@webda/core 4.0.0-beta.5 → 4.0.0-beta.7

package/lib/services/cryptoservice.service.js

@@ -36,35 +36,99 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, generateKeyPa
 import jwt from "jsonwebtoken";
 import { pem2jwk } from "pem-jwk";
 import * as util from "util";
-import { JSONUtils } from "@webda/utils";
+import { FileUtils, JSONUtils } from "@webda/utils";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { deepmerge } from "deepmerge-ts";
+import { AuthenticatedEncryption } from "./authenticatedencryption.js";
+import { checkKid, parsePkiValue, PKI_MIN_BITS, PkiKeyring, pkiEncrypter } from "./pki.encrypter.js";
+import { CodeError } from "../errors/errors.js";
 import { getMachineId, useCore, useService } from "../core/hooks.js";
-import { useLog } from "../loggers/hooks.js";
+import { useLog, useOutput } from "../loggers/hooks.js";
 import { Service } from "./service.js";
+import { Command } from "./command.js";
 import { Route } from "../rest/irest.js";
 import { useRegistry } from "../models/registry.model.js";
-/** Wraps a secret string value, masking it in logs and inspect output */
+import { useApplication } from "../application/hooks.js";
+import { findConfigurationSecrets, OPT_OUT_ENCRYPTER, secretPathExcluder } from "./secretscheck.js";
+/**
+ * Masked representation of a secret
+ */
+const SECRET_MASK = "********";
+/**
+ * A secret value decrypted from a `crypt:<encrypter>:<data>` configuration string
+ *
+ * The plain value is only available through {@link SecretString.getValue}: string
+ * conversion, `JSON.stringify` and `util.inspect` all return a mask, so the secret
+ * does not leak into logs, configuration dumps or serialized services.
+ *
+ * In a service parameters class, type a secret field as `string | SecretString`
+ * and read it with {@link SecretString.from}.
+ *
+ * `@secret` marks every property typed with this class as a secret in the generated
+ * schema (`x-webda-secret`), so `webda config encrypt` encrypts it and `--check` reports it when it is not encrypted.
+ *
+ * @type string
+ * @secret
+ */
 export class SecretString {
-    str;
+    /**
+     * Plain value, kept out of the enumerable properties
+     */
+    #value;
+    /**
+     * Name of the encrypter that decrypted the value
+     */
     encrypter;
     /** Create a new SecretString
      * @param str - the secret value
-     * @param encrypter - the encrypter service name
+     * @param encrypter - the encrypter name
      */
     constructor(str, encrypter) {
-        this.str = str;
+        this.#value = str;
         this.encrypter = encrypter;
     }
     /**
      * Extract the plain string value, warning if the string is not encrypted
-     * @param value - the value to set
-     * @param path - the path
-     * @returns the result string
+     *
+     * The warning never contains the value itself, only the optional path.
+     *
+     * @param value - the secret, or a plain string
+     * @param path - the configuration path of the value, used in the warning
+     * @returns the plain value
      */
     static from(value, path) {
         if (value instanceof SecretString) {
             return value.getValue();
         }
-        useLog("WARN", "A secret string is not encrypted", value);
+        if (value !== undefined && value !== null && value !== "") {
+            useLog("WARN", `A secret is not encrypted${path ? ` (${path})` : ""}, use 'webda config encrypt'`);
+        }
+        return value;
+    }
+    /**
+     * Replace every SecretString in a structure by its plain value
+     *
+     * Use it to pass a configuration object holding secrets to a third-party client
+     * that expects plain strings. The structure is copied, not modified.
+     *
+     * @param value - the structure to unwrap
+     * @returns a copy with plain values
+     */
+    static unwrap(value) {
+        if (value instanceof SecretString) {
+            return value.getValue();
+        }
+        if (Array.isArray(value)) {
+            return value.map(v => SecretString.unwrap(v));
+        }
+        if (isPlainObject(value)) {
+            const res = {};
+            for (const [key, v] of Object.entries(value)) {
+                res[key] = SecretString.unwrap(v);
+            }
+            return res;
+        }
         return value;
     }
     /**
@@ -72,14 +136,21 @@ export class SecretString {
      * @returns the result string
      */
     getValue() {
-        return this.str;
+        return this.#value;
     }
     /**
      * Return a masked representation to prevent secret leakage
      * @returns the result string
      */
     toString() {
-        return "********";
+        return SECRET_MASK;
+    }
+    /**
+     * Return a masked representation to prevent secret leakage through JSON
+     * @returns the result string
+     */
+    toJSON() {
+        return SECRET_MASK;
     }
     /**
      * Custom inspect handler to mask the secret in Node.js util.inspect
@@ -89,15 +160,118 @@ export class SecretString {
      * @returns the result
      */
     [util.inspect.custom](depth, options, inspect) {
-        return "********";
+        return SECRET_MASK;
+    }
+}
+/**
+ * Check if a value is a plain object or an object without prototype
+ *
+ * Class instances (SecretString, Duration...) are not plain objects.
