Initial ClawVault: entry model, L1 crypto, CRUD API, web UI, extension scaffold
Features: - Two-tier encryption (L1 server-side, L2 client-side placeholder) - SQLite with WAL mode - HKDF per-entry key derivation - zstd + AES-256-GCM encryption - HMAC-SHA256 blind indexes for search - Session-based auth - Full CRUD API - Password generator (random + passphrase) - TOTP generation (L1 only, L2 returns flag) - LLM import endpoint (Fireworks) - LLM field mapping endpoint - MCP JSON-RPC endpoint with 5 tools - Vanilla JS web UI (Tailwind, dark theme) - Chrome extension scaffold (MV3) - Audit logging Day 2: WebAuthn PRF, extension autofill, full L2 flow
This commit is contained in:
James (AI)
commit
0ff6db74cb
|
|
@ -0,0 +1,22 @@
|
|||
# Binaries (only at root)
|
||||
/clawvault
|
||||
*.exe
|
||||
|
||||
# Database
|
||||
*.db
|
||||
*.db-journal
|
||||
*.db-wal
|
||||
*.db-shm
|
||||
|
||||
# IDE
|
||||
.idea/
|
||||
.vscode/
|
||||
*.swp
|
||||
*.swo
|
||||
|
||||
# OS
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# Test files
|
||||
/tmp/
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
# ClawVault
|
||||
|
||||
A personal vault with two-tier encryption for AI assistants.
|
||||
|
||||
## Features
|
||||
|
||||
- **Two-tier encryption**: L1 (server-side, AI-readable) + L2 (client-side only)
|
||||
- **Single binary**: Go, cross-compiles, one port (default 8765)
|
||||
- **Single file**: SQLite database, portable
|
||||
- **LLM-powered import**: Parse any password manager export format
|
||||
- **LLM field mapping**: Smart autofill via Chrome extension
|
||||
- **MCP endpoint**: AI assistant integration
|
||||
- **TOTP generation**: Live TOTP codes for L1 entries
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Generate vault key
|
||||
export VAULT_KEY=$(openssl rand -hex 32)
|
||||
export PORT=8765
|
||||
export DB_PATH=./clawvault.db
|
||||
|
||||
# Run
|
||||
./clawvault
|
||||
```
|
||||
|
||||
## Building
|
||||
|
||||
```bash
|
||||
CGO_ENABLED=1 go build ./cmd/clawvault
|
||||
```
|
||||
|
||||
## API Endpoints
|
||||
|
||||
- `GET /health` - Health check
|
||||
- `POST /api/auth/setup` - Initialize session
|
||||
- `GET/POST /api/entries` - CRUD entries
|
||||
- `GET /api/search?q=` - Search entries
|
||||
- `GET /api/generate` - Password generator
|
||||
- `POST /api/import` - LLM import
|
||||
- `GET /api/ext/totp/:id` - TOTP codes
|
||||
- `GET /api/ext/match?url=` - URL matching
|
||||
- `POST /api/ext/map` - LLM field mapping
|
||||
- `POST /mcp` - MCP JSON-RPC endpoint
|
||||
- `GET /api/audit` - Audit log
|
||||
|
||||
## Chrome Extension
|
||||
|
||||
Load `/extension` as unpacked extension in Chrome.
|
||||
|
||||
## License
|
||||
|
||||
Private - Johan Jongsma
|
||||
|
|
@ -0,0 +1,388 @@
|
|||
# ClawVault — SPEC v0.1
|
||||
|
||||
*A personal vault built for humans who have AI assistants.*
|
||||
|
||||
---
|
||||
|
||||
## The Problem
|
||||
|
||||
Existing password managers are built for human→human sharing.
|
||||
The AI assistant use case is different:
|
||||
- Your AI needs ~30 of your 500 credentials to do its job
|
||||
- Some credentials should never reach an AI regardless of trust
|
||||
- Card numbers, CVV, passport data — client-side decrypt only
|
||||
- Everything else — AI can read, use, act on
|
||||
|
||||
Bitwarden MCP server exists but is all-or-nothing. Nothing has two-tier encryption
|
||||
with field-level AI visibility, WebAuthn unlock, and LLM-powered field mapping.
|
||||
|
||||
---
|
||||
|
||||
## Design Principles
|
||||
|
||||
1. **One binary** — Go, cross-compiles mac/linux/windows, single port
|
||||
2. **One file** — SQLite DB, platform-independent, portable
|
||||
3. **Entry model** — same tree as inou/dealspace: everything is an entry
|
||||
4. **Two-tier encryption** — L1 (server key, AI-readable) + L2 (client-side WebAuthn only)
|
||||
5. **LLM import** — any format, no format-specific parsers
|
||||
6. **LLM field mapping** — extension fills forms intelligently
|
||||
7. **No external dependencies** — no cloud, no subscriptions
|
||||
|
||||
---
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
clawvault/
|
||||
├── cmd/clawvault/main.go # single entrypoint
|
||||
├── api/ # REST + MCP handlers
|
||||
├── lib/ # crypto, dbcore, types
|
||||
├── web/ # embedded SPA (go:embed, vanilla JS)
|
||||
└── extension/ # Chrome extension (no build step)
|
||||
```
|
||||
|
||||
Single binary, one port (default 8765):
|
||||
- `GET /` → embedded web UI
|
||||
- `/api/*` → REST API
|
||||
- `/mcp` → MCP endpoint (AI, L1 only)
|
||||
- `/ext/*` → extension API (full access)
|
||||
|
||||
---
|
||||
|
||||
## Data Model
|
||||
|
||||
### Entry table (single table for everything)
|
||||
|
||||
```go
|
||||
type Entry struct {
|
||||
EntryID string // uuid
|
||||
ParentID string // folder entry_id, or "" for root
|
||||
Type string // credential|note|identity|card|ssh_key|totp|folder|any
|
||||
Title string // plaintext title
|
||||
TitleIdx string // HMAC-SHA256 blind index for search
|
||||
Data []byte // zstd + AES-256-GCM (L1 key server-side)
|
||||
// OR: zstd + AES-256-GCM (L2 key client-side only)
|
||||
DataLevel int // 1=L1, 2=L2
|
||||
CreatedAt int64
|
||||
UpdatedAt int64
|
||||
Version int // optimistic locking
|
||||
}
|
||||
```
|
||||
|
||||
### VaultData (packed into Entry.Data)
|
||||
|
||||
```go
|
||||
type VaultData struct {
|
||||
Title string `json:"title"`
|
||||
Type string `json:"type"`
|
||||
Fields []VaultField `json:"fields"`
|
||||
URLs []string `json:"urls,omitempty"`
|
||||
Tags []string `json:"tags,omitempty"`
|
||||
Expires string `json:"expires,omitempty"` // YYYY-MM-DD
|
||||
Notes string `json:"notes,omitempty"`
|
||||
Files []VaultFile `json:"files,omitempty"`
|
||||
}
|
||||
|
||||
type VaultField struct {
|
||||
Label string `json:"label"` // "Username", "Password", "CVV" — anything
|
||||
Value string `json:"value"` // plaintext after decrypt
|
||||
Kind string `json:"kind"` // text|password|totp|url|file
|
||||
Section string `json:"section,omitempty"` // visual grouping
|
||||
L2 bool `json:"l2,omitempty"` // true = client-side decrypt only
|
||||
}
|
||||
|
||||
type VaultFile struct {
|
||||
Name string `json:"name"`
|
||||
MimeType string `json:"mime_type"`
|
||||
Size int64 `json:"size"`
|
||||
Data []byte `json:"data"` // encrypted blob stored in SQLite
|
||||
}
|
||||
```
|
||||
|
||||
The `type` field is just a UI hint — it never constrains the fields.
|
||||
A "shoe size" entry is valid. A "custom API token" entry is valid.
|
||||
|
||||
### Example entries
|
||||
|
||||
**Credit card:**
|
||||
```json
|
||||
{
|
||||
"type": "card",
|
||||
"title": "Amex Platinum",
|
||||
"fields": [
|
||||
{"label":"Cardholder","value":"Johan Jongsma","kind":"text"},
|
||||
{"label":"Number","value":"3782 8224 6310 005","kind":"password","l2":true},
|
||||
{"label":"CVV","value":"1234","kind":"password","l2":true},
|
||||
{"label":"Expiry","value":"09/28","kind":"text"},
|
||||
{"label":"Bank","value":"American Express","kind":"text"}
|
||||
]
|
||||
}
|
||||
```
|
||||
AI sees: Cardholder, Expiry, Bank. Never Number or CVV.
|
||||
|
||||
**Identity:**
|
||||
```json
|
||||
{
|
||||
"type": "identity",
|
||||
"title": "Johan Jongsma",
|
||||
"fields": [
|
||||
{"label":"First Name","value":"Johan","section":"Personal"},
|
||||
{"label":"Last Name","value":"Jongsma","section":"Personal"},
|
||||
{"label":"Email","value":"johan@jongsma.me","section":"Personal"},
|
||||
{"label":"Phone","value":"+17272252475","section":"Personal"},
|
||||
{"label":"Address","value":"851 Brightwaters Blvd","section":"Address"},
|
||||
{"label":"City","value":"St. Petersburg","section":"Address"},
|
||||
{"label":"State","value":"FL","section":"Address"},
|
||||
{"label":"ZIP","value":"33704","section":"Address"},
|
||||
{"label":"Passport","value":"NL12345678","kind":"password","l2":true,"section":"Documents"}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Two-Tier Encryption
|
||||
|
||||
### L1 — Server Key (AI-readable)
|
||||
|
||||
- `VAULT_KEY` env var (hex-encoded 32 bytes)
|
||||
- Per-entry key: HKDF-SHA256(VAULT_KEY, entry_id)
|
||||
- Encryption: zstd compress → AES-256-GCM encrypt → store
|
||||
- AI (MCP) can read all L1 fields
|
||||
- L2 fields within an L1 entry: individual field values are further encrypted
|
||||
with L2 key before being packed into VaultData — server stores ciphertext,
|
||||
returns `{"label":"CVV","value":null,"l2":true}` to AI
|
||||
|
||||
### L2 — Client Key (WebAuthn PRF, never leaves device)
|
||||
|
||||
- Derived entirely in browser via WebAuthn PRF extension
|
||||
- `navigator.credentials.get({extensions:{prf:{eval:{first:salt}}}})` → 32-byte secret
|
||||
- Secret → HKDF → L2 key → decrypt L2 field values in browser (Web Crypto API)
|
||||
- Server NEVER sees L2 key or L2 plaintext
|
||||
- L2 key lives in `sessionStorage` only — gone on tab close
|
||||
- Auto-lock after 15 minutes idle (configurable)
|
||||
|
||||
### WebAuthn authenticators supported
|
||||
|
||||
- Touch ID (Mac) — native browser prompt
|
||||
- Face ID (iPhone, via web UI on iOS Safari)
|
||||
- Windows Hello
|
||||
- Google Titan Key (USB-A/NFC, FIDO2)
|
||||
- YubiKey (FIDO2)
|
||||
|
||||
Register multiple authenticators for redundancy. One unlock = all L2 accessible.
|
||||
|
||||
### Recovery
|
||||
|
||||
- Printed 12-word BIP39 mnemonic generated at vault setup
|
||||
- Mnemonic derives L2 key as last resort (entropy → HKDF)
|
||||
- Store physically (safe, safety deposit box)
|
||||
- NO email/SMS/server fallback — would break the security model
|
||||
|
||||
---
|
||||
|
||||
## Import (LLM-powered)
|
||||
|
||||
`POST /api/import` — multipart, accepts any file format
|
||||
|
||||
Flow:
|
||||
1. User uploads file (Bitwarden JSON, 1Password CSV, LastPass, Chrome, plain text)
|
||||
2. Server sends content to Fireworks LLM (zero retention):
|
||||
> "Parse this password export into ClawVault entries. Return JSON array of
|
||||
> VaultData. Guess types. Mark l2:true on fields that appear sensitive:
|
||||
> card numbers, CVV, SSN, passport numbers, private keys, TOTP seeds."
|
||||
3. Server returns preview — user reviews before committing
|
||||
4. **L2 fields highlighted in amber** — "These fields will NOT be readable by your AI"
|
||||
5. User can toggle L2 per field in preview
|
||||
6. Confirm → write to DB
|
||||
|
||||
Best practice enforced by UI: "Review L2 markings before importing."
|
||||
Sensitive fields default to L2 — user explicitly unlocks them for AI if desired.
|
||||
|
||||
---
|
||||
|
||||
## Browser Extension
|
||||
|
||||
Manifest V3, Chrome first.
|
||||
|
||||
### Files
|
||||
- `manifest.json`
|
||||
- `background.js` — service worker, API key, vault calls
|
||||
- `content.js` — form detection, field filling
|
||||
- `popup.html/js` — credential picker
|
||||
|
||||
### Extension API key
|
||||
Stored in `chrome.storage.local`. Full access (L1 + L2 via client-side decrypt).
|
||||
Extension has its own token type: `ext` — distinguishable in audit log.
|
||||
|
||||
### LLM Field Mapping
|
||||
|
||||
1. Content script detects forms (any login/fill page)
|
||||
2. Serializes visible inputs: label, name, placeholder, type, selector
|
||||
3. User opens popup → picks credential
|
||||
4. Background calls `POST /ext/map`:
|
||||
```json
|
||||
{"entry_id":"...", "fields":[{"selector":"#email","label":"Email","type":"email"},...]}
|
||||
```
|
||||
5. Server calls LLM: maps vault fields to form selectors
|
||||
6. Content script fills mapped fields
|
||||
7. TOTP field detected → live code generated → filled automatically
|
||||
|
||||
### L2 fill flow
|
||||
- Extension popup shows 🔒 on L2 fields
|
||||
- Click → WebAuthn prompt in browser (Touch ID etc.)
