@starci/hfs 4.11.0 → 4.11.11

package/runtime/scripts/hfs/secret-prompt.mjs

@@ -0,0 +1,128 @@
+// secret-prompt.mjs - the values `app secret set` seals: typed at a masked terminal prompt, read as KEY=value lines from
+// redirected stdin, or generated. A value stays in memory; the prompt echoes one `*` per character and nothing else.
+import fs from "node:fs";
+import { SecretError } from "./secret-errors.mjs";
+
+const ENTER = new Set(["\r", "\n"]);
+const ERASE = new Set(["\u007f", "\b"]);
+const INTERRUPT = "\u0003";
+const END = "\u0004";
+
+/**
+ * Read one line from a terminal with no echo: `input` a TTY read stream (raw mode while reading), `output` where the label and
+ * one `*` per character go (stderr, so stdout stays clean). Backspace erases, Enter ends, Ctrl+C or Ctrl+D on an empty line
+ * cancels. Resolves the typed text; the stream is paused, unreferenced (a waiting terminal never holds the process open) and
+ * its raw mode restored either way.
+ */
+export function promptHidden(label, { input = process.stdin, output = (s) => process.stderr.write(s) } = {}) {
+  return new Promise((resolve, reject) => {
+    const wasRaw = input.isRaw === true;
+    let typed = "";
+    const finish = (error) => {
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.setRawMode?.(wasRaw);
+      input.pause();
+      input.unref?.();
+      output("\n");
+      if (error) reject(error);
+      else resolve(typed);
+    };
+    const cancelled = () => new SecretError("cancelled at the prompt; nothing was sealed");
+    const onEnd = () => finish(typed ? null : cancelled());
+    const onData = (chunk) => {
+      for (const char of String(chunk)) {
+        if (ENTER.has(char)) return finish(null);
+        if (char === INTERRUPT || (char === END && !typed)) return finish(cancelled());
+        if (ERASE.has(char)) {
+          if (typed) {
+            typed = [...typed].slice(0, -1).join("");
+            output("\b \b");
+          }
+        } else if (char >= " ") {
+          typed += char;
+          output("*");
+        }
+      }
+      return undefined;
+    };
+    output(label);
+    input.setRawMode?.(true);
+    input.setEncoding?.("utf8");
+    input.on("data", onData);
+    input.on("end", onEnd);
+    input.ref?.();
+    input.resume();
+  });
+}
+
+/** Each key typed once at the terminal, in order; an empty value seals nothing. */
+async function typedValues(keys, prompt) {
+  const values = {};
+  for (const key of keys) {
+    const value = await prompt(`${key}: `);
+    if (!value) throw new SecretError(`${key} is empty; nothing was sealed`);
+    values[key] = value;
+  }
+  return values;
+}
+
+/**
+ * The values of `keys` in redirected stdin text: one key takes the whole text as its value (a trailing newline dropped, so a
+ * multi-line value survives); several take one `KEY=value` line each (blank and `#` lines skipped, the value after the first
+ * `=`, a trailing CR dropped), every key exactly once and no other.
+ */
+export function stdinValues(keys, text) {
+  if (keys.length === 1) {
+    const value = String(text).replace(/\r?\n$/u, "");
+    if (!value) throw new SecretError("the value on stdin is empty");
+    return { [keys[0]]: value };
+  }
+  const wanted = new Set(keys);
+  const values = Object.create(null);
+  for (const raw of String(text).split("\n")) {
+    const line = raw.replace(/\r$/u, "");
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const at = line.indexOf("=");
+    const key = at < 0 ? line.trim() : line.slice(0, at).trim();
+    if (at < 0) throw new SecretError(`stdin line for ${key} has no =; give one KEY=value line per key`);
+    if (!wanted.has(key)) throw new SecretError(`stdin names ${key}, which this set does not; nothing was sealed`);
+    if (Object.hasOwn(values, key)) throw new SecretError(`stdin gives ${key} twice; nothing was sealed`);
+    const value = line.slice(at + 1);
+    if (!value) throw new SecretError(`${key} is empty on stdin; nothing was sealed`);
+    values[key] = value;
+  }
+  const missing = keys.filter((key) => !Object.hasOwn(values, key));
+  if (missing.length) throw new SecretError(`stdin lacks ${missing.join(", ")}; give one KEY=value line per key; nothing was sealed`);
+  return { ...values };
+}
+
+/** The text of a `--from-file` value, byte for byte (a trailing newline kept); an empty file seals nothing. */
+function fileValue(key, file) {
+  let text;
+  try { text = fs.readFileSync(file, "utf8"); }
+  catch (error) { throw new SecretError(`--from-file ${key}: the file cannot be read (${error.code ?? "unreadable"})`); }
+  if (!text) throw new SecretError(`--from-file ${key}: the file is empty; nothing was sealed`);
+  return text;
+}
+
+/**
+ * The values `set` seals for `keys`: each `fromFile` key read byte for byte from its file; the rest from `--generate <bytes>`
+ * (random base64url per key), else the `stdin` port (a function returning the text, as the harness CLI hands a host key, or a
+ * stream with `fd` and `isTTY`): a terminal is prompted through `prompt` (promptHidden by default), anything else is read whole.
+ */
+export async function setValues(keys, { generate, stdin, prompt = promptHidden, random, fromFile = {} }) {
+  const files = Object.fromEntries(Object.entries(fromFile).map(([key, file]) => [key, fileValue(key, file)]));
+  const rest = keys.filter((key) => !Object.hasOwn(files, key));
+  if (!rest.length) return files;
+  if (generate !== undefined) {
+    const bytes = Number(generate);
+    if (!Number.isInteger(bytes) || bytes < 1 || bytes > 1024)
+      throw new SecretError("--generate must be a whole byte count from 1 to 1024");
+    return { ...files, ...Object.fromEntries(rest.map((key) => [key, random(bytes).toString("base64url")])) };
+  }
+  if (typeof stdin === "function") return { ...files, ...stdinValues(rest, stdin()) };
+  const source = stdin ?? process.stdin;
+  if (source.isTTY) return { ...files, ...(await typedValues(rest, prompt)) };
+  return { ...files, ...stdinValues(rest, fs.readFileSync(source.fd ?? 0, "utf8")) };
+}