+ *
+ * @param value - the value to test
+ * @returns true for a plain object
+ */
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object") {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * An encrypted configuration value
+ *
+ * - `encrypt:[<encrypter>:]<plain>` and `sencrypt:[<encrypter>:]<plain>` mark a value to encrypt
+ * - `crypt:<encrypter>:<data>` decrypts to a {@link SecretString}
+ * - `scrypt:<encrypter>:<data>` decrypts to a plain string
+ */
+const CONFIGURATION_VALUE = /^(s?)(encrypt|crypt):([\s\S]+)$/;
+/**
+ * The `<encrypter>:<data>` part of a configuration value
+ */
+const ENCRYPTER_SEGMENT = /^([A-Za-z0-9_.-]+):([\s\S]*)$/;
+/**
+ * Parse an encrypted or to-encrypt configuration value
+ *
+ * `crypt:` and `scrypt:` values always name their encrypter. For `encrypt:` and `sencrypt:`, the
+ * first segment is the encrypter when it is a registered encrypter name: otherwise the whole
+ * remainder is the plain value, encrypted by the default encrypter.
+ *
+ * @param value - the configuration value
+ * @param defaultEncrypter - the encrypter of `encrypt:<value>`
+ * @returns undefined if the value is not an encryption string
+ */
+export function parseEncryptedValue(value, defaultEncrypter) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const match = CONFIGURATION_VALUE.exec(value);
+    if (!match) {
+        return undefined;
+    }
+    const plain = match[1] === "s";
+    const mode = match[2];
+    const segment = ENCRYPTER_SEGMENT.exec(match[3]);
+    if (mode === "crypt") {
+        return segment ? { plain, mode, encrypter: segment[1], data: segment[2], explicit: true } : undefined;
+    }
+    if (segment && (CryptoService.getEncrypter(segment[1]) || !defaultEncrypter)) {
+        // A registered encrypter, or an unknown one reported as such when there is no default
+        return { plain, mode, encrypter: segment[1], data: segment[2], explicit: true };
+    }
+    return { plain, mode, encrypter: defaultEncrypter, data: match[3], explicit: false };
+}
+/**
+ * Path of the encryption settings in a configuration
+ */
+const SETTINGS_PATH = "parameters.configurationEncryption";
+/**
+ * Check that the encryption settings hold no encrypted value
+ * @param settings - the settings
+ * @param path - the path, for messages
+ * @returns the settings
+ */
+function checkEncryptionSettings(settings, path = SETTINGS_PATH) {
+    if (settings instanceof SecretString || /^s?crypt:/.test(typeof settings === "string" ? settings : "")) {
+        throw new CodeError("CONFIGURATION_ENCRYPTION_INVALID", `${path} cannot be encrypted`);
+    }
+    if (settings !== null && typeof settings === "object") {
+        for (const [key, value] of Object.entries(settings)) {
+            checkEncryptionSettings(value, `${path}.${key}`);
+        }
     }
+    return settings;
+}
+/**
+ * Get the application path, the current directory without application
+ * @returns the path
+ */
+function getAppPath() {
+    try {
+        return useApplication().getPath();
+    }
+    catch {
+        return process.cwd();
+    }
+}
+/**
+ * Format a configuration path for messages
+ * @param path - the path segments
+ * @returns the dotted path
+ */
+function formatPath(path) {
+    return path.length ? path.join(".") : "<root>";
 }
 /**
  * @WebdaModda
  */
 let CryptoService = (() => {
     let _classSuper = Service;
+    let _staticExtraInitializers = [];
     let _instanceExtraInitializers = [];
+    let _static_encryptConfigurationFile_decorators;
+    let _static_pkiGenerate_decorators;
+    let _static_pkiList_decorators;
     let _serveJWKS_decorators;
     return class CryptoService extends _classSuper {
         static {
@@ -108,23 +282,73 @@ let CryptoService = (() => {
                         operationId: "getJWKS"
                     }
                 })];
+            _static_encryptConfigurationFile_decorators = [Command("config encrypt", {
+                    description: "Encrypt the secrets of the configuration files, or check them with --check",
+                    // No Core: runs without decrypting the configuration, its sources or the private keys
+                    phase: "application"
+                })];
+            _static_pkiGenerate_decorators = [Command("config pki generate", {
+                    description: "Generate a key pair for the pki configuration encrypter",
+                    // No Core: runs without decrypting the configuration, its sources or the private keys
+                    phase: "application"
+                })];
+            _static_pkiList_decorators = [Command("config pki list", {
+                    description: "List the pki keys and the values encrypted with each of them",
+                    // No Core: runs without decrypting the configuration, its sources or the private keys
+                    phase: "application"
+                })];
+            __esDecorate(this, null, _static_encryptConfigurationFile_decorators, { kind: "method", name: "encryptConfigurationFile", static: true, private: false, access: { has: obj => "encryptConfigurationFile" in obj, get: obj => obj.encryptConfigurationFile }, metadata: _metadata }, null, _staticExtraInitializers);
+            __esDecorate(this, null, _static_pkiGenerate_decorators, { kind: "method", name: "pkiGenerate", static: true, private: false, access: { has: obj => "pkiGenerate" in obj, get: obj => obj.pkiGenerate }, metadata: _metadata }, null, _staticExtraInitializers);
+            __esDecorate(this, null, _static_pkiList_decorators, { kind: "method", name: "pkiList", static: true, private: false, access: { has: obj => "pkiList" in obj, get: obj => obj.pkiList }, metadata: _metadata }, null, _staticExtraInitializers);
             __esDecorate(this, null, _serveJWKS_decorators, { kind: "method", name: "serveJWKS", static: false, private: false, access: { has: obj => "serveJWKS" in obj, get: obj => obj.serveJWKS }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static encrypters = {};
+        static encrypters = (__runInitializers(this, _staticExtraInitializers), {});
         /**
          * Register an encrypter for configuration
-         * @param name - the name to use
+         *
+         * Values written as `encrypt:<name>:<plain>` are then encrypted by it with `webda config encrypt`,
+         * and `crypt:<name>:<data>` values are decrypted by it when the configuration is loaded.
