1519 lines
42 KiB
Go
1519 lines
42 KiB
Go
package api
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base32"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"log"
|
|
"net/http"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/johanj/clavitor/lib"
|
|
"github.com/pquerna/otp/totp"
|
|
)
|
|
|
|
// challenge holds an in-memory WebAuthn challenge.
|
|
type challenge struct {
|
|
Data []byte
|
|
Type string
|
|
CreatedAt time.Time
|
|
}
|
|
|
|
// Handlers holds dependencies for HTTP handlers.
|
|
type Handlers struct {
|
|
Cfg *lib.Config
|
|
|
|
mu sync.Mutex
|
|
challenges map[string]challenge // in-memory challenge store (key = hex of challenge bytes)
|
|
}
|
|
|
|
// NewHandlers creates a new Handlers instance.
|
|
func NewHandlers(cfg *lib.Config) *Handlers {
|
|
h := &Handlers{Cfg: cfg, challenges: make(map[string]challenge)}
|
|
go func() {
|
|
for {
|
|
time.Sleep(60 * time.Second)
|
|
h.cleanChallenges()
|
|
}
|
|
}()
|
|
return h
|
|
}
|
|
|
|
func (h *Handlers) storeChallenge(data []byte, typ string) {
|
|
h.mu.Lock()
|
|
defer h.mu.Unlock()
|
|
h.challenges[hex.EncodeToString(data)] = challenge{Data: data, Type: typ, CreatedAt: time.Now()}
|
|
}
|
|
|
|
func (h *Handlers) consumeChallenge(data []byte, typ string) error {
|
|
h.mu.Lock()
|
|
defer h.mu.Unlock()
|
|
key := hex.EncodeToString(data)
|
|
c, ok := h.challenges[key]
|
|
if !ok || c.Type != typ || time.Since(c.CreatedAt) > 5*time.Minute {
|
|
return fmt.Errorf("challenge not found or expired")
|
|
}
|
|
delete(h.challenges, key)
|
|
return nil
|
|
}
|
|
|
|
func (h *Handlers) cleanChallenges() {
|
|
h.mu.Lock()
|
|
defer h.mu.Unlock()
|
|
for k, c := range h.challenges {
|
|
if time.Since(c.CreatedAt) > 5*time.Minute {
|
|
delete(h.challenges, k)
|
|
}
|
|
}
|
|
}
|
|
|
|
// db returns the vault DB for this request (from context, set by L1Middleware).
|
|
func (h *Handlers) db(r *http.Request) *lib.DB {
|
|
return DBFromContext(r.Context())
|
|
}
|
|
|
|
// vk returns the vault key for this request (from context, set by L1Middleware).
|
|
func (h *Handlers) vk(r *http.Request) []byte {
|
|
return VaultKeyFromContext(r.Context())
|
|
}
|
|
|
|
// agent returns the agent for this request (nil = vault owner via legacy L1).
|
|
func (h *Handlers) agent(r *http.Request) *lib.Agent {
|
|
return AgentFromContext(r.Context())
|
|
}
|
|
|
|
// l1Raw returns the raw (non-normalized) L1 key from the vault key context.
|
|
// Needed for minting agent tokens that embed L1.
|
|
func (h *Handlers) l1Raw(r *http.Request) []byte {
|
|
vk := h.vk(r)
|
|
if len(vk) == 16 {
|
|
return vk[:8] // first 8 bytes of normalized key = original L1
|
|
}
|
|
return vk
|
|
}
|
|
|
|
// requireOwner rejects agent requests. Returns true if blocked (caller should return).
|
|
// Admin operations are HUMANS ONLY — hardware key required, agents forbidden.
|
|
func (h *Handlers) requireOwner(w http.ResponseWriter, r *http.Request) bool {
|
|
if IsAgentRequest(r) {
|
|
ErrorResponse(w, http.StatusForbidden, "owner_only", "This operation requires web authentication")
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// filterByScope removes entries the agent cannot access.
|
|
func filterByScope(agent *lib.Agent, entries []lib.Entry) []lib.Entry {
|
|
if agent == nil || agent.AllAccess {
|
|
return entries
|
|
}
|
|
var filtered []lib.Entry
|
|
for _, e := range entries {
|
|
if lib.AgentCanAccess(agent, e.Scopes) {
|
|
filtered = append(filtered, e)
|
|
}
|
|
}
|
|
if filtered == nil {
|
|
return []lib.Entry{}
|
|
}
|
|
return filtered
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Health & Auth
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// VaultInfo returns the vault ID for the current request.
|
|
func (h *Handlers) VaultInfo(w http.ResponseWriter, r *http.Request) {
|
|
db := h.db(r)
|
|
if db == nil {
|
|
ErrorResponse(w, http.StatusNotFound, "no_vault", "No vault initialized")
|
|
return
|
|
}
|
|
base := filepath.Base(db.DBPath)
|
|
vaultID := strings.TrimSuffix(base, ".db")
|
|
JSONResponse(w, http.StatusOK, map[string]string{"vault_id": vaultID})
|
|
}
|
|
|
|
// Version is set by main via ldflags at build time.
|
|
var Version = "dev"
|
|
|
|
// Health returns server status.
|
|
func (h *Handlers) Health(w http.ResponseWriter, r *http.Request) {
|
|
var count int
|
|
if db := h.db(r); db != nil {
|
|
count, _ = lib.EntryCount(db)
|
|
}
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"status": "ok",
|
|
"version": Version,
|
|
"entries": count,
|
|
"time": time.Now().UTC().Format(time.RFC3339),
|
|
})
|
|
}
|
|
|
|
// Setup creates a session (test-only endpoint).
|
|
func (h *Handlers) Setup(w http.ResponseWriter, r *http.Request) {
|
|
session, err := lib.SessionCreate(h.db(r), h.Cfg.SessionTTL, lib.ActorWeb)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "session_failed", "Failed to create session")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
Action: "setup",
|
|
Actor: lib.ActorWeb,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{
|
|
"token": session.Token,
|
|
})
|
|
}
|
|
|
|
// AuthStatus returns whether the vault is fresh (no credentials) or locked.
