onesecret 0.0.0 → 0.1.0

package/src/write.js

@@ -172,20 +172,24 @@ const updateLayer = (options, layer, update) => {
   return writeLayer(current, update({ ...current.tree }))
 }
 
-const parseAssignment = assignment => {
-  const separator = assignment.indexOf('=')
-  if (separator < 1) {
-    throw new OnesecretError(`"${assignment}" is not NAME=value`, 'EVALUE')
+const set = (options, layer, name, readValue) => {
+  const current = readLayer(options, layer)
+  const { rules } = encryptionFor(current.file, current.existing)
+  assertWritable({ [name]: '' }, [name], rules)
+  const previous = current.tree[name]
+  const shown =
+    previous === undefined || previous === null ? '' : String(previous)
+  const value = readValue(shown)
+  if (previous !== undefined && previous !== null && shown === value) {
+    return { file: current.file, status: 'unchanged' }
+  }
+  if (value === null || value === '') {
+    return { file: current.file, status: 'cancelled' }
   }
-  return [assignment.slice(0, separator), assignment.slice(separator + 1)]
+  writeLayer(current, { ...current.tree, [name]: value })
+  return { file: current.file, status: 'encrypted' }
 }
 
-const set = (options, layer, assignments) =>
-  updateLayer(options, layer, tree => ({
-    ...tree,
-    ...Object.fromEntries(assignments.map(parseAssignment))
-  }))
-
 const unset = (options, layer, secretNames) =>
   updateLayer(options, layer, tree => {
     for (const name of secretNames) {
@@ -234,7 +238,9 @@ const initialRecipients = defaultFile => {
   const rule = store.creationRule(defaultFile)
   if (rule) return { recipients: rule.recipients, source: store.SOPS_CONFIG }
   const exported = exportedRecipients()
-  if (exported.length > 0) { return { recipients: exported, source: 'SOPS_AGE_KEY' } }
+  if (exported.length > 0) {
+    return { recipients: exported, source: 'SOPS_AGE_KEY' }
+  }
   return null
 }
 

package/src/deploy.js

@@ -1,113 +0,0 @@
-'use strict'
-
-const { execFileSync } = require('node:child_process')
-const yaml = require('js-yaml')
-const { loadSecrets, readLayers } = require('./secrets')
-const { withoutAgeKey } = require('./keys')
-const { checksum, toEnv } = require('./format')
-const flyEncoding = require('./fly')
-const { OnesecretError } = require('./error')
-
-const MANAGED_BY_LABEL = 'app.kubernetes.io/managed-by'
-
-const loadForDeploy = (target, options) => {
-  if (!options.env) {
-    throw new OnesecretError(
-      `${target} needs an explicit env, such as "production"`,
-      'EVALUE'
-    )
-  }
-  const layered = readLayers(options)
-  const envLayer = layered.layers.find(({ name }) => name === layered.env)
-  if (!envLayer.plainFile && !envLayer.encryptedFile) {
-    throw new OnesecretError(
-      `${target} found no "${layered.env}" layer in ${layered.dir}, pass --env default to deploy the default layer alone`,
-      'EVALUE'
-    )
-  }
-  return loadSecrets(layered)
-}
-
-const run = (binary, args, input) => {
-  try {
-    return execFileSync(binary, args, {
-      input,
-      encoding: 'utf8',
-      env: withoutAgeKey(process.env),
-      stdio: ['pipe', 'pipe', 'pipe']
-    })
-  } catch (error) {
-    const output = [error.stdout, error.stderr].filter(Boolean).join('\n')
-    const redacted = output.replace(/=.*/g, '=***').trim()
-    const reason =
-      error.code === 'ENOENT'
-        ? `${binary} is not installed`
-        : redacted || error.message
-    throw new OnesecretError(
-      `${binary} ${args.slice(0, 3).join(' ')} failed: ${reason}`,
-      'EDEPLOY'
-    )
-  }
-}
-
-const kubernetesManifest = ({ name, namespace, secrets }) =>
-  yaml.dump(
-    {
-      apiVersion: 'v1',
-      kind: 'Secret',
-      metadata: {
-        name,
-        ...(namespace && { namespace }),
-        labels: { [MANAGED_BY_LABEL]: 'onesecret' }
-      },
-      type: 'Opaque',
-      data: Object.fromEntries(
-        Object.entries(toEnv(secrets)).map(([key, value]) => [
-          key,
-          Buffer.from(value).toString('base64')
-        ])
-      )
-    },
-    { lineWidth: -1 }
-  )
-
-const kubernetes = ({
-  name,
-  namespace,
-  context,
-  kubectl = 'kubectl',
-  args = [],
-  ...options
-}) => {
-  if (!name) {
-    throw new OnesecretError('kubernetes needs the Secret name', 'EVALUE')
-  }
-  const secrets = loadForDeploy('kubernetes', options)
-  const contextArgs = context ? ['--context', context] : []
-  const output = run(
-    kubectl,
-    [...contextArgs, ...args, 'apply', '-f', '-'],
-    kubernetesManifest({ name, namespace, secrets })
-  )
-  return { checksum: checksum(secrets), output: output.trim() }
-}
-
-const flyImport = secrets => flyEncoding.encode(toEnv(secrets))
-
-const fly = ({ app, stage = true, flyctl = 'fly', ...options }) => {
-  if (!app) throw new OnesecretError('fly needs the app name', 'EVALUE')
-  const secrets = loadForDeploy('fly', options)
-  const stageArgs = stage ? ['--stage'] : []
-  const output = run(
-    flyctl,
-    ['secrets', 'import', ...stageArgs, '--app', app],
-    flyImport(secrets)
-  )
-  const summary = output
-    .split('\n')
-    .filter(line => line.trim() && !line.includes('='))
-    .join('\n')
-  return { checksum: checksum(secrets), output: summary }
-}
-
-module.exports = { fly, flyImport, kubernetes, kubernetesManifest }

