hugo/IronStorage
1
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity

Cache TOTP discovery and report progress (#74)

Browse Source
This commit is contained in:
Chili Palmer
2026-08-11 23:15:23 +02:00
parent 6edcb5fc86
commit 9759162eff
12 changed files with 1577 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
crates/storage/src/mobile_authentication.rs
View File

@@ -19,7 +19,10 @@ use crate::{
MobileMutationAction, MobileMutationError, MobileMutationOutcome, MobileMutationPlan,
MobileMutationRequest, MobileMutationService,
},
mobile_totp::{MobileTotpDetail, MobileTotpError, MobileTotpPage, MobileTotpService},
mobile_totp::{
MobileTotpDetail, MobileTotpError, MobileTotpOperation, MobileTotpPage, MobileTotpService,
},
otp::OtpError,
recipient::RecipientPolicyManager,
repository::{
DirectoryPath, EncryptedEntry, EntryPath, Repository, RepositoryError, SecretBytes,
@@ -177,6 +180,7 @@ pub struct MobileAuthentication {
keys: KeyStore,
session: NativeAuthenticationSession,
status: Mutex<MobileAuthenticationStatus>,
totp_discovery: Mutex<()>,
}
impl MobileAuthentication {
@@ -208,6 +212,7 @@ impl MobileAuthentication {
repository,
keys,
session,
totp_discovery: Mutex::new(()),
})
}
@@ -481,8 +486,17 @@ impl MobileAuthentication {
self.unlock_ciphertext(&ciphertext, passphrase)
}
pub fn totp_page(&self) -> Result<MobileTotpPage, MobileAuthenticationError> {
pub fn totp_page(
&self,
operation: &MobileTotpOperation,
) -> Result<MobileTotpPage, MobileAuthenticationError> {
self.ensure_active()?;
let _discovery = self.totp_discovery.lock().map_err(|_| {
entry_detail(
"TOTP Discovery Is Unavailable",
"the TOTP discovery lock is unavailable",
)
})?;
let (handle, key, shared) = {
let status = self.status()?;
let active = status.active.as_ref().ok_or_else(locked_error)?;
@@ -492,12 +506,19 @@ impl MobileAuthentication {
status.watch_shared_totp_entries.clone(),
)
};
let cache_path = self.config.source().with_file_name("totp-catalog.toml");
let mut provider = KeyOnlyProvider::new(handle, &key);
MobileTotpService::new(&self.repository, &self.keys)
.page(&shared, &mut provider)
.discover(&shared, &mut provider, &cache_path, operation)
.map_err(totp_error)
}
pub fn cached_totp_page(&self) -> Result<Option<MobileTotpPage>, MobileAuthenticationError> {
let shared = self.status()?.watch_shared_totp_entries.clone();
let cache_path = self.config.source().with_file_name("totp-catalog.toml");
Ok(MobileTotpService::new(&self.repository, &self.keys).cached_page(&shared, &cache_path))
}
pub fn totp_detail(
&self,
path: &str,
@@ -1043,7 +1064,19 @@ fn editor_error(error: MobileEntryEditorError) -> MobileAuthenticationError {
}
fn totp_error(error: MobileTotpError) -> MobileAuthenticationError {
entry_detail("TOTP Is Unavailable", error)
match error {
MobileTotpError::Otp(OtpError::Cancelled) => MobileAuthenticationError::new(
MobileAuthenticationErrorKind::Cancelled,
"TOTP Discovery Cancelled",
"TOTP discovery was cancelled",
),
MobileTotpError::ConcurrentModification => MobileAuthenticationError::new(
MobileAuthenticationErrorKind::Conflict,
"TOTP Discovery Needs Refreshing",
"the password store changed while TOTP discovery was in progress",
),
error => entry_detail("TOTP Is Unavailable", error),
}
}
fn editor_missing() -> MobileAuthenticationError {

