configre 2.0.0 → 2.1.0

package/README.md

@@ -119,10 +119,10 @@ import Configre from "../../index.js";
 import { join } from "node:path";
 
 const configPath = join(import.meta.dirname, "config");
-const cfg = Configre(configPath, { secrets: true });
+const cfg = Configre(configPath);
 ```
 
-`{ secrets: true }` enables this workflow. Loading remains synchronous, and your application reads the result through ordinary properties such as `cfg.api.key`.
+Secrets activate automatically when the base configuration or selected profile has a corresponding `.secret.cjs` file, or when `secrets.enc.json` already exists. No options are needed. Loading remains synchronous, and your application reads the result through ordinary properties such as `cfg.api.key`.
 
 > The demo reports `API key configured:` without printing the key. Avoid logging `cfg` in your application: it contains the decrypted secrets.
 
@@ -138,18 +138,24 @@ module.exports = {
 };
 ```
 
+Create `demo/secrets/config/index.secret.cjs` yourself to enable secrets, initially with:
+
+```javascript
+module.exports = {};
+```
+
 Then run:
 
 ```bash
 node demo/secrets/demo.js
 ```
 
-For a new setup, Configre creates the following files and directory:
+For a new setup, Configre generates the encrypted file, recipients directory and Git exclusions alongside your existing configuration files:
 
 ```text
 demo/secrets/config/
   index.cjs          # Public configuration
-  index.secret.cjs   # Editable secrets; starts with module.exports = {};
+  index.secret.cjs   # Editable secrets you create yourself
   recipients/        # Public keys of servers that register
   secrets.enc.json   # Generated encrypted values
   .gitignore         # Keeps .secret.cjs files out of Git
@@ -163,7 +169,7 @@ With the public placeholder empty and no secrets added, look for:
 API key configured: false
 ```
 
-**`index.secret.cjs` starts empty on purpose.** Configre does not copy values from `index.cjs` into it. It contains only the fields you choose to override with secrets; public settings continue to come from `index.cjs`.
+**Configre never creates `.secret.cjs` files.** Without a secret counterpart for the base configuration or selected profile, and without an encrypted file, it loads only public settings and creates no identity or secret artifacts. A secret module contains only the fields you choose to override; public settings continue to come from `index.cjs`.
 
 These initialization steps describe a new setup. If `secrets.enc.json` already exists, Configre uses that encrypted file instead of resetting it. A checkout containing the encrypted file but no `.secret.cjs` files is treated as a server checkout.
 
@@ -254,7 +260,7 @@ node demo/secrets/demo.js
 
 Commit and push the updated `secrets.enc.json`, then pull and restart the demo on the server. **You do not need to copy or register `truco.pub` again.** Its existing authorization also covers new keys you add later.
 
-For settings specific to `truco`, add `demo/secrets/config/truco.cjs`. The next administrator run creates an empty `truco.secret.cjs` counterpart, which you can fill with that profile's secrets. All profile secret files, including inactive ones, are encrypted together when the administrator runs the demo.
+For settings specific to `truco`, add `demo/secrets/config/truco.cjs` and create `truco.secret.cjs` yourself with that profile's secrets. The secret file activates secrets when `truco` is selected, even without `index.secret.cjs`. A public profile alone never creates a secret counterpart. Once secrets are active, all profile secret files, including inactive ones, are encrypted together when the administrator runs the demo.
 
 For `--config=truco`, the merge order is:
 
@@ -271,7 +277,7 @@ To revoke this server, remove `demo/secrets/config/recipients/truco.pub`, run th
 
 - Secret `.cjs` modules execute on the administrator and are reloaded on each Configre call. They must export plain objects containing JSON-compatible objects, arrays, strings, finite numbers, booleans and `null`. Functions, `undefined`, accessors, symbols, custom objects, circular references, and properties named `__proto__`, `constructor` or `prototype` are rejected. Consumers decrypt data without executing these modules.
 - Empty strings stay empty strings. Configre does not fill them from environment variables or populate `process.env`. The existing deep-merge behavior, including array merging, also applies to secrets.
-- Without `{ secrets: true }`, Configre does not access identities or secret files. The option also works with `new Configre(configPath, { secrets: true }).get()` and CommonJS consumers.
+- Activation depends only on the existing files; there is no `secrets` option. The same behavior applies to `new Configre(configPath).get()` and CommonJS consumers.
 - Each OS user has one identity reused across projects; authorization is per project. A service running under another OS user needs its own registration. All authorized identities can decrypt all profiles in the project's encrypted file.
 - Public recipient files must contain a single RSA-3072 public key in PEM format, with exponent 65537, as generated by Configre. Other file extensions are ignored, and duplicate keys do not add recipients. The administrator is always included.
 - Registration uses an isolated Git index and publishes only the public-key file. It preserves unrelated staged and unstaged changes, runs no commit or pre-push hooks, and does not push local tags, merge, rebase or force-push. Failed registrations can be retried at the next startup; each Git command has a 30-second timeout. An authorized server loads secrets without Git commands or project writes.

