envshield 1.2.0__py3-none-any.whl

envshield/core/profile_manager.py

@@ -0,0 +1,299 @@
+# envshield/core/profile_manager.py
+# Contains the core business logic for managing environment profiles.
+
+import os
+import shutil
+import subprocess
+from typing import List, Union
+
+import questionary
+import typer
+from rich.console import Console
+from rich.panel import Panel
+from rich.prompt import Prompt
+from rich.table import Table
+
+from envshield import state
+from envshield.config import manager as config_manager
+from envshield.core import file_updater
+from envshield.core.exceptions import ProfileNotFoundError, SourceFileNotFoundError
+from envshield.parsers.factory import get_parser
+
+console = Console()
+
+
+def list_profiles():
+    """
+    Loads profiles from the config and displays them in a formatted table.
+    """
+    config = config_manager.load_config()
+    profiles = config.get("profiles", {})
+    active_profile = state.get_active_profile()
+    if not profiles:
+        console.print("[yellow]No profiles found in 'envshield.yml'.[/yellow]")
+        return
+    table = Table(
+        title="Available Profiles",
+        border_style="blue",
+        show_header=True,
+        header_style="bold blue",
+    )
+    table.add_column("Active", justify="center", style="green")
+    table.add_column("Profile Name", style="cyan", no_wrap=True)
+    table.add_column("Description", style="white")
+    for name, details in profiles.items():
+        is_active = "✓" if name == active_profile else ""
+        table.add_row(is_active, name, details.get("description", ""))
+    console.print(table)
+
+
+def use_profile(profile_name: str):
+    """
+    Switches the active environment by processing the 'links' for the profile.
+    For each link, it creates a symlink from the source to the target.
+
+    Args:
+        profile_name: The name of the profile to activate.
+    """
+    config = config_manager.load_config()
+    profiles = config.get("profiles", {})
+    if profile_name not in profiles:
+        raise ProfileNotFoundError(profile_name)
+    profile_details = profiles[profile_name]
+    links = profile_details.get("links", [])
+    if not links:
+        console.print(
+            f"[yellow]Warning:[/yellow] Profile '{profile_name}' has no 'links' defined. No action taken."
+        )
+        return
+
+    console.print(f"Switching to profile [bold cyan]{profile_name}[/bold cyan]...")
+
+    # --- Symlink Logic ---
+    for link in links:
+        source_file = link.get("source")
+        target_file = link.get("target")
+
+        if not source_file or not target_file:
+            console.print(
+                f"[yellow]Warning:[/yellow] Skipping invalid link in profile '{profile_name}': {link}"
+            )
+            continue
+        if not os.path.exists(source_file):
+            raise SourceFileNotFoundError(source_file)
+
+        # If the target file (.env) already exists, we must remove it first.
+        # It could be a real file or a symlink from a previous 'use' command.
+        # os.lexists() is used to check for symlinks themselves without following them.
+        if os.path.lexists(target_file):
+            os.remove(target_file)
+
+        # Create the symbolic link.
+        try:
+            os.symlink(source_file, target_file)
+            console.print(
+                f"  [green]✓[/green] Linked [magenta]{source_file}[/magenta] -> [bold magenta]{target_file}[/bold magenta]"
+            )
+        except OSError as e:
+            console.print(
+                f"[bold red]Error:[/bold red] Failed to create symbolic link for '{target_file}': {e}"
+            )
+            # We stop on the first error to avoid a partially configured state.
+            raise
+
+    # Only set the profile as active if all links were successful.
+    state.set_active_profile(profile_name)
+    console.print("\n[bold green]Environment is now active![/bold green]")
+
+
+def _run_script(script_command: Union[str, List[str]]):
+    """
+    Runs a single shell command or a list of shell commands.
+    Raises an exception if any script fails.
+    """
+    if not script_command:
+        return
+    commands = script_command if isinstance(script_command, list) else [script_command]
+    for command in commands:
+        console.print(
+            f"\n[bold]Executing script:[/bold] [bright_black]{command}[/bright_black]"
+        )
+        try:
+            process = subprocess.Popen(
+                command,
+                shell=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT,
+                text=True,
+            )
+            for line in process.stdout:
+                console.print(f"[dim]  {line.strip()}[/dim]")
+            process.wait()
+            if process.returncode != 0:
+                raise subprocess.CalledProcessError(process.returncode, command)
+            console.print(f"[green]✓ Script finished successfully.[/green]")
+        except Exception as e:
+            console.print(f"[bold red]Error running script: {e}[/bold red]")
+            raise
+
+
+def onboard_profile(profile_name: str):
+    """
+    Guides a new user through setting up a profile for the first time with
+    smarter, more versatile logic and pre/post scripts.
+    """
+    console.print(
+        Panel(
+            f"[bold cyan]Welcome to EnvShield Onboarding for the '[yellow]{profile_name}[/yellow]' profile![/bold cyan]\n\nThis wizard will get you set up and ready to code.",
+            title="✨ Onboarding ✨",
+            border_style="green",
+        )
+    )
+
+    config = config_manager.load_config()
+    profiles = config.get("profiles", {})