426
crates/storage/src/mobile_totp.rs
View File

@@ -1,13 +1,126 @@
//! Storage-owned TOTP catalog and detail state for native mobile frontends.
use std::{collections::BTreeSet, error::Error, fmt};
use std::{
collections::{BTreeMap, BTreeSet},
error::Error,
fmt, fs,
io::Write as _,
path::Path,
sync::{
Mutex,
atomic::{AtomicBool, Ordering},
},
};
use cap_std::{ambient_authority, fs::Dir};
use cap_tempfile::TempFile;
use data_encoding::HEXLOWER;
use serde::{Deserialize, Serialize};
use sha2::{Digest as _, Sha256};
use crate::{
crypto::{KeyStore, SecretProvider},
otp::{OtpError, OtpKind, OtpService},
repository::{EntryPath, Repository, RepositoryError, SecretBytes},
repository::{EncryptedEntry, EntryPath, Repository, RepositoryError, SecretBytes},
};
const CACHE_VERSION: u32 = 1;
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum MobileTotpDiscoveryPhase {
Preparing,
Inspecting,
Saving,
Complete,
Cancelled,
}
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct MobileTotpDiscoveryProgress {
phase: MobileTotpDiscoveryPhase,
total: u32,
inspected: u32,
cache_hits: u32,
matches: u32,
unavailable: u32,
}
impl MobileTotpDiscoveryProgress {
pub fn phase(&self) -> MobileTotpDiscoveryPhase {
self.phase
}
pub fn total(&self) -> u32 {
self.total
}
pub fn inspected(&self) -> u32 {
self.inspected
}
pub fn cache_hits(&self) -> u32 {
self.cache_hits
}
pub fn matches(&self) -> u32 {
self.matches
}
pub fn unavailable(&self) -> u32 {
self.unavailable
}
}
pub struct MobileTotpOperation {
cancelled: AtomicBool,
progress: Mutex<MobileTotpDiscoveryProgress>,
}
impl Default for MobileTotpOperation {
fn default() -> Self {
Self {
cancelled: AtomicBool::new(false),
progress: Mutex::new(MobileTotpDiscoveryProgress {
phase: MobileTotpDiscoveryPhase::Preparing,
total: 0,
inspected: 0,
cache_hits: 0,
matches: 0,
unavailable: 0,
}),
}
}
}
impl MobileTotpOperation {
pub fn cancel(&self) {
self.cancelled.store(true, Ordering::Relaxed);
self.update(|progress| progress.phase = MobileTotpDiscoveryPhase::Cancelled);
}
pub fn progress(&self) -> MobileTotpDiscoveryProgress {
self.progress.lock().map_or_else(
|poisoned| poisoned.into_inner().clone(),
|value| value.clone(),
)
}
fn check_cancelled(&self) -> Result<(), MobileTotpError> {
if self.cancelled.load(Ordering::Relaxed) {
Err(OtpError::Cancelled.into())
} else {
Ok(())
}
}
fn update(&self, update: impl FnOnce(&mut MobileTotpDiscoveryProgress)) {
match self.progress.lock() {
Ok(mut progress) => update(&mut progress),
Err(poisoned) => update(&mut poisoned.into_inner()),
}
}
}
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum MobileWatchSnapshotState {
Unavailable,
@@ -70,6 +183,7 @@ impl MobileTotpRow {
pub struct MobileTotpPage {
rows: Vec<MobileTotpRow>,
unavailable_entries: u32,
cache_notice: Option<String>,
watch: MobileWatchSnapshotStatus,
}
@@ -82,6 +196,10 @@ impl MobileTotpPage {
self.unavailable_entries
}
pub fn cache_notice(&self) -> Option<&str> {
self.cache_notice.as_deref()
}
pub fn watch(&self) -> &MobileWatchSnapshotStatus {
&self.watch
}
@@ -184,21 +302,129 @@ impl<'a> MobileTotpService<'a> {
Err(_) => {}
}
}
rows.sort_by(|left, right| {
left.title
.to_lowercase()
.cmp(&right.title.to_lowercase())
.then_with(|| {
left.account
.to_lowercase()
.cmp(&right.account.to_lowercase())
})
.then_with(|| left.path.cmp(&right.path))
});
sort_rows(&mut rows);
let selected = rows.iter().filter(|row| row.shared_with_watch).count();
Ok(MobileTotpPage {
rows,
unavailable_entries,
cache_notice: None,
watch: snapshot_status(selected),
})
}
pub fn discover(
&self,
shared: &BTreeSet<EntryPath>,
provider: &mut impl SecretProvider,
cache_path: &Path,
operation: &MobileTotpOperation,
) -> Result<MobileTotpPage, MobileTotpError> {
operation.check_cancelled()?;
let initial_inventory = inventory(self.repository)?;
operation.update(|progress| {
progress.phase = MobileTotpDiscoveryPhase::Inspecting;
progress.total = u32::try_from(initial_inventory.len()).unwrap_or(u32::MAX);
});
let store = store_identity(self.repository.root_path());
let (cached, mut cache_notice) = load_cache(cache_path, &store);
let mut checkpoint = CachedCatalog {
version: CACHE_VERSION,
store: store.clone(),
entries: cached
.as_ref()
.map_or_else(BTreeMap::new, |catalog| catalog.entries.clone()),
};
let mut records = BTreeMap::new();
let mut rows = Vec::new();
let mut unavailable_entries = 0_u32;
for (path, encrypted, ciphertext_hash) in &initial_inventory {
operation.check_cancelled()?;
let path_text = path.to_string();
let cached_record = cached
.as_ref()
.and_then(|catalog| catalog.entries.get(&path_text))
.filter(|record| record.ciphertext_hash == *ciphertext_hash);
let (record, changed) = if let Some(record) = cached_record {
operation
.update(|progress| progress.cache_hits = progress.cache_hits.saturating_add(1));
(record.clone(), false)
} else {
match inspect_entry(self.repository, self.keys, path, encrypted, provider) {
Ok(record) => (record.with_ciphertext_hash(ciphertext_hash.clone()), true),
Err(OtpError::Crypto(_)) => {
unavailable_entries = unavailable_entries.saturating_add(1);
operation.update(|progress| {
progress.unavailable = progress.unavailable.saturating_add(1)
});
operation.update(|progress| {
progress.inspected = progress.inspected.saturating_add(1)
});
continue;
}
Err(OtpError::Repository(error)) => return Err(error.into()),
Err(error) => return Err(error.into()),
}
};
if record.is_totp {
rows.push(cached_row(path, shared.contains(path)));
operation.update(|progress| progress.matches = progress.matches.saturating_add(1));
}
if changed {
checkpoint.entries.insert(path_text.clone(), record.clone());
if let Err(error) = save_cache(cache_path, &checkpoint) {
cache_notice = Some(error.to_string());
}
}
records.insert(path_text, record);
operation.update(|progress| progress.inspected = progress.inspected.saturating_add(1));
}
operation.check_cancelled()?;
if initial_inventory != inventory(self.repository)? {
return Err(MobileTotpError::ConcurrentModification);
}
operation.update(|progress| progress.phase = MobileTotpDiscoveryPhase::Saving);
let catalog = CachedCatalog {
version: CACHE_VERSION,
store,
entries: records,
};
if let Err(error) = save_cache(cache_path, &catalog) {
cache_notice = Some(error.to_string());
}
sort_rows(&mut rows);
