vaulttool 2.0.1__tar.gz → 2.0.2__tar.gz

{vaulttool-2.0.1 → vaulttool-2.0.2}/PKG-INFO

@@ -1,9 +1,9 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: vaulttool
-Version: 2.0.1
+Version: 2.0.2
 Summary: Secure file encryption for secrets/configs
-Home-page: https://github.com/yourusername/vaulttool
 License: Apache-2
+License-File: LICENSE
 Author: Josef Fuchs
 Requires-Python: >=3.10
 Classifier: License :: Other/Proprietary License
@@ -12,10 +12,11 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: cryptography
-Requires-Dist: pytest (>=8.4.2,<9.0.0)
 Requires-Dist: pyyaml
 Requires-Dist: typer
+Project-URL: Homepage, https://github.com/yourusername/vaulttool
 Description-Content-Type: text/markdown
 
 # Vault Tool

{vaulttool-2.0.1 → vaulttool-2.0.2}/pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "vaulttool"
-version = "2.0.1"
+version = "2.0.2"
 description = "Secure file encryption for secrets/configs"
-authors = ["Josef Fuchs"]
-license = { text = "Apache-2" }
+authors = [{name = "Josef Fuchs"}]
+license = {text = "Apache-2"}
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
@@ -18,7 +18,7 @@ vaulttool = "vaulttool.cli:app"
 
 [tool.poetry]
 name = "vaulttool"
-version = "2.0.1"
+version = "2.0.2"
 description = "Secure file encryption for secrets/configs"
 authors = ["Josef Fuchs"]
 license = "Apache-2"

{vaulttool-2.0.1 → vaulttool-2.0.2}/vaulttool/core.py

@@ -218,6 +218,73 @@ class VaultTool:
         # Simple suffix appending
         return f"{source_path}{suffix}"
 
+    def infer_vault_suffix(self, vault_path: str) -> str | None:
+        """Infer the actual vault suffix from a vault file path.
+
+        When fallback is enabled, vault files might have different suffixes than the current
+        configured suffix. This method attempts to determine the actual suffix by checking
+        if the file ends with ".vault" but not with the current suffix.
+
+        Strategy: Since all suffixes must end with ".vault", when a file doesn't match the
+        current suffix but ends with ".vault", we infer the suffix while accounting for
+        common file extensions (.env, .ini, .yaml, etc.).
+
+        Args:
+            vault_path: Path to the vault file to analyze.
+
+        Returns:
+            The inferred suffix (e.g., ".prod.vault", "_n3test.vault") or None if unable to infer.
+
+        Example:
+            >>> vt.infer_vault_suffix("development/creds.env.prod.vault")
+            ".prod.vault"
+        """
+        if not isinstance(vault_path, str):
+            vault_path = str(vault_path)
+
+        # If the file already matches the current suffix, return it
+        if vault_path.endswith(self.suffix):
+            return self.suffix
+
+        # If fallback is enabled and file ends with .vault, we need to infer the suffix
+        if self.use_suffix_fallback and vault_path.endswith(".vault"):
+            # Remove ".vault" to get the base filename
+            base = vault_path[:-6]  # Remove ".vault"
+            
+            # Common file extensions that are NOT part of the vault suffix
+            # These are file extensions that come BEFORE the vault suffix
+            COMMON_EXTENSIONS = {
+                '.env', '.ini', '.yaml', '.yml', '.json', '.conf', '.cfg',
+                '.config', '.secret', '.txt', '.log', '.properties', '.cnf'
+            }
+            
+            # Check if the base ends with a common file extension
+            for ext in COMMON_EXTENSIONS:
+                if base.endswith(ext):
+                    # The file extension is part of the filename, not the vault suffix
+                    # So the vault suffix is just ".vault"
+                    logger.debug(f"Detected common file extension {ext!r} in {vault_path!r}, using .vault as suffix")
+                    return ".vault"
+            
+            # No common extension found, so try to find a custom suffix
+            # Look for the last dot or underscore that could mark the start of a custom suffix
+            last_dot_idx = base.rfind(".")
+            last_underscore_idx = base.rfind("_")
+            
+            # Take the last occurrence of either dot or underscore
+            split_idx = max(last_dot_idx, last_underscore_idx)
+            
+            if split_idx >= 0:
+                # Found a dot or underscore, so custom suffix is from that position to ".vault"
+                inferred_suffix = base[split_idx:] + ".vault"
+                logger.debug(f"Inferred vault suffix {inferred_suffix!r} for file {vault_path!r}")
+                return inferred_suffix
+            else:
+                # No dot or underscore found in base, so suffix is just ".vault"
+                return ".vault"
+
+        return None
+
     def encrypt_file(self, source_path: str, encrypted_path: str):
         """Encrypt a single file using AES-256-CBC with derived encryption key.
 