|
|
func (h *Handlers) AuthStatus(w http.ResponseWriter, r *http.Request) {
|
|
db := h.db(r)
|
|
if db == nil {
|
|
JSONResponse(w, http.StatusOK, map[string]any{"state": "fresh", "credentials": 0})
|
|
return
|
|
}
|
|
count, err := lib.WebAuthnCredentialCount(db)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "db_error", "Failed to check vault status")
|
|
return
|
|
}
|
|
state := "fresh"
|
|
if count > 0 {
|
|
state = "locked"
|
|
}
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"state": state,
|
|
"credentials": count,
|
|
})
|
|
}
|
|
|
|
// rpID returns the RP ID for WebAuthn — the hostname from the Host header, port stripped.
|
|
func rpID(r *http.Request) string {
|
|
host := r.Host
|
|
if idx := strings.Index(host, ":"); idx != -1 {
|
|
host = host[:idx]
|
|
}
|
|
return host
|
|
}
|
|
|
|
// hasValidSession checks if the request has a valid Bearer token.
|
|
func (h *Handlers) hasValidSession(r *http.Request) bool {
|
|
auth := r.Header.Get("Authorization")
|
|
if !strings.HasPrefix(auth, "Bearer ") {
|
|
return false
|
|
}
|
|
db := h.db(r)
|
|
if db == nil {
|
|
return false
|
|
}
|
|
session, err := lib.SessionGet(db, strings.TrimPrefix(auth, "Bearer "))
|
|
return err == nil && session != nil
|
|
}
|
|
|
|
// AuthRegisterBegin starts WebAuthn registration.
|
|
// First passkey: no auth needed (DB may not exist yet). Additional passkeys: valid session required.
|
|
func (h *Handlers) AuthRegisterBegin(w http.ResponseWriter, r *http.Request) {
|
|
db := h.db(r)
|
|
if db != nil {
|
|
count, _ := lib.WebAuthnCredentialCount(db)
|
|
if count > 0 && !h.hasValidSession(r) {
|
|
ErrorResponse(w, http.StatusForbidden, "already_registered", "Vault already has credentials. Authenticate first to add more.")
|
|
return
|
|
}
|
|
}
|
|
|
|
challengeBytes := make([]byte, 32)
|
|
rand.Read(challengeBytes)
|
|
h.storeChallenge(challengeBytes, "register")
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"publicKey": map[string]any{
|
|
"challenge": challengeBytes,
|
|
"rp": map[string]string{"name": "Clavitor", "id": rpID(r)},
|
|
"user": map[string]any{
|
|
"id": []byte("clavitor-owner"),
|
|
"name": "vault-owner",
|
|
"displayName": "Vault Owner",
|
|
},
|
|
"pubKeyCredParams": []map[string]any{
|
|
{"type": "public-key", "alg": -7},
|
|
{"type": "public-key", "alg": -257},
|
|
},
|
|
"authenticatorSelection": map[string]any{
|
|
"residentKey": "preferred",
|
|
"userVerification": "required",
|
|
},
|
|
"attestation": "none",
|
|
"extensions": map[string]any{
|
|
"prf": map[string]any{},
|
|
},
|
|
},
|
|
})
|
|
}
|
|
|
|
// AuthRegisterComplete finishes WebAuthn registration and creates a session.
|
|
func (h *Handlers) AuthRegisterComplete(w http.ResponseWriter, r *http.Request) {
|
|
db := h.db(r)
|
|
if db != nil {
|
|
count, _ := lib.WebAuthnCredentialCount(db)
|
|
if count > 0 && !h.hasValidSession(r) {
|
|
ErrorResponse(w, http.StatusForbidden, "already_registered", "Vault already has credentials. Authenticate first to add more.")
|
|
return
|
|
}
|
|
}
|
|
|
|
var req struct {
|
|
Challenge []byte `json:"challenge"`
|
|
CredentialID []byte `json:"credential_id"`
|
|
PublicKey []byte `json:"public_key"`
|
|
PRFSalt []byte `json:"prf_salt"`
|
|
Name string `json:"name"`
|
|
L1Key []byte `json:"l1_key"` // first 8 bytes of master, for vault DB naming
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
if err := h.consumeChallenge(req.Challenge, "register"); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_challenge", "Challenge verification failed")
|
|
return
|
|
}
|
|
|
|
// First passkey → create DB
|
|
if db == nil && len(req.PublicKey) > 0 {
|
|
// DB named from L1 key: clavitor-XXXXXX (base64url of first 4 bytes, no extension)
|
|
var dbName string
|
|
if len(req.L1Key) >= 4 {
|
|
dbName = "clavitor-" + base64UrlEncode(req.L1Key[:4])
|
|
} else {
|
|
// Fallback: derive from public key hash
|
|
hash := sha256.Sum256(req.PublicKey)
|
|
dbName = "clavitor-" + base64UrlEncode(hash[:4])
|
|
}
|
|
dbPath := filepath.Join(h.Cfg.DataDir, dbName)
|
|
newDB, err := lib.OpenDB(dbPath)
|
|
if err != nil {
|
|
log.Printf("DB create failed: path=%s err=%v", dbPath, err)
|
|
ErrorResponse(w, http.StatusInternalServerError, "db_create_failed", "Failed to create vault database")
|
|
return
|
|
}
|
|
defer newDB.Close()
|
|
if err := lib.MigrateDB(newDB); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "db_migrate_failed", "Failed to initialize vault database")
|
|
return
|
|
}
|
|
db = newDB
|
|
log.Printf("Vault created: %s", dbPath)
|
|
}
|
|
|
|
if req.Name == "" {
|
|
req.Name = "Primary Passkey"
|
|
}
|
|
cred := &lib.WebAuthnCredential{
|
|
CredID: lib.HexID(lib.NewID()),
|
|
Name: req.Name,
|
|
CredentialID: req.CredentialID,
|
|
PublicKey: req.PublicKey,
|
|
PRFSalt: req.PRFSalt,
|
|
}
|
|
if err := lib.StoreWebAuthnCredential(db, cred); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "store_failed", "Failed to store credential")
|
|
return
|
|
}
|
|
|
|
session, err := lib.SessionCreate(db, h.Cfg.SessionTTL, lib.ActorWeb)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "session_failed", "Failed to create session")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(db, &lib.AuditEvent{
|
|
Action: "register",
|
|
Actor: lib.ActorWeb,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusCreated, map[string]any{
|
|
"token": session.Token,
|
|
"cred_id": cred.CredID,
|
|
})
|
|
}
|
|
|
|
// AuthLoginBegin starts WebAuthn authentication.
