fix: Fixes and refactors secrets command

Author: drorganvidez

rosemary/commands/detect_secrets.py

@@ -1,88 +1,167 @@
-import click
-import subprocess
-import os
 import json
+import os
+import subprocess
+import sys
+
+import click
+
+
+def resolve_base_path(specified_path):
+    base_path = specified_path or os.getenv("WORKING_DIR", "")
+    if os.path.exists(base_path):
+        return base_path
+
+    relative = os.path.join(".", base_path)
+    if os.path.exists(relative):
+        return relative
+
+    raise FileNotFoundError(f"Paths '{base_path}' and '{relative}' do not exist.")
+
+
+def build_detect_secrets_cmd(path, baseline_file, all_files, baseline):
+    cmd = [
+        "detect-secrets",
+        "-C",
+        path,
+        "scan",
+        "--exclude-files",
+        baseline_file,
+    ]
 
-# https://github.com/Yelp/detect-secrets
-@click.command('detect_secrets', help="Runs detect-secrets to check if there are any plaintext secret in the source code. By default it only checks tracked files.")
-@click.argument('specified_path', required=False)
-@click.option('--all_files', is_flag=True, help="Scans all files.")
-@click.option('--baseline', is_flag=True, help="Use baseline file")
-@click.option('--add_to_baseline', is_flag=True, help="Adds all detected secrets to baseline file to don't show them as secrets.")
-def detect_secrets(specified_path, all_files, baseline, add_to_baseline):
-    if specified_path:
-        base_path = specified_path
-    else:
-        base_path = os.path.join(os.getenv('WORKING_DIR', ''))
-    if not os.path.exists(base_path):
-        relative_base_path = './'+base_path
-        if not os.path.exists(relative_base_path):
-            click.echo(click.style(f"Paths '{base_path}' and '{relative_base_path}' does not exist.", fg='red'))
-            exit(1)
-        base_path = relative_base_path
-    
-    click.echo(f"Running detect-secrets for the path '{base_path}'")
-    test_path = base_path
-    baseline_file = os.path.join(test_path, '.secrets.baseline')
-    
-    detect_secrets_cmd = ['detect-secrets', '-C', test_path, 'scan', '--exclude-files', baseline_file]
     if all_files:
-        detect_secrets_cmd.extend(['--all-files'])
-        
+        cmd.append("--all-files")
+
     if baseline:
-        if os.path.exists(baseline_file):
-            detect_secrets_cmd.extend(['--baseline',baseline_file])
-        else:
-            click.echo(click.style(f"Baseline file '{baseline_file}' does not exists. You should run --add_to_baseline first", fg='red'))
-            exit(1)
+        cmd.extend(["--baseline", baseline_file])
+
+    return cmd
+
+
+def run_scan(cmd, write_to=None):
+    if write_to:
+        with open(write_to, "w") as file:
+            subprocess.run(cmd, stdout=file, check=True)
+        return None
+
+    result = subprocess.run(
+        cmd,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return result.stdout
+
+
+def parse_results(raw_output):
+    data = json.loads(raw_output)
+    return data.get("results", {})
+
+
+def render_results(secrets, baseline_file, show_hash):
+    if not secrets:
+        click.echo(click.style("No secrets found!", fg="green"))
+        sys.exit(0)
+
+    contains_real = False
+
+    for file, entries in secrets.items():
+        for entry in entries:
+            if not entry.get("is_secret", True):
+                continue
+
+            contains_real = True
+            line = entry["line_number"]
+
+            click.echo(
+                click.style(
+                    f"{file}:{line}",
+                    fg="yellow",
+                )
+            )
+
+            if show_hash:
+                click.echo(
+                    click.style(
+                        f"  Hashed: {entry['hashed_secret']}",
+                        fg="red",
+                    )
+                )
+
+    if contains_real:
+        click.echo(
+            click.style(
+                "Secrets detected.",
+                fg="red",
+            )
+        )
+        click.echo(
+            click.style(
+                f"Run 'detect-secrets audit {baseline_file}' " "to review false positives.",
