Reconstruct KeePassGO repository

2026-03-29 11:04:38 -07:00
commit a2a8fcbd14
34 changed files with 14041 additions and 0 deletions
@@ -0,0 +1,180 @@
+package session
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+
+	"git.julianfamily.org/keepassgo/vault"
+	"git.julianfamily.org/keepassgo/webdav"
+)
+
+var (
+	ErrLocked = errors.New("vault is locked")
+	ErrNoPath = errors.New("no vault path configured")
+)
+
+type Manager struct {
+	model         vault.Model
+	config        *vault.KDBXConfig
+	path          string
+	key           vault.MasterKey
+	locked        bool
+	encoded       []byte
+	remoteClient  *webdav.Client
+	remotePath    string
+	remoteVersion webdav.Version
+}
+
+func (m *Manager) Create(model vault.Model, key vault.MasterKey) error {
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithConfigAndKey(&encoded, model, key, m.config); err != nil {
+		return fmt.Errorf("encode new vault: %w", err)
+	}
+
+	m.model = model
+	m.key = key
+	m.encoded = encoded.Bytes()
+	m.locked = false
+	return nil
+}
+
+func (m *Manager) Open(path string, key vault.MasterKey) error {
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", path, err)
+	}
+
+	model, config, err := vault.LoadKDBXWithConfig(bytes.NewReader(content), key)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", path, err)
+	}
+
+	m.model = model
+	m.config = config
+	m.path = path
+	m.key = key
+	m.encoded = content
+	m.locked = false
+	return nil
+}
+
+func (m *Manager) Save() error {
+	if m.remoteClient != nil && m.remotePath != "" {
+		return m.SaveRemote()
+	}
+
+	if m.path == "" {
+		return ErrNoPath
+	}
+
+	return m.saveToPath(m.path)
+}
+
+func (m *Manager) OpenRemote(client webdav.Client, path string, key vault.MasterKey) error {
+	content, version, err := client.Open(path)
+	if err != nil {
+		return fmt.Errorf("open remote %s: %w", path, err)
+	}
+
+	model, config, err := vault.LoadKDBXWithConfig(bytes.NewReader(content), key)
+	if err != nil {
+		return fmt.Errorf("decode remote %s: %w", path, err)
+	}
+
+	m.model = model
+	m.config = config
+	m.key = key
+	m.encoded = content
+	m.locked = false
+	m.remoteClient = &client
+	m.remotePath = path
+	m.remoteVersion = version
+	return nil
+}
+
+func (m *Manager) SaveRemote() error {
+	if m.remoteClient == nil || m.remotePath == "" {
+		return ErrNoPath
+	}
+
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithConfigAndKey(&encoded, m.model, m.key, m.config); err != nil {
+		return fmt.Errorf("encode vault: %w", err)
+	}
+
+	version, err := m.remoteClient.Save(m.remotePath, bytes.NewReader(encoded.Bytes()), m.remoteVersion)
+	if err != nil {
+		return fmt.Errorf("save remote %s: %w", m.remotePath, err)
+	}
+
+	m.encoded = encoded.Bytes()
+	m.remoteVersion = version
+	return nil
+}
+
+func (m *Manager) SaveAs(path string) error {
+	if err := m.saveToPath(path); err != nil {
+		return err
+	}
+
+	m.path = path
+	return nil
+}
+
+func (m *Manager) Replace(model vault.Model) {
+	m.model = model
+	m.locked = false
+}
+
+func (m *Manager) Current() (vault.Model, error) {
+	if m.locked {
+		return vault.Model{}, ErrLocked
+	}
+
+	return m.model, nil
+}
+
+func (m *Manager) Lock() error {
+	if m.locked {
+		return nil
+	}
+
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithConfigAndKey(&encoded, m.model, m.key, m.config); err != nil {
+		return fmt.Errorf("encode vault for lock: %w", err)
+	}
+
+	m.encoded = encoded.Bytes()
+	m.model = vault.Model{}
+	m.locked = true
+	return nil
+}
+
+func (m *Manager) Unlock(key vault.MasterKey) error {
+	model, config, err := vault.LoadKDBXWithConfig(bytes.NewReader(m.encoded), key)
+	if err != nil {
+		return fmt.Errorf("unlock vault: %w", err)
+	}
+
+	m.model = model
+	m.config = config
+	m.key = key
+	m.locked = false
+	return nil
+}
+
+func (m *Manager) saveToPath(path string) error {
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithConfigAndKey(&encoded, m.model, m.key, m.config); err != nil {
+		return fmt.Errorf("encode vault: %w", err)
+	}
+
+	if err := os.WriteFile(path, encoded.Bytes(), 0o600); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+
+	m.encoded = encoded.Bytes()
+	return nil
+}
@@ -0,0 +1,477 @@
+package session
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.julianfamily.org/keepassgo/vault"
+	"git.julianfamily.org/keepassgo/webdav"
+	"github.com/tobischo/gokeepasslib/v3"
