onesecret 0.0.0-stage → 0.0.0

package/src/cli.js

@@ -0,0 +1,347 @@
+'use strict'
+
+const { spawn, spawnSync } = require('node:child_process')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const mri = require('mri')
+const secrets = require('./secrets')
+const write = require('./write')
+const deploy = require('./deploy')
+const store = require('./store')
+const { isEnvScalar, toDotenv } = require('./format')
+const yaml = require('./yaml')
+const { withoutAgeKey } = require('./keys')
+const { OnesecretError } = require('./error')
+
+const HELP = fs.readFileSync(
+  path.join(__dirname, '..', 'bin', 'help.txt'),
+  'utf8'
+)
+
+const usage = message => {
+  throw new OnesecretError(`${message}\n\n${HELP}`, 'EUSAGE')
+}
+
+const readOptions = flags => ({
+  dir: flags.dir,
+  env: flags.env,
+  cwd: flags.cwd
+})
+
+const writeOptions = flags => ({ dir: flags.dir, cwd: flags.cwd })
+
+const writeLayerOf = flags => flags.env || 'default'
+
+const relative = file => path.relative(process.cwd(), file) || file
+
+const shellQuote = text => `'${text.replace(/'/g, "'\\''")}'`
+
+const WAIT_FLAGS = {
+  atom: '--wait',
+  bbedit: '-w',
+  clion: '--wait',
+  code: '--wait',
+  'code-insiders': '--wait',
+  codium: '--wait',
+  cursor: '--wait',
+  gedit: '--wait',
+  goland: '--wait',
+  gvim: '-f',
+  idea: '--wait',
+  kate: '--block',
+  mate: '-w',
+  mvim: '-f',
+  nova: '--wait',
+  phpstorm: '--wait',
+  pycharm: '--wait',
+  rider: '--wait',
+  rubymine: '--wait',
+  subl: '--wait',
+  webstorm: '--wait',
+  windsurf: '--wait',
+  zed: '--wait'
+}
+
+const waitingEditor = editor => {
+  const [command, ...args] = editor.trim().split(/\s+/)
+  const flag = WAIT_FLAGS[path.basename(command)]
+  if (!flag || [flag, '-w', '--wait'].some(wait => args.includes(wait))) {
+    return editor
+  }
+  return `${editor} ${flag}`
+}
+
+const openEditor = file => {
+  const editor = waitingEditor(process.env.VISUAL || process.env.EDITOR || 'vi')
+  const { status, error } = spawnSync(`${editor} ${shellQuote(file)}`, {
+    stdio: 'inherit',
+    shell: true
+  })
+  if (error || status !== 0) {
+    throw new OnesecretError(
+      `editor "${editor}" exited without saving`,
+      'EUSAGE'
+    )
+  }
+  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+}
+
+const EDIT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP']
+
+const assertOnlyFileOfLayer = (file, kind) => {
+  const dir = path.dirname(file)
+  const layer = secrets.assertEnv(store.layerOfFile(file))
+  const existing =
+    kind === 'plain'
+      ? store.findPlainFile(dir, layer)
+      : store.findLayerFile(dir, layer)
+  if (existing && existing !== file) {
+    throw new OnesecretError(
+      `${relative(existing)} already holds the ${layer} layer, edit it instead`,
+      'EUSAGE'
+    )
+  }
+}
+
+const plainTarget = file => {
+  const original = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+  return {
+    file,
+    original,
+    workspaceName: path.basename(file),
+    save: copy => {
+      try {
+        store.readPlain(copy)
+      } catch (error) {
+        throw new OnesecretError(
+          error.reason.split(copy).join(relative(file)),
+          'EVALUE'
+        )
+      }
+      store.writeText(file, fs.readFileSync(copy, 'utf8'))
+      return `${relative(file)} saved`
+    }
+  }
+}
+
+const encryptedTarget = current => {
+  write.encryptionFor(current.file, current.existing)
+  return {
+    file: current.file,
+    original: write.toEditableYaml(current.tree),
