omnizip 0.3.1

data/lib/omnizip/password/password_validator.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+module Omnizip
+  module Password
+    # Validates password strength and requirements
+    class PasswordValidator
+      attr_reader :min_length, :require_uppercase, :require_lowercase,
+                  :require_numbers, :require_special
+
+      # Initialize password validator
+      # @param min_length [Integer] Minimum password length
+      # @param require_uppercase [Boolean] Require uppercase letters
+      # @param require_lowercase [Boolean] Require lowercase letters
+      # @param require_numbers [Boolean] Require numbers
+      # @param require_special [Boolean] Require special characters
+      def initialize(
+        min_length: 8,
+        require_uppercase: false,
+        require_lowercase: false,
+        require_numbers: false,
+        require_special: false
+      )
+        @min_length = min_length
+        @require_uppercase = require_uppercase
+        @require_lowercase = require_lowercase
+        @require_numbers = require_numbers
+        @require_special = require_special
+      end
+
+      # Validate password
+      # @param password [String] Password to validate
+      # @return [Boolean] True if valid
+      # @raise [ArgumentError] If password is invalid
+      def validate(password)
+        raise ArgumentError, "Password cannot be nil" if password.nil?
+        raise ArgumentError, "Password cannot be empty" if password.empty?
+
+        check_length(password)
+        check_uppercase(password) if require_uppercase
+        check_lowercase(password) if require_lowercase
+        check_numbers(password) if require_numbers
+        check_special(password) if require_special
+
+        true
+      end
+
+      # Check if password is valid (without raising)
+      # @param password [String] Password to check
+      # @return [Boolean] True if valid
+      def valid?(password)
+        validate(password)
+        true
+      rescue ArgumentError
+        false
+      end
+
+      # Get password strength score (0-100)
+      # @param password [String] Password to score
+      # @return [Integer] Strength score
+      def strength(password)
+        return 0 if password.nil? || password.empty?
+
+        score = 0
+
+        # Length score (up to 40 points)
+        score += [password.length * 4, 40].min
+
+        # Character variety (up to 60 points)
+        score += 15 if /[a-z]/.match?(password)
+        score += 15 if /[A-Z]/.match?(password)
+        score += 15 if /[0-9]/.match?(password)
+        score += 15 if /[^a-zA-Z0-9]/.match?(password)
+
+        [score, 100].min
+      end
+
+      # Get password strength label
+      # @param password [String] Password to evaluate
+      # @return [Symbol] Strength label (:weak, :fair, :good, :strong)
+      def strength_label(password)
+        score = strength(password)
+
+        case score
+        when 0...30
+          :weak
+        when 30...50
+          :fair
+        when 50...75
+          :good
+        else
+          :strong
+        end
+      end
+
+      private
+
+      def check_length(password)
+        return if password.length >= min_length
+
+        raise ArgumentError,
+              "Password too short (minimum: #{min_length} characters)"
+      end
+
+      def check_uppercase(password)
+        return if /[A-Z]/.match?(password)
+
+        raise ArgumentError, "Password must contain uppercase letters"
+      end
+
+      def check_lowercase(password)
+        return if /[a-z]/.match?(password)
+
+        raise ArgumentError, "Password must contain lowercase letters"
+      end
+
+      def check_numbers(password)
+        return if /[0-9]/.match?(password)
+
+        raise ArgumentError, "Password must contain numbers"
+      end
+
+      def check_special(password)
+        return if /[^a-zA-Z0-9]/.match?(password)
