onesecret 0.0.0-stage → 0.0.0

package/src/index.js

@@ -0,0 +1,20 @@
+'use strict'
+
+const { config, load, names } = require('./secrets')
+const { fly, kubernetes } = require('./deploy')
+const { checksum, toDotenv, toEnv } = require('./format')
+const { withoutAgeKey } = require('./keys')
+const { OnesecretError } = require('./error')
+
+module.exports = {
+  checksum,
+  config,
+  fly,
+  kubernetes,
+  load,
+  names,
+  toDotenv,
+  toEnv,
+  withoutAgeKey,
+  OnesecretError
+}

package/src/keys.js

@@ -0,0 +1,197 @@
+'use strict'
+
+const { execSync } = require('node:child_process')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const age = require('./age')
+const { OnesecretError } = require('./error')
+
+const KEYS_FILE = path.join('sops', 'age', 'keys.txt')
+const AGE_KEY_VARIABLES = [
+  'SOPS_AGE_KEY',
+  'SOPS_AGE_KEY_FILE',
+  'SOPS_AGE_KEY_CMD'
+]
+
+const sopsKeysFile = () => {
+  if (process.env.XDG_CONFIG_HOME) {
+    return path.join(process.env.XDG_CONFIG_HOME, KEYS_FILE)
+  }
+  if (process.platform === 'darwin') {
+    return path.join(os.homedir(), 'Library', 'Application Support', KEYS_FILE)
+  }
+  return path.join(os.homedir(), '.config', KEYS_FILE)
+}
+
+const defaultKeyFiles = () => [
+  ...new Set([sopsKeysFile(), path.join(os.homedir(), '.config', KEYS_FILE)])
+]
+
+const readKeyFile = file => {
+  try {
+    return fs.readFileSync(file, 'utf8')
+  } catch (error) {
+    throw new OnesecretError(
+      `cannot read age key file ${file}: ${error.code || error.message}`,
+      'EKEY'
+    )
+  }
+}
+
+const parseSource = (label, text) => {
+  try {
+    return age.parseIdentities(text)
+  } catch (error) {
+    throw new OnesecretError(
+      `${label} holds an invalid age key: ${error.message}`,
+      'EKEY'
+    )
+  }
+}
+
+const localSources = () => [
+  ...(process.env.SOPS_AGE_KEY
+    ? [['SOPS_AGE_KEY', () => process.env.SOPS_AGE_KEY]]
+    : []),
+  ...(process.env.SOPS_AGE_KEY_FILE
+    ? [
+        [
+          process.env.SOPS_AGE_KEY_FILE,
+          () => readKeyFile(process.env.SOPS_AGE_KEY_FILE)
+        ]
+      ]
+    : []),
+  ...defaultKeyFiles()
+    .filter(file => fs.existsSync(file))
+    .map(file => [file, () => readKeyFile(file)])
+]
+
+const localIdentities = () => {
+  const identities = []
+  const invalid = []
+  for (const [label, read] of localSources()) {
+    try {
+      identities.push(...parseSource(label, read()))
+    } catch (error) {
+      invalid.push(error)
+    }
+  }
+  return { identities, invalid }
+}
+
+const withSkippedSources = (error, invalid) => {
+  if (error.code !== 'EKEY' || invalid.length === 0) return error
+  const skipped = invalid.map(({ reason }) => reason).join('; ')
+  return new OnesecretError(`${error.reason} (skipped: ${skipped})`, 'EKEY')
+}
+
+const commandCache = new Map()
+
+const runKeyCommand = command => {
+  if (!commandCache.has(command)) {
+    try {
+      commandCache.set(command, { identities: readKeyCommand(command) })
+    } catch (error) {
+      commandCache.set(command, { error })
+    }
+  }
+  const { identities, error } = commandCache.get(command)
+  if (error) throw error
+  return identities
+}
+
+const readKeyCommand = command => {
+  let output
+  try {
+    output = execSync(command, {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+  } catch (error) {
+    const detail = error.stderr
+      ? String(error.stderr).trim().split('\n')[0]
+      : ''
+    throw new OnesecretError(
+      `key command "${command}" failed${detail ? `: ${detail}` : ''}`,
+      'EKEY'
+    )
+  }
+  const identities = parseSource(`key command "${command}"`, output)
