admin/vw-api
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
34 Commits 1 Branch 0 Tags
07272804e496ca33e991a8520c45d87c439f7f61
Commit Graph
12 Commits
Author SHA1 Message Date
Hermes 7934e58c37 feat: support all cipher types (Login/SecureNote/Card/Identity)
CI / docker (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details 
- decryptCipher: full decrypt for Card (number/cvv/exp/brand) and Identity (all fields)
- extractSecret: type-aware output (notes for SecureNote, JSON fields for Card/Identity)
- tested: TEST_NOTE (SecureNote) and login secrets resolve by name
 2026-08-02 14:01:32 +02:00
Thijs Herman 495edffde3 Harden API-key model: per-key scoping + revocable keys, and configurable/whitelist-aware rate limiting (#16) 
* API scope and rate limiting

* improvements from review
 2026-05-28 11:45:16 +02:00
Jethro Young 76b82d4dba Filtering of synchronized secrets on collection, organization, and/or folder (#12) 
* Filtering feature, minor logic changes
+: Add IP validation (to properly log IP even when trusted proxy is missing)
+: Added synchronization of decrypted organization, collection, and folder names (for filtering purposes)
+: Changed sync behavior to prevent collapsing multiple logins with the same name
+: Added possibility to filter logins based on organization, collection, and folder name/id in GetSecret
+: Added support for space character in secret name validation (it is also properly URL-decoded)

* Update README

* Fixes related to issues reported by CodeRabbit:
+: Changed british use of organisations in README
+: Reduced line count in parseSecretFilters by including helper function for filter dimensions resolution
+: Added comment clarifying absence of existence checking on dimension IDs as opposed to names
+: Removed efensive comma split logic on IPs (redundant due to IPValidation setting on Fiber)
+: Changed Query validator to align with name validator (mainly removing hard-coded values)
+: Added comments to decryptVaultLabel for clarity
+: Change empty SyncNameMaps instance with emptySyncNameMaps helper for consistency
+: Add lexical sort for lookupIDByName for deterministic result in case of multiple matches

* Bumped logging to warn and added entity metadata in log

* Unit tests:
+: Added unit tests for every newly introduced or changed function
+: Rewrote NewClient constructor to accept optional preloaded data (so it can be used in test scenarios)

* Changes requested by CodeRabbit
 2026-05-20 23:26:29 +02:00
Thijs Herman 059f23af2a chore: fix module path to match GitHub URL, update Makefile GHCR path 
- Module: github.com/thijsherman → github.com/Turbootzz
- Makefile: turboot/ → ghcr.io/turbootzz/
- Added docker-push-tag target
 2026-02-20 18:18:13 +00:00
Thijs Herman 9f8ebf2408 feat: replace Bitwarden CLI with native Go API client (#2) 
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.

## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
  - AES-256-CBC + HMAC-SHA256 decryption
  - PBKDF2-SHA256 and Argon2id key derivation
  - HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)

## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)

## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars

## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)

## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)
 2026-02-20 13:28:38 +01:00
Thijs Herman e320f95d9f Security: Redact secret names from production logs & bind port to localhost (#1) 
* security: redact secret names from logs, bind port to localhost

- handlers: replace secret names in Warn/Error logs with client IP
  (prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
  (Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
  (prevents direct access bypassing reverse proxy)

Found during security pen test of vault.turboot.com

* Enhance logging for secret retrieval and cache access
 2026-02-20 12:39:04 +01:00
Turbootzz 70481d0350 fixed Fiber IP security and cleanup code 2025-10-24 21:20:29 +02:00
Turbootzz 3055c413ef added CLI improvments to docker 2025-10-24 19:01:39 +02:00
Turbootzz d7a51a0f60 changed auth method 2025-10-24 18:28:52 +02:00
Turbootzz 1daa409a73 fixed CLI issue 2025-10-24 14:10:01 +02:00
Turbootzz 4131345add security update 2025-10-24 13:25:05 +02:00
Turbootzz 5f937f6213 Added implementation 2025-10-17 13:32:58 +02:00