|
||||
- L2 key derived → L2 fields decrypted in browser memory → filled
|
||||
- Key discarded after fill
|
||||
|
||||
---
|
||||
|
||||
## TOTP
|
||||
|
||||
Seed stored as L2 field by default (user can change to L1 per entry).
|
||||
|
||||
**If L1 (AI-accessible):**
|
||||
- `GET /api/ext/totp/:id` → `{"code":"123456","expires_in":23}`
|
||||
- MCP tool `get_totp("GitHub")` → returns live code
|
||||
- AI can complete 2FA flows autonomously — killer feature
|
||||
|
||||
**If L2 (client-only):**
|
||||
- Seed only decryptable client-side
|
||||
- Extension generates code locally after WebAuthn unlock
|
||||
- AI cannot access
|
||||
|
||||
Default: **L2** for TOTP seeds. User explicitly marks L1 to enable AI 2FA automation.
|
||||
This is a conscious, visible decision — not a silent default.
|
||||
|
||||
---
|
||||
|
||||
## MCP Tools (L1 only)
|
||||
|
||||
```
|
||||
get_credential(query) → VaultData, L2 fields omitted
|
||||
list_credentials(filter?) → [{entry_id, title, type, urls}]
|
||||
get_totp(query) → {code, expires_in} (L1 TOTP only)
|
||||
search_vault(query) → [{entry_id, title, type, matched_field}]
|
||||
check_expiring(days?) → [{title, type, expires, days_remaining}]
|
||||
create_entry(data) → entry_id (AI can save new credentials)
|
||||
```
|
||||
|
||||
MCP token: read-only by default. Write token optional (for AI to save new credentials).
|
||||
|
||||
---
|
||||
|
||||
## Web UI
|
||||
|
||||
Vanilla JS, embedded in binary, no framework, no build step.
|
||||
|
||||
### Views
|
||||
- `/` → entry list, folder tree, search
|
||||
- `/entry/:id` → detail view
|
||||
- `/entry/new` → create (dynamic field builder, type picker)
|
||||
- `/import` → LLM import with preview
|
||||
- `/settings` → WebAuthn setup, tokens, export, audit log
|
||||
|
||||
### L2 UX
|
||||
- L2 fields render as: `🔒 Locked — Touch to unlock`
|
||||
- Click → WebAuthn prompt → decrypt in browser → show value + copy button
|
||||
- "Unlock all" button → single WebAuthn prompt → all L2 visible for session
|
||||
- Lock icon in nav shows session state (locked/unlocked)
|
||||
|
||||
---
|
||||
|
||||
## Audit Log
|
||||
|
||||
```go
|
||||
type AuditEvent struct {
|
||||
EventID string
|
||||
EntryID string
|
||||
Title string // snapshot
|
||||
Action string // read|fill|ai_read|create|update|delete|import|export
|
||||
Actor string // web|extension|mcp
|
||||
IPAddr string
|
||||
Timestamp int64
|
||||
}
|
||||
```
|
||||
|
||||
`GET /api/audit` — paginated, filterable by actor/action/entry.
|
||||
AI access clearly marked as `actor:"mcp"`.
|
||||
|
||||
---
|
||||
|
||||
## Password Generator
|
||||
|
||||
`GET /api/generate?length=20&symbols=true`
|
||||
`GET /api/generate?words=4` → "correct-horse-battery-staple"
|
||||
|
||||
Crypto/rand throughout. Built into field editor.
|
||||
|
||||
---
|
||||
|
||||
## Config
|
||||
|
||||
```bash
|
||||
VAULT_KEY=<hex-encoded 32 bytes> # required, L1 master key
|
||||
PORT=8765
|
||||
DB_PATH=./clawvault.db
|
||||
FIREWORKS_API_KEY=... # for LLM import + field mapping
|
||||
LLM_MODEL=accounts/fireworks/models/llama-v3p3-70b-instruct
|
||||
SESSION_TTL=86400 # seconds
|
||||
L2_LOCK_IDLE=900 # L2 auto-lock after 15min idle
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Build Plan
|
||||
|
||||
### Day 1 — Foundation
|
||||
- [ ] Go module, entry model, L1 crypto, dbcore
|
||||
- [ ] CRUD API (create/read/update/delete entries)
|
||||
- [ ] Web UI: list, create, view, edit
|
||||
- [ ] Password generator
|
||||
- [ ] Session auth (token-based)
|
||||
|
||||
### Day 2 — L2 + Extension
|
||||
- [ ] L2 field encryption (client-side Web Crypto in browser)
|
||||
- [ ] WebAuthn PRF registration + unlock flow
|
||||
- [ ] Chrome extension: popup, content script, LLM fill
|
||||
- [ ] `/ext/map` LLM field mapping endpoint
|
||||
|
||||
### Day 3 — AI + Import
|
||||
- [ ] MCP endpoint + 6 tools
|
||||
- [ ] OpenClaw skill: ClawVault
|
||||
- [ ] LLM import (`/api/import`) with preview UI
|
||||
- [ ] TOTP generation
|
||||
|
||||
### Day 4 — Complete
|
||||
- [ ] Audit log
|
||||
- [ ] File attachments (BLOB in SQLite)
|
||||
- [ ] Expiry alerts (heartbeat + MCP)
|
||||
- [ ] Export (Bitwarden-compatible JSON)
|
||||
- [ ] Systemd service + deploy script
|
||||
|
||||
---
|
||||
|
||||
## Out of Scope v0.1
|
||||
|
||||
- Mobile autofill (v2, OSS community)
|
||||
- Firefox/Safari extension
|
||||
- Multi-user/team sharing
|
||||
- Browser extension for non-Chromium
|
||||
|
||||
---
|
||||
|
||||
## Competitive Landscape
|
||||
|
||||
| | ClawVault | Bitwarden MCP | mcp-secrets-vault | 1Password |
|
||||
|--|--|--|--|--|
|
||||
| Field-level AI visibility | ✅ | ❌ | ❌ | ❌ |
|
||||
| Two-tier encryption | ✅ | ❌ | ❌ | ❌ |
|
||||
| WebAuthn L2 unlock | ✅ | ❌ | ❌ | ✅ (auth only) |
|
||||
| LLM field mapping | ✅ | ❌ | ❌ | ❌ |
|
||||
| LLM import (any format) | ✅ | ❌ | ❌ | ❌ |
|
||||
| One binary | ✅ | ❌ | ✅ | ❌ |
|
||||
| Self-hosted | ✅ | ✅ | ✅ | ❌ |
|
||||
| Open source | ✅ | ✅ | ✅ | ❌ |
|
||||
|
||||
---
|
||||
|
||||
*ClawVault — the vault that knows who it's talking to.*
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,202 @@
|
|||
package api
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"log"
|
||||
"net/http"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/johanj/clawvault/lib"
|
||||
)
|
||||
|
||||
type contextKey string
|
||||
|
||||
const (
|
||||
ctxActor contextKey = "actor"
|
||||
ctxSession contextKey = "session"
|
||||
)
|
||||
|
||||
// ActorFromContext returns the actor type from request context.
|
||||
func ActorFromContext(ctx context.Context) string {
|
||||
v, ok := ctx.Value(ctxActor).(string)
|
||||
if !ok {
|
||||
return lib.ActorWeb
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
// SessionFromContext returns the session from request context.
|
||||
func SessionFromContext(ctx context.Context) *lib.Session {
|
||||
v, _ := ctx.Value(ctxSession).(*lib.Session)
|
||||
return v
|
||||
}
|
||||
|
||||
// AuthMiddleware validates Bearer tokens and sets session context.
|
||||
func AuthMiddleware(db *lib.DB) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
auth := r.Header.Get("Authorization")
|
||||
if !strings.HasPrefix(auth, "Bearer ") {
|
||||
ErrorResponse(w, http.StatusUnauthorized, "missing_token", "Authorization header required")
|
||||
return
|
||||
}
|
||||
token := strings.TrimPrefix(auth, "Bearer ")
|
||||
|
||||
session, err := lib.SessionGet(db, token)
|
||||
if err != nil {
|
||||
ErrorResponse(w, http.StatusInternalServerError, "session_error", "Session lookup failed")
|
||||
return
|
||||
}
|
||||
if session == nil {
|
||||
ErrorResponse(w, http.StatusUnauthorized, "invalid_token", "Invalid or expired token")
|
||||
return
|
||||
}
|
||||
|
||||
ctx := context.WithValue(r.Context(), ctxActor, session.Actor)
|
||||
ctx = context.WithValue(ctx, ctxSession, session)
|
||||
next.ServeHTTP(w, r.WithContext(ctx))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// LoggingMiddleware logs HTTP requests.
|
||||
func LoggingMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
start := time.Now()
|
||||
wrapped := &statusWriter{ResponseWriter: w, status: 200}
|
||||
next.ServeHTTP(wrapped, r)
|
||||
log.Printf("%s %s %d %s", r.Method, r.URL.Path, wrapped.status, time.Since(start))
|
||||
})
|
||||
}
|
||||
|
||||
type statusWriter struct {
|
||||
http.ResponseWriter
|
||||
status int
|
||||
}
|
||||
|
||||
func (w *statusWriter) WriteHeader(code int) {
|
||||
w.status = code
|
||||
w.ResponseWriter.WriteHeader(code)
|
||||
}
|
||||
|
||||
// RateLimitMiddleware implements per-IP rate limiting.
|
||||
func RateLimitMiddleware(requestsPerMinute int) func(http.Handler) http.Handler {
|
||||
var mu sync.Mutex
|
||||
clients := make(map[string]*rateLimitEntry)
|
||||
|
||||
go func() {
|
||||
for {
|
||||
time.Sleep(time.Minute)
|
||||
mu.Lock()
|
||||
now := time.Now()
|
||||
for ip, entry := range clients {
|
||||
if now.Sub(entry.windowStart) > time.Minute {
|
||||
delete(clients, ip)
|
||||
}
|
||||
}
|
||||
mu.Unlock()
|
||||
}
|
||||
}()
|
||||
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
ip := realIP(r)
|
||||
|
||||
mu.Lock()
|
||||
entry, exists := clients[ip]
|
||||
now := time.Now()
|
||||
if !exists || now.Sub(entry.windowStart) > time.Minute {
|
||||
entry = &rateLimitEntry{windowStart: now, count: 0}
|
||||
clients[ip] = entry
|
||||
}
|
||||
entry.count++
|
||||
count := entry.count
|
||||
mu.Unlock()
|
||||
|
||||
if count > requestsPerMinute {
|
||||
ErrorResponse(w, http.StatusTooManyRequests, "rate_limited", "Too many requests")
|
||||
return
|
||||
}
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type rateLimitEntry struct {
|
||||
windowStart time.Time
|
||||
count int
|
||||
}
|
||||
|
||||
// CORSMiddleware handles CORS headers.
|
||||
func CORSMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
origin := r.Header.Get("Origin")
|
||||
|
||||
// Allow localhost and 127.0.0.1 for development
|
||||
if origin != "" && (strings.Contains(origin, "localhost") || strings.Contains(origin, "127.0.0.1")) {
|
||||
w.Header().Set("Access-Control-Allow-Origin", origin)
|
||||
w.Header().Set("Vary", "Origin")
|
||||
}
|
||||
|
||||
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
|
||||
w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
|
||||
w.Header().Set("Access-Control-Max-Age", "86400")
|
||||
|
||||
if r.Method == "OPTIONS" {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return
|
||||
}
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
// SecurityHeadersMiddleware adds security headers to all responses.
|
||||
func SecurityHeadersMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("X-Frame-Options", "DENY")
|
||||
w.Header().Set("X-Content-Type-Options", "nosniff")
|
||||
w.Header().Set("X-XSS-Protection", "1; mode=block")
|
||||
w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
||||
// CSP allowing localhost and 127.0.0.1 for development
|
||||
w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' localhost 127.0.0.1")
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
// ErrorResponse sends a standard JSON error response.
|
||||
func ErrorResponse(w http.ResponseWriter, status int, code, message string) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
json.NewEncoder(w).Encode(map[string]string{
|
||||
"error": message,
|
||||
"code": code,
|
||||
})
|
||||
}
|
||||
|
||||
// JSONResponse sends a standard JSON success response.
|
||||
func JSONResponse(w http.ResponseWriter, status int, data any) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
json.NewEncoder(w).Encode(data)
|
||||
}
|
||||
|
||||
func realIP(r *http.Request) string {
|
||||
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
|
||||
parts := strings.SplitN(xff, ",", 2)
|
||||
return strings.TrimSpace(parts[0])
|
||||
}
|
||||
if xri := r.Header.Get("X-Real-IP"); xri != "" {
|
||||
return xri
|
||||
}
|
||||
addr := r.RemoteAddr
|
||||
if idx := strings.LastIndex(addr, ":"); idx != -1 {
|
||||
return addr[:idx]
|
||||
}
|
||||
return addr
|
||||
}
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
package api
|
||||
|
||||
import (
|
||||
"embed"
|
||||
"io/fs"
|
||||
"net/http"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
"github.com/johanj/clawvault/lib"
|
||||
)
|
||||
|
||||
// NewRouter creates the main router with all routes registered.
