@saastemly/voidcommerce 0.2.2 → 0.4.0

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-sbchkpa6.js";
+} from "./index-yzezvy5h.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -77,7 +77,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-zh3tmj08.js";
+} from "./index-pz6m2hkm.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -94,7 +94,8 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-z4qazajn.js";
+} from "./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 export {
   zoneOf,
   zone,

package/dist/manifest.js

@@ -17,8 +17,9 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-zh3tmj08.js";
-import"./index-z4qazajn.js";
+} from "./index-pz6m2hkm.js";
+import"./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 export {
   zoneOf,
   zone,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",
+    "@dotenvx/primitives": "^2.2.0",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {

package/src/cli.ts

@@ -1,4 +1,4 @@
-import { deployCommand, deployHelp, preflightCommand, preflightHelp } from "./deploy/index";
+import { deployCommand, deployHelp, guardCommand, keysCliCommand, keysHelp, preflightCommand, preflightHelp, secretsCliCommand, secretsHelp } from "./deploy/index";
 import { distCommand, distHelp } from "./dist";
 import { importCommand, importHelp } from "./import";
 import { fullHelp, initHelp, version } from "./help";
@@ -38,6 +38,10 @@ export const EXTENDED: Record<string, Extended> = {
 	import: { run: importCommand, help: importHelp },
 	deploy: { run: deployCommand, help: deployHelp },
 	preflight: { run: preflightCommand, help: preflightHelp },
+	secrets: { run: secretsCliCommand, help: secretsHelp },
+	keys: { run: keysCliCommand, help: keysHelp },
+	// Called by the generated pre-commit hook; exit code is the interface.
+	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },
 	build: { run: appScript("build"), help: appScriptHelp("build") },
 	preview: { run: appScript("preview"), help: appScriptHelp("preview") },

package/src/deploy/cloudflare.ts

@@ -6,6 +6,7 @@ import { hasFrontend, workerHosts, writeManifest } from "../manifest";
 import type { Project } from "../project";
 import { parseJsonc, upsertJsonc } from "./jsonc";
 import { preflight, printPreflight } from "./preflight";
+import { SECRETS_FILE, decryptSecrets } from "./secrets";
 import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangler";
 
 /**
@@ -25,7 +26,9 @@ import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangle
  *      secret-class key and every `unset` is removed from dist/ssr/wrangler.json
  *      before it is uploaded; the worker reads those from `wrangler secret`.
  *   6. apply the committed migrations to the remote D1
- *   7. wrangler deploy, on exactly the config that was scrubbed
+ *   7. decrypt the repository's own secrets, if it keeps any
+ *   8. wrangler deploy, on exactly the config that was scrubbed, carrying
+ *      those secrets up with the version
  */
 
 export interface CloudflareOptions {
@@ -153,9 +156,28 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
 	if (migrated.code !== 0) return fail(`applying migrations failed (exit ${migrated.code}); nothing was deployed.`);
 
-	// 7. deploy exactly what was scrubbed.
+	/**
+	 * 7. Secrets, from the repository, in the same operation as the deploy.
+	 *
+	 * `--secrets-file` applies ADDITIVELY: a secret this file does not name is
+	 * left alone rather than deleted, so a shop that sets one by hand does not
+	 * lose it the next time this runs. The plaintext exists only as a
+	 * 0600 temp file for the length of the upload.
+	 */
+	const secretArgs: string[] = [];
+	let cleanupSecrets: (() => void) | undefined;
+	if (existsSync(join(project.root, SECRETS_FILE))) {
+		const decrypted = await decryptSecrets(project);
+		if ("error" in decrypted) return fail(`the repository's secrets could not be read: ${decrypted.error}`);
+		secretArgs.push("--secrets-file", decrypted.path);
+		cleanupSecrets = decrypted.cleanup;
+		console.log(`${color.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+	}
+
+	// 8. deploy exactly what was scrubbed.
 	console.log("\n▸ wrangler deploy -c dist/ssr/wrangler.json");
-	const deployed = await wrangler(bin, ["deploy", "-c", join("dist", "ssr", "wrangler.json")], app, true);
+	const deployed = await wrangler(bin, ["deploy", "-c", join("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
+	cleanupSecrets?.();
 	if (deployed.code !== 0) return fail(`wrangler deploy failed (exit ${deployed.code}).`);
 