+	w "github.com/tobischo/gokeepasslib/v3/wrappers"
+)
+
+func TestCreateSaveAsLockAndUnlockRoundTripsVault(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var sess Manager
+	if err := sess.Create(model, key); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+
+	path := filepath.Join(t.TempDir(), "keepassgo.kdbx")
+	if err := sess.SaveAs(path); err != nil {
+		t.Fatalf("SaveAs() error = %v", err)
+	}
+
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("Stat(saved path) error = %v", err)
+	}
+
+	if err := sess.Lock(); err != nil {
+		t.Fatalf("Lock() error = %v", err)
+	}
+
+	if _, err := sess.Current(); !errors.Is(err, ErrLocked) {
+		t.Fatalf("Current() error = %v, want ErrLocked", err)
+	}
+
+	if err := sess.Unlock(key); err != nil {
+		t.Fatalf("Unlock() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() after Unlock() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Title != "Vault Console" || got[0].Password != "token-1" {
+		t.Fatalf("Current() entries = %#v, want persisted Vault Console entry", got)
+	}
+}
+
+func TestOpenLoadsExistingKDBXFromDisk(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Surveillance Console",
+				Username: "codex",
+				Password: "token-2",
+				URL:      "https://surveillance.crew.example.invalid",
+				Path:     []string{"Root", "Home Assistant"},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "existing.kdbx")
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("Create(existing path) error = %v", err)
+	}
+	if err := vault.SaveKDBXWithKey(file, model, key); err != nil {
+		file.Close()
+		t.Fatalf("SaveKDBXWithKey() error = %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close(existing path) error = %v", err)
+	}
+
+	var sess Manager
+	if err := sess.Open(path, key); err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Home Assistant"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("Current() entries = %#v, want Home Assistant entry", got)
+	}
+}
+
+func TestSavePersistsEditsBackToCurrentPath(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "editable.kdbx")
+
+	var sess Manager
+	if err := sess.Create(model, key); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+	if err := sess.SaveAs(path); err != nil {
+		t.Fatalf("SaveAs() error = %v", err)
+	}
+
+	updated := model
+	updated.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     []string{"Root", "Internet"},
+	})
+	sess.Replace(updated)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	reopened, err := os.Open(path)
+	if err != nil {
+		t.Fatalf("Open(saved path) error = %v", err)
+	}
+	defer reopened.Close()
+
+	loaded, err := vault.LoadKDBXWithKey(reopened, key)
+	if err != nil {
+		t.Fatalf("LoadKDBXWithKey() error = %v", err)
+	}
+
+	got := loaded.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("loaded entries = %#v, want updated password token-2", got)
+	}
+}
+
+func TestSaveWithoutPathFails(t *testing.T) {
+	t.Parallel()
+
+	var sess Manager
+	if err := sess.Create(vault.Model{}, vault.MasterKey{Password: "correct horse battery staple"}); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+
+	err := sess.Save()
+	if !errors.Is(err, ErrNoPath) {
+		t.Fatalf("Save() error = %v, want ErrNoPath", err)
+	}
+}
+
+func TestOpenRemoteLoadsExistingKDBXFromWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+		t.Fatalf("SaveKDBXWithKey() error = %v", err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/vaults/main.kdbx" {
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+
+		w.Header().Set("ETag", "\"v1\"")
+		_, _ = w.Write(encoded.Bytes())
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Password != "token-1" {
+		t.Fatalf("Current() entries = %#v, want Vault Console entry from remote vault", got)
+	}
+}
+
+func TestSaveRemotePersistsEditsBackToWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Surveillance Console",
+				Username: "codex",
+				Password: "token-1",
+				URL:      "https://surveillance.crew.example.invalid",
+				Path:     []string{"Root", "Home Assistant"},
+			},
+		},
+	}
+
+	var (
+		savedETag  string
+		savedBytes []byte
+	)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			var encoded bytes.Buffer
+			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+				t.Fatalf("SaveKDBXWithKey() error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v1\"")
+			_, _ = w.Write(encoded.Bytes())