+    workspaceName: path
+      .basename(current.file)
+      .replace(/\.enc\.(ya?ml|json)$/, '.yml'),
+    save: copy =>
+      `${relative(
+        write.writeLayer(
+          current,
+          write.fromEditableYaml(fs.readFileSync(copy, 'utf8'))
+        )
+      )} encrypted`
+  }
+}
+
+const editTargetOf = (flags, args) => {
+  if (args.length > 1) usage('edit takes at most one file')
+  if (args.length === 0) {
+    return encryptedTarget(
+      write.readLayer(writeOptions(flags), writeLayerOf(flags))
+    )
+  }
+  if (flags.env) usage('edit takes a file or --env, not both')
+  const file = path.resolve(flags.cwd || process.cwd(), args[0])
+  const kind = store.fileKindOf(file)
+  if (!kind) usage(`edit needs a .yml, .yaml, or .json file, got "${args[0]}"`)
+  assertOnlyFileOfLayer(file, kind)
+  return kind === 'plain'
+    ? plainTarget(file)
+    : encryptedTarget(write.readFile(writeOptions(flags), file))
+}
+
+const saveErrorOf = error =>
+  error instanceof OnesecretError
+    ? error.message
+    : `onesecret: cannot save, ${error.code || error.message}`
+
+const editInWorkspace = (target, copy) => {
+  fs.writeFileSync(copy, target.original, { mode: 0o600 })
+  let failed = null
+  for (;;) {
+    const text = openEditor(copy)
+    if (text === target.original) return `${relative(target.file)} unchanged`
+    const retry = failed !== null && text === failed.text
+    if (retry && failed.invalid) {
+      throw new OnesecretError(
+        `edit aborted, ${relative(target.file)} is unchanged`,
+        'EVALUE'
+      )
+    }
+    try {
+      return target.save(copy)
+    } catch (error) {
+      console.error(
+        `${saveErrorOf(error)}\nReopening the editor, save it unchanged to ${
+          error instanceof OnesecretError ? 'abort' : 'try again'
+        }.`
+      )
+      failed = { text, invalid: error instanceof OnesecretError }
+    }
+  }
+}
+
+const edit = (flags, args) => {
+  const target = editTargetOf(flags, args)
+  const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'onesecret-'))
+  const removeWorkspace = () =>
+    fs.rmSync(workspace, { recursive: true, force: true })
+  const onSignal = signal => {
+    removeWorkspace()
+    process.exit(128 + os.constants.signals[signal])
+  }
+  for (const signal of EDIT_SIGNALS) process.on(signal, onSignal)
+  try {
+    return editInWorkspace(target, path.join(workspace, target.workspaceName))
+  } finally {
+    removeWorkspace()
+    for (const signal of EDIT_SIGNALS) process.off(signal, onSignal)
+  }
+}
+
+const exec = (flags, command) => {
+  if (command.length === 0) usage('exec needs a command after --')
+  const env = withoutAgeKey(process.env)
+  if (flags.env) env.NODE_ENV = flags.env
+  secrets.fill(
+    { ...readOptions(flags), processEnv: env },
+    { allowKeyCommand: true }
+  )
+  const child = spawn(command[0], command.slice(1), { stdio: 'inherit', env })
+  for (const signal of EDIT_SIGNALS) {
+    process.on(signal, () => child.kill(signal))
+  }
+  return new Promise((resolve, reject) => {
+    child.on('error', error =>
+      reject(
+        new OnesecretError(
+          `cannot run ${command[0]}: ${error.message}`,
+          'EUSAGE'
+        )
+      )
+    )
+    child.on('exit', (code, signal) =>
+      resolve({ exitCode: signal ? 128 + os.constants.signals[signal] : code })
+    )
+  })
+}
+
+const COMMANDS = {
+  init: flags => {
+    const result = write.initialize(writeOptions(flags))
+    if (result.status === 'existing') {