@@ -453,8 +520,14 @@ class VaultTool:
                     if str(vault_file).endswith(self.suffix):
                         continue
 
-                    source = self.source_filename(str(vault_file), ".vault")
-                    # Only use .vault as fallback if custom suffix doesn't exist
+                    # Infer the actual suffix instead of assuming ".vault"
+                    inferred_suffix = self.infer_vault_suffix(str(vault_file))
+                    if inferred_suffix is None:
+                        # Fallback to ".vault" if unable to infer
+                        inferred_suffix = ".vault"
+                    
+                    source = self.source_filename(str(vault_file), inferred_suffix)
+                    # Only use fallback if custom suffix doesn't exist
                     if source not in vault_files_by_source:
                         vault_files_by_source[source] = vault_file
 
@@ -535,7 +608,13 @@ class VaultTool:
             if str(vault_file).endswith(self.suffix):
                 vault_suffix = self.suffix
             elif self.use_suffix_fallback and str(vault_file).endswith(".vault"):
-                vault_suffix = ".vault"
+                # Use inferred suffix instead of assuming ".vault"
+                vault_suffix = self.infer_vault_suffix(str(vault_file))
+                if vault_suffix is None:
+                    logger.warning(f"Failed to infer vault suffix for {vault_file}")
+                    skipped += 1
+                    continue
+                logger.debug(f"Using inferred suffix {vault_suffix!r} for {vault_file}")
             else:
                 # Unknown suffix, skip
                 logger.warning(f"Vault file {vault_file} doesn't match any known suffix pattern")