let selected = rows.iter().filter(|row| row.shared_with_watch).count();
operation.update(|progress| progress.phase = MobileTotpDiscoveryPhase::Complete);
Ok(MobileTotpPage {
rows,
unavailable_entries,
cache_notice,
watch: snapshot_status(selected),
})
}
pub fn cached_page(
&self,
shared: &BTreeSet<EntryPath>,
cache_path: &Path,
) -> Option<MobileTotpPage> {
let store = store_identity(self.repository.root_path());
let (catalog, _) = load_cache(cache_path, &store);
let mut rows: Vec<_> = catalog?
.entries
.into_iter()
.filter(|(_, record)| record.is_totp)
.filter_map(|(path, _)| EntryPath::parse(&path).ok())
.map(|path| cached_row(&path, shared.contains(&path)))
.collect();
sort_rows(&mut rows);
let selected = rows.iter().filter(|row| row.shared_with_watch).count();
Some(MobileTotpPage {
rows,
unavailable_entries: 0,
cache_notice: None,
watch: snapshot_status(selected),
})
}
@@ -234,6 +460,150 @@ impl<'a> MobileTotpService<'a> {
}
}
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
struct CachedRecord {
ciphertext_hash: String,
is_totp: bool,
}
impl CachedRecord {
fn with_ciphertext_hash(mut self, ciphertext_hash: String) -> Self {
self.ciphertext_hash = ciphertext_hash;
self
}
}
#[derive(Debug, Deserialize, Eq, PartialEq, Serialize)]
struct CachedCatalog {
version: u32,
store: String,
entries: BTreeMap<String, CachedRecord>,
}
fn inventory(
repository: &Repository,
) -> Result<Vec<(EntryPath, EncryptedEntry, String)>, RepositoryError> {
repository
.snapshot()?
.entries()
.map(|entry| {
let encrypted = repository.read_entry(entry.path())?;
let ciphertext_hash = digest(encrypted.as_bytes());
Ok((entry.path().clone(), encrypted, ciphertext_hash))
})
.collect()
}
fn inspect_entry(
repository: &Repository,
keys: &KeyStore,
path: &EntryPath,
encrypted: &EncryptedEntry,
provider: &mut impl SecretProvider,
) -> Result<CachedRecord, OtpError> {
let is_totp = match OtpService::new(repository, keys).uri_encrypted(path, encrypted, provider) {
Ok(uri) => uri.kind() == OtpKind::Totp,
Err(OtpError::MissingUri { .. } | OtpError::AmbiguousUri { .. }) => false,
Err(OtpError::Crypto(error)) => return Err(OtpError::Crypto(error)),
Err(OtpError::Repository(error)) => return Err(OtpError::Repository(error)),
Err(_) => false,
};
Ok(CachedRecord {
ciphertext_hash: String::new(),
is_totp,
})
}
fn load_cache(path: &Path, store: &str) -> (Option<CachedCatalog>, Option<String>) {
if let Ok(metadata) = fs::symlink_metadata(path)
&& (metadata.file_type().is_symlink() || !metadata.is_file())
{
return (
None,
Some("The TOTP cache was not a regular file and was rebuilt.".to_owned()),
);
}
let contents = match fs::read_to_string(path) {
Ok(contents) => contents,
Err(error) if error.kind() == std::io::ErrorKind::NotFound => return (None, None),
Err(_) => {
return (
None,
Some("The TOTP cache could not be read and was rebuilt.".to_owned()),
);
}
};
let catalog = toml::from_str::<CachedCatalog>(&contents)
.ok()
.filter(|catalog| catalog.version == CACHE_VERSION && catalog.store == store);
match catalog {
Some(catalog) => (Some(catalog), None),
None => (
None,
Some("The TOTP cache was outdated or damaged and was rebuilt.".to_owned()),
),
}
}
fn save_cache(path: &Path, catalog: &CachedCatalog) -> Result<(), MobileTotpCacheError> {
let serialized = toml::to_string(catalog).map_err(|_| MobileTotpCacheError::Encode)?;
let parent = path.parent().ok_or(MobileTotpCacheError::Write)?;
let name = path.file_name().ok_or(MobileTotpCacheError::Write)?;
let directory = Dir::open_ambient_dir(parent, ambient_authority())
.map_err(|_| MobileTotpCacheError::Write)?;
if let Ok(metadata) = directory.symlink_metadata(name)
&& (metadata.file_type().is_symlink() || !metadata.is_file())
{
return Err(MobileTotpCacheError::Write);
}
let mut temporary = TempFile::new(&directory).map_err(|_| MobileTotpCacheError::Write)?;
set_private_permissions(&temporary)?;
temporary
.write_all(serialized.as_bytes())
.and_then(|()| temporary.as_file().sync_all())
.and_then(|()| temporary.replace(name))
.and_then(|()| directory.open(".").and_then(|file| file.sync_all()))
.map_err(|_| MobileTotpCacheError::Write)
}
#[cfg(unix)]
fn set_private_permissions(temporary: &TempFile<'_>) -> Result<(), MobileTotpCacheError> {
use cap_std::fs::{Permissions, PermissionsExt as _};
temporary
.as_file()
.set_permissions(Permissions::from_mode(0o600))
.map_err(|_| MobileTotpCacheError::Write)
}
#[cfg(not(unix))]
fn set_private_permissions(_temporary: &TempFile<'_>) -> Result<(), MobileTotpCacheError> {
Ok(())
}
fn store_identity(root: &Path) -> String {
digest(root.to_string_lossy().as_bytes())
}
fn digest(bytes: &[u8]) -> String {
HEXLOWER.encode(&Sha256::digest(bytes))
}
#[derive(Debug)]
enum MobileTotpCacheError {
Encode,
Write,
}
impl fmt::Display for MobileTotpCacheError {
fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
match self {
Self::Encode => formatter.write_str("The TOTP cache could not be encoded."),
Self::Write => formatter.write_str("The TOTP cache could not be saved."),
}
}
}
fn row(
path: &EntryPath,
issuer: Option<&str>,
@@ -250,6 +620,33 @@ fn row(
}
}
fn cached_row(path: &EntryPath, shared_with_watch: bool) -> MobileTotpRow {
let path = path.to_string();
let title = path.rsplit('/').next().unwrap_or(&path).to_owned();
MobileTotpRow {
path: path.clone(),
issuer: None,
account: title.clone(),
title,
detail: path,
shared_with_watch,
}
}
fn sort_rows(rows: &mut [MobileTotpRow]) {
rows.sort_by(|left, right| {
left.title
.to_lowercase()
.cmp(&right.title.to_lowercase())
.then_with(|| {
left.account
.to_lowercase()
.cmp(&right.account.to_lowercase())
})
.then_with(|| left.path.cmp(&right.path))
});
}
fn snapshot_status(selected: usize) -> MobileWatchSnapshotStatus {
if selected == 0 {
MobileWatchSnapshotStatus {
@@ -275,6 +672,7 @@ fn snapshot_status(selected: usize) -> MobileWatchSnapshotStatus {
pub enum MobileTotpError {
Repository(RepositoryError),
Otp(OtpError),
ConcurrentModification,
}
impl fmt::Display for MobileTotpError {
@@ -282,6 +680,8 @@ impl fmt::Display for MobileTotpError {
match self {
Self::Repository(error) => error.fmt(formatter),
Self::Otp(error) => error.fmt(formatter),
Self::ConcurrentModification => formatter
.write_str("the password store changed while TOTP discovery was in progress"),
}
}
}

