souleyez 2.43.29__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/storage/credentials.py

@@ -23,7 +23,7 @@ class CredentialsManager:
     def validate_master_password(self, password: str):
         """
         Validate master password meets security requirements.
-        
+
         Requirements:
         - At least 12 characters
         - Contains uppercase letter
@@ -33,11 +33,11 @@ class CredentialsManager:
         """
         if len(password) < 12:
             raise ValueError("Password must be at least 12 characters")
-        if not re.search(r'[A-Z]', password):
+        if not re.search(r"[A-Z]", password):
             raise ValueError("Password must contain uppercase letter")
-        if not re.search(r'[a-z]', password):
+        if not re.search(r"[a-z]", password):
             raise ValueError("Password must contain lowercase letter")
-        if not re.search(r'[0-9]', password):
+        if not re.search(r"[0-9]", password):
             raise ValueError("Password must contain number")
         if not re.search(r'[!@#$%^&*(),.?":{}|<>]', password):
             raise ValueError("Password must contain special character")
@@ -51,7 +51,9 @@ class CredentialsManager:
                 # Store with a marker prefix to indicate it needs encryption
                 # This allows background workers to store discovered credentials
                 # They will be encrypted when the user next unlocks the database
-                logger.warning(f"Storing credential field with UNENCRYPTED: marker - crypto locked")
+                logger.warning(
+                    f"Storing credential field with UNENCRYPTED: marker - crypto locked"
+                )
                 return f"UNENCRYPTED:{value}"
             return self.crypto.encrypt(value)
         return value
@@ -66,14 +68,17 @@ class CredentialsManager:
                 # Strip marker and return plaintext
                 return value[12:]  # len("UNENCRYPTED:") = 12
             if not self.crypto.is_unlocked():
-                raise RuntimeError("Credentials are encrypted but crypto manager is locked. Call unlock() first.")
+                raise RuntimeError(
+                    "Credentials are encrypted but crypto manager is locked. Call unlock() first."
+                )
             return self.crypto.decrypt(value)
         return value
 
     def _ensure_table(self):
         """Ensure credentials table exists."""
         conn = self.db.get_connection()
-        conn.execute("""
+        conn.execute(
+            """
             CREATE TABLE IF NOT EXISTS credentials (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 engagement_id INTEGER NOT NULL,
@@ -90,21 +95,28 @@ class CredentialsManager:
                 FOREIGN KEY (engagement_id) REFERENCES engagements(id),
                 FOREIGN KEY (host_id) REFERENCES hosts(id)
             )
-        """)
+        """
+        )
 
         # Create index for faster lookups
-        conn.execute("""
+        conn.execute(
+            """
             CREATE INDEX IF NOT EXISTS idx_credentials_engagement
             ON credentials(engagement_id)
-        """)
-        conn.execute("""
+        """
+        )
+        conn.execute(
+            """
             CREATE INDEX IF NOT EXISTS idx_credentials_host
             ON credentials(host_id)
-        """)
-        conn.execute("""
+        """
+        )
+        conn.execute(
+            """
             CREATE INDEX IF NOT EXISTS idx_credentials_status
             ON credentials(status)
-        """)
+        """
+        )
 
         conn.commit()
         conn.close()
@@ -117,10 +129,12 @@ class CredentialsManager:
         password: str = None,
         service: str = None,
         port: int = None,
-        protocol: str = 'tcp',
-        credential_type: str = 'user',
-        status: str = 'untested',
-        tool: str = None
+        protocol: str = "tcp",
+        credential_type: str = "user",
+        status: str = "untested",
+        tool: str = None,
+        notes: str = None,
+        source: str = None,  # Legacy alias for tool
     ) -> int:
         """
         Add a credential to the database.
@@ -136,60 +150,79 @@ class CredentialsManager:
             credential_type: Type of credential (user, password, hash, key)
             status: Status (untested, valid, invalid)
             tool: Tool that discovered this credential
+            notes: Additional notes about the credential
+            source: Legacy alias for tool parameter
 