package/src/fly.js

@@ -1,109 +0,0 @@
-'use strict'
-
-const { isDeepStrictEqual } = require('node:util')
-const { OnesecretError } = require('./error')
-
-const TRIPLE_QUOTE = '"""'
-const SCANNER_MAX_LINE_BYTES = 64 * 1024 - 1
-
-const scanLines = text => {
-  const lines = text.split('\n')
-  if (lines[lines.length - 1] === '') lines.pop()
-  return lines.map(line => line.replace(/\r$/, ''))
-}
-
-const countQuotes = text => text.split('"').length - 1
-
-const parseSinglelineValue = line => {
-  const separator = line.indexOf('=')
-  let value = line.slice(separator + 1).replace(/^ +/, '')
-  const hash = value.indexOf('#')
-  if (hash !== -1 && countQuotes(value.slice(0, hash)) % 2 === 0) { value = value.slice(0, hash).replace(/ +$/, '') }
-  return { key: line.slice(0, separator).trim(), value }
-}
-
-const parse = text => {
-  const secrets = {}
-  let multiline = null
-  for (const line of scanLines(text)) {
-    if (multiline) {
-      if (line.endsWith(TRIPLE_QUOTE)) {
-        secrets[multiline.key] =
-          multiline.value + line.slice(0, -TRIPLE_QUOTE.length)
-        multiline = null
-      } else {
-        multiline.value += `${line}\n`
-      }
-      continue
-    }
-    if (line.startsWith('#') || line.trim() === '') continue
-    if (!line.includes('=')) throw new Error(`"${line}" is not NAME=VALUE`)
-    const { key, value } = parseSinglelineValue(line)
-    if (
-      value.startsWith(TRIPLE_QUOTE) &&
-      value.endsWith(TRIPLE_QUOTE) &&
-      value.length >= 6
-    ) {
-      secrets[key] = value.slice(3, -3)
-    } else if (value.startsWith(TRIPLE_QUOTE)) {
-      multiline = { key, value: `${value.slice(3)}\n` }
-    } else if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      if (value.length < 2) throw new Error('flyctl panics on a lone quote')
-      secrets[key] = value.slice(1, -1)
-    } else {
-      secrets[key] = value
-    }
-  }
-  return secrets
-}
-
-const candidates = value => [
-  value,
-  `${TRIPLE_QUOTE}${value}${TRIPLE_QUOTE}`,
-  `"${value}"`,
-  `'${value}'`
-]
-
-const readsBackAs = (text, expected) => {
-  try {
-    return isDeepStrictEqual(parse(text), expected)
-  } catch {
-    return false
-  }
-}
-
-const isWithinScanner = text =>
-  scanLines(text).every(
-    line => Buffer.byteLength(line) <= SCANNER_MAX_LINE_BYTES
-  )
-
-const encodeLine = (name, value) => {
-  const line = candidates(value)
-    .map(encoded => `${name}=${encoded}\n`)
-    .find(line => isWithinScanner(line) && readsBackAs(line, { [name]: value }))
-  if (!line) {
-    throw new OnesecretError(
-      `"${name}" cannot be imported into fly without changing its value`,
-      'EVALUE'
-    )
-  }
-  return line
-}
-
-const encode = secrets => {
-  const body = Object.entries(secrets)
-    .map(([name, value]) => encodeLine(name, value))
-    .join('')
-  if (!readsBackAs(body, secrets)) {
-    throw new OnesecretError(
-      'the fly import does not read back to the same secrets',
-      'EVALUE'
-    )
-  }
-  return body
-}
-
-module.exports = { encode, parse }