package/demo/secrets/demo.js

@@ -2,7 +2,7 @@ import Configre from "../../index.js";
 import { join } from "node:path";
 
 const configPath = join(import.meta.dirname, "config");
-const cfg = Configre(configPath, { secrets: true });
+const cfg = Configre(configPath);
 console.info("API key configured:", Boolean(cfg.api.key));
 console.info(`Set api.key in ${join(configPath, "index.secret.cjs")} and run this demo again.`);
 console.info(`New servers automatically publish their public key in ${join(configPath, "recipients")}. Pull and rerun here to authorize them.`);

package/index.js

@@ -10,15 +10,10 @@ const requireConfig = createRequire(import.meta.url);
 const log = lemonlog("Configre");
 
 class ConfigreClass {
-    constructor(pathOrDir, options = {}) {
+    constructor(pathOrDir) {
         if (typeof pathOrDir !== "string" || pathOrDir.length === 0) {
             throw new TypeError("Configre path must be a non-empty string");
         }
-        if (options === null || typeof options !== "object" || Array.isArray(options) ||
-            (options.secrets !== undefined && typeof options.secrets !== "boolean")) {
-            throw new TypeError("Configre options must be an object with an optional boolean secrets property");
-        }
-
         const dir = path.join(pathOrDir);
         const isNested = (ConfigreClass._nesting || 0) > 0;
         ConfigreClass._nesting = (ConfigreClass._nesting || 0) + 1;
@@ -35,9 +30,7 @@ class ConfigreClass {
             const configArg = process.argv.find(arg => arg.startsWith('--config='));
             this.profile = configArg ? configArg.slice('--config='.length) : os.hostname();
             this.profileSettings = this.loadProfileSettings();
-            this.secretSettings = options.secrets === true
-                ? loadSecrets(pathOrDir, this.configFile, this.profile)
-                : [];
+            this.secretSettings = loadSecrets(pathOrDir, this.configFile, this.profile);
         } finally {
             ConfigreClass._nesting -= 1;
         }
@@ -93,11 +86,11 @@ class ConfigreClass {
 }
 
 // Wrapper function to support both constructor and function usage
-function Configre(path, options) {
+function Configre(path) {
     if (this instanceof Configre) {
-        return new ConfigreClass(path, options);
+        return new ConfigreClass(path);
     } else {
-        return new ConfigreClass(path, options).get();
+        return new ConfigreClass(path).get();
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configre",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "🔧 Effortlessly Tailor Your Settings",
   "type": "module",
   "engines": {

