@purpleschool/infisical-env 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@purpleschool/infisical-env",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "bin": {
     "infisical-env": "src/cli.js"
@@ -13,6 +13,7 @@
   },
   "dependencies": {
     "picocolors": "^1.0.1",
+    "prompts": "^2.4.2",
     "yaml": "^2.4.5"
   }
-}
+}

package/src/cli.js

@@ -3,10 +3,10 @@ import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
-import readline from "node:readline/promises";
 import YAML from "yaml";
 import os from "node:os";
 import pc from "picocolors";
+import prompts from "prompts";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -16,348 +16,345 @@ const DEFAULT_INFISICAL_BASE_URL = "https://secret.purplecode.ru";
 const DEFAULT_INFISICAL_CLIENT_ID = "f3e0d60c-a602-4296-bd03-3be228e89165";
 
 async function main() {
-    try {
-        const args = process.argv.slice(2);
-        if (args.includes("--help") || args.includes("-h")) {
-            printHelp();
-            return;
-        }
-
-        const repoRoot = findRepoRoot(process.cwd());
-        const packageJson = readJson(path.join(repoRoot, "package.json"));
+  try {
+    const args = process.argv.slice(2);
+    if (args.includes("--help") || args.includes("-h")) {
+      printHelp();
+      return;
+    }
 
-        const projectId = resolveInfisicalProject(packageJson);
-        const envName = await resolveEnvName(args);
+    const repoRoot = findRepoRoot(process.cwd());
+    const packageJson = readJson(path.join(repoRoot, "package.json"));
 
-        const deploymentPath = resolveDeploymentPath(repoRoot);
-        const envRefs = collectEnvRefs(deploymentPath);
+    const projectId = resolveInfisicalProject(packageJson);
+    const envName = await resolveEnvName(args);
 
-        if (envRefs.length === 0) {
-            throw new Error(`No env refs found in ${deploymentPath}`);
-        }
+    const deploymentPath = resolveDeploymentPath(repoRoot);
+    const envRefs = collectEnvRefs(deploymentPath);
 
-        const values = await resolveEnvValues({
-            projectId,
-            envName,
-            envRefs,
-            repoRoot,
-        });
-
-        const envFilePath = path.join(repoRoot, ".env");
-        const lines = values.map((item) => `${item.name}=${item.value}`);
-        fs.writeFileSync(envFilePath, lines.join(os.EOL), "utf8");
-
-        console.log(pc.green(`.env written to ${envFilePath}`));
-    } catch (err) {
-        console.error(pc.red(formatError(err)));
-        console.error(pc.yellow("Run with --help for usage."));
-        process.exit(1);
+    if (envRefs.length === 0) {
+      throw new Error(`No env refs found in ${deploymentPath}`);
     }
+
+    const values = await resolveEnvValues({
+      projectId,
+      envName,
+      envRefs,
+      repoRoot,
+    });
+
+    const envFilePath = path.join(repoRoot, ".env");
+    const lines = values.map((item) => `${item.name}=${item.value}`);
+    fs.writeFileSync(envFilePath, lines.join(os.EOL), "utf8");
+
+    console.log(pc.green(`.env written to ${envFilePath}`));
+  } catch (err) {
+    console.error(pc.red(formatError(err)));
+    console.error(pc.yellow("Run with --help for usage."));
+    process.exit(1);
+  }
 }
 
 function printHelp() {
-    console.log(
-        [
-            pc.bold("Usage:"),
-            "  infisical-env [--env stage|stage-2]",
-            "",
-            pc.bold("Options:"),
-            "  --env <name>   Environment name (stage or stage-2)",
-            "  -h, --help     Show this help",
-            "",
-            pc.bold("Environment variables:"),
-            "  INFISICAL_CLIENT_SECRET   Required (machine identity secret)",
-            "  INFISICAL_CLIENT_ID       Optional override",
-            "  INFISICAL_BASE_URL        Optional override (default https://secret.purplecode.ru)",
-            "  INFISICAL_MOCK_PATH       Optional mock json path for offline testing",
-        ].join(os.EOL)
-    );
+  console.log(
+    [
+      pc.bold("Usage:"),
+      "  infisical-env [--env stage|stage-2]",
+      "",
+      pc.bold("Options:"),
+      "  --env <name>   Environment name (stage or stage-2)",
+      "  -h, --help     Show this help",
+      "",
+      pc.bold("Environment variables:"),
+      "  INFISICAL_CLIENT_SECRET   Required (machine identity secret)",
+      "  INFISICAL_CLIENT_ID       Optional override",
+      "  INFISICAL_BASE_URL        Optional override (default https://secret.purplecode.ru)",
+      "  INFISICAL_MOCK_PATH       Optional mock json path for offline testing",
+    ].join(os.EOL)
+  );
 }
 
