refactor: simplify envelope state handling

Author: mattrighetti

src/command/client.rs

@@ -57,32 +57,33 @@ pub enum EnvelopeCmd {
 
 impl EnvelopeCmd {
     pub async fn run(self) -> Result<()> {
-        let state = core::state::detect()?;
+        let state = core::state::detect().await?;
 
         match (self, state) {
             // init: only valid when uninitialized
             (Self::Init, None) => {
-                core::init().await?;
+                UnlockedEnvelope::init().await?;
                 Ok(())
             }
             (Self::Init, _) => bail!("envelope is already initialized"),
 
             // unlock: only valid when locked
-            (Self::Unlock, Some(EnvelopeState::Locked(env))) => {
+            (Self::Unlock, Some(EnvelopeState::Locked(lenvelope))) => {
                 let password = utils::prompt_password("Password: ")?;
-                env.unlock(&password)?;
+                let path = core::envelope_path()?;
+                lenvelope.unlock(&password).await?.store(&path).await?;
                 println!("database unlocked successfully");
                 Ok(())
             }
-            (Self::Unlock, Some(EnvelopeState::Unlocked)) => {
+            (Self::Unlock, Some(EnvelopeState::Unlocked(_))) => {
                 bail!("envelope is already unlocked")
             }
 
             // lock: only valid when unlocked
-            (Self::Lock, Some(EnvelopeState::Unlocked)) => {
+            (Self::Lock, Some(EnvelopeState::Unlocked(uenvelope))) => {
                 let password = utils::prompt_password_confirm()?;
-                let envelope = UnlockedEnvelope::open().await?;
-                envelope.lock(&password)?;
+                let path = core::envelope_path()?;
+                uenvelope.lock(&password).await?.store(&path)?;
                 println!("database locked successfully");
                 Ok(())
             }
@@ -91,20 +92,18 @@ impl EnvelopeCmd {
             }
 
             // all other commands: only valid when unlocked
-            (cmd, Some(EnvelopeState::Unlocked)) => {
-                let UnlockedEnvelope { db } = UnlockedEnvelope::open().await?;
-                cmd.run_with_db(&db).await
-            }
+            (cmd, Some(EnvelopeState::Unlocked(envelope))) => cmd.run_with_db(envelope.db()).await,
 
             // all other commands when locked: ask for password, decrypt to
-            // memory, run, re-encrypt if modified
+            // memory, run, re-encrypt if modified. The unlocked working copy
+            // stays in memory for the duration of the command.
             (cmd, Some(EnvelopeState::Locked(envelope))) => {
                 let password = utils::prompt_password("Password: ")?;
-                let plaintext = envelope.decrypt_bytes(&password)?;
-                let unlocked = UnlockedEnvelope::open_in_memory(&plaintext).await?;
-                cmd.run_with_db(&unlocked.db).await?;
-                if unlocked.db.total_changes().await? > 0 {
-                    unlocked.store_locked(&password).await?;
+                let unlocked = envelope.unlock(&password).await?;
+                cmd.run_with_db(unlocked.db()).await?;
+                if unlocked.db().total_changes().await? > 0 {
+                    let path = core::envelope_path()?;
+                    unlocked.lock(&password).await?.store(&path)?;
                 }
                 Ok(())
             }

src/core/mod.rs

@@ -1,13 +1,10 @@
 pub(crate) mod crypto;
-pub mod state;
+pub(crate) mod state;
 
 use std::env;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
-use anyhow::{Context, Result};
-
-use crate::core::state::UnlockedEnvelope;
-use crate::db::EnvelopeDb;
+use anyhow::Result;
 
 const ENVELOPE_FILENAME: &str = ".envelope";
 const ENVELOPE_FILENAME_TMP: &str = ".envelope.tmp";
@@ -17,29 +14,13 @@ pub(crate) fn envelope_path() -> Result<PathBuf> {
     Ok(env::current_dir()?.join(ENVELOPE_FILENAME))
 }
 
