Reconstruct KeePassGO repository

2026-03-29 11:04:38 -07:00
commit a2a8fcbd14
34 changed files with 14041 additions and 0 deletions
@@ -0,0 +1,477 @@
+package session
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.julianfamily.org/keepassgo/vault"
+	"git.julianfamily.org/keepassgo/webdav"
+	"github.com/tobischo/gokeepasslib/v3"
+	w "github.com/tobischo/gokeepasslib/v3/wrappers"
+)
+
+func TestCreateSaveAsLockAndUnlockRoundTripsVault(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var sess Manager
+	if err := sess.Create(model, key); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+
+	path := filepath.Join(t.TempDir(), "keepassgo.kdbx")
+	if err := sess.SaveAs(path); err != nil {
+		t.Fatalf("SaveAs() error = %v", err)
+	}
+
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("Stat(saved path) error = %v", err)
+	}
+
+	if err := sess.Lock(); err != nil {
+		t.Fatalf("Lock() error = %v", err)
+	}
+
+	if _, err := sess.Current(); !errors.Is(err, ErrLocked) {
+		t.Fatalf("Current() error = %v, want ErrLocked", err)
+	}
+
+	if err := sess.Unlock(key); err != nil {
+		t.Fatalf("Unlock() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() after Unlock() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Title != "Vault Console" || got[0].Password != "token-1" {
+		t.Fatalf("Current() entries = %#v, want persisted Vault Console entry", got)
+	}
+}
+
+func TestOpenLoadsExistingKDBXFromDisk(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Surveillance Console",
+				Username: "codex",
+				Password: "token-2",
+				URL:      "https://surveillance.crew.example.invalid",
+				Path:     []string{"Root", "Home Assistant"},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "existing.kdbx")
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("Create(existing path) error = %v", err)
+	}
+	if err := vault.SaveKDBXWithKey(file, model, key); err != nil {
+		file.Close()
+		t.Fatalf("SaveKDBXWithKey() error = %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close(existing path) error = %v", err)
+	}
+
+	var sess Manager
+	if err := sess.Open(path, key); err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Home Assistant"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("Current() entries = %#v, want Home Assistant entry", got)
+	}
+}
+
+func TestSavePersistsEditsBackToCurrentPath(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "editable.kdbx")
+
+	var sess Manager
+	if err := sess.Create(model, key); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+	if err := sess.SaveAs(path); err != nil {
+		t.Fatalf("SaveAs() error = %v", err)
+	}
+
+	updated := model
+	updated.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     []string{"Root", "Internet"},
+	})
+	sess.Replace(updated)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	reopened, err := os.Open(path)
+	if err != nil {
+		t.Fatalf("Open(saved path) error = %v", err)
+	}
+	defer reopened.Close()
+
+	loaded, err := vault.LoadKDBXWithKey(reopened, key)
+	if err != nil {
+		t.Fatalf("LoadKDBXWithKey() error = %v", err)
+	}
+
+	got := loaded.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("loaded entries = %#v, want updated password token-2", got)
+	}
+}
+
+func TestSaveWithoutPathFails(t *testing.T) {
+	t.Parallel()
+
+	var sess Manager
+	if err := sess.Create(vault.Model{}, vault.MasterKey{Password: "correct horse battery staple"}); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+
+	err := sess.Save()
+	if !errors.Is(err, ErrNoPath) {
+		t.Fatalf("Save() error = %v, want ErrNoPath", err)
+	}
+}
+
+func TestOpenRemoteLoadsExistingKDBXFromWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var encoded bytes.Buffer
+	if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+		t.Fatalf("SaveKDBXWithKey() error = %v", err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/vaults/main.kdbx" {
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+
+		w.Header().Set("ETag", "\"v1\"")
+		_, _ = w.Write(encoded.Bytes())
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+
+	got := current.EntriesInPath([]string{"Root", "Internet"})
+	if len(got) != 1 || got[0].Password != "token-1" {
+		t.Fatalf("Current() entries = %#v, want Vault Console entry from remote vault", got)
+	}
+}
+
+func TestSaveRemotePersistsEditsBackToWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Surveillance Console",
+				Username: "codex",
+				Password: "token-1",
+				URL:      "https://surveillance.crew.example.invalid",
+				Path:     []string{"Root", "Home Assistant"},
+			},
+		},
+	}
+
+	var (
+		savedETag  string
+		savedBytes []byte
+	)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			var encoded bytes.Buffer
+			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+				t.Fatalf("SaveKDBXWithKey() error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v1\"")
+			_, _ = w.Write(encoded.Bytes())
+		case http.MethodPut:
+			savedETag = r.Header.Get("If-Match")
+			var err error