14
crates/storage/src/mutation.rs
View File

@@ -612,14 +612,6 @@ impl<'a> TreeMutator<'a> {
path: repository.git_directory().to_owned(),
});
}
if let Some(path) = snapshot
.collisions()
.find(|path| path.starts_with(root.as_path()))
{
return Err(MutationError::SourceTypeCollision {
path: (*path).clone(),
});
}
Ok(())
}
@@ -760,7 +752,6 @@ pub enum MutationError {
SameObject,
DestinationInsideSource,
DestinationDirectoryMissing { directory: DirectoryPath },
SourceTypeCollision { path: std::path::PathBuf },
DestinationTypeCollision { path: std::path::PathBuf },
UnsafePolicyOverwrite { directory: DirectoryPath },
UnsupportedAuxiliary { path: std::path::PathBuf },
@@ -788,11 +779,6 @@ impl fmt::Display for MutationError {
formatter,
"trailing-slash destination directory does not exist: {directory}"
),
Self::SourceTypeCollision { path } => write!(
formatter,
"source subtree contains an entry/directory collision: {}",
path.display()
),
Self::DestinationTypeCollision { path } => write!(
formatter,
"directory destination collides with password entry: {}",

17
crates/storage/src/otp.rs
View File

@@ -656,10 +656,21 @@ impl<'a> OtpService<'a> {
pub fn uri(&self, entry: &str, provider: &mut impl SecretProvider) -> Result<OtpUri, OtpError> {
let path = parse_entry(entry)?;
let ciphertext = self.repository.read_entry(&path)?;
let plaintext = self.keys.decrypt(&ciphertext, provider)?;
find_uri(&plaintext, &path)?
self.uri_encrypted(&path, &ciphertext, provider)
}
pub(crate) fn uri_encrypted(
&self,
path: &EntryPath,
ciphertext: &EncryptedEntry,
provider: &mut impl SecretProvider,
) -> Result<OtpUri, OtpError> {
let plaintext = self.keys.decrypt(ciphertext, provider)?;
find_uri(&plaintext, path)?
.map(|(_, uri)| uri)
.ok_or(OtpError::MissingUri { entry: path })
.ok_or_else(|| OtpError::MissingUri {
entry: path.clone(),
})
}
pub fn code(

