dotenvx 0.2.2

A secure environment variable management tool with built-in encryption
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

use crate::crypto::encrypt;
use crate::parser::DotenvParser;
use crate::utils::error::{DotenvxError, Result};
use crate::utils::fs::{read_file, write_file};
use std::path::Path;

pub fn set_command(
    key: &str,
    value: &str,
    env_file: &Path,
    keys_file: Option<&Path>,
    plain: bool,
) -> Result<()> {
    // Read existing file or create empty content
    let content = if env_file.exists() {
        read_file(env_file)?
    } else {
        String::new()
    };

    let mut parser = DotenvParser::new();
    if !content.is_empty() {
        parser.parse(&content)?;
    }

    // Get or create keypair for encryption
    let (final_value, public_key) = if plain {
        (value.to_string(), None)
    } else {
        // Find or generate keypair
        let public_key = if let Some(existing_key) = parser.variables().get("DOTENV_PUBLIC_KEY") {
            existing_key.clone()
        } else {
            let keypair = crate::crypto::Keypair::generate();
            let priv_key = keypair.private_key();

            // Save private key
            save_private_key(env_file, keys_file, &priv_key)?;

            keypair.public_key()
        };

        let encrypted = encrypt(value, &public_key)?;
        (encrypted, Some(public_key))
    };

    // Build new content
    let mut output = String::new();
    let mut key_found = false;

    // Add public key header if encrypting
    if let Some(ref pub_key) = public_key {
        if !content.contains("DOTENV_PUBLIC_KEY") {
            output.push_str("#/-------------------[DOTENV_PUBLIC_KEY]--------------------/\n");
            output.push_str("#/            public-key encryption for .env files          /\n");
            output.push_str("#/       [how it works](https://dotenvx.com/encryption)     /\n");
            output.push_str("#/----------------------------------------------------------/\n");
            output.push_str(&format!("DOTENV_PUBLIC_KEY=\"{}\"\n\n", pub_key));
        }
    }

    // Process existing content
    for line in content.lines() {
        let trimmed = line.trim();

        if trimmed.starts_with(&format!("{}=", key))
            || trimmed.starts_with(&format!("export {}=", key))
        {
            // Replace this line
            output.push_str(&format!("{}=\"{}\"\n", key, final_value));
            key_found = true;
        } else {
            output.push_str(line);
            output.push('\n');
        }
    }

    // Add key if not found
    if !key_found {
        output.push_str(&format!("{}=\"{}\"\n", key, final_value));
    }

    write_file(env_file, &output)?;
    println!("✔ set {} in {}", key, env_file.display());

    Ok(())
}

fn save_private_key(env_file: &Path, keys_file: Option<&Path>, private_key: &str) -> Result<()> {
    let keys_path = if let Some(path) = keys_file {
        path.to_path_buf()
    } else {
        env_file
            .parent()
            .ok_or_else(|| DotenvxError::Other("Invalid env file path".to_string()))?
            .join(".env.keys")
    };

    let mut content = if keys_path.exists() {
        read_file(&keys_path)?
    } else {
        let mut c = String::new();
        c.push_str("#/------------------!DOTENV_PRIVATE_KEYS!-------------------/\n");
        c.push_str("#/ private decryption keys. DO NOT commit to source control /\n");
        c.push_str("#/     [how it works](https://dotenvx.com/encryption)       /\n");
        c.push_str("#/----------------------------------------------------------/\n\n");
        c
    };

    if !content.contains("DOTENV_PRIVATE_KEY=") {
        content.push_str(&format!("DOTENV_PRIVATE_KEY={}\n", private_key));
        write_file(&keys_path, &content)?;
    }

    Ok(())
}