@purpleschool/infisical-env 0.1.0

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@purpleschool/infisical-env",
+  "version": "0.1.0",
+  "type": "module",
+  "bin": {
+    "purple-env": "./src/cli.js"
+  },
+  "scripts": {
+    "start": "node ./src/cli.js"
+  },
+  "dependencies": {
+    "picocolors": "^1.0.1",
+    "yaml": "^2.4.5"
+  }
+}

package/src/cli.js

@@ -0,0 +1,363 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import readline from "node:readline/promises";
+import YAML from "yaml";
+import os from "node:os";
+import pc from "picocolors";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const ALLOWED_ENVS = ["stage", "stage-2"];
+const DEFAULT_INFISICAL_BASE_URL = "https://secret.purplecode.ru";
+const DEFAULT_INFISICAL_CLIENT_ID = "f3e0d60c-a602-4296-bd03-3be228e89165";
+
+async function main() {
+  try {
+    const args = process.argv.slice(2);
+    if (args.includes("--help") || args.includes("-h")) {
+      printHelp();
+      return;
+    }
+
+    const repoRoot = findRepoRoot(process.cwd());
+    const packageJson = readJson(path.join(repoRoot, "package.json"));
+
+    const projectId = resolveInfisicalProject(packageJson);
+    const envName = await resolveEnvName(args);
+
+    const deploymentPath = resolveDeploymentPath(repoRoot);
+    const envRefs = collectEnvRefs(deploymentPath);
+
+    if (envRefs.length === 0) {
+      throw new Error(`No env refs found in ${deploymentPath}`);
+    }
+
+    const values = await resolveEnvValues({
+      projectId,
+      envName,
+      envRefs,
+      repoRoot,
+    });
+
+    const envFilePath = path.join(repoRoot, ".env");
+    const lines = values.map((item) => `${item.name}=${item.value}`);
+    fs.writeFileSync(envFilePath, lines.join(os.EOL), "utf8");
+
+    console.log(pc.green(`.env written to ${envFilePath}`));
+  } catch (err) {
+    console.error(pc.red(formatError(err)));
+    console.error(pc.yellow("Run with --help for usage."));
+    process.exit(1);
+  }
+}
+
+function printHelp() {
+  console.log(
+    [
+      pc.bold("Usage:"),
+      "  purple-env [--env stage|stage-2]",
+      "",
+      pc.bold("Options:"),
+      "  --env <name>   Environment name (stage or stage-2)",
+      "  -h, --help     Show this help",
+      "",
+      pc.bold("Environment variables:"),
+      "  INFISICAL_CLIENT_SECRET   Required (machine identity secret)",
+      "  INFISICAL_CLIENT_ID       Optional override",
+      "  INFISICAL_BASE_URL        Optional override (default https://secret.purplecode.ru)",
+      "  INFISICAL_MOCK_PATH       Optional mock json path for offline testing",
+    ].join(os.EOL)
+  );
+}
+
+function findRepoRoot(startDir) {
+  let current = startDir;
+  while (true) {
+    const candidate = path.join(current, "package.json");
+    if (fs.existsSync(candidate)) {
+      return current;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      throw new Error("package.json not found in any parent directory");
+    }
+    current = parent;
+  }
+}
+
+function readJson(filePath) {
+  const raw = fs.readFileSync(filePath, "utf8");
+  return JSON.parse(raw);
+}
+
+function resolveInfisicalProject(packageJson) {
+  const name = typeof packageJson.name === "string" ? packageJson.name.toLowerCase() : "";
+  if (name.includes("rugpt")) {
+    return "48854e39-7129-4786-87ac-cfcce296991c";
+  }
+  if (name.includes("studdy")) {
+    return "b4b0abbd-f8e6-428a-a296-6289369ca8dd";
+  }
+  if (name.includes("multisite")) {
+    return "6531c08b-45e0-4d75-a8ab-08d14d0387bf";
+  }
+  throw new Error(
+    "Unable to resolve Infisical project from package.json name. Expected name to include rugpt, studdy, or multisite."
+  );
+}
+
+async function resolveEnvName(args) {
+  const flagValue = parseEnvFlag(args);
+  if (flagValue) {
+    return validateEnv(flagValue);
+  }
+  return promptEnv();
+}
+
+function parseEnvFlag(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--env") {
+      return args[i + 1] || "";
+    }
+    if (arg.startsWith("--env=")) {
+      return arg.slice("--env=".length);
+    }
+  }
+  return "";
+}
+
+function validateEnv(value) {
+  if (!ALLOWED_ENVS.includes(value)) {
+    throw new Error(`Invalid environment \"${value}\". Allowed: ${ALLOWED_ENVS.join(", ")}`);
+  }
+  return value;
+}
+
+async function promptEnv() {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  try {
+    console.log(pc.bold("Select environment:"));
+    ALLOWED_ENVS.forEach((name, idx) => {
+      console.log(`${idx + 1}. ${name}`);
+    });
+    const answer = await rl.question("Enter number: ");
+    const index = Number(answer.trim()) - 1;
+    if (!Number.isInteger(index) || index < 0 || index >= ALLOWED_ENVS.length) {
+      throw new Error("Invalid environment selection");
+    }
+    return ALLOWED_ENVS[index];
+  } finally {
+    rl.close();
+  }
+}
+
+function resolveDeploymentPath(repoRoot) {
+  const candidates = [
+    path.join(repoRoot, ".kube", "deployment.yml"),
+    path.join(repoRoot, ".kube", "deployment.yaml"),
+    path.join(repoRoot, "deployment.yml"),
+    path.join(repoRoot, "deployment.yaml"),
+  ];
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  throw new Error("Deployment file not found. Expected .kube/deployment.yml or .kube/deployment.yaml");