70
crates/storage/src/repository.rs
View File

@@ -1,7 +1,7 @@
//! Capability-scoped password-store repository discovery and atomic file access.
use std::{
collections::{BTreeMap, BTreeSet},
collections::BTreeMap,
error::Error,
ffi::{OsStr, OsString},
fmt, fs,
@@ -9,6 +9,9 @@ use std::{
path::{Component, Path, PathBuf},
};
#[cfg(test)]
use std::collections::BTreeSet;
use cap_std::{ambient_authority, fs::Dir};
use cap_tempfile::TempFile;
use zeroize::Zeroize;
@@ -262,7 +265,6 @@ pub struct RepositorySnapshot {
recipients: BTreeMap<DirectoryPath, RecipientPolicy>,
git_repositories: BTreeMap<DirectoryPath, GitRepository>,
auxiliary_files: BTreeMap<PathBuf, AuxiliaryFile>,
collisions: BTreeSet<PathBuf>,
}
impl RepositorySnapshot {
@@ -286,10 +288,6 @@ impl RepositorySnapshot {
self.auxiliary_files.values()
}
pub fn collisions(&self) -> impl ExactSizeIterator<Item = &PathBuf> {
self.collisions.iter()
}
/// Resolve an upstream-style display path. A trailing slash explicitly selects a directory.
pub fn resolve(&self, input: &str) -> Result<ResolvedObject<'_>, RepositoryError> {
let directory_only = input.ends_with('/') || (cfg!(windows) && input.ends_with('\\'));
@@ -310,10 +308,7 @@ impl RepositorySnapshot {
let entry = EntryPath::parse(trimmed)?;
let entry_record = self.entries.get(&entry);
match (entry_record, directory_record) {
(Some(_), Some(_)) => Err(RepositoryError::AmbiguousPath {
path: entry.0.clone(),
}),
(Some(entry), None) => Ok(ResolvedObject::Entry(entry)),
(Some(entry), _) => Ok(ResolvedObject::Entry(entry)),
(None, Some(directory)) => Ok(ResolvedObject::Directory(directory)),
(None, None) => Err(RepositoryError::NotFound {
path: entry.0.clone(),
@@ -390,14 +385,6 @@ impl Repository {
pub fn snapshot(&self) -> Result<RepositorySnapshot, RepositoryError> {
let mut snapshot = RepositorySnapshot::default();
scan_directory(&self.root, &DirectoryPath::root(), &mut snapshot)?;
for entry in snapshot.entries.keys() {
if snapshot
.directories
.contains_key(&DirectoryPath(entry.0.clone()))
{
snapshot.collisions.insert(entry.0.clone());
}
}
Ok(snapshot)
}
@@ -540,7 +527,7 @@ impl Repository {
{
let (parent, file_name, created) = self.create_entry_parent(path)?;
let encrypted_path = path.encrypted_relative_path();
if let Err(error) = validate_write_target(&parent, &file_name, &path.0, &encrypted_path) {
if let Err(error) = validate_write_target(&parent, &file_name, &encrypted_path) {
return self.rollback_created(created, error);
}
@@ -598,7 +585,6 @@ impl Repository {
.0
.file_name()
.expect("non-root directory has a file name");
reject_entry_directory_collision(&parent_handle, name, &parent.0)?;
let metadata = child_metadata(&parent_handle, name, &directory.0)?;
let Some(metadata) = metadata else {
current = directory.parent();
@@ -651,7 +637,6 @@ impl Repository {
.as_path()
.file_name()
.expect("non-root directory has a file name");
reject_entry_directory_collision(&parent_handle, name, parent.as_path())?;
let Some(metadata) = child_metadata(&parent_handle, name, directory.as_path())? else {
return Ok(false);
};
@@ -691,7 +676,6 @@ impl Repository {
file_name.push(".gpg");
return Ok((directory, file_name));
}
reject_entry_directory_collision(&directory, name, &relative)?;
relative.push(name);
let metadata = child_metadata(&directory, name, &relative)?;
let Some(metadata) = metadata else {
@@ -725,9 +709,6 @@ impl Repository {
file_name.push(".gpg");
return Ok((directory, file_name, created));
}
if let Err(error) = reject_entry_directory_collision(&directory, name, &relative) {
return self.rollback_created(created, error);
}
relative.push(name);
match child_metadata(&directory, name, &relative) {
Ok(Some(metadata)) => {
@@ -773,9 +754,6 @@ impl Repository {
let Component::Normal(name) = component else {
unreachable!("DirectoryPath is validated")
};
if let Err(error) = reject_entry_directory_collision(&directory, name, &relative) {
return self.rollback_created(created, error);
}
relative.push(name);
match child_metadata(&directory, name, &relative) {
Ok(Some(metadata)) => {
@@ -845,7 +823,6 @@ impl Repository {
let Component::Normal(name) = component else {
unreachable!("normalized directory path has only normal components")
};
reject_entry_directory_collision(&directory, name, &relative)?;
relative.push(name);
let metadata = child_metadata(&directory, name, &relative)?.ok_or_else(|| {
RepositoryError::NotFound {
@@ -899,9 +876,6 @@ pub enum RepositoryError {
Collision {
path: PathBuf,
},
AmbiguousPath {
path: PathBuf,
},
NotFound {
path: PathBuf,
},
@@ -962,11 +936,6 @@ impl fmt::Display for RepositoryError {
"password-store entry collides with a directory: {}",
path.display()
),
Self::AmbiguousPath { path } => write!(
formatter,
"password-store path is both an entry and directory; add a trailing slash for the directory: {}",
path.display()
),
Self::NotFound { path } => {
write!(
formatter,
@@ -1198,38 +1167,11 @@ fn require_regular_file(
}
}
fn reject_entry_directory_collision(
directory: &Dir,
name: &OsStr,
parent: &Path,
) -> Result<(), RepositoryError> {
let mut encrypted_name = name.to_os_string();
encrypted_name.push(".gpg");
let logical = parent.join(name);
if child_metadata(directory, &encrypted_name, &logical)?.is_some() {
return Err(RepositoryError::Collision { path: logical });
}
Ok(())
}
fn validate_write_target(
parent: &Dir,
file_name: &OsStr,
logical: &Path,
encrypted: &Path,
) -> Result<(), RepositoryError> {
if let Some(metadata) =
child_metadata(parent, logical.file_name().unwrap_or_default(), logical)?
{
if metadata.is_dir() {
return Err(RepositoryError::Collision {
path: logical.to_owned(),
});
}
return Err(RepositoryError::UnsupportedFileType {
path: logical.to_owned(),
});
}
if let Some(metadata) = child_metadata(parent, file_name, encrypted)? {
require_regular_file(metadata, encrypted)?;
}