 	const domain = project.manifest.shop.domain;

package/src/deploy/index.ts

@@ -4,6 +4,8 @@ import { findProject } from "../project";
 import { captureVoid, runVoid } from "../void";
 import { deployCloudflare } from "./cloudflare";
 import { preflight, printPreflight } from "./preflight";
+import { PRIVATE_KEY_VAR, SECRETS_FILE, plaintextSecretNames, secretsCommand } from "./secrets";
+import { keysCommand } from "./keys";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -99,3 +101,89 @@ export async function preflightHelp(): Promise<number> {
 	);
 	return 0;
 }
+
+/** `vc secrets` — what the repository declares, and whether it is encrypted. */
+export async function secretsCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	return secretsCommand(project, args);
+}
+
+export async function secretsHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc secrets", [
+			line(`Secrets that live in the repository, encrypted, in ${SECRETS_FILE}.`, width),
+			line("", width),
+			...row("vc secrets", "what this shop needs, and whether it is declared and encrypted", width, 2),
+			...row("vc secrets --init", `write ${SECRETS_FILE} with every required key as \`unset\``, width, 2),
+			...row(`dotenvx set KEY '…' -f ${SECRETS_FILE}`, "set one, without decrypting the file", width, 2),
+			...row(`dotenvx encrypt -f ${SECRETS_FILE}`, "encrypt anything still in the clear", width, 2),
+			line("", width),
+			line("The file is COMMITTED: values are ciphertext, key names are not, so a", width),
+			line("diff shows which secret changed without showing what it changed to.", width),
+			line(`The private key stays out — .env.keys locally, and ${PRIVATE_KEY_VAR}`, width),
+			line("as one build variable where the deploy runs.", width),
+			line("", width),
+			line("Tradeoff worth knowing: ciphertext in git is permanent, so a leaked key", width),
+			line("exposes rotated secrets too. `wrangler secret put` does not have that", width),
+			line("property, and stays available for anything you would rather keep out.", width),
+		], width),
+	);
+	return 0;
+}
+
+/** `vc keys` — what the token derives, and the warning that goes with it. */
+export async function keysCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	return keysCommand(project.manifest, project.root, args);
+}
+
+export async function keysHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc keys", [
+			line("The key that encrypts this repository's secrets is DERIVED from", width),
+			line("CLOUDFLARE_API_TOKEN, salted with the account id. Nothing is stored.", width),
+			line("", width),
+			...row("vc keys", "what this token derives, and whether it matches the repository", width, 2),
+			...row("vc keys --rotate", "re-encrypt under a new token, while the old one still works", width, 2),
+			line("", width),
+			line("Whoever can deploy the worker can read its secrets, and nobody else can.", width),
+			line("The price: rotating the token orphans every encrypted value, a second", width),
+			line("admin's token derives a different key, and the build must use the same", width),
+			line("token the values were encrypted under. `vc keys` checks the derived", width),
+			line("public key against the committed one, so a mismatch is a clear refusal", width),
+			line("rather than a decryption error nobody can place.", width),
+		], width),
+	);
+	return 0;
+}
+
+/**
+ * The pre-commit gate: refuse a commit that would put a secret in the clear.
+ *
+ * Exit code is the whole interface — a hook cares about nothing else.
+ */
+export async function guardCommand(): Promise<number> {
+	const project = await findProject();
+	if (!project) return 0; // Not a shop; nothing to guard.
+	const bare = plaintextSecretNames(project.root);
+	if (bare.length === 0) return 0;
+	console.error(
+		`\n${color.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${
+			bare.length === 1 ? "is" : "are"
+		} not encrypted.\n\n` +
+			`    ${bare.join("\n    ")}\n\n` +
+			`  bunx dotenvx encrypt -f ${SECRETS_FILE}\n\n` +
+			color.dim("  Committing a secret in the clear cannot be undone by a later commit;\n  the value stays in the history and must be treated as burned.\n"),
+	);
+	return 1;
+}

