@binsky/passman-client-ts 0.1.0-7

package/lib/Model/NextcloudServer.js

@@ -0,0 +1,108 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ConfigurationError_1 = __importDefault(require("../Exception/ConfigurationError"));
+class NextcloudServer {
+    serverData;
+    logger;
+    constructor(serverData, logger) {
+        this.serverData = serverData;
+        this.logger = logger;
+        if (!serverData.baseUrl.startsWith('https://') && !serverData.baseUrl.startsWith('http://')) {
+            this.logger.onThrow(new ConfigurationError_1.default('Base URL (or protocol) is invalid'));
+        }
+        if (serverData.token.length < 3) {
+            this.logger.onThrow(new ConfigurationError_1.default('Password or token is invalid'));
+        }
+    }
+    getBaseUrl() {
+        return this.serverData.baseUrl;
+    }
+    setBaseUrl(value) {
+        if (!value.startsWith('https://')) {
+            this.logger.onThrow(new ConfigurationError_1.default('Base URL is invalid'));
+        }
+        return this.serverData.baseUrl = value;
+    }
+    getUser() {
+        return this.serverData.user;
+    }
+    setUser(value) {
+        return this.serverData.user = value;
+    }
+    getToken() {
+        return this.serverData.token;
+    }
+    setToken(value) {
+        return this.serverData.token = value;
+    }
+    getApiUrl() {
+        return `${this.getBaseUrl()}/index.php/apps/passman/api/v2/`;
+    }
+    getEncodedLogin() {
+        return btoa(this.getUser() + ":" + this.getToken());
+    }
+    get = async (endpoint, errorCallback) => {
+        return await fetch(this.getApiUrl() + endpoint, {
+            headers: {
+                Authorization: `Basic ${this.getEncodedLogin()}`
+            }
+        }).catch((err) => errorCallback(err));
+    };
+    getJson = async (endpoint, errorCallback) => {
+        const res = await fetch(this.getApiUrl() + endpoint, {
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Basic ${this.getEncodedLogin()}`
+            }
+        }).catch((err) => errorCallback(err));
+        if (!res) {
+            return;
+        }
+        if (res.status >= 400) {
+            const data = await res.json();
+            this.logger.onError(data.message);
+            return;
+        }
+        return (await res.json());
+    };
+    delete = async (endpoint, errorCallback) => {
+        return await fetch(this.getApiUrl() + endpoint, {
+            method: 'DELETE',
+            headers: {
+                Authorization: `Basic ${this.getEncodedLogin()}`
+            }
+        }).catch((err) => errorCallback(err));
+    };
+    /**
+     * Do a post request.
+     *
+     * @param endpoint
+     * @param data will be converted to a json string
+     * @param errorCallback
+     * @param method
+     */
+    postJson = async (endpoint, data, errorCallback, method = 'POST') => {
+        const res = await fetch(this.getApiUrl() + endpoint, {
+            method: method,
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Basic ${this.getEncodedLogin()}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }).catch((err) => errorCallback(err));
+        if (!res) {
+            return;
+        }
+        if (res.status >= 400) {
+            const data = await res.json();
+            this.logger.onError(data.message);
+            return;
+        }
+        return (await res.json());
+    };
+}
+exports.default = NextcloudServer;

package/lib/Model/Revision.d.ts

@@ -0,0 +1,21 @@
+import Credential from "./Credential";
+import NextcloudServer from "./NextcloudServer";
+import type Vault from "./Vault";
+import { EncryptedCredentialInterface } from "../Interfaces/Credential/EncryptedCredentialInterface";
+import { FileUploadResponseInterface } from "../Interfaces/File/FileUploadResponseInterface";
+import { RevisionInterface } from "../Interfaces/Revision/RevisionInterface";
+export default class Revision extends Credential {
+    ENCRYPTED_FIELDS: string[];
+    static updateRevision(revision: RevisionInterface, server: NextcloudServer): Promise<void | FileUploadResponseInterface>;
+    /**
+     * Create a revision object based on its encrypted data.
+     * @param data
+     * @param vault
+     * @param server
+     */
+    static fromData(data: EncryptedCredentialInterface, vault: Vault, server: NextcloudServer): Promise<Revision>;
+    /**
+     * Creates a local 100% clone of the current credential.
+     */
+    clone(): Revision;
+}

