pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

cli/cmd/smcli/model.go

@@ -0,0 +1,203 @@
+package main
+
+// Cipher model: decrypt/encrypt for the operations the lane uses
+// (secure notes with hidden fields; login items for password fields).
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// encStr handles empty/unset gracefully.
+type encFunc func(string) (string, error)
+
+type CipherField struct {
+	Type  int     `json:"type"` // 0=text, 1=hidden, 2=boolean (Bitwarden field type)
+	Name  *string `json:"name,omitempty"`
+	Value *string `json:"value,omitempty"`
+}
+
+type CipherLogin struct {
+	Username *string `json:"username,omitempty"`
+	Password *string `json:"password,omitempty"`
+	URIs     []any   `json:"uris,omitempty"`
+}
+
+type cipherRaw struct {
+	ID            string                 `json:"id"`
+	OrganizationID *string               `json:"organizationId"`
+	Type          int                    `json:"type"` // 1=login, 2=secureNote
+	Name          string                 `json:"name"`
+	Notes         *string                `json:"notes"`
+	Fields        []CipherField          `json:"fields,omitempty"`
+	Key           *string                `json:"key,omitempty"`
+	Login         *CipherLogin           `json:"login,omitempty"`
+	SecureNote    map[string]any         `json:"secureNote,omitempty"`
+	DeletedDate   *string                `json:"deletedDate,omitempty"`
+	Extra         map[string]interface{} `json:"-"`
+}
+
+// cipherKeyFor returns the 64B key to use for a cipher's data.
+func cipherKeyFor(userKey []byte, encKey *string) ([]byte, error) {
+	if encKey == nil || *encKey == "" {
+		return userKey, nil
+	}
+	es, err := ParseEncString(*encKey)
+	if err != nil {
+		return nil, err
+	}
+	return symDecrypt(userKey, es)
+}
+
+func decStr(userKey []byte, cipherKey []byte, s *string) (string, error) {
+	if s == nil || *s == "" {
+		return "", nil
+	}
+	es, err := ParseEncString(*s)
+	if err != nil {
+		return "", err
+	}
+	pt, err := symDecrypt(cipherKey, es)
+	if err != nil {
+		return "", err
+	}
+	return string(pt), nil
+}
+
+func encStr(userKey []byte, s string) (string, error) {
+	if s == "" {
+		return "", nil
+	}
+	return symEncrypt(userKey, []byte(s))
+}
+
+// PlainField is a decrypted custom field.
+type PlainField struct {
+	Type  int    `json:"type"`
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+// PlainCipher is a decrypted item view.
+type PlainCipher struct {
+	ID     string       `json:"id"`
+	Name   string       `json:"name"`
+	Notes  string       `json:"notes"`
+	Type   int          `json:"type"`
+	Fields []PlainField `json:"fields"`
+	Login  struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	} `json:"login"`
+	FolderID string `json:"folderId"`
+}
+
+// DecryptCipher converts a raw sync cipher into PlainCipher.
+func DecryptCipher(userKey []byte, raw []byte) (*PlainCipher, error) {
+	var cr cipherRaw
+	if err := json.Unmarshal(raw, &cr); err != nil {
+		return nil, err
+	}
+	if cr.DeletedDate != nil {
+		return nil, fmt.Errorf("deleted")
+	}
+	ck, err := cipherKeyFor(userKey, cr.Key)
+	if err != nil {
+		return nil, err
+	}
+	pc := &PlainCipher{ID: cr.ID, Type: cr.Type}
+	if pc.Name, err = decStr(userKey, ck, &cr.Name); err != nil {
+		return nil, fmt.Errorf("name: %w", err)
+	}
+	if cr.Notes != nil {
+		if pc.Notes, err = decStr(userKey, ck, cr.Notes); err != nil {
+			return nil, fmt.Errorf("notes: %w", err)
+		}
+	}
+	for _, f := range cr.Fields {
+		pf := PlainField{Type: f.Type}
+		if pf.Name, err = decStr(userKey, ck, f.Name); err != nil {
+			continue
+		}
+		if pf.Value, err = decStr(userKey, ck, f.Value); err != nil {
+			continue
+		}
+		pc.Fields = append(pc.Fields, pf)
+	}
+	if cr.Login != nil {
+		if cr.Login.Username != nil {
+			pc.Login.Username, _ = decStr(userKey, ck, cr.Login.Username)
+		}
+		if cr.Login.Password != nil {
+			pc.Login.Password, _ = decStr(userKey, ck, cr.Login.Password)
+		}
+	}
+	return pc, nil
+}
+
+// BuildSecureNoteJSON produces an encrypted create/update payload for a
+// secure-note item with hidden fields (type 1).
+func BuildSecureNoteJSON(userKey []byte, name, folderID, notes string, fields []PlainField, existing *cipherRaw) (map[string]any, error) {
+	nameEnc, err := encStr(userKey, name)
+	if err != nil {
+		return nil, err
+	}
+	notesEnc, err := encStr(userKey, notes)
+	if err != nil {
+		return nil, err
+	}
+	var encFields []map[string]any
+	for _, f := range fields {
+		fn, err := encStr(userKey, f.Name)
+		if err != nil {
+			return nil, err
+		}
+		fv, err := encStr(userKey, f.Value)
+		if err != nil {
+			return nil, err
+		}
+		encFields = append(encFields, map[string]any{
+			"type": f.Type,
+			"name": fn,
+			"value": fv,
+		})
+	}
+	payload := map[string]any{
+		"type":       2,
+		"name":       nameEnc,
+		"notes":      notesEnc,
+		"fields":     encFields,
+		"secureNote": map[string]any{"type": 0},
+	}
+	if folderID != "" {
+		payload["folderId"] = folderID
+	}
+	if existing != nil {
+		payload["id"] = existing.ID
+		if existing.OrganizationID != nil {
+			payload["organizationId"] = existing.OrganizationID
+		}
+	}
+	return payload, nil
+}
+
+// parseEnvFields parses KEY=VALUE lines (quoted or bare) into hidden fields.
+func parseEnvFields(text string) []PlainField {
+	var out []PlainField
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		eq := strings.Index(line, "=")
+		if eq <= 0 {
+			continue
+		}
+		k := line[:eq]
+		v := line[eq+1:]
+		v = strings.Trim(v, "'\"")
+		out = append(out, PlainField{Type: 1, Name: k, Value: v})
+	}
+	return out
+}