package/secrets/index.js

@@ -122,8 +122,14 @@ function selectSecrets(bundle, paths, profile) {
 
 function loadSecrets(configPath, configFile, profile) {
     const paths = secretPaths(configPath, configFile);
+    const names = localFiles(paths);
+    const hasEncrypted = !!stat(paths.encrypted);
+    const hasLocal = names.includes(path.basename(paths.local)) || (paths.directory &&
+        (names.includes(profile + ".dev.secret.cjs") || names.includes(profile + ".secret.cjs")));
+    if (!hasLocal && !hasEncrypted) return [];
+
     const identity = loadIdentity();
-    if (localFiles(paths).length === 0 && stat(paths.encrypted)) {
+    if (names.length === 0 && hasEncrypted) {
         try {
             return selectSecrets(validateBundle(decrypt(readJSON(paths.encrypted), identity)), paths, profile);
         } catch (error) {
@@ -143,20 +149,6 @@ function loadSecrets(configPath, configFile, profile) {
         prepareIgnore(paths);
         const settings = { files: Object.fromEntries(names.map(name => [name, readSecret(path.join(paths.parent, name))])) };
         const recipients = loadRecipients(paths.recipients, identity);
-        const templates = new Set([path.basename(paths.local)]);
-        if (paths.directory) {
-            for (const name of fs.readdirSync(paths.parent)) {
-                if (name.endsWith(".cjs") && !name.endsWith(".secret.cjs") && stat(path.join(paths.parent, name)).isFile()) {
-                    templates.add(name.slice(0, -4) + ".secret.cjs");
-                }
-            }
-        }
-        for (const name of templates) {
-            if (!Object.hasOwn(settings.files, name)) {
-                fs.writeFileSync(path.join(paths.parent, name), "module.exports = {};\n", { flag: "wx", mode: 0o600 });
-                settings.files[name] = {};
-            }
-        }
         if (hasEncrypted) {
             const previousRecipients = envelope.recipients.map(({ fingerprint, publicKey }) => ({ fingerprint, publicKey }));
             if (isDeepStrictEqual(settings, previous) && isDeepStrictEqual(recipients, previousRecipients)) {

package/test/secrets.test.js

@@ -51,7 +51,7 @@ function writeSettings(f, settings = { api: { key: sentinel } }) {
 }
 
 function load(f) {
-    return Configre(f.config, { secrets: true });
+    return Configre(f.config);
 }
 
 function envelope(f) {
@@ -98,23 +98,40 @@ function gitFixture(t) {
     };
 }
 
-test("secrets stay opt-in and invalid options fail before creating an identity", t => {
+test("missing secret counterparts leave configuration and identity untouched", t => {
     const f = fixture(t, { seed: false });
-    fs.writeFileSync(f.local, "invalid-json");
+    const publicFiles = fs.readdirSync(f.config);
     t.mock.method(os, "homedir", () => { throw new Error("must not access the identity"); });
     assert.equal(Configre(f.config).api.key, "");
-    assert.equal(Configre(f.config, { secrets: false }).api.key, "");
+    assert.deepEqual(fs.readdirSync(f.config), publicFiles);
+    fs.writeFileSync(path.join(f.config, "other.secret.cjs"), "invalid-json");
+    const files = fs.readdirSync(f.config);
+    assert.equal(Configre(f.config).api.key, "");
     assert.equal(new Configre(f.config).get().api.key, "");
-    for (const options of [null, true, [], { secrets: "true" }]) {
-        assert.throws(() => Configre(f.config, options), /options must be an object/);
-    }
-    assert.equal(fs.existsSync(f.encrypted), false);
-    assert.equal(fs.existsSync(path.join(f.config, ".gitignore")), false);
+    assert.deepEqual(fs.readdirSync(f.config), files);
     assert.equal(fs.existsSync(f.homes[0]), false);
 });
 
-test("first use initializes empty secrets and reuses all generated files", t => {
+for (const profile of ["testhost", "testhost.dev", "forced"]) {
+    test(`a ${profile} secret activates secrets without a base secret module`, t => {
+        const f = fixture(t);
+        if (profile === "forced") {
+            const previousArgs = process.argv;
+            process.argv = [...previousArgs.filter(arg => !arg.startsWith("--config=")), "--config=forced"];
+            t.after(() => { process.argv = previousArgs; });
+        }
+        const local = path.join(f.config, profile + ".secret.cjs");
+        writeSettings({ local });
+        assert.equal(load(f).api.key, sentinel);
+        assert.equal(fs.existsSync(f.local), false);
+        assert.deepEqual(fs.readdirSync(f.config).filter(name => name.endsWith(".secret.cjs")), [path.basename(local)]);
+        assert.equal(load(consumerCopy(f, "profile-only-consumer")).api.key, sentinel);
+    });
+}
+
+test("an existing empty secret module initializes secrets and reuses generated files", t => {
     const f = fixture(t, { seed: false });
+    fs.writeFileSync(f.local, "module.exports = {};\n", { mode: 0o600 });
     const ignore = path.join(f.config, ".gitignore");
     fs.writeFileSync(ignore, "# existing rules\n*.log");
     const config = load(f);
@@ -198,7 +215,7 @@ test("secrets merge last with profiles, arrays, JSON values and the constructor
     assert.deepEqual(config.api, settings.api);
     assert.deepEqual(config.list, [9, 2]);
     assert.deepEqual(config.json, settings.json);
-    assert.deepEqual(new Configre(f.config, { secrets: true }).get(), config);
+    assert.deepEqual(new Configre(f.config).get(), config);
     assert.equal(fs.existsSync(f.recipients), true);
     assert.equal(fs.readFileSync(f.encrypted, "utf8").includes(sentinel), false);
     assert.equal(envelope(f).recipients.length, 1);
@@ -277,19 +294,19 @@ test("base and host secrets select dev and forced profiles identically on consum
     assert.deepEqual(fs.readdirSync(consumer.config), consumerFiles);
 });
 