package/src/deploy/keys.ts

@@ -0,0 +1,212 @@
+import { hkdfSync } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import color from "picocolors";
+import type { Manifest } from "../manifest";
+import { SECRETS_FILE } from "./secrets";
+
+/**
+ * The key that encrypts the repository's secrets, DERIVED rather than stored.
+ *
+ * ── What this buys, and what it costs ────────────────────────────────────
+ *
+ * Nothing has to be kept. There is no `.env.keys` to lose, leak, or forget to
+ * gitignore — a real failure that has already happened once here. Whoever can
+ * deploy the worker can read its secrets, and nobody else can, which is the
+ * property that was wanted.
+ *
+ * The cost is severe and worth stating plainly, because it is invisible until
+ * the day it is not:
+ *
+ *   **Rotating the API token orphans every secret in the repository.** The
+ *   key changes with the token, and the ciphertext does not. Every
+ *   `encrypted:` value becomes permanently unreadable, and the only recovery
+ *   is to type them all in again.
+ *
+ *   **A second admin derives a different key.** Two people with two tokens
+ *   cannot read each other's values.
+ *
+ *   **The build derives from whichever token it was given**, so the token in
+ *   the build settings must be the one the values were encrypted under.
+ *
+ * So this module's real job is not deriving a key — that is eight lines. It
+ * is making those three failures LOUD. The committed `.env.secrets` carries
+ * the public key, so the derived private key can always be checked against
+ * what the repository was actually encrypted under, and a mismatch is caught
+ * before anything is attempted rather than surfacing as a decryption failure
+ * nobody can explain.
+ *
+ * @see https://developers.cloudflare.com/workers/wrangler/system-environment-variables/
+ */
+
+/**
+ * Domain separation. A key derived for this purpose must not equal one
+ * derived for any other, so the label is versioned: changing it is how a
+ * future scheme migrates without colliding with this one.
+ */
+const INFO = "voidcommerce/dotenvx/secrets/v1";
+
+/** Where the token comes from, in the order wrangler itself reads them. */
+export function apiToken(): string | null {
+	return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
+
+/**
+ * The private key this token and account derive.
+ *
+ * The account id is the salt rather than a constant, so the same token used
+ * against two accounts does not produce one key — tokens are often scoped to
+ * several accounts, and a shared key across them would be a wider blast
+ * radius than anyone asked for.
+ */
+export function derivePrivateKey(token: string, accountId: string): string {
+	const bytes = hkdfSync("sha256", Buffer.from(token, "utf8"), Buffer.from(accountId, "utf8"), Buffer.from(INFO), 32);
+	return Buffer.from(bytes).toString("hex");
+}
+
+/** The public key for a private one, via dotenvx's own primitive. */
+export async function publicKeyFor(privateKey: string): Promise<string | null> {
+	try {
+		const { derive } = await import("@dotenvx/primitives");
+		return derive(privateKey);
+	} catch {
+		return null;
+	}
+}
+
+/** The public key the repository was actually encrypted under. */
+export function committedPublicKey(root: string): string | null {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return null;
+	const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync(path, "utf8"));
+	return match?.[1] ?? null;
+}
+
+export type KeyState =
+	| { ok: true; privateKey: string; publicKey: string; fresh: boolean }
+	| { ok: false; reason: string };
+
+/**
+ * The key for this repository, or a refusal that says exactly what is wrong.
+ *
+ * `fresh` means the repository has no secrets yet, so there is nothing to
+ * check the derivation against and any token is as good as another.
+ */
+export async function keyFor(manifest: Manifest, root: string): Promise<KeyState> {
+	const token = apiToken();
+	if (!token) {
+		return {
+			ok: false,
+			reason:
+				"CLOUDFLARE_API_TOKEN is not set.\n" +
+				"  The key is derived from it, so there is nothing to derive from. Note that\n" +
+				"  `wrangler login` does NOT set one — this scheme needs an API token, from\n" +
+				"  My Profile → API Tokens.",
+		};
+	}
+	const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+	if (!accountId) {
+		return {
+			ok: false,
+			reason:
+				"the account is not pinned, and it salts the derivation.\n" +
