@stravica-ai/digital-operator-pa 0.1.0

package/dist/engineering-pa-cli/src/secrets/commands/verify.mjs

@@ -0,0 +1,143 @@
+// verify --values --against <other-vault-path> — byte/value-level
+// comparison of DECRYPTED values between the working vault and a
+// reference vault (per scope).
+//
+// Never reports success on decrypt-alone. `--values` is REQUIRED — a
+// decrypt-only verification mode is not offered at all, because that is
+// exactly the false-pass class this command exists to catch: a vault
+// clobbered by an always-take-canonical materialisation still decrypts
+// cleanly (same recipients), so decrypt success alone told the operator
+// nothing about whether the CONTENT was right. Only a byte-level value
+// comparison against a known-good reference proves that (see
+// decrypt-only-vault-proof-false-pass, the estate incident this command
+// mirrors).
+//
+// Reports per-key same/differs/missing-in-working/missing-in-reference.
+// Never prints a decrypted VALUE to stdout/stderr — only the comparison
+// RESULT per key name — so a verify run is safe to paste into a log or a
+// chat without leaking secret material.
+
+import {
+  defaultPaths,
+  resolveScopePaths,
+  checkDeps,
+  depInstallMessage,
+  checkVault,
+  sopsDecrypt,
+  VaultError,
+} from '../vault.mjs';
+
+function parseVerifyArgs(args) {
+  let values = false;
+  let against;
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (a === '--values') { values = true; continue; }
+    if (a === '--against') { against = args[i + 1]; i += 1; continue; }
+    if (a.startsWith('--against=')) { against = a.slice('--against='.length); continue; }
+  }
+  return { values, against };
+}
+
+export async function runVerify(args, overrides = {}) {
+  const { values, against } = parseVerifyArgs(args);
+
+  if (!against) {
+    console.error('Usage: secrets verify --values --against <other-vault-path>');
+    throw new VaultError('usage: --against is required', 1);
+  }
+  if (!values) {
+    console.error(
+      'Error: secrets verify requires --values.\n'
+      + '  A decrypt-only verification mode is not offered — a clobbered store can still\n'
+      + '  decrypt cleanly with the WRONG content (stale copy, placeholder values, same\n'
+      + '  recipients), so decrypt success alone is never a valid pass signal. Pass\n'
+      + '  --values to run the real byte-level comparison.',
+    );
+    throw new VaultError('--values is required', 1);
+  }
+
+  const paths = overrides.paths || defaultPaths(overrides);
+
+  const missing = await checkDeps();
+  if (missing.length > 0) {
+    console.error(depInstallMessage(missing[0]));
+    throw new VaultError('missing dependencies', 1);
+  }
+
+  const vaultState = checkVault(paths);
+  if (!vaultState.ok) {
+    console.error(vaultState.message);
+    throw new VaultError(vaultState.reason || 'vault not initialised', vaultState.exitCode ?? 1);
+  }
+
+  // The reference vault is resolved the same way `--file` already works
+  // for every other scope-aware command: an arbitrary path, its own
+  // .sops.yaml expected alongside it. Reuses THIS host's key material —
+  // the reference vault must be decryptable by this host's age key for
+  // the comparison to be meaningful (mirrors the canonical-clone /
+  // workspace pairing, which shares recipients in practice).
+  const refPaths = overrides.refPaths || resolveScopePaths({
+    file: against,
+    keyDir: paths.keyDir,
+    keyFile: paths.keyFile,
+  });
+
+  let workingData;
+  try {
+    workingData = await sopsDecrypt(paths, paths.secretsFile);
+  } catch (err) {
+    const message = `Error: could not decrypt the working vault (${paths.secretsFile}): ${err.message}`;
+    console.error(message);
+    throw new VaultError(message, 2);
+  }
+
+  let refData;
+  try {
+    refData = await sopsDecrypt(refPaths, refPaths.secretsFile);
+  } catch (err) {
+    const message = `Error: could not decrypt the reference vault (${refPaths.secretsFile}): ${err.message}`;
+    console.error(message);
+    throw new VaultError(message, 2);
+  }
+
+  const allKeys = new Set([...Object.keys(workingData), ...Object.keys(refData)]);
+  const rows = [];
+  let anyDiff = false;
+  for (const key of [...allKeys].sort()) {
+    const inWorking = Object.prototype.hasOwnProperty.call(workingData, key);
+    const inRef = Object.prototype.hasOwnProperty.call(refData, key);
+    let status;
+    if (inWorking && inRef) {
+      status = workingData[key] === refData[key] ? 'same' : 'differs';
+    } else if (inWorking) {
+      status = 'missing-in-reference';
+    } else {
+      status = 'missing-in-working';
+    }
+    if (status !== 'same') anyDiff = true;
+    rows.push({ key, status });
+  }
+
+  console.log(`Comparing (working)   ${paths.secretsFile}`);
+  console.log(`     against (ref)    ${refPaths.secretsFile}`);
+  console.log('');
+  if (rows.length === 0) {
+    console.log('(both vaults are empty)');
+  } else {
+    const w = Math.max(3, ...rows.map((r) => r.key.length));
+    for (const r of rows) {
+      console.log(`  ${r.key.padEnd(w)}  ${r.status}`);
+    }
+  }
+  console.log('');
+
+  if (anyDiff) {
+    const diffCount = rows.filter((r) => r.status !== 'same').length;
+    console.log(`FAIL — ${diffCount} of ${rows.length} key(s) differ or are missing on one side.`);
+    throw new VaultError('value comparison found differences', 2);
+  }
+
+  console.log(`OK — all ${rows.length} key(s) match byte-for-byte.`);
+  return 0;
+}