905 lines
30 KiB
Rust
905 lines
30 KiB
Rust
use anyhow::{Context, anyhow, bail};
|
|
use secrecy::{ExposeSecret, SecretString};
|
|
use std::collections::HashMap;
|
|
use std::path::{Path, PathBuf};
|
|
use std::{env, fs};
|
|
use zeroize::Zeroize;
|
|
|
|
use crate::config::{Config, get_config_file_path, load_config};
|
|
use crate::providers::git_sync::{
|
|
SyncOpts, default_git_email, default_git_username, ensure_git_available, repo_name_from_url,
|
|
resolve_git, sync_and_push,
|
|
};
|
|
use crate::providers::{SecretProvider, SupportedProvider};
|
|
use crate::{
|
|
ARGON_M_COST_KIB, ARGON_P, ARGON_T_COST, HEADER, KDF, KEY_LEN, NONCE_LEN, SALT_LEN, VERSION,
|
|
calling_app_name,
|
|
};
|
|
use anyhow::Result;
|
|
use argon2::{Algorithm, Argon2, Params, Version};
|
|
use base64::{Engine as _, engine::general_purpose::STANDARD as B64};
|
|
use chacha20poly1305::aead::rand_core::RngCore;
|
|
use chacha20poly1305::{
|
|
Key, XChaCha20Poly1305, XNonce,
|
|
aead::{Aead, KeyInit, OsRng},
|
|
};
|
|
use dialoguer::{Input, theme};
|
|
use log::{debug, error};
|
|
use serde::{Deserialize, Serialize};
|
|
use serde_with::skip_serializing_none;
|
|
use theme::ColorfulTheme;
|
|
use validator::Validate;
|
|
|
|
#[skip_serializing_none]
|
|
/// File-based vault provider with optional Git sync.
|
|
///
|
|
/// This provider stores encrypted envelopes in a per-user configuration
|
|
/// directory via `confy`. A password is obtained from a configured password
|
|
/// file or via an interactive prompt.
|
|
///
|
|
/// Example
|
|
/// ```no_run
|
|
/// use gman::providers::local::LocalProvider;
|
|
/// use gman::providers::{SecretProvider, SupportedProvider};
|
|
/// use gman::config::Config;
|
|
///
|
|
/// let provider = LocalProvider::default();
|
|
/// // Will prompt for a password when reading/writing secrets unless a
|
|
/// // password file is configured.
|
|
/// let _ = provider.set_secret("MY_SECRET", "value");
|
|
/// ```
|
|
#[derive(Debug, Clone, Validate, Serialize, Deserialize, PartialEq, Eq)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct LocalProvider {
|
|
pub password_file: Option<PathBuf>,
|
|
pub git_branch: Option<String>,
|
|
pub git_remote_url: Option<String>,
|
|
pub git_user_name: Option<String>,
|
|
#[validate(email)]
|
|
pub git_user_email: Option<String>,
|
|
pub git_executable: Option<PathBuf>,
|
|
#[serde(skip)]
|
|
pub runtime_provider_name: Option<String>,
|
|
}
|
|
|
|
impl Default for LocalProvider {
|
|
fn default() -> Self {
|
|
let password_file = match Config::local_provider_password_file() {
|
|
p if p.exists() => Some(p),
|
|
_ => None,
|
|
};
|
|
|
|
Self {
|
|
password_file,
|
|
git_branch: Some("main".into()),
|
|
git_remote_url: None,
|
|
git_user_name: None,
|
|
git_user_email: None,
|
|
git_executable: None,
|
|
runtime_provider_name: None,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[async_trait::async_trait]
|
|
impl SecretProvider for LocalProvider {
|
|
fn name(&self) -> &'static str {
|
|
"LocalProvider"
|
|
}
|
|
|
|
async fn get_secret(&self, key: &str) -> Result<String> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
let envelope = vault
|
|
.get(key)
|
|
.with_context(|| format!("key '{key}' not found in the vault"))?;
|
|
|
|
let password = self.get_password()?;
|
|
let plaintext = decrypt_string(&password, envelope)?;
|
|
drop(password);
|
|
|
|
Ok(plaintext)
|
|
}
|
|
|
|
async fn set_secret(&self, key: &str, value: &str) -> Result<()> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let mut vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
if vault.contains_key(key) {
|
|
error!(
|
|
"Key '{key}' already exists in the vault. Use a different key or delete the existing one first."
