Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Standard password manager

Browse Source
This commit is contained in:
Zaki
2026-05-06 20:49:51 +01:00
commit a4528eb1f7
6 changed files with 1306 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api.php
+273
View File
@@ -0,0 +1,273 @@
<?php
error_reporting(0);
ini_set('display_errors', 0);
set_exception_handler(function($e) {
http_response_code(500);
header('Content-Type: application/json');
echo json_encode(['error' => 'Server error: ' . $e->getMessage()]);
exit;
});
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit(0);
$db_path = __DIR__ . '/vault.db';
$db = new SQLite3($db_path);
$db->enableExceptions(true);
// Create tables
$db->exec("
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
password_hash TEXT NOT NULL,
salt TEXT NOT NULL,
encryption_key TEXT NOT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE IF NOT EXISTS folders (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER NOT NULL,
name TEXT NOT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
UNIQUE(user_id, name)
);
CREATE TABLE IF NOT EXISTS vault_entries (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER NOT NULL,
site TEXT NOT NULL,
username TEXT NOT NULL,
encrypted_password TEXT NOT NULL,
iv TEXT NOT NULL,
encryption_method TEXT DEFAULT 'server',
folder TEXT DEFAULT 'All',
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);
");
// Fix missing columns (existing databases)
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN encryption_method TEXT DEFAULT 'server'"); } catch (Exception $e) {}
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN folder TEXT DEFAULT 'All'"); } catch (Exception $e) {}
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$path = str_replace('/password-manager/api.php', '', $path);
$path = str_replace('/api.php', '', $path);
$method = $_SERVER['REQUEST_METHOD'];
$input = json_decode(file_get_contents('php://input'), true) ?? [];
function genKey($pwd, $salt) { return hash_pbkdf2('sha256', $pwd, $salt, 100000, 32, true); }
function authenticate($db) {
$headers = getallheaders();
$token = str_replace('Bearer ', '', $headers['Authorization'] ?? '');
if (!$token) { http_response_code(401); echo json_encode(['error'=>'No token']); exit; }
$decoded = base64_decode($token);
if (!$decoded) { http_response_code(401); echo json_encode(['error'=>'Bad token']); exit; }
$parts = explode(':', $decoded);
if (count($parts) !== 3) { http_response_code(401); echo json_encode(['error'=>'Token format']); exit; }
$uid = intval($parts[0]);
$key = base64_decode($parts[2]);
$st = $db->prepare('SELECT id, encryption_key FROM users WHERE id=:id');
$st->bindValue(':id', $uid, SQLITE3_INTEGER);
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
if (!$user || $user['encryption_key'] !== base64_encode($key)) { http_response_code(401); echo json_encode(['error'=>'Invalid session']); exit; }
return ['userId' => $uid];
}
try {
switch (true) {
// Auth
case ($path === '/register' && $method === 'POST'):
$u = trim($input['username'] ?? '');
$p = $input['masterPassword'] ?? '';
if (strlen($u) < 3 || strlen($p) < 8) { http_response_code(400); echo json_encode(['error'=>'Min 3/8 chars']); break; }
$st = $db->prepare('SELECT id FROM users WHERE username=:u');
$st->bindValue(':u', $u, SQLITE3_TEXT);
if ($st->execute()->fetchArray()) { http_response_code(409); echo json_encode(['error'=>'Username exists']); break; }
$salt = bin2hex(random_bytes(32));
$hash = hash_pbkdf2('sha256', $p, $salt, 100000);
$key = genKey($p, $salt);
$st = $db->prepare('INSERT INTO users (username, password_hash, salt, encryption_key) VALUES (:u, :h, :s, :k)');
$st->bindValue(':u', $u, SQLITE3_TEXT);
$st->bindValue(':h', $hash, SQLITE3_TEXT);
$st->bindValue(':s', $salt, SQLITE3_TEXT);
$st->bindValue(':k', base64_encode($key), SQLITE3_TEXT);
$st->execute();
$uid = $db->lastInsertRowID();
// Insert default folders
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
foreach ($defaultFolders as $name) {
$stFolder->bindValue(':uid', $uid, SQLITE3_INTEGER);
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
$stFolder->execute();
}
$token = base64_encode($uid . ':' . bin2hex(random_bytes(16)) . ':' . base64_encode($key));
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$uid,'salt'=>$salt]);
break;
case ($path === '/login' && $method === 'POST'):
$u = trim($input['username'] ?? '');
$p = $input['masterPassword'] ?? '';
$st = $db->prepare('SELECT * FROM users WHERE username=:u');
$st->bindValue(':u', $u, SQLITE3_TEXT);
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
if (!$user) { http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break; }
if (!hash_equals($user['password_hash'], hash_pbkdf2('sha256', $p, $user['salt'], 100000))) {
http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break;
}
$key = genKey($p, $user['salt']);
$token = base64_encode($user['id'] . ':' . bin2hex(random_bytes(16)) . ':' . base64_encode($key));
// Ensure default folders exist for existing users (idempotent)
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
foreach ($defaultFolders as $name) {
$stFolder->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
$stFolder->execute();
}
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$user['id'],'salt'=>$user['salt']]);
break;