+  if (identities.length === 0) {
+    throw new OnesecretError(
+      `key command "${command}" printed no age identity`,
+      'EKEY'
+    )
+  }
+  return identities
+}
+
+const keyCommandOf = keyCommand => process.env.SOPS_AGE_KEY_CMD || keyCommand
+
+const withIdentities = (keyCommand, use, { allowKeyCommand = true } = {}) => {
+  const { identities, invalid } = localIdentities()
+  const command = allowKeyCommand ? keyCommandOf(keyCommand) : undefined
+  if (identities.length === 0 && !command) {
+    if (invalid.length > 0) throw invalid[0]
+    const sources = `set SOPS_AGE_KEY or SOPS_AGE_KEY_FILE, or add it to ${sopsKeysFile()}`
+    const hint = allowKeyCommand
+      ? `${sources}, or configure a keyCommand`
+      : `${sources} (keyCommand is not run here)`
+    throw new OnesecretError(`no age key found: ${hint}`, 'ENOKEY')
+  }
+  if (identities.length > 0) {
+    try {
+      return use(identities)
+    } catch (error) {
+      if (error.code !== 'EKEY' || !command) {
+        throw withSkippedSources(error, invalid)
+      }
+    }
+  }
+  return use(runKeyCommand(command))
+}
+
+const withoutAgeKey = env =>
+  Object.fromEntries(
+    Object.entries(env).filter(([name]) => !AGE_KEY_VARIABLES.includes(name))
+  )
+
+const EXPORTED_KEY = /AGE-SECRET-KEY-1[0-9A-Z]+/g
+
+const exportedKeyText = () => {
+  const texts = [process.env.SOPS_AGE_KEY || '']
+  if (process.env.SOPS_AGE_KEY_FILE) {
+    try {
+      texts.push(fs.readFileSync(process.env.SOPS_AGE_KEY_FILE, 'utf8'))
+    } catch {}
+  }
+  return texts
+    .join('\n')
+    .split('\n')
+    .filter(line => !line.trim().startsWith('#'))
+    .join('\n')
+}
+
+const recipientOrNull = identity => {
+  try {
+    return age.recipientOf(identity)
+  } catch {
+    return null
+  }
+}
+
+const exportedRecipients = () => [
+  ...new Set(
+    (exportedKeyText().match(EXPORTED_KEY) || [])
+      .map(recipientOrNull)
+      .filter(Boolean)
+  )
+]
+
+module.exports = {
+  exportedRecipients,
+  sopsKeysFile,
+  withIdentities,
+  withoutAgeKey
+}

package/src/regexp.js

@@ -0,0 +1,91 @@
+'use strict'
+
+const { OnesecretError } = require('./error')
+
+const POSIX_CLASSES = {
+  alnum: '0-9A-Za-z',
+  alpha: 'A-Za-z',
+  ascii: '\\x00-\\x7F',
+  blank: '\\t ',
+  cntrl: '\\x00-\\x1F\\x7F',
+  digit: '0-9',
+  graph: '!-~',
+  lower: 'a-z',
+  print: ' -~',
+  punct: '!-\\/:-@\\[-`{-~',
+  space: '\\t\\n\\v\\f\\r ',
+  upper: 'A-Z',
+  word: '0-9A-Za-z_',
+  xdigit: '0-9A-Fa-f'
+}
+const LEADING_FLAGS = /^\(\?([imsU]+)\)/
+const POSIX_CLASS = /^\[:(\^?)([a-z]+):\]/
+const SUPPORTED_FLAGS = new Set(['i', 'm', 's'])
+const ESCAPES = { A: '(?<![\\s\\S])', z: '(?![\\s\\S])' }
+const UNSUPPORTED_ESCAPES = new Set(['Q', 'E', 'p', 'P', 'C', 'Z'])
+const LITERAL_BRACKET_CLASS = /^\[\^?\]/
+
+const cache = new Map()
+
+const translateBody = pattern => {
+  let output = ''
+  let inClass = false
+  for (let index = 0; index < pattern.length; index++) {
+    const char = pattern[index]
+    const rest = pattern.slice(index)
+    if (char === '\\') {
+      const next = pattern[index + 1]
+      if (
+        UNSUPPORTED_ESCAPES.has(next) ||
+        (next === 'x' && pattern[index + 2] === '{')
+      ) {
+        throw new Error(`the Go escape \\${next} has no JavaScript equivalent`)
+      }
+      output += !inClass && ESCAPES[next] ? ESCAPES[next] : char + (next ?? '')
+      index++
+    } else if (inClass && POSIX_CLASS.test(rest)) {
+      const [match, negated, name] = POSIX_CLASS.exec(rest)
+      if (!POSIX_CLASSES[name]) { throw new Error(`unknown character class [:${name}:]`) }
