Muh dotfiles

.config/nvim/lua/gpg.lua

@@ -0,0 +1,124 @@
+--[[
+TODO:
+* make a plugin state table for each buffer
+* what TO DO if also editing the file externally? have a decrypt fn?
+* query for encryption parameters and be smart
+* support key decryption & encryption
+* write commands to manage parameters
+MAYBE:
+* be able to encrypt into binary? (bin decription works using file path and not buf contents)
+* make fancy windows? why tho
+AT LEAST TRY:
+* ediding encrypted tar files. (is tar plugin even in Lua yet?)
+]]
+
+local function set_gpg_encrypt(passphrase)
+    -- Encrypt text within buffer. On error use old cipher.
+    vim.b.gpg_encrypt = function()
+        local result = vim.system(
+            { "/usr/bin/gpg", "--batch", "--armor", "--symmetric", "--cipher-algo", "AES256", "--passphrase", passphrase },
+            { env = {}, clear_env = true, stdin = vim.api.nvim_buf_get_lines(0, 0, -1, true), text = true }
+        ):wait()
+
+        if result.code == 0 then
+            vim.b.backup_encrypted = vim.split(result.stdout, "\n", { trimempty = true })
+        else
+            vim.notify(result.stderr, vim.log.levels.ERROR)
+        end
+
+        vim.api.nvim_buf_set_lines(0, 0, -1, true, vim.b.backup_encrypted or {})
+    end
+end
+
+
+local gpg_group = vim.api.nvim_create_augroup("custom_gpg", { clear = true })
+
+vim.api.nvim_create_autocmd({ "BufNewFile", "BufReadPre", "FilterReadPre", "FileReadPre" }, {
+    pattern = { "*.gpg", "*.asc" },
+    group = gpg_group,
+    callback = function() -- turn off options that write to disk
+        vim.opt_local.shada = ""
+        vim.opt_local.swapfile = false
+        vim.opt_local.undofile = false
+    end,
+})
+
+vim.api.nvim_create_autocmd({ "BufReadPost", "FileReadPost" }, {
+    pattern = { "*.gpg", "*.asc" },
+    group = gpg_group,
+    callback = function()
+        -- if vim.b.gpg_abort then return end
+
+        -- autocmd can't cancel :w, so for error cases using this backup cipher
+        vim.b.backup_encrypted = vim.api.nvim_buf_get_lines(0, 0, -1, true)
+
+        while true do
+            local passphrase = vim.fn.inputsecret("Enter passphrase to decrypt or 'q' to not: ")
+            if passphrase == "q" then
+                vim.b.gpg_abort = true
+                break
+            end
+
+            local result = vim.system(
+                { "/usr/bin/gpg", "--batch", "--decrypt", "--passphrase",
+                    passphrase, vim.api.nvim_buf_get_name(0) },
+                { env = {}, clear_env = true, text = true }
+            ):wait()
+
+            if result.code == 0 then
+                vim.api.nvim_buf_set_lines(0, 0, -1, true, vim.split(result.stdout:gsub("\n$", ""), "\n"))
+                set_gpg_encrypt(passphrase)
+                break
+            end
+
+            vim.notify(result.stderr, vim.log.levels.ERROR)
+        end
+
+        -- Execute BufReadPost without .gpg in filename
+        vim.api.nvim_exec_autocmds("BufReadPost", { pattern = vim.fn.expand("%:r") })
+    end,
+})
+
+-- Encrypt all text in buffer before writing
+vim.api.nvim_create_autocmd({ "BufWritePre", "FileWritePre" }, {
+    pattern = { "*.gpg", "*.asc" },
+    group = gpg_group,
+    callback = function()
+        if vim.b.gpg_abort then
+            return
+        end
+
+        if vim.b.gpg_encrypt then
+            vim.b.gpg_encrypt()
+            return
+        end
+
+        vim.notify("Need passphrase to encrypt new file.", vim.log.levels.INFO)
+        while true do
+            local passphrase = vim.fn.inputsecret("Enter passphrase for encryption or 'q' to abort: ")
+            if passphrase == "q" then
+                vim.api.nvim_buf_set_lines(0, 0, -1, true, {}) -- can't stop writing operation
+                return
+            end
+
+            local passphrase2 = vim.fn.inputsecret("Repeat passphrase or 'q' to abort: ")
+            if passphrase2 == "q" then
+                vim.api.nvim_buf_set_lines(0, 0, -1, true, {}) -- can't stop writing operation
+                return
+            end
+
+            if passphrase == passphrase2 then
+                set_gpg_encrypt(passphrase)
+                vim.b.gpg_encrypt()
+                break
+            end
+            vim.notify("\nPassphrases do not match!", vim.log.levels.WARN)
+        end
+    end,
+})
+-- Undo the encryption in buffer after the file has been written
+vim.api.nvim_create_autocmd({ "BufWritePost", "FileWritePost" }, {
+    pattern = { "*.gpg", "*.asc" },
+    group = gpg_group,
+    command = ":silent u",
+})