envpass-cli 0.0.0-stage → 0.2.7

package/dist/config.js

@@ -0,0 +1,86 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+export const DEFAULT_URL = "https://envpass.dev";
+const PROJECT_FILE = ".envpass.json";
+export function baseUrl(explicit) {
+    return (explicit ?? process.env.ENVPASS_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+}
+function credentialsPath() {
+    const root = process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+    return join(root, "envpass", "credentials.json");
+}
+function readCredentials() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function saveToken(url, token) {
+    const path = credentialsPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const credentials = readCredentials();
+    credentials[url] = { token, savedAt: new Date().toISOString() };
+    writeFileSync(path, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return path;
+}
+export function forgetToken(url) {
+    const path = credentialsPath();
+    const credentials = readCredentials();
+    if (!credentials[url])
+        return false;
+    delete credentials[url];
+    if (Object.keys(credentials).length === 0)
+        rmSync(path, { force: true });
+    else
+        writeFileSync(path, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+    return true;
+}
+export function storedToken(url) {
+    return readCredentials()[url]?.token;
+}
+export function resolveToken(url, explicit) {
+    return explicit ?? process.env.ENVPASS_TOKEN ?? storedToken(url);
+}
+function findProjectFile(start = process.cwd()) {
+    let dir = resolve(start);
+    for (;;) {
+        const candidate = join(dir, PROJECT_FILE);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function readProjectLink(start) {
+    const path = findProjectFile(start);
+    if (!path)
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`${path} is not valid JSON`);
+    }
+}
+export function writeProjectLink(link, dir = process.cwd()) {
+    const path = join(dir, PROJECT_FILE);
+    writeFileSync(path, `${JSON.stringify(link, null, 2)}\n`);
+    return path;
+}
+export function resolveScope(flags, start) {
+    const file = readProjectLink(start);
+    return {
+        workspace: flags.workspace ?? process.env.ENVPASS_WORKSPACE ?? file.workspace,
+        project: flags.project ?? process.env.ENVPASS_PROJECT ?? file.project,
+        environment: flags.environment ?? process.env.ENVPASS_ENV ?? file.environment,
+    };
+}

package/dist/device.d.ts

@@ -0,0 +1,13 @@
+type DeviceCode = {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+};
+export declare function openBrowser(url: string): void;
+export declare function deviceLogin(url: string, onCode: (code: DeviceCode) => void, options?: {
+    fetch?: typeof fetch;
+}): Promise<string>;
+export {};

package/dist/device.js

@@ -0,0 +1,56 @@
+import { spawn } from "node:child_process";
+const CLI_CLIENT_ID = "envpass-cli";
+export function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        return;
+    }
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export async function deviceLogin(url, onCode, options = {}) {
+    const http = options.fetch ?? fetch;
+    const start = await http(`${url}/api/auth/device/code`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ client_id: CLI_CLIENT_ID }),
+    });
+    if (!start.ok)
+        throw new Error(`Could not start login (${start.status})`);
+    const code = (await start.json());
+    onCode(code);
+    let interval = Math.max(1, code.interval) * 1000;
+    const deadline = Date.now() + code.expires_in * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const poll = await http(`${url}/api/auth/device/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: code.device_code,
+                client_id: CLI_CLIENT_ID,
+            }),
+        });
+        const body = (await poll.json());
+        if (body.access_token)
+            return body.access_token;
+        if (body.error === "authorization_pending")
+            continue;
+        if (body.error === "slow_down") {
+            interval += 5000;
+            continue;
+        }
+        if (body.error === "access_denied")
+            throw new Error("Login was denied in the browser.");
+        if (body.error === "expired_token")
+            throw new Error("The login code expired. Run `envpass login` again.");
+        throw new Error(body.error_description ?? body.error ?? `Login failed (${poll.status})`);
+    }
+    throw new Error("The login code expired. Run `envpass login` again.");
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { type Connection, createEnvpass, type Envpass, EnvpassError, type EnvpassOptions, type Environment, type ExportFormat, loadEnv, type NewWebhook, type ResolvedEntry, type Source, type Sync, WEBHOOK_EVENTS, type Webhook, type WebhookDelivery, type WebhookEvent, type WebhookFormat, type WebhookTestResult, type Workspace, } from "./client.js";
+export { DEFAULT_URL, type ProjectLink } from "./config.js";
+export { maskText } from "./mask.js";
+export type { components, paths } from "./schema.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createEnvpass, EnvpassError, loadEnv, WEBHOOK_EVENTS, } from "./client.js";
+export { DEFAULT_URL } from "./config.js";
+export { maskText } from "./mask.js";

