laneyard 0.7.0 → 0.9.0

package/dist/src/heuristics/readiness.js

@@ -514,6 +514,17 @@ function platformNote(platforms) {
  * here, answered there, and no file in the repository is touched either way.
  */
 const SET_PROPERTIES_PATH = "Set the properties file path on the keystore block, relative to the app.";
+/**
+ * Do the configured path and the one the build reads point at the same file?
+ *
+ * Compared as text after normalising, which is all that can be done here: the
+ * clone is not this function's to stat, and `./android/key.properties` and
+ * `android/key.properties` are the same answer typed twice.
+ */
+function samePath(configured, readAt) {
+    const clean = (p) => p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/").replace(/\/$/, "");
+    return clean(configured) === clean(readAt);
+}
 /**
  * Where the build resolves the properties file, as a clause a sentence can take.
  *
@@ -579,6 +590,31 @@ export function checkReleaseSigning(input) {
     if (conditionalOn) {
         const { name } = conditionalOn;
         const writes = writesAt(keystore, conditionalOn);
+        /**
+         * The configured path, pointing somewhere the build does not read.
+         *
+         * The one way this check can be wrong while every part of it is right: the
+         * setting wins outright in `runner/gradle-properties.ts` — it exists
+         * precisely because detection cannot always tell — so a path off by a
+         * directory is written, found by nobody, and the release build falls back
+         * to the debug config. That is this check's own failure mode, arrived at
+         * through the field meant to prevent it.
+         *
+         * Said rather than refused. The parser can be wrong about the directory too,
+         * and a correct path overruled by a bad reading would be a build that cannot
+         * run at all — worse than one that says what it is about to do.
+         */
+        const configured = keystore?.propertiesPath ?? null;
+        const readAt = input.conditionalFileAt ?? null;
+        if (configured !== null && readAt !== null && !samePath(configured, readAt)) {
+            return {
+                ...META.releaseSigning,
+                ...warn(`the keystore block names ${configured}, and the build reads ${name}${where(conditionalOn)} — ` +
+                    `at ${readAt}. Laneyard writes the file where the block says, so the build finds none and ` +
+                    "signs with the debug key: it does not fail, and the store rejects the artifact.", `Set the properties file path to ${readAt}, or clear it and Laneyard writes it where the ` +
+                    "build reads it.", "signing"),
+            };
+        }
         // What Laneyard will do, in the words of the file the build already asks
         // for. The keys are named rather than assumed silently: they are a
         // convention — the Flutter documentation's — and the one thing between a
@@ -765,6 +801,7 @@ export const SECTIONS = [
                 run: (i) => checkReleaseSigning({
                     gradle: i.androidSigning,
                     conditionalFilePresent: i.signingFilePresent,
+                    conditionalFileAt: i.signingFileAt ?? null,
                     keystore: i.keystore ?? null,
                 }),
             },

