bitwarden-wrapper 0.1.0__py3-none-any.whl

bitwarden_wrapper/__init__.py

@@ -0,0 +1,422 @@
+# extremely simple bitwarden cli wrapper
+# Author: @jessebot jessebot@linux.com
+"""
+Example:
+    bw = BwCLI(my_passsword, my_client_id, my_client_secret)
+    bw.unlock()
+    random_password = bw.generate()
+    bw.create_login(name="test mctest",
+                    item_url="coolhosting4dogs.tech",
+                    user="admin",
+                    password=random_password)
+    bw.lock()
+"""
+import base64
+import json
+import logging as log
+from rich.prompt import Prompt, Confirm
+from rich_subproc import subproc
+from shutil import which
+from sys import exit
+from os import environ as env
+
+# internal libraries
+from .tui.bitwarden_existing_item_app import AskUserForDuplicateStrategy
+
+
+class BwCLI():
+    """
+    Python Wrapper for the Bitwarden cli
+    """
+    def __init__(self,
+                 password: str,
+                 client_id: str,
+                 client_secret: str,
+                 duplicate_strategy: str = "ask",
+                 tui: bool = False):
+        """
+        for storing the session token, credentials, and duplicate_strategy
+
+        duplicate_strategy: str, must be one of: edit, ask, duplicate, no_action
+        """
+        self.bw_path = str(which("bw"))
+        log.debug(f"self.bw_path is {self.bw_path}")
+
+        if not self.bw_path:
+            log.error("whoops, looks like bw isn't installed. "
+                      "Try [green]brew install bw")
+            exit()
+
+        # if we clean up the session when we're done or not
+        self.delete_session = True
+
+        # this is used for bweso and logins
+        self.host = env.get("BW_HOST", "https://bitwarden.com")
+        log.debug(f"Using {self.host} as $BW_HOST")
+
+
+        # make sure there's not a session token in the env vars already
+        self.env = {"BW_SESSION": env.get("BW_SESSION", ""),
+                    "PATH": env.get("PATH"),
+                    "HOME": env.get("HOME"),
+                    "NODE_OPTIONS": "--no-deprecation"}
+
+        # credentials
+        self.password = password
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.duplicate_strategy = duplicate_strategy
+
+        self.tui = tui
+
+    def sync(self) -> None:
+        """
+        syncs your bitwaren vault on initialize of this class
+        """
+        res = subproc([f"{self.bw_path} sync"], env=self.env)
+        log.info(res)
+
+    def __get_credential__(self, credential: str) -> str:
+        """
+        prompts a user for a specific credential
+        """
+        cred_prompt = f"[cyan]🤫 Enter your Bitwarden vault {credential}"
+        return Prompt.ask(cred_prompt, password=True)
+
+    def status(self) -> str:
+        """
+        generate a new password. Takes special_characters bool.
+        """
+        log.info('Checking if you are logged in...')
+        return json.loads(subproc(["bw status"], env=self.env))['status']
+
+    def unlock(self) -> None:
+        """
+        unlocks the local bitwarden vault, and returns session token
+        """
+        if self.env['BW_SESSION']:
+            log.info('Using session token from $BW_SESSION env variable')
+            self.delete_session = False
+
+        status = self.status()
+        if status == "locked" or status == "unauthenticated":
+            env = {"BW_PASSWORD": self.password,
+                   "BW_CLIENTID": self.client_id,
+                   "BW_CLIENTSECRET": self.client_secret,
+                   "BW_HOST": self.host,
+                   "PATH": self.env['PATH'],
+                   "HOME": self.env['HOME'],
+                   "NODE_OPTIONS": "--no-deprecation"}
+
+        # login if we need to
+        if status == "unauthenticated":
+            log.info('Logging into the Bitwarden vault...')
+            # set command to login if we're unauthenticated
+            cmd = f"{self.bw_path} login --passwordenv BW_PASSWORD --apikey --raw"
+            subproc([cmd], quiet=True, env=env)
+
+        # we still need to unlock, even if we logged in already
+        if status == "locked" or status == "unauthenticated":
+            log.info('Unlocking the Bitwarden vault...')
+            # set command to unlock if status is locked
+            cmd = f"{self.bw_path} unlock --passwordenv BW_PASSWORD --raw"
+
+            # run either bw login or bw unlock depending on bw status
+            self.env['BW_SESSION'] = subproc([cmd], quiet=True, env=env)
+            log.debug(f"bw unlock session is {self.env['BW_SESSION']}")
+            log.info('Unlocked the Bitwarden vault.')