+      return `already initialized for ${result.recipients.join(
+        ','
+      )} (${relative(result.defaultFile)})`
+    }
+    if (result.status === 'adopted') {
+      return `created ${relative(
+        result.defaultFile
+      )} for ${result.recipients.join(',')} (from ${result.source})`
+    }
+    return [
+      `public key   ${result.recipients[0]}`,
+      `private key  ${result.identity}`,
+      `secrets      ${relative(result.defaultFile)}`,
+      '',
+      'The private key is shown only now and is not saved anywhere. Keep it in your',
+      'password manager and as SOPS_AGE_KEY in CI. To use it in this shell:',
+      '',
+      `  export SOPS_AGE_KEY=${result.identity}`
+    ].join('\n')
+  },
+  set: (flags, args) => {
+    if (args.length === 0) usage('set needs at least one NAME=value')
+    return `${relative(
+      write.set(writeOptions(flags), writeLayerOf(flags), args)
+    )} encrypted`
+  },
+  unset: (flags, args) => {
+    if (args.length === 0) usage('unset needs at least one NAME')
+    return `${relative(
+      write.unset(writeOptions(flags), writeLayerOf(flags), args)
+    )} encrypted`
+  },
+  edit,
+  rekey: flags =>
+    `${relative(
+      write.rekey(writeOptions(flags), writeLayerOf(flags))
+    )} encrypted with a new data key`,
+  ls: flags => secrets.names(readOptions(flags)).join('\n'),
+  get: (flags, args) => {
+    if (args.length !== 1) usage('get needs exactly one NAME')
+    const values = secrets.get(readOptions(flags), args[0])
+    if (!Object.hasOwn(values, args[0])) {
+      throw new OnesecretError(`"${args[0]}" is not set in any layer`, 'EVALUE')
+    }
+    const value = values[args[0]]
+    if (value === null) return ''
+    return isEnvScalar(value) ? String(value) : yaml.dump(value).trimEnd()
+  },
+  dotenv: flags =>
+    toDotenv(
+      secrets.loadSecrets(secrets.readLayers(readOptions(flags)))
+    ).trimEnd(),
+  exec: (flags, args) => exec(flags, args),
+  kubernetes: flags => {
+    const { checksum, output } = deploy.kubernetes({
+      ...readOptions(flags),
+      name: flags.name,
+      namespace: flags.namespace,
+      context: flags.context
+    })
+    if (output) console.error(output)
+    return checksum
+  },
+  fly: flags => {
+    const { checksum, output } = deploy.fly({
+      ...readOptions(flags),
+      app: flags.app,
+      stage: flags.stage
+    })
+    if (output) console.error(output)
+    return checksum
+  }
+}
+
+const parse = argv => {
+  const separator = argv.indexOf('--')
+  const own = separator === -1 ? argv : argv.slice(0, separator)
+  const rest = separator === -1 ? [] : argv.slice(separator + 1)
+  const {
+    _: [command, ...args],
+    ...flags
+  } = mri(own, {
+    boolean: ['help', 'version', 'stage'],
+    string: ['dir', 'env', 'cwd', 'name', 'namespace', 'context', 'app'],
+    alias: { h: 'help', v: 'version', e: 'env', n: 'namespace' },
+    default: { stage: true }
+  })
+  return {
+    command,
+    args: command === 'exec' ? rest : [...args, ...rest],
+    flags
+  }
+}
+
+const run = async argv => {
+  const { command, args, flags } = parse(argv)
+  if (flags.version) return { stdout: require('../package.json').version }
+  if (flags.help || !command) return { stdout: HELP.trimEnd() }
+  const handler = COMMANDS[command]
+  if (!handler) usage(`unknown command "${command}"`)
+  const result = await handler(flags, args)
+  return typeof result === 'object' ? result : { stdout: result }
+}
+
+module.exports = { run }

