140 lines
3.3 KiB
Go
140 lines
3.3 KiB
Go
package vault
|
||
|
||
import (
|
||
"crypto/aes"
|
||
"crypto/cipher"
|
||
"crypto/rand"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"errors"
|
||
"os"
|
||
"path/filepath"
|
||
)
|
||
|
||
// Vault 凭据保险库：AES-256-GCM 加密的 JSON 文件（主密钥单独 0600 文件）。
|
||
// 二期：Windows 上主密钥改用 DPAPI 保护，文件格式不变。
|
||
type Vault struct {
|
||
dir string
|
||
key []byte
|
||
}
|
||
|
||
type vaultFile struct {
|
||
Version int `json:"version"`
|
||
Entries map[string]string `json:"entries"`
|
||
}
|
||
|
||
// Open 打开/创建保险库（主密钥 data/master.key，32 字节）
|
||
func Open(dir string) (*Vault, error) {
|
||
if err := os.MkdirAll(dir, 0o700); err != nil {
|
||
return nil, err
|
||
}
|
||
keyPath := filepath.Join(dir, "master.key")
|
||
var key []byte
|
||
if raw, err := os.ReadFile(keyPath); err == nil {
|
||
key = make([]byte, base64.RawStdEncoding.DecodedLen(len(raw)))
|
||
if _, err = base64.RawStdEncoding.Decode(key, raw); err != nil || len(key) != 32 {
|
||
return nil, errors.New("master key corrupted")
|
||
}
|
||
} else {
|
||
key = make([]byte, 32)
|
||
if _, err = rand.Read(key); err != nil {
|
||
return nil, err
|
||
}
|
||
if err = os.WriteFile(keyPath, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
|
||
return nil, err
|
||
}
|
||
}
|
||
return &Vault{dir: dir, key: key}, nil
|
||
}
|
||
|
||
func (v *Vault) path() string { return filepath.Join(v.dir, "vault.enc") }
|
||
|
||
// load 读取并解密全部条目
|
||
func (v *Vault) load() (map[string]string, error) {
|
||
raw, err := os.ReadFile(v.path())
|
||
if err != nil {
|
||
if os.IsNotExist(err) {
|
||
return map[string]string{}, nil
|
||
}
|
||
return nil, err
|
||
}
|
||
var f vaultFile
|
||
if err = json.Unmarshal(raw, &f); err != nil {
|
||
return nil, err
|
||
}
|
||
if f.Entries == nil {
|
||
f.Entries = map[string]string{}
|
||
}
|
||
return f.Entries, nil
|
||
}
|
||
|
||
// Save 加密保存单条凭据（cookie/token 等，值为 JSON 字符串）
|
||
func (v *Vault) Save(accountID string, plaintext []byte) error {
|
||
entries, err := v.load()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
block, err := aes.NewCipher(v.key)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
gcm, err := cipher.NewGCM(block)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
nonce := make([]byte, gcm.NonceSize())
|
||
if _, err = rand.Read(nonce); err != nil {
|
||
return err
|
||
}
|
||
sealed := gcm.Seal(nonce, nonce, plaintext, nil)
|
||
entries[accountID] = base64.StdEncoding.EncodeToString(sealed)
|
||
return v.persist(entries)
|
||
}
|
||
|
||
// Load 解密读取单条凭据
|
||
func (v *Vault) Load(accountID string) ([]byte, error) {
|
||
entries, err := v.load()
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
sealedB64, ok := entries[accountID]
|
||
if !ok {
|
||
return nil, errors.New("entry not found")
|
||
}
|
||
sealed, err := base64.StdEncoding.DecodeString(sealedB64)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
block, err := aes.NewCipher(v.key)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
gcm, err := cipher.NewGCM(block)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if len(sealed) < gcm.NonceSize() {
|
||
return nil, errors.New("entry corrupted")
|
||
}
|
||
nonce, ciphertext := sealed[:gcm.NonceSize()], sealed[gcm.NonceSize():]
|
||
return gcm.Open(nil, nonce, ciphertext, nil)
|
||
}
|
||
|
||
// Delete 删除单条凭据
|
||
func (v *Vault) Delete(accountID string) error {
|
||
entries, err := v.load()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
delete(entries, accountID)
|
||
return v.persist(entries)
|
||
}
|
||
|
||
func (v *Vault) persist(entries map[string]string) error {
|
||
raw, err := json.MarshalIndent(vaultFile{Version: 1, Entries: entries}, "", " ")
|
||
if err != nil {
|
||
return err
|
||
}
|
||
return os.WriteFile(v.path(), raw, 0o600)
|
||
}
|