282
crates/storage/tests/mobile_totp.rs
View File

@@ -2,13 +2,20 @@
mod support;
use std::collections::{BTreeMap, BTreeSet};
use std::{
collections::{BTreeMap, BTreeSet},
fs,
};
use ironstorage::{
crypto::{KeyInfo, KeyStore, SecretProvider, SecretProviderError},
mobile_totp::{MobileTotpService, MobileWatchSnapshotState},
mobile_totp::{
MobileTotpDiscoveryPhase, MobileTotpError, MobileTotpOperation, MobileTotpService,
MobileWatchSnapshotState,
},
otp::OtpError,
recipient::RecipientPolicyManager,
repository::{EntryPath, Repository, SecretBytes},
repository::{EncryptedEntry, EntryPath, Repository, SecretBytes},
};
use support::compatibility::{FixtureSet, TestResult};
@@ -42,6 +49,63 @@ impl SecretProvider for FixtureSecrets {
}
}
struct CountingSecrets {
inner: FixtureSecrets,
requests: usize,
}
impl CountingSecrets {
fn all(fixture: &FixtureSet) -> Self {
Self {
inner: FixtureSecrets::all(fixture),
requests: 0,
}
}
}
impl SecretProvider for CountingSecrets {
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError> {
self.requests += 1;
self.inner.secret_for(key)
}
}
struct CancellingSecrets<'a> {
inner: FixtureSecrets,
operation: &'a MobileTotpOperation,
requests: usize,
}
struct MutatingSecrets<'a> {
inner: FixtureSecrets,
repository: &'a Repository,
path: EntryPath,
replacement: Option<EncryptedEntry>,
}
impl SecretProvider for MutatingSecrets<'_> {
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError> {
let secret = self.inner.secret_for(key)?;
if let Some(replacement) = self.replacement.take() {
self.repository
.write_entry(&self.path, &replacement)
.expect("fixture mutation succeeds");
}
Ok(secret)
}
}
impl SecretProvider for CancellingSecrets<'_> {
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError> {
self.requests += 1;
let secret = self.inner.secret_for(key)?;
if self.requests == 1 {
self.operation.cancel();
}
Ok(secret)
}
}
#[test]
fn mobile_totp_catalog_details_and_watch_selection_are_storage_owned() -> TestResult {
let fixture = FixtureSet::load()?;
@@ -99,6 +163,218 @@ fn mobile_totp_catalog_details_and_watch_selection_are_storage_owned() -> TestRe
Ok(())
}
#[test]
fn totp_cache_reuses_ciphertext_hashes_and_removes_deleted_entries() -> TestResult {
let fixture = FixtureSet::load()?;
let store = fixture.materialize_store("basic")?;
let repository = Repository::open(store.path())?;
let keys = KeyStore::load(fixture.path("keys"))?;
write_plaintext(
&repository,
&keys,
"otp/alice",
b"password\notpauth://totp/Acme:alice@example.com?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&issuer=Acme\n",
)?;
for path in ["team-a", "team-a/shared", "team-b/shared"] {
write_plaintext(
&repository,
&keys,
path,
b"otpauth://totp/Shared?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ\n",
)?;
}
write_plaintext(&repository, &keys, "ordinary", b"password\nlogin: alice\n")?;
let cache_directory = tempfile::tempdir()?;
let cache = cache_directory.path().join("totp-catalog.toml");
let service = MobileTotpService::new(&repository, &keys);
let cold = MobileTotpOperation::default();
let mut cold_secrets = CountingSecrets::all(&fixture);
let page = service.discover(&BTreeSet::new(), &mut cold_secrets, &cache, &cold)?;
assert!(page.rows().iter().any(|row| row.path() == "otp/alice"));
assert!(page.rows().iter().any(|row| row.path() == "team-a"));
assert!(page.rows().iter().any(|row| row.path() == "team-a/shared"));
assert!(page.rows().iter().any(|row| row.path() == "team-b/shared"));
assert_eq!(cold.progress().phase(), MobileTotpDiscoveryPhase::Complete);
assert_eq!(cold.progress().inspected(), cold.progress().total());
assert!(cold_secrets.requests > 0);
let encoded = fs::read_to_string(&cache)?;
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt as _;
assert_eq!(fs::metadata(&cache)?.permissions().mode() & 0o777, 0o600);
}
assert!(encoded.contains("is_totp = true"));
assert!(encoded.contains("ciphertext_hash ="));
assert!(encoded.contains("otp/alice"));
for secret in [
"otpauth://",
"secret=",
"alice@example.com",
"Acme",
"password",
] {
assert!(!encoded.contains(secret), "cache leaked {secret}");
}
let warm = MobileTotpOperation::default();
let mut warm_secrets = CountingSecrets::all(&fixture);
let warm_page = service.discover(&BTreeSet::new(), &mut warm_secrets, &cache, &warm)?;
assert_eq!(warm_secrets.requests, 0);
assert_eq!(warm.progress().cache_hits(), warm.progress().total());
assert_eq!(warm_page.rows(), page.rows());
