waidrop-cli 1.0.0__py3-none-any.whl

waidrop_cli/crypto.py

@@ -0,0 +1,126 @@
+"""Client-side archive crypto (must match the extension's background/crypto.js).
+
+Contract:
+  K       = 32-byte master key (base64)
+  hashKey = HKDF-SHA256(ikm=K, salt=b"waidrop-v1", info=b"chat-hash", 32)
+  encKey  = HKDF-SHA256(ikm=K, salt=b"waidrop-v1", info=b"object-encryption", 32)
+  mediaKey = HKDF-SHA256(ikm=K, salt=b"waidrop-v1", info=b"media-encryption", 32)
+  chatHash = lowerhex(HMAC-SHA256(hashKey, chatId))[:16]
+  mediaHash = lowerhex(HMAC-SHA256(hashKey, b"media:" + msgId))[:32]
+  object   = b"WAAR" | 0x01 | nonce(12) | AES-256-GCM ciphertext+tag (AAD = first 5 bytes)
+  media    = b"WAMR" | 0x01 | nonce(12) | AES-256-GCM ciphertext+tag (AAD = header + path)
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import os
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+MAGIC = b"WAAR"
+VERSION = 1
+MEDIA_MAGIC = b"WAMR"
+MEDIA_VERSION = 1
+SALT = b"waidrop-v1"
+
+
+def decode_key(key_base64: str) -> bytes:
+    try:
+        raw = base64.b64decode(str(key_base64 or ""), validate=True)
+    except Exception as exc:
+        raise ValueError("encryption key is not valid base64") from exc
+    if len(raw) != 32:
+        raise ValueError("encryption key must be 32 bytes (base64)")
+    return raw
+
+
+def is_valid_key(key_base64: str) -> bool:
+    try:
+        decode_key(key_base64)
+        return True
+    except ValueError:
+        return False
+
+
+def derive_keys(key_base64: str) -> tuple[bytes, bytes]:
+    master = decode_key(key_base64)
+    hash_key = HKDF(algorithm=hashes.SHA256(), length=32, salt=SALT, info=b"chat-hash").derive(
+        master
+    )
+    enc_key = HKDF(
+        algorithm=hashes.SHA256(), length=32, salt=SALT, info=b"object-encryption"
+    ).derive(master)
+    return hash_key, enc_key
+
+
+def derive_media_key(key_base64: str) -> bytes:
+    master = decode_key(key_base64)
+    return HKDF(algorithm=hashes.SHA256(), length=32, salt=SALT, info=b"media-encryption").derive(
+        master
+    )
+
+
+def chat_hash(hash_key: bytes, chat_id: str) -> str:
+    return hmac.new(hash_key, str(chat_id).encode("utf-8"), hashlib.sha256).hexdigest()[:16]
+
+
+def media_hash(hash_key: bytes, msg_id: str) -> str:
+    return hmac.new(hash_key, f"media:{msg_id}".encode(), hashlib.sha256).hexdigest()[:32]
+
+
+def decrypt_text(enc_key: bytes, envelope: bytes) -> str:
+    data = bytes(envelope)
+    header = len(MAGIC) + 1
+    if len(data) <= header + 12 + 16:
+        raise ValueError("encrypted object is too short")
+    if data[: len(MAGIC)] != MAGIC:
+        raise ValueError("bad envelope magic")
+    if data[len(MAGIC)] != VERSION:
+        raise ValueError("unsupported envelope version")
+    nonce = data[header : header + 12]
+    ciphertext = data[header + 12 :]
+    plaintext = AESGCM(enc_key).decrypt(nonce, ciphertext, data[:header])
+    return plaintext.decode("utf-8")
+
+
+def encrypt_text(enc_key: bytes, text: str) -> bytes:
+    """Encrypt helper (tests/backup tooling); production only decrypts."""
+    nonce = os.urandom(12)
+    header = MAGIC + bytes([VERSION])
+    ciphertext = AESGCM(enc_key).encrypt(nonce, text.encode("utf-8"), header)
+    return header + nonce + ciphertext
+
+
+def _media_aad(relative_path: str) -> bytes:
+    return MEDIA_MAGIC + bytes([MEDIA_VERSION]) + str(relative_path).encode("utf-8")
+
+
+def decrypt_media(media_key: bytes, relative_path: str, envelope: bytes) -> bytes:
+    data = bytes(envelope)
+    header = len(MEDIA_MAGIC) + 1
+    if len(data) <= header + 12 + 16:
+        raise ValueError("media envelope is too short")
+    if data[: len(MEDIA_MAGIC)] != MEDIA_MAGIC:
+        raise ValueError("bad media envelope magic")
+    if data[len(MEDIA_MAGIC)] != MEDIA_VERSION:
+        raise ValueError("unsupported media envelope version")
+    nonce = data[header : header + 12]
+    ciphertext = data[header + 12 :]
+    return AESGCM(media_key).decrypt(nonce, ciphertext, _media_aad(relative_path))
+
+
+def encrypt_media(
+    media_key: bytes, relative_path: str, payload: bytes, nonce: bytes | None = None
+) -> bytes:
+    """Encrypt helper (tests/backup tooling); production only decrypts."""
+    nonce = nonce or os.urandom(12)
+    if len(nonce) != 12:
+        raise ValueError("nonce must be 12 bytes")
+    header = MEDIA_MAGIC + bytes([MEDIA_VERSION])
+    ciphertext = AESGCM(media_key).encrypt(nonce, bytes(payload), _media_aad(relative_path))
+    return header + nonce + ciphertext