         Returns:
             Credential ID
         """
+        # Handle legacy 'source' parameter
+        if source and not tool:
+            tool = source
         # Check for duplicates (must encrypt before comparing)
         encrypted_username = self._encrypt_field(username) if username else None
         encrypted_password = self._encrypt_field(password) if password else None
-        
+
         existing = self.get_credential(
-            engagement_id, host_id, encrypted_username, encrypted_password, service, port
+            engagement_id,
+            host_id,
+            encrypted_username,
+            encrypted_password,
+            service,
+            port,
         )
         if existing:
             # Update status if this one is more definitive
-            if status == 'valid' and existing['status'] != 'valid':
-                self._update_status(existing['id'], status, tool)
-            return existing['id']
+            if status == "valid" and existing["status"] != "valid":
+                self._update_status(existing["id"], status, tool)
+            return existing["id"]
 
         # Special case: If adding a valid username:password pair, check if we have
         # a username-only entry that should be upgraded instead of creating duplicate
-        if username and password and status == 'valid':
+        if username and password and status == "valid":
             username_only = self.get_credential(
                 engagement_id, host_id, encrypted_username, None, service, port
             )
             if username_only:
                 # Upgrade the existing entry with the password
-                self._update_credential(username_only['id'], password=encrypted_password, status=status, tool=tool)
-                return username_only['id']
+                self._update_credential(
+                    username_only["id"],
+                    password=encrypted_password,
+                    status=status,
+                    tool=tool,
+                )
+                return username_only["id"]
 
         data = {
-            'engagement_id': engagement_id,
-            'host_id': host_id,
-            'service': service,
-            'port': port,
-            'protocol': protocol,
-            'username': encrypted_username,
-            'password': encrypted_password,
-            'credential_type': credential_type,
-            'status': status,
-            'tool': tool
-        }
-
-        cred_id = self.db.insert('credentials', data)
-        
-        # Audit log (never log actual password)
-        logger.info("Credential added", extra={
-            "engagement": self.engagement or engagement_id,
-            "cred_id": cred_id,
-            "username": username if username else "<none>",
+            "engagement_id": engagement_id,
             "host_id": host_id,
             "service": service,
             "port": port,
-            "tool": tool
-        })
-        
+            "protocol": protocol,
+            "username": encrypted_username,
+            "password": encrypted_password,
+            "credential_type": credential_type,
+            "status": status,
+            "tool": tool,
+            "notes": notes,
+        }
+
+        cred_id = self.db.insert("credentials", data)
+
+        # Audit log (never log actual password)
+        logger.info(
+            "Credential added",
+            extra={
+                "engagement": self.engagement or engagement_id,
+                "cred_id": cred_id,
+                "username": username if username else "<none>",
+                "host_id": host_id,
+                "service": service,
+                "port": port,
+                "tool": tool,
+            },
+        )
+
         return cred_id
 
     def get_credential(
@@ -199,7 +232,7 @@ class CredentialsManager:
         username: str = None,
         password: str = None,
         service: str = None,
-        port: int = None
+        port: int = None,
     ) -> Optional[Dict[str, Any]]:
         """Check if credential already exists."""
         query = """
@@ -231,16 +264,19 @@ class CredentialsManager:
         query += " LIMIT 1"
 
         result = self.db.execute_one(query, tuple(params))
-        
+
         # Audit log credential access (never log password)
         if result:
-            logger.info("Credential accessed", extra={
-                "engagement": self.engagement or engagement_id,
-                "cred_id": result.get('id'),
-                "username": username if username else "<none>",
-                "host_id": host_id
-            })
-        
+            logger.info(
+                "Credential accessed",
+                extra={
+                    "engagement": self.engagement or engagement_id,
+                    "cred_id": result.get("id"),
+                    "username": username if username else "<none>",
+                    "host_id": host_id,
+                },
+            )
+
         return result
 
     def _update_status(self, credential_id: int, status: str, tool: str = None):
@@ -249,24 +285,35 @@ class CredentialsManager:
         if tool:
             conn.execute(
                 "UPDATE credentials SET status = ?, tool = ? WHERE id = ?",
-                (status, tool, credential_id)
+                (status, tool, credential_id),
             )
         else:
             conn.execute(
                 "UPDATE credentials SET status = ? WHERE id = ?",
-                (status, credential_id)
+                (status, credential_id),
             )
         conn.commit()
         conn.close()
-        
-        logger.info("Credential status updated", extra={
-            "engagement": self.engagement,
-            "cred_id": credential_id,
-            "new_status": status,
-            "tool": tool
-        })
-
-    def _update_credential(self, credential_id: int, password: str = None, status: str = None, tool: str = None, notes: str = None, last_tested: str = None):
+
+        logger.info(
+            "Credential status updated",
+            extra={
+                "engagement": self.engagement,
+                "cred_id": credential_id,
+                "new_status": status,
+                "tool": tool,
+            },
+        )
+
+    def _update_credential(
+        self,
+        credential_id: int,
+        password: str = None,
+        status: str = None,
+        tool: str = None,
+        notes: str = None,
+        last_tested: str = None,
+    ):
         """Update credential with password and/or status."""
         conn = self.db.get_connection()
 
