1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
use crate::commands::Cli;
use crate::config::{self, Config, IfMissing};
use crate::error::{FnoxError, Result};
use clap::Args;
use std::io::{self, Read};
#[derive(Debug, Args)]
#[command(visible_aliases = ["s"])]
pub struct SetCommand {
/// Secret key (environment variable name)
pub key: String,
/// Secret value to store.
///
/// If omitted: reads from stdin when piped (`echo "x" | fnox set KEY`),
/// or prompts interactively with hidden input.
///
/// Passing secrets as arguments exposes them in shell history and `ps` output.
/// For sensitive values, prefer stdin or the interactive prompt.
pub value: Option<String>,
/// Description of the secret
#[arg(short = 'd', long)]
pub description: Option<String>,
/// Save to the global config file (~/.config/fnox/config.toml)
#[arg(short = 'g', long)]
pub global: bool,
/// Key name in the provider (if different from env var name)
#[arg(short = 'k', long)]
pub key_name: Option<String>,
/// Show what would be done without making changes
#[arg(short = 'n', long)]
pub dry_run: bool,
/// Provider to fetch from
#[arg(short = 'p', long)]
pub provider: Option<String>,
/// Base64 encode the secret
#[arg(long)]
pub base64_encode: bool,
/// Default value to use if secret is not found
#[arg(long)]
pub default: Option<String>,
/// What to do if the secret is missing (error, warn, ignore)
#[arg(long)]
pub if_missing: Option<IfMissing>,
}
impl SetCommand {
pub async fn run(&self, cli: &Cli, mut config: Config) -> Result<()> {
let profile = Config::get_profile(cli.profile.as_deref());
tracing::debug!("Setting secret '{}' in profile '{}'", self.key, profile);
// Check if we're only setting metadata (no actual secret value)
let has_metadata =
self.description.is_some() || self.if_missing.is_some() || self.default.is_some();
// Get the secret value if provided
let secret_value = if let Some(ref v) = self.value {
// Value provided as argument
Some(v.clone())
} else if has_metadata && self.key_name.is_none() {
// Only metadata is being set, no secret value needed
None
} else if !atty::is(atty::Stream::Stdin) {
// Read from stdin if piped
tracing::debug!("Reading secret value from stdin");
let mut buffer = String::new();
io::stdin()
.read_to_string(&mut buffer)
.map_err(|source| FnoxError::StdinReadFailed { source })?;
Some(buffer.trim().to_string())
} else {
// Interactive terminal - prompt for value
let value = demand::Input::new("Enter secret value")
.prompt("Secret value: ")
.password(true)
.run()
.map_err(|e| FnoxError::Config(format!("Failed to read input: {}", e)))?;
Some(value)
};
// Determine which provider to use
let provider_name_to_use = if let Some(ref provider_name) = self.provider {
Some(provider_name.clone())
} else if let Some(existing) = config
.get_secret(&profile, &self.key)
.and_then(|s| s.provider().map(str::to_string))
{
Some(existing)
} else {
// Try to use default provider if available, but it's OK if there isn't one
// (will store as plaintext)
config.get_default_provider(&profile)?
};
// Check if secret should be base64 encoded
let secret_value = if self.base64_encode {
secret_value
.as_ref()
.map(|value| data_encoding::BASE64.encode(value.as_bytes()))
} else {
secret_value
};
// Handle provider-specific behavior (before we get mutable borrow)
let (encrypted_value, remote_key_name) = if let Some(ref value) = secret_value {
if let Some(ref provider_name) = provider_name_to_use {
// Get the provider config
let providers = config.get_providers(&profile);
if let Some(provider_config) = providers.get(provider_name) {
// Get the provider (resolving any secret refs) and check its capabilities
let provider = crate::providers::get_provider_resolved(
&config,
&profile,
provider_name,
provider_config,
)
.await?;
let capabilities = provider.capabilities();
// Ensure the provider has at least one capability
if capabilities.is_empty() {
return Err(FnoxError::Config(format!(
"Provider '{}' has no capabilities defined",
provider_name
)));
}
let is_encryption_provider =
capabilities.contains(&crate::providers::ProviderCapability::Encryption);
let is_remote_storage_provider =
capabilities.contains(&crate::providers::ProviderCapability::RemoteStorage);
if is_encryption_provider {
tracing::debug!(
"Encrypting secret value with provider '{}'",
provider_name
);
if self.dry_run {
// In dry-run mode, skip actual encryption
(Some("<encrypted>".to_string()), None)
} else {
// Encrypt with the provider — fail on error rather than
// silently storing plaintext
let encrypted = provider.encrypt(value).await?;
(Some(encrypted), None)
}
} else if is_remote_storage_provider {
tracing::debug!(
"Storing secret '{}' in remote provider '{}'",
self.key,
provider_name
);
if self.dry_run {
// In dry-run mode, skip actual remote storage
let key_name = self.key_name.as_deref().unwrap_or(&self.key);
(None, Some(key_name.to_string()))
} else {
// Use the already-resolved provider to store the secret
let key_name = self.key_name.as_deref().unwrap_or(&self.key);
