t3code-cli 0.11.0 → 0.12.0

package/src/config/config.ts

@@ -0,0 +1,260 @@
+import * as Context from "effect/Context";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+
+import { credentialTokenFromEnv } from "./credential/env.ts";
+import { T3CredentialCrypto } from "./credential/service.ts";
+import { loadT3CliEnv } from "./env/env.ts";
+import { validateEnvironmentName } from "./environment-name/name.ts";
+import { ConfigError } from "./error.ts";
+import { readEncryptedConfigFile, writeEncryptedConfigFile } from "./persist/persist.ts";
+import {
+  buildResolvedConfigFromEnv,
+  buildResolvedConfigFromStored,
+  resolveDefaultForUpsert,
+  selectEnvironmentName,
+  summarizeEnvironments,
+  validateCredentialEnvVars,
+} from "./resolve/resolve.ts";
+import { T3ConfigSelection } from "./selection/service.ts";
+import type { EnvironmentSummary, ResolvedConfig, UpsertEnvironmentInput } from "./types.ts";
+import { normalizeHttpBaseUrl } from "./url/url.ts";
+
+export class T3Config extends Context.Service<
+  T3Config,
+  {
+    readonly resolve: () => Effect.Effect<ResolvedConfig, ConfigError>;
+    readonly resolveActiveEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+    readonly listEnvironments: () => Effect.Effect<readonly EnvironmentSummary[], ConfigError>;
+    readonly upsertEnvironment: (input: UpsertEnvironmentInput) => Effect.Effect<void, ConfigError>;
+    readonly setDefaultEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly removeEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly hasEnvironment: (name: string) => Effect.Effect<boolean, ConfigError>;
+    readonly getDefaultEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+  }
+>()("t3cli/T3Config") {}
+
+export const make = Effect.fn("makeT3Config")(function* () {
+  const configSelection = yield* T3ConfigSelection;
+  const credentialCrypto = yield* T3CredentialCrypto;
+  const t3CliEnv = yield* loadT3CliEnv;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const configProvider = yield* ConfigProvider.ConfigProvider;
+  const services = Layer.mergeAll(
+    Layer.succeed(FileSystem.FileSystem, fs),
+    Layer.succeed(Path.Path, path),
+    Layer.succeed(T3CredentialCrypto, credentialCrypto),
+    Layer.succeed(ConfigProvider.ConfigProvider, configProvider),
+  );
+
+  const hasEnvironment = Effect.fn("T3Config.hasEnvironment")(function* (name: string) {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return encrypted.environments[name] !== undefined;
+  });
+
+  const getDefaultEnvironmentName = Effect.fn("T3Config.getDefaultEnvironmentName")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const defaultName = encrypted.default;
+    return defaultName !== undefined && defaultName.length > 0 ? defaultName : undefined;
+  });
+
+  const resolveActiveEnvironmentName = Effect.fn("T3Config.resolveActiveEnvironmentName")(
+    function* () {
+      const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+      const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+      const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+      yield* validateCredentialEnvVars({ envUrl, envToken });
+      const hasEnvCredentials = envUrl !== undefined && envToken !== undefined;
+      if (hasEnvCredentials) {
+        return undefined;
+      }
+      const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+      const selectedName = selectEnvironmentName({
+        selectedEnvironment: configuredEnvironment,
+        defaultEnvironment: encrypted.default,
+      });
+      if (selectedName === undefined || selectedName.length === 0) {
+        return undefined;
+      }
+      if (encrypted.environments[selectedName] === undefined) {
+        return undefined;
+      }
+      return selectedName;
+    },
+  );
+
+  const listEnvironments = Effect.fn("T3Config.listEnvironments")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return summarizeEnvironments(encrypted);
+  });
+
+  const upsertEnvironment = Effect.fn("T3Config.upsertEnvironment")(function* (