+      if (negated) { throw new Error(`negated class [:^${name}:] is not supported`) }
+      output += POSIX_CLASSES[name]
+      index += match.length - 1
+    } else if (!inClass && LITERAL_BRACKET_CLASS.test(rest)) {
+      throw new Error('a class that starts with ] is not supported')
+    } else if (rest.startsWith('(?P<')) {
+      output += '(?<'
+      index += 3
+    } else {
+      if (char === '[' && !inClass) inClass = true
+      else if (char === ']' && inClass) inClass = false
+      output += char
+    }
+  }
+  return output
+}
+
+const translate = pattern => {
+  const leading = LEADING_FLAGS.exec(pattern)
+  const flags = leading
+    ? [...leading[1]].filter(flag => SUPPORTED_FLAGS.has(flag)).join('')
+    : ''
+  return new RegExp(
+    translateBody(leading ? pattern.slice(leading[0].length) : pattern),
+    flags
+  )
+}
+
+const goRegExp = pattern => {
+  if (!cache.has(pattern)) {
+    try {
+      cache.set(pattern, translate(pattern))
+    } catch (error) {
+      throw new OnesecretError(
+        `regular expression "${pattern}" is not supported: ${error.message}`,
+        'EFORMAT'
+      )
+    }
+  }
+  return cache.get(pattern)
+}
+
+module.exports = { goRegExp }

package/src/secrets.js

@@ -0,0 +1,331 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const sops = require('./sops')
+const store = require('./store')
+const { withIdentities } = require('./keys')
+const { isEnvName, isEnvScalar, toEnvValue } = require('./format')
+const { OnesecretError } = require('./error')
+
+const DEFAULT_DIR = 'config'
+const DEFAULT_ENV = 'development'
+const SKIP_VARIABLE = 'ONESECRET_SKIP'
+const DEPLOYED_ENVS = ['production', 'staging']
+const EXPORTABLE_TYPES = ['str', 'int', 'float', 'bool', 'time', 'null']
+const FILE_LIKE_ENV = /(^|\.)enc(\.|$)|\.(ya?ml|json)$/i
+const KEY_ERRORS = ['ENOKEY', 'EKEY']
+
+const packageSettings = cwd => {
+  try {
+    return (
+      JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'))
+        .onesecret || {}
+    )
+  } catch {
+    return {}
+  }
+}
+
+const ENV_NAME = /^[a-z0-9_-][a-z0-9_.-]*$/
+
+const assertEnv = env => {
+  if (!ENV_NAME.test(env) || env.includes('..') || FILE_LIKE_ENV.test(env)) {
+    throw new OnesecretError(
+      `"${env}" is not a valid env name, use lowercase letters, digits, ".", "_", or "-"`,
+      'EVALUE'
+    )
+  }
+  return env
+}
+
+const optionsOf = input =>
+  typeof input === 'string' ? { env: input } : input || {}
+
+const resolveOptions = input => {
+  const options = optionsOf(input)
+  const cwd = path.resolve(options.cwd || process.cwd())
+  const settings = packageSettings(cwd)
+  return {
+    cwd,
+    dir: path.resolve(cwd, options.dir || settings.dir || DEFAULT_DIR),
+    env:
+      options.env ||
+      (options.processEnv || process.env).NODE_ENV ||
+      DEFAULT_ENV,
+    keyCommand: options.keyCommand || settings.keyCommand
+  }
+}
+
+const readLayer = (dir, name) => {
+  const plainFile = store.findPlainFile(dir, name)
+  const encryptedFile = store.findLayerFile(dir, name)
+  return {
+    name,
+    plainFile,
+    encryptedFile,
+    values: plainFile ? store.readPlain(plainFile) : {},
+    document: encryptedFile ? readEncrypted(encryptedFile) : null
+  }
+}
+
+const readEncrypted = file => {
+  const document = store.readDocument(file)
+  if (document === null) return null
+  try {
+    sops.names(document)
+  } catch (error) {
+    throw new OnesecretError(`${file}: ${error.reason}`, error.code)
+  }
+  return document
+}
+
+const readLayers = input => {
+  const { dir, env, keyCommand } = resolveOptions(input)
