opensecret 0.0.913 → 0.0.941

data/lib/session/user.home.rb

@@ -0,0 +1,49 @@
+#!/usr/bin/ruby
+
+# coding: utf-8
+
+# opensession contains basic behaviour for managing a client only
+# (serverless) session. Configuration directives are read and written
+# from an INI off the home directory that is created when the session
+# is first initiated.
+module OpenSession
+
+  # This singleton class ascertains the users home folder in a manner
+  # agnositic to whether the software is running on Linux or Windows.
+  class Home
+    include Singleton
+
+    # This static behaviour reads the [home folder] just once.
+    def self.dir
+      return Home.instance.folder
+    end
+
+    # This static behaviour reads the [username] just once.
+    def self.usr
+      return Home.instance.username
+    end
+
+    attr_reader :folder
+    attr_reader :username
+
+    # Ascertain the home folder location.
+    def initialize
+
+      # On Windows the home folder may end with [AppData/Roaming].
+      extraneous_path = "/AppData/Roaming"
+
+      @folder  = Dir.home
+      @username = @folder.split("/").last
+      return unless Dir.home.end_with? extraneous_path
+
+      # Remove the tail [AppData/Roaming] from the home path.
+      @folder = Dir.home.gsub extraneous_path, ""
+      @username = @folder.split("/").last
+
+    end
+
+
+  end
+
+
+end

data/lib/usecase/usecase.rb

@@ -0,0 +1,245 @@
+#!/usr/bin/ruby
+# coding: utf-8
+
+# opensession contains basic behaviour for managing a client only
+# (serverless) session. Configuration directives are read and written
+# from an INI off the home directory that is created when the session
+# is first initiated.
+#
+# The session is expected to be formally closed down and that is
+# reflected by explicitly deleting the configuration file. If this
+# "session over" command is not issued a reasonable time limit is
+# then invoked when the next session command is issued.
+#
+# This "session awakening" wipes the slate clean and starts afresh
+# with regard to the two dimensional array of configuration directive
+# pointers.
+module OpenSession
+
+
+  require "session/exceptions"
+  require "session/fact.finder"
+
+  require "extension/array"
+  require "extension/dir"
+  require "extension/string"
+
+
+  # An opensession use case is designed to be extended and does preparatory
+  # work to create favourable and useful conditions to make use cases readable,
+  # less repetitive, simpler and concise.
+  class UseCase
+
+
+    # Execute the use cases's flow from beginning when
+    # you validate the input and parameters through the
+    # memorize, execute and the final cleanup.
+    def flow_of_events
+
+      check_pre_conditions
+      pre_memorize
+      execute
+      post_memorize
+      cleanup
+      check_post_conditions
+
+    end
+
+
+
+    # Validate the input parameters and check that the current
+    # state is perfect for executing the use case.
+    #
+    # If either of the above fail - the validation function should
+    # set a human readable string and then throw an exception.
+    def check_pre_conditions
+
+
+      begin
+
+        pre_validation
+
+      rescue OpenSessionError => e
+
+        puts ""
+        puts "Your command did not complete successfully."
+        puts "Pre validation checks failed."
+        puts ""
+        puts "   => #{e.message}"
+####        puts "   => #{e.culprit}"
+        puts ""
+        abort e.message
+      end
+
+
+    end
+
+
+    # After the main flow of events certain state conditions
+    # must hold true thus demonstrating that the observable
+    # value has indeed ben delivered.
+    #
+    # Child classes should subclass this method and place any
+    # post execution (post condition) checks in it and then
+    # make a call to this method through the "super" keyword.
+    def check_post_conditions
+      begin
+
+        post_validation
+
+      rescue OpenSessionError => e
+
+        puts ""
+        puts "Your command did not complete successfully."
+        puts "Post validation checks failed."
+        puts ""
+        puts "   => #{e.message}"
+####        puts "   => #{e.culprit}"
+        puts ""
+        abort e.message
+      end
+
+
+
+    end
+
+
+    # Child classes should subclass this method and place any
+    # post execution (post condition) checks in it and then
+    # make a call to this method through the "super" keyword if
+    # this method gets any global behaviour in it worth calling.