+         *
+         * Register it as a side effect of a module that the application loads (a Modda file), so it is
+         * available before the services are created.
+         *
+         * @param name - the name to use, letters, digits, `_`, `-` and `.` only
          * @param encrypter - the encrypter implementation
-         * @param encrypter.encrypt - the encrypter.encrypt
-         * @param encrypter.decrypt - the encrypter.decrypt
          */
         static registerEncrypter(name, encrypter) {
-            if (CryptoService.encrypters[name]) {
-                console.error("Encrypter", name, "already registered");
+            if (!/^[A-Za-z0-9_.-]+$/.test(name)) {
+                throw new Error(`Invalid encrypter name '${name}'`);
+            }
+            if (CryptoService.encrypters[name] && CryptoService.encrypters[name] !== encrypter) {
+                useLog("WARN", `Encrypter '${name}' already registered, replacing it`);
             }
             CryptoService.encrypters[name] = encrypter;
         }
+        /**
+         * Get a registered encrypter
+         * @param name - the encrypter name
+         * @returns the encrypter or undefined
+         */
+        static getEncrypter(name) {
+            return CryptoService.encrypters[name];
+        }
+        /**
+         * Get the encrypter for a value, with a helpful error if missing
+         * @param name - the encrypter name
+         * @param path - the configuration path, for the error message
+         * @returns the encrypter
+         */
+        static requireEncrypter(name, path) {
+            const encrypter = CryptoService.encrypters[name];
+            if (!encrypter) {
+                const hint = name === "self"
+                    ? " ('self' is only available once a CryptoService is initialized, it cannot be used in the configuration)"
+                    : ` (registered: ${Object.keys(CryptoService.encrypters).join(", ")})`;
+                throw new Error(`Unknown encrypter '${name}' at ${formatPath(path)}${hint}`);
+            }
+            return encrypter;
+        }
         currentSymetricKey = __runInitializers(this, _instanceExtraInitializers);
         currentAsymetricKey;
         current;
@@ -200,7 +424,9 @@ let CryptoService = (() => {
         generateAsymetricKeys() {
             const { publicKey, privateKey } = generateKeyPairSync(
             // @ts-ignore
-            this.parameters.asymetricType, this.parameters.asymetricOptions);
+            this.parameters.asymetricType, 
+            // The private key passphrase can be an encrypted configuration value
+            SecretString.unwrap(this.parameters.asymetricOptions));
             return { publicKey: publicKey, privateKey: privateKey };
         }
         /**
@@ -267,7 +493,8 @@ let CryptoService = (() => {
          * @returns the result string
          */
         async jwtSign(data, options) {
-            const res = { ...this.parameters.jwt, ...options };
+            // Encrypted configuration values (secretOrPublicKey) are unwrapped to plain strings
+            const res = SecretString.unwrap({ ...this.parameters.jwt, ...options });
             let key = res.secretOrPublicKey;
             // Default to our current private key
             if (!res.secretOrPublicKey) {
@@ -336,6 +563,8 @@ let CryptoService = (() => {
          * @returns the result
          */
         async jwtVerify(token, options) {
+            // Encrypted configuration values (secretOrPublicKey) are unwrapped to plain strings
+            options = SecretString.unwrap(options);
             return new Promise((resolve, reject) => {
                 jwt.verify(token, options?.secretOrPublicKey || this.getJWTKey.bind(this), {
                     ...options,
@@ -378,63 +607,507 @@ let CryptoService = (() => {
             return JSON.parse(Buffer.from(token.split(".")[0], "base64").toString());
         }
         /**
-         * Encrypt configuration
-         * @param data - the data to process
-         * @returns the result
+         * Start an encryption or decryption pass
+         * @param data - the configuration
+         * @param options - the options
+         * @param path - the path of data
+         * @param mode - encrypt or decrypt
+         * @returns the pass
          */
-        static async encryptConfiguration(data) {
-            if (data instanceof Object) {
-                for (const i in data) {
-                    data[i] = await CryptoService.encryptConfiguration(data[i]);
+        static startPass(data, options, path, mode) {
+            // Read the settings from the configuration itself when given the whole configuration
+            const settings = options.settings ?? (path.length === 0 ? data?.parameters?.configurationEncryption : undefined);
+            return {
+                settings: checkEncryptionSettings(settings ?? {}),
+                context: { appPath: options.appPath ?? getAppPath(), mode },
+                configured: new Set()
+            };
+        }
+        /**
+         * Get an encrypter, configured for this pass
+         * @param name - the encrypter name
+         * @param pass - the current pass
+         * @param path - the configuration path, for messages
+         * @returns the encrypter
+         */
+        static async useEncrypter(name, pass, path) {
+            const encrypter = CryptoService.requireEncrypter(name, path);
+            if (encrypter.configure && !pass.configured.has(name)) {
+                pass.configured.add(name);
+                await encrypter.configure(pass.settings.encrypters?.[name] ?? {}, pass.context);
+            }
+            return encrypter;
+        }
+        /**
+         * Encrypt the `encrypt:[<encrypter>:]<plain>` and `sencrypt:[<encrypter>:]<plain>` values of a configuration
+         *
+         * The structure is modified in place, so a comment-preserving document loaded with
+         * `FileUtils.load` can be saved back with its comments.