package/dist/src/main.js

@@ -14,6 +14,7 @@ import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
+import { migrateGlobalScope } from "./db/migrate-global-scope.js";
 import { RunStore } from "./db/runs.js";
 import { CredentialStore } from "./db/credentials.js";
 import { SecretStore } from "./db/secrets.js";
@@ -51,6 +52,10 @@ export async function createServerFromConfig(root) {
     if (!loaded.ok)
         throw new Error(`Unreadable configuration: ${loaded.error}`);
     const db = openDatabase(join(root, "laneyard.db"));
+    // Before anything reads the vault: the two scopes are gone, and every query
+    // below names a project. Reported rather than returned quietly — see
+    // `migrate-global-scope.ts` for why a user has to be told.
+    const migration = migrateGlobalScope(db, config.projects().map((p) => p.slug));
     // No run that had begun can survive the shutdown of the process that carried
     // it. Queued runs never began, so they stay queued for the next start.
     new RunStore(db).interruptInFlight();
@@ -76,12 +81,35 @@ export async function createServerFromConfig(root) {
     // this, `wake()` would only ever be called from the trigger route, and three
     // runs queued before a restart would wait for someone to trigger a fourth.
     app.queue.wake();
-    return { app, db, config };
+    return { app, db, config, migration };
+}
+/**
+ * The upgrade notice for a vault that had a global scope.
+ *
+ * Empty for every start but the one that migrates, so it costs nothing to leave
+ * in. It matters on that one start: someone who stored a signing key once now
+ * has a copy per project, and rotating it means replacing each of them. Finding
+ * that out from a build that uploaded with a key they thought they had replaced
+ * would be far worse than a paragraph on a terminal.
+ */
+function migrationNotice(migration) {
+    const { copied, dropped } = migration;
+    if (copied.length === 0 && dropped.length === 0)
+        return "";
+    const lines = [
+        ...copied.map(({ what, name, slugs }) => `  ${bold(name)} — ${what}, now in ${slugs.join(", ")}`),
+        ...dropped.map(({ what, name }) => `  ${bold(name)} — ${what}, ${dim("removed: no project read it")}`),
+    ];
+    return ("\n" +
+        dim("  A secret and a signing block now belong to one project. What was shared\n") +
+        dim("  has been copied into each project that read it — delete any you do not want.\n\n") +
+        lines.join("\n") +
+        "\n");
 }
 /** Real startup, outside tests. */
 async function main() {
     const root = process.env["LANEYARD_HOME"] ?? join(homedir(), ".laneyard");
-    const { app, config } = await createServerFromConfig(root);
+    const { app, config, migration } = await createServerFromConfig(root);
     config.watch((ok) => {
         if (!ok)
             console.error(`Invalid configuration, the previous one stays active: ${config.lastError()}`);
@@ -105,6 +133,7 @@ async function main() {
                     dim("  No project yet. From a folder that already uses fastlane:\n") +
                     `  ${bold("laneyard setup")}\n`
             : "") +
+        migrationNotice(migration) +
         "\n");
 }
 /**