+                fg="cyan",
+            )
+        )
+        sys.exit(1)
+
+    click.echo(
+        click.style(
+            "All secrets are managed in baseline.",
+            fg="green",
+        )
+    )
+    sys.exit(0)
+
+
+@click.command("detect_secrets")
+@click.argument("specified_path", required=False)
+@click.option("--all-files", is_flag=True)
+@click.option("--baseline", is_flag=True)
+@click.option("--add-to-baseline", is_flag=True)
+@click.option(
+    "--show-hash",
+    is_flag=True,
+    help="Display hashed secrets in output.",
+)
+def detect_secrets(
+    specified_path,
+    all_files,
+    baseline,
+    add_to_baseline,
+    show_hash,
+):
+    try:
+        base_path = resolve_base_path(specified_path)
+    except FileNotFoundError as e:
+        click.echo(click.style(str(e), fg="red"))
+        sys.exit(1)
+
+    baseline_file = os.path.join(base_path, ".secrets.baseline")
+
+    cmd = build_detect_secrets_cmd(
+        base_path,
+        baseline_file,
+        all_files,
+        baseline,
+    )
+
     try:
         if add_to_baseline:
-            file = open(baseline_file,"w")
-            subprocess.run(detect_secrets_cmd, stdout=file)
-            file.close()
-            click.echo(click.style(f"Done! You may now run 'rosemary detect_secrets --all_files --baseline' to inspect secrets. Baseline is updated automatically" , fg='green')) 
-            click.echo(click.style(f"You shouldn't need to run this command again" , fg='red')) 
-            click.echo(click.style(f"You can also just delete the secrets leaked or run 'detect-secrets audit {baseline_file}' to discard false positives", fg='green'))
-            return
-        
-        if baseline:
-            subprocess.run(detect_secrets_cmd)
-            file = open(baseline_file,"r")
-            output = file.read()
-            
-            file.close()
-        else:
-            output = subprocess.run(detect_secrets_cmd, capture_output=True, check=True, text=True).stdout
-        
-        output = json.loads(output)
-        secrets = output["results"]
-        if secrets == {}:
-            click.echo(click.style("No secrets found!", fg='green'))
-            exit(0)
-        else:
-            
-            contains_secrets = False
-            for file in secrets:
-                line = secrets[file][0]["line_number"]
-                secret = secrets[file][0]["hashed_secret"]
-                
-                is_secret = True
-                if "is_secret" in secrets[file][0]:
-                    is_secret = secrets[file][0]["is_secret"]
-                    
-                if is_secret:
-                    contains_secrets = True
-                    click.echo(click.style(f"File {file} in line {line}", fg='yellow'))
-                    click.echo(click.style(f"\tHashed secret(not displayed for security) {secret}", fg='red'))
-            if contains_secrets:
-                click.echo(click.style("########## Secrets found! ##########", fg='red'))
-                if baseline:
-                    click.echo(click.style(f"You may now run 'detect-secrets audit {baseline_file}' to discard false positives", fg='green'))
-                    click.echo(click.style(f"If the secrets listed are not false positives you can remove them by editing the listed lines and rerunning this command", fg='red'))
-                exit(1)
-            else:
-                click.echo(click.style("########## All secrets are managed ##########", fg='green'))
-                exit(0)
-            
+            run_scan(cmd, write_to=baseline_file)
+            click.echo(click.style("Baseline updated.", fg="green"))
+            sys.exit(0)
+
+        raw_output = run_scan(cmd)
+        secrets = parse_results(raw_output)
+        render_results(
+            secrets,
+            baseline_file,
+            show_hash,
+        )
+
     except subprocess.CalledProcessError as e:
-        click.echo(click.style(f"Error running detect_secrets: {e}", fg='red'))
+        click.echo(
+            click.style(
+                f"Error running detect-secrets: {e}",
+                fg="red",
+            )
+        )
+        sys.exit(1)