|
|
);
|
|
bail!("key '{key}' already exists");
|
|
}
|
|
|
|
let password = self.get_password()?;
|
|
let envelope = encrypt_string(&password, value)?;
|
|
drop(password);
|
|
|
|
vault.insert(key.to_string(), envelope);
|
|
|
|
store_vault(&vault_path, &vault).with_context(|| "failed to save secret to the vault")
|
|
}
|
|
|
|
async fn update_secret(&self, key: &str, value: &str) -> Result<()> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let mut vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
|
|
let password = self.get_password()?;
|
|
let envelope = encrypt_string(&password, value)?;
|
|
drop(password);
|
|
|
|
if vault.contains_key(key) {
|
|
debug!("Key '{key}' exists in vault. Overwriting previous value");
|
|
let vault_entry = vault
|
|
.get_mut(key)
|
|
.with_context(|| format!("key '{key}' not found in the vault"))?;
|
|
*vault_entry = envelope;
|
|
|
|
return store_vault(&vault_path, &vault)
|
|
.with_context(|| "failed to save secret to the vault");
|
|
}
|
|
|
|
vault.insert(key.to_string(), envelope);
|
|
store_vault(&vault_path, &vault).with_context(|| "failed to save secret to the vault")
|
|
}
|
|
|
|
async fn delete_secret(&self, key: &str) -> Result<()> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let mut vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
if !vault.contains_key(key) {
|
|
error!("Key '{key}' does not exist in the vault.");
|
|
bail!("key '{key}' does not exist");
|
|
}
|
|
|
|
vault.remove(key);
|
|
store_vault(&vault_path, &vault).with_context(|| "failed to save secret to the vault")
|
|
}
|
|
|
|
async fn list_secrets(&self) -> Result<Vec<String>> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
let keys: Vec<String> = vault.keys().cloned().collect();
|
|
|
|
Ok(keys)
|
|
}
|
|
|
|
async fn sync(&mut self) -> Result<()> {
|
|
let mut config_changed = false;
|
|
let git = resolve_git(self.git_executable.as_ref())?;
|
|
ensure_git_available(&git)?;
|
|
|
|
if self.git_branch.is_none() {
|
|
config_changed = true;
|
|
debug!("Prompting user to set git_branch in config for sync");
|
|
let branch: String = Input::with_theme(&ColorfulTheme::default())
|
|
.with_prompt("Enter git branch to sync with")
|
|
.default("main".into())
|
|
.interact_text()?;
|
|
|
|
self.git_branch = Some(branch);
|
|
}
|
|
|
|
if self.git_remote_url.is_none() {
|
|
config_changed = true;
|
|
debug!("Prompting user to set git_remote in config for sync");
|
|
let remote: String = Input::with_theme(&ColorfulTheme::default())
|
|
.with_prompt(
|
|
"Enter remote git URL to sync with (e.g. 'git@github.com:user/repo.git')",
|
|
)
|
|
.validate_with(|s: &String| {
|
|
LocalProvider {
|
|
git_remote_url: Some(s.clone()),
|
|
..LocalProvider::default()
|
|
}
|
|
.validate()
|
|
.map(|_| ())
|
|
.map_err(|e| e.to_string())
|
|
})
|
|
.interact_text()?;
|
|
|
|
self.git_remote_url = Some(remote);
|
|
}
|
|
|
|
if self.git_user_name.is_none() {
|
|
config_changed = true;
|
|
debug!("Prompting user git user name");
|
|
let default_user_name = default_git_username(&git)?.trim().to_string();
|
|
let branch: String = Input::with_theme(&ColorfulTheme::default())
|
|
.with_prompt("Enter git user name")
|
|
.default(default_user_name)
|
|
.interact_text()?;
|
|
|
|
self.git_user_name = Some(branch);
|
|
}
|
|
|
|
if self.git_user_email.is_none() {
|
|
config_changed = true;
|
|
debug!("Prompting user git email");
|
|
let default_user_name = default_git_email(&git)?.trim().to_string();
|
|
let branch: String = Input::with_theme(&ColorfulTheme::default())
|
|
.with_prompt("Enter git user email")
|
|
.validate_with({
|
|
|s: &String| {
|
|
if s.contains('@') {
|
|
Ok(())
|
|
} else {
|
|
Err("not a valid email address".to_string())
|
|
}
|
|
}
|
|
})
|
|
.default(default_user_name)
|
|
.interact_text()?;
|
|
|
|
self.git_user_email = Some(branch);
|
|
}
|
|
|
|
if config_changed {
|
|