+    def post_validation
+
+    end
+
+
+
+    # (Pre) memorize adds to permanent storage a configuration
+    # directive and its value <tt>provided by the user</tt>
+    # primarily because it avoids repitition in subsequent
+    # use case commands.
+    def pre_memorize
+
+    end
+
+
+
+    # Execute the main flow of events of the use case. Any
+    # exceptions thrown are captured and if the instance
+    # variale [@human_readable_message] is set - tell the
+    # user about it. Without any message - just tell the
+    # user something went wrong and tell them where the logs
+    # are that might carry more information.
+    def execute
+
+    end
+
+
+
+    # (Post) memorize will add to permanent storage) any
+    # key/values that have been derived or looked up during
+    # use case execution. This allows subsequent use case
+    # commands to
+    #
+    # - capitalize on
+    # - take direction from
+    # - and/or simply use
+    #
+    # the value in later use cases or processing.
+    def post_memorize
+
+    end
+
+
+
+    # If the use case validation went well, the memorization
+    # went well the 
+    def cleanup
+
+    end
+
+
+
+    # Resolve +two attached fact files+ with the first being general and
+    # relevant to every use case in the parameter specified domain, and
+    # the second being specific to this use case.
+    #
+    # The <b><em>general factfile</em></b> is expected to be on the class (load) path
+    # and below are paths for a generic domain name and for an example domain
+    # name of *openpost.io*
+    #
+    # - <tt>factbase/facts.<<domain>>.ini</tt>
+    # - <tt>factbase/facts.openpost.io.ini</tt>
+    #
+    # The <b><em>use case specific factfile</em></b> is also _expected_ to be on the class
+    # (load) path and below is a generic and a use case specific path using
+    # the example <tt>deliver</tt> use case.
+    #
+    # - <tt>factbase/facts.<<uc-name>>.usecase.ini</tt>
+    # - <tt>factbase/facts.deliver.usecase.ini</tt>
+    #
+    # The domain name is delivered in the parameter whilst the use case
+    # name is derived from the (extension) class name.
+    #
+    # @param fact_domain [String] domain of the general attached factfile
+    # @return [Hash] a 2d (two-dimensional) hash of keys and their corresponding values
+    def attached_facts fact_domain
+
+    end
+
+
+
+
+###    def path_to_resources
+###      File.join(File.dirname(File.expand_path(__FILE__)), '../path/to/resources')
+###    end
+
+    # This use case is initialized primary by resolving the configured
+    # +general and use case specific facts+. To access the general facts,
+    # a domain name is expected in the parameter delegated by the extension
+    # use case classes.
+    def initialize
+
+
+      class_name = self.class.name.downcase.split(":").last
+      is_pre_init_usecase = [ "safe", "store", "email" ].include? class_name
+      return if is_pre_init_usecase
+
+      @ucid_str = self.class.name.do_flatten
+      @ucid_sym = @ucid_str.gsub(".", "_").to_sym
+
+      OpenSession::FactFind.instance.instantiate @ucid_str
+      OpenSession::FactFind.instance.assimilate "facts.opensecret.io.ini"
+
+      @c = OpenSession::FactFind.instance.f
+      @i = OpenSession::FactFind.instance.i
+      @p = OpenSession::FactFind.instance.f[@ucid_str]
+
+      @time_stamp = OpenSession::Stamp.instance
+=begin
+    @eco_id_str = SnapFlat.do self.class.name
+    @eco_id_sym = @eco_id_str.gsub(".", "_").to_sym
+    @plugin_path = plugin_src_dir
+
+    FactTree.instance.instantiate @eco_id_str, @plugin_path
+    FactTree.instance.assimilate_instance_facts
+
+    instantiate_runtime FactTree.instance.f
+
+    FactTree.instance.identify_my_workstation
+    FactTree.instance.assimilate_station_facts
+    FactTree.instance.assimilate_plugin_facts
+    FactTree.instance.assimilate_general_facts
+
+    @c = FactTree.instance.f
+    @i = FactTree.instance.i
+    @p = FactTree.instance.f[@eco_id_sym]
+=end
+
+    end
+
+
+  end
+
+
+end

data/lib/usecase/usecases/init.rb

@@ -0,0 +1,190 @@
+#!/usr/bin/ruby
+	
+module OpenSecret
+
+  require 'openssl'
+
+# -->  require 'filesize'
+# -->  require 'tmpdir'
+# -->  require 'base64'
+# -->  require 'etc'
+# -->  require 'securerandom'
+# -->  require 'digest'
+# -->  require 'net/http'
+# -->  require 'net/ssh'
+# -->  require 'net/scp'
+# -->  require 'aws-sdk'
+# -->  require 'aws-sdk-resources'
+# -->  require 'nokogiri'
+# -->  require 'io/console'
+
+  require "session/exceptions"
+  require "crypto/collect"
+
+  # Throw this error if the configured safe directory points to a file.