+}
+
+function collectEnvRefs(deploymentPath) {
+  const raw = fs.readFileSync(deploymentPath, "utf8");
+  const docs = YAML.parseAllDocuments(raw);
+  const refs = [];
+
+  for (const doc of docs) {
+    const data = doc.toJSON();
+    const containers = data?.spec?.template?.spec?.containers || [];
+    for (const container of containers) {
+      const envList = container?.env || [];
+      for (const envItem of envList) {
+        const name = envItem?.name;
+        const secretKeyRef = envItem?.valueFrom?.secretKeyRef;
+        const folder = secretKeyRef?.name;
+        const key = secretKeyRef?.key;
+        if (name && folder && key) {
+          refs.push({ name, folder, key });
+        }
+      }
+    }
+  }
+
+  return refs;
+}
+
+async function resolveEnvValues({ projectId, envName, envRefs, repoRoot }) {
+  const mockPath = process.env.INFISICAL_MOCK_PATH;
+  if (mockPath) {
+    return resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot });
+  }
+
+  const clientId = process.env.INFISICAL_CLIENT_ID || DEFAULT_INFISICAL_CLIENT_ID;
+  const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      "Missing Infisical credentials. Set INFISICAL_CLIENT_SECRET or use INFISICAL_MOCK_PATH."
+    );
+  }
+
+  const baseUrl = normalizeBaseUrl(process.env.INFISICAL_BASE_URL || DEFAULT_INFISICAL_BASE_URL);
+  const accessToken = await loginUniversalAuth({ baseUrl, clientId, clientSecret });
+
+  return fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs });
+}
+
+function resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot }) {
+  const absPath = path.isAbsolute(mockPath) ? mockPath : path.join(repoRoot, mockPath);
+  if (!fs.existsSync(absPath)) {
+    throw new Error(`Mock file not found: ${absPath}`);
+  }
+  const data = readJson(absPath);
+  const projectData = data?.projects?.[projectId];
+  if (!projectData) {
+    throw new Error(`Project not found in mock: ${projectId}`);
+  }
+  const envData = projectData?.[envName];
+  if (!envData) {
+    throw new Error(`Environment not found in mock: ${envName}`);
+  }
+
+  return envRefs.map((ref) => {
+    const folderData = envData?.[ref.folder];
+    const value = folderData?.[ref.key];
+    if (value === undefined || value === null) {
+      throw new Error(`Missing value for ${ref.folder}.${ref.key}`);
+    }
+    return { name: ref.name, value: String(value) };
+  });
+}
+
+function formatError(err) {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  return String(err);
+}
+
+function normalizeBaseUrl(value) {
+  return value.replace(/\/+$/, "");
+}
+
+async function loginUniversalAuth({ baseUrl, clientId, clientSecret }) {
+  const url = `${baseUrl}/api/v1/auth/universal-auth/login`;
+  const body = new URLSearchParams();
+  body.set("clientId", clientId);
+  body.set("clientSecret", clientSecret);
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body,
+  });
+
+  if (!res.ok) {
+    const text = await safeReadText(res);
+    throw new Error(`Infisical login failed (${res.status}). ${text}`);
+  }
+
+  const data = await res.json();
+  if (!data?.accessToken) {
+    throw new Error("Infisical login response missing accessToken.");
+  }
+  return data.accessToken;
+}
+
+async function fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs }) {
+  const refsByFolder = new Map();
+  for (const ref of envRefs) {
+    if (!refsByFolder.has(ref.folder)) {
+      refsByFolder.set(ref.folder, []);
+    }
+    refsByFolder.get(ref.folder).push(ref);
+  }
+
+  const secretCache = new Map();
+  for (const [folder, refs] of refsByFolder.entries()) {
+    const secretPath = folder.startsWith("/") ? folder : `/${folder}`;
+    const secrets = await listSecrets({
+      baseUrl,
+      accessToken,
+      projectId,
+      envName,
+      secretPath,
+    });
+    const map = new Map();
+    for (const item of secrets) {
+      if (item?.secretKey != null) {
+        map.set(item.secretKey, item.secretValue);
+      }
+    }
+    secretCache.set(folder, map);
+
+    for (const ref of refs) {
+      if (!map.has(ref.key)) {
+        throw new Error(`Missing value for ${folder}.${ref.key} in environment ${envName}`);
+      }
+    }
+  }
+
+  return envRefs.map((ref) => {
+    const folderMap = secretCache.get(ref.folder);
+    const value = folderMap?.get(ref.key);
+    return { name: ref.name, value: String(value) };
+  });
+}
+
+async function listSecrets({ baseUrl, accessToken, projectId, envName, secretPath }) {
+  const params = new URLSearchParams({
+    projectId,
+    environment: envName,
+    secretPath,
+    viewSecretValue: "true",
+    expandSecretReferences: "true",
+    recursive: "false",
+    includeImports: "true",
+  });
+
+  const url = `${baseUrl}/api/v4/secrets?${params.toString()}`;
+  const res = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  if (!res.ok) {
+    const text = await safeReadText(res);
+    throw new Error(`Infisical secrets list failed (${res.status}) for ${secretPath}. ${text}`);
+  }
+
+  const data = await res.json();
+  return Array.isArray(data?.secrets) ? data.secrets : [];
+}
+
+async function safeReadText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+
+await main();