-test("administrator scaffolds empty counterparts without overwriting existing host secrets", t => {
+test("administrator leaves missing counterparts absent and preserves existing host secrets", t => {
     const f = fixture(t);
     writeSettings(f);
     load(f);
     const host = { local: path.join(f.config, "testhost.secret.cjs") };
-    assert.equal(fs.readFileSync(host.local, "utf8"), "module.exports = {};\n");
+    assert.equal(fs.existsSync(host.local), false);
     writeSettings(host, { api: { key: "host-secret" } });
     const original = fs.readFileSync(host.local);
     fs.writeFileSync(path.join(f.config, "newhost.cjs"), "module.exports = { public: true };\n");
     load(f);
     assert.deepEqual(fs.readFileSync(host.local), original);
-    assert.equal(fs.readFileSync(path.join(f.config, "newhost.secret.cjs"), "utf8"), "module.exports = {};\n");
-    const consumer = consumerCopy(f, "scaffold-consumer");
+    assert.equal(fs.existsSync(path.join(f.config, "newhost.secret.cjs")), false);
+    const consumer = consumerCopy(f, "optional-profile-consumer");
     fs.writeFileSync(path.join(consumer.config, "newhost.cjs"), "module.exports = {};\n");
     assert.equal(load(consumer).api.key, "host-secret");
     assert.equal(fs.existsSync(path.join(consumer.config, "newhost.secret.cjs")), false);
@@ -467,20 +484,33 @@ test("private permissions and symlinks are rejected", { skip: process.platform =
     assert.throws(() => load(f), /regular file/);
 });
 
+test("explicit config files without their own secret sidecar leave identities and files untouched", t => {
+    const f = fixture(t, { seed: false });
+    const filename = path.join(f.root, "settings.cjs");
+    fs.writeFileSync(filename, 'module.exports = { public: true };');
+    fs.writeFileSync(path.join(f.root, "other.secret.cjs"), "invalid-json");
+    const files = fs.readdirSync(f.root);
+    t.mock.method(os, "homedir", () => { throw new Error("must not access the identity"); });
+    assert.deepEqual(Configre(filename), { public: true });
+    assert.deepEqual(Configre(filename.slice(0, -4)), { public: true });
+    assert.deepEqual(fs.readdirSync(f.root), files);
+    assert.equal(fs.existsSync(f.homes[0]), false);
+});
+
 test("explicit config files and extensionless paths use sidecars beside the resolved file", t => {
     const f = fixture(t);
     const filename = path.join(f.root, "settings.cjs");
     fs.writeFileSync(filename, 'module.exports = { api: { key: "", host: "file" } };');
     const local = filename.slice(0, -4) + ".secret.cjs";
     writeSettings({ local });
-    assert.equal(Configre(filename, { secrets: true }).api.key, sentinel);
-    assert.equal(Configre(filename.slice(0, -4), { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(filename).api.key, sentinel);
+    assert.equal(Configre(filename.slice(0, -4)).api.key, sentinel);
     assert.equal(fs.existsSync(filename + ".secrets.enc.json"), true);
     assert.equal(fs.existsSync(filename + ".recipients"), true);
     assert.equal(fs.existsSync(path.join(f.root, "secrets.enc.json")), false);
     const relative = path.relative(process.cwd(), f.config);
     writeSettings(f);
-    assert.equal(Configre(relative, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(relative).api.key, sentinel);
 });
 