+  assertEnv(env)
+  const layers = store.layersFor(env).map(name => readLayer(dir, name))
+  return { dir, env, keyCommand, layers }
+}
+
+const documentsOf = layers =>
+  layers.map(({ document }) => document).filter(Boolean)
+
+const hasFiles = layers =>
+  layers.some(({ plainFile, encryptedFile }) => plainFile || encryptedFile)
+
+const isPlainObject = value =>
+  Object.prototype.toString.call(value) === '[object Object]'
+
+const secretsOf = layers => {
+  const topmost = new Map()
+  for (const layer of layers) {
+    for (const [name, value] of Object.entries(layer.values)) {
+      const merges =
+        isPlainObject(value) && topmost.get(name)?.type === 'mapping'
+      if (!merges) topmost.set(name, null)
+    }
+    if (!layer.document) continue
+    for (const [name, type] of Object.entries(
+      sops.valueTypes(layer.document)
+    )) {
+      topmost.set(name, { type, file: layer.encryptedFile })
+    }
+  }
+  return new Map([...topmost].filter(([, secret]) => secret))
+}
+
+const secretNamesOf = layers => [...secretsOf(layers).keys()]
+
+const decryptDocuments = (documents, keyCommand, keyOptions) => {
+  if (documents.length === 0) return []
+  return withIdentities(
+    keyCommand,
+    identities => documents.map(document => sops.decrypt(document, identities)),
+    keyOptions
+  )
+}
+
+const decryptDocument = (document, keyCommand) =>
+  decryptDocuments([document], keyCommand)[0]
+
+const UNSAFE_NAME = '__proto__'
+
+const assign = (target, name, value) =>
+  Object.defineProperty(target, name, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true
+  })
+
+const deepMerge = (base, override) => {
+  const merged = { ...base }
+  for (const [name, value] of Object.entries(override)) {
+    if (name === UNSAFE_NAME) continue
+    const current = Object.hasOwn(merged, name) ? merged[name] : undefined
+    assign(
+      merged,
+      name,
+      isPlainObject(value)
+        ? deepMerge(isPlainObject(current) ? current : {}, value)
+        : value
+    )
+  }
+  return merged
+}
+
+const withoutMetadata = document => pick(document, sops.names(document))
+
+const mergeLayers = (layers, decrypted) => {
+  const trees = decrypted
+    ? [...decrypted]
+    : documentsOf(layers).map(withoutMetadata)
+  const merged = layers.reduce((merged, layer) => {
+    const withPlain = deepMerge(merged, layer.values)
+    return layer.document ? deepMerge(withPlain, trees.shift()) : withPlain
+  }, {})
+  if (decrypted) return merged
+  for (const name of secretNamesOf(layers)) delete merged[name]
+  return merged
+}
+
+const pick = (values, names) => {
+  const picked = {}
+  for (const name of names) {
+    if (Object.hasOwn(values, name)) assign(picked, name, values[name])
+  }
+  return picked
+}
+
+const names = input => secretNamesOf(readLayers(input).layers)
+
+const loadLayers = ({ layers, keyCommand }) =>
+  mergeLayers(layers, decryptDocuments(documentsOf(layers), keyCommand))
+
+const load = input => loadLayers(readLayers(input))
+
+const get = (input, name) => {
+  const layered = readLayers(input)
+  return secretNamesOf(layered.layers).includes(name)
+    ? loadLayers(layered)
+    : mergeLayers(layered.layers, null)
+}
+
+const loadSecrets = layered =>
+  pick(loadLayers(layered), secretNamesOf(layered.layers))
+
+const isUnset = (target, name) =>
+  !Object.hasOwn(target, name) || target[name] === undefined
+
+const nameOrder = layers => [
+  ...new Set(
+    layers.flatMap(layer => [
+      ...Object.keys(layer.values),
+      ...(layer.document ? sops.names(layer.document) : [])
+    ])
+  )
+]