+        else:
+            log.info(f"[green]bw status[/] returned '{status}', so we won't "
+                     "unlock the Bitwarden vault before starting.")
+
+
+    def create_custom_field(custom_field_name: str, value: str) -> dict:
+       """
+       creates a custom field dict for a bitwarden login item
+       """
+       custom_field = {"name": custom_field_name,
+                       "value": value,
+                       "type": 1,
+                       "linkedId": None}
+
+       return custom_field
+
+    def lock(self) -> None:
+        """
+        lock bitwarden vault, only if the user didn't have a session env var,
+        so that we don't clean up a session the user didn't intend for
+        """
+        if self.delete_session:
+            log.info('Locking the Bitwarden vault...')
+            subproc([f"{self.bw_path} lock"], env=self.env)
+            log.info('Bitwarden vault locked.')
+        else:
+            log.debug("We didn't lock the Bitwarden vault when we were done, "
+                      "because we didn't set the BW_SESSION env var, so we"
+                      " don't want to be rude.")
+
+    def generate(self, special_characters: bool = False) -> str:
+        """
+        generate a new password. Takes special_characters bool.
+        """
+        log.debug('Generating a new password...')
+
+        command = "bw generate --length 32 --uppercase --lowercase --number"
+        if special_characters:
+            command += " --special"
+
+        password = subproc([command], quiet=True)
+        log.debug('New password generated.')
+        return password
+
+    def get_item(self, item_name: str, sync_first: bool = True) -> list:
+        """
+        Get Item and return False if it does not exist. If item exists:
+        return data, unless there's more than one, then return multiple IDs
+
+        Required Args:
+            - item_name: str of name of item
+        """
+        # always sync vault before checking anything, unless otherwise stated
+        if sync_first:
+            self.sync()
+
+        # go get the actual item
+        response = json.loads(
+                subproc([f'{self.bw_path} get item {item_name} --response'],
+                        error_ok=True,
+                        quiet=True,
+                        env=self.env)
+                )
+
+        message = response.get("message", "")
+
+        # if there is no item, just return False
+        if message == "Not found.":
+            log.debug(response)
+            return False, None
+
+        elif 'More than one result was found' in message:
+            item_list = response['data']
+            log.warn(f"found more than 1 entry for {item_name}: {item_list}")
+            # make a list of each full item
+            list_for_dialog = []
+
+            # ask the user what to do
+            if self.tui:
+                for id in item_list:
+                    list_for_dialog.append(self.get_item(id)[0])
+
+                user_response = AskUserForDuplicateStrategy(list_for_dialog,
+                                                            item_name).run()
+                action = user_response[0]
+                always_do_action = user_response[1]
+                item = user_response[2]
+
+            else:
+                action = Prompt.ask(
+                        f"Found more than 1 entry for {item_name}. "
+                        "What would you like to do?",
+                        choices=["duplicate", "edit", "no_action"])
+                if action == "edit":
+                    print("Here are the items:")
+                    for id in item_list:
+                        item_data = self.get_item(id)[0]
+                        print(f"ID: {item_data['id']}, Name: {item_data['name']}")
+                        list_for_dialog.append(item_data['id'])
+
+                    item = Prompt.ask("Which item ID would you like to edit?",
+                                      choices=(list_for_dialog))
+                elif action == "duplicate" or action == "no_action":
+                    always_do_action = Confirm.ask(
+                            f"Would you like to '{action}' every time?")
+
+            # if they always want to do this, then set self.duplicate_strategy
+            if always_do_action:
+                # NOTE: we still always ask if there's more than 1 entry returned
+                self.duplicate_strategy = action
+
+            return item, action
+        else:
+            data = response.get('data', "")
+            log.debug(data)
+            if not data:
+                log.debug(response)
+            return data, self.duplicate_strategy
+
+    def list_items(self, url: str = "", sync_first: bool = True) -> dict:
+        """
+        get multiplte times associated with a given url.
+
+        Optionally specify:
+            sync_first: bool - sync the vault before checking for items
+
+        Returns a dict of name: id
+        """
+        # always sync vault before checking anything, unless otherwise stated
+        if sync_first:
+            self.sync()
+
+        # go get the actual item
+        response = json.loads(
+                subproc([f'{self.bw_path} list items --search {url}'],
+                        error_ok=True,
+                        quiet=True,
+                        env=self.env
+                        )
+                )
+
+        # if there is no item, just return False
+        if not response:
+            log.debug("We didn't get anything back from bitwarden... 🤔")
+            return None
+        else:
+            # make a convenient dictionary to use downstream
+            item_dict = {}
+            for item in response:
+                name = item['name']
+                item_dict[name] = item['id']
+            return item_dict
+
+    def create_login(self,
+                     name: str = "",
+                     item_url: str = "",
+                     user: str = "",
+                     password: str = "",
+                     fields: list = [],
+                     org: str = None,
+                     collection: str = None,
+                     strategy: str = None,
+                     sync: bool = None) -> str:
+        """
+        Create login item to store a set of credentials for one site.
