localvault 1.3.3 → 1.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca1ee7041877b10f5964e4fc74e7edf9365f4a7e34d283c624c15bd45ab32c98
-  data.tar.gz: 59a54ac2d1591cbc6d5910f9222c3c89039edc4d89e45f50dc3fd09aa7720a29
+  metadata.gz: 2e57b23276f02c28222edddf4d555066764b38b091b32e5c107c033c447218e2
+  data.tar.gz: c5b00e5cb5935555e093ab9df9fa0d1f740beb0986c5935818a4ee163d1c3777
 SHA512:
-  metadata.gz: db6ebd7b3e0371faa96ea772f28f8fb6447e03fe7184a596bccccdc8251d32ab9ee7a777ae1d772d985f9ed68f991fb6c2eaba988aded97fc710f2994f6aab7f
-  data.tar.gz: 93286e65a351b4995a438870782c147ae86c227bbe2f307080b76c39eeaa96dfa852f133821dfdc28466329529a2e540d1a0c8738ef26f421b22e1e156361797
+  metadata.gz: f28817a5b6c310436977e07f4a51b8ce4373212d9b65b2560576819d43229b5d137053b0aee00efcfe5f8eaa1016372d1ceb7a113d9d372208da8fef803a5d49
+  data.tar.gz: 6a2326ed0fde101e65b5433ac2e2a211a8c8067f2aeb8726d6fe640b5ce14956e45b2cf135526e33e8595f8bf1667b06f88483e7e0ff2dac2a950db36f124370

data/lib/localvault/cli/sync.rb

@@ -22,8 +22,16 @@ module LocalVault
           return
         end
 
-        # Load remote state to determine vault mode
-        remote_data = load_remote_bundle_data(vault_name)
+        # Load remote state to determine vault mode. MUST distinguish a
+        # genuinely-absent remote (404) from a transient API failure: treating
+        # a 5xx as "no remote" would silently downgrade a team vault to a
+        # personal v1 bundle on the next push.
+        remote_data, load_error = load_remote_bundle_data(vault_name)
+        if load_error
+          $stderr.puts "Error: #{load_error}"
+          $stderr.puts "Refusing to push — cannot verify vault mode. Retry when the server is reachable."
+          return
+        end
         handle = Config.inventlist_handle
 
         if remote_data && remote_data[:owner]
@@ -214,14 +222,25 @@ module LocalVault
       end
 
       # Load the full unpacked remote bundle data (owner, key_slots, etc).
-      # Returns nil if no remote blob exists.
+      # Returns [data, error_message]:
+      #   - [hash, nil] on success
+      #   - [nil,  nil] when there genuinely is no remote bundle (404 / empty)
+      #   - [nil,  msg] on any other failure (transient network, 5xx, bad bundle)
+      #
+      # The caller MUST distinguish these cases — treating a transient error
+      # as "no remote" is a data-corruption bug: sync push would then re-upload
+      # the vault as a v1 personal bundle, silently downgrading a team vault
+      # and wiping its owner + key_slots.
       def load_remote_bundle_data(vault_name)
         client = ApiClient.new(token: Config.token)
         blob = client.pull_vault(vault_name)
-        return nil unless blob.is_a?(String) && !blob.empty?
-        SyncBundle.unpack(blob)
-      rescue ApiClient::ApiError, SyncBundle::UnpackError
-        nil
+        return [nil, nil] unless blob.is_a?(String) && !blob.empty?
+        [SyncBundle.unpack(blob), nil]
+      rescue ApiClient::ApiError => e
+        return [nil, nil] if e.status == 404
+        [nil, "Could not load remote bundle for '#{vault_name}': #{e.message}"]
+      rescue SyncBundle::UnpackError => e
+        [nil, "Could not parse remote bundle for '#{vault_name}': #{e.message}"]
       end
 
       # Load key_slots from the last pushed blob (if any).

data/lib/localvault/cli/team_helpers.rb

@@ -98,28 +98,42 @@ module LocalVault
         store = Store.new(vault_name)
 
