revert: drop POST /secret write support (back to read-only)

internal/vaultwarden/api_client.go

@@ -1,7 +1,6 @@
 package vaultwarden
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -756,123 +755,6 @@ func (ac *APIClient) doTokenRequest(data url.Values) (*TokenResponse, error) {
 	return &tokenResp, nil
 }
 
-// CipherInput describes a new vault item to create.
-type CipherInput struct {
-	Type     int               // 1=Login, 2=SecureNote, 3=Card, 4=Identity
-	Name     string
-	Notes    string
-	Username string
-	Password string
-	URI      string
-	Fields   map[string]string // custom fields (login only)
-}
-
-// CreateCipher encrypts and writes a new vault item via the Vaultwarden API.
-func (ac *APIClient) CreateCipher(in CipherInput) (string, error) {
-	if err := ac.EnsureValidToken(); err != nil {
-		return "", fmt.Errorf("ensure valid token: %w", err)
-	}
-	ac.mu.RLock()
-	token := ac.accessToken
-	key := ac.symKey
-	ac.mu.RUnlock()
-
-	encName, err := EncryptStr(in.Name, key)
-	if err != nil {
-		return "", fmt.Errorf("encrypt name: %w", err)
-	}
-	var encNotes *string
-	if in.Notes != "" {
-		n, err := EncryptStr(in.Notes, key)
-		if err != nil {
-			return "", fmt.Errorf("encrypt notes: %w", err)
-		}
-		encNotes = &n
-	}
-
-	cipher := map[string]interface{}{
-		"type": in.Type,
-		"name": encName,
-	}
-	if encNotes != nil {
-		cipher["notes"] = *encNotes
-	}
-
-	switch in.Type {
-	case CipherTypeLogin:
-		login := map[string]interface{}{}
-		if in.Username != "" {
-			u, err := EncryptStr(in.Username, key); err == nil {
-				login["username"] = u
-			}
-		}
-		if in.Password != "" {
-			p, err := EncryptStr(in.Password, key); err == nil {
-				login["password"] = p
-			}
-		}
-		if in.URI != "" {
-			u, err := EncryptStr(in.URI, key); err == nil {
-				login["uris"] = []map[string]interface{}{{"uri": u, "match": nil}}
-			}
-		}
-		cipher["login"] = login
-		if len(in.Fields) > 0 {
-			fields := make([]map[string]interface{}, 0, len(in.Fields))
-			for k, v := range in.Fields {
-				fk, err1 := EncryptStr(k, key)
-				fv, err2 := EncryptStr(v, key)
-				if err1 == nil && err2 == nil {
-					fields = append(fields, map[string]interface{}{"name": fk, "value": fv, "type": 0})
-				}
-			}
-			cipher["fields"] = fields
-		}
-	case CipherTypeSecureNote:
-		// notes already set; nothing else to add.
-	case CipherTypeCard, CipherTypeIdentity:
-		// Card/Identity writing is not yet implemented.
-		return "", fmt.Errorf("cipher type %d write not supported yet", in.Type)
-	default:
-		return "", fmt.Errorf("unsupported cipher type: %d", in.Type)
-	}
-
-	body, err := json.Marshal(cipher)
-	if err != nil {
-		return "", fmt.Errorf("marshal cipher: %w", err)
-	}
-
-	req, err := http.NewRequest("POST", ac.baseURL+"/api/ciphers", bytes.NewReader(body))
-	if err != nil {
-		return "", fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := ac.httpClient.Do(req)
-	if err != nil {
-		return "", fmt.Errorf("create cipher request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(resp.Body)
-		return "", fmt.Errorf("create cipher failed (HTTP %d): %s", resp.StatusCode, string(b))
-	}
-
-	var out struct {
-		ID   string `json:"Id"`
-		Name string `json:"Name"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		return "", fmt.Errorf("decode create response: %w", err)
-	}
-	if out.ID == "" {
-		return "", fmt.Errorf("create cipher returned empty id")
-	}
-	return out.ID, nil
-}
-
 // fetchProfileKey gets the encrypted symmetric key from the user's profile.
 // Used when API key login doesn't return the Key in the token response.
 func (ac *APIClient) fetchProfileKey() (string, error) {