Plan: Layered Config + Encrypted Secrets Migration (ADR-012 + ADR-017)

pub fn run(tool: &str, args: &[&str], opts: RunOpts) -> Result<Output>;
pub fn run_interactive(tool: &str, args: &[&str], opts: RunOpts) -> Result<()>;

pub struct RunOpts { pub age_key: AgeKeyMode, pub interactive: bool }
pub enum AgeKeyMode { None, ReadOnly, ReadWrite }

// SPDX-License-Identifier: AGPL-3.0-or-later

#[derive(clap::Args)]
pub struct Args {
    #[command(subcommand)]
    pub action: Action,
}

#[derive(clap::Subcommand)]
pub enum Action {
    /// Generate dev age keypair (if missing) and print the public key.
    /// Pass `--for-ci` to instead emit a transient keypair for the
    /// GitLab `CANOPY_CI_AGE_KEY` masked variable.
    Init { #[arg(long = "for-ci")] for_ci: bool },
    /// Open `secrets/dev.yaml` in `$EDITOR` via sops (decrypts on read,
    /// re-encrypts on save).
    Edit,
    /// Print decrypted secrets/dev.yaml as a flat dotenv stream.
    Decrypt,
    /// Append a new age recipient to `.sops.yaml` and re-encrypt the data key.
    AddRecipient { age_key: String },
    /// Print a fresh ECDSA P-256 PEM (paste into `secrets edit`).
    GenerateSigningKey,
}

creation_rules:
  - path_regex: ^secrets/dev\.yaml$
    age: >-
      <DEVELOPER-AGE-PUBLIC-KEY>,
      <CI-RUNNER-AGE-PUBLIC-KEY>

canopy-devtools:
  profiles: [devtools]
  build:
    context: ./tools/canopy-devtools
  image: canopy-devtools:latest
  volumes:
    - .:/work

secrets-yaml-lint:
  image: alpine:3.21
  stage: test
  script:
    - |
      set -euo pipefail
      VIOLATIONS=0
      if [ -d config ]; then
        for f in $(find config -name '*.yaml' 2>/dev/null); do
          if grep -inE '(password|secret|signing_key|private_key|_token|api_key)\s*:\s*[A-Za-z0-9/+]{16,}' "$f" | grep -v '# allow-secret:'; then
            echo "VIOLATION: plaintext secret-shaped value in $f"
            VIOLATIONS=$((VIOLATIONS + 1))
          fi
          if grep -in 'BEGIN .*PRIVATE KEY' "$f" | grep -v '# allow-secret:'; then
            echo "VIOLATION: PEM private key embedded in $f"
            VIOLATIONS=$((VIOLATIONS + 1))
          fi
        done
      fi
      if [ "$VIOLATIONS" -gt 0 ]; then
        echo "ERROR: $VIOLATIONS plaintext-secret violation(s)"
        exit 1
      fi
      echo "OK: no plaintext secrets in config/"
  rules:
    - if: $CI_COMMIT_BRANCH
    - if: $CI_MERGE_REQUEST_IID

// BEFORE:
pub fn load(prefix: &str) -> Result<Self, config::ConfigError> {
    Config::builder()
        .add_source(Environment::with_prefix(prefix).separator("__").try_parsing(true))
        .build()?
        .try_deserialize()
}

pub fn load(prefix: &str) -> Result<Self, config::ConfigError> {
    load_typed::<Self>(prefix, None)
}

/// Generic typed loader. See module docs for layering rules.
pub fn load_typed<T: serde::de::DeserializeOwned>(
    prefix: &str,
    config_root: Option<&Path>,
) -> Result<T, config::ConfigError> {
    let env_name = std::env::var("CANOPY_ENV").unwrap_or_else(|_| "dev".to_string());
    load_typed_internal::<T>(prefix, config_root, &env_name, None)
}