self.persist_git_settings_to_config()?;
|
|
}
|
|
|
|
let sync_opts = SyncOpts {
|
|
remote_url: &self.git_remote_url,
|
|
branch: &self.git_branch,
|
|
user_name: &self.git_user_name,
|
|
user_email: &self.git_user_email,
|
|
git_executable: &self.git_executable,
|
|
};
|
|
|
|
sync_and_push(&sync_opts)
|
|
}
|
|
}
|
|
|
|
impl LocalProvider {
|
|
fn persist_git_settings_to_config(&self) -> Result<()> {
|
|
debug!("Saving updated config (only current local provider)");
|
|
|
|
let mut cfg = load_config(true).with_context(|| "failed to load existing config")?;
|
|
|
|
let target_name = self.runtime_provider_name.clone();
|
|
let mut updated = false;
|
|
for pc in cfg.providers.iter_mut() {
|
|
if let SupportedProvider::Local { provider_def } = &mut pc.provider_type {
|
|
let matches_name = match (&pc.name, &target_name) {
|
|
(Some(n), Some(t)) => n == t,
|
|
(Some(_), None) => false,
|
|
_ => false,
|
|
};
|
|
if matches_name || target_name.is_none() {
|
|
provider_def.git_branch = self.git_branch.clone();
|
|
provider_def.git_remote_url = self.git_remote_url.clone();
|
|
provider_def.git_user_name = self.git_user_name.clone();
|
|
provider_def.git_user_email = self.git_user_email.clone();
|
|
provider_def.git_executable = self.git_executable.clone();
|
|
|
|
updated = true;
|
|
if matches_name {
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if !updated {
|
|
bail!("unable to find matching local provider in config to update");
|
|
}
|
|
|
|
let path = get_config_file_path()?;
|
|
let ext = path.extension().and_then(|s| s.to_str()).unwrap_or("");
|
|
if ext.eq_ignore_ascii_case("yml") || ext.eq_ignore_ascii_case("yaml") {
|
|
if let Some(parent) = path.parent() {
|
|
fs::create_dir_all(parent)?;
|
|
}
|
|
let s = serde_yaml::to_string(&cfg)?;
|
|
fs::write(&path, s).with_context(|| format!("failed to write {}", path.display()))?;
|
|
} else {
|
|
confy::store(&calling_app_name(), "config", &cfg)
|
|
.with_context(|| "failed to save updated config via confy")?;
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
fn repo_dir_for_config(&self) -> Result<Option<PathBuf>> {
|
|
if let Some(remote) = &self.git_remote_url {
|
|
let name = repo_name_from_url(remote);
|
|
let dir = base_config_dir()?.join(format!(".{}", name));
|
|
Ok(Some(dir))
|
|
} else {
|
|
Ok(None)
|
|
}
|
|
}
|
|
|
|
fn active_vault_path(&self) -> Result<PathBuf> {
|
|
if let Some(dir) = self.repo_dir_for_config()?
|
|
&& dir.exists()
|
|
{
|
|
return Ok(dir.join("vault.yml"));
|
|
}
|
|
|
|
default_vault_path()
|
|
}
|
|
|
|
fn get_password(&self) -> Result<SecretString> {
|
|
if let Some(password_file) = &self.password_file {
|
|
#[cfg(unix)]
|
|
{
|
|
use std::os::unix::fs::PermissionsExt;
|
|
let metadata = fs::metadata(password_file).with_context(|| {
|
|
format!("failed to read password file metadata {:?}", password_file)
|
|
})?;
|
|
let mode = metadata.permissions().mode();
|
|
if mode & 0o077 != 0 {
|
|
bail!(
|
|
"password file {:?} has insecure permissions {:o} (should be 0600 or 0400)",
|
|
password_file,
|
|
mode & 0o777
|
|
);
|
|
}
|
|
}
|
|
|
|
let password = SecretString::new(
|
|
fs::read_to_string(password_file)
|
|
.with_context(|| format!("failed to read password file {:?}", password_file))?
|
|
.trim()
|
|
.to_string()
|
|
.into(),
|
|
);
|
|
|
|
Ok(password)
|
|
} else {
|
|
let password = rpassword::prompt_password("\nPassword: ")?;
|
|
Ok(SecretString::new(password.into()))
|
|
}
|
|
}
|
|
}
|
|
|
|
fn default_vault_path() -> Result<PathBuf> {
|
|
let xdg_path = env::var_os("XDG_CONFIG_HOME").map(PathBuf::from);
|
|
|
|
if let Some(xdg) = xdg_path {
|
|
return Ok(xdg.join(calling_app_name()).join("vault.yml"));
|
|
}
|
|
|
|
confy::get_configuration_file_path(&calling_app_name(), "vault")
|
|
.with_context(|| "get config dir")
|
|
}
|
|
|
|
fn base_config_dir() -> Result<PathBuf> {
|
|
default_vault_path()?
