From 37653bf2b2f2dd721e18c6fc9df276a5f293d272 Mon Sep 17 00:00:00 2001 From: crschnick Date: Thu, 23 Jul 2026 00:49:06 +0000 Subject: [PATCH] Rework --- .../io/xpipe/app/secret/EncryptionToken.java | 18 ++--------- .../app/storage/DataStorageMigration.java | 3 ++ .../xpipe/app/storage/DataStorageSecret.java | 31 ++++++++++++------- .../io/xpipe/app/util/AppJacksonModule.java | 4 +-- 4 files changed, 27 insertions(+), 29 deletions(-) diff --git a/app/src/main/java/io/xpipe/app/secret/EncryptionToken.java b/app/src/main/java/io/xpipe/app/secret/EncryptionToken.java index b95b8ccff..aea97fb40 100644 --- a/app/src/main/java/io/xpipe/app/secret/EncryptionToken.java +++ b/app/src/main/java/io/xpipe/app/secret/EncryptionToken.java @@ -8,13 +8,11 @@ import lombok.Builder; import lombok.EqualsAndHashCode; import lombok.Getter; import lombok.ToString; -import lombok.extern.jackson.Jacksonized; import javax.crypto.SecretKey; @EqualsAndHashCode @Builder -@Jacksonized @ToString public class EncryptionToken { @@ -34,20 +32,10 @@ public class EncryptionToken { @JsonIgnore private EncryptionToken usedUserToken; - public static void invalidateUserToken() { + public static void invalidateTokens() { + vaultToken = null; userToken = null; - } - - public static EncryptionToken createMigrated(String s, SecretKey secretKey) { - var v = - new PasswordLockSecretValue(s.toCharArray()) { - @Override - protected SecretKey getSecretKey() { - return secretKey; - } - }; - var userCrypt = v.getEncryptedValue(); - return EncryptionToken.builder().token(userCrypt).build(); + groupToken = null; } private static EncryptionToken createUserToken() { diff --git a/app/src/main/java/io/xpipe/app/storage/DataStorageMigration.java b/app/src/main/java/io/xpipe/app/storage/DataStorageMigration.java index 9319d0cca..47a211cc2 100644 --- a/app/src/main/java/io/xpipe/app/storage/DataStorageMigration.java +++ b/app/src/main/java/io/xpipe/app/storage/DataStorageMigration.java @@ -2,6 +2,7 @@ package io.xpipe.app.storage; import io.xpipe.app.core.AppVersion; import io.xpipe.app.issue.ErrorEventFactory; +import io.xpipe.app.secret.EncryptionToken; import org.apache.commons.io.FileUtils; import java.io.IOException; @@ -70,6 +71,8 @@ public class DataStorageMigration { .handle(); } + EncryptionToken.invalidateTokens(); + DataStorageUserHandler.getInstance().migrate(); getStorage().forceRewrite(); diff --git a/app/src/main/java/io/xpipe/app/storage/DataStorageSecret.java b/app/src/main/java/io/xpipe/app/storage/DataStorageSecret.java index 40d3d6ecc..4f0bbd06d 100644 --- a/app/src/main/java/io/xpipe/app/storage/DataStorageSecret.java +++ b/app/src/main/java/io/xpipe/app/storage/DataStorageSecret.java @@ -1,9 +1,11 @@ package io.xpipe.app.storage; +import com.fasterxml.jackson.databind.node.TextNode; import io.xpipe.app.prefs.AppPrefs; import io.xpipe.app.secret.EncryptionToken; import io.xpipe.app.secret.PasswordLockSecretValue; import io.xpipe.app.secret.VaultKeySecretValue; +import io.xpipe.app.util.Base64Helper; import io.xpipe.core.EncryptedSecretValue; import io.xpipe.core.InPlaceSecretValue; import io.xpipe.core.JacksonMapper; @@ -17,6 +19,7 @@ import lombok.Getter; import lombok.ToString; import java.io.IOException; +import java.util.Base64; import java.util.UUID; @EqualsAndHashCode @@ -58,7 +61,7 @@ public class DataStorageSecret { return null; } - var secret = JacksonMapper.getDefault().treeToValue(secretNode, SecretValue.class); + var secret = VaultKeySecretValue.builder().encryptedValue(SecretValue.toBase64e(Base64Helper.fromBase64UrlString(secretNode.textValue()))).build().inPlace(); var token = JacksonMapper.getDefault().treeToValue(tokenNode, EncryptionToken.class); return new DataStorageSecret(token, secretNode, secret.inPlace()); } @@ -139,16 +142,9 @@ public class DataStorageSecret { } private void rewrite(boolean allowUserSecretKey) { - var handler = DataStorageUserHandler.getInstance(); - if (handler != null && handler.getActiveUser() != null && allowUserSecretKey) { - var val = new PasswordLockSecretValue(getSecret()); - originalNode = JacksonMapper.getDefault().valueToTree(val); - encryptedToken = EncryptionToken.ofUser(); - return; - } - - var val = new VaultKeySecretValue(getSecret()); - originalNode = JacksonMapper.getDefault().valueToTree(val); + var enc = new VaultKeySecretValue(secret.getSecret()).getEncryptedValue(); + var encFixed = Base64Helper.toBase64Url(SecretValue.fromBase64e(enc)); + originalNode = new TextNode(encFixed); encryptedToken = EncryptionToken.ofVaultKey(); } @@ -157,6 +153,10 @@ public class DataStorageSecret { return null; } + if (originalNode == null || requiresRewrite(allowUserSecretKey)) { + rewrite(allowUserSecretKey); + } + var mapper = JacksonMapper.getDefault(); var tree = JsonNodeFactory.instance.objectNode(); tree.put("name", "vault"); @@ -164,7 +164,14 @@ public class DataStorageSecret { tree.put("iteration", 1); tree.set("secret", getOriginalNode()); tree.set("token", mapper.valueToTree(getEncryptedToken())); - return tree; + + var secrets = JsonNodeFactory.instance.arrayNode(); + secrets.add(tree); + + var rootNode = JsonNodeFactory.instance.objectNode(); + rootNode.set("secrets", secrets); + + return rootNode; } public char[] getSecret() { diff --git a/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java b/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java index e7eb5bee5..ab7ce6310 100644 --- a/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java +++ b/app/src/main/java/io/xpipe/app/util/AppJacksonModule.java @@ -106,7 +106,7 @@ public class AppJacksonModule extends SimpleModule { @Override public void serialize(EncryptionToken value, JsonGenerator jgen, SerializerProvider context) throws IOException { - jgen.writeString(value.getToken()); + jgen.writeString(Base64Helper.toBase64Url(SecretValue.fromBase64e(value.getToken()))); } } @@ -117,7 +117,7 @@ public class AppJacksonModule extends SimpleModule { JsonNode tree = p.getCodec().readTree(p); if (tree.isValueNode()) { var s = tree.asText(); - return s != null ? EncryptionToken.builder().token(s).build() : null; + return s != null ? EncryptionToken.builder().token(SecretValue.toBase64e(Base64Helper.fromBase64UrlString(s))).build() : null; } else { var token = tree.required("token").asText(); return token != null ? EncryptionToken.builder().token(token).build() : null;