+
+    if profile_name not in profiles:
+        raise ProfileNotFoundError(profile_name)
+
+    profile_details = profiles[profile_name]
+    links = profile_details.get("links", [])
+    onboarding_prompts = profile_details.get("onboarding_prompts", [])
+    pre_script = profile_details.get("pre_onboard_script")
+    post_script = profile_details.get("post_onboard_script")
+
+    if not links:
+        console.print(
+            f"[yellow]Warning:[/yellow] Profile '{profile_name}' has no 'links' defined. Nothing to onboard."
+        )
+        return
+
+    # --- Step 0: Run Pre-Onboarding Script(s) ---
+    if pre_script:
+        console.print(
+            "\n[bold]Step 0: Running pre-onboarding validation script(s)...[/bold]"
+        )
+        _run_script(pre_script)
+
+    # --- Step 1: Create Missing Source Files ---
+    console.print(
+        "\n[bold]Step 1: Checking for necessary configuration files...[/bold]"
+    )
+    created_files = False
+    for link in links:
+        source_file = link.get("source")
+        template_file = link.get("template")
+        if source_file and not os.path.exists(source_file):
+            console.print(
+                f"  [yellow]![/yellow] Source file [magenta]{source_file}[/magenta] not found. Attempting to create it..."
+            )
+
+            if template_file and os.path.exists(template_file):
+                try:
+                    shutil.copy(template_file, source_file)
+                    console.print(
+                        f"    [green]✓[/green] Created from template '{template_file}'."
+                    )
+                    created_files = True
+                except IOError as e:
+                    console.print(
+                        f"    [red]Error:[/red] Could not create '{source_file}': {e}"
+                    )
+                    raise typer.Exit(code=1)
+            else:
+                open(source_file, "a").close()
+                console.print(
+                    f"    [green]✓[/green] Created a blank file (no template specified for this link)."
+                )
+                created_files = True
+
+    if created_files:
+        console.print("[green]✓ All necessary source files have been created.[/green]")
+    else:
+        console.print("[green]✓ All source files already exist.[/green]")
+
+    # --- Step 2 Populate and Save Secrets ---
+    console.print("\n[bold]Step 2: Let's configure your secrets.[/bold]")
+    placeholder_keywords = [
+        "changeme",
+        "ask",
+        "todo",
+        "example",
+        "dummy",
+        "placeholder",
+        "get from",
+        "your-",
+    ]
+    updates_by_file = {}
+    for link in links:
+        source_file = link.get("source")
+        if not source_file or not os.path.exists(source_file):
+            continue
+        try:
+            with open(source_file, "r") as f:
+                lines = f.readlines()
+            for line in lines:
+                line = line.strip()
+                if not line or line.startswith("#") or "=" not in line:
+                    continue
+                key, value = line.split("=", 1)
+                key = key.strip()
+                raw_value = value.strip().strip("\"'")
+                is_explicit_prompt = key in onboarding_prompts
+                is_placeholder = (
+                    not raw_value
+                    or raw_value.lower() == "x"
+                    or any(
+                        keyword in raw_value.lower() for keyword in placeholder_keywords
+                    )
+                )
+                if is_explicit_prompt or is_placeholder:
+                    if any(
+                        update["key"] == key
+                        for updates in updates_by_file.values()
+                        for update in updates
+                    ):
+                        continue
+                    console.print(
+                        f"\nFound variable to configure: [bold cyan]{key}[/bold cyan] in [magenta]{source_file}[/magenta]."
+                    )
+                    if raw_value:
+                        console.print(
+                            f"  [dim]Current value/instruction: {raw_value}[/dim]"
+                        )
+                    new_value = Prompt.ask(
+                        f"  Please enter the value for [bold cyan]{key}[/bold cyan]",
+                        password=True,
+                    )
+                    if source_file not in updates_by_file:
+                        updates_by_file[source_file] = []
+                    updates_by_file[source_file].append(
+                        {"key": key, "value": new_value}
+                    )
+        except IOError:
+            continue
+    if not updates_by_file:
+        console.print(
+            "[green]✓ No placeholders found to update. Your secrets appear to be configured.[/green]"
+        )
+    else:
+        for file_path, updates in updates_by_file.items():
+            file_updater.update_variables_in_file(file_path, updates)
+        console.print(
+            "[green]✓ All secrets have been securely saved to your local files.[/green]"
+        )
+
+    # --- Step 3: Final Activation ---
+    console.print("\n[bold]Step 3: Activating the environment...[/bold]")
+    use_profile(profile_name)
+
+    # --- Step 4: Run Post-Onboarding Script(s) ---
+    if post_script:
+        console.print(
+            "\n[bold]Step 4: Running post-onboarding setup script(s)...[/bold]"
+        )
+        _run_script(post_script)
+
+    console.print(
+        "\n[bold green]🎉 Onboarding Complete! Your environment is ready. 🎉[/bold green]"
+    )

