secret.mx

config: define secret path {
	"Description": "Path to store GPG encrypted secrets",
	"DataType": "str",
	"Global": true,
	"Default": "~/.secrets"
}

config: define secret recipient {
	"Description": "Key to sign secret with",
	"DataType": "str",
	"Global": true,
	"Default": ""
}

function secret {
	# Manage secrets securely with GPG

	config: set index silent true

	switch $PARAMS[0] {
		case add    { secret.add $PARAMS[1] }
		case env    { secret.get env   $PARAMS[1] }
		case print  { secret.get print $PARAMS[1] }
		case delete { secret.delete $PARAMS[1] }
		case list   { secret.list }
		catch       { secret.default }
	}
}

autocomplete: set secret { [{
	"FlagsDesc": {
		"add": "Add a new secret",
		"env": "Retrieve a secret and store it as an environmental variable with the same name",
		"print": "Retrieve a secret and print it to STDOUT",
		"delete": "Delete a secret",
		"list": "List all secrets"
	},
	"FlagValues": {
		"env":    [{ "Dynamic": ({ secret: list -> cast json }) }],
		"print":  [{ "Dynamic": ({ secret: list -> cast json }) }],
		"delete": [{ "Dynamic": ({ secret: list -> cast json }) }]
	}
}] }

private secret.default {
	# `secret` usage

	err: "Usage: secret add id\n"               \
	      "             env id\n"               \
	      "             print id -> <stdout>\n" \
	      "             delete\n"               \
	      "             list     -> <stdout>" 
}

private secret.get {
	# Gets a secret

	trypipe {
		set name=$PARAMS[1]
		set export=${ $(name) | tr [:lower:] [:upper:] }
		set path=${ config: get secret path }
	
		!if { g: $path/$(name).secret } then {
			err: "Secret '$(name)' does not exist"
		}

		if { os linux } then {
			base64 = %[ -d "$path/$(name).secret" ]
		} else {
			base64 = %[ -d -i "$path/$(name).secret" ]
		}

		gpg = %[ -q --pinentry-mode loopback --decrypt ]

		switch $PARAMS[0] {
			case env {
				base64: @base64 -> gpg: @gpg -> export $export
			}
			case print {
				base64: @base64 -> gpg: @gpg 
			}
			catch {
				err: "Unknown action '$PARAMS[0]'"
			}
		}
	}
}

private secret.add {
	# Stores a new secret

	trypipe {
		set name=$PARAMS[0]
		set path=${ config: get secret path }
		mkdir -p $path
		set enc=${ config: get secret recipient }
		
		if { g: $path/$(name).secret } then {
			err: "Secret '$(name)' already exists! Please delete first"
		}

		if { $enc } then {
			$enc -> prepend "-r" -> set enc
		}

		$enc -> prepend "--encrypt" -> set enc

		read --prompt "Please input secret: " \
		     --variable secret \
		     --mask '*'

		$secret -> tmp -> set tmpfile
		open $tmpfile -> gpg: @enc -> base64 |> $path/$(name).secret
	}
}

private secret.delete {
	# Delete an existing secret

	trypipe {
		set name=$PARAMS[0]
		set path=${ config: get secret path }
		
		!if { g: $path/$(name).secret } then {
			err: "Secret '$(name)' does not exist!"
		}

		rm -v $path/$(name).secret
	}
}

private secret.list {
	# List all the stored secrets
	
	cast json

	path = ${ config: get secret path }
	mkdir -p $path

	g: $path/*.secret -> regexp s:^.*/:: -> regexp s/\.secret$//
}