+    input: UpsertEnvironmentInput,
+  ) {
+    yield* validateEnvironmentName(input.name);
+    const normalizedUrl = yield* normalizeHttpBaseUrl(input.url).pipe(
+      Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    );
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const token = yield* credentialCrypto.encrypt({
+      environmentName: input.name,
+      url: normalizedUrl,
+      local: input.local,
+      token: input.token,
+    });
+    const defaultName = resolveDefaultForUpsert(encrypted, input.name, input.makeDefault);
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments: {
+          ...encrypted.environments,
+          [input.name]: {
+            url: normalizedUrl,
+            local: input.local,
+            token,
+          },
+        },
+      }),
+      services,
+    );
+  });
+
+  const setDefaultEnvironment = Effect.fn("T3Config.setDefaultEnvironment")(function* (
+    name: string,
+  ) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const selectedEnvironment = encrypted.environments[name];
+    yield* credentialCrypto
+      .decrypt({
+        environmentName: name,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${name}'`,
+              cause: error.cause,
+            }),
+        ),
+        Effect.asVoid,
+      );
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        ...encrypted,
+        default: name,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const removeEnvironment = Effect.fn("T3Config.removeEnvironment")(function* (name: string) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const { [name]: _removed, ...environments } = encrypted.environments;
+    const defaultName = encrypted.default === name ? undefined : encrypted.default;
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const resolve = Effect.fn("T3Config.resolve")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+    const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+    yield* validateCredentialEnvVars({ envUrl, envToken });
+    const hasEnvUrl = envUrl !== undefined;
+    const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+    const selectedName = selectEnvironmentName({
+      selectedEnvironment: configuredEnvironment,
+      defaultEnvironment: encrypted.default,
+    });
+
+    if (hasEnvUrl && envToken !== undefined) {
+      if (selectedName !== undefined && selectedName.length > 0) {
+        yield* validateEnvironmentName(selectedName);
+        if (encrypted.environments[selectedName] === undefined) {
+          return yield* Effect.fail(
+            new ConfigError({ message: `environment not found: ${selectedName}` }),
+          );
+        }
+      }
+      return yield* buildResolvedConfigFromEnv({
+        envUrl,
+        envToken,
+      });
+    }
+
+    if (selectedName === undefined || selectedName.length === 0) {
+      return yield* Effect.fail(
+        new ConfigError({
+          message: "not authenticated. run: t3cli auth pair --url <pairing-url>",
+        }),
+      );
+    }
+    yield* validateEnvironmentName(selectedName);
+    if (encrypted.environments[selectedName] === undefined) {
+      return yield* Effect.fail(
+        new ConfigError({ message: `environment not found: ${selectedName}` }),
+      );
+    }
+
+    const selectedEnvironment = encrypted.environments[selectedName];
+    const token = yield* credentialCrypto
+      .decrypt({
+        environmentName: selectedName,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${selectedName}'`,
+              cause: error.cause,
+            }),
+        ),
+      );
+    return yield* buildResolvedConfigFromStored({
+      selectedName,
+      token,
+      encrypted,
+    });
+  });
+
+  return {
+    resolve,
+    resolveActiveEnvironmentName,
+    listEnvironments,
+    upsertEnvironment,
+    setDefaultEnvironment,
+    removeEnvironment,
+    hasEnvironment,
+    getDefaultEnvironmentName,
+  } as const;
+});
+
+export const layer = Layer.effect(T3Config, make());