+        Required Args:
+            - name:        str of the name of the item to create in the vault
+        Optional Args:
+            - user:        str of username to use for login item
+            - password:    str of password you want to use for login item
+            - item_url:    str of URL you want to use the credentials for
+            - org:         str of organization to use for collection
+            - collection:  str collection inside organization to user
+            - fields:      list of {key: value} dicts for custom fields
+            - strategy:    str that defaults to self.duplicate_strategy
+
+        Returns string of the item id created or updated
+        """
+        # don't edit anything by default
+        edit = False
+
+        # fix naming for bitwarden items to inlude the url AND name
+        if name:
+            item_name = name
+            if item_url:
+                item_name += f"-{item_url}"
+        else:
+            item_name = item_url
+
+        # make sure sync is set to False by default
+        if not sync:
+            sync = False
+
+        # go check for existing items
+        item_res = self.get_item(item_name, sync)
+        item = item_res[0]
+
+        if not strategy:
+            strategy = item_res[1]
+
+        if item:
+            if strategy == "ask":
+                if self.tui:
+                    user_response = AskUserForDuplicateStrategy(item,
+                                                                item_name).run()
+                    strategy = user_response[0]
+                    always_do_action = user_response[1]
+                else:
+                    item_desc = f'"{item['name']}" (id: {item['id']})'
+                    strategy = Prompt.ask(
+                            f"A similar entry already exists for {item_name}. "
+                            f"It's called {item_desc}. What would you like to do?",
+                            choices=["duplicate", "edit", "no_action"])
+                    always_do_action = Confirm.ask(
+                            f"Would you like to '{strategy}' every time?")
+
+            # if they always want to do this, then set self.duplicate_strategy
+            if always_do_action:
+               # NOTE: we still always ask if there's more than 1 entry returned
+               self.duplicate_strategy = strategy
+
+            if strategy == 'edit':
+                log.info("duplicate_strategy set to edit, so we will edit the "
+                         f"existing item: {name}")
+                edit = True
+
+            elif strategy == 'duplicate':
+                msg = (f"😵 Item named {name} already exists in your Bitwarden"
+                       " vault and duplicate_strategy is set to 'duplicate'."
+                       " We will create the item anyway, but the Bitwarden ESO "
+                       "Provider may have trouble finding it :(")
+                log.warn(msg)
+
+            elif strategy == "no_action":
+                log.info(
+                    "We've encounted an existing entry for the item we were going "
+                    " to create. duplicate_strategy is set to 'no_action', so we "
+                    "will not replace or edit it nor will we create a new item."
+                    f"item: {item}"
+                    )
+                return
+
+        # create new item
+        if not edit:
+            if item:
+                log.info(f'Not editing Bitwarden item "{item_name}", because we '
+                         'were instructed to create a duplicate.')
+            else:
+                log.info(f'Creating Bitwarden login item "{item_name}"')
+
+            login_obj = json.dumps({
+                "organizationId": org,
+                "collectionIds": collection,
+                "folderId": None,
+                "type": 1,
+                "name": item_name,
+                "notes": None,
+                "favorite": False,
+                "fields": fields,
+                "login": {"uris": [{"match": 0,
+                                    "uri": item_url}],
+                          "username": user,
+                          "password": password,
+                          "totp": None},
+                "secureNote": None,
+                "card": None,
+                "identity": None,
+                "reprompt": 0})
+
+            encodedBytes = base64.b64encode(login_obj.encode("utf-8"))
+            encodedStr = str(encodedBytes, "utf-8")
+
+            cmd = f"{self.bw_path} create item {encodedStr}"
+
+        # edit existing item
+        else:
+            log.info(f'Updating existing Bitwarden login item "{item_name}"...')