#[doc(hidden)]
pub fn load_typed_internal<T: serde::de::DeserializeOwned>(
    prefix: &str,
    config_root: Option<&Path>,
    env_name: &str,
    env_override: Option<config::Map<String, String>>,
) -> Result<T, config::ConfigError> {
    let service = prefix.to_lowercase().replace('_', "-");
    let root: PathBuf = config_root
        .map(Path::to_path_buf)
        .or_else(|| std::env::var_os("CANOPY_CONFIG_ROOT").map(PathBuf::from))
        .unwrap_or_else(|| PathBuf::from("."));
    let default_path = root.join(&service).join("default");
    let env_path = root.join(&service).join(env_name);
    let env_source = Environment::with_prefix(prefix)
        .separator("__")
        .try_parsing(true)
        .source(env_override);
    let builder = Config::builder()
        .add_source(File::with_name(default_path.to_str().unwrap()).required(false))
        .add_source(File::with_name(env_path.to_str().unwrap()).required(false))
        .add_source(env_source);
    let config = builder.build()?;
    // DEBUG attribution per ADR-012 §Negative.
    if tracing::enabled!(tracing::Level::DEBUG)
        && let Ok(map) = config.clone().try_deserialize::<serde_json::Value>()
    {
        tracing::debug!(prefix = %prefix, service = %service, env = %env_name,
                        config = %map, "config loaded");
    }
    config.try_deserialize()
}

jurisdiction: georgia
rulesets_dir: rulesets
rules:
  url: http://canopy-rules:8001
verification:
  url: http://canopy-verification:8005

// SPDX-License-Identifier: AGPL-3.0-or-later

//! Service-specific config schema for canopy-snap (ADR-012).

use std::path::PathBuf;
use serde::Deserialize;

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SnapConfig {
    pub jurisdiction: String,
    pub rulesets_dir: PathBuf,
    pub rules: RulesClientConfig,
    pub verification: VerificationClientConfig,
}

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct RulesClientConfig {
    pub url: String,
}

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct VerificationClientConfig {
    pub url: String,
}

// BEFORE:
let jurisdiction = std::env::var("CANOPY_SNAP__JURISDICTION").expect("CANOPY_SNAP__JURISDICTION is required");
let rulesets_dir = std::env::var("CANOPY_RULESETS_DIR").unwrap_or_else(|_| "rulesets".into());
let rules_url = std::env::var("CANOPY_SNAP__RULES_URL").unwrap_or_else(|_| "http://localhost:8001".into());
let verification_url = std::env::var("CANOPY_SNAP__VERIFICATION_URL").unwrap_or_else(|_| "http://localhost:8005".into());
let internal_api_key = std::env::var("CANOPY_INTERNAL_API_KEY").unwrap_or_else(|_| "canopy-internal-dev-key".into());
let signing_key_pem = std::env::var("CANOPY_SNAP__SIGNING_KEY").unwrap_or_default();

// AFTER:
use canopy_snap::config::SnapConfig;
use canopy_secrets::{EnvSecretProvider, SecretProvider};

let snap_config: SnapConfig =
    canopy_common::settings::ServiceSettings::load_typed("CANOPY_SNAP", None)
        .expect("load canopy-snap config");

let secrets: EnvSecretProvider = EnvSecretProvider::new("canopy-snap");
let internal_api_key = secrets.get_optional("CANOPY_INTERNAL_API_KEY")
    .expect("read CANOPY_INTERNAL_API_KEY")
    .unwrap_or_else(|| "canopy-internal-dev-key".into());
let signing_key_pem = secrets.get_optional("CANOPY_SNAP__SIGNING_KEY")
    .expect("read CANOPY_SNAP__SIGNING_KEY")
    .unwrap_or_default();

canopy-snap:
  signing_key: |
    -----BEGIN PRIVATE KEY-----
    <generated PEM>
    -----END PRIVATE KEY-----
  internal_api_key: canopy-internal-dev-key-NOT-REAL

// Near the top of dev_start, after preflight checks:
let env_file = tempfile::Builder::new()
    .prefix("canopy-dev-")
    .suffix(".env")
    .tempfile()
    .context("create tempfile for sops dotenv")?;
let decrypted = ProcessCommand::new("sops")
    .args(["--decrypt", "secrets/dev.yaml"])
    .output()
    .context("invoke sops --decrypt secrets/dev.yaml")?;
if !decrypted.status.success() {
    let stderr = String::from_utf8_lossy(&decrypted.stderr);
    bail!("sops decrypt failed: {stderr}");
}
let yaml: serde_yaml::Value = serde_yaml::from_slice(&decrypted.stdout)?;
let mut dotenv = crate::cmd::secrets::walk_to_dotenv(&yaml)?;
dotenv.push_str("CANOPY_CONFIG_ROOT=/app/config\n");
std::fs::write(env_file.path(), dotenv)?;
// Pass --env-file=<env_file.path()> to the docker compose invocation.
// `env_file` is dropped at end of dev_start, which removes the tempfile.