veritas-env/dist/index.cjs

Encrypted environment variables for node done right

"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.encrypt = exports.decrypt = void 0;

var _crypto = _interopRequireDefault(require("crypto"));

var _fs = _interopRequireDefault(require("fs"));

var _path = _interopRequireDefault(require("path"));

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }

function _toArray(arr) { return _arrayWithHoles(arr) || _iterableToArray(arr) || _unsupportedIterableToArray(arr) || _nonIterableRest(); }

function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }

function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }

function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) { arr2[i] = arr[i]; } return arr2; }

function _iterableToArray(iter) { if (typeof Symbol !== "undefined" && Symbol.iterator in Object(iter)) return Array.from(iter); }

function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }

// Exit early if ENV vars are missing
var args = ['VERITAS_SECRET', 'VERITAS_SALT'];
args.forEach(function (name) {
  if (!process.env[name]) {
    console.warn("Missing required envrionment variable '".concat(name, "'."));
    process.exit();
  }
});
var _process$env = process.env,
    VERITAS_SECRET = _process$env.VERITAS_SECRET,
    _process$env$VERITAS_ = _process$env.VERITAS_ENCRYPTION_ALGORITHM,
    VERITAS_ENCRYPTION_ALGORITHM = _process$env$VERITAS_ === void 0 ? 'aes256' : _process$env$VERITAS_,
    VERITAS_SALT = _process$env.VERITAS_SALT,
    _process$env$VERITAS_2 = _process$env.VERITAS_SALT_KEY_LENGTH,
    VERITAS_SALT_KEY_LENGTH = _process$env$VERITAS_2 === void 0 ? '32' : _process$env$VERITAS_2,
    VERITAS_IV = _process$env.VERITAS_IV,
    _process$env$VERITAS_3 = _process$env.VERITAS_IV_LENGTH,
    VERITAS_IV_LENGTH = _process$env$VERITAS_3 === void 0 ? '16' : _process$env$VERITAS_3;
var encoding = 'base64';
var ivLength = parseInt(VERITAS_IV_LENGTH, 10);

var key = _crypto["default"].scryptSync(VERITAS_SECRET, VERITAS_SALT, parseInt(VERITAS_SALT_KEY_LENGTH, 10));

var readJsonFile = function readJsonFile(file) {
  return JSON.parse(_fs["default"].readFileSync(file, {
    encoding: 'utf8'
  }));
};

var getIv = function getIv() {
  return VERITAS_IV ? Buffer.from(VERITAS_IV, 'utf8').slice(0, ivLength) : _crypto["default"].randomBytes(ivLength);
};

var decrypt = function decrypt(file, destination) {
  var vars = readJsonFile(file);

  for (var name in vars) {
    var data = Buffer.from(vars[name], encoding);
    var iv = data.slice(0, ivLength);
    var ciphertext = Buffer.from(vars[name].slice(iv.toString(encoding).length), encoding);

    var decipher = _crypto["default"].createDecipheriv(VERITAS_ENCRYPTION_ALGORITHM, key, iv);

    var decrypted = decipher.update(ciphertext, encoding, 'utf8');
    decrypted += decipher["final"]('utf8');
    vars[name] = decrypted;
  }

  _fs["default"].mkdirSync(_path["default"].dirname(destination), {
    recursive: true
  });

  _fs["default"].writeFileSync(destination, Object.entries(vars).map(function (e) {
    return "".concat(e[0], "=").concat(e[1]);
  }).join('\n'));

  return vars;
};

exports.decrypt = decrypt;

var encrypt = function encrypt(envFile, destination) {
  var envData = _fs["default"].readFileSync(envFile, {
    encoding: 'utf-8'
  });

  var vars = Object.fromEntries(envData.split('\n').filter(function (e) {
    return e.indexOf('=') > 0;
  }).map(function (e) {
    var _e$split = e.split('='),
        _e$split2 = _toArray(_e$split),
        name = _e$split2[0],
        value = _e$split2.slice(1);

    return [name, value.join('=')];
  })); // merge with destination

  var existing = {};

  if (_fs["default"].existsSync(destination)) {
    existing = readJsonFile(destination);
  } // Encrypt each value


  for (var name in vars) {
    var iv = getIv();

    var cipher = _crypto["default"].createCipheriv(VERITAS_ENCRYPTION_ALGORITHM, key, iv);

    var encrypted = iv.toString(encoding);
    encrypted += cipher.update(vars[name], 'utf8', encoding);
    encrypted += cipher["final"](encoding);
    existing[name] = encrypted;
  }

  _fs["default"].mkdirSync(_path["default"].dirname(destination), {
    recursive: true
  });

  _fs["default"].writeFileSync(destination, JSON.stringify(existing, null, 2));
};

exports.encrypt = encrypt;