waidrop_cli/dropbox.py

@@ -0,0 +1,217 @@
+"""Minimal Dropbox API client (stdlib urllib)."""
+
+from __future__ import annotations
+
+import json
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from .auth import (
+    EXPIRY_SKEW_SECONDS,
+    load_credentials,
+    parse_token_document,
+    refresh_access_token,
+    save_credentials,
+)
+from .config import DropboxConfig
+from .errors import RemoteError
+
+
+class DropboxClient:
+    def __init__(self, config: DropboxConfig):
+        self.config = config
+        self._access_token = config.token
+        self._expires_at: float | None = config.token_expires_at
+
+    # --- auth ---------------------------------------------------------------
+    def _refresh(self) -> None:
+        if not (self.config.refresh_token and self.config.app_key):
+            raise RemoteError(
+                "Dropbox access token expired and no refresh credentials are configured; "
+                "run `waidrop auth` to connect"
+            )
+        document = refresh_access_token(
+            app_key=self.config.app_key,
+            refresh_token=self.config.refresh_token,
+            token_url=self.config.token_url,
+            client_secret=self.config.app_secret or None,
+            timeout=self.config.timeout,
+        )
+        parsed = parse_token_document(document)
+        self._access_token = parsed["access_token"]
+        self._expires_at = parsed["expires_at"]
+        self._persist(parsed)
+
+    def _persist(self, parsed: dict) -> None:
+        """Write a refreshed access token back to the credentials file (if any)."""
+        if not (self.config.from_file and self.config.credentials_path):
+            return
+        creds = load_credentials(self.config.credentials_path)
+        if creds is None:
+            return
+        creds.access_token = parsed["access_token"]
+        creds.expires_at = parsed["expires_at"]
+        if parsed.get("refresh_token"):
+            creds.refresh_token = parsed["refresh_token"]
+        save_credentials(self.config.credentials_path, creds)
+
+    def _token(self) -> str:
+        expired = (
+            self._expires_at is not None and time.time() >= self._expires_at - EXPIRY_SKEW_SECONDS
+        )
+        if self._access_token and not expired:
+            return self._access_token
+        if self.config.refresh_token and self.config.app_key:
+            self._refresh()
+            return self._access_token or ""
+        if self._access_token:
+            return self._access_token
+        raise RemoteError("no Dropbox access token available")
+
+    # --- transport ----------------------------------------------------------
+    def _send(self, url: str, data: bytes, extra_headers: dict, retry: bool = True):
+        request = urllib.request.Request(
+            url,
+            data=data,
+            method="POST",
+            headers={"authorization": f"Bearer {self._token()}", **extra_headers},
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=self.config.timeout) as response:
+                return response.read(), None
+        except urllib.error.HTTPError as exc:
+            if exc.code == 401 and retry and self.config.refresh_token and self.config.app_key:
+                detail = _body(exc)
+                if "missing_scope" not in detail:
+                    self._refresh()
+                    return self._send(url, data, extra_headers, retry=False)
+            return None, exc
+        except urllib.error.URLError as exc:
+            raise RemoteError(f"cannot reach Dropbox: {exc.reason}") from exc
+
+    def _rpc(self, path: str, payload: dict, allow_not_found: bool = False):
+        data, error = self._send(
+            self.config.api_base + path,
+            json.dumps(payload).encode("utf-8"),
+            {"content-type": "application/json"},
+        )
+        if error is None:
+            try:
+                return json.loads(data.decode("utf-8"))
+            except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+                raise RemoteError("Dropbox returned an invalid JSON response") from exc
+        detail = _body(error)
+        if error.code == 401:
+            raise RemoteError(
+                _scope_guidance(detail) or f"Dropbox authorization failed: HTTP 401 {detail}"
+            )
+        if error.code == 409 and allow_not_found and "not_found" in detail:
