Config flows (#65)

* add: implement config source and config body labels; drop: remove support for yml extension.

* undo

* undo

* add: edit stub

* add: decrypt and edit

* add: re-ecnrypt vars after edit

* add: implement edit

* add: replace describe by show config

* update docs

* fix: short-circuit edit if no changes
fix: fail if config with exact path is missing

---------

Co-authored-by: queil <queil@users.noreply.github.com>

Author: queil

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "rooz"
-version = "0.90.0"
+version = "0.91.0"
 edition = "2021"
 
 [dependencies]
@@ -11,6 +11,7 @@ clap = { version = "4.5.16", features = ["derive", "env"] }
 clap_complete = "4.5.24"
 colored = "2.1.0"
 ctrlc = "3.4.5"
+edit = "0.1.5"
 env_logger = "0.11.5"
 futures = "0.3.30"
 handlebars = "6.0.0"

Cargo.toml

@@ -100,7 +100,7 @@ rooz tmp --image alpine --shell sh
 Most of the settings can be configured via:
 
 * environment variables
-* a config file in the cloned repository (if any)  (`.rooz.toml`, `rooz.yaml`)
+* a config file in the cloned repository (if any)  (`.rooz.toml`, `.rooz.yaml`)
 * a config file specified via `--config` (on `rooz new`) (`toml/yaml`)
   :information_source: it can be a local file path or a remote git file like: `git@github.com/my/configs//path/in/repo/config.rooz.yaml`
 * cmd-line parameters
@@ -209,7 +209,7 @@ env:
 Now, encrypt the value:
 
 ```sh
-rooz encrypt --config ./examples/encrypt/example-secrets.rooz.yaml --env API_KEY
+rooz encrypt --config ./examples/encrypt/example-secrets.rooz.yaml apiKey
 ```
 
 View the file. If the result looks like the below (things may have got re-ordered
@@ -243,7 +243,7 @@ rooz enter secrets-test
 
 *It's similar to docker-compose but super simple and limited to bare minimum.*
 
-* `rooz` has a limited support for sidecars (containers running along). It is only available via `.rooz.toml`:
+* `rooz` has a limited support for sidecars (containers running along). It is only available via `.rooz.toml` / `.rooz.yaml`:
 