+
+const decryptForConfig = (
+  { layers, env, keyCommand },
+  missing,
+  allowKeyCommand = !DEPLOYED_ENVS.includes(env)
+) => {
+  try {
+    return decryptDocuments(documentsOf(layers), keyCommand, {
+      allowKeyCommand
+    })
+  } catch (error) {
+    if (!KEY_ERRORS.includes(error.code)) throw error
+    const verb = missing.length === 1 ? 'is' : 'are'
+    throw new OnesecretError(
+      `${missing.join(', ')} ${verb} not set and cannot be decrypted, ${
+        error.reason
+      }`,
+      'EMISSING'
+    )
+  }
+}
+
+const isExportable = (name, value) =>
+  isEnvName(name) && (value === null || isEnvScalar(value))
+
+const ENV_PARSERS = {
+  int: text => {
+    if (!/^-?\d+$/.test(text)) return undefined
+    const number = Number(text)
+    return Number.isSafeInteger(number) ? number : BigInt(text)
+  },
+  float: text => Number(text),
+  null: text => (text === '' ? null : undefined),
+  bool: text => ({ true: true, false: false }[text])
+}
+
+const envStringOf = value => (value === null ? '' : String(value))
+
+const roundTrips = (value, text) =>
+  value !== undefined && envStringOf(value) === text
+
+const typedSecret = (text, secret) => {
+  const parse = secret && ENV_PARSERS[secret.type]
+  const value = parse ? parse(text) : undefined
+  return roundTrips(value, text) ? value : text
+}
+
+const typedFromEnv = (name, text, merged, secret) => {
+  if (secret || !Object.hasOwn(merged, name)) {
+    return typedSecret(text, secret)
+  }
+  const value = merged[name]
+  return isExportable(name, value) && roundTrips(value, text) ? value : text
+}
+
+const assertScalarSecrets = (secrets, missing) => {
+  for (const name of missing) {
+    const { type, file } = secrets.get(name)
+    if (!isEnvName(name)) {
+      throw new OnesecretError(
+        `"${name}" in ${file} cannot be an environment variable name, so config() could never find it set`,
+        'EFORMAT'
+      )
+    }
+    if (!EXPORTABLE_TYPES.includes(type)) {
+      throw new OnesecretError(
+        `"${name}" in ${file} has type ${type}, config() needs each secret to be a string, number, or boolean`,
+        'EFORMAT'
+      )
+    }
+  }
+}
+
+const config = input => fill(input)
+
+const fill = (input, { allowKeyCommand } = {}) => {
+  const options = optionsOf(input)
+  const target = options.processEnv || process.env
+  const skip = target[SKIP_VARIABLE] === '1'
+  const layered = readLayers(options)
+  if (!hasFiles(layered.layers)) {
+    if (skip) return {}
+    throw new OnesecretError(
+      `no config files for "default" or "${layered.env}" found in ${layered.dir}`,
+      'EMISSING'
+    )
+  }
+  const secrets = secretsOf(layered.layers)
+  const missing = [...secrets.keys()].filter(name => isUnset(target, name))
+  if (!skip) assertScalarSecrets(secrets, missing)
+  const decrypted =
+    missing.length > 0 && !skip
+      ? decryptForConfig(layered, missing, allowKeyCommand)
+      : null
+  const merged = mergeLayers(layered.layers, decrypted)
+  const result = {}
+  for (const name of nameOrder(layered.layers)) {
+    if (!isUnset(target, name)) {
+      assign(
+        result,
+        name,
+        typedFromEnv(name, target[name], merged, secrets.get(name))
+      )
+    } else if (Object.hasOwn(merged, name)) {
+      const value = merged[name]
+      assign(result, name, value)
+      if (isExportable(name, value)) target[name] = toEnvValue(name, value)
+    }
+  }
+  return result
+}
+
+module.exports = {
+  assertEnv,
+  config,
+  decryptDocument,
+  fill,
+  get,
+  load,
+  loadSecrets,
+  names,
+  readLayers,
+  resolveOptions
+}