Avoid reading EJSON file twice during decrypt operations

Previously, Decrypt() and EnvAction() would read the file once to extract
the _private_key_enc field, then the ejson library would read it again
for decryption.

Now we read the file once into memory, extract the private key, and pass
a bytes.Reader to ejson.Decrypt(). This also replaces deprecated
ioutil.ReadAll with os.ReadFile.

Changes:
- Add extractPrivateKeyEnc() that works with []byte instead of file path
- Update Decrypt() to read file once and use ejson.Decrypt() with Reader
- Update EnvAction() to read file once and use ejson2env.ExtractEnv()
- Refactor findPrivateKeyEnc() to use extractPrivateKeyEnc() internally

Author: runlevel5

actions.go

@@ -1,6 +1,7 @@
 package ejsonkms
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -93,7 +94,14 @@ func EnvAction(ejsonFilePath, awsRegion string, quiet bool) error {
 	if quiet {
 		exportFunc = ejson2env.ExportQuiet
 	}
-	privateKeyEnc, err := findPrivateKeyEnc(ejsonFilePath)
+
+	// Read file once
+	data, err := os.ReadFile(ejsonFilePath)
+	if err != nil {
+		return err
+	}
+
+	privateKeyEnc, err := extractPrivateKeyEnc(data)
 	if err != nil {
 		return err
 	}
@@ -103,9 +111,20 @@ func EnvAction(ejsonFilePath, awsRegion string, quiet bool) error {
 		return err
 	}
 
-	envValues, err := ejson2env.ReadAndExtractEnv(ejsonFilePath, "", kmsDecryptedPrivateKey)
+	// Decrypt using the already-read data
+	var decrypted bytes.Buffer
+	if err := ejson.Decrypt(bytes.NewReader(data), &decrypted, "", kmsDecryptedPrivateKey); err != nil {
+		return err
+	}
+
+	// Parse decrypted JSON and extract env values
+	var secrets map[string]interface{}
+	if err := json.Unmarshal(decrypted.Bytes(), &secrets); err != nil {
+		return fmt.Errorf("could not parse decrypted JSON: %s", err)
+	}
 
-	if nil != err && !ejson2env.IsEnvError(err) {
+	envValues, err := ejson2env.ExtractEnv(secrets)
+	if err != nil && !ejson2env.IsEnvError(err) {
 		return fmt.Errorf("could not load environment from file: %s", err)
 	}
 

ejsonkms.go

@@ -1,9 +1,9 @@
 package ejsonkms
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
-	"io/ioutil"
 	"os"
 
 	"github.com/Shopify/ejson"
@@ -40,42 +40,33 @@ func Keygen(kmsKeyID, awsRegion string) (EjsonKmsKeys, error) {
 
 // Decrypt decrypts an EJSON file
 func Decrypt(ejsonFilePath, awsRegion string) ([]byte, error) {
-	privateKeyEnc, err := findPrivateKeyEnc(ejsonFilePath)
+	data, err := os.ReadFile(ejsonFilePath)
 	if err != nil {
 		return nil, err
 	}
 
-	kmsDecryptedPrivateKey, err := decryptPrivateKeyWithKMS(privateKeyEnc, awsRegion)
+	privateKeyEnc, err := extractPrivateKeyEnc(data)
 	if err != nil {
 		return nil, err
 	}
 
-	decrypted, err := ejson.DecryptFile(ejsonFilePath, "", kmsDecryptedPrivateKey)
+	kmsDecryptedPrivateKey, err := decryptPrivateKeyWithKMS(privateKeyEnc, awsRegion)
 	if err != nil {
 		return nil, err
 	}
 
-	return decrypted, nil
-}
-
-func findPrivateKeyEnc(ejsonFilePath string) (key string, err error) {
-	var (
-		ejsonKmsKeys EjsonKmsKeys
-	)
-
-	file, err := os.Open(ejsonFilePath)
-	if err != nil {
-		return "", err
+	var output bytes.Buffer
+	if err := ejson.Decrypt(bytes.NewReader(data), &output, "", kmsDecryptedPrivateKey); err != nil {
+		return nil, err
 	}
-	defer file.Close()
 
-	data, err := ioutil.ReadAll(file)
-	if err != nil {
-		return "", err
-	}
+	return output.Bytes(), nil
+}
 
-	err = json.Unmarshal(data, &ejsonKmsKeys)
-	if err != nil {
+func extractPrivateKeyEnc(data []byte) (string, error) {
+	var ejsonKmsKeys EjsonKmsKeys
+
+	if err := json.Unmarshal(data, &ejsonKmsKeys); err != nil {
 		return "", err
 	}
 
@@ -85,3 +76,12 @@ func findPrivateKeyEnc(ejsonFilePath string) (key string, err error) {
 
 	return ejsonKmsKeys.PrivateKeyEnc, nil
 }
+
+// findPrivateKeyEnc reads a file and extracts the private key
+func findPrivateKeyEnc(ejsonFilePath string) (string, error) {
+	data, err := os.ReadFile(ejsonFilePath)
+	if err != nil {
+		return "", err
+	}
+	return extractPrivateKeyEnc(data)
+}