+			savedBytes, err = io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("ReadAll(PUT body) error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v2\"")
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected method %s", r.Method)
+		}
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Surveillance Console",
+		Username: "codex",
+		Password: "token-2",
+		URL:      "https://surveillance.crew.example.invalid",
+		Path:     []string{"Root", "Home Assistant"},
+	})
+	sess.Replace(current)
+
+	if err := sess.SaveRemote(); err != nil {
+		t.Fatalf("SaveRemote() error = %v", err)
+	}
+
+	if savedETag != "\"v1\"" {
+		t.Fatalf("If-Match header = %q, want %q", savedETag, "\"v1\"")
+	}
+
+	loaded, err := vault.LoadKDBXWithKey(bytes.NewReader(savedBytes), key)
+	if err != nil {
+		t.Fatalf("LoadKDBXWithKey(savedBytes) error = %v", err)
+	}
+
+	got := loaded.EntriesInPath([]string{"Root", "Home Assistant"})
+	if len(got) != 1 || got[0].Password != "token-2" {
+		t.Fatalf("loaded remote entries = %#v, want updated token-2 entry", got)
+	}
+}
+
+func TestSaveUsesRemoteTargetWhenVaultWasOpenedFromWebDAV(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "token-1",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"Root", "Internet"},
+			},
+		},
+	}
+
+	var putCount int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			var encoded bytes.Buffer
+			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
+				t.Fatalf("SaveKDBXWithKey() error = %v", err)
+			}
+			w.Header().Set("ETag", "\"v1\"")
+			_, _ = w.Write(encoded.Bytes())
+		case http.MethodPut:
+			putCount++
+			w.Header().Set("ETag", "\"v2\"")
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Fatalf("unexpected method %s", r.Method)
+		}
+	}))
+	defer server.Close()
+
+	client := webdav.Client{BaseURL: server.URL}
+
+	var sess Manager
+	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
+		t.Fatalf("OpenRemote() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       "entry-1",
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     []string{"Root", "Internet"},
+	})
+	sess.Replace(current)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	if putCount != 1 {
+		t.Fatalf("remote PUT count = %d, want 1", putCount)
+	}
+}
+
+func TestSavePreservesOpenedKDBXSecuritySettings(t *testing.T) {
+	t.Parallel()
+
+	key := vault.MasterKey{Password: "correct horse battery staple"}
+	db := gokeepasslib.NewDatabase(gokeepasslib.WithDatabaseKDBXVersion4())
+	db.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
+	db.Content.Root.Groups = []gokeepasslib.Group{
+		{
+			Name: "Root",
+			Entries: []gokeepasslib.Entry{
+				{
+					UUID: gokeepasslib.NewUUID(),
+					Values: []gokeepasslib.ValueData{
+						{Key: "Title", Value: gokeepasslib.V{Content: "Vault Console"}},
+						{Key: "UserName", Value: gokeepasslib.V{Content: "dannyocean"}},
+						{Key: "Password", Value: gokeepasslib.V{Content: "token-1", Protected: w.NewBoolWrapper(true)}},
+						{Key: "URL", Value: gokeepasslib.V{Content: "https://vault.crew.example.invalid"}},
+					},
+				},
+			},
+		},
+	}
+	if err := db.LockProtectedEntries(); err != nil {
+		t.Fatalf("LockProtectedEntries() error = %v", err)
+	}
+
+	path := filepath.Join(t.TempDir(), "kdbx4.kdbx")
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("Create(path) error = %v", err)
+	}
+	if err := gokeepasslib.NewEncoder(file).Encode(db); err != nil {
+		file.Close()
+		t.Fatalf("Encode() error = %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close(path) error = %v", err)
+	}
+
+	var sess Manager
+	if err := sess.Open(path, key); err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+
+	current, err := sess.Current()
+	if err != nil {
+		t.Fatalf("Current() error = %v", err)
+	}
+	current.UpsertEntry(vault.Entry{
+		ID:       current.Entries[0].ID,
+		Title:    "Vault Console",
+		Username: "dannyocean",
+		Password: "token-2",
+		URL:      "https://vault.crew.example.invalid",
+		Path:     current.Entries[0].Path,
+	})
+	sess.Replace(current)
+
+	if err := sess.Save(); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	saved, err := os.Open(path)
+	if err != nil {
+		t.Fatalf("Open(saved path) error = %v", err)
+	}
+	defer saved.Close()
+
+	reloaded := gokeepasslib.NewDatabase()
+	reloaded.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
+	if err := gokeepasslib.NewDecoder(saved).Decode(reloaded); err != nil {
+		t.Fatalf("Decode(saved path) error = %v", err)
+	}
+
+	if !reloaded.Header.IsKdbx4() {
+		t.Fatal("saved header is not KDBX4, want preserved KDBX4 format")
+	}
+	if !bytes.Equal(reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID) {
+		t.Fatalf("saved cipher = %x, want %x", reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID)
+	}
+	if !bytes.Equal(reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID) {
+		t.Fatalf("saved KDF UUID = %x, want %x", reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID)
+	}
+}