|
|
func (h *Handlers) AuthLoginBegin(w http.ResponseWriter, r *http.Request) {
|
|
creds, err := lib.GetWebAuthnCredentials(h.db(r))
|
|
if err != nil || len(creds) == 0 {
|
|
ErrorResponse(w, http.StatusNotFound, "no_credentials", "No credentials registered")
|
|
return
|
|
}
|
|
|
|
challenge := make([]byte, 32)
|
|
rand.Read(challenge)
|
|
h.storeChallenge(challenge, "login")
|
|
|
|
var allowCreds []map[string]any
|
|
var prfSalt []byte
|
|
for _, c := range creds {
|
|
allowCreds = append(allowCreds, map[string]any{
|
|
"type": "public-key",
|
|
"id": c.CredentialID,
|
|
})
|
|
if len(c.PRFSalt) > 0 {
|
|
prfSalt = c.PRFSalt
|
|
}
|
|
}
|
|
|
|
prfExt := map[string]any{}
|
|
if len(prfSalt) > 0 {
|
|
prfExt["eval"] = map[string]any{"first": prfSalt}
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"publicKey": map[string]any{
|
|
"challenge": challenge,
|
|
"rpId": rpID(r),
|
|
"allowCredentials": allowCreds,
|
|
"userVerification": "required",
|
|
"extensions": map[string]any{"prf": prfExt},
|
|
},
|
|
})
|
|
}
|
|
|
|
// AuthLoginComplete finishes WebAuthn authentication and creates a session.
|
|
func (h *Handlers) AuthLoginComplete(w http.ResponseWriter, r *http.Request) {
|
|
var req struct {
|
|
Challenge []byte `json:"challenge"`
|
|
CredentialID []byte `json:"credential_id"`
|
|
SignCount int `json:"sign_count"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
if err := h.consumeChallenge(req.Challenge, "login"); err != nil {
|
|
ErrorResponse(w, http.StatusUnauthorized, "invalid_challenge", "Challenge verification failed")
|
|
return
|
|
}
|
|
|
|
cred, err := lib.GetWebAuthnCredentialByRawID(h.db(r), req.CredentialID)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusUnauthorized, "unknown_credential", "Credential not recognized")
|
|
return
|
|
}
|
|
|
|
// Cloned authenticator detection
|
|
if req.SignCount > 0 && req.SignCount <= cred.SignCount {
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
Action: "cloned_authenticator_warning",
|
|
Actor: lib.ActorWeb,
|
|
IPAddr: realIP(r),
|
|
})
|
|
}
|
|
lib.UpdateWebAuthnSignCount(h.db(r), int64(cred.CredID), req.SignCount)
|
|
|
|
session, err := lib.SessionCreate(h.db(r), h.Cfg.SessionTTL, lib.ActorWeb)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "session_failed", "Failed to create session")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
Action: "login",
|
|
Actor: lib.ActorWeb,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"token": session.Token,
|
|
})
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Entry CRUD
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// ListEntries returns all entries, filtered by agent scope.
|
|
func (h *Handlers) ListEntries(w http.ResponseWriter, r *http.Request) {
|
|
agent := h.agent(r)
|
|
actor := ActorFromContext(r.Context())
|
|
|
|
// Metadata-only mode
|
|
if r.URL.Query().Get("meta") == "1" {
|
|
entries, err := lib.EntryListMeta(h.db(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list entries")
|
|
return
|
|
}
|
|
if entries == nil {
|
|
entries = []lib.Entry{}
|
|
}
|
|
entries = filterByScope(agent, entries)
|
|
JSONResponse(w, http.StatusOK, entries)
|
|
return
|
|
}
|
|
|
|
var parent *int64
|
|
if pidStr := r.URL.Query().Get("parent_id"); pidStr != "" {
|
|
pid, err := lib.HexToID(pidStr)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid parent_id")
|
|
return
|
|
}
|
|
parent = &pid
|
|
}
|
|
|
|
entries, err := lib.EntryList(h.db(r), h.vk(r), parent)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list entries")
|
|
return
|
|
}
|
|
if entries == nil {
|
|
entries = []lib.Entry{}
|
|
}
|
|
|
|
entries = filterByScope(agent, entries)
|
|
|
|
if actor == lib.ActorAgent {
|
|
for i := range entries {
|
|
if entries[i].VaultData != nil {
|
|
stripL2Fields(entries[i].VaultData)
|
|
}
|
|
}
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, entries)
|
|
}
|
|
|
|
// GetEntry returns a single entry (scope-checked).
