6 Commits

Include renames

Author	SHA1	Message	Date
Hermes	7934e58c37	feat: support all cipher types (Login/SecureNote/Card/Identity) ... - decryptCipher: full decrypt for Card (number/cvv/exp/brand) and Identity (all fields) - extractSecret: type-aware output (notes for SecureNote, JSON fields for Card/Identity) - tested: TEST_NOTE (SecureNote) and login secrets resolve by name	2026-08-02 14:01:32 +02:00
Jethro Young	76b82d4dba	Filtering of synchronized secrets on collection, organization, and/or folder (#12) ... * Filtering feature, minor logic changes +: Add IP validation (to properly log IP even when trusted proxy is missing) +: Added synchronization of decrypted organization, collection, and folder names (for filtering purposes) +: Changed sync behavior to prevent collapsing multiple logins with the same name +: Added possibility to filter logins based on organization, collection, and folder name/id in GetSecret +: Added support for space character in secret name validation (it is also properly URL-decoded) * Update README * Fixes related to issues reported by CodeRabbit: +: Changed british use of organisations in README +: Reduced line count in parseSecretFilters by including helper function for filter dimensions resolution +: Added comment clarifying absence of existence checking on dimension IDs as opposed to names +: Removed efensive comma split logic on IPs (redundant due to IPValidation setting on Fiber) +: Changed Query validator to align with name validator (mainly removing hard-coded values) +: Added comments to decryptVaultLabel for clarity +: Change empty SyncNameMaps instance with emptySyncNameMaps helper for consistency +: Add lexical sort for lookupIDByName for deterministic result in case of multiple matches * Bumped logging to warn and added entity metadata in log * Unit tests: +: Added unit tests for every newly introduced or changed function +: Rewrote NewClient constructor to accept optional preloaded data (so it can be used in test scenarios) * Changes requested by CodeRabbit	2026-05-20 23:26:29 +02:00
Thijs Herman	2b4340d8b0	feat: add organization vault support (#3) ... * feat: add organization vault support - Add RSA-OAEP decryption (type 3: SHA-256, type 4: SHA-1) - Decrypt user's RSA private key from sync response (PKCS8 DER) - Decrypt organization keys using user's RSA private key - Route cipher decryption to correct key based on organizationId - Personal vault items continue to work unchanged Adds 11 new unit tests covering: - RSA cipher string parsing (type 3/4) - RSA-OAEP round-trip (SHA-1 and SHA-256) - Private key decrypt/parse round-trip - Org key decrypt + encKey/macKey split - Cipher decryption with org vs personal key - Backward compatibility for personal items Also adds CI/CD pipeline (.github/workflows/ci.yml): - Tests + build on PRs and main pushes - Docker build + push to GHCR on main * fix: split concatenated .gitignore entries * chore: clean up gitignore	2026-02-21 12:08:03 +01:00
Thijs Herman	059f23af2a	chore: fix module path to match GitHub URL, update Makefile GHCR path ... - Module: github.com/thijsherman → github.com/Turbootzz - Makefile: turboot/ → ghcr.io/turbootzz/ - Added docker-push-tag target	2026-02-20 18:18:13 +00:00
Thijs Herman	d2eb2518fe	fix: use deviceType 14 (Server) instead of 10 (Firefox) ... Prevents confusing 'Firefox' login emails from Vaultwarden. Device type 14 = SDK/Server, which better represents this service.	2026-02-20 12:58:39 +00:00
Thijs Herman	9f8ebf2408	feat: replace Bitwarden CLI with native Go API client (#2) ... BREAKING: Removes Node.js/Bitwarden CLI dependency entirely. ## What changed - New native HTTP client talks directly to Vaultwarden API - Bitwarden-compatible crypto in pure Go: - AES-256-CBC + HMAC-SHA256 decryption - PBKDF2-SHA256 and Argon2id key derivation - HKDF key stretching (with legacy fallback) - Auto token refresh (never expires) - Background vault sync (configurable interval, default 5min) - Docker image: ~233MB → ~15MB (pure Alpine, no Node.js) ## New env vars - VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET) - SYNC_INTERVAL (default: 5m) ## Removed - internal/vaultwarden/client_cli.go (CLI interaction) - Bitwarden CLI dependency (Node.js + npm package) - VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars ## Added - internal/vaultwarden/crypto.go (encryption/decryption) - internal/vaultwarden/crypto_test.go (11 unit tests) - internal/vaultwarden/api_client.go (HTTP client) ## Unchanged - External API surface (GET /secret/:name, POST /refresh, GET /health) - All security middleware (auth, IP whitelist, rate limiting)	2026-02-20 13:28:38 +01:00