|
| 1 | +// Swamp, an Automation Framework |
| 2 | +// Copyright (C) 2026 System Initiative, Inc. |
| 3 | +// |
| 4 | +// This file is part of Swamp. |
| 5 | +// |
| 6 | +// Swamp is free software: you can redistribute it and/or modify |
| 7 | +// it under the terms of the GNU Affero General Public License version 3 |
| 8 | +// as published by the Free Software Foundation, with the Swamp |
| 9 | +// Extension and Definition Exception (found in the "COPYING-EXCEPTION" |
| 10 | +// file). |
| 11 | +// |
| 12 | +// Swamp is distributed in the hope that it will be useful, |
| 13 | +// but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | +// GNU Affero General Public License for more details. |
| 16 | +// |
| 17 | +// You should have received a copy of the GNU Affero General Public License |
| 18 | +// along with Swamp. If not, see <https://www.gnu.org/licenses/>. |
| 19 | + |
| 20 | +import { Command } from "@cliffy/command"; |
| 21 | +import { |
| 22 | + consumeStream, |
| 23 | + createLibSwampContext, |
| 24 | + createVaultMigrateDeps, |
| 25 | + vaultMigrate, |
| 26 | + vaultMigratePreview, |
| 27 | +} from "../../libswamp/mod.ts"; |
| 28 | +import { |
| 29 | + createVaultMigrateRenderer, |
| 30 | + renderVaultMigrateCancelled, |
| 31 | +} from "../../presentation/renderers/vault_migrate.ts"; |
| 32 | +import { createContext, type GlobalOptions } from "../context.ts"; |
| 33 | +import { requireInitializedRepo } from "../repo_context.ts"; |
| 34 | +import { UserError } from "../../domain/errors.ts"; |
| 35 | +import { getSwampLogger } from "../../infrastructure/logging/logger.ts"; |
| 36 | + |
| 37 | +async function promptConfirmation(message: string): Promise<boolean> { |
| 38 | + const encoder = new TextEncoder(); |
| 39 | + const decoder = new TextDecoder(); |
| 40 | + |
| 41 | + await Deno.stdout.write(encoder.encode(`${message} [y/N] `)); |
| 42 | + |
| 43 | + const buf = new Uint8Array(1024); |
| 44 | + const n = await Deno.stdin.read(buf); |
| 45 | + if (n === null) return false; |
| 46 | + |
| 47 | + const response = decoder.decode(buf.subarray(0, n)).trim().toLowerCase(); |
| 48 | + return response === "y" || response === "yes"; |
| 49 | +} |
| 50 | + |
| 51 | +// deno-lint-ignore no-explicit-any |
| 52 | +type AnyOptions = any; |
| 53 | + |
| 54 | +export const vaultMigrateCommand = new Command() |
| 55 | + .name("migrate") |
| 56 | + .description( |
| 57 | + `Migrate a vault to a different backend type. |
| 58 | +
|
| 59 | +Copies all secrets from the current backend to a new one, then updates |
| 60 | +the vault configuration. The vault name stays the same, so all existing |
| 61 | +vault references continue to work without modification. |
| 62 | +
|
| 63 | +Both the source and target vaults must be different types.`, |
| 64 | + ) |
| 65 | + .arguments("<vault_name:string>") |
| 66 | + .option("--to-type <type:string>", "Target vault type", { required: true }) |
| 67 | + .option( |
| 68 | + "--config <config:string>", |
| 69 | + 'Provider-specific config as JSON (e.g. \'{"region":"us-east-1"}\')', |
| 70 | + ) |
| 71 | + .option("-f, --force", "Skip confirmation prompt") |
| 72 | + .option("--dry-run", "Preview migration without making changes") |
| 73 | + .option("--repo-dir <dir:string>", "Repository directory", { default: "." }) |
| 74 | + .example( |
| 75 | + "Migrate to AWS Secrets Manager", |
| 76 | + 'swamp vault migrate my-vault --to-type @swamp/aws-sm --config \'{"region":"us-east-1"}\'', |
| 77 | + ) |
| 78 | + .example( |