|
|
func (h *Handlers) GetEntry(w http.ResponseWriter, r *http.Request) {
|
|
agent := h.agent(r)
|
|
actor := ActorFromContext(r.Context())
|
|
entryID, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid entry ID")
|
|
return
|
|
}
|
|
|
|
entry, err := lib.EntryGet(h.db(r), h.vk(r), entryID)
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Entry not found")
|
|
return
|
|
}
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get entry")
|
|
return
|
|
}
|
|
|
|
if entry.DeletedAt != nil {
|
|
ErrorResponse(w, http.StatusNotFound, "deleted", "Entry has been deleted")
|
|
return
|
|
}
|
|
|
|
if !lib.AgentCanAccess(agent, entry.Scopes) {
|
|
ErrorResponse(w, http.StatusForbidden, "forbidden", "Access denied")
|
|
return
|
|
}
|
|
|
|
if actor == lib.ActorAgent && entry.VaultData != nil {
|
|
stripL2Fields(entry.VaultData)
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: entry.EntryID,
|
|
Title: entry.Title,
|
|
Action: lib.ActionRead,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, entry)
|
|
}
|
|
|
|
// CreateEntry creates a new entry.
|
|
func (h *Handlers) CreateEntry(w http.ResponseWriter, r *http.Request) {
|
|
actor := ActorFromContext(r.Context())
|
|
|
|
var req struct {
|
|
Type string `json:"type"`
|
|
Title string `json:"title"`
|
|
ParentID lib.HexID `json:"parent_id"`
|
|
Data *lib.VaultData `json:"data"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
if req.Title == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "missing_title", "Title is required")
|
|
return
|
|
}
|
|
if req.Type == "" {
|
|
req.Type = lib.TypeCredential
|
|
}
|
|
|
|
entry := &lib.Entry{
|
|
Type: req.Type,
|
|
Title: req.Title,
|
|
ParentID: req.ParentID,
|
|
DataLevel: lib.DataLevelL1,
|
|
VaultData: req.Data,
|
|
}
|
|
|
|
if err := lib.EntryCreate(h.db(r), h.vk(r), entry); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "create_failed", "Failed to create entry")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: entry.EntryID,
|
|
Title: entry.Title,
|
|
Action: lib.ActionCreate,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusCreated, entry)
|
|
}
|
|
|
|
// UpsertEntry creates or updates an entry by title match (case-insensitive).
|
|
// If an entry with the same title exists, it is updated. Otherwise, a new entry is created.
|
|
func (h *Handlers) UpsertEntry(w http.ResponseWriter, r *http.Request) {
|
|
actor := ActorFromContext(r.Context())
|
|
|
|
var req struct {
|
|
Type string `json:"type"`
|
|
Title string `json:"title"`
|
|
ParentID lib.HexID `json:"parent_id"`
|
|
Data *lib.VaultData `json:"data"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
if req.Title == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "missing_title", "Title is required")
|
|
return
|
|
}
|
|
if req.Type == "" {
|
|
req.Type = lib.TypeCredential
|
|
}
|
|
|
|
// Search for existing entry with same title
|
|
existing, err := lib.EntrySearchFuzzy(h.db(r), h.vk(r), req.Title)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "search_failed", "Failed to search entries")
|
|
return
|
|
}
|
|
|
|
// Find exact title match (case-insensitive)
|
|
var match *lib.Entry
|
|
for i := range existing {
|
|
if strings.EqualFold(existing[i].Title, req.Title) {
|
|
match = &existing[i]
|
|
break
|
|
}
|
|
}
|
|
|
|
if match != nil {
|
|
// Update existing
|
|
match.Title = req.Title
|
|
match.Type = req.Type
|
|
match.ParentID = req.ParentID
|
|
if req.Data != nil {
|
|
match.VaultData = req.Data
|
|
}
|
|
if err := lib.EntryUpdate(h.db(r), h.vk(r), match); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "update_failed", "Failed to update entry")
|
|
return
|
|
}
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: match.EntryID,
|
|
Title: match.Title,
|
|
Action: lib.ActionUpdate,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
JSONResponse(w, http.StatusOK, match)
|
|
} else {
|
|
// Create new
|
|
entry := &lib.Entry{
|
|
Type: req.Type,
|
|
Title: req.Title,
|
|
ParentID: req.ParentID,
|
|
DataLevel: lib.DataLevelL1,
|
|
VaultData: req.Data,
|
|
}
|
|
if err := lib.EntryCreate(h.db(r), h.vk(r), entry); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "create_failed", "Failed to create entry")
|
|
return
|
|
}
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: entry.EntryID,
|
|
Title: entry.Title,
|
|
Action: lib.ActionCreate,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
JSONResponse(w, http.StatusCreated, entry)
|
|
}
|
|
}
|
|
|
|
// UpdateEntry updates an existing entry.
|
|
func (h *Handlers) UpdateEntry(w http.ResponseWriter, r *http.Request) {
|
|
actor := ActorFromContext(r.Context())
|
|
entryID, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid entry ID")
|
|
return
|
|
}
|
|
|
|
var req struct {
|
|
Type string `json:"type"`
|
|
Title string `json:"title"`
|
|
ParentID lib.HexID `json:"parent_id"`
|
|
Version int `json:"version"`
|
|
Data *lib.VaultData `json:"data"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
// Get existing entry
|
|
existing, err := lib.EntryGet(h.db(r), h.vk(r), entryID)
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Entry not found")
|
|
return
|
|
}
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get entry")
|
|
return
|
|
}
|
|
|
|
// Update fields
|
|
if req.Title != "" {
|
|
existing.Title = req.Title
|
|
}
|
|
if req.Type != "" {
|
|
existing.Type = req.Type
|
|
}
|
|
existing.ParentID = req.ParentID
|
|
existing.Version = req.Version
|
|
if req.Data != nil {
|
|
existing.VaultData = req.Data
|
|
}
|
|
|
|
if err := lib.EntryUpdate(h.db(r), h.vk(r), existing); err != nil {
|
|
if err == lib.ErrVersionConflict {
|
|
ErrorResponse(w, http.StatusConflict, "version_conflict", err.Error())
|
|
return
|
|
}
|
|
ErrorResponse(w, http.StatusInternalServerError, "update_failed", "Failed to update entry")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: existing.EntryID,
|
|
Title: existing.Title,
|
|
Action: lib.ActionUpdate,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, existing)
|
|
}
|
|
|
|
// DeleteEntry soft-deletes an entry.
