lade 0.15.3

Automatically load secrets from your preferred vault as environment variables, and clear them once your shell command is over.
mod loader;
mod secret;
#[cfg(test)]
mod tests;

pub use loader::LadeFile;
use secret::resolve_lade_secret;
pub use secret::*;

use crate::global_config::GlobalConfig;
use anyhow::{Result, bail};
use futures::future::try_join_all;
use lade_sdk::{hydrate_one, hydrate_with_maskable};
use regex::RegexSet;
use rustc_hash::FxHashMap;
use rustc_hash::FxHashSet;
use std::{collections::HashMap, path::PathBuf};

pub type Output = Option<PathBuf>;

type VarsByOutput = FxHashMap<Output, HashMap<String, String>>;

type CollectHydrateAccum = (
    VarsByOutput,
    HashMap<String, String>,
    FxHashSet<String>,
    Vec<String>,
);

fn output_name(output: &Output) -> String {
    output
        .as_ref()
        .map(|path| path.display().to_string())
        .unwrap_or_else(|| "environment".to_string())
}

fn merge_vars(
    vars: &mut VarsByOutput,
    output: Output,
    incoming: HashMap<String, String>,
) -> Result<()> {
    let target = vars.entry(output.clone()).or_default();
    for (key, value) in incoming {
        match target.get(&key) {
            Some(existing) if existing != &value => bail!(
                "conflicting value for '{}' in {}: '{}' and '{}' match the same command; use more specific rules",
                key,
                output_name(&output),
                existing,
                value
            ),
            Some(_) => {}
            None => {
                target.insert(key, value);
            }
        }
    }
    Ok(())
}

fn merge_sources(
    sources: &mut HashMap<String, String>,
    incoming: HashMap<String, String>,
) -> Result<()> {
    for (key, source) in incoming {
        match sources.get(&key) {
            Some(existing) if existing != &source => bail!(
                "conflicting source for '{}': '{}' and '{}' match the same command; use one source per variable",
                key,
                existing,
                source
            ),
            Some(_) => {}
            None => {
                sources.insert(key, source);
            }
        }
    }
    Ok(())
}

fn rule_sources(rule: &LadeRule, saved_user: &Option<String>) -> HashMap<String, String> {
    rule.secrets
        .iter()
        .filter_map(|(key, secret)| {
            resolve_lade_secret(secret, saved_user).map(|v| (key.clone(), v))
        })
        .collect()
}

async fn saved_user() -> Result<Option<String>> {
    use std::env;

    let local_config = GlobalConfig::load().await?;
    Ok(local_config
        .user
        .or_else(|| env::var("USER").ok().or_else(|| env::var("USERNAME").ok())))
}

pub struct Config {
    rules: Vec<(PathBuf, LadeRule)>,
    regex_set: RegexSet,
}

impl Config {
    pub(crate) fn new(rules: Vec<(PathBuf, LadeRule)>, regex_set: RegexSet) -> Self {
        Config { rules, regex_set }
    }

    pub(crate) fn collect(&self, command: &str) -> Vec<(PathBuf, LadeRule)> {
        self.regex_set
            .matches(command)
            .into_iter()
            .map(|i| self.rules[i].clone())
            .collect()
    }

    async fn hydrate_output(
        &self,
        path: PathBuf,
        rule: LadeRule,
        saved_user: &Option<String>,
    ) -> Result<(
        Output,
        HashMap<String, String>,
        HashMap<String, String>,
        FxHashSet<String>,
        Vec<String>,
    )> {
        let sources = rule_sources(&rule, saved_user);

        let config = rule.config.as_ref();
        let output = config.and_then(|c| c.file.clone());
        let extra_env = if let Some(uri) = config
            .and_then(|c| c.onepassword_service_account.as_ref())
            .and_then(|sa| resolve_lade_secret(sa, saved_user))
        {
            let token = hydrate_one(uri, &path, &HashMap::new()).await?;
            HashMap::from([("OP_SERVICE_ACCOUNT_TOKEN".to_string(), token)])
        } else {
            HashMap::new()
        };

        let (values, maskable, warnings) =
            hydrate_with_maskable(sources.clone(), path.clone(), extra_env).await?;
        Ok((
            output.map(|subpath| path.join(subpath)),
            values,
            sources,
            maskable,
            warnings,
        ))
    }

    pub async fn collect_hydrate(
        &self,
        command: &str,
    ) -> Result<(
        HashMap<Output, HashMap<String, String>>,
        HashMap<String, String>,
        FxHashSet<String>,
        Vec<String>,
    )> {
        let saved_user = saved_user().await?;

        let (vars, sources, maskable, warnings): CollectHydrateAccum = try_join_all(
            self.collect(command)
                .into_iter()
                .map(|(path, rule)| self.hydrate_output(path, rule, &saved_user)),
        )
        .await?
        .into_iter()
        .try_fold(
            (
                FxHashMap::default(),
                HashMap::new(),
                FxHashSet::default(),
                Vec::new(),
            ),
            |(mut vars, mut sources, mut maskable, mut warnings),
             (output, map, rule_sources, rule_maskable, rule_warnings)| {
                merge_vars(&mut vars, output, map)?;
                merge_sources(&mut sources, rule_sources)?;
                maskable.extend(rule_maskable);
                warnings.extend(rule_warnings);
                Ok::<_, anyhow::Error>((vars, sources, maskable, warnings))
            },
        )?;
        Ok((vars.into_iter().collect(), sources, maskable, warnings))
    }

    pub fn collect_keys(&self, command: &str) -> HashMap<Output, Vec<String>> {
        self.collect(command)
            .into_iter()
            .map(|(_, rule)| {
                (
                    rule.config.as_ref().and_then(|c| c.file.clone()),
                    rule.secrets.keys().cloned().collect::<Vec<_>>(),
                )
            })
            .collect()
    }

    /// All disclaimers from rules matching `command`, in rule order, deduplicated
    /// so the same text from several matching rules is shown only once.
    pub fn collect_disclaimers(&self, command: &str) -> Vec<String> {
        let mut seen = std::collections::HashSet::new();
        self.collect(command)
            .into_iter()
            .filter_map(|(_, rule)| rule.config.as_ref().and_then(|c| c.disclaimer.clone()))
            .filter(|d| seen.insert(d.clone()))
            .collect()
    }

    pub fn all_secret_sources(&self, saved_user: &Option<String>) -> Vec<String> {
        self.rules
            .iter()
            .flat_map(|(_, rule)| rule_sources(rule, saved_user).into_values())
            .collect()
    }

    pub fn rule_count(&self) -> usize {
        self.rules.len()
    }
}