| 79 | + "Preview migration (dry run)", |
| 80 | + "swamp vault migrate my-vault --to-type @swamp/aws-sm --dry-run", |
| 81 | + ) |
| 82 | + .action(async function (options: AnyOptions, vaultName: string) { |
| 83 | + const cliCtx = createContext(options as GlobalOptions, [ |
| 84 | + "vault", |
| 85 | + "migrate", |
| 86 | + ]); |
| 87 | + cliCtx.logger.debug`Migrating vault: ${vaultName}`; |
| 88 | + |
| 89 | + const { repoDir } = await requireInitializedRepo({ |
| 90 | + repoDir: options.repoDir ?? ".", |
| 91 | + outputMode: cliCtx.outputMode, |
| 92 | + }); |
| 93 | + |
| 94 | + // Parse --config JSON if provided |
| 95 | + let targetConfig: Record<string, unknown> | undefined; |
| 96 | + if (options.config) { |
| 97 | + try { |
| 98 | + targetConfig = JSON.parse(options.config); |
| 99 | + } catch { |
| 100 | + throw new UserError( |
| 101 | + `Invalid JSON in --config: ${options.config}`, |
| 102 | + ); |
| 103 | + } |
| 104 | + } |
| 105 | + |
| 106 | + const ctx = createLibSwampContext({ logger: cliCtx.logger }); |
| 107 | + const deps = await createVaultMigrateDeps(repoDir); |
| 108 | + |
| 109 | + // Phase 1: Preview |
| 110 | + let preview; |
| 111 | + try { |
| 112 | + preview = await vaultMigratePreview(ctx, deps, { |
| 113 | + vaultName, |
| 114 | + targetType: options.toType, |
| 115 | + targetConfig, |
| 116 | + repoDir, |
| 117 | + }); |
| 118 | + } catch (error) { |
| 119 | + if ("code" in (error as Record<string, unknown>)) { |
| 120 | + throw new UserError((error as { message: string }).message); |
| 121 | + } |
| 122 | + throw error; |
| 123 | + } |
| 124 | + |
| 125 | + const logger = getSwampLogger(["vault", "migrate"]); |
| 126 | + |
| 127 | + if (cliCtx.outputMode === "log") { |
| 128 | + logger |
| 129 | + .info`Vault "${preview.vaultName}" (${preview.currentType}) has ${preview.secretCount} secret(s).`; |
| 130 | + logger |
| 131 | + .info`Target: ${preview.targetTypeName} (${preview.targetType})`; |
| 132 | + } |
| 133 | + |
| 134 | + // Phase 2: Dry run or confirmation |
| 135 | + if (options.dryRun) { |
| 136 | + if (cliCtx.outputMode === "json") { |
| 137 | + console.log(JSON.stringify( |
| 138 | + { |
| 139 | + dryRun: true, |
| 140 | + vaultName: preview.vaultName, |
| 141 | + currentType: preview.currentType, |
| 142 | + currentTypeName: preview.currentTypeName, |
| 143 | + targetType: preview.targetType, |
| 144 | + targetTypeName: preview.targetTypeName, |
| 145 | + secretCount: preview.secretCount, |
| 146 | + }, |
| 147 | + null, |
| 148 | + 2, |
| 149 | + )); |
| 150 | + } else { |
| 151 | + logger.info`Dry run — no changes made.`; |
| 152 | + } |
| 153 | + return; |
| 154 | + } |
| 155 | + |
| 156 | + if (cliCtx.outputMode === "log" && !options.force) { |
| 157 | + const confirmed = await promptConfirmation( |
| 158 | + `Migrate vault backend from ${preview.currentType} to ${preview.targetType}?`, |
| 159 | + ); |
| 160 | + if (!confirmed) { |
| 161 | + renderVaultMigrateCancelled(cliCtx.outputMode); |
| 162 | + return; |
| 163 | + } |
| 164 | + } |
| 165 | + |
| 166 | + // Phase 3: Execute migration |
| 167 | + const renderer = createVaultMigrateRenderer(cliCtx.outputMode); |
| 168 | + await consumeStream( |
| 169 | + vaultMigrate(ctx, deps, { |
| 170 | + vaultName, |
| 171 | + targetType: options.toType, |
| 172 | + targetConfig, |
| 173 | + repoDir, |
| 174 | + }), |
| 175 | + renderer.handlers(), |
| 176 | + ); |
| 177 | + |
| 178 | + cliCtx.logger.debug("Vault migrate command completed"); |
| 179 | + }); |
0 commit comments