 function findRepoRoot(startDir) {
-    let current = startDir;
-    while (true) {
-        const candidate = path.join(current, "package.json");
-        if (fs.existsSync(candidate)) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            throw new Error("package.json not found in any parent directory");
-        }
-        current = parent;
+  let current = startDir;
+  while (true) {
+    const candidate = path.join(current, "package.json");
+    if (fs.existsSync(candidate)) {
+      return current;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      throw new Error("package.json not found in any parent directory");
     }
+    current = parent;
+  }
 }
 
 function readJson(filePath) {
-    const raw = fs.readFileSync(filePath, "utf8");
-    return JSON.parse(raw);
+  const raw = fs.readFileSync(filePath, "utf8");
+  return JSON.parse(raw);
 }
 
 function resolveInfisicalProject(packageJson) {
-    const name = typeof packageJson.name === "string" ? packageJson.name.toLowerCase() : "";
-    if (name.includes("rugpt")) {
-        return "48854e39-7129-4786-87ac-cfcce296991c";
-    }
-    if (name.includes("studdy") || name.includes('student-works')) {
-        return "b4b0abbd-f8e6-428a-a296-6289369ca8dd";
-    }
-    if (name.includes("multisite")) {
-        return "6531c08b-45e0-4d75-a8ab-08d14d0387bf";
-    }
-    throw new Error(
-        "Unable to resolve Infisical project from package.json name. Expected name to include rugpt, studdy, or multisite."
-    );
+  const name = typeof packageJson.name === "string" ? packageJson.name.toLowerCase() : "";
+  if (name.includes("rugpt")) {
+    return "48854e39-7129-4786-87ac-cfcce296991c";
+  }
+  if (name.includes("studdy") || name.includes("student-works")) {
+    return "b4b0abbd-f8e6-428a-a296-6289369ca8dd";
+  }
+  if (name.includes("multisite")) {
+    return "6531c08b-45e0-4d75-a8ab-08d14d0387bf";
+  }
+  throw new Error(
+    "Unable to resolve Infisical project from package.json name. Expected name to include rugpt, studdy, student-works, or multisite."
+  );
 }
 
 async function resolveEnvName(args) {
-    const flagValue = parseEnvFlag(args);
-    if (flagValue) {
-        return validateEnv(flagValue);
-    }
-    return promptEnv();
+  const flagValue = parseEnvFlag(args);
+  if (flagValue) {
+    return validateEnv(flagValue);
+  }
+  return promptEnv();
 }
 
 function parseEnvFlag(args) {
-    for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (arg === "--env") {
-            return args[i + 1] || "";
-        }
-        if (arg.startsWith("--env=")) {
-            return arg.slice("--env=".length);
-        }
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--env") {
+      return args[i + 1] || "";
     }
-    return "";
+    if (arg.startsWith("--env=")) {
+      return arg.slice("--env=".length);
+    }
+  }
+  return "";
 }
 
 function validateEnv(value) {
-    if (!ALLOWED_ENVS.includes(value)) {
-        throw new Error(`Invalid environment \"${value}\". Allowed: ${ALLOWED_ENVS.join(", ")}`);
-    }
-    return value;
+  if (!ALLOWED_ENVS.includes(value)) {
+    throw new Error(`Invalid environment \"${value}\". Allowed: ${ALLOWED_ENVS.join(", ")}`);
+  }
+  return value;
 }
 