+         *
+         * `encrypt:<plain>` uses the default encrypter, `parameters.configurationEncryption.default`. The output
+         * always names its encrypter.
+         *
+         * @param data - the configuration, or a single value
+         * @param options - options
+         * @param options.migrate - also re-encrypt the already encrypted values with this encrypter, with the
+         *   default encrypter when `""`, or with their own encrypter when `true` (same as `upgrade`)
+         * @param options.upgrade - also re-encrypt the already encrypted values with their own encrypter, to its
+         *   current format or key
+         * @param path - the path of data, for error messages
+         * @returns the encrypted data
+         */
+        static async encryptConfiguration(data, options = {}, path = []) {
+            const pass = CryptoService.startPass(data, options, path, "encrypt");
+            pass.migrate = typeof options.migrate === "string" ? options.migrate : undefined;
+            pass.upgrade = options.upgrade || options.migrate === true;
+            if (pass.migrate === "") {
+                pass.migrate = pass.settings.default;
+                if (!pass.migrate) {
+                    throw new Error(`No default encrypter to migrate to, set ${SETTINGS_PATH}.default`);
                 }
             }
-            else if (typeof data === "string") {
-                if (data.startsWith("encrypt:") || data.startsWith("sencrypt:")) {
-                    let str = data.substring(data.indexOf(":") + 1);
-                    const type = str.substring(0, str.indexOf(":"));
-                    str = str.substring(str.indexOf(":") + 1);
-                    if (!CryptoService.encrypters[type]) {
-                        throw new Error("Unknown encrypter " + type);
-                    }
-                    if (data.startsWith("s")) {
-                        data = `scrypt:${type}:` + (await CryptoService.encrypters[type].encrypt(str));
+            return CryptoService.encryptValues(data, pass, path);
+        }
+        /**
+         * Encrypt the values of a configuration, see {@link encryptConfiguration}
+         * @param data - the configuration, or a single value
+         * @param pass - the current pass
+         * @param path - the path of data
+         * @returns the encrypted data
+         */
+        static async encryptValues(data, pass, path) {
+            if (data !== null && typeof data === "object" && !(data instanceof SecretString)) {
+                for (const i in data) {
+                    // The encryption settings are never encrypted
+                    if (path.length === 1 && path[0] === "parameters" && i === "configurationEncryption") {
+                        continue;
                     }
-                    else {
-                        data = `crypt:${type}:` + (await CryptoService.encrypters[type].encrypt(str));
+                    data[i] = await CryptoService.encryptValues(data[i], pass, [...path, i]);
+                }
+                return data;
+            }
+            const parsed = parseEncryptedValue(data, pass.settings.default);
+            if (!parsed) {
+                return data;
+            }
+            let { encrypter, data: plain } = parsed;
+            if (parsed.mode === "crypt") {
+                // An opted-out value stays in clear text, it is not migrated to another encrypter
+                if ((!pass.migrate && !pass.upgrade) || encrypter === OPT_OUT_ENCRYPTER) {
+                    return data;
+                }
+                const target = pass.migrate || encrypter;
+                if (target === encrypter) {
+                    const current = await CryptoService.useEncrypter(encrypter, pass, path);
+                    if (current.needsUpgrade && !current.needsUpgrade(parsed.data)) {
+                        return data;
                     }
                 }
+                plain = await CryptoService.decryptValue(encrypter, parsed.data, path, pass);
+                encrypter = target;
+            }
+            else if (!encrypter) {
+                throw new Error(`No default encrypter for the value at ${formatPath(path)}, set ${SETTINGS_PATH}.default`);
+            }
+            else if (!CryptoService.getEncrypter(encrypter) && !pass.settings.default) {
+                throw new Error(`Unknown encrypter '${encrypter}' at ${formatPath(path)} (registered: ${Object.keys(CryptoService.encrypters).join(", ")}), ` +
+                    `or set ${SETTINGS_PATH}.default to encrypt the whole value with the default encrypter`);
+            }
+            const encrypted = await (await CryptoService.useEncrypter(encrypter, pass, path)).encrypt(plain);
+            return `${parsed.plain ? "s" : ""}crypt:${encrypter}:${encrypted}`;
+        }
+        /**
+         * Decrypt one value with an encrypter, with a message that never contains the value
+         * @param encrypter - the encrypter name
+         * @param data - the encrypted data
+         * @param path - the configuration path
+         * @param pass - the current pass, to configure the encrypter
+         * @returns the plain value
+         */
+        static async decryptValue(encrypter, data, path, pass) {
+            const impl = pass
+                ? await CryptoService.useEncrypter(encrypter, pass, path)
+                : CryptoService.requireEncrypter(encrypter, path);
+            try {
+                return await impl.decrypt(data);
+            }
+            catch (err) {
+                throw new Error(`Cannot decrypt the value at ${formatPath(path)} with encrypter '${encrypter}': ${err.message}`);
+            }
+        }
+        /**
+         * Decrypt the `crypt:` and `scrypt:` values of a configuration
+         *
+         * - `crypt:<encrypter>:<data>` becomes a {@link SecretString}
+         * - `scrypt:<encrypter>:<data>` becomes a plain string, for a module that cannot handle SecretString
+         *
+         * The input is not modified: a decrypted copy is returned. Only plain objects and
+         * arrays are traversed.
