pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw
ci / vet (pull_request) Failing after 12s

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832
This commit is contained in:
2026-09-06 16:45:45 -05:00
parent f63417b1eb
commit 4728b3cff0
18 changed files with 1304 additions and 0 deletions
+291
View File
@@ -0,0 +1,291 @@
package main
// Vaultwarden/Bitwarden API client: prelogin, login, sync, cipher create/edit.
import (
"bytes"
"encoding/binary"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"net/url"
"os"
"strings"
"time"
)
type Client struct {
Server string // e.g. https://pwvault.turnsys.com
HTTP *http.Client
Email string
Password string
AccessToken string
KDFType int
KDFIter uint32
KDFMemory uint32
KDFParallel uint32
MasterKey []byte // 32B
StretchedKey []byte // 64B
UserSymKey []byte // 64B (decrypted from profile.Key)
}
func (c *Client) api(method, path string, body any, auth bool) ([]byte, error) {
var rd io.Reader
if body != nil {
switch b := body.(type) {
case url.Values:
rd = strings.NewReader(b.Encode())
default:
j, err := json.Marshal(body)
if err != nil {
return nil, err
}
rd = bytes.NewReader(j)
}
} else {
rd = strings.NewReader("")
}
req, err := http.NewRequest(method, c.Server+path, rd)
if err != nil {
return nil, err
}
if body != nil {
if _, ok := body.(url.Values); ok {
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
} else {
req.Header.Set("Content-Type", "application/json")
}
}
if auth {
req.Header.Set("Authorization", "Bearer "+c.AccessToken)
}
resp, err := c.HTTP.Do(req)
if err != nil {
return nil, err
}
defer resp.Body.Close()
out, err := io.ReadAll(resp.Body)
if err != nil {
return nil, err
}
if resp.StatusCode >= 300 {
return out, fmt.Errorf("%s %s: HTTP %d: %s", method, path, resp.StatusCode, truncate(string(out), 200))
}
return out, nil
}
func truncate(s string, n int) string {
if len(s) <= n {
return s
}
return s[:n] + "..."
}
type preloginResp struct {
KDF int `json:"kdf"`
KDFIterations uint32 `json:"kdfIterations"`
KDFMemory uint32 `json:"kdfMemory"`
KDFParallelism uint32 `json:"kdfParallelism"`
}
func (c *Client) Prelogin() error {
out, err := c.api("POST", "/api/accounts/prelogin", map[string]string{"email": c.Email}, false)
if err != nil {
return err
}
var p preloginResp
if err := json.Unmarshal(out, &p); err != nil {
return err
}
c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel = p.KDF, p.KDFIterations, p.KDFMemory, p.KDFParallelism
return nil
}
type tokenResp struct {
AccessToken string `json:"access_token"`
RefreshTok string `json:"refresh_token"`
Key string `json:"Key"`
PrivateKey string `json:"PrivateKey"`
ErrorDesc string `json:"ErrorDescription"`
}
// Login performs prelogin + key derivation + password grant.
func (c *Client) Login() error {
if err := c.Prelogin(); err != nil {
return fmt.Errorf("prelogin: %w", err)
}
c.MasterKey = deriveMasterKey(c.Password, c.Email, c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel)
c.StretchedKey = stretchKey(c.MasterKey)
form := url.Values{}
form.Set("grant_type", "password")
form.Set("username", c.Email)
form.Set("password", masterPasswordHash(c.MasterKey, c.Password))
form.Set("scope", "api offline_access")
form.Set("client_id", "cli")
form.Set("deviceIdentifier", deviceID())
form.Set("deviceName", "smcli")
form.Set("deviceType", "9")
var lastOut []byte
out, err := c.apiRaw("POST", "/identity/connect/token", form, false)
if err != nil {
return fmt.Errorf("token: %w", err)
}
var t tokenResp
if err := json.Unmarshal(out, &t); err != nil {
return err
}
if t.AccessToken == "" {
// 2FA retry path (provider 0 = authenticator TOTP)
if strings.Contains(string(out), "Two factor required") {
secret := os.Getenv("SM_TOTP_SECRET")
if secret != "" {
code, terr := totpNow(secret, time.Now())
if terr != nil {
return fmt.Errorf("totp: %w", terr)
}
form.Set("twoFactor", "0")
form.Set("twoFactorProvider", "0")
form.Set("twoFactorToken", code)
form.Set("twoFactorRemember", "1")
out2, err2 := c.api("POST", "/identity/connect/token", form, false)
if err2 != nil {
return fmt.Errorf("token(2fa): %w", err2)
}
if err := json.Unmarshal(out2, &t); err != nil {
return err
}
lastOut = out2
}
}
}
if t.AccessToken == "" {
payload := string(out)
if lastOut != nil {
payload = string(lastOut)
}
return fmt.Errorf("login failed: %s", truncate(payload, 300))
}
c.AccessToken = t.AccessToken
return nil
}
type syncResp struct {
Profile struct {
Key string `json:"key"`
PrivateKey string `json:"privateKey"`
Email string `json:"email"`
} `json:"profile"`
Folders []struct {
ID string `json:"id"`
Name string `json:"name"`
} `json:"folders"`
Ciphers []json.RawMessage `json:"ciphers"`
}
// Unlock performs sync-light: fetches profile key, decrypts the user sym key.