package/dist/integrations.d.ts

@@ -0,0 +1,21 @@
+import { type Envpass } from "./client.js";
+import type { ProjectLink } from "./config.js";
+export type Io = {
+    out: (text: string) => void;
+    err: (text: string) => void;
+};
+export type IntegrationArgs = {
+    scope: ProjectLink;
+    args: string[];
+    json?: boolean;
+    url?: string;
+    events?: string[];
+    environments?: string[];
+    projects?: string[];
+    format?: string;
+    description?: string;
+    limit?: string;
+};
+export declare function table(header: string[], rows: string[][]): string;
+export declare function webhooksCommand(client: Envpass, options: IntegrationArgs, io: Io): Promise<number>;
+export declare function syncsCommand(client: Envpass, options: IntegrationArgs, io: Io): Promise<number>;

package/dist/integrations.js

@@ -0,0 +1,181 @@
+import { WEBHOOK_EVENTS, } from "./client.js";
+const WEBHOOKS_USAGE = "Usage: envpass webhooks <list|add|remove|test|deliveries>";
+const SYNCS_USAGE = "Usage: envpass syncs <list|run|pause|resume>";
+export function table(header, rows) {
+    const all = [header, ...rows];
+    const widths = header.map((_, i) => Math.max(...all.map((row) => (row[i] ?? "").length)));
+    return all
+        .map((row) => row.map((cell, i) => (i === row.length - 1 ? cell : cell.padEnd(widths[i] ?? 0))).join("  "))
+        .join("\n")
+        .concat("\n");
+}
+function oneLine(text) {
+    return text ? text.replace(/\s+/g, " ").trim() : "-";
+}
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function requireId(args, usage) {
+    const [id] = args;
+    if (!id)
+        throw new Error(usage);
+    return id;
+}
+function describeTest(result) {
+    const status = result.responseStatus === null ? "no response" : `HTTP ${result.responseStatus}`;
+    const detail = result.error ? `: ${oneLine(result.error)}` : "";
+    return `${result.ok ? "Delivered" : "Failed"}: ${status} in ${result.durationMs}ms${detail}\n`;
+}
+function parseLimit(limit) {
+    if (limit === undefined)
+        return undefined;
+    const value = Number(limit);
+    if (!/^[0-9]+$/.test(limit) || value < 1 || value > 100)
+        throw new Error("--limit must be a whole number from 1 to 100");
+    return value;
+}
+function parseEvents(events) {
+    if (!events?.length)
+        return undefined;
+    return events.map((event) => {
+        const known = WEBHOOK_EVENTS.find((candidate) => candidate === event);
+        if (!known)
+            throw new Error(`--event must be one of ${WEBHOOK_EVENTS.join(", ")}`);
+        return known;
+    });
+}
+function parseFormat(format) {
+    if (format === undefined)
+        return undefined;
+    if (format !== "json" && format !== "slack")
+        throw new Error("--format must be json or slack");
+    return format;
+}
+export async function webhooksCommand(client, options, io) {
+    const [action, ...args] = options.args;
+    const scope = { workspace: options.scope.workspace };
+    switch (action) {
+        case "list": {
+            const [webhooks, environments] = await Promise.all([
+                client.listWebhooks(scope),
+                client.listEnvironments(scope),
+            ]);
+            if (options.json) {
+                io.out(json(webhooks));
+                return 0;
+            }
+            if (!webhooks.length) {
+                io.err("No webhooks.\n");
+                return 0;
+            }
+            const slugs = new Map(environments.map((e) => [e.id, e.slug]));
+            io.out(table(["ID", "URL", "EVENTS", "ENVIRONMENTS", "ENABLED", "LAST DELIVERY"], webhooks.map((hook) => [
+                hook.id,
+                hook.url,
+                hook.events.join(","),
+                hook.environmentIds.length
+                    ? hook.environmentIds.map((id) => slugs.get(id) ?? id).join(",")
+                    : "all",
+                hook.enabled ? "on" : "off",
+                hook.lastDelivery
+                    ? [hook.lastDelivery.status, hook.lastDelivery.responseStatus ?? ""].join(" ").trim()
+                    : "-",
+            ])));
+            return 0;
+        }
+        case "add": {
+            if (!options.url)
+                throw new Error("Usage: envpass webhooks add --url <url> [options]");
+            const { webhook, secret } = await client.createWebhook({
+                url: options.url,
+                events: parseEvents(options.events),
+                environments: options.environments,
+                projects: options.projects,
+                format: parseFormat(options.format),
+                description: options.description,
+            }, scope);
+            io.out(`Webhook ${webhook.id} created for ${webhook.url}\n`);
+            io.out(`Signing secret: ${secret}\n`);
+            io.err("Store the signing secret now: it is shown only once. Use it to verify the envpass-signature header.\n");
+            return 0;
+        }
+        case "remove": {
+            const id = requireId(args, "Usage: envpass webhooks remove <id>");
+            await client.deleteWebhook(id, scope);
+            io.err(`Removed webhook ${id}\n`);
+            return 0;
+        }
+        case "test": {
+            const id = requireId(args, "Usage: envpass webhooks test <id>");
+            const result = await client.testWebhook(id, scope);
+            io.out(describeTest(result));
+            return result.ok ? 0 : 1;
+        }
+        case "deliveries": {
+            const id = requireId(args, "Usage: envpass webhooks deliveries <id> [--limit N]");
+            const deliveries = await client.listWebhookDeliveries(id, { limit: parseLimit(options.limit) }, scope);
+            if (options.json) {
+                io.out(json(deliveries));
+                return 0;
+            }
+            if (!deliveries.length) {
+                io.err("No deliveries yet.\n");
+                return 0;
+            }
+            io.out(table(["ID", "EVENT", "STATUS", "CODE", "ATTEMPTS", "DURATION", "CREATED", "ERROR"], deliveries.map((delivery) => [
+                delivery.id,
+                delivery.eventType,
+                delivery.status,
+                delivery.responseStatus === null ? "-" : String(delivery.responseStatus),
+                String(delivery.attempts),
+                delivery.durationMs === null ? "-" : `${delivery.durationMs}ms`,
+                delivery.createdAt,
+                oneLine(delivery.error),
+            ])));
+            return 0;
+        }
+        default:
+            throw new Error(WEBHOOKS_USAGE);
+    }
+}
+export async function syncsCommand(client, options, io) {
+    const [action, ...args] = options.args;
+    const scope = { workspace: options.scope.workspace, project: options.scope.project };
+    switch (action) {
+        case "list": {
+            const syncs = await client.listSyncs(scope);
+            if (options.json) {
+                io.out(json(syncs));
+                return 0;
+            }
+            if (!syncs.length) {
+                io.err("No syncs.\n");
+                return 0;
+            }
+            io.out(table(["ID", "DESTINATION", "ENVIRONMENT", "STATUS", "LAST SYNCED", "LAST ERROR"], syncs.map((sync) => [
+                sync.id,
+                sync.destination,
+                sync.environmentSlug,
+                sync.enabled ? sync.status : "paused",
+                sync.lastSyncedAt ?? "never",
+                oneLine(sync.lastError),
+            ])));
+            return 0;
+        }
+        case "run": {
+            const id = requireId(args, "Usage: envpass syncs run <id>");
+            await client.runSync(id, scope);
+            io.err(`Queued sync ${id}\n`);
+            return 0;
+        }
+        case "pause":
+        case "resume": {
+            const id = requireId(args, `Usage: envpass syncs ${action} <id>`);
+            await client.setSyncEnabled(id, action === "resume", scope);
+            io.err(`${action === "resume" ? "Resumed" : "Paused"} sync ${id}\n`);
+            return 0;
+        }
+        default:
+            throw new Error(SYNCS_USAGE);
+    }
+}

