passwd-sso-cli 0.4.46 → 0.4.47

package/dist/commands/env.js

@@ -7,7 +7,7 @@
  * Requires the vault to be unlocked (encryption key in memory) OR
  * an apiKey + PSSO_PASSPHRASE env var for non-interactive mode.
  */
-import { loadSecretsConfig, getPasswordPath } from "../lib/secrets-config.js";
+import { loadSecretsConfig, getPasswordPath, getSecretsServerUrl } from "../lib/secrets-config.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { autoUnlockIfNeeded } from "./unlock.js";
 import { getToken } from "../lib/api-client.js";
@@ -22,10 +22,17 @@ export async function envCommand(opts) {
     }
     catch (err) {
         output.error(err instanceof Error ? err.message : "Failed to load config.");
-        return;
+        process.exit(1);
     }
     const useV1 = !!config.apiKey;
-    const baseUrl = config.server.replace(/\/$/, "");
+    let baseUrl;
+    try {
+        baseUrl = getSecretsServerUrl();
+    }
+    catch (err) {
+        output.error(err instanceof Error ? err.message : "Failed to resolve server URL.");
+        process.exit(1);
+    }
     // Determine auth header
     let authHeader;
     if (config.apiKey) {
@@ -35,14 +42,14 @@ export async function envCommand(opts) {
         const token = await getToken();
         if (!token) {
             output.error("Not logged in. Run `passwd-sso login` first, or set apiKey in config.");
-            return;
+            process.exit(1);
         }
         authHeader = `Bearer ${token}`;
     }
     // Auto-unlock with PSSO_PASSPHRASE if needed
     if (!await autoUnlockIfNeeded()) {
         output.error("Vault is not unlocked. Run `passwd-sso unlock` first, or set PSSO_PASSPHRASE.");
-        return;
+        process.exit(1);
     }
     const encryptionKey = getEncryptionKey();
     const userId = getUserId();

package/dist/commands/run.js

@@ -5,7 +5,7 @@
  * Blocks certain dangerous env var names from being overwritten.
  */
 import { spawn } from "node:child_process";
-import { loadSecretsConfig, getPasswordPath } from "../lib/secrets-config.js";
+import { loadSecretsConfig, getPasswordPath, getSecretsServerUrl } from "../lib/secrets-config.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { autoUnlockIfNeeded } from "./unlock.js";
 import { getToken } from "../lib/api-client.js";
@@ -27,7 +27,14 @@ export async function runCommand(opts) {
         process.exit(1);
     }
     const useV1 = !!config.apiKey;
-    const baseUrl = config.server.replace(/\/$/, "");
+    let baseUrl;
+    try {
+        baseUrl = getSecretsServerUrl();
+    }
+    catch (err) {
+        output.error(err instanceof Error ? err.message : "Failed to resolve server URL.");
+        process.exit(1);
+    }
     let authHeader;
     if (config.apiKey) {
         authHeader = `Bearer ${config.apiKey}`;

package/dist/lib/secrets-config.d.ts

@@ -3,7 +3,6 @@
  *
  * Schema:
  * {
- *   "server": "https://...",
  *   "apiKey?": "api_...",         // optional — uses /api/v1/ path
  *   "secrets": {
  *     "ENV_VAR_NAME": { "entry": "<entryId>", "field": "password" }
@@ -19,11 +18,11 @@ export interface SecretMapping {
     field: string;
 }
 export interface SecretsConfig {
-    server: string;
     apiKey?: string;
     secrets: Record<string, SecretMapping>;
 }
 export declare function loadSecretsConfig(configPath?: string): SecretsConfig;
+export declare function getSecretsServerUrl(): string;
 /**
  * Returns the API path for fetching a single password entry.
  * If apiKey is configured, use the public /api/v1/ path.

package/dist/lib/secrets-config.js

@@ -3,7 +3,6 @@
  *
  * Schema:
  * {
- *   "server": "https://...",
  *   "apiKey?": "api_...",         // optional — uses /api/v1/ path
  *   "secrets": {
  *     "ENV_VAR_NAME": { "entry": "<entryId>", "field": "password" }
@@ -16,6 +15,11 @@
  */
 import { readFileSync, existsSync } from "node:fs";
 import { resolve } from "node:path";
+import { loadConfig } from "./config.js";
+import { validateServerUrl } from "./oauth.js";
+function isPlaceholderEntryId(entryId) {
+    return entryId === "dummy-entry-id" || /^<[^>]+>$/.test(entryId);
+}
 export function loadSecretsConfig(configPath) {
     const filePath = configPath
         ? resolve(configPath)
@@ -25,14 +29,41 @@ export function loadSecretsConfig(configPath) {
     }
     const raw = readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
-    if (!parsed.server || typeof parsed.server !== "string") {
-        throw new Error("Config file must have a 'server' field.");
-    }
     if (!parsed.secrets || typeof parsed.secrets !== "object") {
         throw new Error("Config file must have a 'secrets' field.");
     }
+    for (const [envName, mapping] of Object.entries(parsed.secrets)) {
+        if (!mapping || typeof mapping !== "object") {
+            throw new Error(`Secret mapping for '${envName}' must be an object.`);
+        }
+        const rawMapping = mapping;
+        if (typeof rawMapping.entry !== "string" || rawMapping.entry.trim().length === 0) {
+            throw new Error(`Secret mapping for '${envName}' must have a non-empty 'entry' string.`);
+        }
+        if (typeof rawMapping.field !== "string" || rawMapping.field.trim().length === 0) {
+            throw new Error(`Secret mapping for '${envName}' must have a non-empty 'field' string.`);
+        }
+        const entry = rawMapping.entry.trim();
+        const field = rawMapping.field.trim();
+        if (isPlaceholderEntryId(entry)) {
+            throw new Error(`Secret mapping for '${envName}' uses placeholder entry ID "${entry}". Replace it with a real vault entry ID.`);
+        }
+        // Preserve unknown keys (e.g. user-added comment fields) while normalising entry/field.
+        parsed.secrets[envName] = { ...rawMapping, entry, field };
+    }
     return parsed;
 }
+export function getSecretsServerUrl() {
+    const { serverUrl } = loadConfig();
+    if (!serverUrl) {
+        throw new Error("Server URL not configured. Run `passwd-sso login -s <server-url>` once to configure it.");
+    }
+    // Defense-in-depth: re-validate the persisted URL before issuing a fetch
+    // with a Bearer token. Login validates at write time, but a hand-edited
+    // config file would otherwise reach fetch() unchecked.
+    validateServerUrl(serverUrl);
+    return serverUrl.replace(/\/$/, "");
+}
 /**
  * Returns the API path for fetching a single password entry.
  * If apiKey is configured, use the public /api/v1/ path.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.46",
+  "version": "0.4.47",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",