vaultic 1.0.0

Secure your secrets. Sync your team. Trust your configs.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

use std::path::Path;
use std::process::Command;

use chrono::Utc;
use sha2::{Digest, Sha256};

use crate::adapters::audit::json_audit_logger::JsonAuditLogger;
use crate::cli::output;
use crate::config::app_config::AppConfig;
use crate::core::models::audit_entry::{AuditAction, AuditEntry};
use crate::core::traits::audit::AuditLogger;

/// Read the git user name and email from the local/global config.
/// Returns `("unknown", None)` if git is not available.
pub fn git_author() -> (String, Option<String>) {
    let name = Command::new("git")
        .args(["config", "user.name"])
        .output()
        .ok()
        .and_then(|o| {
            if o.status.success() {
                Some(String::from_utf8_lossy(&o.stdout).trim().to_string())
            } else {
                None
            }
        })
        .unwrap_or_else(|| "unknown".to_string());

    let email = Command::new("git")
        .args(["config", "user.email"])
        .output()
        .ok()
        .and_then(|o| {
            if o.status.success() {
                let val = String::from_utf8_lossy(&o.stdout).trim().to_string();
                if val.is_empty() { None } else { Some(val) }
            } else {
                None
            }
        });

    (name, email)
}

/// Compute the SHA-256 hash of a file, returning the hex string.
/// Returns `None` if the file cannot be read.
pub fn compute_file_hash(path: &Path) -> Option<String> {
    let data = std::fs::read(path).ok()?;
    let hash = Sha256::digest(&data);
    Some(format!("{hash:x}"))
}

/// Record an audit event. Warns on failure instead of propagating
/// the error, since audit should not block the main operation.
pub fn log_audit(action: AuditAction, files: Vec<String>, detail: Option<String>) {
    log_audit_with_hash(action, files, detail, None);
}

/// Record an audit event with an optional state hash.
pub fn log_audit_with_hash(
    action: AuditAction,
    files: Vec<String>,
    detail: Option<String>,
    state_hash: Option<String>,
) {
    let vaultic_dir = crate::cli::context::vaultic_dir();

    let config = AppConfig::load(vaultic_dir).ok();

    let audit_section = config.as_ref().and_then(|c| c.audit.as_ref());

    if !JsonAuditLogger::is_enabled(audit_section) {
        return;
    }

    let logger = JsonAuditLogger::from_config(vaultic_dir, audit_section);
    let (author, email) = git_author();

    let entry = AuditEntry {
        timestamp: Utc::now(),
        author,
        email,
        action,
        files,
        detail,
        state_hash,
    };

    if let Err(e) = logger.log_event(&entry) {
        output::warning(&format!("Could not write audit log: {e}"));
    }
}

/// Record an audit event right after `vaultic init`, before config
/// exists. Uses default values for the logger path.
pub fn log_audit_init() {
    let vaultic_dir = crate::cli::context::vaultic_dir();
    let logger = JsonAuditLogger::new(vaultic_dir, "audit.log");
    let (author, email) = git_author();

    let entry = AuditEntry {
        timestamp: Utc::now(),
        author,
        email,
        action: AuditAction::Init,
        files: vec![],
        detail: Some("project initialized".to_string()),
        state_hash: None,
    };

    if let Err(e) = logger.log_event(&entry) {
        output::warning(&format!("Could not write audit log: {e}"));
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn compute_file_hash_returns_hex_string() {
        let dir = tempfile::tempdir().unwrap();
        let file = dir.path().join("test.txt");
        std::fs::write(&file, "hello world").unwrap();

        let hash = compute_file_hash(&file).unwrap();
        // SHA-256 of "hello world" is well-known
        assert_eq!(
            hash,
            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
        );
    }

    #[test]
    fn compute_file_hash_nonexistent_returns_none() {
        let result = compute_file_hash(Path::new("/nonexistent/file.txt"));
        assert!(result.is_none());
    }
}