feat(cli): Quit on decryption failure (#381)

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-pnpm lint && pnpm format && pnpm test:api && pnpm test:api-client
+pnpm lint && pnpm format && pnpm test:api && pnpm test:api-client

apps/api/package.json

@@ -16,7 +16,7 @@
     "db:format": "pnpm dlx prisma format --schema=src/prisma/schema.prisma",
     "db:reset": "pnpx dotenv-cli -e ../../.env -- pnpm dlx prisma migrate reset --force --schema=src/prisma/schema.prisma",
     "sourcemaps": "sentry-cli sourcemaps inject ./dist && sentry-cli sourcemaps upload ./dist  || echo 'Failed to upload source maps to Sentry'",
-    "e2e:prepare": "cd ../../ && docker compose down && docker compose -f docker-compose-test.yml up -d && cd apps/api && pnpm db:generate-types && cross-env NODE_ENV='e2e' DATABASE_URL='postgresql://prisma:prisma@localhost:5432/tests' pnpm run db:deploy-migrations",
+    "e2e:prepare": "cd ../../ && docker compose down && docker compose -f docker-compose-test.yml up -d && sleep 3 && cd apps/api && pnpm db:generate-types && cross-env NODE_ENV='e2e' DATABASE_URL='postgresql://prisma:prisma@localhost:5432/tests' pnpm run db:deploy-migrations",
     "e2e": "pnpm run e2e:prepare && cross-env NODE_ENV='e2e' DATABASE_URL='postgresql://prisma:prisma@localhost:5432/tests' jest --runInBand --config=jest.e2e-config.ts --coverage --coverageDirectory=../../coverage-e2e/api --coverageReporters=json && pnpm run e2e:teardown",
     "e2e:teardown": "cd ../../ && docker compose -f docker-compose-test.yml down",
     "unit": "pnpm db:generate-types && jest --config=jest.config.ts"

apps/cli/package.json

@@ -19,6 +19,7 @@
     "cli-table": "^0.3.11",
     "colors": "^1.4.0",
     "commander": "^12.1.0",
+    "eccrypto": "^1.1.6",
     "figlet": "^1.7.0",
     "fs": "0.0.1-security",
     "nodemon": "^3.1.4",

apps/cli/src/commands/init.command.ts

@@ -38,6 +38,12 @@ export default class InitCommand extends BaseCommand {
         long: '--overwrite',
         description: 'Overwrite existing configuration',
         defaultValue: false
+      },
+      {
+        short: '-q',
+        long: '--quit-on-decryption-failure',
+        description: 'Quit on decryption failure',
+        defaultValue: false
       }
     ]
   }
@@ -52,7 +58,7 @@ export default class InitCommand extends BaseCommand {
 
   async action({ options }: CommandActionData): Promise<void> {
     let { workspace, project, environment, privateKey } = options
-    const { overwrite } = options
+    const { overwrite, quitOnDecryptionFailure } = options
 
     intro('Configure the project for live-updates')
 
@@ -85,7 +91,8 @@ export default class InitCommand extends BaseCommand {
     await writeProjectRootConfig({
       workspace,
       project,
-      environment
+      environment,
+      quitOnDecryptionFailure
     })
 
     await writePrivateKeyConfig({

apps/cli/src/commands/run.command.ts

@@ -15,9 +15,12 @@ import {
 import { Logger } from '@/util/logger'
 import type {
   ClientRegisteredResponse,
-  Configuration
+  Configuration,
+  RunData
 } from '@/types/command/run.types'
 
+import { decrypt } from '@/util/decrypt'
+
 export default class RunCommand extends BaseCommand {
   private processEnvironmentalVariables = {}
 
@@ -29,7 +32,7 @@ export default class RunCommand extends BaseCommand {
   getName(): string {
     return 'run'
   }
-
+  
   getDescription(): string {
     return 'Run a command'
   }
@@ -52,9 +55,9 @@ export default class RunCommand extends BaseCommand {
   }
 
   private async fetchConfigurations(): Promise<
-    ProjectRootConfig & { privateKey: string }
+    RunData
   > {
-    const { environment, project, workspace } = await fetchProjectRootConfig()
+    const { environment, project, workspace, quitOnDecryptionFailure } = await fetchProjectRootConfig()
     const privateKeyConfig = await fetchPrivateKeyConfig()
     const privateKey =
       privateKeyConfig[`${workspace}_${project}_${environment}`]
@@ -67,7 +70,8 @@ export default class RunCommand extends BaseCommand {
       environment,
       project,
       workspace,
-      privateKey
+      privateKey,
+      quitOnDecryptionFailure
     }
   }
 
@@ -78,11 +82,13 @@ export default class RunCommand extends BaseCommand {
     return 'ws'
   }
 
-  private async connectToSocket(data: ProjectRootConfig) {
+  private async connectToSocket(data: RunData) {
     Logger.info('Connecting to socket...')
     const host = this.baseUrl.substring(this.baseUrl.lastIndexOf('/') + 1)
     const websocketUrl = `${this.getWebsocketType(this.baseUrl)}://${host}/change-notifier`
-
+    const privateKey = data.privateKey
+    const quitOnDecryptionFailure = data.quitOnDecryptionFailure
+
     const ioClient = io(websocketUrl, {
       autoConnect: false,
       extraHeaders: {
@@ -102,8 +108,23 @@ export default class RunCommand extends BaseCommand {
 
       ioClient.on('configuration-updated', async (data: Configuration) => {
         Logger.info(
-          `Configuration change received from API (name: ${data.name}, value: ${data.value})`
+          `Configuration change received from API (name: ${data.name})`
         )
+
+        if (!data.isPlaintext) {
+          try {
+            data.value = await decrypt(privateKey, data.value)
+          } catch (error) {
+            if (quitOnDecryptionFailure) {
+              Logger.error(`Decryption failed for ${data.name}. Stopping the process.`);
+              process.exit(1)
+            } else {
+              Logger.warn(`Decryption failed for ${data.name}. Skipping this configuration.`);
+              return;
+            }
+          }
+        }
+
         this.processEnvironmentalVariables[data.name] = data.value
         this.shouldRestart = true
       })

apps/cli/src/types/command/run.types.d.ts

@@ -1,3 +1,5 @@
+import { ProjectRootConfig } from "../index.types"
+
 export interface Configuration {
   name: string
   value: string
@@ -9,3 +11,7 @@ export interface ClientRegisteredResponse {
   projectId: string
   environmentId: string
 }
+
+export interface RunData extends ProjectRootConfig{
+    privateKey: string
+}

apps/cli/src/types/index.types.d.ts

@@ -2,6 +2,7 @@ export interface ProjectRootConfig {
   workspace: string
   project: string
   environment: string
+  quitOnDecryptionFailure: boolean
 }
 
 export interface ProfileConfig {

apps/cli/src/util/decrypt.ts

@@ -0,0 +1,22 @@
+import * as eccrypto from 'eccrypto'
+
+export const decrypt = async (
+  privateKey: string,
+  data: string
+): Promise<string> => {
+  const parsed = JSON.parse(data)
+
+  const eicesData = {
+    iv: Buffer.from(parsed.iv),
+    ephemPublicKey: Buffer.from(parsed.ephemPublicKey),
+    ciphertext: Buffer.from(parsed.ciphertext),
+    mac: Buffer.from(parsed.mac)
+  }
+
+  const decrypted = await eccrypto.decrypt(
+    Buffer.from(privateKey, 'hex'),
+    eicesData
+  )
+
+  return decrypted.toString()
+}