+         *
+         * A value still marked `encrypt:` is kept as is, with a warning.
+         *
+         * @param data - the configuration, or a single value
+         * @param path - the path of data, for messages
+         * @param options - the encryption settings and the application path
+         * @returns the decrypted copy
+         */
+        static async decryptConfiguration(data, path = [], options = {}) {
+            return CryptoService.decryptValues(data, CryptoService.startPass(data, options, path, "decrypt"), path);
+        }
+        /**
+         * Decrypt the values of a configuration, see {@link decryptConfiguration}
+         * @param data - the configuration, or a single value
+         * @param pass - the current pass
+         * @param path - the path of data
+         * @returns the decrypted copy
+         */
+        static async decryptValues(data, pass, path) {
+            if (Array.isArray(data)) {
+                const res = [];
+                for (let i = 0; i < data.length; i++) {
+                    res.push(await CryptoService.decryptValues(data[i], pass, [...path, i]));
+                }
+                return res;
             }
-            return data;
+            if (isPlainObject(data)) {
+                const res = {};
+                for (const i of Object.keys(data)) {
+                    res[i] = await CryptoService.decryptValues(data[i], pass, [...path, i]);
+                }
+                return res;
+            }
+            const parsed = parseEncryptedValue(data);
+            if (!parsed) {
+                return data;
+            }
+            if (parsed.mode === "encrypt") {
+                useLog("WARN", `The value at ${formatPath(path)} is marked for encryption but not encrypted, run 'webda config encrypt'`);
+                return data;
+            }
+            const plain = await CryptoService.decryptValue(parsed.encrypter, parsed.data, path, pass);
+            return parsed.plain ? plain : new SecretString(plain, parsed.encrypter);
+        }
+        /**
+         * Get the encryption settings of the application, merged with the ones of a configuration file
+         * @param data - the configuration file content
+         * @returns the settings
+         */
+        static getEncryptionSettings(data) {
+            return checkEncryptionSettings(deepmerge(useApplication().getConfiguration()?.parameters?.configurationEncryption ?? {}, data?.parameters?.configurationEncryption ?? {}));
         }
         /**
+         * Encrypt the marked values of a configuration file, keeping its comments
          *
-         * @param data - the data to process
-         * @returns the result
+         * Prefix a value with `encrypt:[<encrypter>:]` (SecretString once decrypted) or
+         * `sencrypt:[<encrypter>:]` (plain string once decrypted) then run this command.
+         *
+         * @param file - the configuration file (json, jsonc or yaml) to update
+         * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+         * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+         * @returns the number of values changed
          */
-        static async decryptConfiguration(data) {
-            if (data instanceof Object) {
-                for (const i in data) {
-                    data[i] = await CryptoService.decryptConfiguration(data[i]);
+        async encryptConfigurationFile(file, migrate, upgrade) {
+            return CryptoService.encryptFile(file, migrate, upgrade);
+        }
+        /**
+         * Encrypt the secrets of the configuration files, keeping their comments, or check them
+         *
+         * Encrypts the values marked `encrypt:` or `sencrypt:`, and the plain values of the secret fields: the fields
+         * typed `SecretString` or tagged `@secret` in their service parameters, marked `x-webda-secret` in the compiled
+         * schemas. The plain secrets are encrypted with the default encrypter.
+         *
+         * Without `file`, it updates the application configuration and the file of the selected deployment.
+         *
+         * With `check`, nothing is written: it fails when a secret is not encrypted. It needs no key, so it runs in CI.
+         * Only the paths are reported, never the values.
+         *
+         * It only needs the loaded application: the configuration is not decrypted and no service is created.
