admin/vw-api
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
43 Commits 1 Branch 0 Tags
0ede8f145dfb166526d9af484e804359128fa217
Commit Graph
43 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hermes 0ede8f145d feat: write Card (3) and Identity (4) ciphers
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details 
Add card/identity sub-objects (camelCase serde per Vaultwarden API).
brand/expMonth/expYear sent plaintext; other fields encrypted.
Verified end-to-end: create + read decrypt correctly.
 2026-08-02 19:12:57 +02:00
Hermes b48cb16746 fix: write SecureNote (camelCase secureNote sub-object per Vaultwarden API)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details 
Vaultwarden post_ciphers expects type=2 data in 'secureNote' field
(camelCase serde), not 'notes'/'secure_note'. Verified end-to-end:
SecureNote create + read works; Login write unchanged.
 2026-08-02 19:04:33 +02:00
Hermes b92880d515 feat: re-add POST /secret write support (Login working)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details 
Restore CreateCipher/CreateSecret with fixed syntax (quoted map keys,
pkcs7Unpad restored). Login write verified end-to-end.
 2026-08-02 18:29:18 +02:00
Hermes bb650d9acd revert: drop POST /secret write support (back to read-only)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 17:50:37 +02:00
Hermes ad8d1298ae ci: force rebuild with POST /secret
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 17:38:24 +02:00
Hermes 8801217dd1 feat: add POST /secret to write Login and SecureNote ciphers
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 17:34:44 +02:00
Hermes 0ad0415dba feat: GetSecret returns full item (all fields: username/uri/notes/fields)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 17:17:33 +02:00
Hermes 4fdc94ba44 ci: test autodeploy webhook (POST method fix)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 14:20:29 +02:00
Hermes 0ae4416b0b fix: allow UTF-8 (Cyrillic) secret names in validator
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 14:17:11 +02:00
Hermes 07272804e4 ci: trigger autodeploy webhook test
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details
2026-08-02 14:09:03 +02:00
Hermes 7934e58c37 feat: support all cipher types (Login/SecureNote/Card/Identity)
CI / test (push) Has been cancelled
Details
CI / docker (push) Has been cancelled
Details 
- decryptCipher: full decrypt for Card (number/cvv/exp/brand) and Identity (all fields)
- extractSecret: type-aware output (notes for SecureNote, JSON fields for Card/Identity)
- tested: TEST_NOTE (SecureNote) and login secrets resolve by name
 2026-08-02 14:01:32 +02:00
dependabot[bot] 4408999bb9 chore(ci): bump actions/checkout in the actions-dependencies group (#19) 
Bumps the actions-dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-18 22:47:46 +02:00
dependabot[bot] 710ce19adb chore(docker): bump alpine from 3.23 to 3.24 (#18) 
Bumps alpine from 3.23 to 3.24.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.24'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-18 22:47:24 +02:00
Thijs Herman 495edffde3 Harden API-key model: per-key scoping + revocable keys, and configurable/whitelist-aware rate limiting (#16) 
* API scope and rate limiting

* improvements from review
 2026-05-28 11:45:16 +02:00
dependabot[bot] a400e07ae2 chore(deps): bump the go-dependencies group across 1 directory with 2 updates (#10) 
Bumps the go-dependencies group with 2 updates in the / directory: [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber) and [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `github.com/gofiber/fiber/v2` from 2.52.11 to 2.52.12
- [Release notes](https://github.com/gofiber/fiber/releases)
- [Commits](https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12)

Updates `golang.org/x/crypto` from 0.48.0 to 0.49.0
- [Commits](https://github.com/golang/crypto/compare/v0.48.0...v0.49.0)

