Rework

app/src/main/java/io/xpipe/app/secret/EncryptionToken.java

@@ -8,13 +8,11 @@ import lombok.Builder;
 import lombok.EqualsAndHashCode;
 import lombok.Getter;
 import lombok.ToString;
-import lombok.extern.jackson.Jacksonized;
 
 import javax.crypto.SecretKey;
 
 @EqualsAndHashCode
 @Builder
-@Jacksonized
 @ToString
 public class EncryptionToken {
 
@@ -34,20 +32,10 @@ public class EncryptionToken {
     @JsonIgnore
     private EncryptionToken usedUserToken;
 
-    public static void invalidateUserToken() {
+    public static void invalidateTokens() {
+        vaultToken = null;
         userToken = null;
-    }
-
-    public static EncryptionToken createMigrated(String s, SecretKey secretKey) {
-        var v =
-                new PasswordLockSecretValue(s.toCharArray()) {
-                    @Override
-                    protected SecretKey getSecretKey() {
-                        return secretKey;
-                    }
-                };
-        var userCrypt = v.getEncryptedValue();
-        return EncryptionToken.builder().token(userCrypt).build();
+        groupToken = null;
     }
 
     private static EncryptionToken createUserToken() {

app/src/main/java/io/xpipe/app/storage/DataStorageMigration.java

@@ -2,6 +2,7 @@ package io.xpipe.app.storage;
 
 import io.xpipe.app.core.AppVersion;
 import io.xpipe.app.issue.ErrorEventFactory;
+import io.xpipe.app.secret.EncryptionToken;
 import org.apache.commons.io.FileUtils;
 
 import java.io.IOException;
@@ -70,6 +71,8 @@ public class DataStorageMigration {
                     .handle();
         }
 
+        EncryptionToken.invalidateTokens();
+
         DataStorageUserHandler.getInstance().migrate();
 
         getStorage().forceRewrite();

app/src/main/java/io/xpipe/app/storage/DataStorageSecret.java

@@ -1,9 +1,11 @@
 package io.xpipe.app.storage;
 
+import com.fasterxml.jackson.databind.node.TextNode;
 import io.xpipe.app.prefs.AppPrefs;
 import io.xpipe.app.secret.EncryptionToken;
 import io.xpipe.app.secret.PasswordLockSecretValue;
 import io.xpipe.app.secret.VaultKeySecretValue;
+import io.xpipe.app.util.Base64Helper;
 import io.xpipe.core.EncryptedSecretValue;
 import io.xpipe.core.InPlaceSecretValue;
 import io.xpipe.core.JacksonMapper;
@@ -17,6 +19,7 @@ import lombok.Getter;
 import lombok.ToString;
 
 import java.io.IOException;
+import java.util.Base64;
 import java.util.UUID;
 
 @EqualsAndHashCode
@@ -58,7 +61,7 @@ public class DataStorageSecret {
                 return null;
             }
 
-            var secret = JacksonMapper.getDefault().treeToValue(secretNode, SecretValue.class);
+            var secret = VaultKeySecretValue.builder().encryptedValue(SecretValue.toBase64e(Base64Helper.fromBase64UrlString(secretNode.textValue()))).build().inPlace();
             var token = JacksonMapper.getDefault().treeToValue(tokenNode, EncryptionToken.class);
             return new DataStorageSecret(token, secretNode, secret.inPlace());
         }
@@ -139,16 +142,9 @@ public class DataStorageSecret {
     }
 
     private void rewrite(boolean allowUserSecretKey) {
-        var handler = DataStorageUserHandler.getInstance();
-        if (handler != null && handler.getActiveUser() != null && allowUserSecretKey) {
-            var val = new PasswordLockSecretValue(getSecret());
-            originalNode = JacksonMapper.getDefault().valueToTree(val);
-            encryptedToken = EncryptionToken.ofUser();
-            return;
-        }
-
-        var val = new VaultKeySecretValue(getSecret());
-        originalNode = JacksonMapper.getDefault().valueToTree(val);
+        var enc = new VaultKeySecretValue(secret.getSecret()).getEncryptedValue();
+        var encFixed = Base64Helper.toBase64Url(SecretValue.fromBase64e(enc));
+        originalNode = new TextNode(encFixed);
         encryptedToken = EncryptionToken.ofVaultKey();
     }
 
@@ -157,6 +153,10 @@ public class DataStorageSecret {
             return null;
         }
 
+        if (originalNode == null || requiresRewrite(allowUserSecretKey)) {
+            rewrite(allowUserSecretKey);
+        }
+
         var mapper = JacksonMapper.getDefault();
         var tree = JsonNodeFactory.instance.objectNode();
         tree.put("name", "vault");
@@ -164,7 +164,14 @@ public class DataStorageSecret {
         tree.put("iteration", 1);
         tree.set("secret", getOriginalNode());
         tree.set("token", mapper.valueToTree(getEncryptedToken()));
-        return tree;
+
+        var secrets = JsonNodeFactory.instance.arrayNode();
+        secrets.add(tree);
+
+        var rootNode = JsonNodeFactory.instance.objectNode();
+        rootNode.set("secrets", secrets);
+
+        return rootNode;
     }
 
     public char[] getSecret() {

app/src/main/java/io/xpipe/app/util/AppJacksonModule.java

@@ -106,7 +106,7 @@ public class AppJacksonModule extends SimpleModule {
 
         @Override
         public void serialize(EncryptionToken value, JsonGenerator jgen, SerializerProvider context) throws IOException {
-            jgen.writeString(value.getToken());
+            jgen.writeString(Base64Helper.toBase64Url(SecretValue.fromBase64e(value.getToken())));
         }
     }
 
@@ -117,7 +117,7 @@ public class AppJacksonModule extends SimpleModule {
             JsonNode tree = p.getCodec().readTree(p);
             if (tree.isValueNode()) {
                 var s = tree.asText();
-                return s != null ? EncryptionToken.builder().token(s).build() : null;
+                return s != null ? EncryptionToken.builder().token(SecretValue.toBase64e(Base64Helper.fromBase64UrlString(s))).build() : null;
             } else {
                 var token = tree.required("token").asText();
                 return token != null ? EncryptionToken.builder().token(token).build() : null;