+				"  Run `vc deploy --cloudflare --provision` once, or set CLOUDFLARE_ACCOUNT_ID.",
+		};
+	}
+
+	const privateKey = derivePrivateKey(token, accountId);
+	const publicKey = await publicKeyFor(privateKey);
+	if (!publicKey) {
+		return { ok: false, reason: "@dotenvx/dotenvx is not installed here, so a key cannot be derived. `bun add -d @dotenvx/dotenvx`" };
+	}
+
+	const committed = committedPublicKey(root);
+	if (!committed) return { ok: true, privateKey, publicKey, fresh: true };
+
+	if (committed.toLowerCase() !== publicKey.toLowerCase()) {
+		return {
+			ok: false,
+			reason:
+				`this token does not derive the key ${SECRETS_FILE} was encrypted under.\n\n` +
+				`  encrypted under:  ${committed.slice(0, 16)}…\n` +
+				`  this token gives: ${publicKey.slice(0, 16)}…\n\n` +
+				"  That is one of three things, and all of them are the same fix:\n" +
+				"    · the token was rotated since the secrets were encrypted\n" +
+				"    · this is a different admin's token\n" +
+				"    · CLOUDFLARE_ACCOUNT_ID is not the account they were encrypted for\n\n" +
+				`  If you still have the ORIGINAL token, \`vc keys rotate\` re-encrypts\n` +
+				"  everything under the new one. If you do not, the values are unrecoverable\n" +
+				"  and must be entered again.",
+		};
+	}
+	return { ok: true, privateKey, publicKey, fresh: false };
+}
+
+/** `vc keys` — what the derivation says, without printing anything secret. */
+export async function keysCommand(manifest: Manifest, root: string, args: string[]): Promise<number> {
+	if (args.includes("--rotate")) return rotate(manifest, root);
+
+	const state = await keyFor(manifest, root);
+	console.log(`\nThe key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the account id.`);
+	console.log(color.dim("Nothing is stored, so nothing can leak — and nothing can be recovered.\n"));
+
+	if (!state.ok) {
+		console.error(`${color.red("✗")} ${state.reason}\n`);
+		return 1;
+	}
+	console.log(`  derives public key  ${state.publicKey.slice(0, 20)}…`);
+	console.log(
+		state.fresh
+			? `  ${color.dim(`${SECRETS_FILE} does not exist yet, so there is nothing to check against`)}`
+			: `  ${color.green("✓")} matches what ${SECRETS_FILE} was encrypted under`,
+	);
+	console.log(
+		color.yellow(
+			`\n! Rotating this API token makes every secret in ${SECRETS_FILE} unreadable.\n` +
+				"  Run `vc keys --rotate` with the NEW token exported and the old one in\n" +
+				"  CLOUDFLARE_API_TOKEN_OLD, BEFORE the old one stops working.\n",
+		),
+	);
+	return 0;
+}
+
+/**
+ * Re-encrypt under a new token's key, while the old one still works.
+ *
+ * This is the escape hatch that makes a derived key survivable, and it only
+ * exists in the window where both tokens are known. Outside that window there
+ * is no recovery, which is why `vc keys` says so every time it runs.
+ */
+async function rotate(manifest: Manifest, root: string): Promise<number> {
+	const oldToken = process.env["CLOUDFLARE_API_TOKEN_OLD"];
+	const newToken = apiToken();
+	if (!oldToken || !newToken) {
+		console.error(
+			"\nvc: rotation needs BOTH tokens:\n" +
+				"  CLOUDFLARE_API_TOKEN_OLD=<the one the secrets were encrypted under>\n" +
+				"  CLOUDFLARE_API_TOKEN=<the new one>\n\n" +
+				"  The old one is the only thing that can read the current values.\n",
+		);
+		return 1;
+	}
+	const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+	if (!accountId) {
+		console.error("vc: the account is not pinned, and it salts the derivation.");
+		return 1;
+	}
+	const oldKey = derivePrivateKey(oldToken, accountId);
+	const oldPublic = await publicKeyFor(oldKey);
+	const committed = committedPublicKey(root);
+	if (committed && oldPublic && committed.toLowerCase() !== oldPublic.toLowerCase()) {
+		console.error(`\nvc: CLOUDFLARE_API_TOKEN_OLD does not derive the key ${SECRETS_FILE} was encrypted under either.\n`);
+		return 1;
+	}
+	console.log(
+		`\nRotation is a decrypt with the old key and an encrypt with the new one.\n` +
+			`Run these two, in this order, from ${root}:\n\n` +
+			`  ${color.cyan(`DOTENV_PRIVATE_KEY_SECRETS=<old> bunx dotenvx decrypt -f ${SECRETS_FILE}`)}\n` +
+			`  ${color.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}   ${color.dim("# under the new derived key")}\n\n` +
+			color.dim("vc does not run them for you: the middle state is your secrets in\nplaintext on disk, and that is a moment to be deliberate about.\n"),
+	);
+	return 0;
+}