+
+        raise ArgumentError, "Password must contain special characters"
+      end
+    end
+  end
+end

data/lib/omnizip/password/winzip_aes_strategy.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require_relative "encryption_strategy"
+
+module Omnizip
+  module Password
+    # WinZip AES encryption (recommended)
+    # Implements WinZip AES-256 encryption standard
+    class WinzipAesStrategy < EncryptionStrategy
+      # WinZip AES compression method
+      COMPRESSION_METHOD = 99 # AES encryption
+
+      # AES key sizes
+      KEY_SIZE_128 = 1
+      KEY_SIZE_192 = 2
+      KEY_SIZE_256 = 3
+
+      # Extra field header IDs
+      WINZIP_AES_EXTRA_ID = 0x9901
+
+      attr_reader :key_size, :actual_compression_method
+
+      # Initialize WinZip AES encryption
+      # @param password [String] Password to use
+      # @param key_size [Integer] Key size (128, 192, or 256 bits)
+      # @param compression_method [Integer] Actual compression method to use
+      def initialize(password, key_size: 256, compression_method: 8)
+        super(password)
+        @key_size = validate_key_size(key_size)
+        @actual_compression_method = compression_method
+      end
+
+      # Encrypt data using WinZip AES
+      # @param data [String] Data to encrypt
+      # @return [String] Encrypted data with authentication
+      def encrypt(data)
+        require "openssl"
+
+        # Generate salt
+        salt = generate_salt
+
+        # Derive keys
+        encryption_key, password_verify, hmac_key = derive_winzip_keys(salt)
+
+        # Create cipher
+        cipher = OpenSSL::Cipher.new("AES-#{key_bits}-CTR")
+        cipher.encrypt
+        cipher.key = encryption_key
+        cipher.iv = "\x00" * 16 # WinZip AES uses zero IV
+
+        # Encrypt data
+        encrypted = cipher.update(data) + cipher.final
+
+        # Calculate HMAC
+        hmac = calculate_hmac(hmac_key, encrypted)
+
+        # Return: salt + password_verify + encrypted_data + hmac
+        salt + password_verify + encrypted + hmac
+      end
+
+      # Decrypt data using WinZip AES
+      # @param data [String] Encrypted data
+      # @return [String] Decrypted data
+      def decrypt(data)
+        require "openssl"
+
+        # Extract components
+        salt_size = salt_length
+        salt = data[0, salt_size]
+        password_verify_bytes = data[salt_size, 2]
+        hmac_size = 10
+        encrypted_data = data[(salt_size + 2)...-hmac_size]
+        stored_hmac = data[-hmac_size..]
+
+        # Derive keys
+        encryption_key, expected_verify, hmac_key = derive_winzip_keys(salt)
+
+        # Verify password
+        unless password_verify_bytes == expected_verify
+          raise Omnizip::PasswordError, "Incorrect password"
+        end
+
+        # Verify HMAC
+        calculated_hmac = calculate_hmac(hmac_key, encrypted_data)
+        unless stored_hmac == calculated_hmac
+          raise Omnizip::PasswordError, "Data integrity check failed"
+        end
+
+        # Decrypt data
+        cipher = OpenSSL::Cipher.new("AES-#{key_bits}-CTR")
+        cipher.decrypt
+        cipher.key = encryption_key
+        cipher.iv = "\x00" * 16
+
+        cipher.update(encrypted_data) + cipher.final
+      end
+
+      # Get compression method for ZIP header
+      # @return [Integer] Compression method ID (99 for AES)
+      def compression_method
+        COMPRESSION_METHOD
+      end
+
+      # Get extra field data for ZIP central directory
+      # @return [String] Extra field data
+      def extra_field_data
+        # WinZip AES extra field format:
+        # 2 bytes: extra field ID (0x9901)
+        # 2 bytes: data size
+        # 2 bytes: AES version (0x0001 or 0x0002)
+        # 2 bytes: vendor ID (0x4145 = "AE")
+        # 1 byte: AES strength (1=128, 2=192, 3=256)
+        # 2 bytes: actual compression method
+
