aethervault-py 6.4.0__py3-none-any.whl

aethervault/__init__.py

@@ -0,0 +1,49 @@
+# Created: 2026-07-24
+# Last Edited: 2026-08-05 17:06 CT (America/Chicago)
+# Path: aethervault/__init__.py
+# Purpose: Package init for AetherVault source. Defines PROJECT_ROOT and portable mode.
+
+"""Package initializer providing PROJECT_ROOT, version constants, and portable mode controls."""
+
+__version__ = "6.4.0"
+VERSION = __version__
+__app_name__ = "AetherVault"
+APP_NAME = __app_name__
+
+import os
+import sys
+
+if getattr(sys, "frozen", False):
+    PROJECT_ROOT = os.getcwd()
+else:
+    PROJECT_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+PORTABLE_MARKER = ".portable"
+
+
+def is_portable() -> bool:
+    """Return True if the portable marker file exists in PROJECT_ROOT."""
+    return os.path.exists(os.path.join(PROJECT_ROOT, PORTABLE_MARKER))
+
+
+def enable_portable_mode() -> bool:
+    """Create the portable marker file and return True, or return False on failure."""
+    try:
+        path = os.path.join(PROJECT_ROOT, PORTABLE_MARKER)
+        if not os.path.exists(path):
+            with open(path, "w") as f:
+                f.write("Portable mode enabled\n")
+        return True
+    except OSError:
+        return False
+
+
+def disable_portable_mode() -> bool:
+    """Remove the portable marker file and return True, or return False on failure."""
+    try:
+        path = os.path.join(PROJECT_ROOT, PORTABLE_MARKER)
+        if os.path.exists(path):
+            os.remove(path)
+        return True
+    except OSError:
+        return False