|
||||
func NewRouter(db *lib.DB, cfg *lib.Config, webFS embed.FS) *chi.Mux {
|
||||
r := chi.NewRouter()
|
||||
h := NewHandlers(db, cfg)
|
||||
|
||||
// Global middleware
|
||||
r.Use(LoggingMiddleware)
|
||||
r.Use(CORSMiddleware)
|
||||
r.Use(SecurityHeadersMiddleware)
|
||||
r.Use(RateLimitMiddleware(120)) // 120 req/min per IP
|
||||
|
||||
// Health check (unauthenticated)
|
||||
r.Get("/health", h.Health)
|
||||
|
||||
// Setup endpoint (creates initial session)
|
||||
r.Post("/api/auth/setup", h.Setup)
|
||||
|
||||
// API routes (authenticated)
|
||||
r.Route("/api", func(r chi.Router) {
|
||||
r.Use(AuthMiddleware(db))
|
||||
|
||||
// Entries CRUD
|
||||
r.Get("/entries", h.ListEntries)
|
||||
r.Post("/entries", h.CreateEntry)
|
||||
r.Get("/entries/{id}", h.GetEntry)
|
||||
r.Put("/entries/{id}", h.UpdateEntry)
|
||||
r.Delete("/entries/{id}", h.DeleteEntry)
|
||||
|
||||
// Search
|
||||
r.Get("/search", h.SearchEntries)
|
||||
|
||||
// Password generator
|
||||
r.Get("/generate", h.GeneratePassword)
|
||||
|
||||
// Import
|
||||
r.Post("/import", h.ImportEntries)
|
||||
r.Post("/import/confirm", h.ImportConfirm)
|
||||
|
||||
// Audit log
|
||||
r.Get("/audit", h.GetAuditLog)
|
||||
|
||||
// Extension API
|
||||
r.Get("/ext/totp/{id}", h.GetTOTP)
|
||||
r.Get("/ext/match", h.MatchURL)
|
||||
r.Post("/ext/map", h.MapFields)
|
||||
})
|
||||
|
||||
// MCP endpoint (authenticated)
|
||||
r.With(AuthMiddleware(db)).Post("/mcp", h.MCPHandler)
|
||||
|
||||
// Embedded web UI
|
||||
webRoot, err := fs.Sub(webFS, "web")
|
||||
if err == nil {
|
||||
fileServer := http.FileServer(http.FS(webRoot))
|
||||
r.Handle("/*", fileServer)
|
||||
}
|
||||
|
||||
return r
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"embed"
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"github.com/johanj/clawvault/api"
|
||||
"github.com/johanj/clawvault/lib"
|
||||
)
|
||||
|
||||
//go:embed web
|
||||
var webFS embed.FS
|
||||
|
||||
func main() {
|
||||
cfg, err := lib.LoadConfig()
|
||||
if err != nil {
|
||||
log.Fatalf("config: %v", err)
|
||||
}
|
||||
|
||||
db, err := lib.OpenDB(cfg.DBPath)
|
||||
if err != nil {
|
||||
log.Fatalf("database: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
if err := lib.MigrateDB(db); err != nil {
|
||||
log.Fatalf("migration: %v", err)
|
||||
}
|
||||
|
||||
router := api.NewRouter(db, cfg, webFS)
|
||||
|
||||
addr := ":" + cfg.Port
|
||||
log.Printf("ClawVault starting on %s", addr)
|
||||
if err := http.ListenAndServe(addr, router); err != nil {
|
||||
log.Fatalf("server: %v", err)
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,698 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en" class="h-full">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>ClawVault</title>
|
||||
<script src="https://cdn.tailwindcss.com"></script>
|
||||
<script>
|
||||
tailwind.config = {
|
||||
theme: {
|
||||
extend: {
|
||||
colors: {
|
||||
navy: {
|
||||
900: '#0a0f1a',
|
||||
800: '#111827',
|
||||
700: '#1f2937',
|
||||
600: '#374151',
|
||||
},
|
||||
gold: '#c9a84c',
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
</script>
|
||||
<style>
|
||||
.password-masked { font-family: 'Courier New', monospace; letter-spacing: 0.1em; }
|
||||
.toast { animation: slideIn 0.3s ease; }
|
||||
@keyframes slideIn { from { transform: translateY(-100%); opacity: 0; } to { transform: translateY(0); opacity: 1; } }
|
||||
</style>
|
||||
</head>
|
||||
<body class="h-full bg-navy-900 text-gray-100">
|
||||
<div id="app" class="h-full flex">
|
||||
<!-- Sidebar -->
|
||||
<aside class="w-64 bg-navy-800 border-r border-navy-600 flex flex-col">
|
||||
<div class="p-4 border-b border-navy-600">
|
||||
<h1 class="text-xl font-bold text-gold">🔐 ClawVault</h1>
|
||||
</div>
|
||||
|
||||
<!-- Search -->
|
||||
<div class="p-3">
|
||||
<input type="text" id="searchBox" placeholder="Search vault..."
|
||||
class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded text-sm focus:outline-none focus:border-gold">
|
||||
</div>
|
||||
|
||||
<!-- Folder tree -->
|
||||
<nav id="folderTree" class="flex-1 overflow-y-auto p-3">
|
||||
<div class="text-sm text-gray-400">Loading...</div>
|
||||
</nav>
|
||||
|
||||
<!-- Bottom actions -->
|
||||
<div class="p-3 border-t border-navy-600 space-y-2">
|
||||
<button onclick="showNewEntry()" class="w-full px-3 py-2 bg-gold text-navy-900 rounded font-medium hover:bg-yellow-400">
|
||||
+ New Entry
|
||||
</button>
|
||||
<button onclick="showImport()" class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded text-sm hover:bg-navy-600">
|
||||
Import
|
||||
</button>
|
||||
</div>
|
||||
</aside>
|
||||
|
||||
<!-- Main content -->
|
||||
<main class="flex-1 flex flex-col overflow-hidden">
|
||||
<!-- Top nav -->
|
||||
<header class="h-14 bg-navy-800 border-b border-navy-600 flex items-center justify-between px-4">
|
||||
<div id="breadcrumb" class="text-sm text-gray-400">All Items</div>
|
||||
<div class="flex items-center gap-3">
|
||||
<span id="lockStatus" class="text-sm text-gray-400">🔓 L1 Active</span>
|
||||
<button onclick="showAudit()" class="text-sm text-gray-400 hover:text-white">Audit Log</button>
|
||||
<button onclick="logout()" class="text-sm text-gray-400 hover:text-white">Logout</button>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<!-- Content area -->
|
||||
<div id="content" class="flex-1 overflow-y-auto p-6">
|
||||
<!-- Entry list or detail view -->
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
|
||||
<!-- Modals -->
|
||||
<div id="modal" class="hidden fixed inset-0 bg-black/50 flex items-center justify-center z-50">
|
||||
<div id="modalContent" class="bg-navy-800 rounded-lg shadow-xl max-w-2xl w-full max-h-[90vh] overflow-y-auto">
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Toast -->
|
||||
<div id="toast" class="hidden fixed top-4 right-4 px-4 py-2 bg-green-600 text-white rounded shadow-lg z-50"></div>
|
||||
|
||||
<script>
|
||||
let token = localStorage.getItem('clawvault_token');
|
||||
let entries = [];
|
||||
let currentEntry = null;
|
||||
|
||||
// API helpers
|
||||
async function api(method, path, body) {
|
||||
const opts = {
|
||||
method,
|
||||
headers: { 'Content-Type': 'application/json' }
|
||||
};
|
||||
if (token) opts.headers['Authorization'] = 'Bearer ' + token;
|
||||
if (body) opts.body = JSON.stringify(body);
|
||||
|
||||
const res = await fetch(path, opts);
|
||||
if (res.status === 401) {
|
||||
token = null;
|
||||
localStorage.removeItem('clawvault_token');
|
||||
showSetup();
|
||||
throw new Error('Unauthorized');
|
||||
}
|
||||
return res.json();
|
||||
}
|
||||
|
||||
function toast(msg, type = 'success') {
|
||||
const t = document.getElementById('toast');
|
||||
t.textContent = msg;
|
||||
t.className = 'toast fixed top-4 right-4 px-4 py-2 rounded shadow-lg z-50 ' + (type === 'error' ? 'bg-red-600' : 'bg-green-600') + ' text-white';
|
||||
setTimeout(() => t.classList.add('hidden'), 3000);
|
||||
}
|
||||
|
||||
// Setup / Auth
|
||||
async function showSetup() {
|
||||
document.getElementById('content').innerHTML =
|
||||
'<div class="max-w-md mx-auto mt-20 text-center">' +
|
||||
'<h2 class="text-2xl font-bold mb-4">Welcome to ClawVault</h2>' +
|
||||
'<p class="text-gray-400 mb-6">Your personal vault is ready.</p>' +
|
||||
'<button onclick="doSetup()" class="px-6 py-3 bg-gold text-navy-900 rounded font-medium hover:bg-yellow-400">' +
|
||||
'Initialize Vault' +
|
||||
'</button>' +
|
||||
'</div>';
|
||||
}
|
||||
|
||||
async function doSetup() {
|
||||
try {
|
||||
const data = await api('POST', '/api/auth/setup');
|
||||
token = data.token;
|
||||
localStorage.setItem('clawvault_token', token);
|
||||
toast('Vault initialized!');
|
||||
loadEntries();
|
||||
} catch (e) {
|
||||
toast('Setup failed: ' + e.message, 'error');
|
||||
}
|
||||
}
|
||||
|
||||
function logout() {
|
||||
token = null;
|
||||
localStorage.removeItem('clawvault_token');
|
||||
showSetup();
|
||||
}
|
||||
|
||||
// Entry list
|
||||
async function loadEntries() {
|
||||
try {
|
||||
entries = await api('GET', '/api/entries');
|
||||
renderEntryList();
|
||||
renderFolderTree();
|
||||
} catch (e) {
|
||||
if (e.message !== 'Unauthorized') {
|
||||
toast('Failed to load entries', 'error');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function renderEntryList(parentId) {
|
||||
parentId = parentId || '';
|
||||
const filtered = entries.filter(function(e) { return e.parent_id === parentId; });
|
||||
const content = document.getElementById('content');
|
||||
|
||||
if (filtered.length === 0) {
|
||||
content.innerHTML =
|
||||
'<div class="text-center text-gray-400 mt-20">' +
|
||||
'<div class="text-4xl mb-4">🔐</div>' +
|
||||
'<p>No entries yet. Create your first one!</p>' +
|
||||
'</div>';
|
||||
return;
|
||||
}
|
||||
|
||||
var html = '<div class="grid gap-3">';
|
||||
filtered.forEach(function(e) {
|
||||
html += '<div onclick="showEntry(\'' + e.entry_id + '\')" ' +
|
||||
'class="p-4 bg-navy-800 rounded-lg border border-navy-600 hover:border-gold cursor-pointer flex items-center gap-4">' +
|
||||
'<div class="text-2xl">' + getTypeIcon(e.type) + '</div>' +
|
||||
'<div class="flex-1">' +
|
||||
'<div class="font-medium">' + escapeHtml(e.title) + '</div>' +
|
||||
'<div class="text-sm text-gray-400">' + e.type + (e.data && e.data.urls && e.data.urls.length ? ' • ' + e.data.urls[0] : '') + '</div>' +
|
||||
'</div>' +
|
||||
(hasL2Fields(e) ? '<span class="text-sm text-amber-400">🔒 L2</span>' : '') +
|
||||
'</div>';
|
||||
});
|
||||
html += '</div>';
|
||||
content.innerHTML = html;
|
||||
}
|
||||
|
||||
function renderFolderTree() {
|
||||
var folders = entries.filter(function(e) { return e.type === 'folder'; });
|
||||
var tree = document.getElementById('folderTree');
|
||||
|
||||
var html = '<div onclick="renderEntryList(\'\')" class="py-1 px-2 rounded hover:bg-navy-700 cursor-pointer text-sm">📁 All Items</div>';
|
||||
|
||||
folders.forEach(function(f) {
|
||||
html += '<div onclick="renderEntryList(\'' + f.entry_id + '\')" class="py-1 px-2 rounded hover:bg-navy-700 cursor-pointer text-sm ml-2">📁 ' + escapeHtml(f.title) + '</div>';
|
||||
});
|
||||
|
||||
tree.innerHTML = html;
|
||||
}
|
||||
|
||||
// Entry detail
|
||||
async function showEntry(id) {
|
||||
try {
|
||||
currentEntry = await api('GET', '/api/entries/' + id);
|
||||
renderEntryDetail();
|
||||
} catch (e) {
|
||||
toast('Failed to load entry', 'error');
|
||||
}
|
||||
}
|
||||
|
||||
function renderEntryDetail() {
|
||||
var e = currentEntry;
|
||||
var content = document.getElementById('content');
|
||||
|
||||
var fieldsHtml = '';
|
||||
if (e.data && e.data.fields) {
|
||||
e.data.fields.forEach(function(f, i) {
|
||||
fieldsHtml += '<div class="p-3 bg-navy-700 rounded">' +
|
||||
'<div class="text-xs text-gray-400 mb-1">' + escapeHtml(f.label) + (f.l2 ? ' <span class="text-amber-400">🔒 L2</span>' : '') + '</div>' +
|
||||
'<div class="flex items-center gap-2">';
|
||||
if (f.l2) {
|
||||
fieldsHtml += '<span class="text-amber-400 italic">🔒 Locked — Touch to unlock</span>';
|
||||
} else if (f.kind === 'password') {
|
||||
fieldsHtml += '<span class="password-masked" id="field-' + i + '">••••••••</span>' +
|
||||
'<button onclick="togglePassword(' + i + ', \'' + escapeHtml(f.value).replace(/'/g, "\\'") + '\')" class="text-xs text-gray-400 hover:text-white">👁</button>';
|
||||
} else {
|
||||
fieldsHtml += '<span id="field-' + i + '">' + escapeHtml(f.value) + '</span>';
|
||||
}
|
||||
if (!f.l2) {
|
||||
fieldsHtml += '<button onclick="copyField(\'' + escapeHtml(f.value).replace(/'/g, "\\'") + '\')" class="text-xs text-gray-400 hover:text-white">📋</button>';
|
||||
}
|
||||
fieldsHtml += '</div></div>';
|
||||
});
|
||||
}
|
||||
|
||||
var html = '<div class="max-w-2xl">' +
|
||||
'<div class="flex items-center gap-4 mb-6">' +
|
||||
'<button onclick="loadEntries()" class="text-gray-400 hover:text-white">← Back</button>' +
|
||||
'<div class="text-3xl">' + getTypeIcon(e.type) + '</div>' +
|
||||
'<div>' +
|
||||
'<h2 class="text-xl font-bold">' + escapeHtml(e.title) + '</h2>' +
|
||||
'<div class="text-sm text-gray-400">' + e.type + '</div>' +
|
||||
'</div>' +
|
||||
'</div>';
|
||||
|
||||
if (e.data && e.data.urls && e.data.urls.length) {
|
||||
html += '<div class="mb-4"><div class="text-xs text-gray-400 mb-1">URLs</div>';
|
||||
e.data.urls.forEach(function(u) {