|
|
func (h *Handlers) DeleteEntry(w http.ResponseWriter, r *http.Request) {
|
|
actor := ActorFromContext(r.Context())
|
|
entryID, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid entry ID")
|
|
return
|
|
}
|
|
|
|
// Get entry for audit log
|
|
entry, _ := lib.EntryGet(h.db(r), h.vk(r), entryID)
|
|
|
|
if err := lib.EntryDelete(h.db(r), entryID); err != nil {
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Entry not found")
|
|
return
|
|
}
|
|
ErrorResponse(w, http.StatusInternalServerError, "delete_failed", "Failed to delete entry")
|
|
return
|
|
}
|
|
|
|
title := ""
|
|
if entry != nil {
|
|
title = entry.Title
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: lib.HexID(entryID),
|
|
Title: title,
|
|
Action: lib.ActionDelete,
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "deleted"})
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Search
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// SearchEntries searches entries by title (scope-filtered).
|
|
func (h *Handlers) SearchEntries(w http.ResponseWriter, r *http.Request) {
|
|
agent := h.agent(r)
|
|
actor := ActorFromContext(r.Context())
|
|
query := r.URL.Query().Get("q")
|
|
if query == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "missing_query", "Query parameter 'q' is required")
|
|
return
|
|
}
|
|
|
|
entries, err := lib.EntrySearchFuzzy(h.db(r), h.vk(r), query)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "search_failed", "Search failed")
|
|
return
|
|
}
|
|
if entries == nil {
|
|
entries = []lib.Entry{}
|
|
}
|
|
|
|
entries = filterByScope(agent, entries)
|
|
|
|
if actor == lib.ActorAgent {
|
|
for i := range entries {
|
|
if entries[i].VaultData != nil {
|
|
stripL2Fields(entries[i].VaultData)
|
|
}
|
|
}
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, entries)
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Password Generator
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// GeneratePassword generates a random password.
|
|
func (h *Handlers) GeneratePassword(w http.ResponseWriter, r *http.Request) {
|
|
lengthStr := r.URL.Query().Get("length")
|
|
length := 20
|
|
if lengthStr != "" {
|
|
if l, err := strconv.Atoi(lengthStr); err == nil && l > 0 && l <= 128 {
|
|
length = l
|
|
}
|
|
}
|
|
|
|
symbols := r.URL.Query().Get("symbols") != "false"
|
|
wordsParam := r.URL.Query().Get("words")
|
|
wordsN := 0
|
|
if wordsParam == "true" {
|
|
wordsN = 4
|
|
} else if n, err := strconv.Atoi(wordsParam); err == nil && n > 0 {
|
|
wordsN = n
|
|
}
|
|
|
|
var password string
|
|
if wordsN > 0 {
|
|
password = generatePassphrase(wordsN)
|
|
} else {
|
|
password = generatePassword(length, symbols)
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{
|
|
"password": password,
|
|
})
|
|
}
|
|
|
|
func generatePassword(length int, symbols bool) string {
|
|
const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
|
const digits = "0123456789"
|
|
const syms = "!@#$%^&*()_+-=[]{}|;:,.<>?"
|
|
|
|
charset := letters + digits
|
|
if symbols {
|
|
charset += syms
|
|
}
|
|
|
|
b := make([]byte, length)
|
|
rand.Read(b)
|
|
for i := range b {
|
|
b[i] = charset[int(b[i])%len(charset)]
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
func generatePassphrase(words int) string {
|
|
wordList := []string{
|
|
"correct", "horse", "battery", "staple", "cloud", "mountain",
|
|
"river", "forest", "castle", "dragon", "phoenix", "crystal",
|
|
"shadow", "thunder", "whisper", "harvest", "journey", "compass",
|
|
"anchor", "beacon", "bridge", "canyon", "desert", "empire",
|
|
}
|
|
b := make([]byte, words)
|
|
rand.Read(b)
|
|
parts := make([]string, words)
|
|
for i := range parts {
|
|
parts[i] = wordList[int(b[i])%len(wordList)]
|
|
}
|
|
return strings.Join(parts, "-")
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Extension API
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// GetTOTP generates a live TOTP code for an entry (scope-checked).
|
|
func (h *Handlers) GetTOTP(w http.ResponseWriter, r *http.Request) {
|
|
agent := h.agent(r)
|
|
actor := ActorFromContext(r.Context())
|
|
entryID, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid entry ID")
|
|
return
|
|
}
|
|
|
|
entry, err := lib.EntryGet(h.db(r), h.vk(r), entryID)
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Entry not found")
|
|
return
|
|
}
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get entry")
|
|
return
|
|
}
|
|
|
|
if !lib.AgentCanAccess(agent, entry.Scopes) {
|
|
ErrorResponse(w, http.StatusForbidden, "forbidden", "Access denied")
|
|
return
|
|
}
|
|
|
|
if entry.VaultData == nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "no_totp", "Entry has no TOTP field")
|
|
return
|
|
}
|
|
|
|
// Find TOTP field
|
|
var totpSeed string
|
|
var isL2 bool
|
|
for _, field := range entry.VaultData.Fields {
|
|
if field.Kind == "totp" {
|
|
if field.L2 {
|
|
isL2 = true
|
|
} else {
|
|
totpSeed = field.Value
|
|
}
|
|
break
|
|
}
|
|
}
|
|
|
|
if isL2 {
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"l2": true,
|
|
})
|
|
return
|
|
}
|
|
|
|
if totpSeed == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "no_totp", "Entry has no TOTP field")
|
|
return
|
|
}
|
|
|
|
// Normalize seed (remove spaces, uppercase)
|
|
totpSeed = strings.ToUpper(strings.ReplaceAll(totpSeed, " ", ""))
|
|
|
|
// Generate TOTP code
|
|
code, err := totp.GenerateCode(totpSeed, time.Now())
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_totp", "Invalid TOTP seed")
|
|
return
|
|
}
|
|
|
|
// Calculate time until expiry (30 second window)
|
|
now := time.Now().Unix()
|
|
expiresIn := 30 - (now % 30)
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: entry.EntryID,
|
|
Title: entry.Title,
|
|
Action: "totp",
|
|
Actor: actor,
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]any{
|
|
"code": code,
|
|
"expires_in": expiresIn,
|
|
"l2": false,
|
|
})
|
|
}
|
|
|
|
// MatchURL finds credentials matching a URL (scope-filtered).