package/src/deploy.js

@@ -0,0 +1,113 @@
+'use strict'
+
+const { execFileSync } = require('node:child_process')
+const yaml = require('js-yaml')
+const { loadSecrets, readLayers } = require('./secrets')
+const { withoutAgeKey } = require('./keys')
+const { checksum, toEnv } = require('./format')
+const flyEncoding = require('./fly')
+const { OnesecretError } = require('./error')
+
+const MANAGED_BY_LABEL = 'app.kubernetes.io/managed-by'
+
+const loadForDeploy = (target, options) => {
+  if (!options.env) {
+    throw new OnesecretError(
+      `${target} needs an explicit env, such as "production"`,
+      'EVALUE'
+    )
+  }
+  const layered = readLayers(options)
+  const envLayer = layered.layers.find(({ name }) => name === layered.env)
+  if (!envLayer.plainFile && !envLayer.encryptedFile) {
+    throw new OnesecretError(
+      `${target} found no "${layered.env}" layer in ${layered.dir}, pass --env default to deploy the default layer alone`,
+      'EVALUE'
+    )
+  }
+  return loadSecrets(layered)
+}
+
+const run = (binary, args, input) => {
+  try {
+    return execFileSync(binary, args, {
+      input,
+      encoding: 'utf8',
+      env: withoutAgeKey(process.env),
+      stdio: ['pipe', 'pipe', 'pipe']
+    })
+  } catch (error) {
+    const output = [error.stdout, error.stderr].filter(Boolean).join('\n')
+    const redacted = output.replace(/=.*/g, '=***').trim()
+    const reason =
+      error.code === 'ENOENT'
+        ? `${binary} is not installed`
+        : redacted || error.message
+    throw new OnesecretError(
+      `${binary} ${args.slice(0, 3).join(' ')} failed: ${reason}`,
+      'EDEPLOY'
+    )
+  }
+}
+
+const kubernetesManifest = ({ name, namespace, secrets }) =>
+  yaml.dump(
+    {
+      apiVersion: 'v1',
+      kind: 'Secret',
+      metadata: {
+        name,
+        ...(namespace && { namespace }),
+        labels: { [MANAGED_BY_LABEL]: 'onesecret' }
+      },
+      type: 'Opaque',
+      data: Object.fromEntries(
+        Object.entries(toEnv(secrets)).map(([key, value]) => [
+          key,
+          Buffer.from(value).toString('base64')
+        ])
+      )
+    },
+    { lineWidth: -1 }
+  )
+
+const kubernetes = ({
+  name,
+  namespace,
+  context,
+  kubectl = 'kubectl',
+  args = [],
+  ...options
+}) => {
+  if (!name) {
+    throw new OnesecretError('kubernetes needs the Secret name', 'EVALUE')
+  }
+  const secrets = loadForDeploy('kubernetes', options)
+  const contextArgs = context ? ['--context', context] : []
+  const output = run(
+    kubectl,
+    [...contextArgs, ...args, 'apply', '-f', '-'],
+    kubernetesManifest({ name, namespace, secrets })
+  )
+  return { checksum: checksum(secrets), output: output.trim() }
+}
+
+const flyImport = secrets => flyEncoding.encode(toEnv(secrets))
+
+const fly = ({ app, stage = true, flyctl = 'fly', ...options }) => {
+  if (!app) throw new OnesecretError('fly needs the app name', 'EVALUE')
+  const secrets = loadForDeploy('fly', options)
+  const stageArgs = stage ? ['--stage'] : []
+  const output = run(
+    flyctl,
+    ['secrets', 'import', ...stageArgs, '--app', app],
+    flyImport(secrets)
+  )
+  const summary = output
+    .split('\n')
+    .filter(line => line.trim() && !line.includes('='))
+    .join('\n')
+  return { checksum: checksum(secrets), output: summary }
+}
+
+module.exports = { fly, flyImport, kubernetes, kubernetesManifest }