|
||||
html += '<a href="' + escapeHtml(u) + '" target="_blank" class="text-gold hover:underline block">' + escapeHtml(u) + '</a>';
|
||||
});
|
||||
html += '</div>';
|
||||
}
|
||||
|
||||
html += '<div class="space-y-3 mb-6">' + fieldsHtml + '</div>';
|
||||
|
||||
if (e.data && e.data.notes) {
|
||||
html += '<div class="p-3 bg-navy-700 rounded mb-6">' +
|
||||
'<div class="text-xs text-gray-400 mb-1">Notes</div>' +
|
||||
'<div class="whitespace-pre-wrap">' + escapeHtml(e.data.notes) + '</div>' +
|
||||
'</div>';
|
||||
}
|
||||
|
||||
html += '<div class="flex gap-3">' +
|
||||
'<button onclick="editEntry()" class="px-4 py-2 bg-navy-700 border border-navy-600 rounded hover:bg-navy-600">Edit</button>' +
|
||||
'<button onclick="deleteEntry(\'' + e.entry_id + '\')" class="px-4 py-2 bg-red-600/20 text-red-400 border border-red-600/30 rounded hover:bg-red-600/30">Delete</button>' +
|
||||
'</div></div>';
|
||||
|
||||
content.innerHTML = html;
|
||||
}
|
||||
|
||||
function togglePassword(idx, value) {
|
||||
var el = document.getElementById('field-' + idx);
|
||||
if (el.textContent === '••••••••') {
|
||||
el.textContent = value;
|
||||
} else {
|
||||
el.textContent = '••••••••';
|
||||
}
|
||||
}
|
||||
|
||||
async function copyField(value) {
|
||||
await navigator.clipboard.writeText(value);
|
||||
toast('Copied!');
|
||||
}
|
||||
|
||||
async function deleteEntry(id) {
|
||||
if (!confirm('Delete this entry?')) return;
|
||||
try {
|
||||
await api('DELETE', '/api/entries/' + id);
|
||||
toast('Entry deleted');
|
||||
loadEntries();
|
||||
} catch (e) {
|
||||
toast('Delete failed', 'error');
|
||||
}
|
||||
}
|
||||
|
||||
// New Entry
|
||||
var fieldCount = 0;
|
||||
|
||||
function showNewEntry() {
|
||||
var modal = document.getElementById('modal');
|
||||
var content = document.getElementById('modalContent');
|
||||
|
||||
content.innerHTML =
|
||||
'<div class="p-6">' +
|
||||
'<h3 class="text-lg font-bold mb-4">New Entry</h3>' +
|
||||
'<form id="newEntryForm" class="space-y-4">' +
|
||||
'<div>' +
|
||||
'<label class="block text-sm text-gray-400 mb-1">Type</label>' +
|
||||
'<select id="entryType" class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded">' +
|
||||
'<option value="credential">Credential</option>' +
|
||||
'<option value="card">Card</option>' +
|
||||
'<option value="identity">Identity</option>' +
|
||||
'<option value="note">Note</option>' +
|
||||
'<option value="ssh_key">SSH Key</option>' +
|
||||
'<option value="totp">TOTP</option>' +
|
||||
'<option value="folder">Folder</option>' +
|
||||
'</select>' +
|
||||
'</div>' +
|
||||
'<div>' +
|
||||
'<label class="block text-sm text-gray-400 mb-1">Title</label>' +
|
||||
'<input type="text" id="entryTitle" class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded" required>' +
|
||||
'</div>' +
|
||||
'<div id="fieldsContainer">' +
|
||||
'<label class="block text-sm text-gray-400 mb-1">Fields</label>' +
|
||||
'<div id="fieldsList" class="space-y-2"></div>' +
|
||||
'<button type="button" onclick="addField()" class="mt-2 text-sm text-gold hover:underline">+ Add Field</button>' +
|
||||
'</div>' +
|
||||
'<div>' +
|
||||
'<label class="block text-sm text-gray-400 mb-1">URLs (one per line)</label>' +
|
||||
'<textarea id="entryURLs" rows="2" class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded"></textarea>' +
|
||||
'</div>' +
|
||||
'<div>' +
|
||||
'<label class="block text-sm text-gray-400 mb-1">Notes</label>' +
|
||||
'<textarea id="entryNotes" rows="3" class="w-full px-3 py-2 bg-navy-700 border border-navy-600 rounded"></textarea>' +
|
||||
'</div>' +
|
||||
'<div class="flex justify-end gap-3">' +
|
||||
'<button type="button" onclick="closeModal()" class="px-4 py-2 bg-navy-700 rounded">Cancel</button>' +
|
||||
'<button type="submit" class="px-4 py-2 bg-gold text-navy-900 rounded font-medium">Save</button>' +
|
||||
'</div>' +
|
||||
'</form>' +
|
||||
'</div>';
|
||||
|
||||
document.getElementById('entryType').addEventListener('change', updateDefaultFields);
|
||||
updateDefaultFields();
|
||||
|
||||
document.getElementById('newEntryForm').addEventListener('submit', saveNewEntry);
|
||||
modal.classList.remove('hidden');
|
||||
}
|
||||
|
||||
function updateDefaultFields() {
|
||||
var type = document.getElementById('entryType').value;
|
||||
var container = document.getElementById('fieldsList');
|
||||
container.innerHTML = '';
|
||||
fieldCount = 0;
|
||||
|
||||
var defaults = {
|
||||
credential: [['Username', 'text', false], ['Password', 'password', false]],
|
||||
card: [['Cardholder', 'text', false], ['Number', 'password', true], ['CVV', 'password', true], ['Expiry', 'text', false]],
|
||||
identity: [['First Name', 'text', false], ['Last Name', 'text', false], ['Email', 'text', false], ['Phone', 'text', false]],
|
||||
ssh_key: [['Private Key', 'password', true]],
|
||||
totp: [['Secret', 'totp', true]],
|
||||
note: [],
|
||||
folder: []
|
||||
};
|
||||
|
||||
var fields = defaults[type] || [];
|
||||
fields.forEach(function(f) { addField(f[0], f[1], f[2]); });
|
||||
}
|
||||
|
||||
function addField(label, kind, l2) {
|
||||
label = label || '';
|
||||
kind = kind || 'text';
|
||||
l2 = l2 || false;
|
||||
var container = document.getElementById('fieldsList');
|
||||
var idx = fieldCount++;
|
||||
var div = document.createElement('div');
|
||||
div.className = 'flex gap-2 items-start';
|
||||
div.innerHTML =
|
||||
'<input type="text" placeholder="Label" value="' + escapeHtml(label) + '" class="field-label flex-1 px-2 py-1 bg-navy-700 border border-navy-600 rounded text-sm">' +
|
||||
'<input type="text" placeholder="Value" class="field-value flex-1 px-2 py-1 bg-navy-700 border border-navy-600 rounded text-sm">' +
|
||||
'<select class="field-kind px-2 py-1 bg-navy-700 border border-navy-600 rounded text-sm">' +
|
||||
'<option value="text"' + (kind==='text'?' selected':'') + '>Text</option>' +
|
||||
'<option value="password"' + (kind==='password'?' selected':'') + '>Password</option>' +
|
||||
'<option value="totp"' + (kind==='totp'?' selected':'') + '>TOTP</option>' +
|
||||
'<option value="url"' + (kind==='url'?' selected':'') + '>URL</option>' +
|
||||
'</select>' +
|
||||
'<label class="flex items-center gap-1 text-sm">' +
|
||||
'<input type="checkbox" class="field-l2"' + (l2?' checked':'') + '>' +
|
||||
'<span class="text-amber-400">L2</span>' +
|
||||
'</label>' +
|
||||
'<button type="button" onclick="this.parentElement.remove()" class="text-red-400 hover:text-red-300">×</button>';
|
||||
container.appendChild(div);
|
||||
}
|
||||
|
||||
async function saveNewEntry(e) {
|
||||
e.preventDefault();
|
||||
|
||||
var fieldDivs = document.querySelectorAll('#fieldsList > div');
|
||||
var fields = [];
|
||||
fieldDivs.forEach(function(div) {
|
||||
var label = div.querySelector('.field-label').value;
|
||||
if (label) {
|
||||
fields.push({
|
||||
label: label,
|
||||
value: div.querySelector('.field-value').value,
|
||||
kind: div.querySelector('.field-kind').value,
|
||||
l2: div.querySelector('.field-l2').checked
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
var urlText = document.getElementById('entryURLs').value;
|
||||
var urls = urlText.split('\n').map(function(u) { return u.trim(); }).filter(Boolean);
|
||||
|
||||
var entry = {
|
||||
type: document.getElementById('entryType').value,
|
||||
title: document.getElementById('entryTitle').value,
|
||||
data: {
|
||||
title: document.getElementById('entryTitle').value,
|
||||
type: document.getElementById('entryType').value,
|
||||
fields: fields,
|
||||
urls: urls,
|
||||
notes: document.getElementById('entryNotes').value
|
||||
}
|
||||
};
|
||||
|
||||
try {
|
||||
await api('POST', '/api/entries', entry);
|
||||
toast('Entry created!');
|
||||
closeModal();
|
||||
loadEntries();
|
||||
} catch (err) {
|
||||
toast('Failed to create entry', 'error');
|
||||
}
|
||||
}
|
||||
|
||||
function editEntry() {
|
||||
showNewEntry();
|
||||
setTimeout(function() {
|
||||
var e = currentEntry;
|
||||
document.getElementById('entryType').value = e.type;
|
||||
document.getElementById('entryTitle').value = e.title;
|
||||
if (e.data) {
|
||||
if (e.data.urls) document.getElementById('entryURLs').value = e.data.urls.join('\n');
|
||||
if (e.data.notes) document.getElementById('entryNotes').value = e.data.notes;
|
||||
|
||||
document.getElementById('fieldsList').innerHTML = '';
|
||||
fieldCount = 0;
|
||||
(e.data.fields || []).forEach(function(f) {
|
||||
addField(f.label, f.kind, f.l2);
|
||||
var lastField = document.querySelector('#fieldsList > div:last-child');
|
||||
lastField.querySelector('.field-value').value = f.value;
|
||||
});
|
||||
}
|
||||
|
||||
var form = document.getElementById('newEntryForm');
|
||||
form.onsubmit = async function(ev) {
|
||||
ev.preventDefault();
|
||||
var fieldDivs = document.querySelectorAll('#fieldsList > div');
|
||||
var fields = [];
|
||||
fieldDivs.forEach(function(div) {
|
||||
var label = div.querySelector('.field-label').value;
|
||||
if (label) {
|
||||
fields.push({
|
||||
label: label,
|
||||
value: div.querySelector('.field-value').value,
|
||||
kind: div.querySelector('.field-kind').value,
|
||||
l2: div.querySelector('.field-l2').checked
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
var urlText = document.getElementById('entryURLs').value;
|
||||
var urls = urlText.split('\n').map(function(u) { return u.trim(); }).filter(Boolean);
|
||||
|
||||
var updated = {
|
||||
type: document.getElementById('entryType').value,
|
||||
title: document.getElementById('entryTitle').value,
|
||||
version: e.version,
|
||||
data: {
|
||||
title: document.getElementById('entryTitle').value,
|
||||
type: document.getElementById('entryType').value,
|
||||
fields: fields,
|
||||
urls: urls,
|
||||
notes: document.getElementById('entryNotes').value
|
||||
}
|
||||
};
|
||||
|
||||
try {
|
||||
await api('PUT', '/api/entries/' + e.entry_id, updated);
|
||||
toast('Entry updated!');
|
||||
closeModal();
|
||||
showEntry(e.entry_id);
|
||||
} catch (err) {
|
||||
toast('Failed to update entry', 'error');
|
||||
}
|
||||
};
|
||||
}, 100);
|
||||
}
|
||||
|
||||
// Import
|
||||
var importedEntries = [];
|
||||
|
||||
function showImport() {
|
||||
var modal = document.getElementById('modal');
|
||||
var content = document.getElementById('modalContent');
|
||||
|
||||
content.innerHTML =
|
||||
'<div class="p-6">' +
|
||||
'<h3 class="text-lg font-bold mb-4">Import Entries</h3>' +
|
||||
'<p class="text-gray-400 text-sm mb-4">Upload a password manager export (CSV, JSON, or any format). Our AI will parse it automatically.</p>' +
|
||||
'<form id="importForm" enctype="multipart/form-data">' +
|
||||
'<div class="border-2 border-dashed border-navy-600 rounded-lg p-8 text-center mb-4">' +
|
||||
'<input type="file" id="importFile" class="hidden" accept=".csv,.json,.txt,.xml">' +
|
||||
'<label for="importFile" class="cursor-pointer">' +
|
||||
'<div class="text-4xl mb-2">📄</div>' +
|
||||
'<div class="text-gray-400">Drop file here or click to browse</div>' +
|
||||
'</label>' +
|
||||
'</div>' +
|
||||
'<div id="importPreview" class="hidden"></div>' +
|
||||
'<div class="flex justify-end gap-3">' +
|
||||
'<button type="button" onclick="closeModal()" class="px-4 py-2 bg-navy-700 rounded">Cancel</button>' +
|
||||
'<button type="submit" class="px-4 py-2 bg-gold text-navy-900 rounded font-medium">Import</button>' +
|
||||
'</div>' +
|
||||
'</form>' +
|
||||
'</div>';
|
||||
|
||||
document.getElementById('importFile').addEventListener('change', previewImport);
|
||||
document.getElementById('importForm').addEventListener('submit', doImport);
|
||||
modal.classList.remove('hidden');
|
||||
}
|
||||
|
||||
async function previewImport(e) {
|
||||
var file = e.target.files[0];
|
||||
if (!file) return;
|
||||
|
||||
var formData = new FormData();
|
||||
formData.append('file', file);
|
||||
|
||||
document.getElementById('importPreview').innerHTML = '<div class="text-gray-400">Analyzing file...</div>';
|
||||
document.getElementById('importPreview').classList.remove('hidden');
|
||||
|
||||
try {
|
||||
var res = await fetch('/api/import', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + token },
|
||||
body: formData
|
||||
});
|
||||
var data = await res.json();
|
||||
|
||||
if (data.error) {
|
||||