+            item['login']['password'] = password
+            item['login']['username'] = user
+            item['fields'] = fields
+
+            encodedBytes = base64.b64encode(json.dumps(item).encode("utf-8"))
+            encodedStr = str(encodedBytes, "utf-8")
+
+            cmd = f"{self.bw_path} edit item {item['id']} {encodedStr}"
+
+
+        # edit OR create the item
+        bitwarden_return_item = subproc([cmd + " --response"], quiet=True, env=self.env)
+        log.debug(bitwarden_return_item)
+
+        if edit:
+            return item['id']
+        else:
+            return json.loads(bitwarden_return_item)['data']['id']

bitwarden_wrapper/tui/bitwarden.css

@@ -0,0 +1,81 @@
+$bluish_white: rgb(189,216,255);
+$lavender: rgb(174,168,248);
+$spacechalk_red: rgb(255,141,135);
+$neon_magenta: rgb(242,137,249);
+$light_pink: rgb(255,175,249);
+$orange: rgb(253,205,54);
+$soft_yellow: rgb(249,249,134);
+$soft_green: rgb(193,255,135);
+$spacechalk_lime: rgb(168,253,87);
+$sky_blue: rgb(92,201,253);
+$cornflower: rgb(95,135,255);
+$light_cornflower: rgb(122,162,247);
+$blue_gray: rgb(86,95,137);
+$dark_gray: rgb(58,58,58);
+$navy: rgb(35,35,54);
+
+/* base container for the whole screen */
+#bitwarden-modal-container {
+    width: 90%;
+    height: 60%;
+    align: center middle;
+    background: $navy 50%;
+}
+
+/* box with border and inputs and button */
+#credentials-box {
+    align: center middle;
+    content-align: center middle;
+    padding: 1;
+    border: round $cornflower;
+    border-title-color: $soft_green;
+    grid-gutter: 1;
+    grid-rows: 0.25fr 1fr 0.25fr;
+}
+
+/* help blurb */
+#bitwarden-help-text {
+    color: $blue_gray;
+    width: 100%;
+    margin-left: 1;
+}
+
+#all-bitwarden-inputs {
+    align: center middle;
+    content-align: center middle;
+    grid-gutter: 1;
+    padding-left: 1;
+}
+
+/* bitwarden label and input row */
+.bitwarden-input-row {
+    grid-size: 2;
+    grid-columns: 0.42fr 1fr;
+    height: auto;
+    align: center middle;
+    content-align: center middle;
+}
+
+/* bitwarden input label */
+.bitwarden-label {
+    content-align: left middle;
+    color: $light_cornflower 80%;
+    width: 100%;
+    height: 3;
+}
+
+/* bitwarden input */
+.bitwarden-inputs {
+    height: 100%;
+    content-align: left middle;
+}
+
+/* submit button */
+#bitwarden-button-box {
+    grid-size: 2;
+    align: center middle;
+    margin-bottom: 1;
+}
+
+#bitwarden-submit {
+}

bitwarden_wrapper/tui/bitwarden_app.py

@@ -0,0 +1,78 @@
+from smol_k8s_lab.tui.bitwarden.bitwarden_credentials_modal_screen import (
+        BitwardenCredentialsScreen)
+from textual.app import App, ComposeResult
+from textual.widgets import Label
+
+
+class BitwardenCredentialsApp(App[None]):
+    """ 
+    small app to launch a modal screen for a bitwarden credentials prompt
+    """
+    CSS = """
+        $bluish_white: rgb(189,216,255);
+        $lavender: rgb(174,168,248);
+        $neon_magenta: rgb(242,137,249);
+        $orange: rgb(253,205,54);
+        $spacechalk_lime: rgb(168,253,87);
+        $light_cornflower: rgb(122,162,247);
+        $blue_gray: rgb(86,95,137);
+        $dark_gray: rgb(58,58,58);
+        $navy: rgb(35,35,54);
+
+        Screen {
+           align: center middle;
+        }
+
+        Tooltip {
+          background: $navy 50%;
+          color: $bluish_white 75%;
+          border: dashed gray 80%;
+          padding-bottom: 0;
+          padding-left: 1;
+          padding-right: 1;
+        }
+
+        Button {
+          color: $light_cornflower;
+          background: $lavender 10%;
+          border-top: tall $blue_gray 60%;
+          border-bottom: tall $dark_gray 50%;
+        }
+
+        Input {
+          background: $bluish_white 8%;
+          color: white 75%;
+          border: tall black 18%;
+        }
+
+        Input.-invalid {
+           border: tall $neon_magenta 90%;
+        }
+
+        Input.-valid:focus {
+           border: tall $spacechalk_lime 70%;
+        }
+        """
+
+    def compose(self) -> ComposeResult:
+        """
+        check if we need to grab the password or not
+        """
+        yield Label("")
+        self.get_credentials()
+
+    def get_credentials(self) -> None:
+        """
+        launch a modal screen wtih inputs for bitwarden credentials
+        """
+        def check_modal_output(credentials: dict):
+            if credentials:
+                self.app.exit(credentials)
+            else:
+                self.app.exit(None)
+
+        self.app.push_screen(BitwardenCredentialsScreen(), check_modal_output)
+
+if __name__ == "__main__":
+    app = BitwardenCredentialsApp()
+    app.run()