aethervault/__main__.py

@@ -0,0 +1,214 @@
+# Created: 2026-07-24
+# Last Edited: 2026-08-01 01:55 CT (America/Chicago)
+# Path: aethervault/__main__.py
+# Purpose: Application entry point with CLI switches (--version, --debug, --upgrade, --foreground).
+
+"""Application entry point with CLI switches (--version, --debug, --upgrade, --foreground)."""
+
+import argparse
+import json
+import logging
+import os
+import subprocess
+import sys
+import urllib.request
+import urllib.error
+from typing import Optional
+
+from PySide6.QtCore import QTimer
+from PySide6.QtWidgets import QApplication
+
+from aethervault import PROJECT_ROOT, VERSION
+from aethervault.gui.app import PySidePWManager
+
+GITHUB_TAGS_API = "https://api.github.com/repos/AetherSolDev/AetherVault/tags"
+
+
+GIT_REPO_URL = "https://github.com/AetherSolDev/AetherVault.git"
+RELEASES_URL = "https://github.com/AetherSolDev/AetherVault/releases/latest"
+
+
+def _is_git_repo() -> bool:
+    """Return True if PROJECT_ROOT contains a .git directory."""
+    return os.path.isdir(os.path.join(PROJECT_ROOT, ".git"))
+
+
+def _get_pip_command() -> str:
+    """Return the appropriate pip command (venv or system)."""
+    in_venv = sys.prefix != sys.base_prefix
+    if in_venv:
+        return os.path.join(sys.prefix, "bin", "pip")
+    return "pip"
+
+
+def _fetch_latest_tag() -> Optional[str]:
+    """Fetch the latest version tag from GitHub. Returns tag string or None."""
+    try:
+        req = urllib.request.Request(GITHUB_TAGS_API, headers={"User-Agent": "AetherVault"})
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            tags = json.loads(resp.read().decode())
+    except urllib.error.HTTPError as e:
+        print(f"Upgrade check failed (HTTP {e.code})")
+        return None
+    except (urllib.error.URLError, json.JSONDecodeError, OSError) as e:
+        print(f"Upgrade check failed: {e}")
+        return None
+
+    if not tags:
+        print("No version tags found on GitHub.")
+        return None
+
+    latest_tag = tags[0].get("name", "").lstrip("v")
+    if not latest_tag:
+        print("Could not determine latest version.")
+        return None
+
+    return latest_tag
+
+
+def _perform_upgrade(latest_tag: str) -> bool:
+    """Perform the actual upgrade. Returns True on success."""
+    print(f"Upgrading AetherVault v{VERSION} → v{latest_tag} ...")
+    print()
+
+    try:
+        git_env = os.environ.copy()
+        git_env["GIT_DISCOVERY_ACROSS_FILESYSTEM"] = "1"
+
+        if _is_git_repo():
+            print("1. Pulling latest code via git ...", end=" ", flush=True)
+            result = subprocess.run(
+                ["git", "pull"],
+                cwd=PROJECT_ROOT,
+                capture_output=True, text=True, timeout=60,
+                env=git_env,
+            )
+            if result.returncode != 0:
+                print("FAILED")
+                print(result.stderr)
+                print("Tip: Set git safe.directory or GIT_DISCOVERY_ACROSS_FILESYSTEM")
+                return False
+            print("done")
+
+            print("2. Reinstalling package ...", end=" ", flush=True)
+            pip_cmd = _get_pip_command()
+            result = subprocess.run(
+                [pip_cmd, "install", "-e", "."],
+                cwd=PROJECT_ROOT,
+                capture_output=True, text=True, timeout=120,
+            )
+            if result.returncode != 0:
+                print("FAILED")
+                print(result.stderr)
+                return False
+            print("done")
+        else:
+            print("1. Upgrading via pip ...", end=" ", flush=True)
+            pip_cmd = _get_pip_command()
+            result = subprocess.run(
+                [pip_cmd, "install", "--upgrade", f"git+{GIT_REPO_URL}"],
+                capture_output=True, text=True, timeout=120,
+            )
+            if result.returncode != 0:
+                print("FAILED")
+                print(result.stderr)
+                return False
+            print("done")
+
+        print(f"\nUpgrade to v{latest_tag} complete!")
+        return True
+
+    except (subprocess.TimeoutExpired, OSError) as e:
+        print(f"FAILED — {e}")
+        return False
+
+
+def check_for_upgrades() -> bool:
+    """Check GitHub tags for a newer version and upgrade if available. Returns True on success."""
+    latest_tag = _fetch_latest_tag()
+    if latest_tag is None:
+        return False
+
+    def parse_ver(v: str):
+        parts = v.split(".")
+        return tuple(int(p) if p.isdigit() else 0 for p in parts[:3])
+
+    current = parse_ver(VERSION)
+    latest = parse_ver(latest_tag)
+
+    if latest <= current:
+        print(f"You're up to date! (v{VERSION})")
+        return False
+
+    return _perform_upgrade(latest_tag)
+
+
+def detach_from_terminal():
+    """Fork and release the terminal (Unix only). Parent exits, child continues."""
+    try:
+        pid = os.fork()
+        if pid > 0:
+            sys.exit(0)
+        os.setsid()
+        devnull = os.open(os.devnull, os.O_RDWR)
+        os.dup2(devnull, 0)
+        os.dup2(devnull, 1)
+        os.dup2(devnull, 2)
+        os.close(devnull)
+    except OSError:
+        pass
+
+
+def run():
+    """Parse CLI arguments and run the application."""
+    parser = argparse.ArgumentParser(description="AetherVault — secure password manager")
+    parser.add_argument(
+        "--version", "-v",
+        action="store_true",
+        help="Show version and exit",
+    )
+    parser.add_argument(
+        "--debug", "-d",
+        action="store_true",
+        help="Enable debug logging to terminal",
+    )
+    parser.add_argument(
+        "--upgrade", "-u",
+        action="store_true",
+        help="Check for updates and auto-upgrade (git pull + pip install)",
+    )
+    parser.add_argument(
+        "--foreground", "-f",
+        action="store_true",
+        help="Keep terminal attached (for debugging)",
+    )
+    args = parser.parse_args()
+
+    if args.version:
+        print(f"AetherVault v{VERSION}")
+        sys.exit(0)
+
+    if args.upgrade:
+        check_for_upgrades()
+        sys.exit(0)
+
+    if args.debug:
+        logging.basicConfig(
+            level=logging.DEBUG,
+            stream=sys.stderr,
+            format="%(levelname)s:%(name)s:%(message)s",
+        )
+
+    if not args.foreground and sys.platform != "win32":
+        detach_from_terminal()
+
+    app = QApplication(sys.argv)
+    app.setStyle("Fusion")
+    window = PySidePWManager()
+    window.show()
+    QTimer.singleShot(500, window.check_setup_state)
+    sys.exit(app.exec())
+
+
+if __name__ == "__main__":
+    run()

aethervault/core/__init__.py

@@ -0,0 +1,6 @@
+# Created: 2026-08-05
+# Last Edited: 2026-08-05 15:35 CT (America/Chicago)
+# Path: aethervault/core/__init__.py
+# Purpose: Business-logic package — engine, password utilities.
+
+"""Business logic for AetherVault: engine (encryption/hashing/settings) and password utilities."""