package/runtime/scripts/hfs/secret-sops.mjs

@@ -5,24 +5,87 @@ import { runProgram } from "../api/process/run-program.mjs";
 import { resolveRealTool } from "../api/process/resolve-real-tool.mjs";
 import { decrypt as sopsDecrypt } from "../api/sops/decrypt.mjs";
 import { seal as sopsSeal } from "../api/sops/seal.mjs";
+import { updateKeys as sopsUpdateKeys } from "../api/sops/update-keys.mjs";
+import { isLegacyName } from "../lib/sealed-member.mjs";
 import { invocationDir } from "../lib/roots.mjs";
 import { envelopeOf } from "./secret-document.mjs";
-import { ageIdentityEnv, configuredRecipients, secretTools } from "./secret-init.mjs";
+import { configuredRecipients, localAgeIdentity, secretTools } from "./secret-init.mjs";
 import { outsideRepository, secretRoots } from "./secret-files.mjs";
 import { SecretError, publicStorage } from "./secret-errors.mjs";
 
 const sopsInvocation = Object.freeze({ runProgram, resolveRealTool });
 const AGE_IDENTITY_NAME = /^SOPS_AGE_KEY(?:_FILE)?$/i;
 
-/** The default sops seam: the runtime's sops api, which finds the binary on this machine. */
+/** The environment with no age identity selected: what a seal runs with. */
+const withoutIdentity = (env) =>
+  Object.fromEntries(Object.entries(env).filter(([name]) => !AGE_IDENTITY_NAME.test(name)));
+
+/** The KEY map of sops' JSON output: a flat object of string values, else refused naming no value. */
+function exactMap(stdout) {
+  let document;
+  try { document = JSON.parse(String(stdout)); }
+  catch { throw new SecretError("sops returned an invalid JSON document"); }
+  if (!document || typeof document !== "object" || Array.isArray(document))
+    throw new SecretError("sops returned an invalid JSON document");
+  const map = Object.create(null);
+  for (const [key, value] of Object.entries(document)) {
+    if (typeof value !== "string") throw new SecretError(`${key} is not a string value; a member holds string values only`);
+    map[key] = value;
+  }
+  return map;
+}
+
+/** The public age recipients a sealed member names, read without decrypting; none when it cannot be read. */
+function recipientsOf(file) {
+  try { return envelopeOf(fs.readFileSync(file, "utf8")).recipients; }
+  catch { return []; }
+}
+
+/**
+ * The refusal of a decrypt whose selected identity is not one `file` is sealed to: names where the identity came from and the
+ * member's recipients, and the two ways out. It carries no value.
+ */
+function identityMismatch(repoRoot, identity, file) {
+  const recipients = recipientsOf(file);
+  return new SecretError(
+    `the age identity of ${identity.source ?? "the environment"} does not open ${path.basename(file)}, ` +
+      `sealed to ${recipients.join(", ") || "another recipient"}. Fix: put that recipient's age secret key in ${path.join(repoRoot, ".claude", "secret.env")} as SOPS_AGE_KEY, ` +
+      "or, when no one holds it any more, seal the member's keys again (remove it and set them) after .sops.yaml names this identity's recipient",
+  );
+}
+
+/**
+ * The refusal of an operation that must decrypt `file` with no age identity selected: it names the recipient the member is
+ * sealed to, every place looked, and the one line that fixes it. It carries no value.
+ */
+function identityMissing(repoRoot, identity, file) {
+  const recipients = recipientsOf(file);
+  const sealedTo = recipients.length ? `, sealed to ${recipients.join(", ")}` : "";
+  const places = ["the environment (SOPS_AGE_KEY, SOPS_AGE_KEY_FILE)", ...identity.looked].join(", ");
+  return new SecretError(
+    `no age identity opens ${path.basename(file)}${sealedTo}; looked in ${places}. ` +
+      `Fix: add the line SOPS_AGE_KEY=<the age secret key of that recipient> to ${path.join(repoRoot, ".claude", "secret.env")} (git-ignored), ` +
+      "or set SOPS_AGE_KEY_FILE to the absolute path of its key file",
+  );
+}
+
+/**
+ * The default sops seam: the runtime's sops api, which finds the binary on this machine; the age identity is localAgeIdentity's
+ * (`host` its last source), then the legacy sops keys.txt. `identity` says where the age identity
+ * was found (`source`, null when nowhere) and where it was looked for; `requireIdentity(file)` refuses, before any value is
+ * read, an operation that must decrypt `file` with no identity.
+ */
 export function defaultSops(
   env = process.env,
   repoRoot = invocationDir(),
   platform = process.platform,
   tools = undefined,
+  host = null,
 ) {