assert_eq!(
service
.cached_page(&BTreeSet::new(), &cache)
.expect("created cache")
.rows(),
page.rows()
);
write_plaintext(
&repository,
&keys,
"ordinary",
b"otpauth://totp/New:new@example.com?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&issuer=New\n",
)?;
let changed = MobileTotpOperation::default();
let mut changed_secrets = CountingSecrets::all(&fixture);
let changed_page =
service.discover(&BTreeSet::new(), &mut changed_secrets, &cache, &changed)?;
assert_eq!(changed_secrets.requests, 1);
assert_eq!(
changed.progress().cache_hits() + 1,
changed.progress().total()
);
assert!(
changed_page
.rows()
.iter()
.any(|row| row.path() == "ordinary")
);
repository.remove_entry(&EntryPath::parse("otp/alice")?)?;
let deleted = MobileTotpOperation::default();
let mut deleted_secrets = CountingSecrets::all(&fixture);
let deleted_page =
service.discover(&BTreeSet::new(), &mut deleted_secrets, &cache, &deleted)?;
assert_eq!(deleted_secrets.requests, 0);
assert!(
deleted_page
.rows()
.iter()
.all(|row| row.path() != "otp/alice")
);
assert!(
service
.cached_page(&BTreeSet::new(), &cache)
.expect("updated cache")
.rows()
.iter()
.all(|row| row.path() != "otp/alice")
);
let cancelled = MobileTotpOperation::default();
cancelled.cancel();
let mut cancelled_secrets = CountingSecrets::all(&fixture);
assert!(matches!(
service.discover(&BTreeSet::new(), &mut cancelled_secrets, &cache, &cancelled,),
Err(MobileTotpError::Otp(OtpError::Cancelled))
));
assert_eq!(
cancelled.progress().phase(),
MobileTotpDiscoveryPhase::Cancelled
);
fs::write(&cache, "not a TOTP catalog")?;
let recovery = MobileTotpOperation::default();
let mut recovery_secrets = CountingSecrets::all(&fixture);
let recovered = service.discover(&BTreeSet::new(), &mut recovery_secrets, &cache, &recovery)?;
assert!(recovered.cache_notice().is_some());
assert!(service.cached_page(&BTreeSet::new(), &cache).is_some());
let other_store = fixture.materialize_store("nested")?;
let other_repository = Repository::open(other_store.path())?;
assert!(
MobileTotpService::new(&other_repository, &keys)
.cached_page(&BTreeSet::new(), &cache)
.is_none()
);
Ok(())
}
#[test]
fn cancelled_discovery_checkpoints_completed_entries() -> TestResult {
let fixture = FixtureSet::load()?;
let store = fixture.materialize_store("basic")?;
let repository = Repository::open(store.path())?;
let keys = KeyStore::load(fixture.path("keys"))?;
let cache_directory = tempfile::tempdir()?;
let cache = cache_directory.path().join("totp-catalog.toml");
let service = MobileTotpService::new(&repository, &keys);
let interrupted = MobileTotpOperation::default();
let mut secrets = CancellingSecrets {
inner: FixtureSecrets::all(&fixture),
operation: &interrupted,
requests: 0,
};
assert!(matches!(
service.discover(&BTreeSet::new(), &mut secrets, &cache, &interrupted,),
Err(MobileTotpError::Otp(OtpError::Cancelled))
));
assert!(cache.is_file());
let resumed = MobileTotpOperation::default();
let mut resumed_secrets = CountingSecrets::all(&fixture);
service.discover(&BTreeSet::new(), &mut resumed_secrets, &cache, &resumed)?;
assert!(resumed.progress().cache_hits() >= 1);
assert!(resumed_secrets.requests < resumed.progress().total() as usize);
Ok(())
}
#[test]
fn discovery_rejects_a_result_when_ciphertext_changes_mid_scan() -> TestResult {
let fixture = FixtureSet::load()?;
let store = fixture.materialize_store("basic")?;
let repository = Repository::open(store.path())?;
let keys = KeyStore::load(fixture.path("keys"))?;
let path = EntryPath::parse("ordinary")?;
write_plaintext(&repository, &keys, "ordinary", b"password\n")?;
let recipients =
RecipientPolicyManager::new(&repository, &keys).resolve_for_entry(&path, None)?;
let replacement = keys.encrypt(
SecretBytes::new(b"changed password\n".to_vec()),
recipients.recipients(),
)?;
let cache_directory = tempfile::tempdir()?;
let cache = cache_directory.path().join("totp-catalog.toml");
let operation = MobileTotpOperation::default();
let mut secrets = MutatingSecrets {
inner: FixtureSecrets::all(&fixture),
repository: &repository,
path,
replacement: Some(replacement),
};
assert!(matches!(
MobileTotpService::new(&repository, &keys).discover(
&BTreeSet::new(),
&mut secrets,
&cache,
&operation,
),
Err(MobileTotpError::ConcurrentModification)
));
assert_ne!(
operation.progress().phase(),
MobileTotpDiscoveryPhase::Complete
);
Ok(())
}
fn write_plaintext(
repository: &Repository,
keys: &KeyStore,