package/lib/Model/Revision.js

@@ -0,0 +1,33 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Credential_1 = __importDefault(require("./Credential"));
+class Revision extends Credential_1.default {
+    ENCRYPTED_FIELDS = ['description', 'username', 'password', 'files', 'custom_fields', 'otp', 'email', 'tags', 'url', 'compromised'];
+    static updateRevision(revision, server) {
+        const credentialGUID = revision.credential_data.guid;
+        revision.credential_data = window.btoa(JSON.stringify(revision.credential_data));
+        return server.postJson('/credentials/' + credentialGUID + '/revision/' + revision.revision_id, revision, () => {
+        }, 'PATCH');
+    }
+    /**
+     * Create a revision object based on its encrypted data.
+     * @param data
+     * @param vault
+     * @param server
+     */
+    static async fromData(data, vault, server) {
+        return new Revision(vault, server, data);
+    }
+    /**
+     * Creates a local 100% clone of the current credential.
+     */
+    clone() {
+        const newCredential = new Revision(this.vault, this.server, this.encryptedData);
+        newCredential.sharedCredentialEncryptionKey = this.sharedCredentialEncryptionKey;
+        return newCredential;
+    }
+}
+exports.default = Revision;

package/lib/Model/SharingACL.d.ts

@@ -0,0 +1,28 @@
+export declare class SharingACL {
+    private permission;
+    constructor(permission: number);
+    static readonly permissions: {
+        READ: number;
+        WRITE: number;
+        FILES: number;
+        HISTORY: number;
+        OWNER: number;
+    };
+    /**
+     * Checks if a user has the given permission/s
+     * @param permission
+     */
+    hasPermission(permission: any): boolean;
+    /**
+     * Adds a permission to a user, leaving any other permissions intact
+     * @param permission
+     */
+    addPermission(permission: any): void;
+    /**
+     * Removes a given permission from the item, leaving any other intact
+     * @param permission
+     */
+    removePermission(permission: any): void;
+    togglePermission(permission: any): void;
+    getAccessLevel(): number;
+}

package/lib/Model/SharingACL.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharingACL = void 0;
+class SharingACL {
+    permission;
+    constructor(permission) {
+        this.permission = permission;
+    }
+    static permissions = {
+        READ: 0x01,
+        WRITE: 0x02,
+        FILES: 0x04,
+        HISTORY: 0x08,
+        OWNER: 0x80,
+    };
+    /**
+     * Checks if a user has the given permission/s
+     * @param permission
+     */
+    hasPermission(permission) {
+        return permission === (this.permission & permission);
+    }
+    ;
+    /**
+     * Adds a permission to a user, leaving any other permissions intact
+     * @param permission
+     */
+    addPermission(permission) {
+        this.permission = this.permission | permission;
+    }
+    ;
+    /**
+     * Removes a given permission from the item, leaving any other intact
+     * @param permission
+     */
+    removePermission(permission) {
+        this.permission = this.permission & ~permission;
+    }
+    ;
+    togglePermission(permission) {
+        this.permission ^= permission;
+    }
+    ;
+    getAccessLevel() {
+        return this.permission;
+    }
+}
+exports.SharingACL = SharingACL;