+  class SafeDirectoryIsFile < OpenSession::OpenSessionError; end;
+  # Throw this error if safe directory path is either nil or empty.
+  class SafeDirNotConfigured < OpenSession::OpenSessionError; end;
+  # Throw this error if the email address is nil, empty or less than 5 characters.
+  class EmailAddrNotConfigured < OpenSession::OpenSessionError; end;
+  # Throw this error if the store url is either nil or empty.
+  class StoreUrlNotConfigured < OpenSession::OpenSessionError; end;
+  # Throw if "prime folder" name occurs 2 or more times in the path.
+  class SafePrimeNameRepeated < OpenSession::OpenSessionError; end;
+  # Throw if "prime folder" name occurs 2 or more times in the path.
+  class SafePrimeNameNotAtEnd < OpenSession::OpenSessionError; end;
+
+
+  # The <tt>init use case</tt> initializes +opensecret+ thus preparing it
+  # for the ability to lock secrets, unlock them, transport their keys and
+  # much more.
+  #
+  # Like all use cases, {self} validates to ensure that the pre-conditions
+  # have been met and then proceeds to execute its core offering and deliver
+  # observable value.
+  #
+  # == Observable Value
+  #
+  # The observable value delivered by init boils down to
+  #
+  # - <tt>4 crypted keys</tt> on USB (or phone) in the +master.keys+ folder.
+  # - <tt>1 crypted workstation key</tt> under the workstation's home directory
+  # - one human password stashed deep inside your brain
+  #
+  # +No cloud or other external access+ occurs as per the opensecret policy.
+  class Init < OpenSession::UseCase
+
+
+    attr_writer :safe_path, :email_addr, :store_url
+    @@context_name = "opensecret"
+
+    # The init use case initializes [opensecret] making it ready to lock and
+    # unlock secrets.
+    #
+    # == Main Flow of Events
+    #
+    # So in preparation to execute its modus operandi encryption,
+    # decryption and (if required) transportation use cases opensecret will
+    #
+    # - +collect the human password+ (twice), verify robustness (and throw away asap)
+    # - +manufacture workstation key+ that will be encrypted b4 it rests on machine
+    # - +create amalgamated human/workstation password+ for locking the private key
+    # - +create a long cryptographically strong symmetric encryption key+
+    # - +encrypt workstation key+ into <tt>.opensecret/<email>/machine.password.cipher.txt</tt>
+    # - +encrypt workstation encryption key+ with human password and email address
+    # - then write into <tt>safe</tt> under <tt>machine.password.key.cipher.txt</tt>
+    # - +create a super 8,192 bit private/public key pair+
+    # - use +amalgamated password to encrypt the private key+
+    # - write to <tt><SAFE>/<email>/master.keys/master.private.key.crypt.txt</tt>
+    # - +create robust salt+ for hashing the path to the (crypted) keys and ciphers
+    # - use +public key to encrypt the salt+
+    # - write crypted salt to <tt><SAFE>/<email>/master.keys/master.path.salt.crypt.txt</tt>
+    # - now +use the public key to encrypt itself+
+    # - write public key crypt to <tt><SAFE>/<email>/master.keys/master.public.key.crypt.txt</tt>
+    # - +create the cryptographic keystore+ inside the safe
+    #
+    # Variables should be first zeroed and then deleted immediately after their last use.
+    # +We need to avoid sensitive keys hanging around waiting for the garbage collector.+
+    # If necessary - sensitive areas such as these could be implemented in Go or C which
+    # deliver control of exactly where, when and how memory is allocaed, and zeroed out.
