latest

internal/secret/crypto.go

@@ -11,8 +11,8 @@ import (
 	"golang.org/x/term"
 )
 
-// encryptToRecipient encrypts data to a recipient using age
-func encryptToRecipient(data []byte, recipient age.Recipient) ([]byte, error) {
+// EncryptToRecipient encrypts data to a recipient using age
+func EncryptToRecipient(data []byte, recipient age.Recipient) ([]byte, error) {
 	Debug("encryptToRecipient starting", "data_length", len(data))
 
 	var buf bytes.Buffer
@@ -43,6 +43,11 @@ func encryptToRecipient(data []byte, recipient age.Recipient) ([]byte, error) {
 	return result, nil
 }
 
+// encryptToRecipient encrypts data to a recipient using age (internal version)
+func encryptToRecipient(data []byte, recipient age.Recipient) ([]byte, error) {
+	return EncryptToRecipient(data, recipient)
+}
+
 // decryptWithIdentity decrypts data with an identity using age
 func decryptWithIdentity(data []byte, identity age.Identity) ([]byte, error) {
 	r, err := age.Decrypt(bytes.NewReader(data), identity)
@@ -81,18 +86,18 @@ func decryptWithPassphrase(encryptedData []byte, passphrase string) ([]byte, err
 // readPassphrase reads a passphrase securely from the terminal without echoing
 // This version is for unlocking and doesn't require confirmation
 func readPassphrase(prompt string) (string, error) {
-	// Check if stderr is a terminal - if not, we can't prompt interactively
-	if !term.IsTerminal(int(syscall.Stderr)) {
-		return "", fmt.Errorf("cannot prompt for passphrase: stderr is not a terminal (running in non-interactive mode)")
-	}
-
 	// Check if stdin is a terminal
 	if !term.IsTerminal(int(syscall.Stdin)) {
-		// Not a terminal - use shared line reader to avoid buffering conflicts
-		return readLineFromStdin(prompt)
+		// Not a terminal - never read passphrases from piped input for security reasons
+		return "", fmt.Errorf("cannot read passphrase from non-terminal stdin (piped input or script). Please set the SB_UNLOCK_PASSPHRASE environment variable or run interactively")
 	}
 
-	// Terminal input - use secure password reading
+	// stdin is a terminal, check if stderr is also a terminal for interactive prompting
+	if !term.IsTerminal(int(syscall.Stderr)) {
+		return "", fmt.Errorf("cannot prompt for passphrase: stderr is not a terminal (running in non-interactive mode). Please set the SB_UNLOCK_PASSPHRASE environment variable")
+	}
+
+	// Both stdin and stderr are terminals - use secure password reading
 	fmt.Fprint(os.Stderr, prompt) // Write prompt to stderr, not stdout
 	passphrase, err := term.ReadPassword(int(syscall.Stdin))
 	if err != nil {