envshield/core/scanner.py

@@ -0,0 +1,123 @@
+# envshield/core/scanner.py
+# The core secret scanning engine for EnvShield.
+
+import re
+from typing import Dict, List
+
+from rich.console import Console
+
+console = Console()
+
+# A comprehensive, curated list of high-confidence regex patterns for common secrets,
+# inspired by community projects like https://github.com/mazen160/secrets-patterns-db
+SECRET_PATTERNS: List[Dict[str, str]] = [
+    # --- Generic High-Confidence Patterns ---
+    {
+        "name": "Generic API Key",
+        "pattern": r"(?i)(key|api(?!version)|token|secret|password|auth|credential)[a-z0-9_ .\-,]{0,25}\s*[:=]\s*['\"]([0-9a-zA-Z\-_=]{16,64})['\"]",
+    },
+    {
+        "name": "Private Key",
+        "pattern": r"-----BEGIN (?:EC|PGP|DSA|RSA|OPENSSH|ENCRYPTED)? ?PRIVATE KEY(?: BLOCK)?-----",
+    },
+    {
+        "name": "JSON Web Token (JWT)",
+        "pattern": r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b",
+    },
+    {
+        "name": "Database Connection String",
+        "pattern": r"(?i)(postgres|mysql|mongodb(?:\+srv)?|redis)://[^:]+:[^@]+@",
+    },
+    # --- Cloud & IaaS Providers ---
+    {
+        "name": "AWS Access Key ID",
+        "pattern": r"\b(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b",
+    },
+    {
+        "name": "AWS Secret Access Key",
+        "pattern": r"(?i)aws(.{0,20})?['\"][0-9a-zA-Z\/+=]{40}['\"]",
+    },
+    {"name": "Google Cloud API Key", "pattern": r"\bAIza[0-9A-Za-z\-_]{35}\b"},
+    {"name": "Google OAuth Access Token", "pattern": r"\bya29\.[0-9A-Za-z\-_]+\b"},
+    # --- Version Control & DevOps ---
+    {
+        "name": "GitHub Personal Access Token (Classic)",
+        "pattern": r"\bghp_[0-9a-zA-Z]{36}\b",
+    },
+    {
+        "name": "GitHub Personal Access Token (Fine-grained)",
+        "pattern": r"\bgithub_pat_[0-9a-zA-Z]{22}_[0-9a-zA-Z]{59}\b",
+    },
+    {"name": "GitHub OAuth Access Token", "pattern": r"\bgho_[0-9a-zA-Z]{36}\b"},
+    {"name": "GitHub App Token", "pattern": r"\b(ghu|ghs)_[0-9a-zA-Z]{36}\b"},
+    {
+        "name": "Terraform Cloud/Enterprise Token",
+        "pattern": r"\b[a-zA-Z0-9]+\.atlasv1\.[a-zA-Z0-9\-_=]{60,70}\b",
+    },
+    # --- Communication & Messaging ---
+    {"name": "Slack Token", "pattern": r"\bxox[baprs]-[0-9a-zA-Z]{10,48}\b"},
+    {"name": "Telegram Bot Token", "pattern": r"\b[0-9]{8,10}:[a-zA-Z0-9_-]{35}\b"},
+    {"name": "Twilio API Key", "pattern": r"\bSK[0-9a-fA-F]{32}\b"},
+    {
+        "name": "SendGrid API Key",
+        "pattern": r"\bSG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}\b",
+    },
+    {"name": "Mailchimp API Key", "pattern": r"\b[0-9a-f]{32}-us[0-9]{1,2}\b"},
+    {"name": "Mailgun API Key", "pattern": r"\bkey-[0-9a-zA-Z]{32}\b"},
+    # --- SaaS, PaaS & APIs ---
+    {
+        "name": "Stripe API Key",
+        "pattern": r"\b(sk|pk)_(test|live)_[0-9a-zA-Z]{24,99}\b",
+    },
+    {
+        "name": "Heroku API Key",
+        "pattern": r"(?i)heroku[a-z0-9_\- ]*['\"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['\"]",
+    },
+    {
+        "name": "Discord Bot Token",
+        "pattern": r"\b[MN][A-Za-z\d]{23,25}\.[\w-]{6}\.[\w-]{27,}\b",
+    },
+    # --- Package Managers ---
+    {"name": "npm Token", "pattern": r"\bnpm_[a-zA-Z0-9]{36}\b"},
+    {
+        "name": "PyPI Upload Token",
+        "pattern": r"\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}\b",
+    },
+]
+
+
+def scan_file_for_secrets(file_path: str) -> List[Dict]:
+    """
+    Scans a single file for any of the defined secret patterns.
+
+    Args:
+        file_path: The path to the file to scan.
+
+    Returns:
+        A list of dictionaries, where each dictionary represents a found secret.
+        Returns an empty list if no secrets are found.
+    """
+    findings = []
+    try:
+        with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
+            # We read line by line to get the line number for reporting.
+            for line_num, line in enumerate(f, 1):
+                for secret in SECRET_PATTERNS:
+                    # re.search finds the first occurrence in the line
+                    if re.search(secret["pattern"], line):
+                        findings.append(
+                            {
+                                "file_path": file_path,
+                                "line_num": line_num,
+                                "secret_type": secret["name"],
+                                "line_content": line.strip(),
+                            }
+                        )
+                        # We break after the first find per line to avoid duplicate reports
+                        # for the same line if multiple patterns match.
+                        break
+    except IOError:
+        # Fails silently if a file can't be opened (e.g., broken symlink)
+        return []
+
+    return findings