|
|
.parent()
|
|
.map(Path::to_path_buf)
|
|
.ok_or_else(|| anyhow!("Failed to determine config dir"))
|
|
}
|
|
|
|
fn load_vault(path: &Path) -> Result<HashMap<String, String>> {
|
|
if !path.exists() {
|
|
return Ok(HashMap::new());
|
|
}
|
|
let s = fs::read_to_string(path).with_context(|| format!("read {}", path.display()))?;
|
|
let map: HashMap<String, String> = serde_yaml::from_str(&s).unwrap_or_default();
|
|
Ok(map)
|
|
}
|
|
|
|
fn store_vault(path: &Path, map: &HashMap<String, String>) -> Result<()> {
|
|
if let Some(parent) = path.parent() {
|
|
fs::create_dir_all(parent).with_context(|| format!("create {}", parent.display()))?;
|
|
}
|
|
let s = serde_yaml::to_string(map).with_context(|| "serialize vault")?;
|
|
fs::write(path, &s).with_context(|| format!("write {}", path.display()))?;
|
|
|
|
#[cfg(unix)]
|
|
{
|
|
use std::os::unix::fs::PermissionsExt;
|
|
fs::set_permissions(path, fs::Permissions::from_mode(0o600))
|
|
.with_context(|| format!("set permissions on {}", path.display()))?;
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
fn encrypt_string(password: &SecretString, plaintext: &str) -> Result<String> {
|
|
if password.expose_secret().is_empty() {
|
|
bail!("password cannot be empty");
|
|
}
|
|
|
|
let mut salt = [0u8; SALT_LEN];
|
|
OsRng.fill_bytes(&mut salt);
|
|
let mut nonce_bytes = [0u8; NONCE_LEN];
|
|
OsRng.fill_bytes(&mut nonce_bytes);
|
|
|
|
let mut key = derive_key(password, &salt)?;
|
|
let cipher = XChaCha20Poly1305::new(&key);
|
|
|
|
let aad = format!(
|
|
"{};{};{};m={},t={},p={}",
|
|
HEADER, VERSION, KDF, ARGON_M_COST_KIB, ARGON_T_COST, ARGON_P
|
|
);
|
|
|
|
let nonce: XNonce = nonce_bytes.into();
|
|
let mut pt = plaintext.as_bytes().to_vec();
|
|
let ct = cipher
|
|
.encrypt(
|
|
&nonce,
|
|
chacha20poly1305::aead::Payload {
|
|
msg: &pt,
|
|
aad: aad.as_bytes(),
|
|
},
|
|
)
|
|
.map_err(|_| anyhow!("encryption failed"))?;
|
|
pt.zeroize();
|
|
|
|
let env = format!(
|
|
"{};{};{};m={m},t={t},p={p};salt={salt};nonce={nonce};ct={ct}",
|
|
HEADER,
|
|
VERSION,
|
|
KDF,
|
|
m = ARGON_M_COST_KIB,
|
|
t = ARGON_T_COST,
|
|
p = ARGON_P,
|
|
salt = B64.encode(salt),
|
|
nonce = B64.encode(nonce_bytes),
|
|
ct = B64.encode(&ct),
|
|
);
|
|
|
|
drop(cipher);
|
|
key.zeroize();
|
|
salt.zeroize();
|
|
nonce_bytes.zeroize();
|
|
|
|
Ok(env)
|
|
}
|
|
|
|
fn derive_key_with_params(
|
|
password: &SecretString,
|
|
salt: &[u8],
|
|
m_cost: u32,
|
|
t_cost: u32,
|
|
p: u32,
|
|
) -> Result<Key> {
|
|
let params = Params::new(m_cost, t_cost, p, Some(KEY_LEN))
|
|
.map_err(|e| anyhow!("argon2 params error: {:?}", e))?;
|
|
let argon = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);
|
|
let mut key_bytes = [0u8; KEY_LEN];
|
|
argon
|
|
.hash_password_into(password.expose_secret().as_bytes(), salt, &mut key_bytes)
|
|
.map_err(|e| anyhow!("argon2 derive error: {:?}", e))?;
|
|
let key: Key = key_bytes.into();
|
|
key_bytes.zeroize();
|
|
Ok(key)
|
|
}
|
|
|
|
fn derive_key(password: &SecretString, salt: &[u8]) -> Result<Key> {
|
|
derive_key_with_params(password, salt, ARGON_M_COST_KIB, ARGON_T_COST, ARGON_P)
|
|
}
|
|
|
|
/// Attempts to decrypt with the given cipher, nonce, ciphertext, and AAD.