package/src/dotenv.js

@@ -0,0 +1,67 @@
+'use strict'
+
+const { parseEnv } = require('node:util')
+const { isDeepStrictEqual } = require('node:util')
+const { OnesecretError } = require('./error')
+
+const DOTENV_LINE =
+  /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/gm
+const QUOTES = ["'", '`', '"']
+const NEIGHBOR = 'ONESECRET_NEIGHBOR'
+
+const parseDotenvPackage = source => {
+  const secrets = {}
+  const lines = source.replace(/\r\n?/gm, '\n')
+  for (const match of lines.matchAll(DOTENV_LINE)) {
+    const quote = (match[2] || '').trim()[0]
+    let value = (match[2] || '').trim().replace(/^(['"`])([\s\S]*)\1$/gm, '$2')
+    if (quote === '"') value = value.replace(/\\n/g, '\n').replace(/\\r/g, '\r')
+    secrets[match[1]] = value
+  }
+  return secrets
+}
+
+const PARSERS = [source => ({ ...parseEnv(source) }), parseDotenvPackage]
+
+const readsBackAs = (source, expected) =>
+  PARSERS.every(parse => isDeepStrictEqual(parse(source), expected))
+
+const survivesNeighbors = (line, name, value) =>
+  QUOTES.every(quote =>
+    readsBackAs(`${line}${NEIGHBOR}=${quote}#${quote}\n`, {
+      [name]: value,
+      [NEIGHBOR]: '#'
+    })
+  )
+
+const encodeLine = (name, value) => {
+  const line = [value, ...QUOTES.map(quote => quote + value + quote)]
+    .map(encoded => `${name}=${encoded}\n`)
+    .find(
+      line =>
+        readsBackAs(line, { [name]: value }) &&
+        survivesNeighbors(line, name, value)
+    )
+  if (!line) {
+    throw new OnesecretError(
+      `"${name}" cannot be written as dotenv without changing its value`,
+      'EVALUE'
+    )
+  }
+  return line
+}
+
+const encode = secrets => {
+  const body = Object.entries(secrets)
+    .map(([name, value]) => encodeLine(name, value))
+    .join('')
+  if (!readsBackAs(body, secrets)) {
+    throw new OnesecretError(
+      'the dotenv output does not read back to the same secrets',
+      'EVALUE'
+    )
+  }
+  return body
+}
+
+module.exports = { encode, parseDotenvPackage }

package/src/error.js

@@ -0,0 +1,12 @@
+'use strict'
+
+class OnesecretError extends Error {
+  constructor (message, code) {
+    super(`onesecret: ${message}`)
+    this.name = 'OnesecretError'
+    this.code = code
+    this.reason = message
+  }
+}
+
+module.exports = { OnesecretError }