package/lib/Model/Vault.d.ts

@@ -0,0 +1,38 @@
+import NextcloudServer from "./NextcloudServer";
+import Credential from "./Credential";
+import { VaultInterface } from "../Interfaces/Vault/VaultInterface";
+export default class Vault {
+    private data;
+    private server;
+    private _vaultKey;
+    constructor(data: VaultInterface, server: NextcloudServer);
+    static create(vaultName: string, vaultPassword: string, server: NextcloudServer): Promise<Vault>;
+    refresh(): Promise<boolean>;
+    update(): Promise<boolean>;
+    delete(currentPassword: string): Promise<boolean>;
+    lock(): void;
+    updateSharingKeys(public_sharing_key: string, private_sharing_key: string): Promise<void>;
+    testVaultKey(vaultKey: string): boolean;
+    private getChallengingFieldValue;
+    private getFirstOwnedCredential;
+    getCredentialByGuid(guid: string): Credential | undefined;
+    getServer(): NextcloudServer;
+    get vaultId(): number | null;
+    get vaultKey(): string;
+    set vaultKey(value: string);
+    get guid(): string;
+    get name(): string;
+    set name(value: string);
+    get created(): number;
+    get public_sharing_key(): string;
+    get private_sharing_key(): string;
+    get sharing_keys_generated(): number;
+    set sharing_keys_generated(value: number);
+    get last_access(): number;
+    get challenge_password(): string;
+    get delete_request_pending(): boolean;
+    set delete_request_pending(value: boolean);
+    get vault_settings(): null;
+    set vault_settings(value: null);
+    get credentials(): Credential[];
+}