bitwarden_wrapper/tui/bitwarden_credentials_modal_screen.py

@@ -0,0 +1,119 @@
+from rich.text import Text
+from textual import on
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Grid
+from textual.screen import ModalScreen
+from textual.validation import Length
+from textual.widgets import Label, Input, Button
+
+
+HELP_TXT = ("Requires [u][link=https://bitwarden.com/help/personal-api-key/]"
+            "personal API credentials[/][/]. To avoid this prompt, export the "
+            "following env vars before running smol-k8s-lab: "
+            "BW_PASSWORD, BW_CLIENTID, BW_CLIENTSECRET")
+
+
+class BitwardenCredentialsScreen(ModalScreen):
+    """
+    modal screen to ask for bitwarden credentials
+    """
+    CSS_PATH = "./bitwarden.css"
+    BINDINGS = [Binding(key="b,escape,q",
+                        key_display="b",
+                        action="press_cancel",
+                        description=" Back")]
+
+    def compose(self) -> ComposeResult:
+
+        # base container for the whole screen
+        with Grid(id="bitwarden-modal-container"):
+
+            # container for the actual help, inputs, and confirm button
+            with Grid(id="credentials-box"):
+
+                # base help text to start us off
+                yield Label(Text.from_markup(HELP_TXT), id="bitwarden-help-text")
+
+                with Grid(id="all-bitwarden-inputs"):
+                    for variable in ['password', 'client_id', 'client_secret']:
+                        yield self.generate_credential_row(variable)
+
+                with Grid(id="bitwarden-button-box"):
+                    # submit button, to trigger returning the credentials/exiting
+                    confirm_button = Button("submit", id="bitwarden-submit")
+                    confirm_button.disabled = True
+                    confirm_button.tooltip = ("submit your credentials, disabled"
+                                              " until all fields are filled out.")
+                    yield confirm_button
+
+                    # cancel button, to go back to the script or previous tui screen
+                    back_button = Button("cancel", id="bitwarden-cancel")
+                    back_button.tooltip = ("Exit Bitwarden credentials input screen "
+                                           "without saving")
+                    yield back_button
+
+    def on_mount(self,) -> None:
+        credentials_box = self.get_widget_by_id("credentials-box")
+        credentials_box.border_title = "🛡️ Enter Bitwarden Vault Credentials"
+
+        # we set this at the beginning, so we can still return empty if they cancel
+        self.credentials = {}
+
+    def action_press_cancel(self) -> None:
+        """
+        presses the cancel button
+        """
+        self.get_widget_by_id("bitwarden-cancel").action_press()
+
+    def on_button_pressed(self, event: Button.Pressed) -> None:
+        """
+        return bitwarden password, client id, and client secret as a dict
+        """
+        if event.button.id == "bitwarden-cancel":
+            self.dismiss(None)
+        else:
+            self.dismiss(self.credentials)
+
+    @on(Input.Changed)
+    def on_input_changed(self, event: Input.Changed) -> None:
+        """
+        on any input field change, check all input fields and enable or disable
+        the confirm button
+        """
+        all_valid = True
+
+        all_inputs = self.query(".bitwarden-inputs")
+
+        # check all the input validations
+        for input in all_inputs:
+            is_not_valid = input.validate(input.value).failures
+            # returns None if input is valid
+            if is_not_valid:
+                all_valid = False
+            # if valid, make sure it's in our final return dict
+            else:
+                self.credentials[input.name] = input.value
+
+        confirm_button = self.get_widget_by_id("bitwarden-submit")
+
+        # disable button if any inputs are invalid
+        if all_valid:
+            confirm_button.disabled = False
+        else:
+            confirm_button.disabled = True
+
+    def generate_credential_row(self, label: str) -> None:
+        """
+        return a row of a Label and Input in a Grid container
+        """
+        pretty_label = label.replace("_", " ").replace("id", "ID") + ":"
+        input_label = Label(pretty_label, classes="bitwarden-label")
+
+        input = Input(placeholder=label,
+                      password=True,
+                      validators=Length(minimum=2),
+                      classes="bitwarden-inputs",
+                      name=label)
+
+        return Grid(input_label, input, classes="bitwarden-input-row")