@koishijs/loader - npm Package Compare versions

Comparing version 3.0.1 to 3.0.2

lib/index.d.ts

@@ -6,2 +6,3 @@ import { Loader } from './shared';
     scope: ns.Scope;
+    localKeys: string[];
     init(filename?: string): Promise<void>;
@@ -8,0 +9,0 @@ readConfig(): Promise<import("@satorijs/core").Context.Config>;

lib/index.js

@@ -39,2 +39,3 @@ var __create = Object.create;
 var import_shared = require("./shared");
+var import_fs = require("fs");
 var dotenv = __toESM(require("dotenv"));
@@ -47,3 +48,8 @@ var import_ns_require = __toESM(require("ns-require"));
 }
+var initialKeys = Object.getOwnPropertyNames(process.env);
 var NodeLoader = class extends import_shared.Loader {
+  constructor() {
+    super(...arguments);
+    this.localKeys = [];
+  }
   async init(filename) {
@@ -59,3 +65,20 @@ await super.init(filename);
   async readConfig() {
-    dotenv.config({ path: this.envfile });
+    for (const key of this.localKeys) {
+      delete process.env[key];
+    }
+    const parsed = {};
+    for (const filename of this.envFiles) {
+      try {
+        const raw = await import_fs.promises.readFile(filename, "utf8");
+        Object.assign(parsed, dotenv.parse(raw));
+      } catch {
+      }
+    }
+    this.localKeys = [];
+    for (const key in parsed) {
+      if (initialKeys.includes(key))
+        continue;
+      process.env[key] = parsed[key];
+      this.localKeys.push(key);
+    }
     return await super.readConfig();
@@ -62,0 +85,0 @@ }

lib/shared.d.ts

@@ -40,5 +40,6 @@ import { Context, Dict } from '@koishijs/core';
     suspend: boolean;
+    writable: boolean;
+    mime: string;
     filename: string;
-    writable: string;
-    envfile: string;
+    envFiles: string[];
     cache: Dict<string>;
@@ -45,0 +46,0 @@ abstract resolve(name: string): Promise<string>;

lib/shared.js

@@ -104,2 +104,3 @@ var __create = Object.create;
     this.suspend = false;
+    this.writable = false;
     this.cache = /* @__PURE__ */ Object.create(null);
@@ -115,3 +116,3 @@ }
         const extname = import_path.default.extname(filename);
-        this.writable = writable[extname];
+        this.mime = writable[extname];
         if (!_Loader.extensions.has(extname)) {
@@ -127,10 +128,13 @@ throw new Error(`extension "${extname}" not supported`);
     }
-    if (this.writable) {
+    if (this.mime) {
       try {
         await import_fs.promises.access(this.filename, import_fs.constants.W_OK);
+        this.writable = true;
       } catch {
-        this.writable = null;
       }
     }
-    this.envfile = import_path.default.resolve(this.baseDir, ".env");
+    this.envFiles = [
+      import_path.default.resolve(this.baseDir, ".env"),
+      import_path.default.resolve(this.baseDir, ".env.local")
+    ];
   }
@@ -142,3 +146,3 @@ async findConfig() {
         if (files.includes(basename + extname)) {
-          this.writable = writable[extname];
+          this.mime = writable[extname];
           this.filename = import_path.default.resolve(this.baseDir, basename + extname);
@@ -152,5 +156,5 @@ return;
   async readConfig() {
-    if (this.writable === "application/yaml") {
+    if (this.mime === "application/yaml") {
       this.config = yaml.load(await import_fs.promises.readFile(this.filename, "utf8"));
-    } else if (this.writable === "application/json") {
+    } else if (this.mime === "application/json") {
       this.config = JSON.parse(await import_fs.promises.readFile(this.filename, "utf8"));
@@ -164,11 +168,12 @@ } else {
   async writeConfig() {
-    this.app.emit("config");
     this.suspend = true;
-    if (this.writable === "application/yaml") {
+    if (!this.writable) {
+      throw new Error(`cannot overwrite readonly config`);
+    }
+    if (this.mime === "application/yaml") {
       await import_fs.promises.writeFile(this.filename, yaml.dump(this.config));
-    } else if (this.writable === "application/json") {
+    } else if (this.mime === "application/json") {
       await import_fs.promises.writeFile(this.filename, JSON.stringify(this.config, null, 2));
-    } else {
-      throw new Error(`cannot overwrite readonly config`);
     }
+    this.app.emit("config");
   }
@@ -175,0 +180,0 @@ interpolate(source) {

package.json

 {
   "name": "@koishijs/loader",
   "description": "Config Loader for Koishi",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "main": "lib/index.js",
@@ -41,6 +41,6 @@ "module": "lib/shared.mjs",
   "peerDependencies": {
-    "@koishijs/core": "4.11.7"
+    "@koishijs/core": "4.11.8"
   },
   "devDependencies": {
-    "@koishijs/core": "4.11.7",
+    "@koishijs/core": "4.11.8",
     "@types/js-yaml": "^4.0.5"
@@ -47,0 +47,0 @@ },

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

60827

increased by3.83%

Lines of code

753

increased by4.87%

Worsened metrics

Number of low supply chain risk alerts

15

increased by36.36%

No dependency changes