Remove duplicated wrapper crypto functions and use exported implementations directly

internal/cli/init.go

@@ -6,7 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
 	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
@@ -15,7 +14,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/tyler-smith/go-bip39"
-	"golang.org/x/term"
 )
 
 func newInitCmd() *cobra.Command {
@@ -173,45 +171,24 @@ func (cli *CLIInstance) Init(cmd *cobra.Command) error {
 }
 
 // readSecurePassphrase reads a passphrase securely from the terminal without echoing
-// and prompts for confirmation. Falls back to regular input when not on a terminal.
+// This version adds confirmation (read twice) for creating new unlock keys
 func readSecurePassphrase(prompt string) (string, error) {
-	// Check if stdin is a terminal
-	if !term.IsTerminal(int(syscall.Stdin)) {
-		// Not a terminal - never read passphrases from piped input for security reasons
-		return "", fmt.Errorf("cannot read passphrase from non-terminal stdin (piped input or script). Please set the SB_UNLOCK_PASSPHRASE environment variable or run interactively")
-	}
-
-	// Check if stderr is a terminal - if not, we can't prompt interactively
-	if !term.IsTerminal(int(syscall.Stderr)) {
-		return "", fmt.Errorf("cannot prompt for passphrase: stderr is not a terminal (running in non-interactive mode). Please set the SB_UNLOCK_PASSPHRASE environment variable")
-	}
-
-	// Terminal input - use secure password reading with confirmation
-	fmt.Fprint(os.Stderr, prompt) // Write prompt to stderr, not stdout
-
-	// Read first passphrase
-	passphrase1, err := term.ReadPassword(int(syscall.Stdin))
+	// Get the first passphrase
+	passphrase1, err := secret.ReadPassphrase(prompt)
 	if err != nil {
-		return "", fmt.Errorf("failed to read passphrase: %w", err)
+		return "", err
 	}
-	fmt.Fprintln(os.Stderr) // Print newline to stderr since ReadPassword doesn't echo
 
 	// Read confirmation passphrase
-	fmt.Fprint(os.Stderr, "Confirm passphrase: ") // Write prompt to stderr, not stdout
-	passphrase2, err := term.ReadPassword(int(syscall.Stdin))
+	passphrase2, err := secret.ReadPassphrase("Confirm passphrase: ")
 	if err != nil {
 		return "", fmt.Errorf("failed to read passphrase confirmation: %w", err)
 	}
-	fmt.Fprintln(os.Stderr) // Print newline to stderr since ReadPassword doesn't echo
 
 	// Compare passphrases
-	if string(passphrase1) != string(passphrase2) {
+	if passphrase1 != passphrase2 {
 		return "", fmt.Errorf("passphrases do not match")
 	}
 
-	if len(passphrase1) == 0 {
-		return "", fmt.Errorf("passphrase cannot be empty")
-	}
-
-	return string(passphrase1), nil
+	return passphrase1, nil
 }