+        data = [
+          0x0002, # AES version 2
+          0x4145, # Vendor ID "AE"
+          key_size_code,
+          actual_compression_method,
+        ].pack("vvCv")
+
+        [WINZIP_AES_EXTRA_ID, data.bytesize].pack("vv") + data
+      end
+
+      # Get encryption flags
+      # @return [Integer] Encryption flags
+      def encryption_flags
+        0x0001 | 0x0040 # Encrypted + strong encryption
+      end
+
+      private
+
+      def key_bits
+        case @key_size
+        when KEY_SIZE_128 then 128
+        when KEY_SIZE_192 then 192
+        when KEY_SIZE_256 then 256
+        end
+      end
+
+      def key_size_code
+        @key_size
+      end
+
+      def salt_length
+        key_bits / 16 # Salt length in bytes
+      end
+
+      def validate_key_size(size)
+        case size
+        when 128 then KEY_SIZE_128
+        when 192 then KEY_SIZE_192
+        when 256 then KEY_SIZE_256
+        else
+          raise ArgumentError,
+                "Invalid key size: #{size}. Must be 128, 192, or 256"
+        end
+      end
+
+      def generate_salt
+        require "securerandom"
+        SecureRandom.random_bytes(salt_length)
+      end
+
+      def derive_winzip_keys(salt)
+        require "openssl"
+
+        # WinZip uses PBKDF2 with HMAC-SHA1
+        key_material = OpenSSL::PKCS5.pbkdf2_hmac(
+          password,
+          salt,
+          1000, # iterations
+          (2 * key_bits / 8) + 2, # key + hmac + verify
+          OpenSSL::Digest.new("SHA1"),
+        )
+
+        key_size_bytes = key_bits / 8
+
+        encryption_key = key_material[0, key_size_bytes]
+        password_verify = key_material[key_size_bytes, 2]
+        hmac_key = key_material[(key_size_bytes + 2), key_size_bytes]
+
+        [encryption_key, password_verify, hmac_key]
+      end
+
+      def calculate_hmac(key, data)
+        require "openssl"
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new("SHA1"), key, data)[0, 10]
+      end
+    end
+  end
+end

data/lib/omnizip/password/zip_crypto_strategy.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require_relative "encryption_strategy"
+
+module Omnizip
+  module Password
+    # Traditional ZIP encryption (PKWARE)
+    # WARNING: This is a weak encryption method and should not be used
+    # for sensitive data. Use WinZipAesStrategy instead.
+    class ZipCryptoStrategy < EncryptionStrategy
+      # ZIP compression method for traditional encryption
+      COMPRESSION_METHOD = 0 # Stored (encryption is separate)
+
+      # Initialize ZIP crypto encryption
+      # @param password [String] Password to use
+      # @param warn_weak [Boolean] Show security warning (default: true)
+      def initialize(password, warn_weak: true)
+        super(password)
+
+        if warn_weak
+          warn "WARNING: Traditional ZIP encryption is weak and easily cracked."
+          warn "Consider using WinZip AES encryption instead for better security."
+        end
+      end
+
+      # Encrypt data using traditional ZIP encryption
+      # @param data [String] Data to encrypt
+      # @return [String] Encrypted data
+      def encrypt(data)
+        keys = initialize_keys
+
+        # Generate encryption header
+        header = generate_encryption_header(keys)
+
+        # Encrypt data with same keys (header generation updated them)
+        encrypted = data.bytes.map do |byte|
+          temp = decrypt_byte(keys)
+          update_keys(keys, byte)
+          byte ^ temp
+        end
+
+        (header + encrypted).pack("C*")
+      end
+
+      # Decrypt data using traditional ZIP encryption
+      # @param data [String] Data to decrypt
+      # @return [String] Decrypted data
+      def decrypt(data)
+        bytes = data.bytes
+        keys = initialize_keys
+
+        # Skip encryption header (12 bytes)
+        header = bytes[0...12]
+        encrypted_data = bytes[12..]