package/dist/src/runner/env-file.js

@@ -0,0 +1,144 @@
+/**
+ * The environment file a build reads from disk.
+ *
+ * A project's own `.env` — the one its app reads, not the one fastlane reads —
+ * is gitignored, and Laneyard builds from a clone, so it is never there. The
+ * vault does not answer that on its own: a stored secret becomes an environment
+ * variable of the run, which is enough for fastlane and enough for a Fastfile
+ * that forwards values itself, and no use at all to anything that reads a
+ * *file*. `flutter_dotenv` bundles `.env` as an asset,
+ * `--dart-define-from-file=config.json` reads a path at compile time, an
+ * `.xcconfig` is a file by definition. None of them looks at the environment,
+ * and none of them fails loudly — they produce an app configured with nothing.
+ *
+ * So the variables a project ticks are rendered into a file at the path its
+ * `laneyard.yml` names, for the length of one run, and removed afterwards. The
+ * ticking decides membership of this file and nothing else: a ticked secret
+ * still reaches the run as an environment variable like every other one.
+ */
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { LANEYARD_MARKER } from "./gradle-properties.js";
+/**
+ * Whether a value can be written bare.
+ *
+ * Anything outside this set is quoted. The set is deliberately narrow — a bare
+ * line is a convenience, and being wrong about it costs a value silently read
+ * back short. `#` starts a comment, whitespace at either end is trimmed by most
+ * readers, and a quote or backslash is an escape somebody has to interpret.
+ */
+const BARE = /^[A-Za-z0-9_./:@+-]*$/;
+/**
+ * Escapes a value for a double-quoted dotenv line.
+ *
+ * Backslash first, or every escape this function then writes would be escaped
+ * again by its own output. Newlines become `\n` rather than being written
+ * literally: a line break inside a value ends the line, and the parser reads a
+ * truncated value and a second variable that does not exist. A private key
+ * pasted into a variable is where that happens for real.
+ */
+function escape(value) {
+    return value
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\r/g, "\\r")
+        .replace(/\n/g, "\\n");
+}
+/**
+ * Renders variables as dotenv text.
+ *
+ * Sorted by name, so a diff between two runs shows what changed rather than
+ * what moved. Pure, and tested against a parser rather than against itself:
+ * the property worth having is "a reader gets back what went in", and a test
+ * written against this function's own idea of the format would pass however
+ * wrong that idea was.
+ */
+export function renderDotenv(values) {
+    return Object.keys(values)
+        .sort()
+        .map((key) => dotenvLine(key, values[key]))
+        .join("");
+}
+/**
+ * One `KEY=value` line, quoted if the value needs it.
+ *
+ * Exported for the preview the secrets screen shows, which renders a stand-in
+ * for every masked value rather than the value. It has to compose its own lines
+ * — a row of dots is not ASCII, so it would come back quoted, and the quotes
+ * would be a claim about the real value that nobody can check. It still goes
+ * through this function for everything it does show, so the preview and the
+ * file cannot drift apart in how they write a line.
+ */
+export function dotenvLine(key, value) {
+    return `${key}=${BARE.test(value) ? value : `"${escape(value)}"`}\n`;
+}
+/** The first line of a file, or null when there is no file to read. */
+async function firstLine(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    return text === null ? null : (text.split("\n")[0] ?? "");
+}
+/** Whether this file is one Laneyard wrote, and may therefore replace or remove. */
+async function ours(path) {
+    const line = await firstLine(path);
+    return line === null || line.trimEnd() === LANEYARD_MARKER;
+}
+/**
+ * Writes the environment file, and returns its path — or null, having written
+ * nothing.
+ *
+ * Null has two causes and neither is an error: the project names no `env_file`,
+ * or a file is already there that Laneyard did not write. That second one is
+ * the important guard. The path points into a clone the user can work in by
+ * hand, and a `.env` they put there themselves is their build's real
+ * configuration — overwriting it would replace something that works with
+ * something assembled from a checklist. It is left exactly as it is.
+ *
+ * The marker is the first line, so the file says what it is to anyone who opens
+ * it, and so this function can tell its own output from a person's on the next
+ * run. `#` is a comment in dotenv, which is the reason dotenv is the only
+ * format for now: JSON has nowhere to put a line like this.
+ */
+export async function writeEnvFile(appRoot, envFile, values) {
+    if (envFile === undefined)
+        return null;
+    const path = join(appRoot, envFile);
+    if (!(await ours(path)))
+        return null;
+    await mkdir(dirname(path), { recursive: true });
+    // The mode is set twice, as in `materialise.ts` and `gradle-properties.ts`:
+    // `writeFile`'s mode is masked by the process umask, and ignored outright for
+    // a file that already exists. This one holds whatever the vault held.
+    await writeFile(path, `${LANEYARD_MARKER}\n${renderDotenv(values)}`, { mode: 0o600 });
+    await chmod(path, 0o600);
+    return path;
+}
+/**
+ * Removes a file this run wrote, and only such a file.
+ *
+ * Called from the run's `finally`, so the values do not outlive the build that
+ * needed them. Takes null so the caller can hand it whatever `writeEnvFile`
+ * returned without a branch of its own.
+ */
+export async function removeEnvFile(path) {
+    if (path === null)
+        return;
+    if ((await firstLine(path))?.trimEnd() !== LANEYARD_MARKER)
+        return;
+    await rm(path, { force: true }).catch(() => { });
+}
+/**
+ * Removes a marked file left where this run would write one.
+ *
+ * A run killed between writing the file and reaching its `finally` — an
+ * unplugged server, a `kill -9` — leaves values in a working tree that is kept
+ * between runs. Nothing at that moment can clean up after itself, so the next
+ * run does it first.
+ *
+ * Silent about everything: a workspace that was never cloned has nothing to
+ * sweep, and a sweep that failed must not be the reason a build did not start.
+ */
+export async function sweepEnvFile(appRoot, envFile) {
+    if (envFile === undefined)
+        return;
+    await removeEnvFile(join(appRoot, envFile)).catch(() => { });
+}