 async function promptEnv() {
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
-
-    try {
-        console.log(pc.bold("Select environment:"));
-        ALLOWED_ENVS.forEach((name, idx) => {
-            console.log(`${idx + 1}. ${name}`);
-        });
-        const answer = await rl.question("Enter number: ");
-        const index = Number(answer.trim()) - 1;
-        if (!Number.isInteger(index) || index < 0 || index >= ALLOWED_ENVS.length) {
-            throw new Error("Invalid environment selection");
-        }
-        return ALLOWED_ENVS[index];
-    } finally {
-        rl.close();
+  const response = await prompts(
+    {
+      type: "select",
+      name: "env",
+      message: "Select environment",
+      choices: ALLOWED_ENVS.map((value) => ({ title: value, value })),
+      initial: 0,
+    },
+    {
+      onCancel: () => {
+        throw new Error("Environment selection canceled");
+      },
     }
+  );
+
+  return validateEnv(response.env);
 }
 
 function resolveDeploymentPath(repoRoot) {
-    const candidates = [
-        path.join(repoRoot, ".kube", "deployment.yml"),
-        path.join(repoRoot, ".kube", "deployment.yaml"),
-        path.join(repoRoot, "deployment.yml"),
-        path.join(repoRoot, "deployment.yaml"),
-    ];
-
-    for (const candidate of candidates) {
-        if (fs.existsSync(candidate)) {
-            return candidate;
-        }
+  const candidates = [
+    path.join(repoRoot, ".kube", "deployment.yml"),
+    path.join(repoRoot, ".kube", "deployment.yaml"),
+    path.join(repoRoot, "deployment.yml"),
+    path.join(repoRoot, "deployment.yaml"),
+  ];
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
     }
+  }
 
-    throw new Error("Deployment file not found. Expected .kube/deployment.yml or .kube/deployment.yaml");
+  throw new Error("Deployment file not found. Expected .kube/deployment.yml or .kube/deployment.yaml");
 }
 
 function collectEnvRefs(deploymentPath) {
-    const raw = fs.readFileSync(deploymentPath, "utf8");
-    const docs = YAML.parseAllDocuments(raw);
-    const refs = [];
-
-    for (const doc of docs) {
-        const data = doc.toJSON();
-        const containers = data?.spec?.template?.spec?.containers || [];
-        for (const container of containers) {
-            const envList = container?.env || [];
-            for (const envItem of envList) {
-                const name = envItem?.name;
-                const secretKeyRef = envItem?.valueFrom?.secretKeyRef;
-                const folder = secretKeyRef?.name;
-                const key = secretKeyRef?.key;
-                if (name && folder && key) {
-                    refs.push({ name, folder, key });
-                }
-            }
+  const raw = fs.readFileSync(deploymentPath, "utf8");
+  const docs = YAML.parseAllDocuments(raw);
+  const refs = [];
+
+  for (const doc of docs) {
+    const data = doc.toJSON();
+    const containers = data?.spec?.template?.spec?.containers || [];
+    for (const container of containers) {
+      const envList = container?.env || [];
+      for (const envItem of envList) {
+        const name = envItem?.name;
+        const secretKeyRef = envItem?.valueFrom?.secretKeyRef;
+        const folder = secretKeyRef?.name;
+        const key = secretKeyRef?.key;
+        if (name && folder && key) {
+          refs.push({ name, folder, key });
         }
+      }
     }
+  }
 
-    return refs;
+  return refs;
 }
 
 async function resolveEnvValues({ projectId, envName, envRefs, repoRoot }) {
-    const mockPath = process.env.INFISICAL_MOCK_PATH;
-    if (mockPath) {
-        return resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot });
-    }
-
-    const clientId = process.env.INFISICAL_CLIENT_ID || DEFAULT_INFISICAL_CLIENT_ID;
-    const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
-    if (!clientId || !clientSecret) {
-        throw new Error(
-            "Missing Infisical credentials. Set INFISICAL_CLIENT_SECRET or use INFISICAL_MOCK_PATH."
-        );
-    }
+  const mockPath = process.env.INFISICAL_MOCK_PATH;
+  if (mockPath) {
+    return resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot });
+  }
+
+  const clientId = process.env.INFISICAL_CLIENT_ID || DEFAULT_INFISICAL_CLIENT_ID;
+  const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      "Missing Infisical credentials. Set INFISICAL_CLIENT_SECRET or use INFISICAL_MOCK_PATH."
+    );
+  }
 