+    #
+    # == Observable Value
+    #
+    # The <tt>init use case</tt> observable value post-conditions are
+    #
+    # - <tt>4 crypted keys</tt> on USB (or phone) in the +master.keys+ folder.
+    # - <tt>1 crypted workstation key</tt> under the workstation's home directory
+    # - one human password stashed deep inside your brain
+    #
+    # == New Feature | Prevent Public Key Switch Attacks
+    #
+    # +Public Key switch attacks+ try to access <tt>future secrets</tt> - not the ones
+    # already encrypted.
+    #
+    # Their goal is <tt>unwitting encryption using a public key they control.</tt>
+    #
+    # A new feature should tie down the signatures of the 5 encrypted files (4 on
+    # usb/phone store and 1 on the machine) within a second workstation file and use
+    # first the human password and then the public key to lock it down.
+    #
+    # This action thwarts (usb key) switch attacks where the attacker knows the human
+    # password and has access to the USB key for a time.
+    #
+    def execute
+
+      natural_password = Collect.secret_text @c[:global][:min_passwd_len], @c[:global][:prompt_1], @c[:global][:prompt_2]
+
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+##########------------> START FROM HERE (aside from prompt bug (check facts) all good.
+      machine_password = Crypto.get_machine_password natural_password.length, @p[:ratio]
+      amalgam_password = Crypto.get_amalgam_password natural_password, machine_password, @p[:ratio]
+
+      asymmetric_keys = OpenSSL::PKey::RSA.new @p[:bit_key_size]
+      secured_keytext = asymmetric_keys.export @p[:key_cipher], amalgam_password
+      public_key_text = asymmetric_keys.public_key.to_pem
+
+      Dir.mkdir @p[:secret_keydir] unless File.exists? @p[:secret_keydir]
+      File.write @p[:secret_keypath], secured_keytext
+
+      Crypto.print_secret_env_var @p[:env_var_name], machine_password
+
+      GitFlow.do_clone_repo @p[:public_gitrepo], @p[:local_gitrepo]
+      FileUtils.mkdir_p @p[:public_keydir]
+      File.write @p[:public_keypath], public_key_text
+      GitFlow.push @p[:local_gitrepo], @p[:public_keyname], @c[:time][:stamp]
+
+#    exit
+# key4_pem = File.read 'private.secure.pem'
+# pass_phrase = 'superduperpasswordistoBeENTEREDRIGHT1234HereandRightNOW'
+# key4 = OpenSSL::PKey::RSA.new key4_pem, pass_phrase
+# decrypted_text = key4.private_decrypt(Base64.decode64(encrypted_string))
+
+# print "\nHey we have done the decryption.\n", "\n"
+# print decrypted_text, "\n"
+
+
+
+    end
+
+
+    # Perform pre-conditional validations in preparation to executing the main flow
+    # of events for this use case. This method may throw the below exceptions.
+    #
+    # @raise [SafeDirNotConfigured] if the safe's url has not been configured
+    # @raise [EmailAddrNotConfigured] if the email address has not been configured
+    # @raise [StoreUrlNotConfigured] if the crypt store url is not configured
+    def pre_validation
+
+      @safe_path = OpenSession::Attributes.instance.get_value @@context_name, "safe"
+      safe_configured = File.exists?( @safe_path ) && File.directory?( @safe_path )
+      @err_msg = "[safe] storage not yet configured. Try =>] opensecret safe /folder/path"
+      raise SafeDirNotConfigured.new @err_msg, @safe_path unless safe_configured
+
+      @email_addr = OpenSession::Attributes.instance.get_value @@context_name, "email"
+      email_configured = !@email_addr.nil? && !@email_addr.empty? && @email_addr.length > 4
+      @err_msg = "viable [email address] not configured. Try =>] opensecret email joe@example.com"
+      raise EmailAddrNotConfigured.new @err_msg, @email_addr unless email_configured
+
+      @store_url = OpenSession::Attributes.instance.get_value @@context_name, "store"
+      store_configured = !@store_url.nil? && !@store_url.empty? && @store_url.length > 0
+      @err_msg = "crypt [store url] not configured. Try =>] opensecret store /path/to/crypt"
+      raise StoreUrlNotConfigured.new @err_msg, @store_url unless store_configured
+
+    end
+
+
+  end
+
+
+end