package/src/deploy/preflight.ts

@@ -7,6 +7,7 @@ import { workerHosts } from "../manifest";
 import type { Project } from "../project";
 import { captureVoid } from "../void";
 import { parseJsonc } from "./jsonc";
+import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames } from "./secrets";
 import { findWrangler, secretNames } from "./wrangler";
 
 /**
@@ -28,6 +29,8 @@ export interface Preflight {
 	remote: Set<string> | null;
 	missing: EnvKey[];
 	routeProblem: string | null;
+	/** Names in `.env.secrets` whose value was committed unencrypted. */
+	bareSecrets: string[];
 	ready: boolean;
 }
 
@@ -86,12 +89,29 @@ export async function preflight(project: Project, source: SecretSource): Promise
 	}
 	for (const name of remote ?? []) present.set(name, "<secret>");
 
+	/**
+	 * A secret the REPOSITORY declares counts as present, because the deploy
+	 * uploads it. The names are readable without the key — dotenvx encrypts
+	 * values, not keys — so this works on a machine that cannot decrypt.
+	 */
+	for (const name of declaredSecretNames(project.root)) present.set(name, "<in the repository>");
+
 	const missing = allEnvKeys(project.manifest).filter((key) => {
 		const value = present.get(key.key);
 		return value === undefined || value === "" || value === UNSET;
 	});
 	const problem = routeProblem(project);
-	return { present, remote, missing, routeProblem: problem, ready: missing.length === 0 && problem === null };
+	// A value committed in the clear is worse than a missing one: it is a
+	// leak that looks like it is working.
+	const bare = plaintextSecretNames(project.root);
+	return {
+		present,
+		remote,
+		missing,
+		routeProblem: problem,
+		bareSecrets: bare,
+		ready: missing.length === 0 && problem === null && bare.length === 0,
+	};
 }
 
 /** Print the report a person can act on. */
@@ -120,6 +140,12 @@ export function printPreflight(project: Project, result: Preflight, source: Secr
 	if (result.routeProblem) {
 		console.log(`${color.red("✗")} the worker's hostname\n    ${result.routeProblem}\n`);
 	}
+	if (result.bareSecrets.length > 0) {
+		console.log(
+			`${color.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}\n` +
+				`    Run \`dotenvx encrypt -f ${SECRETS_FILE}\` — and treat those values as burned.\n`,
+		);
+	}
 	for (const key of result.missing) {
 		console.log(`${color.red("✗")} ${key.key}`);
 		console.log(`    ${key.breaks}`);
@@ -128,8 +154,17 @@ export function printPreflight(project: Project, result: Preflight, source: Secr
 	}
 	const secrets = result.missing.filter((key) => !key.plaintext);
 	if (secrets.length > 0) {
-		console.log(source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
-		for (const key of secrets) console.log(`  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+		const inRepo = existsSync(join(project.root, SECRETS_FILE));
+		console.log(
+			inRepo
+				? `Put each in ${SECRETS_FILE}, which the deploy uploads:`
+				: source === "wrangler"
+					? "Set each secret on the worker (this also creates the draft worker on a first deploy):"
+					: "Set each secret on the project:",
+		);
+		for (const key of secrets) {
+			console.log(inRepo ? `  dotenvx set ${key.key} '…' -f ${SECRETS_FILE}` : `  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+		}
 	}
 	const plain = result.missing.filter((key) => key.plaintext);
 	if (plain.length > 0) console.log(`Values safe to commit go in .env.production: ${plain.map((k) => k.key).join(", ")}`);