+
+        # Verify header
+        header.each { |byte| update_keys(keys, decrypt_byte(keys) ^ byte) }
+
+        # Decrypt data
+        decrypted = encrypted_data.map do |byte|
+          temp = decrypt_byte(keys)
+          plaintext_byte = byte ^ temp
+          update_keys(keys, plaintext_byte)
+          plaintext_byte
+        end
+
+        decrypted.pack("C*")
+      end
+
+      # Get compression method for ZIP header
+      # @return [Integer] Compression method ID
+      def compression_method
+        COMPRESSION_METHOD
+      end
+
+      # Get encryption flags
+      # @return [Integer] Encryption flags (bit 0 set)
+      def encryption_flags
+        0x0001 # Traditional encryption
+      end
+
+      private
+
+      # Initialize encryption keys
+      # @return [Array<Integer>] Initial key values
+      def initialize_keys
+        keys = [0x12345678, 0x23456789, 0x34567890]
+
+        password.each_byte do |byte|
+          update_keys(keys, byte)
+        end
+
+        keys
+      end
+
+      # Update encryption keys
+      # @param keys [Array<Integer>] Current keys
+      # @param byte [Integer] Byte to incorporate
+      def update_keys(keys, byte)
+        keys[0] = crc32_update(keys[0], byte)
+        keys[1] =
+          (((keys[1] + (keys[0] & 0xFF)) * 134_775_813) + 1) & 0xFFFFFFFF
+        keys[2] = crc32_update(keys[2], keys[1] >> 24)
+      end
+
+      # Decrypt a single byte
+      # @param keys [Array<Integer>] Current keys
+      # @return [Integer] Decrypted byte value
+      def decrypt_byte(keys)
+        temp = keys[2] | 2
+        ((temp * (temp ^ 1)) >> 8) & 0xFF
+      end
+
+      # CRC32 update for key generation
+      # @param crc [Integer] Current CRC value
+      # @param byte [Integer] Byte to add
+      # @return [Integer] Updated CRC
+      def crc32_update(crc, byte)
+        require_relative "../checksums/crc32"
+        crc32 = Omnizip::Checksums::Crc32.new
+        crc32.instance_variable_set(:@crc, crc)
+        crc32.update(byte.chr)
+        crc32.value
+      end
+
+      # Generate encryption header
+      # @param keys [Array<Integer>] Encryption keys
+      # @return [Array<Integer>] 12-byte header
+      def generate_encryption_header(keys)
+        header = Array.new(12) { rand(256) }
+        encrypted_header = []
+        header.each do |byte|
+          temp = decrypt_byte(keys)
+          update_keys(keys, byte)
+          encrypted_header << (byte ^ temp)
+        end
+        encrypted_header
+      end
+    end
+  end
+end

data/lib/omnizip/password.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require_relative "password/password_validator"
+require_relative "password/encryption_strategy"
+require_relative "password/zip_crypto_strategy"
+require_relative "password/winzip_aes_strategy"
+require_relative "password/encryption_registry"
+
+module Omnizip
+  # Password protection module
+  # Provides encryption and password validation for archives
+  module Password
+    class << self
+      # Validate a password
+      # @param password [String] Password to validate
+      # @param options [Hash] Validation options
+      # @return [Boolean] True if valid
+      def validate(password, **options)
+        validator = PasswordValidator.new(**options)
+        validator.validate(password)
+      end
+
+      # Check password strength
+      # @param password [String] Password to check
+      # @return [Symbol] Strength label (:weak, :fair, :good, :strong)
+      def strength(password)
+        validator = PasswordValidator.new
+        validator.strength_label(password)
+      end
+
+      # Create encryption strategy
+      # @param method [Symbol] Encryption method
+      # @param password [String] Password
+      # @param options [Hash] Strategy options
+      # @return [EncryptionStrategy] Encryption strategy instance
+      def create_strategy(method, password, **options)
+        EncryptionRegistry.create(method, password, **options)
+      end
+
+      # Get available encryption methods
+      # @return [Array<Symbol>] List of methods
+      def encryption_methods
+        EncryptionRegistry.strategies
+      end
+
+      # Prompt for password (with confirmation)
+      # @param confirm [Boolean] Require confirmation
+      # @return [String] Password entered by user
+      def prompt(confirm: true)
+        require "io/console"
+
+        print "Enter password: "
+        password = $stdin.noecho(&:gets).chomp
+        puts
+
+        if confirm
+          print "Confirm password: "
+          confirmation = $stdin.noecho(&:gets).chomp
+          puts
+
+          unless password == confirmation
+            raise PasswordError, "Passwords do not match"
+          end
+        end
+
+        password
+      end
+
+      # Read password from environment variable
+      # @param var_name [String] Environment variable name
+      # @return [String, nil] Password or nil
+      def from_env(var_name = "OMNIZIP_PASSWORD")
+        ENV.fetch(var_name, nil)
+      end
+
+      # Read password from file
+      # @param file_path [String] Path to password file
+      # @return [String] Password from file
+      def from_file(file_path)
+        File.read(file_path).strip
+      end
+    end
+  end
+
+  # Password-related error
+  class PasswordError < Error; end
+end

data/lib/omnizip/pipe/stream_compressor.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module Omnizip
+  module Pipe
+    # Stream-based compression for pipe operations
+    #
+    # Accepts any IO-like input source and writes compressed output
+    # to any IO-like sink, using chunk-based processing to avoid
+    # loading entire streams into memory.