+		case http.MethodPut:
+			savedETag = r.Header.Get("If-Match")
+			var err error
+			savedBytes, err = io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("ReadAll(PUT body) error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v2\"")
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected method %s", r.Method)
+		}
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Surveillance Console",
+		Username: "codex",
+		Password: "token-2",
+		URL:      "https://surveillance.crew.example.invalid",
+		Path:     []string{"Root", "Home Assistant"},
+	})
+	sess.Replace(current)
+
+	if err := sess.SaveRemote(); err != nil {
+		t.Fatalf("SaveRemote() error = %v", err)
+	}
+
+	if savedETag != "\"v1\"" {
+		t.Fatalf("If-Match header = %q, want %q", savedETag, "\"v1\"")
+	}
+
+	loaded, err := vault.LoadKDBXWithKey(bytes.NewReader(savedBytes), key)
+	if err != nil {
+		t.Fatalf("LoadKDBXWithKey(savedBytes) error = %v", err)
+	}
+
+	got := loaded.EntriesInPath([]string{"Root", "Home Assistant"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("loaded remote entries = %#v, want updated token-2 entry", got)
+	}
+}
+
+func TestSaveUsesRemoteTargetWhenVaultWasOpenedFromWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var putCount int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			var encoded bytes.Buffer
+			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+				t.Fatalf("SaveKDBXWithKey() error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v1\"")
+			_, _ = w.Write(encoded.Bytes())
+		case http.MethodPut:
+			putCount++
+			w.Header().Set("ETag", "\"v2\"")
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected method %s", r.Method)
+		}
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     []string{"Root", "Internet"},
+	})
+	sess.Replace(current)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	if putCount != 1 {
+		t.Fatalf("remote PUT count = %d, want 1", putCount)
+	}
+}
+
+func TestSavePreservesOpenedKDBXSecuritySettings(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	db := gokeepasslib.NewDatabase(gokeepasslib.WithDatabaseKDBXVersion4())
+	db.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
+	db.Content.Root.Groups = []gokeepasslib.Group{
+		{
+			Name: "Root",
+			Entries: []gokeepasslib.Entry{
+				{
+					UUID: gokeepasslib.NewUUID(),
+					Values: []gokeepasslib.ValueData{
+						{Key: "Title", Value: gokeepasslib.V{Content: "Vault Console"}},
+						{Key: "UserName", Value: gokeepasslib.V{Content: "dannyocean"}},
+						{Key: "Password", Value: gokeepasslib.V{Content: "token-1", Protected: w.NewBoolWrapper(true)}},
+						{Key: "URL", Value: gokeepasslib.V{Content: "https://vault.crew.example.invalid"}},
+					},
+				},
+			},
+		},
+	}
+	if err := db.LockProtectedEntries(); err != nil {
+		t.Fatalf("LockProtectedEntries() error = %v", err)
+	}
+
+	path := filepath.Join(t.TempDir(), "kdbx4.kdbx")
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("Create(path) error = %v", err)
+	}
+	if err := gokeepasslib.NewEncoder(file).Encode(db); err != nil {
+		file.Close()
+		t.Fatalf("Encode() error = %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close(path) error = %v", err)
+	}
+
+	var sess Manager
+	if err := sess.Open(path, key); err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       current.Entries[0].ID,
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     current.Entries[0].Path,
+	})
+	sess.Replace(current)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	saved, err := os.Open(path)
+	if err != nil {
+		t.Fatalf("Open(saved path) error = %v", err)
+	}
+	defer saved.Close()
+
+	reloaded := gokeepasslib.NewDatabase()
+	reloaded.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
+	if err := gokeepasslib.NewDecoder(saved).Decode(reloaded); err != nil {
+		t.Fatalf("Decode(saved path) error = %v", err)
+	}
+
+	if !reloaded.Header.IsKdbx4() {
+		t.Fatal("saved header is not KDBX4, want preserved KDBX4 format")
+	}
+	if !bytes.Equal(reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID) {
+		t.Fatalf("saved cipher = %x, want %x", reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID)
+	}
+	if !bytes.Equal(reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID) {
+		t.Fatalf("saved KDF UUID = %x, want %x", reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID)
+	}
+}