|
|
fn try_decrypt(
|
|
cipher: &XChaCha20Poly1305,
|
|
nonce: &XNonce,
|
|
ct: &[u8],
|
|
aad: &[u8],
|
|
) -> std::result::Result<Vec<u8>, chacha20poly1305::aead::Error> {
|
|
cipher.decrypt(nonce, chacha20poly1305::aead::Payload { msg: ct, aad })
|
|
}
|
|
|
|
type EnvelopeComponents = (u32, u32, u32, Vec<u8>, [u8; NONCE_LEN], Vec<u8>);
|
|
|
|
/// Parse an envelope string and extract its components.
|
|
/// Returns (m, t, p, salt, nonce_arr, ct) on success.
|
|
fn parse_envelope(envelope: &str) -> Result<EnvelopeComponents> {
|
|
let parts: Vec<&str> = envelope.trim().split(';').collect();
|
|
if parts.len() < 7 {
|
|
debug!("Invalid envelope format: {:?}", parts);
|
|
bail!("invalid envelope format");
|
|
}
|
|
if parts[0] != HEADER {
|
|
debug!("Invalid header: {}", parts[0]);
|
|
bail!("unexpected header");
|
|
}
|
|
if parts[1] != VERSION {
|
|
debug!("Unsupported version: {}", parts[1]);
|
|
bail!("unsupported version {}", parts[1]);
|
|
}
|
|
if parts[2] != KDF {
|
|
debug!("Unsupported kdf: {}", parts[2]);
|
|
bail!("unsupported kdf {}", parts[2]);
|
|
}
|
|
|
|
let params_str = parts[3];
|
|
let mut m = ARGON_M_COST_KIB;
|
|
let mut t = ARGON_T_COST;
|
|
let mut p = ARGON_P;
|
|
for kv in params_str.split(',') {
|
|
if let Some((k, v)) = kv.split_once('=') {
|
|
match k {
|
|
"m" => m = v.parse().unwrap_or(m),
|
|
"t" => t = v.parse().unwrap_or(t),
|
|
"p" => p = v.parse().unwrap_or(p),
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
|
|
let salt_b64 = parts[4]
|
|
.strip_prefix("salt=")
|
|
.with_context(|| "missing salt")?;
|
|
let nonce_b64 = parts[5]
|
|
.strip_prefix("nonce=")
|
|
.with_context(|| "missing nonce")?;
|
|
let ct_b64 = parts[6].strip_prefix("ct=").with_context(|| "missing ct")?;
|
|
|
|
let salt = B64.decode(salt_b64).with_context(|| "bad salt b64")?;
|
|
let nonce_bytes = B64.decode(nonce_b64).with_context(|| "bad nonce b64")?;
|
|
let ct = B64.decode(ct_b64).with_context(|| "bad ct b64")?;
|
|
|
|
if nonce_bytes.len() != NONCE_LEN {
|
|
debug!("Nonce length mismatch: {}", nonce_bytes.len());
|
|
bail!("nonce length mismatch");
|
|
}
|
|
|
|
let nonce_arr: [u8; NONCE_LEN] = nonce_bytes
|
|
.try_into()
|
|
.map_err(|_| anyhow!("invalid nonce length"))?;
|
|
|
|
Ok((m, t, p, salt, nonce_arr, ct))
|
|
}
|
|
|
|
fn decrypt_string(password: &SecretString, envelope: &str) -> Result<String> {
|
|
if password.expose_secret().is_empty() {
|
|
bail!("password cannot be empty");
|
|
}
|
|
|
|
let (m, t, p, mut salt, mut nonce_arr, mut ct) = parse_envelope(envelope)?;
|
|
let nonce: XNonce = nonce_arr.into();
|
|
|
|
let aad_current = format!("{};{};{};m={},t={},p={}", HEADER, VERSION, KDF, m, t, p);
|
|
|
|
let mut key = derive_key_with_params(password, &salt, m, t, p)?;
|
|
let cipher = XChaCha20Poly1305::new(&key);
|
|
|
|
if let Ok(pt) = try_decrypt(&cipher, &nonce, &ct, aad_current.as_bytes()) {
|
|
let s = String::from_utf8(pt.clone()).with_context(|| "plaintext not valid UTF-8")?;
|
|
key.zeroize();
|
|
salt.zeroize();
|
|
nonce_arr.zeroize();
|
|
ct.zeroize();
|
|
return Ok(s);
|
|
}
|
|
|
|
key.zeroize();
|
|
salt.zeroize();
|
|
nonce_arr.zeroize();
|
|
ct.zeroize();
|
|
|
|
// TODO: Remove once all users have migrated their local vaults
|
|
if let Ok(plaintext) = legacy::decrypt_string_legacy(password, envelope) {
|
|
return Ok(plaintext);
|
|
}
|
|
|
|
bail!("decryption failed (wrong password or corrupted data)")
|
|
}
|
|
|
|
// TODO: Remove this entire module once all users have migrated their vaults.