+            return None
+        if error.code == 429:
+            retry_after = error.headers.get("retry-after") if error.headers else None
+            raise RemoteError(f"Dropbox rate limit (retry after {retry_after or '?'}s)")
+        raise RemoteError(f"Dropbox API error HTTP {error.code}: {detail}")
+
+    # --- account / lifecycle ------------------------------------------------
+    def ensure_access_token(self) -> str:
+        return self._token()
+
+    def get_current_account(self) -> dict:
+        data, error = self._send(
+            self.config.api_base + "/users/get_current_account",
+            b"null",
+            {"content-type": "application/json"},
+        )
+        if error is None:
+            try:
+                return json.loads(data.decode("utf-8"))
+            except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+                raise RemoteError("Dropbox returned an invalid JSON response") from exc
+        detail = _body(error)
+        if error.code == 401:
+            raise RemoteError(
+                _scope_guidance(detail) or f"Dropbox authorization failed: HTTP 401 {detail}"
+            )
+        raise RemoteError(f"Dropbox account lookup failed: HTTP {error.code} {detail}")
+
+    def revoke(self) -> bool:
+        """Revoke the current access token (and its refresh token). Returns True on success."""
+        token = self._token()
+        request = urllib.request.Request(
+            self.config.revoke_url,
+            method="POST",
+            headers={"authorization": f"Bearer {token}"},
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=self.config.timeout):
+                return True
+        except urllib.error.HTTPError as exc:
+            if exc.code in (400, 401):
+                return False
+            raise RemoteError(f"Dropbox token revoke failed: HTTP {exc.code} {_body(exc)}") from exc
+        except urllib.error.URLError as exc:
+            raise RemoteError(f"cannot reach Dropbox: {exc.reason}") from exc
+
+    # --- endpoints ----------------------------------------------------------
+    def list_folder(self, path: str, missing_ok: bool = True) -> list[dict]:
+        document = self._rpc(
+            "/files/list_folder", {"path": path, "recursive": False}, allow_not_found=missing_ok
+        )
+        if document is None:
+            return []
+        entries = list(document.get("entries") or [])
+        while document.get("has_more"):
+            document = self._rpc("/files/list_folder/continue", {"cursor": document.get("cursor")})
+            entries.extend(document.get("entries") or [])
+        return entries
+
+    def download(self, path: str) -> bytes | None:
+        data, error = self._send(
+            self.config.content_base + "/files/download",
+            b"",
+            {"dropbox-api-arg": json.dumps({"path": path})},
+        )
+        if error is None:
+            return data
+        detail = _body(error)
+        if error.code == 409 and "not_found" in detail:
+            return None
+        if error.code == 401:
+            raise RemoteError(
+                _scope_guidance(detail) or f"Dropbox authorization failed: HTTP 401 {detail}"
+            )
+        raise RemoteError(f"Dropbox download failed: HTTP {error.code} {detail}")
+
+
+def _body(exc: urllib.error.HTTPError) -> str:
+    cached = getattr(exc, "_cached_body", None)
+    if cached is not None:
+        return cached
+    try:
+        detail = exc.read().decode("utf-8", errors="replace")[:300]
+    except Exception:
+        detail = ""
+    exc._cached_body = detail
+    return detail
+
+
+def _scope_guidance(detail: str) -> str | None:
+    try:
+        document = json.loads(detail)
+    except json.JSONDecodeError:
+        return None
+    error = document.get("error")
+    summary = str(document.get("error_summary") or "")
+    if isinstance(error, dict) and (
+        error.get(".tag") == "missing_scope" or "missing_scope" in summary
+    ):
+        scope = error.get("required_scope")
+        if isinstance(scope, list):
+            scope = ", ".join(str(item) for item in scope)
+        return (
+            f"Dropbox token is missing required scope {scope or 'unknown'}; "
+            "enable it in the Dropbox app console and re-authorize"
+        )
+    return None