+         *
+         * @param file - the configuration file (json, jsonc or yaml) to update
+         * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+         * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+         * @param check - only check that the secrets are encrypted, write nothing
+         * @param strict - with check, report the values still marked `encrypt:` as failures
+         * @param format - with check, output format: text or json
+         * @param none - with check, accept the values kept in clear text with `crypt:none:`, false to fail on them
+         * @param exclude - secret paths to leave alone, comma-separated: not checked, not auto-encrypted
+         * @returns with check, 1 when a secret is not encrypted, otherwise 0
+         */
+        static async encryptConfigurationFile(
+        /** @alias f @description Configuration file to update (json, jsonc or yaml), the application and deployment files by default */
+        file, 
+        /** @description Re-encrypt the already encrypted values with this encrypter, the default one when empty */
+        migrate, 
+        /** @description Re-encrypt the already encrypted values with their own encrypter, to its current format or key */
+        upgrade, 
+        /** @description Only check that the secrets are encrypted, write nothing and fail if one is not */
+        check = false, 
+        /** @description With --check, report the values marked encrypt: as failures */
+        strict = true, 
+        /** @description With --check, output format: text or json */
+        format = "text", 
+        /** @description With --check, accept the values kept in clear text with crypt:none: (--no-none to fail on them) */
+        none = true, 
+        /** @description Secret paths to leave alone, comma-separated (services.demo.password, units[*].token, $.parameters.**) */
+        exclude) {
+            const files = CryptoService.getConfigurationFiles(file);
+            if (check) {
+                return CryptoService.checkFiles(files, { strict, format, none, exclude });
+            }
+            // The count is logged, not returned: a command result is its exit code
+            for (const filename of files) {
+                await CryptoService.encryptFile(filename, migrate, upgrade, exclude);
+            }
+            return 0;
+        }
+        /**
+         * The configuration files to encrypt or check
+         * @param file - the file given on the command line
+         * @returns the absolute paths: the file, or the application configuration and the selected deployment file
+         */
+        static getConfigurationFiles(file) {
+            const app = useApplication();
+            if (file) {
+                return [resolve(app.getPath(), file)];
+            }
+            const files = [app.configurationFile, app.getDeployment() ? app.deploymentFile : undefined].filter(f => f && existsSync(f));
+            if (!files.length) {
+                throw new Error("No configuration file found, use --file");
+            }
+            return files;
+        }
+        /**
+         * Check that the secrets of configuration files are encrypted
+         * @param files - the files to check
+         * @param options - check options
+         * @param options.strict - report the values still marked `encrypt:` as failures
+         * @param options.format - output format: text or json
+         * @param options.none - accept the values kept in clear text with `crypt:none:`
+         * @param options.exclude - secret paths not checked, comma-separated
+         * @returns 1 when a secret is not encrypted, 0 otherwise
+         */
+        static checkFiles(files, options = {}) {
+            const { strict = true, format = "text", none = true, exclude } = options;
+            const app = useApplication();
+            const failures = [];
+            const warnings = [];
+            for (const filename of files) {
+                // Same report on every OS: forward slashes
+                const file = (relative(app.getPath(), filename) || filename).replace(/\\/g, "/");
+                // Plain JSON: the comment-preserving loader returns wrapper objects
+                const findings = CryptoService.findFileSecrets(JSON.parse(JSON.stringify(FileUtils.load(filename))), exclude);
+                for (const finding of findings) {
+                    const failure = finding.reason === "plain" ||
+                        (strict && finding.reason === "marked") ||
+                        (!none && finding.reason === "opted-out");
+                    const message = {
+                        plain: "secret is not encrypted",
+                        marked: "secret is marked encrypt: but not encrypted, run 'webda config encrypt'",
+                        "opted-out": "secret is kept in clear text on purpose (crypt:none:)"
+                    }[finding.reason];
+                    useLog(failure ? "ERROR" : "WARN", `${failure ? "✗" : "!"} ${file}: ${finding.path} (${finding.type}): ${message}`);
+                    const { location: _location, ...reported } = finding;
+                    (failure ? failures : warnings).push({ file, ...reported });
                 }
             }
-            else if (typeof data === "string") {
-                if (data.startsWith("crypt:") || data.startsWith("scrypt:")) {
-                    let str = data.substring(data.indexOf(":") + 1);
-                    const type = str.substring(0, str.indexOf(":"));
-                    str = str.substring(str.indexOf(":") + 1);
-                    if (!CryptoService.encrypters[type]) {
-                        throw new Error("Unknown encrypter " + type);
-                    }
-                    // We keep the ability to map to a simple string for incompatible module
-                    if (data.startsWith("scrypt:")) {
-                        return await CryptoService.encrypters[type].decrypt(str);
-                    }
-                    else {
-                        return new SecretString(await CryptoService.encrypters[type].decrypt(str), type);
-                    }
+            if (format === "json") {
+                useOutput(JSON.stringify({ findings: failures, warnings }, undefined, 2));
+            }
+            else {
+                const optedOut = warnings.filter(w => w.reason === "opted-out").length;
+                useOutput((failures.length ? `${failures.length} unencrypted secret(s) found` : "No unencrypted secret found") +
+                    (optedOut ? `, ${optedOut} kept in clear text on purpose` : ""));
+            }
+            return failures.length ? 1 : 0;
+        }
+        /**
+         * Find the unencrypted secrets of a configuration or deployment file
+         *
+         * A service the file overrides without its type takes the type of the application configuration, and the
+         * file `parameters` are also checked against the services of the application.
+         *
+         * @param data - the file content, as plain JSON
+         * @param exclude - secret paths to leave out, comma-separated patterns, see {@link secretPathExcluder}
+         * @returns the findings, with their location in data, without the values
+         */
+        static findFileSecrets(data, exclude) {
+            const app = useApplication();
+            const services = app.getConfiguration().services ?? {};
+            const { findings, unknownTypes } = findConfigurationSecrets({ services: data?.services, parameters: data?.parameters, resources: data?.resources, units: data?.units }, {
+                getSchema: type => app.getSchema(type),
+                // Same resolution as the services: the application namespace, then Webda
+                completeNamespace: type => {
+                    const namespaced = app.completeNamespace(type);
+                    return app.getSchema(namespaced) || type.includes("/") ? namespaced : `Webda/${type}`;
+                },
+                getType: name => services[name]?.type,
+                inheritingServices: services
+            });
+            for (const type of unknownTypes) {
+                useLog("WARN", `No schema for service type ${type}, its secrets are not checked`);
+            }
+            const excluded = secretPathExcluder(exclude);
+            return findings.filter(finding => {
+                if (!excluded(finding.path))
+                    return true;
+                useLog("DEBUG", `Secret ${finding.path} excluded`);
+                return false;
+            });
+        }
+        /**
+         * Encrypt the secrets of a configuration file, keeping its comments
+         *
+         * The values marked `encrypt:` or `sencrypt:`, and the plain values of the secret fields, with the default
+         * encrypter.