aethervault/core/engine.py

@@ -0,0 +1,226 @@
+# Created: 2026-08-05
+# Last Edited: 2026-08-05 15:35 CT (America/Chicago)
+# Path: aethervault/core/engine.py
+# Purpose: Encryption, hashing, key derivation, backup/wipe, and settings management.
+
+"""Encryption, hashing, key derivation, backup/wipe, and settings management."""
+
+import base64
+import hashlib
+import json
+import logging
+import os
+import time
+from typing import Optional
+
+from cryptography.fernet import Fernet, InvalidToken
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+from aethervault import PROJECT_ROOT
+
+DATA_DIR = os.path.join(PROJECT_ROOT, "data")
+DB_PATH = os.path.join(DATA_DIR, "aethervault.db")
+MASTER_KEY_FILE = os.path.join(DATA_DIR, ".master.key")
+DURESS_KEY_FILE = os.path.join(DATA_DIR, ".duress.key")
+DB_BACKUP_PATH = f"{DB_PATH}.bak"
+BACKUP_MAX_FILES = 5
+JOURNAL_FILE = os.path.join(PROJECT_ROOT, "journal.md")
+APP_SETTINGS_FILE = os.path.join(DATA_DIR, ".app_settings.json")
+
+APPLICATION_SALT = b"password_manager_salt_value_12345"
+backend = default_backend()
+DEFAULT_LOCKOUT_MINUTES = 3
+logger = logging.getLogger(__name__)
+
+
+def derive_encryption_key(master_password_hash: str) -> bytes:
+    """Derive an AES-256 Fernet key from the master password hash via PBKDF2."""
+    if not master_password_hash:
+        raise ValueError("Master password hash cannot be empty for key derivation.")
+    password_bytes = master_password_hash.encode("utf-8")
+    kdf = PBKDF2HMAC(
+        algorithm=hashes.SHA256(),
+        length=32,
+        salt=APPLICATION_SALT,
+        iterations=480000,
+        backend=backend,
+    )
+    key = base64.urlsafe_b64encode(kdf.derive(password_bytes))
+    return key
+
+
+def get_timestamped_backup_path() -> str:
+    """Return a backup file path with a human-readable timestamp."""
+    timestamp = time.strftime("%Y.%m.%d_%H%M%S")
+    db_dir = os.path.dirname(DB_PATH)
+    return os.path.join(db_dir, f"aethervault_{timestamp}.db.bak")
+
+
+def encrypt_data(data: str, key: bytes) -> str:
+    """Encrypt a plaintext string using Fernet symmetric encryption."""
+    if not data:
+        return ""
+    try:
+        f = Fernet(key)
+        encrypted_bytes = f.encrypt(data.encode("utf-8"))
+        return encrypted_bytes.decode("utf-8")
+    except (TypeError, ValueError) as e:
+        logger.error("Encryption failed: %s", e)
+        return data
+
+
+def decrypt_data(encrypted_data: str, key: bytes) -> str:
+    """Decrypt a Fernet-encrypted string back to plaintext."""
+    if not encrypted_data:
+        return ""
+    try:
+        f = Fernet(key)
+        decrypted_bytes = f.decrypt(encrypted_data.encode("utf-8"))
+        return decrypted_bytes.decode("utf-8")
+    except (InvalidToken, TypeError, ValueError):
+        return encrypted_data
+
+
+def hash_password(password: str) -> str:
+    """Hash a password with a random salt using PBKDF2-SHA256 and return a Base64 string."""
+    salt = os.urandom(16)
+    hashed_bytes = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 600000)
+    return base64.b64encode(salt + hashed_bytes).decode("utf-8")
+
+
+def verify_password(password: str, stored_hash: str) -> bool:
+    """Verify a password against a stored PBKDF2-SHA256 hash."""
+    try:
+        decoded_hash = base64.b64decode(stored_hash)
+        salt = decoded_hash[:16]
+        stored_hash_part = decoded_hash[16:]
+        new_hash_part = hashlib.pbkdf2_hmac(
+            "sha256", password.encode("utf-8"), salt, 600000
+        )
+        return new_hash_part == stored_hash_part
+    except (ValueError, TypeError):
+        return False
+
+
+def load_master_password(file_path: str) -> Optional[str]:
+    """Read the stored master password hash from disk, or return None."""
+    if os.path.exists(file_path):
+        try:
+            with open(file_path, "r") as f:
+                return f.read().strip()
+        except OSError:
+            return None
+    return None
+
+
+def store_master_password(password: str) -> bool:
+    """Hash and persist the master password to the master key file."""
+    hashed_pass = hash_password(password)
+    try:
+        with open(MASTER_KEY_FILE, "w") as f:
+            f.write(hashed_pass)
+        return True
+    except OSError:
+        return False
+
+
+def load_duress_password() -> Optional[str]:
+    """Read the stored duress password hash from disk, or return None."""
+    return load_master_password(DURESS_KEY_FILE)
+
+
+def store_duress_password(password: str) -> bool:
+    """Hash and persist the duress password to the duress key file."""
+    hashed_pass = hash_password(password)
+    try:
+        with open(DURESS_KEY_FILE, "w") as f:
+            f.write(hashed_pass)
+        return True
+    except OSError:
+        return False
+
+
+def clear_duress_password() -> bool:
+    """Delete the duress key file. Returns True if removed (or absent)."""
+    try:
+        if os.path.exists(DURESS_KEY_FILE):
+            os.remove(DURESS_KEY_FILE)
+        return True
+    except OSError:
+        return False
+
+
+def rotate_backups(max_files: int = BACKUP_MAX_FILES) -> int:
+    """Prune timestamped .bak files in DATA_DIR, keeping the max_files most recent.
+    Returns the number of files removed."""
+    if max_files <= 0:
+        return 0
+    backups = sorted(
+        f for f in os.listdir(DATA_DIR)
+        if f.startswith("aethervault_") and f.endswith(".db.bak")
+    )
+    stale = backups[:-max_files]
+    for f in stale:
+        try:
+            os.remove(os.path.join(DATA_DIR, f))
+        except OSError:
+            pass
+    return len(stale)
+
+
+def _overwrite_and_remove(path: str):
+    """Overwrite a file with random bytes then delete it (defense-in-depth wipe)."""
+    try:
+        size = os.path.getsize(path)
+        if size > 0:
+            with open(path, "r+b") as f:
+                remaining = size
+                chunk = 65536
+                while remaining > 0:
+                    n = min(chunk, remaining)
+                    f.write(os.urandom(n))
+                    remaining -= n
+                f.flush()
+                os.fsync(f.fileno())
+        os.remove(path)
+    except OSError:
+        pass
+
+
+def wipe_vault() -> bool:
+    """Destroy the vault and all backups, making the data unrecoverable.
+
+    Order matters: the master/duress key files are deleted FIRST so the AES
+    ciphertext becomes cryptographically unrecoverable even if a later step
+    is interrupted. Remaining files are then overwritten with random data
+    and removed as defense-in-depth."""
+    for key_file in (MASTER_KEY_FILE, DURESS_KEY_FILE):
+        _overwrite_and_remove(key_file)
+    for name in os.listdir(DATA_DIR):
+        path = os.path.join(DATA_DIR, name)
+        if not os.path.isfile(path):
+            continue
+        if name == ".portable":
+            continue
+        _overwrite_and_remove(path)
+    return True
+
+
+def load_settings() -> dict:
+    """Load application settings from the JSON settings file, falling back to defaults."""
+    try:
+        with open(APP_SETTINGS_FILE, "r") as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError):
+        return {"lockout_minutes": DEFAULT_LOCKOUT_MINUTES, "theme": "dark"}
+
+
+def save_settings(settings: dict):
+    """Persist application settings to the JSON settings file."""
+    try:
+        with open(APP_SETTINGS_FILE, "w") as f:
+            json.dump(settings, f, indent=4)
+    except IOError as e:
+        logger.error("Error saving settings: %s", e)

