keepassgo/session/session_test.go

package session

import (
	"bytes"
	"errors"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"testing"

	"git.julianfamily.org/keepassgo/vault"
	"git.julianfamily.org/keepassgo/webdav"
	"github.com/tobischo/gokeepasslib/v3"
	w "github.com/tobischo/gokeepasslib/v3/wrappers"
)

func TestCreateSaveAsLockAndUnlockRoundTripsVault(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Vault Console",
				Username: "dannyocean",
				Password: "token-1",
				URL:      "https://vault.crew.example.invalid",
				Path:     []string{"Root", "Internet"},
			},
		},
	}

	var sess Manager
	if err := sess.Create(model, key); err != nil {
		t.Fatalf("Create() error = %v", err)
	}

	path := filepath.Join(t.TempDir(), "keepassgo.kdbx")
	if err := sess.SaveAs(path); err != nil {
		t.Fatalf("SaveAs() error = %v", err)
	}

	if _, err := os.Stat(path); err != nil {
		t.Fatalf("Stat(saved path) error = %v", err)
	}

	if err := sess.Lock(); err != nil {
		t.Fatalf("Lock() error = %v", err)
	}

	if _, err := sess.Current(); !errors.Is(err, ErrLocked) {
		t.Fatalf("Current() error = %v, want ErrLocked", err)
	}

	if err := sess.Unlock(key); err != nil {
		t.Fatalf("Unlock() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() after Unlock() error = %v", err)
	}

	got := current.EntriesInPath([]string{"Root", "Internet"})
	if len(got) != 1 || got[0].Title != "Vault Console" || got[0].Password != "token-1" {
		t.Fatalf("Current() entries = %#v, want persisted Vault Console entry", got)
	}
}

func TestOpenLoadsExistingKDBXFromDisk(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Surveillance Console",
				Username: "codex",
				Password: "token-2",
				URL:      "https://surveillance.crew.example.invalid",
				Path:     []string{"Root", "Home Assistant"},
			},
		},
	}

	path := filepath.Join(t.TempDir(), "existing.kdbx")
	file, err := os.Create(path)
	if err != nil {
		t.Fatalf("Create(existing path) error = %v", err)
	}
	if err := vault.SaveKDBXWithKey(file, model, key); err != nil {
		file.Close()
		t.Fatalf("SaveKDBXWithKey() error = %v", err)
	}
	if err := file.Close(); err != nil {
		t.Fatalf("Close(existing path) error = %v", err)
	}

	var sess Manager
	if err := sess.Open(path, key); err != nil {
		t.Fatalf("Open() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() error = %v", err)
	}

	got := current.EntriesInPath([]string{"Root", "Home Assistant"})
	if len(got) != 1 || got[0].Password != "token-2" {
		t.Fatalf("Current() entries = %#v, want Home Assistant entry", got)
	}
}

func TestSavePersistsEditsBackToCurrentPath(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Vault Console",
				Username: "dannyocean",
				Password: "token-1",
				URL:      "https://vault.crew.example.invalid",
				Path:     []string{"Root", "Internet"},
			},
		},
	}

	path := filepath.Join(t.TempDir(), "editable.kdbx")

	var sess Manager
	if err := sess.Create(model, key); err != nil {
		t.Fatalf("Create() error = %v", err)
	}
	if err := sess.SaveAs(path); err != nil {
		t.Fatalf("SaveAs() error = %v", err)
	}

	updated := model
	updated.UpsertEntry(vault.Entry{
		ID:       "entry-1",
		Title:    "Vault Console",
		Username: "dannyocean",
		Password: "token-2",
		URL:      "https://vault.crew.example.invalid",
		Path:     []string{"Root", "Internet"},
	})
	sess.Replace(updated)

	if err := sess.Save(); err != nil {
		t.Fatalf("Save() error = %v", err)
	}

	reopened, err := os.Open(path)
	if err != nil {
		t.Fatalf("Open(saved path) error = %v", err)
	}
	defer reopened.Close()

	loaded, err := vault.LoadKDBXWithKey(reopened, key)
	if err != nil {
		t.Fatalf("LoadKDBXWithKey() error = %v", err)
	}

	got := loaded.EntriesInPath([]string{"Root", "Internet"})
	if len(got) != 1 || got[0].Password != "token-2" {
		t.Fatalf("loaded entries = %#v, want updated password token-2", got)
	}
}