-    const baseUrl = normalizeBaseUrl(process.env.INFISICAL_BASE_URL || DEFAULT_INFISICAL_BASE_URL);
-    const accessToken = await loginUniversalAuth({ baseUrl, clientId, clientSecret });
+  const baseUrl = normalizeBaseUrl(process.env.INFISICAL_BASE_URL || DEFAULT_INFISICAL_BASE_URL);
+  const accessToken = await loginUniversalAuth({ baseUrl, clientId, clientSecret });
 
-    return fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs });
+  return fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs });
 }
 
 function resolveFromMock({ projectId, envName, envRefs, mockPath, repoRoot }) {
-    const absPath = path.isAbsolute(mockPath) ? mockPath : path.join(repoRoot, mockPath);
-    if (!fs.existsSync(absPath)) {
-        throw new Error(`Mock file not found: ${absPath}`);
-    }
-    const data = readJson(absPath);
-    const projectData = data?.projects?.[projectId];
-    if (!projectData) {
-        throw new Error(`Project not found in mock: ${projectId}`);
+  const absPath = path.isAbsolute(mockPath) ? mockPath : path.join(repoRoot, mockPath);
+  if (!fs.existsSync(absPath)) {
+    throw new Error(`Mock file not found: ${absPath}`);
+  }
+  const data = readJson(absPath);
+  const projectData = data?.projects?.[projectId];
+  if (!projectData) {
+    throw new Error(`Project not found in mock: ${projectId}`);
+  }
+  const envData = projectData?.[envName];
+  if (!envData) {
+    throw new Error(`Environment not found in mock: ${envName}`);
+  }
+
+  return envRefs.map((ref) => {
+    const folderData = envData?.[ref.folder];
+    const value = folderData?.[ref.key];
+    if (value === undefined || value === null) {
+      throw new Error(`Missing value for ${ref.folder}.${ref.key}`);
     }
-    const envData = projectData?.[envName];
-    if (!envData) {
-        throw new Error(`Environment not found in mock: ${envName}`);
-    }
-
-    return envRefs.map((ref) => {
-        const folderData = envData?.[ref.folder];
-        const value = folderData?.[ref.key];
-        if (value === undefined || value === null) {
-            throw new Error(`Missing value for ${ref.folder}.${ref.key}`);
-        }
-        return { name: ref.name, value: String(value) };
-    });
+    return { name: ref.name, value: String(value) };
+  });
 }
 
 function formatError(err) {
-    if (err instanceof Error) {
-        return err.message;
-    }
-    return String(err);
+  if (err instanceof Error) {
+    return err.message;
+  }
+  return String(err);
 }
 
 function normalizeBaseUrl(value) {
-    return value.replace(/\/+$/, "");
+  return value.replace(/\/+$/, "");
 }
 
 async function loginUniversalAuth({ baseUrl, clientId, clientSecret }) {
-    const url = `${baseUrl}/api/v1/auth/universal-auth/login`;
-    const body = new URLSearchParams();
-    body.set("clientId", clientId);
-    body.set("clientSecret", clientSecret);
-
-    const res = await fetch(url, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-        body,
-    });
-
-    if (!res.ok) {
-        const text = await safeReadText(res);
-        throw new Error(`Infisical login failed (${res.status}). ${text}`);
-    }
-
-    const data = await res.json();
-    if (!data?.accessToken) {
-        throw new Error("Infisical login response missing accessToken.");
-    }
-    return data.accessToken;
+  const url = `${baseUrl}/api/v1/auth/universal-auth/login`;
+  const body = new URLSearchParams();
+  body.set("clientId", clientId);
+  body.set("clientSecret", clientSecret);
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body,
+  });
+
+  if (!res.ok) {
+    const text = await safeReadText(res);
+    throw new Error(`Infisical login failed (${res.status}). ${text}`);
+  }
+
+  const data = await res.json();
+  if (!data?.accessToken) {
+    throw new Error("Infisical login response missing accessToken.");
+  }
+  return data.accessToken;
 }
 