document.getElementById('importPreview').innerHTML = '<div class="text-red-400">' + data.error + '</div>';
|
||||
return;
|
||||
}
|
||||
|
||||
importedEntries = data.entries;
|
||||
|
||||
var html = '<div class="mb-4 text-sm text-gray-400">' + data.count + ' entries found</div>' +
|
||||
'<div class="max-h-60 overflow-y-auto space-y-2">';
|
||||
data.entries.forEach(function(e, i) {
|
||||
html += '<div class="p-2 bg-navy-700 rounded text-sm flex items-center gap-2">' +
|
||||
'<input type="checkbox" checked class="import-check" data-idx="' + i + '">' +
|
||||
'<span>' + getTypeIcon(e.type) + '</span>' +
|
||||
'<span>' + escapeHtml(e.title) + '</span>' +
|
||||
(e.fields && e.fields.some(function(f) { return f.l2; }) ? '<span class="text-amber-400">🔒</span>' : '') +
|
||||
'</div>';
|
||||
});
|
||||
html += '</div>';
|
||||
document.getElementById('importPreview').innerHTML = html;
|
||||
} catch (err) {
|
||||
document.getElementById('importPreview').innerHTML = '<div class="text-red-400">Import failed: ' + err.message + '</div>';
|
||||
}
|
||||
}
|
||||
|
||||
async function doImport(e) {
|
||||
e.preventDefault();
|
||||
|
||||
var checkboxes = document.querySelectorAll('.import-check:checked');
|
||||
var selected = [];
|
||||
checkboxes.forEach(function(cb) {
|
||||
selected.push(importedEntries[parseInt(cb.dataset.idx)]);
|
||||
});
|
||||
|
||||
if (selected.length === 0) {
|
||||
toast('No entries selected', 'error');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
var data = await api('POST', '/api/import/confirm', { entries: selected });
|
||||
toast('Imported ' + data.imported + ' entries!');
|
||||
closeModal();
|
||||
loadEntries();
|
||||
} catch (err) {
|
||||
toast('Import failed', 'error');
|
||||
}
|
||||
}
|
||||
|
||||
// Audit Log
|
||||
async function showAudit() {
|
||||
var modal = document.getElementById('modal');
|
||||
var content = document.getElementById('modalContent');
|
||||
|
||||
content.innerHTML = '<div class="p-6 text-gray-400">Loading...</div>';
|
||||
modal.classList.remove('hidden');
|
||||
|
||||
try {
|
||||
var events = await api('GET', '/api/audit?limit=50');
|
||||
|
||||
var html = '<div class="p-6">' +
|
||||
'<h3 class="text-lg font-bold mb-4">Audit Log</h3>' +
|
||||
'<div class="max-h-96 overflow-y-auto">' +
|
||||
'<table class="w-full text-sm">' +
|
||||
'<thead class="text-gray-400 text-left">' +
|
||||
'<tr><th class="py-1">Time</th><th>Action</th><th>Entry</th><th>Actor</th></tr>' +
|
||||
'</thead>' +
|
||||
'<tbody>';
|
||||
events.forEach(function(e) {
|
||||
html += '<tr class="border-t border-navy-600">' +
|
||||
'<td class="py-2">' + new Date(e.created_at).toLocaleString() + '</td>' +
|
||||
'<td>' + e.action + '</td>' +
|
||||
'<td>' + escapeHtml(e.title || '-') + '</td>' +
|
||||
'<td>' + e.actor + '</td>' +
|
||||
'</tr>';
|
||||
});
|
||||
html += '</tbody></table></div>' +
|
||||
'<div class="mt-4 flex justify-end">' +
|
||||
'<button onclick="closeModal()" class="px-4 py-2 bg-navy-700 rounded">Close</button>' +
|
||||
'</div></div>';
|
||||
content.innerHTML = html;
|
||||
} catch (err) {
|
||||
content.innerHTML = '<div class="p-6 text-red-400">Failed to load audit log</div>';
|
||||
}
|
||||
}
|
||||
|
||||
// Search
|
||||
document.getElementById('searchBox').addEventListener('input', async function(e) {
|
||||
var q = e.target.value.trim();
|
||||
if (q.length < 2) {
|
||||
renderEntryList();
|
||||
return;
|
||||
}
|
||||
try {
|
||||
var results = await api('GET', '/api/search?q=' + encodeURIComponent(q));
|
||||
entries = results;
|
||||
renderEntryList();
|
||||
} catch (err) {
|
||||
// ignore
|
||||
}
|
||||
});
|
||||
|
||||
// Utilities
|
||||
function closeModal() {
|
||||
document.getElementById('modal').classList.add('hidden');
|
||||
}
|
||||
|
||||
function getTypeIcon(type) {
|
||||
var icons = {
|
||||
credential: '🔑',
|
||||
card: '💳',
|
||||
identity: '👤',
|
||||
note: '📝',
|
||||
ssh_key: '🔐',
|
||||
totp: '🔢',
|
||||
folder: '📁',
|
||||
custom: '📦'
|
||||
};
|
||||
return icons[type] || '📄';
|
||||
}
|
||||
|
||||
function hasL2Fields(entry) {
|
||||
return entry.data && entry.data.fields && entry.data.fields.some(function(f) { return f.l2; });
|
||||
}
|
||||
|
||||
function escapeHtml(str) {
|
||||
if (!str) return '';
|
||||
return str.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"');
|
||||
}
|
||||
|
||||
// Init
|
||||
if (token) {
|
||||
loadEntries();
|
||||
} else {
|
||||
showSetup();
|
||||
}
|
||||
|
||||
// Close modal on backdrop click
|
||||
document.getElementById('modal').addEventListener('click', function(e) {
|
||||
if (e.target.id === 'modal') closeModal();
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
// ClawVault Background Service Worker
|
||||
|
||||
// Get settings from storage
|
||||
async function getSettings() {
|
||||
const result = await chrome.storage.local.get(['vaultUrl', 'apiToken']);
|
||||
return {
|
||||
vaultUrl: result.vaultUrl || 'http://localhost:8765',
|
||||
apiToken: result.apiToken || ''
|
||||
};
|
||||
}
|
||||
|
||||
// API call helper
|
||||
async function apiCall(method, path, body) {
|
||||
const settings = await getSettings();
|
||||
if (!settings.apiToken) {
|
||||
throw new Error('Not configured');
|
||||
}
|
||||
|
||||
const opts = {
|
||||
method,
|
||||
headers: {
|
||||
'Authorization': 'Bearer ' + settings.apiToken,
|
||||
'Content-Type': 'application/json'
|
||||
}
|
||||
};
|
||||
if (body) {
|
||||
opts.body = JSON.stringify(body);
|
||||
}
|
||||
|
||||
const res = await fetch(settings.vaultUrl + path, opts);
|
||||
if (!res.ok) {
|
||||
throw new Error('API error: ' + res.status);
|
||||
}
|
||||
return res.json();
|
||||
}
|
||||
|
||||
// Handle messages from popup and content scripts
|
||||
chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {
|
||||
if (request.action === 'getMatches') {
|
||||
apiCall('GET', '/api/ext/match?url=' + encodeURIComponent(request.url))
|
||||
.then(matches => sendResponse({ success: true, matches }))
|
||||
.catch(err => sendResponse({ success: false, error: err.message }));
|
||||
return true; // async response
|
||||
}
|
||||
|
||||
if (request.action === 'getEntry') {
|
||||
apiCall('GET', '/api/entries/' + request.id)
|
||||
.then(entry => sendResponse({ success: true, entry }))
|
||||
.catch(err => sendResponse({ success: false, error: err.message }));
|
||||
return true;
|
||||
}
|
||||
|
||||
if (request.action === 'getTOTP') {
|
||||
apiCall('GET', '/api/ext/totp/' + request.id)
|
||||
.then(data => sendResponse({ success: true, data }))
|
||||
.catch(err => sendResponse({ success: false, error: err.message }));
|
||||
return true;
|
||||
}
|
||||
|
||||
if (request.action === 'mapFields') {
|
||||
apiCall('POST', '/api/ext/map', request.data)
|
||||
.then(mapping => sendResponse({ success: true, mapping }))
|
||||
.catch(err => sendResponse({ success: false, error: err.message }));
|
||||
return true;
|
||||
}
|
||||
|
||||
if (request.action === 'fill') {
|
||||
// Relay fill request to content script
|
||||
chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
|
||||
if (tabs[0]) {
|
||||
chrome.tabs.sendMessage(tabs[0].id, {
|
||||
action: 'fillFields',
|
||||
fields: request.fields
|
||||
});
|
||||
}
|
||||
});
|
||||
sendResponse({ success: true });
|
||||
return true;
|
||||
}
|
||||
|
||||
if (request.action === 'getSettings') {
|
||||
getSettings().then(settings => sendResponse({ success: true, settings }));
|
||||
return true;
|
||||
}
|
||||
|
||||
if (request.action === 'saveSettings') {
|
||||
chrome.storage.local.set({
|
||||
vaultUrl: request.vaultUrl,
|
||||
apiToken: request.apiToken
|
||||
}).then(() => sendResponse({ success: true }));
|
||||
return true;
|
||||
}
|
||||
});
|
||||
|
||||
// Listen for form detection from content scripts
|
||||
chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {
|
||||
if (request.action === 'formsDetected') {
|
||||
// Update badge with form count
|
||||
if (request.count > 0) {
|
||||
chrome.action.setBadgeText({ text: String(request.count), tabId: sender.tab.id });
|
||||
chrome.action.setBadgeBackgroundColor({ color: '#c9a84c', tabId: sender.tab.id });
|
||||
} else {
|
||||
chrome.action.setBadgeText({ text: '', tabId: sender.tab.id });
|
||||
}
|
||||
}
|
||||
});
|
||||
|
|
@ -0,0 +1,124 @@
|
|||
// ClawVault Content Script
|
||||
|
||||
// Detect login forms and notify background
|
||||
function detectForms() {
|
||||
const forms = document.querySelectorAll('form');
|
||||
let loginForms = 0;
|
||||
|
||||
forms.forEach(form => {
|
||||
const hasPassword = form.querySelector('input[type="password"]');
|
||||
const hasUsername = form.querySelector('input[type="text"], input[type="email"], input[name*="user"], input[name*="email"], input[name*="login"]');
|
||||
|
||||
if (hasPassword || hasUsername) {
|
||||
loginForms++;
|
||||
}
|
||||
});
|
||||
|
||||
// Also check for standalone password fields
|
||||
const standalonePasswords = document.querySelectorAll('input[type="password"]:not(form input)');
|
||||
loginForms += standalonePasswords.length;
|
||||
|
||||
chrome.runtime.sendMessage({ action: 'formsDetected', count: loginForms });
|
||||
|
||||
return loginForms;
|
||||
}
|
||||
|
||||
// Get all form fields for mapping
|
||||
function getFormFields() {
|
||||
const fields = [];
|
||||
const inputs = document.querySelectorAll('input:not([type="hidden"]):not([type="submit"]):not([type="button"])');
|
||||
|
||||
inputs.forEach(input => {
|
||||
const label = findLabel(input);
|
||||
fields.push({
|
||||
selector: getSelector(input),
|
||||
label: label,
|
||||
type: input.type,
|
||||
name: input.name,
|
||||
placeholder: input.placeholder,
|
||||
autocomplete: input.autocomplete
|
||||
});
|
||||
});
|
||||
|
||||
return fields;
|
||||
}
|
||||
|
||||
// Find label for an input
|
||||
function findLabel(input) {
|
||||
// Check for associated label
|
||||
if (input.id) {
|
||||
const label = document.querySelector(`label[for="${input.id}"]`);
|
||||
if (label) return label.textContent.trim();
|
||||
}
|
||||
|
||||
// Check for wrapping label
|
||||
const parent = input.closest('label');
|
||||
if (parent) {
|
||||
const text = parent.textContent.replace(input.value, '').trim();
|
||||
if (text) return text;
|
||||
}
|
||||
|
||||
// Check aria-label
|
||||
if (input.getAttribute('aria-label')) {
|
||||
return input.getAttribute('aria-label');
|
||||
}
|
||||
|
||||
// Use placeholder or name as fallback
|
||||
return input.placeholder || input.name || input.type;
|
||||
}
|
||||
|
||||
// Generate a unique selector for an element
|
||||
function getSelector(el) {
|
||||
if (el.id) return '#' + el.id;
|
||||
if (el.name) return `[name="${el.name}"]`;
|
||||
|
||||
// Build a path selector
|
||||
const path = [];
|
||||
while (el && el !== document.body) {
|
||||
let selector = el.tagName.toLowerCase();
|
||||
if (el.className) {
|
||||
selector += '.' + el.className.trim().split(/\s+/).join('.');
|
||||
}
|
||||
path.unshift(selector);
|
||||
el = el.parentElement;
|
||||
}
|
||||
return path.join(' > ');
|
||||
}
|
||||
|
||||
// Fill fields by selector
|
||||
function fillFields(fields) {
|
||||
Object.entries(fields).forEach(([label, selector]) => {
|
||||
try {
|
||||
const el = document.querySelector(selector);
|
||||
if (el) {
|
||||
el.value = label; // label here is actually the value
|
||||
el.dispatchEvent(new Event('input', { bubbles: true }));
|
||||
el.dispatchEvent(new Event('change', { bubbles: true }));
|
||||
}
|
||||
} catch (e) {
|
||||
console.error('ClawVault: Failed to fill field', selector, e);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Listen for messages from background
|
||||
chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {
|
||||
if (request.action === 'fillFields') {
|
||||
fillFields(request.fields);
|
||||
sendResponse({ success: true });
|
||||
}
|
||||
|
||||
if (request.action === 'getFormFields') {
|
||||
const fields = getFormFields();
|
||||
sendResponse({ success: true, fields });
|
||||
}
|
||||
});
|
||||
|
||||
// Detect forms on page load
|
||||
setTimeout(detectForms, 500);
|
||||
|
||||
// Re-detect on dynamic content changes
|
||||
const observer = new MutationObserver(() => {
|
||||
detectForms();
|
||||
});
|
||||
observer.observe(document.body, { childList: true, subtree: true });
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 118 B |
Binary file not shown.