---
updated-dependencies:
- dependency-name: github.com/gofiber/fiber/v2
  dependency-version: 2.52.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-23 11:36:17 +02:00
Jethro Young 76b82d4dba Filtering of synchronized secrets on collection, organization, and/or folder (#12) 
* Filtering feature, minor logic changes
+: Add IP validation (to properly log IP even when trusted proxy is missing)
+: Added synchronization of decrypted organization, collection, and folder names (for filtering purposes)
+: Changed sync behavior to prevent collapsing multiple logins with the same name
+: Added possibility to filter logins based on organization, collection, and folder name/id in GetSecret
+: Added support for space character in secret name validation (it is also properly URL-decoded)

* Update README

* Fixes related to issues reported by CodeRabbit:
+: Changed british use of organisations in README
+: Reduced line count in parseSecretFilters by including helper function for filter dimensions resolution
+: Added comment clarifying absence of existence checking on dimension IDs as opposed to names
+: Removed efensive comma split logic on IPs (redundant due to IPValidation setting on Fiber)
+: Changed Query validator to align with name validator (mainly removing hard-coded values)
+: Added comments to decryptVaultLabel for clarity
+: Change empty SyncNameMaps instance with emptySyncNameMaps helper for consistency
+: Add lexical sort for lookupIDByName for deterministic result in case of multiple matches

* Bumped logging to warn and added entity metadata in log

* Unit tests:
+: Added unit tests for every newly introduced or changed function
+: Rewrote NewClient constructor to accept optional preloaded data (so it can be used in test scenarios)

* Changes requested by CodeRabbit
 2026-05-20 23:26:29 +02:00
dependabot[bot] cac042a5c4 chore(ci): bump the actions-dependencies group with 4 updates (#11) 
Bumps the actions-dependencies group with 4 updates: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action) and [docker/build-push-action](https://github.com/docker/build-push-action).


Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4)

Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3...v4)

Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-dependencies
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-dependencies
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-dependencies
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-17 11:34:59 +02:00
dependabot[bot] 6551e31583 chore(docker): bump alpine from 3.21 to 3.23 (#5) 
Bumps alpine from 3.21 to 3.23.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.23'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...
 2026-02-21 12:55:49 +01:00
dependabot[bot] bd1a6e2e12 chore(deps): bump github.com/gofiber/fiber/v2 (#6) 
Bumps the go-dependencies group with 1 update: [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber).


Updates `github.com/gofiber/fiber/v2` from 2.52.9 to 2.52.11
- [Release notes](https://github.com/gofiber/fiber/releases)
- [Commits](https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.11)

---
updated-dependencies:
- dependency-name: github.com/gofiber/fiber/v2
  dependency-version: 2.52.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...
 2026-02-21 12:55:11 +01:00
dependabot[bot] 0f9cf6943f chore(docker): bump golang from 1.25-alpine to 1.26-alpine (#7) 
Bumps golang from 1.25-alpine to 1.26-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26-alpine
  dependency-type: direct:production
...
 2026-02-21 12:54:45 +01:00
Thijs Herman 159eab5d1c chore: multi-arch Docker build (amd64, arm64, armv7) (#4) 
* chore: multi-arch Docker build (amd64, arm64, armv7)

- Remove hardcoded GOARCH=amd64 from Dockerfile, use TARGETARCH ARG
- Add QEMU + buildx to CI for cross-compilation
- Build for linux/amd64, linux/arm64, linux/arm/v7

* chore: update action versions, add dependabot

- actions/checkout v4 → v6
- actions/setup-go v5 → v6
- Add dependabot.yml (monthly checks for Go, Actions, Docker)
 2026-02-21 12:15:43 +01:00
Thijs Herman 2b4340d8b0 feat: add organization vault support (#3) 
* feat: add organization vault support

- Add RSA-OAEP decryption (type 3: SHA-256, type 4: SHA-1)
- Decrypt user's RSA private key from sync response (PKCS8 DER)
- Decrypt organization keys using user's RSA private key
- Route cipher decryption to correct key based on organizationId
- Personal vault items continue to work unchanged