|
|
func (h *Handlers) MatchURL(w http.ResponseWriter, r *http.Request) {
|
|
agent := h.agent(r)
|
|
urlStr := r.URL.Query().Get("url")
|
|
if urlStr == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "missing_url", "URL parameter required")
|
|
return
|
|
}
|
|
|
|
domain := extractDomain(urlStr)
|
|
|
|
entries, err := lib.EntryList(h.db(r), h.vk(r), nil)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list entries")
|
|
return
|
|
}
|
|
|
|
var matches []lib.Entry
|
|
for _, entry := range entries {
|
|
if !lib.AgentCanAccess(agent, entry.Scopes) {
|
|
continue
|
|
}
|
|
if entry.VaultData == nil {
|
|
continue
|
|
}
|
|
for _, u := range entry.VaultData.URLs {
|
|
if strings.Contains(u, domain) || strings.Contains(domain, extractDomain(u)) {
|
|
matches = append(matches, entry)
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
if matches == nil {
|
|
matches = []lib.Entry{}
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, matches)
|
|
}
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Audit Log
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// GetAuditLog returns recent audit events.
|
|
func (h *Handlers) GetAuditLog(w http.ResponseWriter, r *http.Request) {
|
|
limitStr := r.URL.Query().Get("limit")
|
|
limit := 100
|
|
if limitStr != "" {
|
|
if l, err := strconv.Atoi(limitStr); err == nil && l > 0 {
|
|
limit = l
|
|
}
|
|
}
|
|
|
|
events, err := lib.AuditList(h.db(r), limit)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list audit events")
|
|
return
|
|
}
|
|
if events == nil {
|
|
events = []lib.AuditEvent{}
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, events)
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// WebAuthn PRF
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// HandleWebAuthnRegisterBegin starts WebAuthn registration.
|
|
func (h *Handlers) HandleWebAuthnRegisterBegin(w http.ResponseWriter, r *http.Request) {
|
|
// Generate a challenge
|
|
challenge := make([]byte, 32)
|
|
rand.Read(challenge)
|
|
|
|
options := map[string]any{
|
|
"publicKey": map[string]any{
|
|
"challenge": challenge,
|
|
"rp": map[string]string{"name": "Clavitor", "id": rpID(r)},
|
|
"user": map[string]any{
|
|
"id": []byte("clavitor-owner"),
|
|
"name": "vault-owner",
|
|
"displayName": "Clavitor Owner",
|
|
},
|
|
"pubKeyCredParams": []map[string]any{
|
|
{"type": "public-key", "alg": -7}, // ES256
|
|
{"type": "public-key", "alg": -257}, // RS256
|
|
},
|
|
"authenticatorSelection": map[string]any{
|
|
"residentKey": "preferred",
|
|
"userVerification": "required",
|
|
},
|
|
"extensions": map[string]any{
|
|
"prf": map[string]any{},
|
|
},
|
|
},
|
|
}
|
|
JSONResponse(w, http.StatusOK, options)
|
|
}
|
|
|
|
// HandleWebAuthnRegisterComplete finishes WebAuthn registration.
|
|
func (h *Handlers) HandleWebAuthnRegisterComplete(w http.ResponseWriter, r *http.Request) {
|
|
var req struct {
|
|
CredID string `json:"cred_id"`
|
|
PublicKey []byte `json:"public_key"`
|
|
PRFSalt []byte `json:"prf_salt"`
|
|
Name string `json:"name"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
// Decode the base64url credential ID from the browser
|
|
credentialID, err := base64.RawURLEncoding.DecodeString(req.CredID)
|
|
if err != nil {
|
|
credentialID = []byte{}
|
|
}
|
|
|
|
cred := &lib.WebAuthnCredential{
|
|
CredID: lib.HexID(lib.NewID()),
|
|
Name: req.Name,
|
|
PublicKey: req.PublicKey,
|
|
CredentialID: credentialID,
|
|
PRFSalt: req.PRFSalt,
|
|
}
|
|
if err := lib.StoreWebAuthnCredential(h.db(r), cred); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "store_failed", "Failed to store credential")
|
|
return
|
|
}
|
|
|
|
JSONResponse(w, http.StatusCreated, map[string]any{"status": "registered", "cred_id": cred.CredID})
|
|
}
|
|
|
|
// HandleWebAuthnAuthBegin starts WebAuthn authentication with PRF extension.
|
|
func (h *Handlers) HandleWebAuthnAuthBegin(w http.ResponseWriter, r *http.Request) {
|
|
creds, err := lib.GetWebAuthnCredentials(h.db(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get credentials")
|
|
return
|
|
}
|
|
|
|
challenge := make([]byte, 32)
|
|
rand.Read(challenge)
|
|
|
|
var allowCreds []map[string]any
|
|
var prfSalt []byte
|
|
for _, c := range creds {
|
|
allowCreds = append(allowCreds, map[string]any{
|
|
"type": "public-key",
|
|
"id": c.CredID,
|
|
})
|
|
if len(c.PRFSalt) > 0 {
|
|
prfSalt = c.PRFSalt
|
|
}
|
|
}
|
|
|
|
prfExt := map[string]any{}
|
|
if len(prfSalt) > 0 {
|
|
prfExt["eval"] = map[string]any{
|
|
"first": prfSalt,
|
|
}
|
|
}
|
|
|
|
options := map[string]any{
|
|
"publicKey": map[string]any{
|
|
"challenge": challenge,
|
|
"allowCredentials": allowCreds,
|
|
"userVerification": "required",
|
|
"extensions": map[string]any{
|
|
"prf": prfExt,
|
|
},
|
|
},
|
|
}
|
|
JSONResponse(w, http.StatusOK, options)
|
|
}
|
|
|
|
// HandleWebAuthnAuthComplete finishes WebAuthn authentication.