vaulttool-2.0.2/vaulttool/tests/test_suffix_switch_bug.py

@@ -0,0 +1,142 @@
+"""Test for bug fix: refresh creates wrong filename when suffix changes.
+
+This test suite addresses the issue where `vaulttool refresh` would create
+a file with an incorrect name (missing source filename) when the suffix
+configuration changed between encryption and refresh operations.
+
+Issue:
+- Encrypt file with VAULTTOOL_OPTIONS_SUFFIX=n3test.vault creates development/creds.env_n3test.vault
+- Run refresh → should restore development/creds.env
+- BUG: created development/creds.env_n3test instead
+
+Root Cause:
+When a vault file from a previous suffix (e.g., .prod.vault) is found during refresh
+with a different current suffix (e.g., _n3test.vault), the fallback logic would
+incorrectly use ".vault" as the suffix, removing only 6 characters instead of 12,
+resulting in an incorrect source filename.
+
+Fix:
+infer_vault_suffix() method now intelligently determines the actual vault suffix
+by recognizing common file extensions (.env, .ini, etc.) and correctly inferring
+custom suffixes like .prod.vault.
+"""
+
+import os
+import pytest
+import tempfile
+import shutil
+from pathlib import Path
+from vaulttool.core import VaultTool
+
+
+class TestSuffixSwitchBugFix:
+    """Test that refresh correctly handles vault files with different suffix than current."""
+
+    def setup_method(self):
+        """Set up test environment."""
+        try:
+            self.original_cwd = os.getcwd()
+        except FileNotFoundError:
+            self.original_cwd = Path.home()
+
+        self.test_dir = tempfile.mkdtemp()
+        os.chdir(self.test_dir)
+
+        # Create key file
+        self.key_file = Path('test.key')
+        self.key_file.write_text('a' * 32)
+
+        # Create development directory
+        Path('development').mkdir(exist_ok=True)
+
+    def teardown_method(self):
+        """Clean up test environment."""
+        os.chdir(self.original_cwd)
+        shutil.rmtree(self.test_dir)
+
+    def test_env_variable_suffix_refresh_restores_correct_file(self):
+        """Test the exact bug scenario: suffix changed via env var, refresh restores source."""
+        # Setup config with default .vault
+        Path('.vaulttool.yml').write_text(f"""
+options:
+  suffix: .vault
+  key_file: {self.key_file.absolute()}
+  use_suffix_fallback: true
+
+include_directories: [.]
+exclude_directories: []
+include_patterns:
+  - "*.env"
+exclude_patterns: []
+""")
+
+        # Create and encrypt with environment variable suffix
+        Path('development/creds.env').write_text('DATABASE_PASSWORD=super_secret\n')
+        os.environ['VAULTTOOL_OPTIONS_SUFFIX'] = 'n3test.vault'
+
+        vt = VaultTool()
+        vt.encrypt_task(force=True)
+
+        # Verify vault file created with correct name
+        assert Path('development/creds.env_n3test.vault').exists()
+        source_file = Path('development/creds.env')
+        assert source_file.exists()
+
+        # Delete source file
+        source_file.unlink()
+
+        # Run refresh - should restore development/creds.env
+        result = vt.refresh_task(force=True)
+
+        # Verify success
+        assert result['succeeded'] == 1
+        assert result['failed'] == 0
+
+        # CRITICAL: Check that the CORRECT file was restored
+        assert Path('development/creds.env').exists(), "Source file not restored"
+        assert Path('development/creds.env').read_text() == 'DATABASE_PASSWORD=super_secret\n'
+
+        # CRITICAL: Check that no wrong files were created
+        wrong_files = list(Path('development').glob('*_n3test'))
+        assert len(wrong_files) == 0, f"Wrong file created: {wrong_files}"
+
+    def test_infer_vault_suffix_with_various_file_extensions(self):
+        """Test that infer_vault_suffix correctly handles different file types."""
+        # Use .custom.vault as current suffix for this test
+        Path('.vaulttool.yml').write_text(f"""
+options:
+  suffix: .custom.vault
+  key_file: {self.key_file.absolute()}
+  use_suffix_fallback: true
+
+include_directories: [.]
+exclude_directories: []
+include_patterns:
+  - "*.env"
+  - "*.ini"
+  - "*.yaml"
+exclude_patterns: []
+""")
+
+        vt = VaultTool()
+
+        # Test cases: (filename, expected_inferred_suffix)
+        test_cases = [
+            ('config.env.vault', '.vault'),  # Common .env extension
+            ('config.ini.vault', '.vault'),  # Common .ini extension
+            ('config.yaml.vault', '.vault'),  # Common .yaml extension
+            ('config.yml.vault', '.vault'),  # Common .yml extension
+            ('config.prod.vault', '.prod.vault'),  # Custom suffix (no common ext)
+            ('database.cfg.vault', '.vault'),  # Common .cfg extension
+            ('secret.conf.vault', '.vault'),  # Common .conf extension
+        ]
+
+        for filename, expected_suffix in test_cases:
+            inferred = vt.infer_vault_suffix(filename)
+            assert inferred == expected_suffix, \
+                f"For {filename}: expected {expected_suffix!r}, got {inferred!r}"
+
+
+if __name__ == '__main__':
+    pytest.main([__file__, '-v'])
+