Thijs Herman
9f8ebf2408
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely. ## What changed - New native HTTP client talks directly to Vaultwarden API - Bitwarden-compatible crypto in pure Go: - AES-256-CBC + HMAC-SHA256 decryption - PBKDF2-SHA256 and Argon2id key derivation - HKDF key stretching (with legacy fallback) - Auto token refresh (never expires) - Background vault sync (configurable interval, default 5min) - Docker image: ~233MB → ~15MB (pure Alpine, no Node.js) ## New env vars - VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET) - SYNC_INTERVAL (default: 5m) ## Removed - internal/vaultwarden/client_cli.go (CLI interaction) - Bitwarden CLI dependency (Node.js + npm package) - VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars ## Added - internal/vaultwarden/crypto.go (encryption/decryption) - internal/vaultwarden/crypto_test.go (11 unit tests) - internal/vaultwarden/api_client.go (HTTP client) ## Unchanged - External API surface (GET /secret/:name, POST /refresh, GET /health) - All security middleware (auth, IP whitelist, rate limiting)
73 lines
1.8 KiB
Go
73 lines
1.8 KiB
Go
// Package handlers provides HTTP request handlers for the API.
|
|
package handlers
|
|
|
|
import (
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/thijsherman/vaultwarden-api/internal/validators"
|
|
"github.com/thijsherman/vaultwarden-api/internal/vaultwarden"
|
|
"github.com/thijsherman/vaultwarden-api/pkg/logger"
|
|
)
|
|
|
|
// Handler contains all HTTP handlers.
|
|
type Handler struct {
|
|
vaultClient *vaultwarden.Client
|
|
}
|
|
|
|
// NewHandler creates a new handler instance.
|
|
func NewHandler(vaultClient *vaultwarden.Client) *Handler {
|
|
return &Handler{
|
|
vaultClient: vaultClient,
|
|
}
|
|
}
|
|
|
|
// HealthCheck handles GET /health.
|
|
func (h *Handler) HealthCheck(c *fiber.Ctx) error {
|
|
return c.JSON(fiber.Map{
|
|
"status": "ok",
|
|
"service": "vaultwarden-api",
|
|
})
|
|
}
|
|
|
|
// GetSecret handles GET /secret/:name.
|
|
func (h *Handler) GetSecret(c *fiber.Ctx) error {
|
|
secretName := c.Params("name")
|
|
|
|
if secretName == "" {
|
|
logger.Warn.Println("Secret name not provided")
|
|
return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
|
|
"error": "secret name is required",
|
|
})
|
|
}
|
|
|
|
if !validators.IsValidSecretName(secretName) {
|
|
logger.Warn.Printf("Invalid secret name format attempted from IP: %s", c.IP())
|
|
return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
|
|
"error": "invalid secret name format",
|
|
})
|
|
}
|
|
|
|
value, err := h.vaultClient.GetSecret(secretName)
|
|
if err != nil {
|
|
logger.Error.Printf("Failed to fetch secret (requested by IP: %s)", c.IP())
|
|
return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
|
|
"error": "secret not found",
|
|
})
|
|
}
|
|
|
|
return c.JSON(fiber.Map{
|
|
"name": secretName,
|
|
"value": value,
|
|
})
|
|
}
|
|
|
|
// RefreshCache handles POST /refresh.
|
|
func (h *Handler) RefreshCache(c *fiber.Ctx) error {
|
|
h.vaultClient.ClearCache()
|
|
|
|
logger.Info.Println("Cache refresh requested")
|
|
return c.JSON(fiber.Map{
|
|
"status": "ok",
|
|
"message": "cache cleared successfully",
|
|
})
|
|
}
|