|
|
mod legacy {
|
|
use super::*;
|
|
|
|
fn legacy_aad() -> String {
|
|
format!("{};{}", HEADER, VERSION)
|
|
}
|
|
|
|
pub fn decrypt_string_legacy(password: &SecretString, envelope: &str) -> Result<String> {
|
|
if password.expose_secret().is_empty() {
|
|
bail!("password cannot be empty");
|
|
}
|
|
|
|
let (m, t, p, mut salt, mut nonce_arr, mut ct) = parse_envelope(envelope)?;
|
|
let nonce: XNonce = nonce_arr.into();
|
|
let aad = legacy_aad();
|
|
|
|
let mut key = derive_key_with_params(password, &salt, m, t, p)?;
|
|
let cipher = XChaCha20Poly1305::new(&key);
|
|
|
|
if let Ok(pt) = try_decrypt(&cipher, &nonce, &ct, aad.as_bytes()) {
|
|
let s = String::from_utf8(pt.clone()).with_context(|| "plaintext not valid UTF-8")?;
|
|
key.zeroize();
|
|
salt.zeroize();
|
|
nonce_arr.zeroize();
|
|
ct.zeroize();
|
|
return Ok(s);
|
|
}
|
|
|
|
key.zeroize();
|
|
|
|
let mut zeros_key: Key = [0u8; KEY_LEN].into();
|
|
let zeros_cipher = XChaCha20Poly1305::new(&zeros_key);
|
|
|
|
if let Ok(pt) = try_decrypt(&zeros_cipher, &nonce, &ct, aad.as_bytes()) {
|
|
debug!("Decrypted using legacy all-zeros key - secret needs migration");
|
|
let s = String::from_utf8(pt.clone()).with_context(|| "plaintext not valid UTF-8")?;
|
|
zeros_key.zeroize();
|
|
salt.zeroize();
|
|
nonce_arr.zeroize();
|
|
ct.zeroize();
|
|
return Ok(s);
|
|
}
|
|
|
|
zeros_key.zeroize();
|
|
salt.zeroize();
|
|
nonce_arr.zeroize();
|
|
ct.zeroize();
|
|
|
|
bail!("legacy decryption failed")
|
|
}
|
|
|
|
pub fn is_current_format(password: &SecretString, envelope: &str) -> Result<bool> {
|
|
if password.expose_secret().is_empty() {
|
|
bail!("password cannot be empty");
|
|
}
|
|
|
|
let (m, t, p, salt, nonce_arr, ct) = parse_envelope(envelope)?;
|
|
let nonce: XNonce = nonce_arr.into();
|
|
|
|
let aad_current = format!("{};{};{};m={},t={},p={}", HEADER, VERSION, KDF, m, t, p);
|
|
let key = derive_key_with_params(password, &salt, m, t, p)?;
|
|
let cipher = XChaCha20Poly1305::new(&key);
|
|
|
|
Ok(try_decrypt(&cipher, &nonce, &ct, aad_current.as_bytes()).is_ok())
|
|
}
|
|
}
|
|
|
|
// TODO: Remove once all users have migrated their local vaults
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub enum SecretStatus {
|
|
Current,
|
|
NeedsMigration,
|
|
}
|
|
|
|
// TODO: Remove once all users have migrated their local vaults
|
|
#[derive(Debug)]
|
|
pub struct MigrationResult {
|
|
pub total: usize,
|
|
pub migrated: usize,
|
|
pub already_current: usize,
|
|
pub failed: Vec<(String, String)>,
|
|
}
|
|
|
|
impl LocalProvider {
|
|
// TODO: Remove once all users have migrated their local vaults
|
|
pub async fn migrate_vault(&self) -> Result<MigrationResult> {
|
|
let vault_path = self.active_vault_path()?;
|
|
let vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
|
|
|
|
if vault.is_empty() {
|
|
return Ok(MigrationResult {
|
|
total: 0,
|
|
migrated: 0,
|
|
already_current: 0,
|
|
failed: vec![],
|
|
});
|
|
}
|
|
|
|
let password = self.get_password()?;
|
|
let mut migrated_vault = HashMap::new();
|
|
let mut migrated_count = 0;
|
|
let mut already_current_count = 0;
|
|
let mut failed = vec![];
|
|
|
|
for (key, envelope) in &vault {