let stored_key = provider.put_secret(key_name, value).await?;
// Store just the key name (without prefix) in config
(None, Some(stored_key))
}
} else {
// Not an encryption or remote storage provider
(None, None)
}
} else {
return Err(FnoxError::Config(format!(
"Provider '{}' not found in configuration",
provider_name
)));
}
} else {
// No provider specified or available
(None, None)
}
} else {
(None, None)
};
// Now update the config
let profile_secrets = config.get_secrets_mut(&profile);
// Get or create the secret config
let secret_config = profile_secrets.entry(self.key.clone()).or_default();
// Update metadata
if let Some(ref desc) = self.description {
secret_config.description = Some(desc.clone());
}
if let Some(if_missing) = self.if_missing {
secret_config.if_missing = Some(if_missing);
}
if let Some(ref default) = self.default {
secret_config.default = Some(default.clone());
}
// Set the provider if explicitly specified
if let Some(ref provider) = self.provider {
secret_config.set_provider(Some(provider.clone()));
} else if provider_name_to_use.is_some() && secret_config.provider().is_none() {
// If we have a default provider and the secret doesn't already have one,
// store it explicitly for clarity
secret_config.set_provider(provider_name_to_use.clone());
}
if let Some(ref value) = secret_value {
// Priority order: remote key name, encrypted value, then plaintext
if let Some(remote_key) = remote_key_name {
// Store the key name for remote storage providers
secret_config.set_value(Some(remote_key));
} else if let Some(encrypted) = encrypted_value {
// Store encrypted value for encryption providers
secret_config.set_value(Some(encrypted));
} else if provider_name_to_use.is_some() {
// Provider specified or default provider available (but not an encryption/remote provider)
secret_config.set_value(Some(value.clone()));
} else {
// No provider specified or available, store as default value
secret_config.set_value(Some(value.clone()));
secret_config.default = Some(value.clone());
}
}
let secret_config = profile_secrets.get(&self.key).unwrap().clone();
let _ = profile_secrets; // Release the mutable borrow
// Save the secret to the appropriate config file
let target_path = if self.global {
// Save to global config
let global_path = Config::global_config_path();
// Create parent directory if it doesn't exist
if let Some(parent) = global_path.parent()
&& !self.dry_run
{
std::fs::create_dir_all(parent).map_err(|e| {
FnoxError::Config(format!(
"Failed to create config directory '{}': {}",
parent.display(),
e
))
})?;
}
global_path
} else {
let current_dir = std::env::current_dir().map_err(|e| {
FnoxError::Config(format!("Failed to get current directory: {}", e))
})?;
// Only use auto-detection when --config is the clap default ("fnox.toml").
// Any other value means the user explicitly chose a config file.
if cli.config == std::path::Path::new(config::DEFAULT_CONFIG_FILENAME) {
config::find_local_config(¤t_dir, Some(&profile))
} else {
current_dir.join(&cli.config)
}
};
if self.dry_run {
// Show what would be done
let dry_run_label = console::style("[dry-run]").yellow().bold();
let styled_key = console::style(&self.key).cyan();
let styled_profile = console::style(&profile).magenta();
let styled_path = console::style(target_path.display()).dim();
let global_suffix = if self.global { " (global)" } else { "" };
if profile == "default" {
println!(
"{dry_run_label} Would set secret {styled_key}{global_suffix} in {styled_path}"
);
} else {
println!(
"{dry_run_label} Would set secret {styled_key} in profile {styled_profile}{global_suffix} in {styled_path}"
);
}
// Show the config that would be written
if let Some(provider) = secret_config.provider() {
println!(" provider: {}", console::style(provider).green());
}
if let Some(value) = secret_config.value() {
// Use character-aware truncation to avoid panicking on multi-byte UTF-8
let display_value = if value.chars().count() > 50 {
format!("{}...", value.chars().take(50).collect::<String>())
} else {
value.to_string()
};
println!(" value: {}", console::style(display_value).dim());
}
if let Some(ref desc) = secret_config.description {
println!(" description: {}", console::style(desc).dim());
}
if let Some(ref default) = secret_config.default {
println!(" default: {}", console::style(default).dim());
}
if let Some(if_missing) = secret_config.if_missing {
println!(
" if_missing: {}",
console::style(format!("{:?}", if_missing).to_lowercase()).dim()
);
}
} else {
config.save_secret_to_source(&self.key, &secret_config, &profile, &target_path)?;
let check = console::style("✓").green();
let styled_key = console::style(&self.key).cyan();
let styled_profile = console::style(&profile).magenta();
let global_suffix = if self.global { " (global)" } else { "" };
if profile == "default" {
println!("{check} Set secret {styled_key}{global_suffix}");
} else {
println!(
"{check} Set secret {styled_key} in profile {styled_profile}{global_suffix}"
);
}
}
Ok(())
}
}