+         *
+         * @param file - the configuration file (json, jsonc or yaml) to update
+         * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+         * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+         * @param exclude - secret paths not auto-encrypted, comma-separated patterns, see {@link secretPathExcluder}
+         * @returns the number of values changed
+         */
+        static async encryptFile(file, migrate, upgrade, exclude) {
+            const filename = resolve(useApplication().getPath(), file);
+            const data = FileUtils.load(filename);
+            const before = JSON.stringify(data);
+            const settings = CryptoService.getEncryptionSettings(data);
+            const plain = CryptoService.findFileSecrets(JSON.parse(before), exclude).filter(f => f.reason === "plain");
+            if (plain.length && !settings.default) {
+                throw new Error(`${plain.length} secret(s) are not encrypted in ${filename} (${plain.map(f => f.path).join(", ")}): ` +
+                    `set ${SETTINGS_PATH}.default or prefix them with encrypt:<encrypter>:`);
+            }
+            for (const finding of plain) {
+                // The encrypter is explicit: a plain value starting with an encrypter name is not misread
+                const parent = finding.location.slice(0, -1).reduce((target, segment) => target[segment], data);
+                const key = finding.location[finding.location.length - 1];
+                parent[key] = `encrypt:${settings.default}:${parent[key]}`;
+                useLog("INFO", `Encrypting the plain secret ${finding.path}`);
+            }
+            let changes = 0;
+            await CryptoService.encryptConfiguration(data, {
+                migrate,
+                upgrade,
+                settings,
+                appPath: useApplication().getPath()
+            });
+            // Count the changed values without logging them
+            const count = (a, b) => {
+                if (a !== null && typeof a === "object") {
+                    Object.keys(a).forEach(k => count(a[k], b?.[k]));
+                }
+                else if (a !== b) {
+                    changes++;
+                }
+            };
+            // Compare plain JSON: the comment-preserving arrays are wrapper objects
+            count(JSON.parse(JSON.stringify(data)), JSON.parse(before));
+            if (changes) {
+                FileUtils.save(data, filename);
+            }
+            useLog("INFO", `${changes} value(s) encrypted in ${filename}`);
+            return changes;
+        }
+        /**
+         * Get the keyring of the `pki` encrypter, as configured for the application
+         * @param data - a configuration file content, its settings override the application ones
+         * @returns the keyring
+         */
+        static getPkiKeyring(data) {
+            return new PkiKeyring(CryptoService.getEncryptionSettings(data).encrypters?.pki ?? {}, useApplication().getPath());
+        }
+        /**
+         * Generate a key pair for the `pki` encrypter
+         *
+         * The public key is written in the public keys directory, to commit. The private key is written
+         * outside of it, to store in the runtime secrets (a Kubernetes Secret for example), never in the repository.
+         *
+         * @param kid - the key id
+         * @param bits - the RSA modulus length
+         * @param out - the private key file
+         * @returns the written files
+         */
+        static async pkiGenerate(
+        /** @description Key id, for example 2026-10 */
+        kid, 
+        /** @description RSA modulus length */
+        bits = 4096, 
+        /** @description Private key file, ./<kid>.pem by default */
+        out) {
+            checkKid(kid);
+            if (!(bits >= PKI_MIN_BITS)) {
+                throw new Error(`RSA ${PKI_MIN_BITS} bits at least is required`);
+            }
+            const keyring = CryptoService.getPkiKeyring();
+            const publicKey = resolve(keyring.publicKeysDir, `${kid}.pub.pem`);
+            const privateKey = resolve(useApplication().getPath(), out || `${kid}.pem`);
+            const fromPublicDir = relative(keyring.publicKeysDir, privateKey);
+            if (!fromPublicDir.startsWith("..") && !isAbsolute(fromPublicDir)) {
+                throw new Error(`The private key cannot be written in the public keys directory ${keyring.publicKeysDir}`);
+            }
+            for (const f of [publicKey, privateKey]) {
+                if (existsSync(f)) {
+                    throw new Error(`${f} already exists`);
                 }
             }
-            return data;
+            const pair = generateKeyPairSync("rsa", {
+                modulusLength: bits,
+                publicKeyEncoding: { type: "spki", format: "pem" },
+                privateKeyEncoding: { type: "pkcs8", format: "pem" }
+            });
+            mkdirSync(keyring.publicKeysDir, { recursive: true });
+            writeFileSync(privateKey, pair.privateKey, { mode: 0o600, flag: "wx" });
+            writeFileSync(publicKey, pair.publicKey, { flag: "wx" });
+            useLog("INFO", `Public key written to ${publicKey}, commit it`);
+            useLog("INFO", `Private key written to ${privateKey}, never commit it. Ignore it in git:\n  *.pem\n  !*.pub.pem`);
+            useLog("INFO", `Store it in the runtime, then delete the local file:\n  kubectl create secret generic webda-pki --from-file=${kid}.pem=${privateKey}`);
+            useLog("INFO", `Set ${SETTINGS_PATH}.encrypters.pki.activeKey to '${kid}' to encrypt the new values with it`);
+            return { publicKey, privateKey };
+        }
+        /**
+         * List the public keys of the `pki` encrypter and the number of values encrypted with each key in a file
+         *
+         * A key with no value left can be retired.