Adds 11 new unit tests covering:
- RSA cipher string parsing (type 3/4)
- RSA-OAEP round-trip (SHA-1 and SHA-256)
- Private key decrypt/parse round-trip
- Org key decrypt + encKey/macKey split
- Cipher decryption with org vs personal key
- Backward compatibility for personal items

Also adds CI/CD pipeline (.github/workflows/ci.yml):
- Tests + build on PRs and main pushes
- Docker build + push to GHCR on main

* fix: split concatenated .gitignore entries

* chore: clean up gitignore
 2026-02-21 12:08:03 +01:00
Thijs Herman f194e85ec0 docs: add setup guide, dedicated user recommendation, troubleshooting 
- How to store secrets in Vaultwarden
- Recommended: dedicated user for security
- Docker Compose alongside existing Vaultwarden
- Troubleshooting table with common errors
 2026-02-20 18:21:14 +00:00
Thijs Herman 059f23af2a chore: fix module path to match GitHub URL, update Makefile GHCR path 
- Module: github.com/thijsherman → github.com/Turbootzz
- Makefile: turboot/ → ghcr.io/turbootzz/
- Added docker-push-tag target
 2026-02-20 18:18:13 +00:00
Thijs Herman eecdb5d0eb docs: update copyright year 2026-02-20 18:15:35 +00:00
Thijs Herman ffdfefea6d docs: fix remaining ~15MB references to ~20MB 2026-02-20 17:15:43 +00:00
Thijs Herman 997805fa79 docs: fix image size, document 2FA bypass env vars 2026-02-20 13:02:18 +00:00
Thijs Herman d2eb2518fe fix: use deviceType 14 (Server) instead of 10 (Firefox) 
Prevents confusing 'Firefox' login emails from Vaultwarden.
Device type 14 = SDK/Server, which better represents this service.
 2026-02-20 12:58:39 +00:00
Thijs Herman 9f8ebf2408 feat: replace Bitwarden CLI with native Go API client (#2) 
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.

## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
  - AES-256-CBC + HMAC-SHA256 decryption
  - PBKDF2-SHA256 and Argon2id key derivation
  - HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)

## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)

## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars

## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)

## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)
 2026-02-20 13:28:38 +01:00
Thijs Herman e320f95d9f Security: Redact secret names from production logs & bind port to localhost (#1) 
* security: redact secret names from logs, bind port to localhost

- handlers: replace secret names in Warn/Error logs with client IP
  (prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
  (Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
  (prevents direct access bypassing reverse proxy)

Found during security pen test of vault.turboot.com

* Enhance logging for secret retrieval and cache access
 2026-02-20 12:39:04 +01:00
Turbootzz 9f41e1a1f7 updated README 2025-10-24 21:32:07 +02:00
Turbootzz 79b436ea6f applied suggestions 2025-10-24 21:26:45 +02:00
Turbootzz 70481d0350 fixed Fiber IP security and cleanup code 2025-10-24 21:20:29 +02:00
Turbootzz 8cea6d1f8c fixed IP whitelist bugs 2025-10-24 20:39:11 +02:00
Turbootzz e48098090d added IP whitelisting 2025-10-24 19:30:56 +02:00
Turbootzz 3055c413ef added CLI improvments to docker 2025-10-24 19:01:39 +02:00
Turbootzz d7a51a0f60 changed auth method 2025-10-24 18:28:52 +02:00
Turbootzz 1daa409a73 fixed CLI issue 2025-10-24 14:10:01 +02:00
Turbootzz 349ebd7562 solved issues 2025-10-24 13:45:17 +02:00
Turbootzz 4131345add security update 2025-10-24 13:25:05 +02:00
Turbootzz 5b9f19e237 supports amd64 2025-10-17 17:35:56 +02:00
Turbootzz 5f937f6213 Added implementation 2025-10-17 13:32:58 +02:00
Thijs Herman 6ae6201dad Initial commit 2025-10-17 12:56:43 +02:00