func TestSaveWithoutPathFails(t *testing.T) {
	t.Parallel()

	var sess Manager
	if err := sess.Create(vault.Model{}, vault.MasterKey{Password: "correct horse battery staple"}); err != nil {
		t.Fatalf("Create() error = %v", err)
	}

	err := sess.Save()
	if !errors.Is(err, ErrNoPath) {
		t.Fatalf("Save() error = %v, want ErrNoPath", err)
	}
}

func TestOpenRemoteLoadsExistingKDBXFromWebDAV(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Vault Console",
				Username: "dannyocean",
				Password: "token-1",
				URL:      "https://vault.crew.example.invalid",
				Path:     []string{"Root", "Internet"},
			},
		},
	}

	var encoded bytes.Buffer
	if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
		t.Fatalf("SaveKDBXWithKey() error = %v", err)
	}

	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodGet || r.URL.Path != "/vaults/main.kdbx" {
			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
		}

		w.Header().Set("ETag", "\"v1\"")
		_, _ = w.Write(encoded.Bytes())
	}))
	defer server.Close()

	client := webdav.Client{BaseURL: server.URL}

	var sess Manager
	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
		t.Fatalf("OpenRemote() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() error = %v", err)
	}

	got := current.EntriesInPath([]string{"Root", "Internet"})
	if len(got) != 1 || got[0].Password != "token-1" {
		t.Fatalf("Current() entries = %#v, want Vault Console entry from remote vault", got)
	}
}

func TestSaveRemotePersistsEditsBackToWebDAV(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Surveillance Console",
				Username: "codex",
				Password: "token-1",
				URL:      "https://surveillance.crew.example.invalid",
				Path:     []string{"Root", "Home Assistant"},
			},
		},
	}

	var (
		savedETag  string
		savedBytes []byte
	)
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.Method {
		case http.MethodGet:
			var encoded bytes.Buffer
			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
				t.Fatalf("SaveKDBXWithKey() error = %v", err)
			}
			w.Header().Set("ETag", "\"v1\"")
			_, _ = w.Write(encoded.Bytes())
		case http.MethodPut:
			savedETag = r.Header.Get("If-Match")
			var err error
			savedBytes, err = io.ReadAll(r.Body)
			if err != nil {
				t.Fatalf("ReadAll(PUT body) error = %v", err)
			}
			w.Header().Set("ETag", "\"v2\"")
			w.WriteHeader(http.StatusNoContent)
		default:
			t.Fatalf("unexpected method %s", r.Method)
		}
	}))
	defer server.Close()

	client := webdav.Client{BaseURL: server.URL}

	var sess Manager
	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
		t.Fatalf("OpenRemote() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() error = %v", err)
	}
	current.UpsertEntry(vault.Entry{
		ID:       "entry-1",
		Title:    "Surveillance Console",
		Username: "codex",
		Password: "token-2",
		URL:      "https://surveillance.crew.example.invalid",
		Path:     []string{"Root", "Home Assistant"},
	})
	sess.Replace(current)

	if err := sess.SaveRemote(); err != nil {
		t.Fatalf("SaveRemote() error = %v", err)
	}

	if savedETag != "\"v1\"" {
		t.Fatalf("If-Match header = %q, want %q", savedETag, "\"v1\"")
	}

	loaded, err := vault.LoadKDBXWithKey(bytes.NewReader(savedBytes), key)
	if err != nil {
		t.Fatalf("LoadKDBXWithKey(savedBytes) error = %v", err)
	}

	got := loaded.EntriesInPath([]string{"Root", "Home Assistant"})
	if len(got) != 1 || got[0].Password != "token-2" {
		t.Fatalf("loaded remote entries = %#v, want updated token-2 entry", got)
	}
}

func TestSaveUsesRemoteTargetWhenVaultWasOpenedFromWebDAV(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	model := vault.Model{
		Entries: []vault.Entry{
			{
				ID:       "entry-1",
				Title:    "Vault Console",
				Username: "dannyocean",
				Password: "token-1",
				URL:      "https://vault.crew.example.invalid",
				Path:     []string{"Root", "Internet"},
			},
		},
	}