package/lib/Model/Vault.js

@@ -0,0 +1,265 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Credential_1 = __importDefault(require("./Credential"));
+const PassmanCrypto_1 = require("../Service/PassmanCrypto");
+const ShareService_1 = require("../Service/ShareService");
+const File_1 = require("./File");
+const BrowserStorage_1 = require("../BrowserStorage");
+class Vault {
+    data;
+    server;
+    _vaultKey;
+    constructor(data, server) {
+        this.data = data;
+        this.server = server;
+    }
+    static async create(vaultName, vaultPassword, server) {
+        let vaultResponse = await server.postJson('/vaults', { vault_name: vaultName }, (response) => {
+            server.logger.onError(response.message);
+        });
+        if (vaultResponse) {
+            const vault = new Vault(vaultResponse, server);
+            vault._vaultKey = vaultPassword;
+            await PassmanCrypto_1.PassmanCrypto.generateRSAKeypair(2048).then(async (value) => {
+                if (value.keypair) {
+                    const pemKeyPair = PassmanCrypto_1.PassmanCrypto.rsaKeyPairToPEM(value.keypair);
+                    await vault.updateSharingKeys(pemKeyPair.publicKey, pemKeyPair.privateKey);
+                    // todo: create hidden test credential
+                    let testCredential = new Credential_1.default(vault, server);
+                    testCredential.label = 'Test key for vault ' + vaultName;
+                    testCredential.hidden = true;
+                    testCredential.password = 'lorum ipsum';
+                    if (await testCredential.save()) {
+                        // todo: refresh / log in to the new vault
+                        server.logger.onSuccess('Vault successfully created');
+                    }
+                    else {
+                        server.logger.onError('Failed saving test credential in new vault');
+                    }
+                }
+                else {
+                    server.logger.onError('Failed to create a new vault rsa key-pair');
+                }
+            });
+            return vault;
+        }
+    }
+    async refresh() {
+        let vaultResponse = await this.server.getJson('/vaults/' + this.guid, (response) => {
+            this.server.logger.onError(response.message);
+        });
+        if (vaultResponse) {
+            const credentials = [];
+            for (const credentialData of vaultResponse.credentials) {
+                try {
+                    credentials.push(await Credential_1.default.fromData(credentialData, this, this.server));
+                }
+                catch (e) {
+                    this.server.logger.anyError(e);
+                    this.server.logger.onError('Failed to decrypt credential: ' + credentialData.label);
+                }
+            }
+            const credentialsSharedWithUs = await ShareService_1.ShareService.getCredentialsSharedWithUs(this, this.server);
+            for (const credential of credentialsSharedWithUs) {
+                credentials.push(credential);
+            }
+            // todo: check if a creation of vault.private_sharing_key for old vaults is required
+            this.data = {
+                challenge_password: vaultResponse.challenge_password,
+                created: vaultResponse.created,
+                credentials: credentials,
+                delete_request_pending: vaultResponse.delete_request_pending,
+                guid: vaultResponse.guid,
+                last_access: vaultResponse.last_access,
+                name: vaultResponse.name,
+                private_sharing_key: vaultResponse.private_sharing_key,
+                public_sharing_key: vaultResponse.public_sharing_key,
+                sharing_keys_generated: vaultResponse.sharing_keys_generated,
+                vault_id: vaultResponse.vault_id,
+                vault_settings: vaultResponse.vault_settings,
+            };
+            return true;
+        }
+        return false;
+    }
+    async update() {
+        const result = await this.server.postJson('/vaults/' + this.data.guid, {
+            guid: this.data.guid,
+            vault_id: this.data.vault_id,
+            name: this.data.name,
+            created: this.data.created,
+            public_sharing_key: this.data.public_sharing_key,
+            last_access: this.data.last_access,
+            delete_request_pending: this.data.delete_request_pending,
+            sharing_keys_generated: this.data.sharing_keys_generated,
+            vault_settings: this.data.vault_settings
+        }, (response) => {
+            this.server.logger.onError(response.message);
+        }, 'PATCH');
+        return result === null;
+    }
+    async delete(currentPassword) {
+        if (!this.testVaultKey(currentPassword)) {
+            this.server.logger.onError('Invalid password!');
+            return false;
+        }
+        let fileIds = [];
+        for (const credential of this.credentials) {
+            for (const file of credential.files) {
+                if (file.file_id) {
+                    fileIds.push(file.file_id);
+                }
+            }
+        }
+        const deleteFilesResponse = await File_1.File.deleteFiles({ file_ids: JSON.stringify(fileIds) }, this.server);