package/src/config/credential/cipher-node.ts

@@ -0,0 +1,40 @@
+import { createCipheriv, createDecipheriv } from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { credentialCipherTagByteLength, T3CredentialCipher } from "./cipher.ts";
+import { CredentialCipherError } from "./error.ts";
+
+const make = (): T3CredentialCipher["Service"] => ({
+  encrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const cipher = createCipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        cipher.setAAD(input.additionalData);
+        const ciphertext = Buffer.concat([cipher.update(input.plaintext), cipher.final()]);
+        return {
+          ciphertext: new Uint8Array(ciphertext),
+          tag: new Uint8Array(cipher.getAuthTag()),
+        };
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "encrypt", cause }),
+    }),
+  decrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const decipher = createDecipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        decipher.setAAD(input.additionalData);
+        decipher.setAuthTag(input.tag);
+        const plaintext = Buffer.concat([decipher.update(input.ciphertext), decipher.final()]);
+        return new Uint8Array(plaintext);
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "decrypt", cause }),
+    }),
+});
+
+export const layerNode = Layer.succeed(T3CredentialCipher, make());

package/src/config/credential/cipher-web.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { credentialCipherTagByteLength, T3CredentialCipher } from "./cipher.ts";
+import { CredentialCipherError } from "./error.ts";
+
+const aesGcmAlgorithm = "AES-GCM";
+
+function copyBytes(bytes: Uint8Array) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy;
+}
+
+function importAesGcmKey(key: Uint8Array, operation: "encrypt" | "decrypt") {
+  return Effect.tryPromise({
+    try: () =>
+      globalThis.crypto.subtle.importKey("raw", copyBytes(key), { name: aesGcmAlgorithm }, false, [
+        "encrypt",
+        "decrypt",
+      ]),
+    catch: (cause) => new CredentialCipherError({ operation, cause }),
+  });
+}
+
+const make = (): T3CredentialCipher["Service"] => ({
+  encrypt: (input) =>
+    Effect.gen(function* () {
+      const cryptoKey = yield* importAesGcmKey(input.key, "encrypt");
+      const encrypted = yield* Effect.tryPromise({
+        try: () =>
+          globalThis.crypto.subtle.encrypt(
+            {
+              name: aesGcmAlgorithm,
+              iv: copyBytes(input.nonce),
+              additionalData: copyBytes(input.additionalData),
+              tagLength: credentialCipherTagByteLength * 8,
+            },
+            cryptoKey,
+            copyBytes(input.plaintext),
+          ),
+        catch: (cause) => new CredentialCipherError({ operation: "encrypt", cause }),
+      });
+      const bytes = new Uint8Array(encrypted);
+      if (bytes.byteLength < credentialCipherTagByteLength) {
+        return yield* Effect.fail(
+          new CredentialCipherError({
+            operation: "encrypt",
+            cause: new Error("encrypted output shorter than auth tag"),
+          }),
+        );
+      }
+      return {
+        ciphertext: bytes.slice(0, -credentialCipherTagByteLength),
+        tag: bytes.slice(-credentialCipherTagByteLength),
+      };
+    }),
+  decrypt: (input) =>
+    Effect.gen(function* () {
+      const cryptoKey = yield* importAesGcmKey(input.key, "decrypt");
+      const combined = new Uint8Array(input.ciphertext.byteLength + input.tag.byteLength);
+      combined.set(input.ciphertext);
+      combined.set(input.tag, input.ciphertext.byteLength);
+      const plaintext = yield* Effect.tryPromise({
+        try: () =>
+          globalThis.crypto.subtle.decrypt(
+            {
+              name: aesGcmAlgorithm,
+              iv: copyBytes(input.nonce),
+              additionalData: copyBytes(input.additionalData),
+              tagLength: credentialCipherTagByteLength * 8,
+            },
+            cryptoKey,
+            combined,
+          ),
+        catch: (cause) => new CredentialCipherError({ operation: "decrypt", cause }),
+      });
+      return new Uint8Array(plaintext);
+    }),
+});
+
+export const layerWeb = Layer.succeed(T3CredentialCipher, make());

package/src/config/credential/cipher.ts

@@ -0,0 +1,39 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+
+import type { CredentialCipherError } from "./error.ts";
+
+export const credentialCipherNonceByteLength = 12;
+export const credentialCipherTagByteLength = 16;
+
+export type AesGcmEncryptInput = {
+  readonly key: Uint8Array;
+  readonly nonce: Uint8Array;
+  readonly plaintext: Uint8Array;
+  readonly additionalData: Uint8Array;
+};
+
+export type AesGcmDecryptInput = {
+  readonly key: Uint8Array;
+  readonly nonce: Uint8Array;
+  readonly ciphertext: Uint8Array;
+  readonly tag: Uint8Array;
+  readonly additionalData: Uint8Array;
+};
+
+export type AesGcmEncryptResult = {
+  readonly ciphertext: Uint8Array;
+  readonly tag: Uint8Array;
+};
+
+export class T3CredentialCipher extends Context.Service<
+  T3CredentialCipher,
+  {
+    readonly encrypt: (
+      input: AesGcmEncryptInput,
+    ) => Effect.Effect<AesGcmEncryptResult, CredentialCipherError>;
+    readonly decrypt: (
+      input: AesGcmDecryptInput,
+    ) => Effect.Effect<Uint8Array, CredentialCipherError>;
+  }
+>()("t3cli/T3CredentialCipher") {}

package/src/config/credential/env.ts

@@ -0,0 +1,13 @@
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+
+import type { T3CliEnvShape } from "../env/env.ts";
+
+export function credentialTokenFromEnv(
+  t3CliEnv: Pick<T3CliEnvShape, "t3codeToken">,
+): Option.Option<string> {
+  return Option.flatMap(t3CliEnv.t3codeToken, (token) => {
+    const value = Redacted.value(token).trim();
+    return value.length > 0 ? Option.some(value) : Option.none();
+  });
+}

