zurik 1.0.2 → 1.0.5

package/bin/zurik.js

@@ -1,21 +1,74 @@
 #!/usr/bin/env node
 
+import * as readline from "readline";
 import encryptFiles from "../lib/encrypt.js";
 import decryptFiles from "../lib/decrypt.js";
 
 const args = process.argv.slice(2);
 
-function extractPassword() {
+
+function readPassword() {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: false
+    });
+
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode(true);
+    }
+
+    process.stdout.write("Password: ");
+
+    let password = "";
+
+    process.stdin.on("data", (char) => {
+      char = char.toString();
+
+      if (char === "\n" || char === "\r" || char === "\u0004") {
+        process.stdin.pause();
+        if (process.stdin.isTTY) {
+          process.stdin.setRawMode(false);
+        }
+        rl.close();
+        console.log();
+        resolve(password);
+      } else if (char === "\u007f" || char === "\b") {
+        // Backspace
+        if (password.length > 0) {
+          password = password.slice(0, -1);
+          process.stdout.clearLine(0);
+          process.stdout.cursorTo(0);
+          process.stdout.write("Password: " + "*".repeat(password.length));
+        }
+      } else if (char === "\u0003") {
+        // Ctrl+C
+        console.log();
+        process.exit(0);
+      } else {
+        password += char;
+        process.stdout.write("*");
+      }
+    });
+  });
+}
+
+
+async function extractPassword() {
   const pIndex = args.indexOf("-p");
-  if (pIndex !== -1 && args[pIndex + 1]) {
-    return args[pIndex + 1];
+  if (pIndex !== -1) {
+    if (args[pIndex + 1] && !args[pIndex + 1].startsWith("-")) {
+      return args[pIndex + 1];
+    }
+
+    return await readPassword()
   }
   return process.env.ZURIK_PASSWORD || null;
 }
 
-
 async function run() {
-  const password = extractPassword();
+  const password = await extractPassword();
   if (!password) {
     console.error("Missing password. Use -p <password> or set ZURIK_PASSWORD environment variable.");
     process.exit(1);

package/lib/crypto.js

@@ -3,9 +3,9 @@ import crypto from "crypto";
 const ALGO = "aes-256-gcm";
 const IV_LENGTH = 16;
 
-function deriveKey(password) {
+function deriveKey(password, salt) {
   return new Promise((resolve, reject) => {
-    crypto.scrypt(password, "zurik_fixed_salt", 32, (err, key) => {
+    crypto.scrypt(password, salt, 32, (err, key) => {
       if (err) reject(err);
       else resolve(key);
     });
@@ -13,29 +13,27 @@ function deriveKey(password) {
 }
 
 export async function encryptData(data, password) {
-  const key = await deriveKey(password);
+  const salt = crypto.randomBytes(16);
+  const key = await deriveKey(password, salt);
   const iv = crypto.randomBytes(IV_LENGTH);
   const cipher = crypto.createCipheriv(ALGO, key, iv);
 
   const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
 
-  return Buffer.concat([iv, tag, encrypted]).toString("base64");
+  return Buffer.concat([salt, iv, tag, encrypted]).toString("base64");
 }
 
 export async function decryptData(base64, password) {
   const buffer = Buffer.from(base64, "base64");
+  const salt = buffer.subarray(0, 16);
+  const iv = buffer.subarray(16, 32);
+  const tag = buffer.subarray(32, 48);
+  const ciphertext = buffer.subarray(48);
 
-  const iv = buffer.subarray(0, 16);
-  const tag = buffer.subarray(16, 32);
-  const ciphertext = buffer.subarray(32);
-
-  const key = await deriveKey(password);
+  const key = await deriveKey(password, salt);
   const decipher = crypto.createDecipheriv(ALGO, key, iv);
   decipher.setAuthTag(tag);
 
-  return Buffer.concat([
-    decipher.update(ciphertext),
-    decipher.final()
-  ]);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
 }

package/lib/encrypt.js

@@ -1,5 +1,4 @@
 import fs from "fs";
-import path from "path";
 import { encryptData } from "./crypto.js";
 
 export default async function encryptFiles(password) {
@@ -15,6 +14,10 @@ export default async function encryptFiles(password) {
     .map(x => x.trim())
     .filter(Boolean);
 
+  if (fileList.length === 0) {
+    throw new Error("No files listed in .gitencrypt");
+  }
+
   const bundle = { version: 1, files: {} };
 
   for (const filePath of fileList) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zurik",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "CLI tool for encrypting and decrypting sensitive project files into a single .zurik bundle.",
   "type": "module",
   "bin": {

package/readme.md

@@ -22,6 +22,9 @@ npm install -g zurik
 
 # also you can pass the password as an argument
 npx zurik -e -p "your-password"
+
+# or you can type the password interactively
+npx zurik -e -p
 ```
 
 ## Usage