envshield/core/template_manager.py

@@ -0,0 +1,184 @@
+# envshield/core/template_manager.py
+# Core logic for template checking and syncing, with per-link support.
+
+import os
+import questionary
+from rich.console import Console
+from rich.table import Table
+import datetime
+
+from envshield.config import manager as config_manager
+from envshield.core.exceptions import ProfileNotFoundError
+from envshield.parsers.factory import get_parser
+
+console = Console()
+
+
+def _get_link_diff(link: dict):
+    """Helper to get the variable difference for a single link."""
+    source_file = link.get("source")
+    template_file = link.get("template")
+
+    if not source_file or not template_file:
+        return None, None
+
+    source_parser = get_parser(source_file)
+    template_parser = get_parser(template_file)
+
+    if not source_parser or not template_parser:
+        return None, None
+
+    try:
+        source_vars = source_parser.get_vars(source_file)
+        template_vars = template_parser.get_vars(template_file)
+    except FileNotFoundError:
+        return None, None  # Handled by the calling function
+
+    extra_in_source = source_vars - template_vars
+    return extra_in_source, template_file
+
+
+def check_template(profile_name: str):
+    """
+    Compares each link in a profile with its own specific template.
+    """
+    config = config_manager.load_config()
+    profiles = config.get("profiles", {})
+
+    if profile_name not in profiles:
+        raise ProfileNotFoundError(profile_name)
+
+    profile_details = profiles[profile_name]
+    links = profile_details.get("links", [])
+
+    console.print(
+        f"\n[bold]Template Check for Profile: [cyan]{profile_name}[/cyan][/bold]"
+    )
+
+    found_issues = False
+    for link in links:
+        source_file = link.get("source")
+        template_file = link.get("template")
+
+        if not template_file:
+            continue  # Skip links without a template
+
+        console.print(
+            f"\n[bold]Checking Link:[/bold] [magenta]{source_file}[/magenta] vs [magenta]{template_file}[/magenta]"
+        )
+
+        try:
+            extra_vars, _ = _get_link_diff(link)
+            # We also need to get missing vars for the report
+            template_vars = get_parser(template_file).get_vars(template_file)
+            source_vars = get_parser(source_file).get_vars(source_file)
+            missing_vars = template_vars - source_vars
+
+            if not extra_vars and not missing_vars:
+                console.print("[green]  ✓ In sync.[/green]")
+                continue
+
+            found_issues = True
+            table = Table(show_header=True, header_style="bold blue")
+            table.add_column("Status", style="cyan")
+            table.add_column("Variable Name", style="white")
+
+            for var in sorted(list(missing_vars)):
+                table.add_row("[red]Missing in Source[/red]", var)
+            for var in sorted(list(extra_vars)):
+                table.add_row("[yellow]Extra in Source[/yellow]", var)
+
+            console.print(table)
+
+        except FileNotFoundError:
+            console.print(
+                f"[red]  Error: One of the files was not found. Please run 'envshield onboard'.[/red]"
+            )
+            found_issues = True
+
+    if found_issues:
+        console.print(
+            "\n[bold]Suggestion:[/bold] Run `envshield template sync` to interactively update your templates."
+        )
+    else:
+        console.print(
+            "\n[bold green]✓ All configured templates are perfectly in sync![/bold green]"
+        )
+
+
+def _append_to_template(template_file: str, variables_to_add: list):
+    """Appends new variables to the specified template file."""
+    if not variables_to_add:
+        return
+
+    console.print(f"\nUpdating template file: [magenta]{template_file}[/magenta]")
+
+    is_python_file = template_file.endswith(".py")
+
+    try:
+        with open(template_file, "a") as f:
+            f.write(