|
After Width: | Height: | Size: 87 B |
Binary file not shown.
|
After Width: | Height: | Size: 100 B |
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"manifest_version": 3,
|
||||
"name": "ClawVault",
|
||||
"version": "0.1.0",
|
||||
"description": "ClawVault password manager extension",
|
||||
"permissions": ["activeTab", "storage", "scripting"],
|
||||
"action": {
|
||||
"default_popup": "popup.html",
|
||||
"default_icon": {
|
||||
"16": "icon16.png",
|
||||
"48": "icon48.png",
|
||||
"128": "icon128.png"
|
||||
}
|
||||
},
|
||||
"background": {
|
||||
"service_worker": "background.js"
|
||||
},
|
||||
"content_scripts": [{
|
||||
"matches": ["<all_urls>"],
|
||||
"js": ["content.js"],
|
||||
"run_at": "document_idle"
|
||||
}],
|
||||
"icons": {
|
||||
"16": "icon16.png",
|
||||
"48": "icon48.png",
|
||||
"128": "icon128.png"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<style>
|
||||
* { margin: 0; padding: 0; box-sizing: border-box; }
|
||||
body {
|
||||
width: 320px;
|
||||
min-height: 200px;
|
||||
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
|
||||
background: #111827;
|
||||
color: #e5e7eb;
|
||||
}
|
||||
.header {
|
||||
padding: 12px 16px;
|
||||
background: #0a0f1a;
|
||||
border-bottom: 1px solid #374151;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
}
|
||||
.header h1 {
|
||||
font-size: 14px;
|
||||
font-weight: 600;
|
||||
color: #c9a84c;
|
||||
}
|
||||
.content { padding: 12px; }
|
||||
.url {
|
||||
font-size: 11px;
|
||||
color: #9ca3af;
|
||||
margin-bottom: 12px;
|
||||
white-space: nowrap;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
}
|
||||
.entry {
|
||||
padding: 10px;
|
||||
background: #1f2937;
|
||||
border: 1px solid #374151;
|
||||
border-radius: 6px;
|
||||
margin-bottom: 8px;
|
||||
cursor: pointer;
|
||||
transition: border-color 0.2s;
|
||||
}
|
||||
.entry:hover { border-color: #c9a84c; }
|
||||
.entry-title { font-weight: 500; }
|
||||
.entry-meta { font-size: 11px; color: #9ca3af; margin-top: 2px; }
|
||||
.entry-l2 { color: #fbbf24; }
|
||||
.empty {
|
||||
text-align: center;
|
||||
color: #6b7280;
|
||||
padding: 24px;
|
||||
}
|
||||
.settings-link {
|
||||
font-size: 11px;
|
||||
color: #c9a84c;
|
||||
text-decoration: none;
|
||||
display: block;
|
||||
text-align: center;
|
||||
padding: 8px;
|
||||
border-top: 1px solid #374151;
|
||||
}
|
||||
.settings-link:hover { text-decoration: underline; }
|
||||
|
||||
/* Settings view */
|
||||
.settings { display: none; padding: 12px; }
|
||||
.settings.active { display: block; }
|
||||
.settings label {
|
||||
display: block;
|
||||
font-size: 12px;
|
||||
color: #9ca3af;
|
||||
margin-bottom: 4px;
|
||||
}
|
||||
.settings input {
|
||||
width: 100%;
|
||||
padding: 8px;
|
||||
margin-bottom: 12px;
|
||||
background: #1f2937;
|
||||
border: 1px solid #374151;
|
||||
border-radius: 4px;
|
||||
color: #e5e7eb;
|
||||
font-size: 12px;
|
||||
}
|
||||
.settings input:focus {
|
||||
outline: none;
|
||||
border-color: #c9a84c;
|
||||
}
|
||||
.btn {
|
||||
width: 100%;
|
||||
padding: 10px;
|
||||
background: #c9a84c;
|
||||
color: #0a0f1a;
|
||||
border: none;
|
||||
border-radius: 4px;
|
||||
font-weight: 500;
|
||||
cursor: pointer;
|
||||
}
|
||||
.btn:hover { background: #d4af5a; }
|
||||
.btn-secondary {
|
||||
background: #374151;
|
||||
color: #e5e7eb;
|
||||
}
|
||||
.btn-secondary:hover { background: #4b5563; }
|
||||
.status {
|
||||
font-size: 11px;
|
||||
text-align: center;
|
||||
padding: 8px;
|
||||
border-radius: 4px;
|
||||
margin-bottom: 12px;
|
||||
}
|
||||
.status.success { background: #064e3b; color: #34d399; }
|
||||
.status.error { background: #7f1d1d; color: #fca5a5; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="header">
|
||||
<span>🔐</span>
|
||||
<h1>ClawVault</h1>
|
||||
</div>
|
||||
|
||||
<div id="matchView" class="content">
|
||||
<div class="url" id="currentUrl"></div>
|
||||
<div id="matches"></div>
|
||||
<a href="#" class="settings-link" id="settingsLink">⚙️ Settings</a>
|
||||
</div>
|
||||
|
||||
<div id="settingsView" class="settings">
|
||||
<div id="settingsStatus"></div>
|
||||
<label>Vault URL</label>
|
||||
<input type="text" id="vaultUrl" placeholder="http://localhost:8765">
|
||||
<label>API Token</label>
|
||||
<input type="password" id="apiToken" placeholder="Your API token">
|
||||
<button class="btn" id="saveSettings">Save Settings</button>
|
||||
<button class="btn btn-secondary" id="backToMatches" style="margin-top: 8px;">← Back</button>
|
||||
</div>
|
||||
|
||||
<script src="popup.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,174 @@
|
|||
// ClawVault Popup Script
|
||||
|
||||
let currentUrl = '';
|
||||
let currentMatches = [];
|
||||
|
||||
// Get current tab URL
|
||||
async function getCurrentUrl() {
|
||||
const tabs = await chrome.tabs.query({ active: true, currentWindow: true });
|
||||
if (tabs[0]) {
|
||||
currentUrl = tabs[0].url;
|
||||
document.getElementById('currentUrl').textContent = new URL(currentUrl).hostname;
|
||||
return currentUrl;
|
||||
}
|
||||
return '';
|
||||
}
|
||||
|
||||
// Load matching credentials
|
||||
async function loadMatches() {
|
||||
const url = await getCurrentUrl();
|
||||
if (!url) return;
|
||||
|
||||
const matchesDiv = document.getElementById('matches');
|
||||
matchesDiv.innerHTML = '<div class="empty">Loading...</div>';
|
||||
|
||||
chrome.runtime.sendMessage({ action: 'getMatches', url }, (response) => {
|
||||
if (chrome.runtime.lastError || !response || !response.success) {
|
||||
matchesDiv.innerHTML = '<div class="empty">Not connected to vault. Check settings.</div>';
|
||||
return;
|
||||
}
|
||||
|
||||
currentMatches = response.matches;
|
||||
|
||||
if (!currentMatches || currentMatches.length === 0) {
|
||||
matchesDiv.innerHTML = '<div class="empty">No matching credentials</div>';
|
||||
return;
|
||||
}
|
||||
|
||||
let html = '';
|
||||
currentMatches.forEach((entry, idx) => {
|
||||
const hasL2 = entry.data && entry.data.fields && entry.data.fields.some(f => f.l2);
|
||||
html += `<div class="entry" data-idx="${idx}">
|
||||
<div class="entry-title">${escapeHtml(entry.title)}</div>
|
||||
<div class="entry-meta">
|
||||
${entry.type}
|
||||
${hasL2 ? '<span class="entry-l2">🔒 L2</span>' : ''}
|
||||
</div>
|
||||
</div>`;
|
||||
});
|
||||
|
||||
matchesDiv.innerHTML = html;
|
||||
|
||||
// Add click handlers
|
||||
document.querySelectorAll('.entry').forEach(el => {
|
||||
el.addEventListener('click', () => fillEntry(parseInt(el.dataset.idx)));
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// Fill an entry into the page
|
||||
async function fillEntry(idx) {
|
||||
const entry = currentMatches[idx];
|
||||
if (!entry || !entry.data || !entry.data.fields) return;
|
||||
|
||||
// Get form fields from page
|
||||
chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
|
||||
chrome.tabs.sendMessage(tabs[0].id, { action: 'getFormFields' }, (response) => {
|
||||
if (chrome.runtime.lastError || !response || !response.success) {
|
||||
// Fallback: try simple fill
|
||||
simpleFill(entry);
|
||||
return;
|
||||
}
|
||||
|
||||
// Request LLM mapping
|
||||
chrome.runtime.sendMessage({
|
||||
action: 'mapFields',
|
||||
data: {
|
||||
entry_id: entry.entry_id,
|
||||
page_fields: response.fields
|
||||
}
|
||||
}, (mapResponse) => {
|
||||
if (mapResponse && mapResponse.success && mapResponse.mapping) {
|
||||
// Convert mapping to actual values
|
||||
const fields = {};
|
||||
Object.entries(mapResponse.mapping).forEach(([label, selector]) => {
|
||||
const field = entry.data.fields.find(f => f.label === label);
|
||||
if (field && !field.l2) {
|
||||
fields[selector] = field.value;
|
||||
}
|
||||
});
|
||||
|
||||
chrome.runtime.sendMessage({ action: 'fill', fields });
|
||||
} else {
|
||||
simpleFill(entry);
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
window.close();
|
||||
}
|
||||
|
||||
// Simple fill without LLM mapping
|
||||
function simpleFill(entry) {
|
||||
const fields = {};
|
||||
entry.data.fields.forEach(f => {
|
||||
if (f.l2) return;
|
||||
|
||||
if (f.label.toLowerCase().includes('user') || f.label.toLowerCase().includes('email')) {
|
||||
fields['input[type="email"], input[type="text"], input[name*="user"], input[name*="email"]'] = f.value;
|
||||
}
|
||||
if (f.label.toLowerCase().includes('password') || f.kind === 'password') {
|
||||
fields['input[type="password"]'] = f.value;
|
||||
}
|
||||
});
|
||||
|
||||
chrome.runtime.sendMessage({ action: 'fill', fields });
|
||||
}
|
||||
|
||||
// Settings handlers
|
||||
document.getElementById('settingsLink').addEventListener('click', (e) => {
|
||||
e.preventDefault();
|
||||
document.getElementById('matchView').style.display = 'none';
|
||||
document.getElementById('settingsView').classList.add('active');
|
||||
loadSettings();
|
||||
});
|
||||
|
||||
document.getElementById('backToMatches').addEventListener('click', () => {
|
||||
document.getElementById('settingsView').classList.remove('active');
|
||||
document.getElementById('matchView').style.display = 'block';
|
||||
});
|
||||
|
||||
document.getElementById('saveSettings').addEventListener('click', saveSettings);
|
||||
|
||||
async function loadSettings() {
|
||||
chrome.runtime.sendMessage({ action: 'getSettings' }, (response) => {
|
||||
if (response && response.success) {
|
||||
document.getElementById('vaultUrl').value = response.settings.vaultUrl || '';
|
||||
document.getElementById('apiToken').value = response.settings.apiToken || '';
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
async function saveSettings() {
|
||||
const vaultUrl = document.getElementById('vaultUrl').value.trim();
|
||||
const apiToken = document.getElementById('apiToken').value.trim();
|
||||
|
||||
chrome.runtime.sendMessage({
|
||||
action: 'saveSettings',
|
||||
vaultUrl,
|
||||
apiToken
|
||||
}, (response) => {
|
||||
const status = document.getElementById('settingsStatus');
|
||||
if (response && response.success) {
|
||||
status.className = 'status success';
|
||||
status.textContent = 'Settings saved!';
|
||||
setTimeout(() => {
|
||||
document.getElementById('settingsView').classList.remove('active');
|
||||
document.getElementById('matchView').style.display = 'block';
|
||||
loadMatches();
|
||||
}, 1000);
|
||||
} else {
|
||||
status.className = 'status error';
|
||||
status.textContent = 'Failed to save settings';
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
function escapeHtml(str) {
|
||||
if (!str) return '';
|
||||
return str.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');
|
||||
}
|
||||
|
||||
// Initialize
|
||||
loadMatches();
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
module github.com/johanj/clawvault
|
||||
|
||||
go 1.24.0
|
||||
|
||||
require (
|
||||
github.com/go-chi/chi/v5 v5.2.5
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/klauspost/compress v1.18.4
|
||||
github.com/mattn/go-sqlite3 v1.14.34
|
||||
github.com/pquerna/otp v1.5.0
|
||||
golang.org/x/crypto v0.48.0
|
||||
)
|
||||
|
||||
require github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
|
||||
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
|
||||
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
|
||||
github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
|
||||
github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
|
||||
github.com/mattn/go-sqlite3 v1.14.34 h1:3NtcvcUnFBPsuRcno8pUtupspG/GM+9nZ88zgJcp6Zk=
|
||||
github.com/mattn/go-sqlite3 v1.14.34/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
|
||||
github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
|
||||
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
package lib
|
||||
|
||||
import (
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"os"
|
||||
)
|
||||
|
||||
// Config holds application configuration.