|
|
func (h *Handlers) HandleWebAuthnAuthComplete(w http.ResponseWriter, r *http.Request) {
|
|
var req struct {
|
|
CredID lib.HexID `json:"cred_id"`
|
|
SignCount int `json:"sign_count"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
if err := lib.UpdateWebAuthnSignCount(h.db(r), int64(req.CredID), req.SignCount); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "update_failed", "Failed to update sign count")
|
|
return
|
|
}
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "authenticated"})
|
|
}
|
|
|
|
// HandleListWebAuthnCredentials returns all registered WebAuthn credentials.
|
|
func (h *Handlers) HandleListWebAuthnCredentials(w http.ResponseWriter, r *http.Request) {
|
|
creds, err := lib.GetWebAuthnCredentials(h.db(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list credentials")
|
|
return
|
|
}
|
|
if creds == nil {
|
|
creds = []lib.WebAuthnCredential{}
|
|
}
|
|
JSONResponse(w, http.StatusOK, creds)
|
|
}
|
|
|
|
// HandleDeleteWebAuthnCredential removes a WebAuthn credential.
|
|
func (h *Handlers) HandleDeleteWebAuthnCredential(w http.ResponseWriter, r *http.Request) {
|
|
id, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid credential ID")
|
|
return
|
|
}
|
|
if err := lib.DeleteWebAuthnCredential(h.db(r), id); err != nil {
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Credential not found")
|
|
return
|
|
}
|
|
ErrorResponse(w, http.StatusInternalServerError, "delete_failed", "Failed to delete credential")
|
|
return
|
|
}
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "deleted"})
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
func stripL2Fields(vd *lib.VaultData) {
|
|
for i := range vd.Fields {
|
|
if vd.Fields[i].L2 {
|
|
vd.Fields[i].Value = "[REDACTED — not available to agents]"
|
|
}
|
|
}
|
|
}
|
|
|
|
func extractDomain(urlStr string) string {
|
|
// Simple domain extraction
|
|
urlStr = strings.TrimPrefix(urlStr, "https://")
|
|
urlStr = strings.TrimPrefix(urlStr, "http://")
|
|
urlStr = strings.TrimPrefix(urlStr, "www.")
|
|
if idx := strings.Index(urlStr, "/"); idx > 0 {
|
|
urlStr = urlStr[:idx]
|
|
}
|
|
if idx := strings.Index(urlStr, ":"); idx > 0 {
|
|
urlStr = urlStr[:idx]
|
|
}
|
|
return urlStr
|
|
}
|
|
|
|
// generateTOTPSecret generates a new TOTP secret.
|
|
func generateTOTPSecret() string {
|
|
b := make([]byte, 20)
|
|
rand.Read(b)
|
|
return base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b)
|
|
}
|
|
|
|
// --- Backup / Restore ---
|
|
|
|
// ListBackups returns all available backup files.
|
|
func (h *Handlers) ListBackups(w http.ResponseWriter, r *http.Request) {
|
|
backups := lib.ListBackups(h.Cfg.DataDir)
|
|
JSONResponse(w, http.StatusOK, backups)
|
|
}
|
|
|
|
// CreateBackup triggers an immediate backup.
|
|
func (h *Handlers) CreateBackup(w http.ResponseWriter, r *http.Request) {
|
|
lib.RunBackups(h.Cfg.DataDir)
|
|
backups := lib.ListBackups(h.Cfg.DataDir)
|
|
JSONResponse(w, http.StatusOK, backups)
|
|
}
|
|
|
|
// RestoreBackup restores from a named backup file.
|
|
func (h *Handlers) RestoreBackup(w http.ResponseWriter, r *http.Request) {
|
|
var req struct {
|
|
Name string `json:"name"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.Name == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_request", "Backup name required")
|
|
return
|
|
}
|
|
if err := lib.RestoreBackup(h.Cfg.DataDir, req.Name); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "restore_error", err.Error())
|
|
return
|
|
}
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "restored", "name": req.Name})
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Agent Management
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// HandleCreateAgent creates a new agent. OWNER ONLY.
|
|
// POST /api/agents
|
|
func (h *Handlers) HandleCreateAgent(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
|
|
var req struct {
|
|
Name string `json:"name"`
|
|
Scopes string `json:"scopes"` // "auto" or comma-separated hex, default auto
|
|
AllAccess bool `json:"all_access"`
|
|
Admin bool `json:"admin"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
if req.Name == "" {
|
|
ErrorResponse(w, http.StatusBadRequest, "missing_name", "Name is required")
|
|
return
|
|
}
|
|
if len(req.Name) > 100 {
|
|
ErrorResponse(w, http.StatusBadRequest, "name_too_long", "Name must be 100 characters or less")
|
|
return
|
|
}
|
|
|
|
db := h.db(r)
|
|
scopes := req.Scopes
|
|
if scopes == "" {
|
|
scopes = "auto"
|
|
}
|
|
|
|
agent, rawToken, err := lib.AgentCreate(db, req.Name, scopes, req.AllAccess, req.Admin, h.l1Raw(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "create_failed", "Failed to create agent")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(db, &lib.AuditEvent{
|
|
Action: lib.ActionAgentCreate,
|
|
Actor: ActorFromContext(r.Context()),
|
|
IPAddr: realIP(r),
|
|
Title: agent.Name,
|
|
})
|
|
|
|
// Return agent info + raw token (shown ONCE, never retrievable again)
|
|
JSONResponse(w, http.StatusCreated, map[string]any{
|
|
"id": agent.ID,
|
|
"scope": agent.ScopeHex(),
|
|
"name": agent.Name,
|
|
"scopes": agent.Scopes,
|
|
"all_access": agent.AllAccess,
|
|
"admin": agent.Admin,
|
|
"token": rawToken,
|
|
})
|
|
}
|
|
|
|
// HandleListAgents lists all agents. OWNER ONLY.