@@ -301,7 +348,9 @@ class CredentialsManager:
         conn.commit()
         conn.close()
 
-    def update_credential_status(self, credential_id: int, status: str = None, notes: str = None):
+    def update_credential_status(
+        self, credential_id: int, status: str = None, notes: str = None
+    ):
         """
         Update the status and/or notes of a credential.
 
@@ -309,25 +358,30 @@ class CredentialsManager:
             credential_id: Credential ID
             status: New status (valid, invalid, untested, discovered, etc.)
             notes: Optional notes about the credential
-            
+
         Returns:
             bool: True if successful
         """
         from datetime import datetime
-        
+
         # Update last_tested if status is changing
         last_tested = datetime.now().isoformat() if status else None
-        
-        self._update_credential(credential_id, status=status, notes=notes, last_tested=last_tested)
-        
-        logger.info("Credential status updated", extra={
-            "engagement": self.engagement,
-            "cred_id": credential_id,
-            "new_status": status
-        })
-        
+
+        self._update_credential(
+            credential_id, status=status, notes=notes, last_tested=last_tested
+        )
+
+        logger.info(
+            "Credential status updated",
+            extra={
+                "engagement": self.engagement,
+                "cred_id": credential_id,
+                "new_status": status,
+            },
+        )
+
         return True
-    
+
     def delete_credential(self, credential_id: int):
         """
         Delete a credential.
@@ -341,6 +395,7 @@ class CredentialsManager:
         # Check permission
         from souleyez.auth import get_current_user
         from souleyez.auth.permissions import Permission, PermissionChecker
+
         user = get_current_user()
         if user:
             checker = PermissionChecker(user.role, user.tier)
@@ -348,69 +403,72 @@ class CredentialsManager:
                 raise PermissionError("Permission denied: CREDENTIAL_DELETE required")
 
         # Get username for audit log before deleting
-        cred = self.db.execute_one("SELECT username FROM credentials WHERE id = ?", (credential_id,))
-        username = cred.get('username') if cred else "<unknown>"
-        
+        cred = self.db.execute_one(
+            "SELECT username FROM credentials WHERE id = ?", (credential_id,)
+        )
+        username = cred.get("username") if cred else "<unknown>"
+
         conn = self.db.get_connection()
         conn.execute("DELETE FROM credentials WHERE id = ?", (credential_id,))
         conn.commit()
         conn.close()
-        
-        logger.info("Credential deleted", extra={
-            "engagement": self.engagement,
-            "cred_id": credential_id,
-            "username": username
-        })
-    
+
+        logger.info(
+            "Credential deleted",
+            extra={
+                "engagement": self.engagement,
+                "cred_id": credential_id,
+                "username": username,
+            },
+        )
+
     def enable_encryption(self, password: str) -> bool:
         """
         Enable encryption for credentials.
-        
+
         Args:
             password: Master password
-            
+
         Returns:
             True if encryption enabled successfully
         """
         # Validate password complexity
         self.validate_master_password(password)
-        
+
         result = self.crypto.enable_encryption(password)
-        
+
         if result:
-            logger.info("Encryption enabled", extra={
-                "engagement": self.engagement
-            })
+            logger.info("Encryption enabled", extra={"engagement": self.engagement})
         else:
-            logger.warning("Encryption enable failed", extra={
-                "engagement": self.engagement
-            })
-        
+            logger.warning(
+                "Encryption enable failed", extra={"engagement": self.engagement}
+            )
+
         return result
-    
+
     def unlock(self, password: str) -> bool:
         """
         Unlock encrypted credentials.
-        
+
         Args:
             password: Master password
-            
+
         Returns:
             True if unlock successful
         """
         result = self.crypto.unlock(password)
-        
+
         if result:
-            logger.info("Credentials unlocked", extra={
-                "engagement": self.engagement,
-                "success": True
-            })
+            logger.info(
+                "Credentials unlocked",
+                extra={"engagement": self.engagement, "success": True},
+            )
         else:
-            logger.warning("Credentials unlock failed", extra={
-                "engagement": self.engagement,
-                "success": False
-            })
-        
+            logger.warning(
+                "Credentials unlock failed",
+                extra={"engagement": self.engagement, "success": False},
+            )
+
         return result
 
