git_crypt/
git.rs

1use crate::crypto::CryptoKey;
2use crate::error::{GitCryptError, Result};
3use git2::Repository;
4use std::io::{self, Read, Write};
5use std::path::Path;
6
7pub struct GitRepo {
8    repo: Repository,
9}
10
11impl GitRepo {
12    /// Open repository at the given path
13    pub fn open(path: impl AsRef<Path>) -> Result<Self> {
14        let repo = Repository::discover(path).map_err(|_| GitCryptError::NotInGitRepo)?;
15        Ok(Self { repo })
16    }
17
18    /// Get the git directory path
19    pub fn git_dir(&self) -> &Path {
20        self.repo.path()
21    }
22
23    /// Configure git filters for git-crypt
24    pub fn configure_filters(&self) -> Result<()> {
25        let mut config = self.repo.config()?;
26
27        // Set up clean filter (encrypts on add/commit)
28        config.set_str("filter.git-crypt.clean", "git-crypt clean")?;
29
30        // Set up smudge filter (decrypts on checkout)
31        config.set_str("filter.git-crypt.smudge", "git-crypt smudge")?;
32
33        // Don't diff encrypted files
34        config.set_str("filter.git-crypt.diff", "git-crypt diff")?;
35
36        // Required attribute
37        config.set_bool("filter.git-crypt.required", true)?;
38
39        Ok(())
40    }
41
42    /// Remove git-crypt filters
43    pub fn remove_filters(&self) -> Result<()> {
44        let mut config = self.repo.config()?;
45
46        let _ = config.remove("filter.git-crypt.clean");
47        let _ = config.remove("filter.git-crypt.smudge");
48        let _ = config.remove("filter.git-crypt.diff");
49        let _ = config.remove("filter.git-crypt.required");
50
51        Ok(())
52    }
53
54    /// Get repository root path
55    #[allow(dead_code)]
56    pub fn workdir(&self) -> Result<&Path> {
57        self.repo.workdir().ok_or(GitCryptError::Other(
58            "Repository has no working directory".into(),
59        ))
60    }
61}
62
63/// Clean filter: encrypt file content
64pub fn clean_filter(key: &CryptoKey) -> Result<()> {
65    let mut input = Vec::new();
66    io::stdin().read_to_end(&mut input)?;
67
68    // Check if already encrypted (has magic header)
69    if CryptoKey::is_encrypted(&input) {
70        io::stdout().write_all(&input)?;
71        return Ok(());
72    }
73
74    let encrypted = key.encrypt(&input)?;
75
76    // Write encrypted data to stdout
77    io::stdout().write_all(&encrypted)?;
78
79    Ok(())
80}
81
82/// Smudge filter: decrypt file content
83pub fn smudge_filter(key: &CryptoKey) -> Result<()> {
84    let mut input = Vec::new();
85    io::stdin().read_to_end(&mut input)?;
86
87    // Check if encrypted
88    if !CryptoKey::is_encrypted(&input) {
89        io::stdout().write_all(&input)?;
90        return Ok(());
91    }
92
93    let decrypted = key.decrypt(&input)?;
94
95    // Write decrypted data to stdout
96    io::stdout().write_all(&decrypted)?;
97
98    Ok(())
99}
100
101/// Diff filter: show that file is encrypted
102pub fn diff_filter() -> Result<()> {
103    let mut input = Vec::new();
104    io::stdin().read_to_end(&mut input)?;
105
106    if CryptoKey::is_encrypted(&input) {
107        writeln!(
108            io::stdout(),
109            "*** This file is encrypted with git-crypt ***"
110        )?;
111    } else {
112        io::stdout().write_all(&input)?;
113    }
114
115    Ok(())
116}
git_crypt/git.rs

git_crypt/
git.rs