aethervault/core/password.py

@@ -0,0 +1,67 @@
+# Created: 2026-08-05
+# Last Edited: 2026-08-05 15:35 CT (America/Chicago)
+# Path: aethervault/core/password.py
+# Purpose: Password strength scoring and secure password generation.
+
+"""Password strength scoring and secure password generation."""
+
+import random
+import re
+import string
+
+
+def score_password(password: str) -> int:
+    """Score a password 0-100 based on length and character diversity."""
+    if not password:
+        return 0
+    score = 0
+    if len(password) >= 8:
+        score += 15
+    if len(password) >= 12:
+        score += 15
+    if len(password) >= 16:
+        score += 10
+    if re.search(r"[a-z]", password):
+        score += 10
+    if re.search(r"[A-Z]", password):
+        score += 15
+    if re.search(r"\d", password):
+        score += 15
+    if re.search(r"[^a-zA-Z0-9]", password):
+        score += 20
+    return min(score, 100)
+
+
+def generate_strong_password(
+    length: int = 18, use_lower=True, use_upper=True, use_digit=True, use_symbol=True
+) -> str:
+    """Generate a cryptographically random password with configurable character sets."""
+    if length < 1:
+        length = 1
+    char_sets = []
+    if use_lower:
+        char_sets.append(string.ascii_lowercase)
+    if use_upper:
+        char_sets.append(string.ascii_uppercase)
+    if use_digit:
+        char_sets.append(string.digits)
+    if use_symbol:
+        char_sets.append(string.punctuation)
+    if not char_sets:
+        char_sets.append(string.ascii_letters)
+    all_chars = "".join(char_sets)
+    if not all_chars:
+        return ""
+    password = []
+    if use_lower:
+        password.append(random.choice(string.ascii_lowercase))
+    if use_upper:
+        password.append(random.choice(string.ascii_uppercase))
+    if use_digit:
+        password.append(random.choice(string.digits))
+    if use_symbol:
+        password.append(random.choice(string.punctuation))
+    while len(password) < length:
+        password.append(random.choice(all_chars))
+    random.shuffle(password)
+    return "".join(password[:length])