|
||||
type Config struct {
|
||||
VaultKey []byte // decoded from VAULT_KEY hex env
|
||||
Port string // default "8765"
|
||||
DBPath string // default "./clawvault.db"
|
||||
FireworksAPIKey string
|
||||
LLMModel string // default llama-v3p3-70b-instruct
|
||||
SessionTTL int64 // default 86400 (24 hours)
|
||||
}
|
||||
|
||||
// LoadConfig loads configuration from environment variables.
|
||||
func LoadConfig() (*Config, error) {
|
||||
vaultKeyHex := os.Getenv("VAULT_KEY")
|
||||
if vaultKeyHex == "" {
|
||||
return nil, fmt.Errorf("VAULT_KEY environment variable required")
|
||||
}
|
||||
vaultKey, err := hex.DecodeString(vaultKeyHex)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("VAULT_KEY must be hex: %w", err)
|
||||
}
|
||||
if len(vaultKey) != 32 {
|
||||
return nil, fmt.Errorf("VAULT_KEY must be 32 bytes (64 hex chars)")
|
||||
}
|
||||
|
||||
port := os.Getenv("PORT")
|
||||
if port == "" {
|
||||
port = "8765"
|
||||
}
|
||||
|
||||
dbPath := os.Getenv("DB_PATH")
|
||||
if dbPath == "" {
|
||||
dbPath = "./clawvault.db"
|
||||
}
|
||||
|
||||
fireworksKey := os.Getenv("FIREWORKS_API_KEY")
|
||||
llmModel := os.Getenv("LLM_MODEL")
|
||||
if llmModel == "" {
|
||||
llmModel = "accounts/fireworks/models/llama-v3p3-70b-instruct"
|
||||
}
|
||||
|
||||
sessionTTL := int64(86400) // 24 hours default
|
||||
|
||||
return &Config{
|
||||
VaultKey: vaultKey,
|
||||
Port: port,
|
||||
DBPath: dbPath,
|
||||
FireworksAPIKey: fireworksKey,
|
||||
LLMModel: llmModel,
|
||||
SessionTTL: sessionTTL,
|
||||
}, nil
|
||||
}
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
package lib
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/hmac"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"errors"
|
||||
"io"
|
||||
|
||||
"github.com/klauspost/compress/zstd"
|
||||
"golang.org/x/crypto/hkdf"
|
||||
)
|
||||
|
||||
var (
|
||||
ErrDecryptionFailed = errors.New("decryption failed")
|
||||
ErrInvalidCiphertext = errors.New("invalid ciphertext")
|
||||
)
|
||||
|
||||
// DeriveEntryKey derives a per-entry AES-256 key from the vault key using HKDF-SHA256.
|
||||
func DeriveEntryKey(vaultKey []byte, entryID string) ([]byte, error) {
|
||||
info := []byte("clawvault-entry-" + entryID)
|
||||
reader := hkdf.New(sha256.New, vaultKey, nil, info)
|
||||
key := make([]byte, 32) // AES-256
|
||||
if _, err := io.ReadFull(reader, key); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
// DeriveHMACKey derives a separate HMAC key for blind indexes.
|
||||
func DeriveHMACKey(vaultKey []byte) ([]byte, error) {
|
||||
info := []byte("clawvault-hmac-index")
|
||||
reader := hkdf.New(sha256.New, vaultKey, nil, info)
|
||||
key := make([]byte, 32)
|
||||
if _, err := io.ReadFull(reader, key); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
// BlindIndex computes an HMAC-SHA256 blind index for searchable encrypted fields.
|
||||
// Returns truncated hash (16 bytes) for storage efficiency.
|
||||
func BlindIndex(hmacKey []byte, plaintext string) []byte {
|
||||
h := hmac.New(sha256.New, hmacKey)
|
||||
h.Write([]byte(plaintext))
|
||||
return h.Sum(nil)[:16] // truncate to 16 bytes
|
||||
}
|
||||
|
||||
// Pack compresses with zstd then encrypts with AES-256-GCM (random nonce).
|
||||
func Pack(key []byte, plaintext string) ([]byte, error) {
|
||||
compressed, err := zstdCompress([]byte(plaintext))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return gcm.Seal(nonce, nonce, compressed, nil), nil
|
||||
}
|
||||
|
||||
// Unpack decrypts AES-256-GCM then decompresses zstd.
|
||||
func Unpack(key []byte, ciphertext []byte) (string, error) {
|
||||
if len(ciphertext) == 0 {
|
||||
return "", nil
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
nonceSize := gcm.NonceSize()
|
||||
if len(ciphertext) < nonceSize {
|
||||
return "", ErrInvalidCiphertext
|
||||
}
|
||||
|
||||
nonce, ct := ciphertext[:nonceSize], ciphertext[nonceSize:]
|
||||
compressed, err := gcm.Open(nil, nonce, ct, nil)
|
||||
if err != nil {
|
||||
return "", ErrDecryptionFailed
|
||||
}
|
||||
|
||||
decompressed, err := zstdDecompress(compressed)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return string(decompressed), nil
|
||||
}
|
||||
|
||||
// zstd encoder/decoder (reusable, goroutine-safe)
|
||||
var (
|
||||
zstdEncoder, _ = zstd.NewWriter(nil, zstd.WithEncoderLevel(zstd.SpeedDefault))
|
||||
zstdDecoder, _ = zstd.NewReader(nil)
|
||||
)
|
||||
|
||||
func zstdCompress(data []byte) ([]byte, error) {
|
||||
return zstdEncoder.EncodeAll(data, nil), nil
|
||||
}
|
||||
|
||||
func zstdDecompress(data []byte) ([]byte, error) {
|
||||
return zstdDecoder.DecodeAll(data, nil)
|
||||
}
|
||||
|
||||
// GenerateToken generates a random hex token (32 bytes = 64 hex chars).
|
||||
func GenerateToken() string {
|
||||
b := make([]byte, 32)
|
||||
rand.Read(b)
|
||||
const hex = "0123456789abcdef"
|
||||
result := make([]byte, 64)
|
||||
for i, v := range b {
|
||||
result[i*2] = hex[v>>4]
|
||||
result[i*2+1] = hex[v&0x0f]
|
||||
}
|
||||
return string(result)
|
||||
}
|
||||
|
|
@ -0,0 +1,469 @@
|
|||
package lib
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
)
|
||||
|
||||
var (
|
||||
ErrNotFound = errors.New("not found")
|
||||
ErrVersionConflict = errors.New("version conflict: entry was modified")
|
||||
)
|
||||
|
||||
const schema = `
|
||||
CREATE TABLE IF NOT EXISTS entries (
|
||||
entry_id TEXT PRIMARY KEY,
|
||||
parent_id TEXT NOT NULL DEFAULT '',
|
||||
type TEXT NOT NULL,
|
||||
title TEXT NOT NULL,
|
||||
title_idx BLOB NOT NULL,
|
||||
data BLOB NOT NULL,
|
||||
data_level INTEGER NOT NULL DEFAULT 1,
|
||||
created_at INTEGER NOT NULL,
|
||||
updated_at INTEGER NOT NULL,
|
||||
version INTEGER NOT NULL DEFAULT 1,
|
||||
deleted_at INTEGER
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_entries_parent ON entries(parent_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_entries_type ON entries(type);
|
||||
CREATE INDEX IF NOT EXISTS idx_entries_title_idx ON entries(title_idx);
|
||||
CREATE INDEX IF NOT EXISTS idx_entries_deleted ON entries(deleted_at);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS sessions (
|
||||
token TEXT PRIMARY KEY,
|
||||
created_at INTEGER NOT NULL,
|
||||
expires_at INTEGER NOT NULL,
|
||||
actor TEXT NOT NULL DEFAULT 'web'
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS audit_log (
|
||||
event_id TEXT PRIMARY KEY,
|
||||
entry_id TEXT,
|
||||
title TEXT,
|
||||
action TEXT NOT NULL,
|
||||
actor TEXT NOT NULL,
|
||||
ip_addr TEXT,
|
||||
created_at INTEGER NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_entry ON audit_log(entry_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log(created_at);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS webauthn_credentials (
|
||||
cred_id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
public_key BLOB NOT NULL,
|
||||
prf_salt BLOB NOT NULL,
|
||||
sign_count INTEGER NOT NULL DEFAULT 0,
|
||||
created_at INTEGER NOT NULL
|
||||
);
|
||||
`
|
||||
|
||||
// OpenDB opens the SQLite database.
|
||||
func OpenDB(dbPath string) (*DB, error) {
|
||||
conn, err := sql.Open("sqlite3", dbPath+"?_journal_mode=WAL&_foreign_keys=ON&_busy_timeout=5000")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open db: %w", err)
|
||||
}
|
||||
if err := conn.Ping(); err != nil {
|
||||
return nil, fmt.Errorf("ping db: %w", err)
|
||||
}
|
||||
return &DB{Conn: conn}, nil
|
||||
}
|
||||
|
||||
// MigrateDB runs the schema migrations.
|
||||
func MigrateDB(db *DB) error {
|
||||
_, err := db.Conn.Exec(schema)
|
||||
return err
|
||||
}
|
||||
|
||||
// Close closes the database connection.
|
||||
func (db *DB) Close() error {
|
||||
return db.Conn.Close()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Entry operations
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// EntryCreate creates a new entry.
|
||||
func EntryCreate(db *DB, cfg *Config, e *Entry) error {
|
||||
if e.EntryID == "" {
|
||||
e.EntryID = uuid.New().String()
|
||||
}
|
||||
|
||||
now := time.Now().UnixMilli()
|
||||
e.CreatedAt = now
|
||||
e.UpdatedAt = now
|
||||
e.Version = 1
|
||||
if e.DataLevel == 0 {
|
||||
e.DataLevel = DataLevelL1
|
||||
}
|
||||
|
||||
// Derive keys and encrypt
|
||||
entryKey, err := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
hmacKey, err := DeriveHMACKey(cfg.VaultKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Create blind index for title
|
||||
e.TitleIdx = BlindIndex(hmacKey, strings.ToLower(e.Title))
|
||||
|
||||
// Pack VaultData if present
|
||||
if e.VaultData != nil {
|
||||
dataJSON, err := json.Marshal(e.VaultData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
packed, err := Pack(entryKey, string(dataJSON))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
e.Data = packed
|
||||
}
|
||||
|
||||
_, err = db.Conn.Exec(
|
||||
`INSERT INTO entries (entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
e.EntryID, e.ParentID, e.Type, e.Title, e.TitleIdx, e.Data, e.DataLevel, e.CreatedAt, e.UpdatedAt, e.Version,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
// EntryGet retrieves an entry by ID.
|
||||
func EntryGet(db *DB, cfg *Config, entryID string) (*Entry, error) {
|
||||
var e Entry
|
||||
var deletedAt sql.NullInt64
|
||||
err := db.Conn.QueryRow(
|
||||
`SELECT entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version, deleted_at
|
||||
FROM entries WHERE entry_id = ?`, entryID,
|
||||
).Scan(&e.EntryID, &e.ParentID, &e.Type, &e.Title, &e.TitleIdx, &e.Data, &e.DataLevel, &e.CreatedAt, &e.UpdatedAt, &e.Version, &deletedAt)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if deletedAt.Valid {
|
||||
v := deletedAt.Int64
|
||||
e.DeletedAt = &v
|
||||
}
|
||||
|
||||
// Unpack data
|
||||
if len(e.Data) > 0 && e.DataLevel == DataLevelL1 {
|
||||
entryKey, err := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
dataText, err := Unpack(entryKey, e.Data)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var vd VaultData
|
||||
if err := json.Unmarshal([]byte(dataText), &vd); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
e.VaultData = &vd
|
||||
}
|
||||
|
||||
return &e, nil
|
||||
}
|
||||
|
||||
// EntryUpdate updates an existing entry with optimistic locking.
|
||||
func EntryUpdate(db *DB, cfg *Config, e *Entry) error {
|
||||
now := time.Now().UnixMilli()
|
||||
|
||||
// Derive keys
|
||||
entryKey, err := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
hmacKey, err := DeriveHMACKey(cfg.VaultKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Update blind index
|
||||
e.TitleIdx = BlindIndex(hmacKey, strings.ToLower(e.Title))
|
||||
|
||||
// Pack VaultData if present
|
||||
if e.VaultData != nil {
|
||||
dataJSON, err := json.Marshal(e.VaultData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
packed, err := Pack(entryKey, string(dataJSON))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
e.Data = packed
|
||||
}
|
||||
|
||||
result, err := db.Conn.Exec(
|
||||
`UPDATE entries SET parent_id=?, type=?, title=?, title_idx=?, data=?, data_level=?, updated_at=?, version=version+1
|
||||
WHERE entry_id = ? AND version = ? AND deleted_at IS NULL`,
|
||||
e.ParentID, e.Type, e.Title, e.TitleIdx, e.Data, e.DataLevel, now,
|
||||
e.EntryID, e.Version,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
affected, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if affected == 0 {
|
||||
return ErrVersionConflict
|
||||
}
|
||||
e.Version++
|
||||
e.UpdatedAt = now
|
||||
return nil
|
||||
}
|
||||
|
||||
// EntryDelete soft-deletes an entry.