+    #
+    # @example Compress stdin to stdout
+    #   compressor = StreamCompressor.new($stdin, $stdout, :zip)
+    #   compressor.compress
+    #
+    # @example Compress with custom chunk size
+    #   compressor = StreamCompressor.new(
+    #     input_file,
+    #     output_file,
+    #     :zip,
+    #     chunk_size: 1024 * 1024  # 1MB chunks
+    #   )
+    #   compressor.compress
+    class StreamCompressor
+      # Default chunk size for reading input (64KB)
+      DEFAULT_CHUNK_SIZE = 64 * 1024
+
+      attr_reader :input, :output, :format, :options, :bytes_written
+
+      # Initialize stream compressor
+      #
+      # @param input [IO] Input stream to compress
+      # @param output [IO] Output stream for compressed data
+      # @param format [Symbol] Archive format (:zip, :seven_zip)
+      # @param compression [Symbol, nil] Compression algorithm
+      # @param options [Hash] Compression options
+      # @option options [String] :entry_name Name for entry (default: 'stream.dat')
+      # @option options [Integer] :chunk_size Read buffer size
+      # @option options [Integer] :level Compression level (1-9)
+      # @option options [Proc] :progress Progress callback
+      def initialize(input, output, format, compression: nil, **options)
+        @input = input
+        @output = output
+        @format = format
+        @compression = compression
+        @options = options
+        @chunk_size = options[:chunk_size] || DEFAULT_CHUNK_SIZE
+        @bytes_read = 0
+        @bytes_written = 0
+        @progress_callback = options[:progress]
+      end
+
+      # Compress input stream to output stream
+      #
+      # Reads input in chunks and writes compressed output,
+      # maintaining constant memory usage regardless of input size.
+      #
+      # @return [Integer] Total bytes written to output
+      # @raise [ArgumentError] If format is unsupported
+      def compress
+        case @format
+        when :zip
+          compress_zip
+        when :seven_zip, :'7z'
+          compress_7z
+        else
+          raise ArgumentError, "Unsupported format: #{@format}"
+        end
+
+        @bytes_written
+      end
+
+      private
+
+      # Compress to ZIP format
+      #
+      # Creates a single-entry ZIP archive from the input stream.
+      # Uses chunked reading to handle arbitrarily large inputs.
+      def compress_zip
+        entry_name = @options[:entry_name] || "stream.dat"
+        level = @options[:level]
+
+        Omnizip::Zip::OutputStream.open(@output) do |zos|
+          # Create entry with optional compression level
+          entry_options = {}
+          entry_options[:level] = level if level
+
+          zos.put_next_entry(entry_name, **entry_options)
+
+          # Stream chunks from input to output
+          stream_chunks(zos)
+        end
+      end
+
+      # Compress to 7z format
+      #
+      # Note: 7z streaming support is limited due to format requirements.
+      # For full 7z support, use file-based operations.
+      def compress_7z
+        raise NotImplementedError,
+              "7z pipe compression not yet implemented. " \
+              "Use file-based operations for 7z format."
+      end
+
+      # Stream data in chunks from input to output
+      #
+      # @param output_stream [IO] Stream to write chunks to
+      def stream_chunks(output_stream)
+        loop do
+          chunk = @input.read(@chunk_size)
+          break unless chunk
+
+          output_stream.write(chunk)
+          @bytes_read += chunk.bytesize
+          @bytes_written += chunk.bytesize
+
+          # Call progress callback if provided
+          @progress_callback&.call(@bytes_read, @bytes_written)
+        end
+      rescue IOError, SystemCallError => e
+        raise Omnizip::Error, "Stream compression failed: #{e.message}"
+      end
+    end
+  end
+end