tsafe-cli 1.0.26

Secrets runtime for developers — inject credentials into processes via exec, never into shell history or .env files
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

//! Non-core `tsafe gcp-pull` handler — import secrets from GCP Secret Manager.

use anyhow::{Context as _, Result};
use colored::Colorize;
use crate::tsafe_gcp::{acquire_token, pull_secrets, GcpConfig, GcpError};
use tsafe_core::{audit::AuditEntry, events::emit_event};

use crate::helpers::*;
use crate::cli::PullOnError;

pub(crate) fn cmd_gcp_pull(
    profile: &str,
    project: Option<&str>,
    prefix: Option<&str>,
    overwrite: bool,
    on_error: PullOnError,
) -> Result<()> {
    cmd_gcp_pull_ns(profile, project, prefix, overwrite, on_error, None)
}

/// Inner implementation that supports an optional namespace prefix (ADR-012).
///
/// When `ns` is `Some("prod")`, every key name returned from Secret Manager
/// is stored as `prod.KEY_NAME` in the local vault.
pub(crate) fn cmd_gcp_pull_ns(
    profile: &str,
    project: Option<&str>,
    prefix: Option<&str>,
    overwrite: bool,
    on_error: PullOnError,
    ns: Option<&str>,
) -> Result<()> {
    let cfg = match project {
        Some(p) => GcpConfig::with_endpoint(p, "https://secretmanager.googleapis.com/v1"),
        None => GcpConfig::from_env().with_context(|| {
            "GCP project is not configured\n\
             \n  Fix:  export GOOGLE_CLOUD_PROJECT=my-project  (or pass --project)\
             \n  Help: tsafe explain pull-auth"
        })?,
    };

    let secrets = match pull_secrets(
        &cfg,
        &|| acquire_token().map_err(|e| GcpError::Auth(format!("{e}"))),
        prefix,
    )
    .with_context(|| {
        "failed to pull secrets from GCP Secret Manager\n\
         \n  Credential setup: tsafe explain pull-auth\
         \n  Local dev:        gcloud auth application-default login\
         \n  CI:               export GOOGLE_OAUTH_TOKEN=$(gcloud auth print-access-token)"
    }) {
        Ok(secrets) => secrets,
        Err(err) => match on_error {
            PullOnError::FailAll => return Err(err),
            PullOnError::SkipFailed | PullOnError::WarnOnly => {
                eprintln!("{} GCP pull failed: {err}", "!".yellow());
                return Ok(());
            }
        },
    };

    if secrets.is_empty() {
        println!(
            "{} No secrets found in Secret Manager matching the filter",
            "i".blue()
        );
        return Ok(());
    }

    let mut vault = open_vault(profile)?;
    let mut imported = 0usize;
    let mut skipped = 0usize;

    for (raw_key, value) in &secrets {
        // ADR-012: apply per-source namespace prefix when declared in the manifest.
        let key = match ns {
            Some(prefix) => format!("{prefix}.{raw_key}"),
            None => raw_key.clone(),
        };
        let exists = vault.list().contains(&key.as_str());
        if exists && !overwrite {
            skipped += 1;
            continue;
        }
        vault.set(&key, value, std::collections::HashMap::new())?;
        imported += 1;
    }

    audit(profile)
        .append(&AuditEntry::success(profile, "gcp-pull", None))
        .ok();
    emit_event(profile, "gcp-pull", None);
    println!(
        "{} Imported {imported} secret(s) from GCP Secret Manager (project: {}){}",
        "✓".green(),
        cfg.project_id,
        if skipped > 0 {
            format!(" ({skipped} skipped — use --overwrite to replace)")
        } else {
            String::new()
        }
    );
    Ok(())
}