   ```toml
   [sidecars.sql]

README.md

@@ -23,6 +23,20 @@ pub fn mount(target: &str) -> Mount {
     }
 }
 
+pub enum Variable {
+    Secret { value: String },
+    ClearText { value: String },
+}
+
+impl Variable {
+    pub fn to_string(&self) -> String {
+        match &self {
+            Variable::Secret { value } => value.to_string(),
+            Variable::ClearText { value } => value.to_string(),
+        }
+    }
+}
+
 impl<'a> WorkspaceApi<'a> {
     pub async fn read_age_identity(&self) -> Result<Identity, AnyError> {
         let workspace_key = id::random_suffix("tmp");
@@ -104,8 +118,8 @@ pub fn encrypt(plaintext: String, recipient: Recipient) -> Result<String, AnyErr
 pub fn decrypt(
     identity: &dyn age::Identity,
     env_vars: LinkedHashMap<String, String>,
-) -> Result<LinkedHashMap<String, String>, AnyError> {
-    let mut ret = LinkedHashMap::<String, String>::new();
+) -> Result<LinkedHashMap<String, Variable>, AnyError> {
+    let mut ret = LinkedHashMap::<String, Variable>::new();
     for (k, v) in env_vars.iter() {
         if v.starts_with(SECRET_HEADER) {
             let formatted = v.replace("|", "\n");
@@ -126,10 +140,17 @@ pub fn decrypt(
 
             ret.insert(
                 k.to_string(),
-                std::str::from_utf8(&decrypted[..])?.to_string(),
+                Variable::Secret {
+                    value: std::str::from_utf8(&decrypted[..])?.to_string(),
+                },
             );
         } else {
-            ret.insert(k.to_string(), v.to_string());
+            ret.insert(
+                k.to_string(),
+                Variable::ClearText {
+                    value: v.to_string(),
+                },
+            );
         }
     }
     Ok(ret)

src/age_utils.rs

@@ -54,7 +54,7 @@ impl<'a> WorkspaceApi<'a> {
             let labels = labels
                 .clone()
                 .with_container(Some(&name))
-                .with_role(Some(labels::ROLE_SIDECAR));
+                .with_role(labels::ROLE_SIDECAR);
             let mut ports = HashMap::<String, Option<String>>::new();
             RoozCfg::parse_ports(&mut ports, s.ports.clone());
 

src/api/sidecar.rs

@@ -1,18 +1,20 @@
-use std::path::Path;
-
+use age::x25519::Identity;
 use bollard::{
     network::ListNetworksOptions,
     service::{ContainerSummary, Volume},
     volume::ListVolumesOptions,
 };
+use linked_hash_map::LinkedHashMap;
+use std::path::Path;
 
 use crate::{
-    age_utils,
+    age_utils::{self, Variable},
     api::WorkspaceApi,
+    cli::{ConfigPart, WorkParams, WorkspacePersistence},
     constants,
     labels::{self, Labels, ROLE},
     model::{
-        config::FinalCfg,
+        config::{ConfigSource, FileFormat, FinalCfg, RoozCfg},
         types::{AnyError, ContainerResult, RunSpec, WorkSpec, WorkspaceResult},
         volume::{RoozVolume, CACHE_ROLE, WORK_ROLE},
     },
@@ -200,11 +202,143 @@ impl<'a> WorkspaceApi<'a> {
         Ok(())
     }
 
-    pub async fn show_config(&self, workspace_key: &str) -> Result<(), AnyError> {
+    pub async fn show_config(&self, workspace_key: &str, part: ConfigPart) -> Result<(), AnyError> {
+        let labels = Labels::new(Some(workspace_key), Some(WORK_ROLE));
+        for c in self.api.container.get_all(&labels).await? {
+            if let Some(labels) = c.labels {
+                println!(
+                    "{}",
+                    labels[match part {
+                        ConfigPart::OriginPath => labels::CONFIG_ORIGIN,
+                        ConfigPart::OriginBody => labels::CONFIG_BODY,
+                        ConfigPart::Runtime => labels::RUNTIME_CONFIG,
+                    }]
+                );
+            }
+        }
+        Ok(())
+    }
+
+    pub fn encrypt(
+        &self,
+        identity: Identity,
+        name: &str,
+        vars: LinkedHashMap<String, String>,
+    ) -> Result<LinkedHashMap<String, String>, AnyError> {
+        let encrypted = self.encrypt_value(identity, vars[name].to_string())?;
+        let mut new_vars = vars.clone();
+        new_vars.insert(name.to_string(), encrypted);
+        Ok(new_vars)
+    }
+
+    pub fn encrypt_value(
+        &self,
+        identity: Identity,
+        clear_text: String,
+    ) -> Result<String, AnyError> {
+        age_utils::encrypt(clear_text, identity.to_public())
+    }
+
+    pub async fn decrypt(
+        &self,
+        vars: Option<LinkedHashMap<String, String>>,
+    ) -> Result<LinkedHashMap<String, age_utils::Variable>, AnyError> {
+        log::debug!("Checking if vars need decryption");
+        if let Some(vars) = age_utils::needs_decryption(vars.clone()) {
+            log::debug!("Decrypting vars");
+            let identity = self.read_age_identity().await?;
+            age_utils::decrypt(&identity, vars)
+        } else {
+            log::debug!("No encrypted vars found");
+            let mut ret = LinkedHashMap::<String, Variable>::new();
+            match vars {
+                Some(vars) => {
+                    for (k, v) in vars {
+                        ret.insert(k, Variable::ClearText { value: v });
+                    }
+                    Ok(ret)
+                }
+                None => Ok(ret),
+            }
+        }
+    }
+
+    pub fn variables_to_string(
+        &self,
+        vars: &LinkedHashMap<String, Variable>,
+    ) -> LinkedHashMap<String, String> {
+        let mut ret = LinkedHashMap::<String, String>::new();
+        for (k, v) in vars {
+            ret.insert(k.clone(), v.to_string());
+        }
+        ret
+    }
+
+    pub async fn edit(&self, workspace_key: &str) -> Result<(), AnyError> {
         let labels = Labels::new(Some(workspace_key), Some(WORK_ROLE));
         for c in self.api.container.get_all(&labels).await? {
             if let Some(labels) = c.labels {
-                println!("{}", labels[labels::RUNTIME_CONFIG]);
+                let config_source = &labels[labels::CONFIG_ORIGIN];
+                let format = FileFormat::from_path(config_source);
+                let config =
+                    RoozCfg::deserialize_config(&labels[labels::CONFIG_BODY], format)?.unwrap();
+                let decrypted = self.decrypt(config.clone().vars).await?;
+                let decrypted_config = RoozCfg {
+                    vars: if decrypted.len() > 0 {
+                        Some(self.variables_to_string(&decrypted))
+                    } else {
+                        None
+                    },
+                    ..config
+                };
+
+                let decrypted_string = decrypted_config.to_string(format)?;
+                let edited_string = edit::edit(decrypted_string.clone())?;
+
+                if edited_string != decrypted_string {
+                    let edited_config = RoozCfg::from_string(&edited_string, format)?;
+                    let identity = self.read_age_identity().await?;
+
+                    let mut encrypted_vars = LinkedHashMap::<String, String>::new();
+                    for (k, v) in &decrypted {
+                        let edited_value = &edited_config.clone().vars.unwrap()[k];
+                        match v {
+                            Variable::ClearText { .. } => {
+                                encrypted_vars.insert(k.to_string(), edited_value.to_string())
+                            }
+                            Variable::Secret { .. } => encrypted_vars.insert(
+                                k.to_string(),
+                                self.encrypt_value(identity.clone(), edited_value.to_string())?,
+                            ),
+                        };
+                    }
+
+                    let encrypted_config = RoozCfg {
+                        vars: if encrypted_vars.len() > 0 {
+                            Some(encrypted_vars)
+                        } else {
+                            None
+                        },
+                        ..edited_config
+                    };
+
+                    self.new(
+                        &WorkParams {
+                            ..Default::default()
+                        },
+                        Some(ConfigSource::Body {
+                            value: encrypted_config,
+                            origin: config_source.to_string(),
+                            format,
+                        }),
+                        Some(WorkspacePersistence {
+                            name: labels[labels::WORKSPACE_KEY].to_string(),
+                            replace: false,
+                            apply: true,
+                        }),
+                    )
+                    .await?;
+                }
             }
         }
         Ok(())