     def list_credentials(
@@ -419,7 +477,7 @@ class CredentialsManager:
         host_id: int = None,
         service: str = None,
         status: str = None,
-        decrypt: bool = True
+        decrypt: bool = True,
     ) -> List[Dict[str, Any]]:
         """
         List credentials for an engagement.
@@ -464,21 +522,23 @@ class CredentialsManager:
         # Decrypt username and password fields if requested
         if decrypt:
             for row in results:
-                if row.get('username'):
-                    row['username'] = self._decrypt_field(row['username'])
-                if row.get('password'):
-                    row['password'] = self._decrypt_field(row['password'])
+                if row.get("username"):
+                    row["username"] = self._decrypt_field(row["username"])
+                if row.get("password"):
+                    row["password"] = self._decrypt_field(row["password"])
         else:
             # Mask credentials when not decrypting (for display purposes)
             for row in results:
-                if row.get('username'):
-                    row['username'] = '••••••••'
-                if row.get('password'):
-                    row['password'] = '••••••••'
+                if row.get("username"):
+                    row["username"] = "••••••••"
+                if row.get("password"):
+                    row["password"] = "••••••••"
 
         return results
 
-    def list_credentials_for_engagement(self, engagement_id: int, decrypt: bool = True) -> List[Dict[str, Any]]:
+    def list_credentials_for_engagement(
+        self, engagement_id: int, decrypt: bool = True
+    ) -> List[Dict[str, Any]]:
         """
         List all credentials for an engagement (alias method for compatibility).
 
@@ -498,76 +558,76 @@ class CredentialsManager:
         # Total credentials
         total = conn.execute(
             "SELECT COUNT(*) as count FROM credentials WHERE engagement_id = ?",
-            (engagement_id,)
-        ).fetchone()['count']
+            (engagement_id,),
+        ).fetchone()["count"]
 
         # Valid credentials (confirmed working)
         valid = conn.execute(
             "SELECT COUNT(*) as count FROM credentials WHERE engagement_id = ? AND status = 'valid'",
-            (engagement_id,)
-        ).fetchone()['count']
+            (engagement_id,),
+        ).fetchone()["count"]
 
         # Username-only (enumerated users)
         users_only = conn.execute(
             "SELECT COUNT(*) as count FROM credentials WHERE engagement_id = ? AND username IS NOT NULL AND password IS NULL",
-            (engagement_id,)
-        ).fetchone()['count']
+            (engagement_id,),
+        ).fetchone()["count"]
 
         # Password-only
         passwords_only = conn.execute(
             "SELECT COUNT(*) as count FROM credentials WHERE engagement_id = ? AND username IS NULL AND password IS NOT NULL",
-            (engagement_id,)
-        ).fetchone()['count']
+            (engagement_id,),
+        ).fetchone()["count"]
 
         # Username:password pairs
         pairs = conn.execute(
             "SELECT COUNT(*) as count FROM credentials WHERE engagement_id = ? AND username IS NOT NULL AND password IS NOT NULL",
-            (engagement_id,)
-        ).fetchone()['count']
+            (engagement_id,),
+        ).fetchone()["count"]
 
         conn.close()
 
         return {
-            'total': total,
-            'valid': valid,
-            'users_only': users_only,
-            'passwords_only': passwords_only,
-            'pairs': pairs
+            "total": total,
+            "valid": valid,
+            "users_only": users_only,
+            "passwords_only": passwords_only,
+            "pairs": pairs,
         }
 