package/dist/src/runner/orchestrate.js

@@ -7,6 +7,7 @@ import { Redactor, scrub } from "../logs/redact.js";
 import { assertFastlaneDir } from "../sidecar/fastlane-dir.js";
 import { collectArtifacts } from "./artifacts.js";
 import { removeGradleProperties, sweepGradleProperties, writeGradleProperties, } from "./gradle-properties.js";
+import { removeEnvFile, sweepEnvFile, writeEnvFile } from "./env-file.js";
 import { LiveStepTracker } from "./live-steps.js";
 import { startPty } from "./pty.js";
 import { readReport } from "./report.js";
@@ -31,13 +32,14 @@ import { readReport } from "./report.js";
  * inside the run and has to be visible to a `finally` wrapped around all of it.
  */
 export async function executeRun(opts) {
-    const wrote = { properties: null };
+    const wrote = { properties: null, envFile: null };
     try {
         return await execute(opts, wrote);
     }
     finally {
         // Guarded by the marker, so a file the user replaced mid-run survives.
         await removeGradleProperties(wrote.properties).catch(() => { });
+        await removeEnvFile(wrote.envFile).catch(() => { });
         // Deliberately swallowed: by now the log writer is closed and the run's
         // verdict is recorded, so there is nowhere left to report this without
         // rewriting a finished run's outcome as a failure it did not have. A
@@ -139,6 +141,7 @@ async function execute(opts, wrote) {
         return fail(cause.message);
     }
     await sweepGradleProperties(appRoot, opts.androidKeystore).catch(() => { });
+    await sweepEnvFile(appRoot, settings.env_file).catch(() => { });
     try {
         wrote.properties = await writeGradleProperties(appRoot, opts.androidKeystore);
     }
@@ -148,6 +151,16 @@ async function execute(opts, wrote) {
         // succeeds, signed with the debug key, rejected by the store days later.
         return fail(`Could not write the signing properties file: ${cause.message}`);
     }
+    try {
+        wrote.envFile = await writeEnvFile(appRoot, settings.env_file, opts.envFileValues ?? {});
+    }
+    catch (cause) {
+        // Failing for the same reason, and it is the same shape of failure. A build
+        // that carries on without the file it was configured to read does not stop:
+        // it produces an app pointed at nothing, which is discovered by a person
+        // opening it rather than by this run.
+        return fail(`Could not write the environment file: ${cause.message}`);
+    }
     // Cancelled during preparation: fastlane never gets to start.
     if (opts.signal?.aborted) {
         return finishAs("cancelled", "Cancelled");