+                "\n\n# === Variables added by EnvShield on {} ===\n".format(
+                    datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+                )
+            )
+            for var in sorted(variables_to_add):
+                if is_python_file:
+                    line = f'{var} = ""  # TODO: Add default value\n'
+                else:  # .env style
+                    line = f"{var}=\n"
+                f.write(line)
+        console.print("[green]✓ Template file updated successfully.[/green]")
+    except IOError as e:
+        console.print(f"[red]Error:[/red] Could not write to template file: {e}")
+
+
+def sync_template(profile_name: str):
+    """
+    Interactively syncs templates for each link in a profile.
+    """
+    config = config_manager.load_config()
+    profiles = config.get("profiles", {})
+    if profile_name not in profiles:
+        raise ProfileNotFoundError(profile_name)
+
+    links = profiles[profile_name].get("links", [])
+
+    console.print(
+        f"\n[bold]Interactive Template Sync for Profile: [cyan]{profile_name}[/cyan][/bold]"
+    )
+
+    synced_something = False
+    for link in links:
+        try:
+            extra_vars, template_file = _get_link_diff(link)
+        except FileNotFoundError:
+            continue  # Skip if files don't exist
+
+        if not extra_vars or not template_file:
+            continue
+
+        synced_something = True
+        console.print(
+            f"\nFound extra variables for template [magenta]{template_file}[/magenta]:"
+        )
+
+        try:
+            variables_to_add = questionary.checkbox(
+                f"Which variables to add to {template_file}?",
+                choices=[
+                    questionary.Choice(title=var, checked=True)
+                    for var in sorted(list(extra_vars))
+                ],
+            ).ask()
+        except (KeyboardInterrupt, TypeError):
+            console.print("\n[yellow]Sync cancelled by user.[/yellow]")
+            return
+
+        if variables_to_add:
+            _append_to_template(template_file, variables_to_add)
+
+    if not synced_something:
+        console.print(
+            "\n[bold green]✓ All templates are already up-to-date![/bold green]"
+        )

envshield/parsers/_base.py

@@ -0,0 +1,28 @@
+# envshield/parsers/_base.py
+# Defines the abstract base class for all file parsers.
+
+from abc import ABC, abstractmethod
+from typing import Set
+
+
+class BaseParser(ABC):
+    """
+    Abstract Base Class for file parsers.
+    Ensures that every parser implements a 'get_vars' method.
+    """
+
+    @abstractmethod
+    def get_vars(self, file_path: str) -> Set[str]:
+        """
+        Parses a file and extracts the set of defined variable names.
+
+        Args:
+            file_path: The path to the file to be parsed.
+
+        Returns:
+            A set of strings, where each string is a variable name.
+
+        Raises:
+            FileNotFoundError: If the file_path does not exist.
+        """
+        pass

envshield/parsers/_dotenv.py

@@ -0,0 +1,35 @@
+# envshield/parsers/_dotenv.py
+# A simple parser for key-value .env files.
+import os
+from typing import Set
+from ._base import BaseParser
+
+
+class DotenvParser(BaseParser):
+    """
+    Parses traditional .env files.
+    """
+
+    def get_vars(self, file_path: str) -> Set[str]:
+        """
+        Extracts variable names from a .env file.
+        - Ignores lines starting with '#' (comments).
+        - Ignores empty lines.
+        - Splits lines by the first '=' to get the key.
+        """
+        if not os.path.exists(file_path):
+            raise FileNotFoundError(f"File not found: {file_path}")
+
+        variables = set()
+        with open(file_path, "r") as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith("#"):
+                    continue
+
+                if "=" in line:
+                    key = line.split("=", 1)[0].strip()
+                    if key:  # Ensure key is not empty
+                        variables.add(key)
+
+        return variables