   const { sops: binary } = publicStorage(() => secretTools(env, tools));
-  const selectedEnv = ageIdentityEnv(repoRoot, env, tools);
+  const local = localAgeIdentity(repoRoot, env, tools, host);
+  const selectedEnv = local.env;
+  const identity = { source: local.source, looked: [...local.looked] };
   const invocation = {
     runProgram: tools?.runProgram ?? sopsInvocation.runProgram,
     resolveRealTool: tools?.resolveRealTool ?? sopsInvocation.resolveRealTool,
@@ -49,11 +112,22 @@ export function defaultSops(
   if (
     !Object.keys(selectedEnv).some((name) => AGE_IDENTITY_NAME.test(name))
   ) {
-    const identity = secretRoots(env, platform).identity;
-    checkIdentity(identity);
-    if (fs.existsSync(identity)) selectedEnv.SOPS_AGE_KEY_FILE = identity;
+    const keys = secretRoots(env, platform).identity;
+    checkIdentity(keys);
+    identity.looked.push(keys);
+    if (fs.existsSync(keys)) {
+      selectedEnv.SOPS_AGE_KEY_FILE = keys;
+      identity.source = keys;
+    }
   }
-  const refuse = (what, result) => {
+  const requireIdentity = (file) => {
+    if (identity.source === null) throw identityMissing(repoRoot, identity, file);
+  };
+  const refuse = (what, result, file) => {
+    if (result.error?.identityRefusal === "identity-not-supplied" && file)
+      return identityMissing(repoRoot, identity, file);
+    if (result.error?.identityRefusal === "recipient-mismatch" && file)
+      return identityMismatch(repoRoot, identity, file);
     if (result.error?.identityRefusal)
       return Object.assign(new SecretError(result.error.message), {
         identityRefusal: result.error.identityRefusal,
@@ -65,17 +139,26 @@ export function defaultSops(
     );
   };
   return {
+    identity,
+    requireIdentity,
+    /**
+     * The KEY map of a member. A YAML or JSON member decrypts to JSON, so every value comes back byte for byte (a multi-line
+     * key, a trailing newline, a carriage return); a legacy dotenv member decrypts to dotenv, whose LF is escaped.
+     */
     decrypt(file, format) {
+      const exact = format === "yaml" || format === "json";
       const result = sopsDecrypt(
         binary,
-        ["decrypt", "--input-type", format, "--output-type", "dotenv", file],
+        ["decrypt", "--input-type", format, "--output-type", exact ? "json" : "dotenv", file],
         { env: selectedEnv, cwd: repoRoot, invocation },
       );
       if (result.status !== 0)
         throw refuse(
           `decrypt ${path.basename(file)}; is the age identity installed?`,
           result,
+          file,
         );
+      if (exact) return exactMap(result.stdout);
       const map = Object.create(null);
       for (const line of String(result.stdout).split(/\r?\n/u)) {
         if (!line || line.startsWith("#")) continue;
@@ -109,19 +192,35 @@ export function defaultSops(
         throw refuse(
           `decrypt ${path.basename(file)}; is the age identity installed?`,
           result,
+          file,
         );
       return String(result.stdout);
     },
+    /**
+     * Wraps member `file` again to the recipients its environment's rule of the app's .sops.yaml names (sops updatekeys): the
+     * selected identity opens the data key only, no value is decrypted, nothing is printed.
+     */
+    updateKeys(file) {
+      const result = sopsUpdateKeys(
+        binary,
+        { file: path.resolve(file), config: path.join(path.resolve(repoRoot), ".sops.yaml"), inputType: isLegacyName(file) ? "dotenv" : "yaml" },
+        { env: selectedEnv, cwd: repoRoot, invocation },
+      );
+      if (result.status !== 0)
+        throw refuse(`update the keys of ${path.basename(file)}; is the age identity a recipient of it?`, result, file);
+    },
     seal(request) {
       const recipients = request.recipients.length
         ? request.recipients
         : publicStorage(() =>
             configuredRecipients(repoRoot, request.filenameOverride),
           );
+      // Sealing needs only public recipients, so it runs with no identity selected and may name several (an environment's
+      // server key and the owner key both).
       const result = sopsSeal(
         binary,
         { ...request, recipients },
-        { env: selectedEnv, cwd: repoRoot, invocation },
+        { env: withoutIdentity(selectedEnv), cwd: repoRoot, invocation },
       );
       if (result.status !== 0) throw refuse("seal the secret", result);
       return result.stdout;