53
crates/storage/tests/repository_core.rs
View File

@@ -24,7 +24,6 @@ fn ordinary_nested_and_unicode_pass_trees_are_discovered() -> TestResult {
assert_eq!(paths.len(), 6);
assert!(paths.contains(&Path::new("email/personal").to_owned()));
assert!(paths.contains(&Path::new("unicode/咖啡").to_owned()));
assert_eq!(snapshot.collisions().len(), 0);
assert_eq!(snapshot.auxiliary_files().len(), 0);
assert_eq!(snapshot.recipient_policies().len(), 3);
@@ -86,38 +85,54 @@ fn innermost_git_repository_is_selected_without_scanning_git_objects() -> TestRe
}
#[test]
fn entry_and_directory_ambiguity_requires_explicit_directory_syntax() -> TestResult {
fn entry_and_directory_with_the_same_logical_path_remain_independent() -> TestResult {
let temporary = tempfile::tempdir()?;
fs::create_dir(temporary.path().join("ambiguous"))?;
fs::write(temporary.path().join("ambiguous.gpg"), b"ciphertext")?;
fs::write(
temporary.path().join("ambiguous/child.gpg"),
b"child ciphertext",
)?;
let repository = Repository::open(temporary.path())?;
let snapshot = repository.snapshot()?;
assert_eq!(
snapshot.resolve("ambiguous").expect_err("ambiguous path"),
RepositoryError::AmbiguousPath {
path: Path::new("ambiguous").to_owned()
}
);
assert!(matches!(
snapshot.resolve("ambiguous")?,
ResolvedObject::Entry(entry) if entry.path().as_path() == Path::new("ambiguous")
));
assert!(matches!(
snapshot.resolve("ambiguous/")?,
ResolvedObject::Directory(directory)
if directory.path().as_path() == Path::new("ambiguous")
));
assert_eq!(
snapshot.collisions().collect::<Vec<_>>(),
[&Path::new("ambiguous").to_owned()]
snapshot
.entries()
.map(|entry| entry.path().as_path())
.collect::<Vec<_>>(),
[Path::new("ambiguous"), Path::new("ambiguous/child")]
);
let original = fs::read(temporary.path().join("ambiguous.gpg"))?;
assert!(matches!(
repository.write_entry(
&EntryPath::parse("ambiguous")?,
&EncryptedEntry::new(b"replacement".to_vec())
),
Err(RepositoryError::Collision { .. })
));
assert_eq!(fs::read(temporary.path().join("ambiguous.gpg"))?, original);
repository.write_entry(
&EntryPath::parse("ambiguous")?,
&EncryptedEntry::new(b"replacement".to_vec()),
)?;
repository.write_entry(
&EntryPath::parse("ambiguous/new-child")?,
&EncryptedEntry::new(b"new child".to_vec()),
)?;
assert_eq!(
repository
.read_entry(&EntryPath::parse("ambiguous")?)?
.as_bytes(),
b"replacement"
);
assert_eq!(
repository
.read_entry(&EntryPath::parse("ambiguous/new-child")?)?
.as_bytes(),
b"new child"
);
Ok(())
}

36
crates/storage/tests/tree_mutations.rs
View File

@@ -320,7 +320,7 @@ fn entry_collisions_require_confirmation_unless_forced() -> TestResult {
}
#[test]
fn mutation_rejects_ambiguous_sources_and_same_object_targets() -> TestResult {
fn mutation_prefers_an_entry_over_its_same_named_directory() -> TestResult {
let fixture = FixtureSet::load()?;
let store = fixture.materialize_store("basic")?;
fs::create_dir(store.path().join("email/personal"))?;
@@ -329,22 +329,26 @@ fn mutation_rejects_ambiguous_sources_and_same_object_targets() -> TestResult {
let mut provider = Secrets::all(&fixture);
let mutator = TreeMutator::new(&repository, &keys);
assert!(matches!(
mutator.copy(
&CopyRequest {
source: "email/personal".into(),
destination: "elsewhere".into(),
force: false,
},
OverwriteDecision::Allow,
None,
mutator.copy(
&CopyRequest {
source: "email/personal".into(),
destination: "elsewhere".into(),
force: false,
},
OverwriteDecision::Allow,
None,
&mut provider,
&mut Committer::default(),
)?;
assert!(store.path().join("email/personal").is_dir());
assert_eq!(
keys.decrypt(
&repository.read_entry(&EntryPath::parse("elsewhere")?)?,
&mut provider,
&mut Committer::default()
),
Err(MutationError::Repository(
ironstorage::repository::RepositoryError::AmbiguousPath { .. }
))
));
)?
.expose(),
fixture.read("expected/basic/email/personal.txt")?
);
assert!(matches!(
mutator.copy(
&CopyRequest {