package/dist/mask.d.ts

@@ -0,0 +1,3 @@
+import { Transform } from "node:stream";
+export declare function maskText(text: string, secrets: readonly string[]): string;
+export declare function maskingStream(values: readonly string[]): Transform;

package/dist/mask.js

@@ -0,0 +1,59 @@
+import { Transform } from "node:stream";
+const MASK = "***";
+const MIN_LENGTH = 4;
+export function maskText(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (secret.length >= MIN_LENGTH)
+            out = out.split(secret).join(MASK);
+    }
+    return out;
+}
+function partialSuffix(text, secrets) {
+    let longest = 0;
+    for (const secret of secrets) {
+        const max = Math.min(secret.length - 1, text.length);
+        for (let k = max; k > longest; k--) {
+            if (text.endsWith(secret.slice(0, k))) {
+                longest = k;
+                break;
+            }
+        }
+    }
+    return longest;
+}
+export function maskingStream(values) {
+    const secrets = [...new Set(values.filter((v) => v.length >= MIN_LENGTH))].sort((a, b) => b.length - a.length);
+    let pending = "";
+    let timer;
+    const stream = new Transform({
+        transform(chunk, _encoding, callback) {
+            if (timer)
+                clearTimeout(timer);
+            pending = maskText(pending + chunk.toString("utf8"), secrets);
+            const keep = partialSuffix(pending, secrets);
+            const emit = pending.slice(0, pending.length - keep);
+            pending = pending.slice(emit.length);
+            if (emit)
+                this.push(emit);
+            if (pending) {
+                timer = setTimeout(() => {
+                    const rest = pending;
+                    pending = "";
+                    if (rest)
+                        stream.push(rest);
+                }, 100);
+            }
+            callback();
+        },
+        flush(callback) {
+            if (timer)
+                clearTimeout(timer);
+            if (pending)
+                this.push(pending);
+            pending = "";
+            callback();
+        },
+    });
+    return stream;
+}