// Folders
case ($path === '/folders' && $method === 'GET'):
$auth = authenticate($db);
$st = $db->prepare('SELECT name FROM folders WHERE user_id=:uid ORDER BY name');
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$res = $st->execute();
$folders = [];
while ($row = $res->fetchArray(SQLITE3_ASSOC)) {
$folders[] = $row['name'];
}
echo json_encode($folders);
break;
case ($path === '/folders' && $method === 'POST'):
$auth = authenticate($db);
$name = trim($input['name'] ?? '');
if (!$name) { http_response_code(400); echo json_encode(['error'=>'Folder name required']); break; }
if (strtolower($name) === 'all') { http_response_code(400); echo json_encode(['error'=>'Cannot use "All"']); break; }
$st = $db->prepare('INSERT INTO folders (user_id, name) VALUES (:uid, :name)');
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$st->bindValue(':name', $name, SQLITE3_TEXT);
try { $st->execute(); }
catch (Exception $e) { http_response_code(409); echo json_encode(['error'=>'Folder already exists']); break; }
echo json_encode(['message'=>'Folder created', 'name'=>$name]);
break;
case (preg_match('/^\/folders\/(.+)$/', $path, $m) && $method === 'DELETE'):
$auth = authenticate($db);
$folderName = urldecode($m[1]);
if ($folderName === 'All') { http_response_code(400); echo json_encode(['error'=>'Cannot delete All']); break; }
$st = $db->prepare('DELETE FROM folders WHERE user_id=:uid AND name=:name');
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$st->bindValue(':name', $folderName, SQLITE3_TEXT);
$st->execute();
if ($db->changes() === 0) { http_response_code(404); echo json_encode(['error'=>'Folder not found']); break; }
// Update entries that had this folder to 'All'
$stUp = $db->prepare("UPDATE vault_entries SET folder='All' WHERE user_id=:uid AND folder=:f");
$stUp->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$stUp->bindValue(':f', $folderName, SQLITE3_TEXT);
$stUp->execute();
echo json_encode(['message'=>'Deleted']);
break;
// Entries
case ($path === '/entries' && $method === 'GET'):
$auth = authenticate($db);
$q = $_GET['search'] ?? '';
if ($q) {
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid AND (site LIKE :q OR username LIKE :q) ORDER BY updated_at DESC');
$st->bindValue(':q', "%$q%", SQLITE3_TEXT);
} else {
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid ORDER BY updated_at DESC');
}
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$res = $st->execute();
$entries = [];
while ($r = $res->fetchArray(SQLITE3_ASSOC)) {
$entries[] = [
'id' => $r['id'],
'site' => $r['site'],
'username' => $r['username'],
'encrypted_password' => $r['encrypted_password'],
'iv' => $r['iv'],
'encryption_method' => $r['encryption_method'] ?? 'server',
'folder' => $r['folder'] ?? 'All',
'created_at' => $r['created_at'],
'updated_at' => $r['updated_at']
];
}
echo json_encode($entries);
break;
case ($path === '/entries' && $method === 'POST'):
$auth = authenticate($db);
$site = trim($input['site'] ?? '');
$username = trim($input['username'] ?? '');
$folder = trim($input['folder'] ?? 'All');
$encPwd = $input['encrypted_password'] ?? '';
$iv = $input['iv'] ?? '';
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
$now = date('Y-m-d H:i:s');
$st = $db->prepare('INSERT INTO vault_entries (user_id, site, username, encrypted_password, iv, encryption_method, folder, created_at, updated_at) VALUES (:uid,:s,:u,:e,:i,:m,:f,:c,:c)');
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$st->bindValue(':s', $site, SQLITE3_TEXT);
$st->bindValue(':u', $username, SQLITE3_TEXT);
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
$st->bindValue(':i', $iv, SQLITE3_TEXT);
$st->bindValue(':m', 'client', SQLITE3_TEXT);
$st->bindValue(':f', $folder, SQLITE3_TEXT);
$st->bindValue(':c', $now, SQLITE3_TEXT);
$st->execute();
echo json_encode(['id'=>$db->lastInsertRowID(), 'site'=>$site, 'username'=>$username, 'folder'=>$folder]);
break;
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'PUT'):
$auth = authenticate($db);
$site = trim($input['site'] ?? '');
$username = trim($input['username'] ?? '');
$encPwd = $input['encrypted_password'] ?? '';
$iv = $input['iv'] ?? '';
$folder = trim($input['folder'] ?? 'All');
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
$now = date('Y-m-d H:i:s');
$st = $db->prepare('UPDATE vault_entries SET site=:s, username=:u, encrypted_password=:e, iv=:i, folder=:f, updated_at=:c WHERE id=:id AND user_id=:uid');
$st->bindValue(':s', $site, SQLITE3_TEXT);
$st->bindValue(':u', $username, SQLITE3_TEXT);
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
$st->bindValue(':i', $iv, SQLITE3_TEXT);
$st->bindValue(':f', $folder, SQLITE3_TEXT);
$st->bindValue(':c', $now, SQLITE3_TEXT);
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$st->execute();
echo json_encode(['message'=>'Updated']);
break;
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'DELETE'):
$auth = authenticate($db);
$st = $db->prepare('DELETE FROM vault_entries WHERE id=:id AND user_id=:uid');
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
$st->execute();
echo json_encode(['message'=>'Deleted']);
break;
default:
http_response_code(404);
echo json_encode(['error'=>'Not found']);
}
} catch (Exception $e) {
http_response_code(500);
echo json_encode(['error' => $e->getMessage()]);
}
$db->close();
?>