	var putCount int
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.Method {
		case http.MethodGet:
			var encoded bytes.Buffer
			if err := vault.SaveKDBXWithKey(&encoded, model, key); err != nil {
				t.Fatalf("SaveKDBXWithKey() error = %v", err)
			}
			w.Header().Set("ETag", "\"v1\"")
			_, _ = w.Write(encoded.Bytes())
		case http.MethodPut:
			putCount++
			w.Header().Set("ETag", "\"v2\"")
			w.WriteHeader(http.StatusNoContent)
		default:
			t.Fatalf("unexpected method %s", r.Method)
		}
	}))
	defer server.Close()

	client := webdav.Client{BaseURL: server.URL}

	var sess Manager
	if err := sess.OpenRemote(client, "vaults/main.kdbx", key); err != nil {
		t.Fatalf("OpenRemote() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() error = %v", err)
	}
	current.UpsertEntry(vault.Entry{
		ID:       "entry-1",
		Title:    "Vault Console",
		Username: "dannyocean",
		Password: "token-2",
		URL:      "https://vault.crew.example.invalid",
		Path:     []string{"Root", "Internet"},
	})
	sess.Replace(current)

	if err := sess.Save(); err != nil {
		t.Fatalf("Save() error = %v", err)
	}

	if putCount != 1 {
		t.Fatalf("remote PUT count = %d, want 1", putCount)
	}
}

func TestSavePreservesOpenedKDBXSecuritySettings(t *testing.T) {
	t.Parallel()

	key := vault.MasterKey{Password: "correct horse battery staple"}
	db := gokeepasslib.NewDatabase(gokeepasslib.WithDatabaseKDBXVersion4())
	db.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
	db.Content.Root.Groups = []gokeepasslib.Group{
		{
			Name: "Root",
			Entries: []gokeepasslib.Entry{
				{
					UUID: gokeepasslib.NewUUID(),
					Values: []gokeepasslib.ValueData{
						{Key: "Title", Value: gokeepasslib.V{Content: "Vault Console"}},
						{Key: "UserName", Value: gokeepasslib.V{Content: "dannyocean"}},
						{Key: "Password", Value: gokeepasslib.V{Content: "token-1", Protected: w.NewBoolWrapper(true)}},
						{Key: "URL", Value: gokeepasslib.V{Content: "https://vault.crew.example.invalid"}},
					},
				},
			},
		},
	}
	if err := db.LockProtectedEntries(); err != nil {
		t.Fatalf("LockProtectedEntries() error = %v", err)
	}

	path := filepath.Join(t.TempDir(), "kdbx4.kdbx")
	file, err := os.Create(path)
	if err != nil {
		t.Fatalf("Create(path) error = %v", err)
	}
	if err := gokeepasslib.NewEncoder(file).Encode(db); err != nil {
		file.Close()
		t.Fatalf("Encode() error = %v", err)
	}
	if err := file.Close(); err != nil {
		t.Fatalf("Close(path) error = %v", err)
	}

	var sess Manager
	if err := sess.Open(path, key); err != nil {
		t.Fatalf("Open() error = %v", err)
	}

	current, err := sess.Current()
	if err != nil {
		t.Fatalf("Current() error = %v", err)
	}
	current.UpsertEntry(vault.Entry{
		ID:       current.Entries[0].ID,
		Title:    "Vault Console",
		Username: "dannyocean",
		Password: "token-2",
		URL:      "https://vault.crew.example.invalid",
		Path:     current.Entries[0].Path,
	})
	sess.Replace(current)

	if err := sess.Save(); err != nil {
		t.Fatalf("Save() error = %v", err)
	}

	saved, err := os.Open(path)
	if err != nil {
		t.Fatalf("Open(saved path) error = %v", err)
	}
	defer saved.Close()

	reloaded := gokeepasslib.NewDatabase()
	reloaded.Credentials = gokeepasslib.NewPasswordCredentials(key.Password)
	if err := gokeepasslib.NewDecoder(saved).Decode(reloaded); err != nil {
		t.Fatalf("Decode(saved path) error = %v", err)
	}

	if !reloaded.Header.IsKdbx4() {
		t.Fatal("saved header is not KDBX4, want preserved KDBX4 format")
	}
	if !bytes.Equal(reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID) {
		t.Fatalf("saved cipher = %x, want %x", reloaded.Header.FileHeaders.CipherID, db.Header.FileHeaders.CipherID)
	}
	if !bytes.Equal(reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID) {
		t.Fatalf("saved KDF UUID = %x, want %x", reloaded.Header.FileHeaders.KdfParameters.UUID, db.Header.FileHeaders.KdfParameters.UUID)
	}
}