package/src/fly.js

@@ -0,0 +1,109 @@
+'use strict'
+
+const { isDeepStrictEqual } = require('node:util')
+const { OnesecretError } = require('./error')
+
+const TRIPLE_QUOTE = '"""'
+const SCANNER_MAX_LINE_BYTES = 64 * 1024 - 1
+
+const scanLines = text => {
+  const lines = text.split('\n')
+  if (lines[lines.length - 1] === '') lines.pop()
+  return lines.map(line => line.replace(/\r$/, ''))
+}
+
+const countQuotes = text => text.split('"').length - 1
+
+const parseSinglelineValue = line => {
+  const separator = line.indexOf('=')
+  let value = line.slice(separator + 1).replace(/^ +/, '')
+  const hash = value.indexOf('#')
+  if (hash !== -1 && countQuotes(value.slice(0, hash)) % 2 === 0) { value = value.slice(0, hash).replace(/ +$/, '') }
+  return { key: line.slice(0, separator).trim(), value }
+}
+
+const parse = text => {
+  const secrets = {}
+  let multiline = null
+  for (const line of scanLines(text)) {
+    if (multiline) {
+      if (line.endsWith(TRIPLE_QUOTE)) {
+        secrets[multiline.key] =
+          multiline.value + line.slice(0, -TRIPLE_QUOTE.length)
+        multiline = null
+      } else {
+        multiline.value += `${line}\n`
+      }
+      continue
+    }
+    if (line.startsWith('#') || line.trim() === '') continue
+    if (!line.includes('=')) throw new Error(`"${line}" is not NAME=VALUE`)
+    const { key, value } = parseSinglelineValue(line)
+    if (
+      value.startsWith(TRIPLE_QUOTE) &&
+      value.endsWith(TRIPLE_QUOTE) &&
+      value.length >= 6
+    ) {
+      secrets[key] = value.slice(3, -3)
+    } else if (value.startsWith(TRIPLE_QUOTE)) {
+      multiline = { key, value: `${value.slice(3)}\n` }
+    } else if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      if (value.length < 2) throw new Error('flyctl panics on a lone quote')
+      secrets[key] = value.slice(1, -1)
+    } else {
+      secrets[key] = value
+    }
+  }
+  return secrets
+}
+
+const candidates = value => [
+  value,
+  `${TRIPLE_QUOTE}${value}${TRIPLE_QUOTE}`,
+  `"${value}"`,
+  `'${value}'`
+]
+
+const readsBackAs = (text, expected) => {
+  try {
+    return isDeepStrictEqual(parse(text), expected)
+  } catch {
+    return false
+  }
+}
+
+const isWithinScanner = text =>
+  scanLines(text).every(
+    line => Buffer.byteLength(line) <= SCANNER_MAX_LINE_BYTES
+  )
+
+const encodeLine = (name, value) => {
+  const line = candidates(value)
+    .map(encoded => `${name}=${encoded}\n`)
+    .find(line => isWithinScanner(line) && readsBackAs(line, { [name]: value }))
+  if (!line) {
+    throw new OnesecretError(
+      `"${name}" cannot be imported into fly without changing its value`,
+      'EVALUE'
+    )
+  }
+  return line
+}
+
+const encode = secrets => {
+  const body = Object.entries(secrets)
+    .map(([name, value]) => encodeLine(name, value))
+    .join('')
+  if (!readsBackAs(body, secrets)) {
+    throw new OnesecretError(
+      'the fly import does not read back to the same secrets',
+      'EVALUE'
+    )
+  }
+  return body
+}
+
+module.exports = { encode, parse }

package/src/format.js

@@ -0,0 +1,61 @@
+'use strict'
+
+const crypto = require('node:crypto')
+const dotenv = require('./dotenv')
+const { OnesecretError } = require('./error')
+
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+const isEnvName = name => ENV_NAME.test(name) && name !== '__proto__'
+
+const assertEnvName = name => {
+  if (!isEnvName(name)) {
+    throw new OnesecretError(
+      `"${name}" is not a valid environment variable name`,
+      'EVALUE'
+    )
+  }
+}
+
+const isEnvScalar = value =>
+  ['string', 'number', 'boolean', 'bigint'].includes(typeof value)
+
+const toEnvValue = (name, value) => {
+  assertEnvName(name)
+  if (value === null || value === undefined) return ''
+  if (isEnvScalar(value)) return String(value)
+  throw new OnesecretError(
+    `"${name}" must be a string, number, or boolean to become an environment variable`,
+    'EVALUE'
+  )
+}
+
+const toEnv = secrets =>
+  Object.fromEntries(
+    Object.entries(secrets).map(([name, value]) => [
+      name,
+      toEnvValue(name, value)
+    ])
+  )
+
+const toDotenv = secrets => dotenv.encode(toEnv(secrets))
+
+const checksum = secrets => {
+  const entries = Object.entries(toEnv(secrets)).sort(([a], [b]) =>
+    a < b ? -1 : a > b ? 1 : 0
+  )
+  return crypto
+    .createHash('sha256')
+    .update(JSON.stringify(entries))
+    .digest('hex')
+}
+
+module.exports = {
+  assertEnvName,
+  checksum,
+  isEnvName,
+  isEnvScalar,
+  toDotenv,
+  toEnv,
+  toEnvValue
+}