         # Partial scope removal
-        if remove_scopes && key_slots[handle].is_a?(Hash) && key_slots[handle]["scopes"].is_a?(Array)
-          remaining = key_slots[handle]["scopes"] - remove_scopes
+        if remove_scopes
+          slot = key_slots[handle]
+          slot_scopes = slot.is_a?(Hash) ? slot["scopes"] : nil
+
+          unless slot_scopes.is_a?(Array)
+            # Member has full access (nil scopes) — --scope is a user error.
+            # Falling through to full removal here used to silently delete
+            # the member, which is surprising and destructive.
+            $stderr.puts "Error: @#{handle} has full access to '#{vault_name}', not scoped. " \
+                         "Use `localvault remove @#{handle}` without --scope to revoke access."
+            return
+          end
+
+          remaining = slot_scopes - remove_scopes
           if remaining.empty?
             # Last scope removed — remove member entirely
             key_slots.delete(handle)
             $stdout.puts "Removed @#{handle} from vault '#{vault_name}' (last scope removed)."
           else
-            # Rebuild blob with remaining scopes
-            master_key = SessionCache.get(vault_name)
-            if master_key
-              vault = Vault.new(name: vault_name, master_key: master_key)
-              filtered = vault.filter(remaining)
-              member_key = RbNaCl::Random.random_bytes(32)
-              encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
-              enc_key = KeySlot.create(member_key, key_slots[handle]["pub"])
-              key_slots[handle] = {
-                "pub" => key_slots[handle]["pub"],
-                "enc_key" => enc_key,
-                "scopes" => remaining,
-                "blob" => Base64.strict_encode64(encrypted_blob)
-              }
-            end
+            # Rebuild blob with remaining scopes. Requires the vault to be
+            # unlocked — previously this would silently no-op (print success,
+            # push unchanged slot) when the session cache was empty.
+            master_key = ensure_master_key(vault_name)
+            return unless master_key
+
+            vault = Vault.new(name: vault_name, master_key: master_key)
+            filtered = vault.filter(remaining)
+            member_key = RbNaCl::Random.random_bytes(32)
+            encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
+            enc_key = KeySlot.create(member_key, slot["pub"])
+            key_slots[handle] = {
+              "pub" => slot["pub"],
+              "enc_key" => enc_key,
+              "scopes" => remaining,
+              "blob" => Base64.strict_encode64(encrypted_blob)
+            }
             $stdout.puts "Removed scope(s) #{remove_scopes.join(", ")} from @#{handle}. Remaining: #{remaining.join(", ")}"
           end
 

data/lib/localvault/cli.rb

@@ -405,8 +405,9 @@ module LocalVault
         return
       end
 
-      store.destroy!
-
+      # Gather + validate the new passphrase BEFORE destroying the existing
+      # vault. If the user enters empty / mismatched / interrupts, we abort
+      # without touching anything on disk.
       passphrase = prompt_passphrase("New passphrase: ")
       if passphrase.empty?
         abort_with "Passphrase cannot be empty"
@@ -419,6 +420,8 @@ module LocalVault
         return
       end
 
+      # All inputs validated — safe to destroy + recreate.
+      store.destroy!
       salt = Crypto.generate_salt
       master_key = Crypto.derive_master_key(passphrase, salt)
       Vault.create!(name: vault_name, master_key: master_key, salt: salt)

data/lib/localvault/vault.rb

@@ -64,7 +64,8 @@ module LocalVault
     # @param value [String] the secret value
     # @return [String] the stored value
     # @raise [InvalidKeyName] when key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def set(key, value)
       validate_key!(key)
       secrets = all
@@ -74,6 +75,15 @@ module LocalVault
         raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
         secrets[group][subkey] = value
       else
+        # Refuse to silently clobber an existing group with a scalar. This
+        # used to succeed: set("app", "oops") on a vault containing
+        # {"app" => {"DB" => ...}} would replace the whole group and lose
+        # every nested secret under it.
+        if secrets[key].is_a?(Hash)
+          raise "'#{key}' is a group containing #{secrets[key].size} secret(s), " \
+                "not a scalar. Use `localvault delete #{key}` first if you " \
+                "really want to replace the whole group."
+        end
         secrets[key] = value
       end
       write_secrets(secrets)
@@ -283,7 +293,8 @@ module LocalVault
     # @param hash [Hash] key-value pairs to merge into the vault
     # @return [void]
     # @raise [InvalidKeyName] when any key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def merge(hash)
       secrets = all
       hash.each do |k, v|
@@ -303,6 +314,13 @@ module LocalVault
             raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
             secrets[group][subkey] = v.to_s
           else
+            # Same guard as Vault#set: don't silently clobber a group with
+            # a scalar. This protects bulk `import` and `receive` flows.
+            if secrets[k].is_a?(Hash)
+              raise "'#{k}' is a group containing #{secrets[k].size} secret(s), " \
+                    "not a scalar. Delete the group first if you really want " \
+                    "to replace it with a scalar."
+            end
             secrets[k] = v.to_s
           end
         end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.3.3"
+  VERSION = "1.3.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.3.4
 platform: ruby
 authors:
 - Nauman Tariq