waidrop_cli/env_file.py

@@ -0,0 +1,132 @@
+"""Private environment files for archive credentials."""
+
+from __future__ import annotations
+
+import os
+import stat
+import tempfile
+from pathlib import Path
+from types import SimpleNamespace
+
+from .auth import resolve_credentials_path
+from .errors import UsageError
+
+ENV_KEY_PREFIX = "WAIDROP_"
+MANAGED_KEYS = ("WAIDROP_KEY", "WAIDROP_ACCOUNT")
+
+
+def default_env_path(args=None) -> Path:
+    credentials = resolve_credentials_path(args or SimpleNamespace(credentials_file=None))
+    return credentials.parent / "env"
+
+
+def parse_env_text(text: str) -> dict[str, str]:
+    values: dict[str, str] = {}
+    for raw_line in text.splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith("export "):
+            line = line[7:].lstrip()
+        key, separator, value = line.partition("=")
+        key = key.strip()
+        if not separator or not key or not key.startswith(ENV_KEY_PREFIX):
+            continue
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in {"'", '"'}:
+            value = value[1:-1]
+        values[key] = value
+    return values
+
+
+def load_env_file(path: Path) -> dict[str, str]:
+    path = Path(path).expanduser()
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except FileNotFoundError:
+        return {}
+    except OSError:
+        return {}
+
+    if os.name != "nt":
+        try:
+            mode = stat.S_IMODE(path.stat().st_mode)
+        except OSError:
+            return {}
+        if mode & 0o077:
+            raise UsageError(
+                f"env file {path} must not be readable or writable by group/others; "
+                f"run `chmod 600 {path}`"
+            )
+
+    return parse_env_text(text)
+
+
+def read_env_file_unchecked(path: Path) -> dict[str, str]:
+    """Read an env file without enforcing permissions (used before repairing it)."""
+    path = Path(path).expanduser()
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except FileNotFoundError:
+        return {}
+    except OSError as exc:
+        raise UsageError(f"could not read {path}: {exc}") from exc
+    return parse_env_text(text)
+
+
+def write_env_file(path: Path, *, key: str, account: str) -> None:
+    path = Path(path).expanduser()
+    existing = _read_text_unchecked(path)
+    lines = _strip_managed_keys(existing)
+    if not lines:
+        lines.append("# WAiDrop CLI environment; keep this file private (chmod 600).")
+    elif lines[-1].strip():
+        lines.append("")
+    lines.append(f"WAIDROP_KEY={key}")
+    lines.append(f"WAIDROP_ACCOUNT={account}")
+    _atomic_write_private(path, "\n".join(lines).rstrip("\n") + "\n")
+
+
+def _read_text_unchecked(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8", errors="replace")
+    except FileNotFoundError:
+        return ""
+    except OSError as exc:
+        raise UsageError(f"could not read {path}: {exc}") from exc
+
+
+def _strip_managed_keys(text: str) -> list[str]:
+    lines: list[str] = []
+    for raw_line in text.splitlines():
+        parsed = parse_env_text(raw_line)
+        if any(name in parsed for name in MANAGED_KEYS):
+            continue
+        lines.append(raw_line)
+    while lines and not lines[-1].strip():
+        lines.pop()
+    return lines
+
+
+def _atomic_write_private(path: Path, text: str) -> None:
+    parent = path.parent
+    existed = parent.exists()
+    parent.mkdir(parents=True, exist_ok=True)
+    if os.name != "nt" and (not existed or parent == default_env_path().parent):
+        try:
+            os.chmod(parent, 0o700)
+        except OSError:
+            pass
+
+    fd, tmp = tempfile.mkstemp(dir=str(parent), prefix=".env-", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            handle.write(text)
+        os.chmod(tmp, 0o600)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise

waidrop_cli/errors.py

@@ -0,0 +1,21 @@
+"""Error types with stable CLI exit codes."""
+
+
+class CliError(Exception):
+    exit_code = 1
+
+
+class UsageError(CliError):
+    exit_code = 2
+
+
+class NoMatchesError(CliError):
+    exit_code = 3
+
+
+class GuardError(CliError):
+    exit_code = 4
+
+
+class RemoteError(CliError):
+    exit_code = 5