+         *
+         * @param file - the configuration file to inspect
+         * @returns the active key, the public keys and the values count by kid
+         */
+        static async pkiList(
+        /** @alias f @description Configuration file to inspect (json, jsonc or yaml) */
+        file) {
+            const filename = resolve(useApplication().getPath(), file);
+            const data = FileUtils.load(filename);
+            const keyring = CryptoService.getPkiKeyring(data);
+            const values = {};
+            const count = (value) => {
+                if (value !== null && typeof value === "object") {
+                    Object.values(value).forEach(count);
+                    return;
+                }
+                const parsed = parseEncryptedValue(value);
+                if (parsed?.mode !== "crypt" || parsed.encrypter !== "pki") {
+                    return;
+                }
+                let kid;
+                try {
+                    kid = parsePkiValue(parsed.data).kid;
+                }
+                catch {
+                    kid = "<invalid>";
+                }
+                values[kid] = (values[kid] ?? 0) + 1;
+            };
+            count(data);
+            const publicKeys = keyring.listKids();
+            const lines = [
+                `Active key: ${keyring.activeKey ?? "<none>"}`,
+                `Public keys in ${keyring.publicKeysDir}: ${publicKeys.join(", ") || "<none>"}`,
+                `Values in ${filename}:`
+            ];
+            for (const kid of [...new Set([...publicKeys, ...Object.keys(values)])].sort()) {
+                lines.push(`  ${kid}${kid === keyring.activeKey ? " (active)" : ""}: ${values[kid] ?? 0}`);
+            }
+            useOutput(lines.join("\n"));
+            return { activeKey: keyring.activeKey, publicKeys, values };
         }
         /**
          * Decrypt data
@@ -492,27 +1165,61 @@ let CryptoService = (() => {
     };
 })();
 export { CryptoService };
+/**
+ * Prefix of the current encrypted format of the built-in encrypters
+ *
+ * Legacy values (AES-256-CTR, unauthenticated) have no prefix: base64 never contains `:`.
+ */
+export const ENCRYPTION_FORMAT_V2 = "v2:";
+/**
+ * Get the key of the local encrypter
+ * @returns the key derived from the machine id
+ */
+function getLocalKey() {
+    return new Uint8Array(createHash("sha256").update(getMachineId()).digest());
+}
 /**
  * Encrypt data with local machine id
+ *
+ * The machine id is `WEBDA_MACHINE_ID` if defined, the OS machine id otherwise: a value
+ * encrypted on one machine can only be decrypted on the same machine, or with the same
+ * `WEBDA_MACHINE_ID`.
  */
 CryptoService.registerEncrypter("local", {
     encrypt: async (data) => {
-        // Initialization Vector
-        const iv = randomBytes(16);
-        const key = createHash("sha256").update(getMachineId()).digest();
-        const cipher = createCipheriv("aes-256-ctr", new Uint8Array(key), new Uint8Array(iv));
-        const updated = cipher.update(new Uint8Array(Buffer.from(data)));
-        const final = cipher.final();
-        return Buffer.concat([new Uint8Array(iv), new Uint8Array(updated), new Uint8Array(final)]).toString("base64");
+        return ENCRYPTION_FORMAT_V2 + AuthenticatedEncryption.encrypt(getLocalKey(), data);
     },
     decrypt: async (data) => {
+        if (data.startsWith(ENCRYPTION_FORMAT_V2)) {
+            return AuthenticatedEncryption.decrypt(getLocalKey(), data.substring(ENCRYPTION_FORMAT_V2.length));
+        }
+        // Legacy format: AES-256-CTR, re-encrypt with 'webda config encrypt --upgrade'
         const input = Buffer.from(data, "base64");
         const iv = input.subarray(0, 16);
-        const key = createHash("sha256").update(getMachineId()).digest();
-        const decipher = createDecipheriv("aes-256-ctr", new Uint8Array(key), new Uint8Array(iv));
+        const decipher = createDecipheriv("aes-256-ctr", getLocalKey(), new Uint8Array(iv));
         return decipher.update(new Uint8Array(input.subarray(16))).toString() + decipher.final().toString();
     }
 });
+/**
+ * Asymmetric encrypter: public keys in the repository, private keys in the runtime
+ */
+CryptoService.registerEncrypter("pki", pkiEncrypter);
+/**
+ * Opt-out: `crypt:none:<value>` keeps a value of a secret field in clear text on purpose
+ *
+ * `webda config encrypt` does not encrypt it, even with `--migrate`, and `--check` reports it as a warning.
+ */
+CryptoService.registerEncrypter(OPT_OUT_ENCRYPTER, {
+    encrypt: async (data) => {
+        if (/[\r\n]/.test(data)) {
+            throw new Error("A multi-line value cannot be kept in clear text with crypt:none:");
+        }
+        return data;
+    },
+    decrypt: async (data) => data,
+    needsUpgrade: () => false
+});
+export { AuthenticatedEncryption };
 export default CryptoService;
 /**
  * Return the CryptoService