|
|
// GET /api/agents
|
|
func (h *Handlers) HandleListAgents(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
agents, err := lib.AgentList(h.db(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "list_failed", "Failed to list agents")
|
|
return
|
|
}
|
|
if agents == nil {
|
|
agents = []lib.Agent{}
|
|
}
|
|
JSONResponse(w, http.StatusOK, agents)
|
|
}
|
|
|
|
// HandleGetAgent returns a single agent. OWNER ONLY.
|
|
// GET /api/agents/{id}
|
|
func (h *Handlers) HandleGetAgent(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid agent ID")
|
|
return
|
|
}
|
|
a, err := lib.AgentGet(h.db(r), id)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get agent")
|
|
return
|
|
}
|
|
if a == nil {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Agent not found")
|
|
return
|
|
}
|
|
JSONResponse(w, http.StatusOK, a)
|
|
}
|
|
|
|
// HandleUpdateAgent updates an agent's name, scopes, flags. OWNER ONLY.
|
|
// PUT /api/agents/{id}
|
|
func (h *Handlers) HandleUpdateAgent(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid agent ID")
|
|
return
|
|
}
|
|
|
|
var req struct {
|
|
Name string `json:"name"`
|
|
Scopes string `json:"scopes"`
|
|
AllAccess bool `json:"all_access"`
|
|
Admin bool `json:"admin"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
db := h.db(r)
|
|
a, err := lib.AgentGet(db, id)
|
|
if err != nil || a == nil {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Agent not found")
|
|
return
|
|
}
|
|
|
|
if err := lib.AgentUpdate(db, id, req.Name, req.Scopes, req.AllAccess, req.Admin); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "update_failed", "Failed to update agent")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(db, &lib.AuditEvent{
|
|
Action: "agent_update",
|
|
Actor: ActorFromContext(r.Context()),
|
|
IPAddr: realIP(r),
|
|
Title: a.Name,
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "updated"})
|
|
}
|
|
|
|
// HandleDeleteAgent deletes an agent. OWNER ONLY.
|
|
// DELETE /api/agents/{id}
|
|
func (h *Handlers) HandleDeleteAgent(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid agent ID")
|
|
return
|
|
}
|
|
|
|
db := h.db(r)
|
|
a, err := lib.AgentGet(db, id)
|
|
if err != nil || a == nil {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Agent not found")
|
|
return
|
|
}
|
|
|
|
if err := lib.AgentDelete(db, id); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "delete_failed", "Failed to delete agent")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(db, &lib.AuditEvent{
|
|
Action: lib.ActionAgentRevoke,
|
|
Actor: ActorFromContext(r.Context()),
|
|
IPAddr: realIP(r),
|
|
Title: a.Name,
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "deleted"})
|
|
}
|
|
|
|
// HandleUpdateEntryScopes updates only the scopes of an entry. OWNER ONLY.
|
|
// PUT /api/entries/{id}/scopes
|
|
func (h *Handlers) HandleUpdateEntryScopes(w http.ResponseWriter, r *http.Request) {
|
|
if h.requireOwner(w, r) {
|
|
return
|
|
}
|
|
entryID, err := lib.HexToID(chi.URLParam(r, "id"))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_id", "Invalid entry ID")
|
|
return
|
|
}
|
|
|
|
var req struct {
|
|
Scopes string `json:"scopes"`
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
ErrorResponse(w, http.StatusBadRequest, "invalid_json", "Invalid request body")
|
|
return
|
|
}
|
|
|
|
if err := lib.EntryUpdateScopes(h.db(r), entryID, req.Scopes); err != nil {
|
|
if err == lib.ErrNotFound {
|
|
ErrorResponse(w, http.StatusNotFound, "not_found", "Entry not found")
|
|
return
|
|
}
|
|
ErrorResponse(w, http.StatusInternalServerError, "update_failed", "Failed to update scopes")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(h.db(r), &lib.AuditEvent{
|
|
EntryID: lib.HexID(entryID),
|
|
Action: "entry_scopes_update",
|
|
Actor: ActorFromContext(r.Context()),
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "updated"})
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Vault Lock
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// HandleVaultLockStatus returns the vault lock state.
|
|
// GET /api/vault-lock
|
|
func (h *Handlers) HandleVaultLockStatus(w http.ResponseWriter, r *http.Request) {
|
|
vl, err := lib.VaultLockGet(h.db(r))
|
|
if err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "get_failed", "Failed to get vault lock status")
|
|
return
|
|
}
|
|
JSONResponse(w, http.StatusOK, vl)
|
|
}
|
|
|
|
// HandleVaultUnlock unlocks the vault.
|
|
// POST /api/vault-unlock
|
|
func (h *Handlers) HandleVaultUnlock(w http.ResponseWriter, r *http.Request) {
|
|
db := h.db(r)
|
|
if err := lib.VaultLockSet(db, false, ""); err != nil {
|
|
ErrorResponse(w, http.StatusInternalServerError, "unlock_failed", "Failed to unlock vault")
|
|
return
|
|
}
|
|
|
|
lib.AuditLog(db, &lib.AuditEvent{
|
|
Action: "vault_unlock",
|
|
Actor: ActorFromContext(r.Context()),
|
|
IPAddr: realIP(r),
|
|
})
|
|
|
|
JSONResponse(w, http.StatusOK, map[string]string{"status": "unlocked"})
|
|
}
|