|
||||
func EntryDelete(db *DB, entryID string) error {
|
||||
now := time.Now().UnixMilli()
|
||||
result, err := db.Conn.Exec(
|
||||
`UPDATE entries SET deleted_at = ?, updated_at = ? WHERE entry_id = ? AND deleted_at IS NULL`,
|
||||
now, now, entryID,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
affected, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if affected == 0 {
|
||||
return ErrNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// EntryList returns all non-deleted entries, optionally filtered by parent.
|
||||
func EntryList(db *DB, cfg *Config, parentID *string) ([]Entry, error) {
|
||||
var rows *sql.Rows
|
||||
var err error
|
||||
|
||||
if parentID != nil {
|
||||
rows, err = db.Conn.Query(
|
||||
`SELECT entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version
|
||||
FROM entries WHERE deleted_at IS NULL AND parent_id = ? ORDER BY type, title`, *parentID,
|
||||
)
|
||||
} else {
|
||||
rows, err = db.Conn.Query(
|
||||
`SELECT entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version
|
||||
FROM entries WHERE deleted_at IS NULL ORDER BY type, title`,
|
||||
)
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var entries []Entry
|
||||
for rows.Next() {
|
||||
var e Entry
|
||||
if err := rows.Scan(&e.EntryID, &e.ParentID, &e.Type, &e.Title, &e.TitleIdx, &e.Data, &e.DataLevel, &e.CreatedAt, &e.UpdatedAt, &e.Version); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Unpack L1 data
|
||||
if len(e.Data) > 0 && e.DataLevel == DataLevelL1 {
|
||||
entryKey, err := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
if err == nil {
|
||||
dataText, err := Unpack(entryKey, e.Data)
|
||||
if err == nil {
|
||||
var vd VaultData
|
||||
if json.Unmarshal([]byte(dataText), &vd) == nil {
|
||||
e.VaultData = &vd
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
entries = append(entries, e)
|
||||
}
|
||||
return entries, rows.Err()
|
||||
}
|
||||
|
||||
// EntrySearch searches entries by title (blind index lookup).
|
||||
func EntrySearch(db *DB, cfg *Config, query string) ([]Entry, error) {
|
||||
hmacKey, err := DeriveHMACKey(cfg.VaultKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
idx := BlindIndex(hmacKey, strings.ToLower(query))
|
||||
|
||||
rows, err := db.Conn.Query(
|
||||
`SELECT entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version
|
||||
FROM entries WHERE deleted_at IS NULL AND title_idx = ? ORDER BY title`, idx,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var entries []Entry
|
||||
for rows.Next() {
|
||||
var e Entry
|
||||
if err := rows.Scan(&e.EntryID, &e.ParentID, &e.Type, &e.Title, &e.TitleIdx, &e.Data, &e.DataLevel, &e.CreatedAt, &e.UpdatedAt, &e.Version); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(e.Data) > 0 && e.DataLevel == DataLevelL1 {
|
||||
entryKey, _ := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
dataText, _ := Unpack(entryKey, e.Data)
|
||||
var vd VaultData
|
||||
if json.Unmarshal([]byte(dataText), &vd) == nil {
|
||||
e.VaultData = &vd
|
||||
}
|
||||
}
|
||||
entries = append(entries, e)
|
||||
}
|
||||
return entries, rows.Err()
|
||||
}
|
||||
|
||||
// EntrySearchFuzzy searches entries by title using LIKE (less secure but more practical).
|
||||
func EntrySearchFuzzy(db *DB, cfg *Config, query string) ([]Entry, error) {
|
||||
rows, err := db.Conn.Query(
|
||||
`SELECT entry_id, parent_id, type, title, title_idx, data, data_level, created_at, updated_at, version
|
||||
FROM entries WHERE deleted_at IS NULL AND title LIKE ? ORDER BY title`, "%"+query+"%",
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var entries []Entry
|
||||
for rows.Next() {
|
||||
var e Entry
|
||||
if err := rows.Scan(&e.EntryID, &e.ParentID, &e.Type, &e.Title, &e.TitleIdx, &e.Data, &e.DataLevel, &e.CreatedAt, &e.UpdatedAt, &e.Version); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(e.Data) > 0 && e.DataLevel == DataLevelL1 {
|
||||
entryKey, _ := DeriveEntryKey(cfg.VaultKey, e.EntryID)
|
||||
dataText, _ := Unpack(entryKey, e.Data)
|
||||
var vd VaultData
|
||||
if json.Unmarshal([]byte(dataText), &vd) == nil {
|
||||
e.VaultData = &vd
|
||||
}
|
||||
}
|
||||
entries = append(entries, e)
|
||||
}
|
||||
return entries, rows.Err()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Session operations
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// SessionCreate creates a new session.
|
||||
func SessionCreate(db *DB, ttl int64, actor string) (*Session, error) {
|
||||
now := time.Now().UnixMilli()
|
||||
s := &Session{
|
||||
Token: GenerateToken(),
|
||||
CreatedAt: now,
|
||||
ExpiresAt: now + (ttl * 1000),
|
||||
Actor: actor,
|
||||
}
|
||||
_, err := db.Conn.Exec(
|
||||
`INSERT INTO sessions (token, created_at, expires_at, actor) VALUES (?, ?, ?, ?)`,
|
||||
s.Token, s.CreatedAt, s.ExpiresAt, s.Actor,
|
||||
)
|
||||
return s, err
|
||||
}
|
||||
|
||||
// SessionGet retrieves a session by token.
|
||||
func SessionGet(db *DB, token string) (*Session, error) {
|
||||
var s Session
|
||||
err := db.Conn.QueryRow(
|
||||
`SELECT token, created_at, expires_at, actor FROM sessions WHERE token = ?`, token,
|
||||
).Scan(&s.Token, &s.CreatedAt, &s.ExpiresAt, &s.Actor)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, nil
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Check expiry
|
||||
if s.ExpiresAt < time.Now().UnixMilli() {
|
||||
return nil, nil
|
||||
}
|
||||
return &s, nil
|
||||
}
|
||||
|
||||
// SessionDelete deletes a session.
|
||||
func SessionDelete(db *DB, token string) error {
|
||||
_, err := db.Conn.Exec(`DELETE FROM sessions WHERE token = ?`, token)
|
||||
return err
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Audit operations
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// AuditLog records an audit event.
|
||||
func AuditLog(db *DB, ev *AuditEvent) error {
|
||||
if ev.EventID == "" {
|
||||
ev.EventID = uuid.New().String()
|
||||
}
|
||||
if ev.CreatedAt == 0 {
|
||||
ev.CreatedAt = time.Now().UnixMilli()
|
||||
}
|
||||
_, err := db.Conn.Exec(
|
||||
`INSERT INTO audit_log (event_id, entry_id, title, action, actor, ip_addr, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
||||
ev.EventID, ev.EntryID, ev.Title, ev.Action, ev.Actor, ev.IPAddr, ev.CreatedAt,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
// AuditList returns recent audit events.
|
||||
func AuditList(db *DB, limit int) ([]AuditEvent, error) {
|
||||
if limit <= 0 {
|
||||
limit = 100
|
||||
}
|
||||
rows, err := db.Conn.Query(
|
||||
`SELECT event_id, entry_id, title, action, actor, ip_addr, created_at
|
||||
FROM audit_log ORDER BY created_at DESC LIMIT ?`, limit,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var events []AuditEvent
|
||||
for rows.Next() {
|
||||
var ev AuditEvent
|
||||
var entryID, title, ipAddr sql.NullString
|
||||
if err := rows.Scan(&ev.EventID, &entryID, &title, &ev.Action, &ev.Actor, &ipAddr, &ev.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if entryID.Valid {
|
||||
ev.EntryID = entryID.String
|
||||
}
|
||||
if title.Valid {
|
||||
ev.Title = title.String
|
||||
}
|
||||
if ipAddr.Valid {
|
||||
ev.IPAddr = ipAddr.String
|
||||
}
|
||||
events = append(events, ev)
|
||||
}
|
||||
return events, rows.Err()
|
||||
}
|
||||
|
||||
// EntryCount returns total entry count (for health check).
|
||||
func EntryCount(db *DB) (int, error) {
|
||||
var count int
|
||||
err := db.Conn.QueryRow(`SELECT COUNT(*) FROM entries WHERE deleted_at IS NULL`).Scan(&count)
|
||||
return count, err
|
||||
}
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
package lib
|
||||
|
||||
import "database/sql"
|
||||
|
||||
// VaultField represents a single field within a vault entry.
|
||||
type VaultField struct {
|
||||
Label string `json:"label"`
|
||||
Value string `json:"value"`
|
||||
Kind string `json:"kind"` // text|password|totp|url|file
|
||||
Section string `json:"section,omitempty"`
|
||||
L2 bool `json:"l2,omitempty"` // true = client-side decrypt only
|
||||
}
|
||||
|
||||
// VaultFile represents an attached file.
|
||||
type VaultFile struct {
|
||||
Name string `json:"name"`
|
||||
MimeType string `json:"mime_type"`
|
||||
Size int64 `json:"size"`
|
||||
Data []byte `json:"data"`
|
||||
}
|
||||
|
||||
// VaultData is the JSON structure packed into Entry.Data.
|
||||
type VaultData struct {
|
||||
Title string `json:"title"`
|
||||
Type string `json:"type"`
|
||||
Fields []VaultField `json:"fields"`
|
||||
URLs []string `json:"urls,omitempty"`
|
||||
Tags []string `json:"tags,omitempty"`
|
||||
Expires string `json:"expires,omitempty"` // YYYY-MM-DD
|
||||
Notes string `json:"notes,omitempty"`
|
||||
Files []VaultFile `json:"files,omitempty"`
|
||||
}
|
||||
|
||||
// Entry is the core data model — single table for all vault items.
|
||||
type Entry struct {
|
||||
EntryID string `json:"entry_id"`
|
||||
ParentID string `json:"parent_id"` // folder entry_id, or "" for root
|
||||
Type string `json:"type"` // credential|note|identity|card|ssh_key|totp|folder|custom
|
||||
Title string `json:"title"` // plaintext for UI
|
||||
TitleIdx []byte `json:"-"` // HMAC-SHA256 blind index for search
|
||||
Data []byte `json:"-"` // packed: zstd + AES-256-GCM
|
||||
DataLevel int `json:"data_level"` // 1=L1, 2=L2
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
UpdatedAt int64 `json:"updated_at"`
|
||||
Version int `json:"version"` // optimistic locking
|
||||
DeletedAt *int64 `json:"deleted_at,omitempty"`
|
||||
|
||||
// Unpacked field (not stored directly, populated after decrypt)
|
||||
VaultData *VaultData `json:"data,omitempty"`
|
||||
}
|
||||
|
||||
// Session represents an authenticated session.
|
||||
type Session struct {
|
||||
Token string `json:"token"`
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
Actor string `json:"actor"` // web|extension|mcp
|
||||
}
|
||||
|
||||
// AuditEvent represents a security audit log entry.
|
||||
type AuditEvent struct {
|
||||
EventID string `json:"event_id"`
|
||||
EntryID string `json:"entry_id,omitempty"`
|
||||
Title string `json:"title,omitempty"` // snapshot of entry title
|
||||
Action string `json:"action"` // read|fill|ai_read|create|update|delete|import|export
|
||||
Actor string `json:"actor"` // web|extension|mcp
|
||||
IPAddr string `json:"ip_addr,omitempty"`
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
}
|
||||
|
||||
// WebAuthnCredential stores a registered WebAuthn credential.
|
||||
type WebAuthnCredential struct {
|
||||
CredID string `json:"cred_id"`
|
||||
Name string `json:"name"`
|
||||
PublicKey []byte `json:"public_key"`
|
||||
PRFSalt []byte `json:"prf_salt"`
|
||||
SignCount int `json:"sign_count"`
|
||||
CreatedAt int64 `json:"created_at"`
|
||||
}
|
||||
|
||||
// DB wraps the database connection.
|
||||
type DB struct {
|
||||
Conn *sql.DB
|
||||
}
|
||||
|
||||
// Entry types
|
||||
const (
|
||||
TypeCredential = "credential"
|
||||
TypeCard = "card"
|
||||
TypeIdentity = "identity"
|
||||
TypeNote = "note"
|
||||
TypeSSHKey = "ssh_key"
|
||||
TypeTOTP = "totp"
|
||||
TypeFolder = "folder"
|
||||
TypeCustom = "custom"
|
||||
)
|
||||
|
||||
// Data levels
|
||||
const (
|
||||
DataLevelL1 = 1 // Server-side encrypted (AI-readable)
|
||||
DataLevelL2 = 2 // Client-side only (WebAuthn PRF)
|
||||
)
|
||||
|
||||
// Actor types
|
||||
const (
|
||||
ActorWeb = "web"
|
||||
ActorExtension = "extension"
|
||||
ActorMCP = "mcp"
|
||||
)
|
||||
|
||||
// Action types
|
||||
const (
|
||||
ActionRead = "read"
|
||||
ActionFill = "fill"
|
||||
ActionAIRead = "ai_read"
|
||||
ActionCreate = "create"
|
||||
ActionUpdate = "update"
|
||||
ActionDelete = "delete"
|
||||
ActionImport = "import"
|
||||
ActionExport = "export"
|
||||
)
|
||||
Loading…
Reference in New Issue