func (c *Client) Unlock() error {
out, err := c.api("GET", "/api/sync?excludeDomains=true", nil, true)
if err != nil {
return err
}
var s syncResp
if err := json.Unmarshal(out, &s); err != nil {
return err
}
if s.Profile.Key == "" {
return errors.New("sync: empty profile key")
}
es, err := ParseEncString(s.Profile.Key)
if err != nil {
return err
}
c.UserSymKey, err = symDecrypt(c.StretchedKey, es)
if err != nil {
return fmt.Errorf("decrypt user key: %w", err)
}
return nil
}
// Sync returns the raw sync payload (cached by caller as needed).
func (c *Client) Sync() ([]byte, error) {
return c.api("GET", "/api/sync?excludeDomains=true", nil, true)
}
// CreateCipher posts an encrypted cipher.
func (c *Client) CreateCipher(cipherJSON any) ([]byte, error) {
return c.api("POST", "/api/ciphers", cipherJSON, true)
}
// EditCipher updates an encrypted cipher.
func (c *Client) EditCipher(id string, cipherJSON any) ([]byte, error) {
return c.api("PUT", "/api/ciphers/"+id, cipherJSON, true)
}
func deviceID() string {
// stable per machine: hash of hostname (no secrets involved)
hn := hostnameSafe()
sum := sha256Sum([]byte("knel-secretsmgr:" + hn))
var b [16]byte
copy(b[:], sum[:16])
return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
binary.BigEndian.Uint32(b[0:4]),
binary.BigEndian.Uint16(b[4:6]),
binary.BigEndian.Uint16(b[6:8]),
binary.BigEndian.Uint16(b[8:10]),
b[10:16])
}
// apiRaw performs the request and returns the body regardless of status.
func (c *Client) apiRaw(method, path string, body any, auth bool) ([]byte, error) {
var rd io.Reader
if body != nil {
switch b := body.(type) {
case url.Values:
rd = strings.NewReader(b.Encode())
default:
j, err := json.Marshal(body)
if err != nil {
return nil, err
}
rd = bytes.NewReader(j)
}
} else {
rd = strings.NewReader("")
}
req, err := http.NewRequest(method, c.Server+path, rd)
if err != nil {
return nil, err
}
if body != nil {
if _, ok := body.(url.Values); ok {
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
} else {
req.Header.Set("Content-Type", "application/json")
}
}
if auth {
req.Header.Set("Authorization", "Bearer "+c.AccessToken)
}
resp, err := c.HTTP.Do(req)
if err != nil {
return nil, err
}
defer resp.Body.Close()
return io.ReadAll(resp.Body)
}
// DeleteCipher moves a cipher to trash (soft delete). Best-effort permanent
// purge afterwards; Vaultwarden tolerates trash-only items.
func (c *Client) DeleteCipher(id string) error {
if _, err := c.api("DELETE", "/api/ciphers/"+id, nil, true); err != nil {
return err
}
_, _ = c.api("PUT", "/api/ciphers/"+id+"/purge", map[string]any{}, true)
return nil
}