-
Notifications
You must be signed in to change notification settings - Fork 220
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: support encrypted values in config
- Loading branch information
1 parent
2cca98c
commit 6ada505
Showing
4 changed files
with
124 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "encoding/base64" | ||
| "fmt" | ||
| "os" | ||
| "strings" | ||
|
|
||
| ecies "github.com/ecies/go/v2" | ||
| "github.com/go-errors/errors" | ||
| ) | ||
|
|
||
| type Secret string | ||
|
|
||
| func (s Secret) PlainText() *string { | ||
| key := os.Getenv("DOTENV_PRIVATE_KEY") | ||
| for _, k := range strings.Split(key, ",") { | ||
| value, err := decrypt(k, string(s)) | ||
| if err != nil { | ||
| fmt.Fprintln(os.Stderr, err) | ||
| } else if len(value) > 0 { | ||
| return &value | ||
| } | ||
| } | ||
| // Empty strings are converted to nil | ||
| return nil | ||
| } | ||
|
|
||
| const ENCRYPTED_PREFIX = "encrypted:" | ||
|
|
||
| // Decrypt secret values following dotenvx convention: | ||
| // https://github.com/dotenvx/dotenvx/blob/main/src/lib/helpers/decryptKeyValue.js | ||
| func decrypt(key, value string) (string, error) { | ||
| if !strings.HasPrefix(value, ENCRYPTED_PREFIX) { | ||
| return value, nil | ||
| } | ||
| if len(key) == 0 { | ||
| return value, errors.New("missing private key") | ||
| } | ||
| // Verify private key exists | ||
| privateKey, err := ecies.NewPrivateKeyFromHex(key) | ||
| if err != nil { | ||
| return value, errors.Errorf("failed to hex decode private key: %w", err) | ||
| } | ||
| // Verify ciphertext is base64 encoded | ||
| encoded := value[len(ENCRYPTED_PREFIX):] | ||
| ciphertext, err := base64.StdEncoding.DecodeString(encoded) | ||
| if err != nil { | ||
| return value, errors.Errorf("failed to base64 decode secret: %w", err) | ||
| } | ||
| // Return decrypted value | ||
| plaintext, err := ecies.Decrypt(privateKey, ciphertext) | ||
| if err != nil { | ||
| return value, errors.Errorf("failed to decrypt secret: %w", err) | ||
| } | ||
| return string(plaintext), nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestDecryptSecret(t *testing.T) { | ||
| key := "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb" | ||
| value := "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/" | ||
|
|
||
| t.Run("decrypts secret value", func(t *testing.T) { | ||
| // Run test | ||
| plaintext, err := decrypt(key, value) | ||
| // Check error | ||
| assert.NoError(t, err) | ||
| assert.Equal(t, "value", plaintext) | ||
| }) | ||
|
|
||
| t.Run("throws error on missing key", func(t *testing.T) { | ||
| // Run test | ||
| plaintext, err := decrypt("", value) | ||
| // Check error | ||
| assert.ErrorContains(t, err, "missing private key") | ||
| assert.Equal(t, value, plaintext) | ||
| }) | ||
|
|
||
| t.Run("throws error on non-hex key", func(t *testing.T) { | ||
| // Run test | ||
| plaintext, err := decrypt("invalid", value) | ||
| // Check error | ||
| assert.ErrorContains(t, err, "failed to hex decode private key: cannot decode hex string") | ||
| assert.Equal(t, value, plaintext) | ||
| }) | ||
|
|
||
| t.Run("throws error on non-base64 value", func(t *testing.T) { | ||
| // Run test | ||
| plaintext, err := decrypt(key, "encrypted:invalid") | ||
| // Check error | ||
| assert.ErrorContains(t, err, "failed to base64 decode secret: illegal base64 data at input byte 4") | ||
| assert.Equal(t, "encrypted:invalid", plaintext) | ||
| }) | ||
|
|
||
| t.Run("throws error on empty ciphertext", func(t *testing.T) { | ||
| // Run test | ||
| plaintext, err := decrypt(key, "encrypted:") | ||
| // Check error | ||
| assert.ErrorContains(t, err, "failed to decrypt secret: invalid length of message") | ||
| assert.Equal(t, "encrypted:", plaintext) | ||
| }) | ||
| } |