Benjamin Diedrichsen
11c323b715
encrypt read ~/.ssh and the tmp directory, and decrypt read <vault>/keys, with no existsSync between them. main.ts created vaultRoot and tmpDir but never keysDir, so decrypt on a fresh vault threw ENOENT instead of printing the "no encrypted keys" message it already had — the message was unreachable until something else created the directory. Both functions now fall through to their warning. main.ts creates all three directories, 0700: the vault holds the age identity and tmp holds plaintext private keys. age spawns go through runTool, which separates "not installed" (ENOENT, whose message is `spawn age ENOENT`) from "age refused" (whose reason is on stderr and nowhere in the thrown message). Tested against real processes, not a mocked execa — the shape of the failure is the point. list.ts kept statSync rather than switching to withFileTypes as planned: withFileTypes reports a symlinked key directory as a link and would have silently dropped it. `throwIfNoEntry: false` fixes the dangling-symlink throw and keeps following the good ones. Both cases now have a test. Also deletes the three debug logs (encrypt.ts printed both key arrays, decrypt.ts printed every candidate path from inside a filter). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
55 lines
1.8 KiB
TypeScript
55 lines
1.8 KiB
TypeScript
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import { execa } from 'execa';
|
|
import inquirer from 'inquirer';
|
|
import { runTool } from './keyman.utils.js';
|
|
|
|
export async function decryptKeys(sshDir: string, vaultDir: string, ageKey: string) {
|
|
const keyDir = path.join(vaultDir, 'keys');
|
|
// Guarded: nothing creates the keys directory until the first encrypt, so on a
|
|
// fresh vault this readdir threw instead of reporting an empty vault.
|
|
const vaultKeys = fs.existsSync(keyDir)
|
|
? fs.readdirSync(keyDir).filter((key) => fs.existsSync(path.join(keyDir, key, `id_${key}.age`)))
|
|
: [];
|
|
|
|
if (vaultKeys.length === 0) {
|
|
console.log('⚠️ No encrypted keys found.');
|
|
return;
|
|
}
|
|
|
|
const { selectedKeys, decryptMode } = await inquirer.prompt([
|
|
{
|
|
type: 'checkbox',
|
|
name: 'selectedKeys',
|
|
message: 'Select keys to decrypt:',
|
|
choices: vaultKeys,
|
|
},
|
|
{
|
|
type: 'list',
|
|
name: 'decryptMode',
|
|
message: 'Choose decryption location:',
|
|
choices: ['Local (vault/tmp)', 'SSH (~/.ssh)'],
|
|
},
|
|
]);
|
|
|
|
for (const key of selectedKeys) {
|
|
const encryptedKey = path.join(keyDir, key, `id_${key}.age`);
|
|
const publicKey = path.join(keyDir, key, `id_${key}.pub`);
|
|
const privateKeyOut =
|
|
decryptMode === 'Local (vault/tmp)'
|
|
? path.join(vaultDir, 'tmp', `id_${key}`)
|
|
: path.join(sshDir, `id_${key}`);
|
|
const publicKeyOut =
|
|
decryptMode === 'Local (vault/tmp)'
|
|
? path.join(vaultDir, 'tmp', `id_${key}.pub`)
|
|
: path.join(sshDir, `id_${key}.pub`);
|
|
|
|
// Decrypt key
|
|
await runTool('age', ['-d', '-i', ageKey, '-o', privateKeyOut, encryptedKey]);
|
|
|
|
await execa('cp', [publicKey, publicKeyOut]);
|
|
await execa('chmod', ['600', privateKeyOut]);
|
|
console.log(`✅ Decrypted: ${privateKeyOut}`);
|
|
}
|
|
}
|