     def encrypt_all_unencrypted(self) -> Dict[str, int]:
         """
         Encrypt all plaintext credentials in the database.
-        
+
         This should be called after unlocking crypto to encrypt credentials
         that were stored while the worker was running without the master password.
-        
+
         Returns:
             Dict with counts of encrypted credentials
         """
         if not self.crypto.is_encryption_enabled():
-            return {'error': 'Encryption not enabled'}
-        
+            return {"error": "Encryption not enabled"}
+
         if not self.crypto.is_unlocked():
-            return {'error': 'Crypto manager is locked - cannot encrypt'}
-        
+            return {"error": "Crypto manager is locked - cannot encrypt"}
+
         conn = self.db.get_connection()
-        
+
         # Get all credentials
         rows = conn.execute("SELECT id, username, password FROM credentials").fetchall()
-        
+
         encrypted_count = 0
         skipped_count = 0
-        
+
         for row in rows:
-            cred_id = row['id']
-            username = row['username']
-            password = row['password']
-            
+            cred_id = row["id"]
+            username = row["username"]
+            password = row["password"]
+
             needs_update = False
             new_username = username
             new_password = password
-            
+
             # Check if username needs encryption
             if username and isinstance(username, str):
                 if username.startswith("UNENCRYPTED:"):
@@ -584,7 +644,7 @@ class CredentialsManager:
                         # Not encrypted and no marker - encrypt as-is (legacy data)
                         new_username = self.crypto.encrypt(username)
                         needs_update = True
-            
+
             # Check if password needs encryption
             if password and isinstance(password, str):
                 if password.startswith("UNENCRYPTED:"):
@@ -601,32 +661,34 @@ class CredentialsManager:
                         # Not encrypted and no marker - encrypt as-is (legacy data)
                         new_password = self.crypto.encrypt(password)
                         needs_update = True
-            
+
             if needs_update:
                 conn.execute(
                     "UPDATE credentials SET username = ?, password = ? WHERE id = ?",
-                    (new_username, new_password, cred_id)
+                    (new_username, new_password, cred_id),
                 )
                 encrypted_count += 1
             else:
                 skipped_count += 1
-        
+
         conn.commit()
         conn.close()
-        
-        logger.info(f"Encrypted {encrypted_count} credentials, skipped {skipped_count} already encrypted")
-        
+
+        logger.info(
+            f"Encrypted {encrypted_count} credentials, skipped {skipped_count} already encrypted"
+        )
+
         return {
-            'encrypted': encrypted_count,
-            'skipped': skipped_count,
-            'total': encrypted_count + skipped_count
+            "encrypted": encrypted_count,
+            "skipped": skipped_count,
+            "total": encrypted_count + skipped_count,
         }
-    
+
     def remove_duplicates(self, engagement_id: int) -> Dict[str, int]:
         """
         Remove duplicate credentials from the database.
         Keeps the one with the most definitive status (valid > untested).
-        
+
         Returns:
             dict: {'removed': count, 'kept': count}
         """
@@ -643,42 +705,41 @@ class CredentialsManager:
                 END,
                 created_at DESC
         """
-        
+
         all_creds = self.db.execute(query, (engagement_id,))
-        
+
         seen = set()
         to_remove = []
         kept_count = 0
-        
+
         for cred in all_creds:
             # Create a unique key for this credential
             key = (
-                cred['host_id'],
-                cred['username'],
-                cred['password'],
-                cred['service'],
-                cred['port']
+                cred["host_id"],
+                cred["username"],
+                cred["password"],
+                cred["service"],
+                cred["port"],
             )
-            
+
             if key in seen:
                 # Duplicate found
-                to_remove.append(cred['id'])
+                to_remove.append(cred["id"])
             else:
                 # First occurrence, keep it
                 seen.add(key)
                 kept_count += 1
-        
+
         # Remove duplicates
         if to_remove:
-            placeholders = ','.join(['?'] * len(to_remove))
+            placeholders = ",".join(["?"] * len(to_remove))
             self.db.execute(
                 f"DELETE FROM credentials WHERE id IN ({placeholders})",
-                tuple(to_remove)
+                tuple(to_remove),
             )
-        
-        logger.info(f"Removed {len(to_remove)} duplicate credentials, kept {kept_count}")
-        
-        return {
-            'removed': len(to_remove),
-            'kept': kept_count
-        }
+
+        logger.info(
+            f"Removed {len(to_remove)} duplicate credentials, kept {kept_count}"
+        )
+
+        return {"removed": len(to_remove), "kept": kept_count}