 test("ESM callers can use the same synchronous API", t => {
@@ -494,7 +524,7 @@ test("ESM callers can use the same synchronous API", t => {
         import os from 'node:os';
         import Configre from ${JSON.stringify(moduleURL)};
         os.homedir = () => process.env.CONFIGRE_TEST_HOME;
-        const cfg = Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true });
+        const cfg = Configre(process.env.CONFIGRE_TEST_PATH);
         assert.equal(typeof cfg.then, 'undefined');
         assert.equal(cfg.api.key, ${JSON.stringify(sentinel)});
     `);
@@ -511,7 +541,7 @@ test("symlinked configuration directories keep directory sidecar names", { skip:
     writeSettings(f);
     const linked = path.join(f.root, "linked-config");
     fs.symlinkSync(f.config, linked);
-    assert.equal(Configre(linked, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(linked).api.key, sentinel);
     assert.equal(fs.existsSync(f.encrypted), true);
     assert.equal(fs.existsSync(path.join(f.config, "index.cjs.secrets.enc.json")), false);
 });
@@ -520,13 +550,12 @@ test("error output never includes local secret values or private key contents",
     const f = fixture(t);
     fs.writeFileSync(f.local, `module.exports = {secret: "${sentinel}", bad`);
     assert.throws(() => load(f), /invalid secret module/);
-    assert.equal(new Configre(f.config)._isNested, false);
     const script = `
         const os = require('node:os');
         os.homedir = () => process.env.CONFIGRE_TEST_HOME;
         const Configre = require(process.env.CONFIGRE_TEST_MODULE);
         try {
-            Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true });
+            Configre(process.env.CONFIGRE_TEST_PATH);
         } catch (error) {
             console.error(error.stack);
             process.exitCode = 1;
@@ -545,6 +574,8 @@ test("error output never includes local secret values or private key contents",
     assert.match(result.stderr, /invalid secret module/);
     assert.equal((result.stdout + result.stderr).includes(sentinel), false);
     assert.equal((result.stdout + result.stderr).includes("BEGIN PRIVATE KEY"), false);
+    writeSettings(f);
+    assert.equal(new Configre(f.config)._isNested, false);
 });
 
 test("Git exclusions preserve existing rules and never hide already tracked local files", t => {
@@ -568,6 +599,7 @@ test("Git exclusions preserve existing rules and never hide already tracked loca
     assert.deepEqual(fs.readFileSync(f.encrypted), original);
     assert.ok(git(f.root, ["ls-files"]).includes("config/index.secret.cjs"));
     git(f.root, ["rm", "--cached", "config/index.secret.cjs"]);
+    writeSettings({ local: path.join(f.config, "testhost.secret.cjs") }, {});
     git(f.root, ["add", "-f", "config/testhost.secret.cjs"]);
     assert.throws(() => load(f), /tracked by Git/);
 });
@@ -579,13 +611,13 @@ test("recipient files can be tracked and sidecar names are escaped literally in
     fs.writeFileSync(filename, "module.exports = {};");
     const local = filename.slice(0, -4) + ".secret.cjs";
     writeSettings({ local });
-    Configre(filename, { secrets: true });
+    Configre(filename);
     assert.ok(git(f.root, ["check-ignore", path.basename(local)]).includes(path.basename(local)));
     const recipient = filename + ".recipients/developer.pub";
     fs.copyFileSync(f.publicPath(1), recipient);
     git(f.root, ["add", "-f", path.relative(f.root, recipient)]);
     const original = fs.readFileSync(filename + ".secrets.enc.json");
-    assert.equal(Configre(filename, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(filename).api.key, sentinel);
     assert.notDeepEqual(fs.readFileSync(filename + ".secrets.enc.json"), original);
 });
 
@@ -773,7 +805,7 @@ test("a second process cannot write while an encrypted replacement is pending",
                 const os = require('node:os');
                 os.homedir = () => process.env.CONFIGRE_TEST_HOME;
                 const Configre = require(process.env.CONFIGRE_TEST_MODULE);
-                assert.throws(() => Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true }), /another writer/);
+                assert.throws(() => Configre(process.env.CONFIGRE_TEST_PATH), /another writer/);
             `], {
                 encoding: "utf8",
                 env: {
@@ -792,6 +824,5 @@ test("a second process cannot write while an encrypted replacement is pending",
     assert.equal(load(f).api.key, sentinel + "-new");
     assert.equal(contested, true);
     fs.unlinkSync(f.local);
-    fs.unlinkSync(path.join(f.config, "testhost.secret.cjs"));
     assert.equal(load(f).api.key, sentinel + "-new");
 });