package/dist/src/secrets/vault.js

@@ -21,8 +21,8 @@ export class Vault {
     static async open(home, store, credentials) {
         return new Vault(await loadOrCreateKey(home), store, credentials);
     }
-    async set(projectSlug, key, value, masked) {
-        this.store.set(projectSlug, key, encrypt(value, this.key), masked);
+    async set(projectSlug, key, value, masked, inEnvFile = false) {
+        this.store.set(projectSlug, key, encrypt(value, this.key), masked, inEnvFile);
     }
     remove(projectSlug, key) {
         return this.store.remove(projectSlug, key);
@@ -66,24 +66,6 @@ export class Vault {
             }
         });
     }
-    listGlobal() {
-        return this.store.listGlobal();
-    }
-    /**
-     * What the vault holds under one project's own name — secrets and signing
-     * blocks — and nothing global.
-     *
-     * Its own method rather than a filter over `list`, because the question is a
-     * different one: `list` is "what would a run of this project see", and this is
-     * "what would be left behind if the project went away". A global secret is in
-     * the first answer and must never be in the second.
-     */
-    ownedBy(projectSlug) {
-        return {
-            secrets: this.store.listOwn(projectSlug),
-            credentials: this.credentials.listOwn(projectSlug),
-        };
-    }
     /**
      * Forgets everything stored under one project's name.
      *
@@ -92,13 +74,15 @@ export class Vault {
      * covers all of it. What it forgets is Laneyard's own encrypted copy — the
      * `.p8` and the keystore that went in are still wherever the user keeps them.
      *
-     * Scoped by slug, so a global secret or a global signing block survives it:
-     * those are read by every project and are never one project's to remove.
+     * There is nothing it has to leave behind. Everything a project sees is a row
+     * under its own slug, so "what would a run see" and "what would be left if the
+     * project went away" are now the same question — which is most of the point of
+     * having one scope.
      */
     forget(projectSlug) {
         return {
-            secrets: this.store.removeAllOwn(projectSlug),
-            credentials: this.credentials.removeAllOwn(projectSlug),
+            secrets: this.store.removeAll(projectSlug),
+            credentials: this.credentials.removeAll(projectSlug),
         };
     }
     /**
@@ -111,7 +95,7 @@ export class Vault {
         return scrub(text, this.maskedValues(projectSlug));
     }
     /**
-     * Every secret that applies to a project, ready to become environment variables.
+     * Every secret a project holds, ready to become environment variables.
      *
      * A row that will not decrypt is skipped rather than thrown: a key that was
      * rotated or a corrupted row should cost one variable, not the whole build.
@@ -160,6 +144,23 @@ export class Vault {
     setMasked(projectSlug, key, masked) {
         return this.store.setMasked(projectSlug, key, masked);
     }
+    /** Flips whether a value is written into the environment file. */
+    setInEnvFile(projectSlug, key, inEnvFile) {
+        return this.store.setInEnvFile(projectSlug, key, inEnvFile);
+    }
+    /**
+     * The variables that go in the environment file, in the clear, ready to be
+     * rendered.
+     *
+     * Decrypted here rather than in the writer, so plaintext stays inside this one
+     * file — the property the whole module exists to make checkable by reading.
+     * A row that will not decrypt is skipped, the same leniency `resolve` takes:
+     * the build then fails on its own terms rather than on a rotated key.
+     */
+    envFileValues(projectSlug) {
+        const wanted = new Set(this.store.envFileKeys(projectSlug));
+        return Object.fromEntries(Object.entries(this.resolve(projectSlug)).filter(([key]) => wanted.has(key)));
+    }
     /**
      * Stores a signing block: the file, and the fields that make it usable.
      *
@@ -177,7 +178,7 @@ export class Vault {
         });
     }
     /**
-     * One block that applies to a project, in the clear, or undefined if there is none.
+     * One of a project's blocks, in the clear, or undefined if there is none.
      *
      * Unlike `resolve`, an unreadable row throws. The leniency there is earned: a
      * missing variable makes fastlane stop and say which one. A block that quietly
@@ -205,8 +206,96 @@ export class Vault {
     listCredentials(projectSlug) {
         return this.credentials.list(projectSlug);
     }
-    listGlobalCredentials() {
-        return this.credentials.listGlobal();
+    /**
+     * The same listing, with the fields that are not secret attached.
+     *
+     * The exact trade `listWithValues` makes for secrets, made again here and for
+     * a reason this project learned the hard way: a block whose every field reads
+     * `stored` cannot be checked. An alias with a character missing, a key id off