|
|
match legacy::is_current_format(&password, envelope) {
|
|
Ok(true) => {
|
|
migrated_vault.insert(key.clone(), envelope.clone());
|
|
already_current_count += 1;
|
|
}
|
|
Ok(false) => match decrypt_string(&password, envelope) {
|
|
Ok(plaintext) => match encrypt_string(&password, &plaintext) {
|
|
Ok(new_envelope) => {
|
|
migrated_vault.insert(key.clone(), new_envelope);
|
|
migrated_count += 1;
|
|
}
|
|
Err(e) => {
|
|
failed.push((key.clone(), format!("re-encryption failed: {}", e)));
|
|
migrated_vault.insert(key.clone(), envelope.clone());
|
|
}
|
|
},
|
|
Err(e) => {
|
|
failed.push((key.clone(), format!("decryption failed: {}", e)));
|
|
migrated_vault.insert(key.clone(), envelope.clone());
|
|
}
|
|
},
|
|
Err(e) => {
|
|
failed.push((key.clone(), format!("status check failed: {}", e)));
|
|
migrated_vault.insert(key.clone(), envelope.clone());
|
|
}
|
|
}
|
|
}
|
|
|
|
if migrated_count > 0 {
|
|
store_vault(&vault_path, &migrated_vault)?;
|
|
}
|
|
|
|
Ok(MigrationResult {
|
|
total: vault.len(),
|
|
migrated: migrated_count,
|
|
already_current: already_current_count,
|
|
failed,
|
|
})
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
use secrecy::{ExposeSecret, SecretString};
|
|
use std::env as std_env;
|
|
use tempfile::tempdir;
|
|
|
|
#[test]
|
|
fn test_derive_key() {
|
|
let password = SecretString::new("test_password".to_string().into());
|
|
let salt = [0u8; 16];
|
|
let key = derive_key(&password, &salt).unwrap();
|
|
assert_eq!(key.len(), 32);
|
|
}
|
|
|
|
#[test]
|
|
fn test_derive_key_with_params() {
|
|
let password = SecretString::new("test_password".to_string().into());
|
|
let salt = [0u8; 16];
|
|
let key = derive_key_with_params(&password, &salt, 10, 1, 1).unwrap();
|
|
assert_eq!(key.len(), 32);
|
|
}
|
|
|
|
#[test]
|
|
fn crypto_roundtrip_local_impl() {
|
|
let pw = SecretString::new("pw".into());
|
|
let msg = "hello world";
|
|
let env = encrypt_string(&pw, msg).unwrap();
|
|
let out = decrypt_string(&pw, &env).unwrap();
|
|
assert_eq!(out, msg);
|
|
}
|
|
|
|
#[test]
|
|
#[cfg(unix)]
|
|
fn get_password_reads_password_file() {
|
|
use std::os::unix::fs::PermissionsExt;
|
|
let dir = tempdir().unwrap();
|
|
let file = dir.path().join("pw.txt");
|
|
fs::write(&file, "secretpw\n").unwrap();
|
|
fs::set_permissions(&file, fs::Permissions::from_mode(0o600)).unwrap();
|
|
let provider = LocalProvider {
|
|
password_file: Some(file),
|
|
runtime_provider_name: None,
|
|
..LocalProvider::default()
|
|
};
|
|
let pw = provider.get_password().unwrap();
|
|
assert_eq!(pw.expose_secret(), "secretpw");
|
|
}
|
|
|
|
#[test]
|
|
#[cfg(unix)]
|
|
fn get_password_rejects_insecure_file() {
|
|
use std::os::unix::fs::PermissionsExt;
|
|
let dir = tempdir().unwrap();
|
|
let file = dir.path().join("pw.txt");
|
|
fs::write(&file, "secretpw\n").unwrap();
|
|
fs::set_permissions(&file, fs::Permissions::from_mode(0o644)).unwrap();
|
|
let provider = LocalProvider {
|
|
password_file: Some(file),
|
|
runtime_provider_name: None,
|
|
..LocalProvider::default()
|
|
};
|
|
assert!(provider.get_password().is_err());
|
|
}
|
|
|
|
#[test]
|
|
#[cfg(not(unix))]
|
|
