Modernise and update the migrator to work with new storage backend

Author: jcoglan

bin/vault

@@ -18,6 +18,15 @@ const key = process.env.VAULT_KEY ||
 const vaultPath = process.env.VAULT_PATH || '.vault'
 const pathname = path.resolve(home, vaultPath)
 
+let logger = {
+  info (...args) {
+    console.error('[info]', ...args)
+  },
+  error (error) {
+    console.error('[error]', process.env.DEBUG ? error.stack : error.message)
+  }
+}
+
 let cli = new CLI({
   config: { path: pathname, key },
   stdout: process.stdout,
@@ -32,11 +41,11 @@ let cli = new CLI({
 
 async function main () {
   try {
-    await legacy.migrateConfig(pathname, key)
+    await legacy.migrate(logger, pathname, key)
     await cli.run(process.argv)
     process.exit(0)
   } catch (error) {
-    console.error('[ERROR] ' + (process.env.DEBUG ? error.stack : error.message))
+    logger.error(error)
     process.exit(1)
   }
 }

lib/crypto/node_crypto.js

@@ -13,5 +13,33 @@ module.exports = {
       let bytes = Math.ceil(size / 8)
       return fn(pw, salt, iterations, bytes, 'sha1')
     }
+  },
+
+  legacy: {
+    hmacSha256: {
+      async sign (key, data) {
+        let hmac = crypto.createHmac('sha256', key)
+        hmac.update(data)
+        return hmac.digest()
+      },
+
+      async verify (key, data, signature) {
+        let expected = await this.sign(key, data)
+        return crypto.timingSafeEqual(expected, signature)
+      }
+    },
+
+    aes256cbc: {
+      async decrypt (key, iv, data) {
+        let cipher = (iv === null)
+                   ? crypto.createDecipher('aes256', key)
+                   : crypto.createDecipheriv('aes-256-cbc', key, iv)
+
+        return Buffer.concat([
+          cipher.update(data),
+          cipher.final()
+        ])
+      }
+    }
   }
 }

lib/legacy/index.js

@@ -1,73 +1,66 @@
-'use strict';
+'use strict'
 
-var fs       = require('fs'),
-    Migrator = require('./migrator'),
-    confirm  = require('../cli/confirm');
+const fs = require('fs')
+const Migrator = require('./migrator')
+const confirm  = require('../cli/confirm')
 
-var SEP = '========================================================================';
+const SEP = '========================================================================'
 
-var formatMessage = function(text) {
-  if (!process.stderr.getWindowSize) return message;
+async function migrate (logger, pathname, password) {
+  let stat
 
-  var width = process.stderr.getWindowSize()[0] - 4,
-      words = text.split(/\s+/),
-      lines = [''],
-      last, word;
+  try {
+    stat = fs.statSync(pathname)
+  } catch (error) {
+    return false
+  }
 
-  while (words.length > 0) {
-    last = lines[lines.length - 1];
-    word = words.shift();
+  if (!stat.isFile()) return false
 
-    if (last.length + word.length + 1 > width)
-      lines.push('');
+  message(
+    'It looks as though your config file (' + pathname + ') was created ' +
+    'with an old version of Vault. In order to continue, it needs to be ' +
+    'converted to a new format.')
 
-    last = lines[lines.length - 1];
-    lines[lines.length - 1] = (last === '') ? word : last + ' ' + word;
-  }
-  return lines.join('\n');
-};
-
-var message = function(text) {
-  console.error('\n' + formatMessage(text) + '\n');
-};
-
-var migrate = function(pathname, password) {
-  var migrator = new Migrator(pathname, password);
-
-  migrator.on('message', function(message) {
-    console.error('[INFO] ' + message);
-  });
-
-  return migrator.run();
-};
-
-module.exports = {
-  migrateConfig: function(pathname, password) {
-    var stat;
-    try {
-      stat = fs.statSync(pathname);
-    } catch (error) {
-      return Promise.resolve();
-    }
+  await confirm('Would you like Vault to perform this conversion now?')
+
+  console.error('\n' + SEP)
+
+  let migrator = new Migrator({ logger, pathname, password })
+  let backupPath = await migrator.run()
+
+  console.error(SEP)
 