+        if (!deleteFilesResponse) {
+            // void response should "never" happen with a working server side
+            this.server.logger.onError('Abort! Failed to request files deletion.');
+            return false;
+        }
+        if (!deleteFilesResponse.ok) {
+            // minor file deletion issues; continue vault deletion
+            this.server.logger.onError('Failed to delete files: ' + deleteFilesResponse.failed.toString());
+        }
+        let deleteVaultResponse = await this.server.delete('/vaults/' + this.guid, (response) => {
+            this.server.logger.onError(response.message);
+        });
+        if (!deleteVaultResponse) {
+            // void response should "never" happen with a working server side
+            this.server.logger.onError('Abort! Failed to request vault deletion.');
+            return false;
+        }
+        if (deleteVaultResponse.status === 200) {
+            BrowserStorage_1.BrowserStorage.clearAllStorageTypesForVaultGUID(this.guid);
+            // todo: delete from local/memory vaults store
+            /*let passmanClient = get<PassmanClient>(passmanStore);
+            for (let i = 0; i < passmanClient.vaults.length; i++) {
+                if (passmanClient.vaults[i].guid === this.guid) {
+                    passmanClient.vaults.splice(i, 1);
+                }
+            }*/
+            return true;
+        }
+        return false;
+    }
+    lock() {
+        this.vaultKey = null;
+        // clear decrypted credential cache from memory
+        for (const credential of this.data.credentials) {
+            credential.clearDecryptedDataCache();
+        }
+        BrowserStorage_1.BrowserStorage.ensureDeleteKeyForAllStorageTypes('vault-' + this.guid, 'vaultKey');
+    }
+    async updateSharingKeys(public_sharing_key, private_sharing_key) {
+        return await this.server.postJson('/vaults/' + this.data.guid + '/sharing-keys', {
+            guid: this.data.guid,
+            public_sharing_key: public_sharing_key,
+            private_sharing_key: PassmanCrypto_1.PassmanCrypto.encryptString(private_sharing_key, this.vaultKey),
+        }, (response) => {
+            this.server.logger.onError(response.message);
+        });
+    }
+    testVaultKey(vaultKey) {
+        try {
+            if (this.challenge_password) {
+                PassmanCrypto_1.PassmanCrypto.decryptString(this.challenge_password, vaultKey);
+                return true;
+            }
+            else if (this.credentials.length > 0) {
+                PassmanCrypto_1.PassmanCrypto.decryptString(this.getChallengingFieldValue(), vaultKey);
+                return true;
+            }
+        }
+        catch (e) {
+        }
+        return false;
+    }
+    getChallengingFieldValue() {
+        const testCredential = this.getFirstOwnedCredential();
+        if (testCredential.getEncrypted().username != null) {
+            return testCredential.getEncrypted().username;
+        }
+        else if (testCredential.getEncrypted().password != null) {
+            return testCredential.getEncrypted().password;
+        }
+        else if (testCredential.getEncrypted().email != null) {
+            return testCredential.getEncrypted().email;
+        }
+        return null;
+    }
+    getFirstOwnedCredential() {
+        for (let credential of this.credentials) {
+            if (!credential.hasValidSharedKey() && credential.sharedCredentialEncryptionKey === undefined) {
+                return credential;
+            }
+        }
+    }
+    getCredentialByGuid(guid) {
+        for (let credential of this.credentials) {
+            if (credential.guid === guid) {
+                return credential;
+            }
+        }
+    }
+    getServer() {
+        return this.server;
+    }
+    get vaultId() {
+        return this.data.vault_id;
+    }
+    get vaultKey() {
+        return this._vaultKey;
+    }
+    set vaultKey(value) {
+        this._vaultKey = value;
+    }
+    get guid() {
+        return this.data.guid;
+    }
+    get name() {
+        return this.data.name;
+    }
+    set name(value) {
+        this.data.name = value;
+    }
+    get created() {
+        return this.data.created;
+    }
+    get public_sharing_key() {
+        return this.data.public_sharing_key;
+    }
+    get private_sharing_key() {
+        return PassmanCrypto_1.PassmanCrypto.decryptString(this.data.private_sharing_key, this.vaultKey);
+    }
+    get sharing_keys_generated() {
+        return this.data.sharing_keys_generated;
+    }
+    set sharing_keys_generated(value) {
+        this.data.sharing_keys_generated = value;
+    }
+    get last_access() {
+        return this.data.last_access;
+    }
+    get challenge_password() {
+        return this.data.challenge_password;
+    }
+    get delete_request_pending() {
+        return this.data.delete_request_pending;
+    }
+    set delete_request_pending(value) {
+        this.data.delete_request_pending = value;
+    }
+    get vault_settings() {
+        return this.data.vault_settings;
+    }
+    set vault_settings(value) {
+        this.data.vault_settings = value;
+    }
+    get credentials() {
+        return this.data.credentials ?? [];
+    }
+}
+exports.default = Vault;