package/src/config/credential/error.ts

@@ -0,0 +1,9 @@
+import * as Schema from "effect/Schema";
+
+export class CredentialCipherError extends Schema.TaggedErrorClass<CredentialCipherError>()(
+  "CredentialCipherError",
+  {
+    operation: Schema.Literals(["encrypt", "decrypt"]),
+    cause: Schema.Defect(),
+  },
+) {}

package/src/config/credential/index.ts

@@ -0,0 +1,6 @@
+export * as Service from "./service.ts";
+export * as Cipher from "./cipher.ts";
+export * as CipherNode from "./cipher-node.ts";
+export * as CipherWeb from "./cipher-web.ts";
+export { credentialTokenFromEnv } from "./env.ts";
+export { CredentialCipherError } from "./error.ts";

package/src/config/credential/service.test-utils.ts

@@ -0,0 +1,25 @@
+import * as Layer from "effect/Layer";
+
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { t3CliEnvConfigLayer } from "../env/env.test-utils.ts";
+import * as CredentialCipherWeb from "./cipher-web.ts";
+import * as Keystore from "../keystore/service.test-utils.ts";
+import * as Credential from "./service.ts";
+
+export function t3CredentialCryptoDepsLayer(homeDir: string) {
+  return Credential.layer.pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        CliRuntime.layerTest({ cwd: homeDir }),
+        t3CliEnvConfigLayer(homeDir),
+        CredentialCipherWeb.layerWeb,
+        Keystore.unavailableKeystoreFactoryLayer,
+      ),
+    ),
+  );
+}
+
+export function t3CredentialCryptoLayerTest(homeDir: string) {
+  return Layer.mergeAll(ConfigPlatformLayer, t3CredentialCryptoDepsLayer(homeDir));
+}

package/src/config/credential/service.test.ts

@@ -0,0 +1,116 @@
+import "vite-plus/test/config";
+
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { assert, describe, it } from "@effect/vitest";
+
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { makeTempHomeScoped } from "../temp-home.test-utils.ts";
+import { T3CredentialCrypto } from "./service.ts";
+import { t3CredentialCryptoDepsLayer } from "./service.test-utils.ts";
+
+describe("T3CredentialCrypto", () => {
+  it.effect("falls back to key file when keyring backend is unavailable", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const cryptoService = yield* Crypto.Crypto;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const masterKey = yield* cryptoService.randomBytes(32);
+        yield* fs.makeDirectory(path.dirname(keyPath), { recursive: true });
+        yield* fs.writeFileString(keyPath, `${Buffer.from(masterKey).toString("base64")}\n`, {
+          mode: 0o600,
+        });
+        const credentialCrypto = yield* T3CredentialCrypto;
+        const encrypted = yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret-token",
+        });
+        const token = yield* credentialCrypto.decrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: encrypted,
+        });
+        assert.equal(token, "secret-token");
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("hardens existing key file permissions to 0600 on use", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const cryptoService = yield* Crypto.Crypto;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const masterKey = yield* cryptoService.randomBytes(32);
+        yield* fs.makeDirectory(path.dirname(keyPath), { recursive: true });
+        yield* fs.writeFileString(keyPath, `${Buffer.from(masterKey).toString("base64")}\n`, {
+          mode: 0o644,
+        });
+        const credentialCrypto = yield* T3CredentialCrypto;
+        yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret-token",
+        });
+        const keyStat = yield* fs.stat(keyPath);
+        assert.equal(keyStat.mode & 0o777, 0o600);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("creates key file with 0600 permissions when keyring is unavailable", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const credentialCrypto = yield* T3CredentialCrypto;
+        yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "rotate-write",
+        });
+        const keyStat = yield* fs.stat(keyPath);
+        assert.equal(keyStat.mode & 0o777, 0o600);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("fails decrypt when ciphertext AAD does not match", () =>
+    Effect.gen(function* () {
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const crypto = yield* T3CredentialCrypto;
+        const token = yield* crypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret",
+        });
+        const result = yield* crypto
+          .decrypt({
+            environmentName: "home",
+            url: "https://tampered.example",
+            local: false,
+            token,
+          })
+          .pipe(Effect.exit);
+        assert.equal(Exit.isFailure(result), true);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+});