-/// Returns the path to the temporary .envelope file
-pub(crate) fn envelope_tmp_path() -> Result<PathBuf> {
-    Ok(env::current_dir()?.join(ENVELOPE_FILENAME_TMP))
-}
-
-/// Initializes a new envelope database.
-///
-/// Creates the .envelope SQLite database file and runs migrations.
-/// Consumes self and returns an UnlockedEnvelope on success.
-pub async fn init() -> Result<UnlockedEnvelope> {
+/// Returns the path to the .envelope file only if it exists
+pub(crate) fn envelope_path_exists() -> Result<Option<PathBuf>> {
     let path = envelope_path()?;
-    let db_path = path
-        .to_str()
-        .context("current directory path contains invalid characters")?;
-
-    let pool = sqlx::sqlite::SqlitePool::connect(&format!("sqlite://{db_path}?mode=rwc"))
-        .await
-        .context("failed to create .envelope database")?;
-
-    sqlx::migrate!("./migrations")
-        .run(&pool)
-        .await
-        .context("failed to initialize database schema")?;
+    Ok(path.exists().then_some(path))
+}
 
-    Ok(UnlockedEnvelope::with_db(EnvelopeDb::with(pool)))
+/// Returns the temporary path used while atomically replacing `path`.
+pub(crate) fn envelope_tmp_path_for(path: &Path) -> PathBuf {
+    path.with_file_name(ENVELOPE_FILENAME_TMP)
 }

src/core/state/locked.rs

@@ -1,18 +1,20 @@
 use std::fs;
+use std::path::Path;
 
 use anyhow::Result;
 use zeroize::Zeroizing;
 
 use crate::core::crypto::decrypt;
 use crate::core::crypto::header::EnvelopeFileHeader;
-use crate::core::{envelope_path, envelope_tmp_path};
+use crate::core::envelope_tmp_path_for;
+use crate::core::state::UnlockedEnvelope;
 
 /// Represents a locked (encrypted) envelope.
 ///
 /// Contains the encrypted ciphertext and header information needed for
 /// decryption.
 #[derive(Debug)]
-pub struct LockedEnvelope {
+pub(crate) struct LockedEnvelope {
     header: EnvelopeFileHeader,
     ciphertext: Vec<u8>,
 }
@@ -22,30 +24,47 @@ impl LockedEnvelope {
         Self { header, ciphertext }
     }
 
-    /// Decrypts the envelope to raw bytes. Returned in `Zeroizing` to not leak
-    /// data.
-    pub fn decrypt_bytes(&self, password: &str) -> Result<Zeroizing<Vec<u8>>> {
-        decrypt(&self.ciphertext, &self.header, password.as_bytes()).map(Zeroizing::new)
+    /// Persists the encrypted envelope to `path`.
+    ///
+    /// The target file is replaced atomically via a temporary file rename.
+    pub(crate) fn store(self, path: &Path) -> Result<()> {
+        let tmp_path = envelope_tmp_path_for(path);
+        let data = [
+            self.header.to_bytes().as_slice(),
+            self.ciphertext.as_slice(),
+        ]
+        .concat();
+
+        fs::write(&tmp_path, &data)?;
+        fs::rename(&tmp_path, path)?;
+        Ok(())
     }
 
     /// Decrypts the envelope database file.
     ///
     /// Reads the encrypted file, decrypts it with the provided password,
-    /// and writes the decrypted SQLite database back to disk using an
-    /// atomic write (temp file + rename).
+    /// and returns an [`UnlockedEnvelope`] loaded in memory.
+    ///
+    /// Decryption never restores a disk-backed unlocked value directly. The
+    /// plaintext is materialized into an in-memory SQLite database first, and
+    /// callers must explicitly persist it if they want a plain SQLite file on
+    /// disk again.
     ///
     /// Consumes self since the envelope is no longer locked after this
     /// operation.
-    pub fn unlock(self, password: &str) -> Result<()> {
-        let path = envelope_path()?;
+    pub(crate) async fn unlock(self, password: &str) -> Result<UnlockedEnvelope> {
         let plaintext =
             decrypt(&self.ciphertext, &self.header, password.as_bytes()).map(Zeroizing::new)?;
 
-        // Atomic write: write to temp file, then rename
-        let tmp_path = envelope_tmp_path()?;
-        fs::write(&tmp_path, &plaintext)?;
-        fs::rename(&tmp_path, &path)?;
+        UnlockedEnvelope::open_in_memory(plaintext.as_slice()).await
+    }
 
-        Ok(())
+    #[cfg(test)]
+    pub(crate) fn to_bytes(&self) -> Vec<u8> {
+        [
+            self.header.to_bytes().as_slice(),
+            self.ciphertext.as_slice(),
+        ]
+        .concat()
     }
 }