 async function fetchSecretsFromInfisical({ baseUrl, accessToken, projectId, envName, envRefs }) {
-    const refsByFolder = new Map();
-    for (const ref of envRefs) {
-        if (!refsByFolder.has(ref.folder)) {
-            refsByFolder.set(ref.folder, []);
-        }
-        refsByFolder.get(ref.folder).push(ref);
+  const refsByFolder = new Map();
+  for (const ref of envRefs) {
+    if (!refsByFolder.has(ref.folder)) {
+      refsByFolder.set(ref.folder, []);
     }
+    refsByFolder.get(ref.folder).push(ref);
+  }
+
+  const secretCache = new Map();
+  for (const [folder, refs] of refsByFolder.entries()) {
+    const secretPath = folder.startsWith("/") ? folder : `/${folder}`;
+    const secrets = await listSecrets({
+      baseUrl,
+      accessToken,
+      projectId,
+      envName,
+      secretPath,
+    });
+    const map = new Map();
+    for (const item of secrets) {
+      if (item?.secretKey != null) {
+        map.set(item.secretKey, item.secretValue);
+      }
+    }
+    secretCache.set(folder, map);
 
-    const secretCache = new Map();
-    for (const [folder, refs] of refsByFolder.entries()) {
-        const secretPath = folder.startsWith("/") ? folder : `/${folder}`;
-        const secrets = await listSecrets({
-            baseUrl,
-            accessToken,
-            projectId,
-            envName,
-            secretPath,
-        });
-        const map = new Map();
-        for (const item of secrets) {
-            if (item?.secretKey != null) {
-                map.set(item.secretKey, item.secretValue);
-            }
-        }
-        secretCache.set(folder, map);
-
-        for (const ref of refs) {
-            if (!map.has(ref.key)) {
-                throw new Error(`Missing value for ${folder}.${ref.key} in environment ${envName}`);
-            }
-        }
+    for (const ref of refs) {
+      if (!map.has(ref.key)) {
+        throw new Error(`Missing value for ${folder}.${ref.key} in environment ${envName}`);
+      }
     }
+  }
 
-    return envRefs.map((ref) => {
-        const folderMap = secretCache.get(ref.folder);
-        const value = folderMap?.get(ref.key);
-        return { name: ref.name, value: String(value) };
-    });
+  return envRefs.map((ref) => {
+    const folderMap = secretCache.get(ref.folder);
+    const value = folderMap?.get(ref.key);
+    return { name: ref.name, value: String(value) };
+  });
 }
 
 async function listSecrets({ baseUrl, accessToken, projectId, envName, secretPath }) {
-    const params = new URLSearchParams({
-        projectId,
-        environment: envName,
-        secretPath,
-        viewSecretValue: "true",
-        expandSecretReferences: "true",
-        recursive: "false",
-        includeImports: "true",
-    });
-
-    const url = `${baseUrl}/api/v4/secrets?${params.toString()}`;
-    const res = await fetch(url, {
-        headers: {
-            Authorization: `Bearer ${accessToken}`,
-        },
-    });
-
-    if (!res.ok) {
-        const text = await safeReadText(res);
-        throw new Error(`Infisical secrets list failed (${res.status}) for ${secretPath}. ${text}`);
-    }
-
-    const data = await res.json();
-    return Array.isArray(data?.secrets) ? data.secrets : [];
+  const params = new URLSearchParams({
+    projectId,
+    environment: envName,
+    secretPath,
+    viewSecretValue: "true",
+    expandSecretReferences: "true",
+    recursive: "false",
+    includeImports: "true",
+  });
+
+  const url = `${baseUrl}/api/v4/secrets?${params.toString()}`;
+  const res = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  if (!res.ok) {
+    const text = await safeReadText(res);
+    throw new Error(`Infisical secrets list failed (${res.status}) for ${secretPath}. ${text}`);
+  }
+
+  const data = await res.json();
+  return Array.isArray(data?.secrets) ? data.secrets : [];
 }
 
 async function safeReadText(res) {
-    try {
-        return await res.text();
-    } catch {
-        return "";
-    }
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
 }
 
 await main();