+     * by a digit, and the screen says the same word it says when they are right —
+     * so the mistake is found by a build that fails an hour later, if it fails at
+     * all rather than shipping a debug-signed artifact.
+     *
+     * A field marked `secret` is never here. Those come one at a time through
+     * `revealCredentialField`, so opening the screen puts no password in a
+     * browser.
+     *
+     * An unanswered optional field is absent rather than empty: the block never
+     * held it, and `""` would read as an answer somebody gave. A block that will
+     * not decrypt keeps its summary and loses its fields — the same leniency the
+     * rest of this file takes, and the screen still says what file is in place.
+     */
+    listCredentialsWithFields(projectSlug) {
+        return this.credentials.list(projectSlug).map((summary) => {
+            try {
+                const block = this.resolveCredential(projectSlug, summary.kind);
+                const fields = {};
+                for (const field of fieldsOf(summary.kind)) {
+                    const value = block?.fields[field.name];
+                    if (!field.secret && value)
+                        fields[field.name] = value;
+                }
+                return { ...summary, fields };
+            }
+            catch {
+                return { ...summary, fields: {} };
+            }
+        });
+    }
+    /**
+     * One field of one block, in the clear — a password included, on request.
+     *
+     * Deliberately as narrow as `reveal`: one named field of one named block, by
+     * an admin, one request at a time. That is what keeps a keystore password a
+     * secret while still letting somebody check the one they suspect of a typo,
+     * which is the whole reason this exists — a password can only be replaced by
+     * uploading the whole block again, and replacing a value you cannot read is
+     * how the wrong one gets stored twice.
+     *
+     * Null for a block that is not stored or a field it does not hold.
+     */
+    revealCredentialField(projectSlug, kind, field) {
+        const block = this.resolveCredential(projectSlug, kind);
+        return block?.fields[field] ?? null;
+    }
+    /**
+     * Corrects fields of a stored block, leaving its file alone.
+     *
+     * A block is still taken whole on the way in: `setCredential` is what "taken
+     * whole or refused" means, and it is right for a block arriving for the first
+     * time — a keystore with no alias is not a partial success. It was wrong for a
+     * block already in place. A password typed with one character missing could
+     * only be fixed by uploading the `.jks` again, which is asking someone to
+     * re-supply the one part that was never in doubt, and every re-supply is
+     * another chance to get the part that was in doubt wrong a second time.
+     *
+     * So: the fields given are the fields changed, and nothing else moves. An
+     * empty value removes an optional field, which is how an answer is taken back
+     * — the reader then falls back to what it would have used anyway. The caller
+     * decides what may be emptied; this stores what it is told.
+     *
+     * Returns false when there is no such block. Throws, through
+     * `resolveCredential`, on a block that will not decrypt: rewriting one of its
+     * fields would mean re-encrypting a file read as garbage.
+     */
+    async updateCredential(projectSlug, kind, changes) {
+        const block = this.resolveCredential(projectSlug, kind);
+        if (!block)
+            return false;
+        const fields = { ...block.fields };
+        for (const [name, value] of Object.entries(changes.fields ?? {})) {
+            if (value === "")
+                delete fields[name];
+            else
+                fields[name] = value;
+        }
+        await this.setCredential(projectSlug, kind, {
+            fileName: changes.file?.fileName ?? block.fileName,
+            fileBytes: changes.file?.fileBytes ?? block.fileBytes,
+            fields,
+            varNames: { ...block.varNames, ...(changes.varNames ?? {}) },
+        });
+        return true;
     }
     removeCredential(projectSlug, kind) {
         return this.credentials.remove(projectSlug, kind);

package/dist/src/server/app.js

@@ -98,6 +98,10 @@ export async function buildApp(deps) {
             },
             env: process.env,
             secrets: ctx.vault.resolve(slug),
+            // A subset of the line above, not a second source. The tick decides which
+            // variables are also written into the file the build reads from disk;
+            // every one of them still reaches the run through the environment.
+            envFileValues: ctx.vault.envFileValues(slug),
             credentialEnv: credentials.env,
             androidKeystore: credentials.keystore,
             cleanup: credentials.cleanup,