fn get_password_reads_password_file() {
|
|
let dir = tempdir().unwrap();
|
|
let file = dir.path().join("pw.txt");
|
|
fs::write(&file, "secretpw\n").unwrap();
|
|
let provider = LocalProvider {
|
|
password_file: Some(file),
|
|
runtime_provider_name: None,
|
|
..LocalProvider::default()
|
|
};
|
|
let pw = provider.get_password().unwrap();
|
|
assert_eq!(pw.expose_secret(), "secretpw");
|
|
}
|
|
|
|
#[test]
|
|
fn persist_only_target_local_provider_git_settings() {
|
|
let td = tempdir().unwrap();
|
|
let xdg = td.path().join("xdg");
|
|
let app_dir = xdg.join(calling_app_name());
|
|
fs::create_dir_all(&app_dir).unwrap();
|
|
unsafe {
|
|
std_env::set_var("XDG_CONFIG_HOME", &xdg);
|
|
}
|
|
|
|
let initial_yaml = indoc::indoc! {
|
|
"---
|
|
default_provider: local
|
|
providers:
|
|
- name: local
|
|
type: local
|
|
password_file: /tmp/.gman_pass
|
|
git_branch: main
|
|
git_remote_url: null
|
|
git_user_name: null
|
|
git_user_email: null
|
|
git_executable: null
|
|
- name: other
|
|
type: local
|
|
git_branch: main
|
|
git_remote_url: git@github.com:someone/else.git
|
|
run_configs:
|
|
- name: echo
|
|
secrets: [API_KEY]
|
|
"
|
|
};
|
|
let cfg_path = app_dir.join("config.yml");
|
|
fs::write(&cfg_path, initial_yaml).unwrap();
|
|
|
|
let provider = LocalProvider {
|
|
password_file: None,
|
|
git_branch: Some("dev".into()),
|
|
git_remote_url: Some("git@github.com:user/repo.git".into()),
|
|
git_user_name: Some("Test User".into()),
|
|
git_user_email: Some("test@example.com".into()),
|
|
git_executable: Some(PathBuf::from("/usr/bin/git")),
|
|
runtime_provider_name: Some("local".into()),
|
|
};
|
|
|
|
provider
|
|
.persist_git_settings_to_config()
|
|
.expect("persist ok");
|
|
|
|
let content = fs::read_to_string(&cfg_path).unwrap();
|
|
let cfg: Config = serde_yaml::from_str(&content).unwrap();
|
|
|
|
assert_eq!(cfg.default_provider.as_deref(), Some("local"));
|
|
assert!(cfg.run_configs.is_some());
|
|
assert_eq!(cfg.run_configs.as_ref().unwrap().len(), 1);
|
|
|
|
let p0 = &cfg.providers[0];
|
|
assert_eq!(p0.name.as_deref(), Some("local"));
|
|
match &p0.provider_type {
|
|
SupportedProvider::Local { provider_def } => {
|
|
assert_eq!(provider_def.git_branch.as_deref(), Some("dev"));
|
|
assert_eq!(
|
|
provider_def.git_remote_url.as_deref(),
|
|
Some("git@github.com:user/repo.git")
|
|
);
|
|
assert_eq!(provider_def.git_user_name.as_deref(), Some("Test User"));
|
|
assert_eq!(
|
|
provider_def.git_user_email.as_deref(),
|
|
Some("test@example.com")
|
|
);
|
|
assert_eq!(
|
|
provider_def.git_executable.as_ref(),
|
|
Some(&PathBuf::from("/usr/bin/git"))
|
|
);
|
|
}
|
|
_ => panic!("expected local provider"),
|
|
}
|
|
|
|
let p1 = &cfg.providers[1];
|
|
assert_eq!(p1.name.as_deref(), Some("other"));
|
|
match &p1.provider_type {
|
|
SupportedProvider::Local { provider_def } => {
|
|
assert_eq!(provider_def.git_branch.as_deref(), Some("main"));
|
|
assert_eq!(
|
|
provider_def.git_remote_url.as_deref(),
|
|
Some("git@github.com:someone/else.git")
|
|
);
|
|
}
|
|
_ => panic!("expected local provider"),
|
|
}
|
|
|
|
unsafe {
|
|
std_env::remove_var("XDG_CONFIG_HOME");
|
|
}
|
|
}
|
|
}
|