
+        const secretPath = folder.startsWith("/") ? folder : `/${folder}`;
+        const secrets = await listSecrets({
+            baseUrl,
+            accessToken,
+            projectId,
+            envName,
+            secretPath,
+        });
+        const map = new Map();
+        for (const item of secrets) {
+            if (item?.secretKey != null) {
+                map.set(item.secretKey, item.secretValue);
+            }
+        }
+        secretCache.set(folder, map);
+
+        for (const ref of refs) {
+            if (!map.has(ref.key)) {
+                throw new Error(`Missing value for ${folder}.${ref.key} in environment ${envName}`);
+            }
+        }
     }
-  }
 
-  return envRefs.map((ref) => {
-    const folderMap = secretCache.get(ref.folder);
-    const value = folderMap?.get(ref.key);
-    return { name: ref.name, value: String(value) };
-  });
+    return envRefs.map((ref) => {
+        const folderMap = secretCache.get(ref.folder);
+        const value = folderMap?.get(ref.key);
+        return { name: ref.name, value: String(value) };
+    });
 }
 
 async function listSecrets({ baseUrl, accessToken, projectId, envName, secretPath }) {
-  const params = new URLSearchParams({
-    projectId,
-    environment: envName,
-    secretPath,
-    viewSecretValue: "true",
-    expandSecretReferences: "true",
-    recursive: "false",
-    includeImports: "true",
-  });
-
-  const url = `${baseUrl}/api/v4/secrets?${params.toString()}`;
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-    },
-  });
-
-  if (!res.ok) {
-    const text = await safeReadText(res);
-    throw new Error(`Infisical secrets list failed (${res.status}) for ${secretPath}. ${text}`);
-  }
-
-  const data = await res.json();
-  return Array.isArray(data?.secrets) ? data.secrets : [];
+    const params = new URLSearchParams({
+        projectId,
+        environment: envName,
+        secretPath,
+        viewSecretValue: "true",
+        expandSecretReferences: "true",
+        recursive: "false",
+        includeImports: "true",
+    });
+
+    const url = `${baseUrl}/api/v4/secrets?${params.toString()}`;
+    const res = await fetch(url, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+
+    if (!res.ok) {
+        const text = await safeReadText(res);
+        throw new Error(`Infisical secrets list failed (${res.status}) for ${secretPath}. ${text}`);
+    }
+
+    const data = await res.json();
+    return Array.isArray(data?.secrets) ? data.secrets : [];
 }
 
 async function safeReadText(res) {
-  try {
-    return await res.text();
-  } catch {
-    return "";
-  }
+    try {
+        return await res.text();
+    } catch {
+        return "";
+    }
 }
 
 await main();