-    if (!stat.isFile()) return Promise.resolve();
+  message(
+    'Your original config file has been backed up at ' + backupPath + '. ' +
+    'If you are happy with how Vault is working, you should delete that file ' +
+    'as soon as possible.')
+}
 
-    message(
-      'It looks as though your config file (' + pathname + ') was created' +
-      ' with an old version of Vault. In order to continue, it needs to be' +
-      ' converted to a new format.');
+function message (text) {
+  console.error('\n' + formatMessage(text) + '\n')
+}
 
-    return confirm('Would you like Vault to perform this conversion now?').then(function() {
-      console.error('\n' + SEP);
-      return migrate(pathname, password);
+function formatMessage (text) {
+  if (!process.stderr.getWindowSize) return message
 
-    }).then(function(backupPath) {
-      console.error(SEP);
+  let width = process.stderr.getWindowSize()[0] - 4
+  let words = text.split(/\s+/)
+  let lines = ['']
 
-      message(
-        'Your original config file has been backed up at ' + backupPath +
-        '. If you are happy with how Vault is working, you should delete' +
-        ' that file as soon as possible.');
-    });
+  while (words.length > 0) {
+    let last = lines[lines.length - 1]
+    let word = words.shift()
+
+    if (last.length + word.length + 1 > width) {
+      lines.push('')
+    }
+
+    last = lines[lines.length - 1]
+    lines[lines.length - 1] = (last === '') ? word : last + ' ' + word
   }
-};
+
+  return lines.join('\n')
+}
+
+module.exports = { migrate }

lib/legacy/migrator.js

@@ -1,135 +1,94 @@
 'use strict';
 
-var assert       = require('assert'),
-    crypto       = require('crypto'),
-    EventEmitter = require('events').EventEmitter,
-    fs           = require('fs'),
-    util         = require('util'),
-    escodb       = require('../escodb');
-
-var READERS = [
-  require('./v03_reader'),
-  require('./v02_reader')
-];
-
-var random = function() {
-  return crypto.randomBytes(6).toString('hex');
-};
-
-var Migrator = function(filename, password) {
-  this._filename = filename;
-  this._password = password;
-};
-util.inherits(Migrator, EventEmitter);
-
-Migrator.prototype.run = function() {
-  var self = this;
-
-  return new Promise(function(resolve, reject) {
-    try {
-      resolve(self._migrate());
-    } catch (error) {
-      reject(error);
-    }
-  });
-};
-
-Migrator.prototype.log = function(message) {
-  this.emit('message', message);
-};
-
-Migrator.prototype._migrate = function() {
-  var self = this;
-
-  this._readInputFile();
-  this._decryptFile();
-
-  this._createStore().then(function() {
-    return this._copySettings();
-  }).then(function() {
-    return self._swapFiles();
-  }).then(function() {
-    self.log('done');
-    return self._backuppath;
-  });
-};
-
-Migrator.prototype._readInputFile = function() {
-  this.log('reading input file: ' + this._filename);
-
-  try {
-    this._content = fs.readFileSync(this._filename, 'utf8');
-  } catch (error) {
-    throw new Error('File is unreadable: ' + this._filename);
+const assert = require('assert')
+const fs = require('fs')
+
+const crypto = require('../crypto')
+const escodb = require('../escodb')
+const Reader = require('./reader')
+
+class Migrator {
+  constructor ({ logger, pathname, password }) {
+    this._logger = logger
+    this._filename = pathname
+    this._password = password
+  };
+
+  log (message) {
+    this._logger.info(message)
   }
 