package/lib/PassmanClient.d.ts

@@ -0,0 +1,20 @@
+import NextcloudServer from "./Model/NextcloudServer";
+import Vault from "./Model/Vault";
+import type { LoggingHandlerInterface } from "./Interfaces/LoggingHandlerInterface";
+import { NextcloudServerInterface } from "./Interfaces/NextcloudServer/NextcloudServerInterface";
+export declare class PassmanClient {
+    readonly server: NextcloudServer;
+    private logger;
+    vaults: Vault[];
+    constructor(serverData: NextcloudServerInterface, logger?: LoggingHandlerInterface);
+    refreshVaults(throwError?: boolean, preserveInMemoryVaultKeys?: boolean): Promise<boolean>;
+    createVault(vaultName: string, vaultPassword: string): Promise<void | Vault>;
+    getVaultByGuid(guid: string): Promise<Vault>;
+    /**
+     * Make sure that this.vaults is an array and not undefined, before using this method.
+     * @param guid
+     * @private
+     */
+    private _getVaultByGuid;
+    getTranslation(lang?: string): Promise<void | object>;
+}

package/lib/PassmanClient.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PassmanClient = void 0;
+const NextcloudServer_1 = __importDefault(require("./Model/NextcloudServer"));
+const Vault_1 = __importDefault(require("./Model/Vault"));
+const DefaultLoggingService_1 = require("./Service/DefaultLoggingService");
+class PassmanClient {
+    server;
+    logger;
+    vaults;
+    constructor(serverData, logger = undefined) {
+        this.logger = logger ?? new DefaultLoggingService_1.DefaultLoggingService();
+        this.server = new NextcloudServer_1.default(serverData, this.logger);
+    }
+    async refreshVaults(throwError = false, preserveInMemoryVaultKeys = true) {
+        let newVaults = [];
+        const vaults = await this.server.getJson('/vaults', (error) => {
+            console.error(error);
+            if (throwError) {
+                this.logger.onThrow(error);
+            }
+        });
+        if (vaults) {
+            vaults.forEach((vaultData) => {
+                const vault = new Vault_1.default(vaultData, this.server);
+                if (this.vaults !== undefined && preserveInMemoryVaultKeys) {
+                    const oldVaultInstance = this._getVaultByGuid(vault.guid);
+                    if (oldVaultInstance && oldVaultInstance.vaultKey && vault.testVaultKey(oldVaultInstance.vaultKey)) {
+                        vault.vaultKey = oldVaultInstance.vaultKey;
+                    }
+                }
+                newVaults.push(vault);
+            });
+            this.vaults = newVaults;
+            return true;
+        }
+        return false;
+    }
+    async createVault(vaultName, vaultPassword) {
+        let newVault = await Vault_1.default.create(vaultName, vaultPassword, this.server);
+        if (newVault) {
+            this.vaults.push(newVault);
+            return newVault;
+        }
+    }
+    async getVaultByGuid(guid) {
+        if (this.vaults === undefined) {
+            if (!await this.refreshVaults()) {
+                this.logger.onError("failed to refresh vaults");
+                return;
+            }
+        }
+        const foundVault = this._getVaultByGuid(guid);
+        if (foundVault) {
+            return foundVault;
+        }
+        this.logger.onError(`vault with guid ${guid} not found`);
+    }
+    /**
+     * Make sure that this.vaults is an array and not undefined, before using this method.
+     * @param guid
+     * @private
+     */
+    _getVaultByGuid(guid) {
+        for (const element of this.vaults) {
+            if (element.guid === guid) {
+                return element;
+            }
+        }
+    }
+    async getTranslation(lang = 'en') {
+        return await this.server.getJson('/language?lang=' + lang, (response) => {
+            this.logger.onError(response.message);
+        });
+    }
+}
+exports.PassmanClient = PassmanClient;

package/lib/Service/CredentialFilterService.d.ts

@@ -0,0 +1,24 @@
+import type Credential from "../Model/Credential";
+import { FilterStatsInterface } from "../Interfaces/CredentialFilterService/FilterStatsInterface";
+export declare enum FILTERS {
+    SHOW_ALL = 0,
+    COMPROMISED = 1,
+    STRENGTH_LOW = 2,
+    STRENGTH_MEDIUM = 3,
+    STRENGTH_GOOD = 4,
+    EXPIRED = 5,
+    DELETED = 6,
+    ENCRYPTION_BROKEN = 7
+}
+export declare class CredentialFilterService {
+    static getFilteredCredentials: (allCredentials: Credential[], filter: FILTERS, additionalFilterText?: string) => Credential[];
+    static getFilterStats: (allCredentials: Credential[]) => FilterStatsInterface;
+    static isHidden(credential: Credential): boolean;
+    static isDeleted(credential: Credential): boolean;
+    static isCompromised(credential: Credential): boolean;
+    static isExpired(credential: Credential, now?: number): boolean;
+    static hasLowStrength(credential: Credential): boolean;
+    static hasMediumStrength(credential: Credential): boolean;
+    static hasGoodStrength(credential: Credential): boolean;
+    static matchesFilterText(credential: Credential, filterText: string): boolean;
+}