-  this._buffer = Buffer.from(this._content, 'base64');
-};
+  async run () {
+    await this._readInputFile()
+    await this._decryptFile()
+    await this._createStore()
+    await this._copySettings()
+    await this._swapFiles()
+
+    this.log('done')
+    return this._backuppath
+  }
 
-Migrator.prototype._decryptFile = function() {
-  READERS.forEach(function(Reader) {
-    if (this._data) return;
+  _readInputFile () {
+    this.log('reading input file: ' + this._filename)
 
-    var reader = new Reader(this, this._buffer, this._password);
     try {
-      this._data = reader.run();
+      this._content = fs.readFileSync(this._filename, 'utf8')
     } catch (error) {
-      this.log(error.message);
+      throw new Error('file is unreadable: ' + this._filename)
     }
-  }, this);
-
-  if (!this._data)
-    throw new Error('Failed to decrypt the file');
-};
-
-Migrator.prototype._createStore = function() {
-  this._storepath = '/tmp/vault-convert-' + random();
-  this.log('creating new storage target: ' + this._storepath);
-
-  var adapter = escodb.createFileAdapter(this._storepath);
+  }
 
-  return escodb.createStore({adapter: adapter, password: this._password}).then(function(store) {
-    this._store = store;
-  });
-};
+  async _decryptFile () {
+    let config = { logger: this._logger, password: this._password }
+    this._data = await Reader.read(config, this._content)
 
-Migrator.prototype._copySettings = function() {
-  var copies = [['/global', this._data.global]];
+    if (!this._data) {
+      throw new Error('failed to decrypt the file')
+    }
+  }
 
-  for (var service in this._data.services)
-    copies.push(['/services/' + service, this._data.services[service]]);
+  async _createStore () {
+    this._storepath = '/tmp/vault-convert-' + random()
+    this.log('creating new storage target: ' + this._storepath)
 
-  var self = this;
+    let adapter = escodb.createFileAdapter(this._storepath)
+    this._store = await escodb.createStore({ adapter, password: this._password })
+  }
 
-  return copies.reduce(function(state, copy) {
-    var key   = copy[0],
-        value = copy[1];
+  async _copySettings () {
+    let copies = [['/global', this._data.global]];
 
-    if (value === undefined) return state;
+    for (let service in this._data.services) {
+      copies.push(['/services/' + service, this._data.services[service]])
+    }
 
-    return state.then(function() {
-      return self._store.update(key, function() { return value });
+    for (let [key, value] of copies) {
+      await this._store.update(key, () => value)
+      let stored = await this._store.get(key)
 
-    }).then(function() {
-      return self._store.get(key);
+      assert.deepEqual(value, stored,
+        'failed to write: [' + key + '] ' + JSON.stringify(value))
 
-    }).then(function(result) {
-      var message = 'Failed to write: [' + key + '] ' + JSON.stringify(value);
-      assert.deepEqual(result, value, message);
+      this.log('wrote setting: ' + key)
+    }
+  }
 
-      self.log('wrote setting: ' + key);
-    });
-  }, Promise.resolve());
-};
+  _swapFiles () {
+    this._backuppath = '/tmp/vault-backup-' + random()
 
-Migrator.prototype._swapFiles = function() {
-  this._backuppath = '/tmp/vault-backup-' + random();
+    this._rename(this._filename, this._backuppath)
+    this._rename(this._storepath, this._filename)
+  }
 
-  this.log('moving old file: ' + this._filename + ' -> ' + this._backuppath);
-  fs.renameSync(this._filename, this._backuppath);
+  _rename (a, b) {
+    this.log('moving file: ' + a + ' -> ' + b)
+    fs.renameSync(a, b)
+  }
+}
 
-  this.log('moving new file: ' + this._storepath + ' -> ' + this._filename);
-  fs.renameSync(this._storepath, this._filename);
-};
+function random () {
+  return crypto.randomBytes(6).toString('hex')
+}
 
-module.exports = Migrator;
+module.exports = Migrator