Zaki
46d7ca3694
Content-Security-Policy: default-src 'self'; restricts external resource loading. Session rotation: delete all existing sessions for a user on login, so re-logging invalidates any leaked tokens.
670 lines
36 KiB
PHP
670 lines
36 KiB
PHP
<?php
|
|
error_reporting(0);
|
|
ini_set('display_errors', 0);
|
|
|
|
$logFile = __DIR__ . '/vault-error.log';
|
|
|
|
set_exception_handler(function($e) use ($logFile) {
|
|
file_put_contents($logFile, '[' . date('Y-m-d H:i:s') . '] FATAL: ' . $e->getMessage() . PHP_EOL, FILE_APPEND);
|
|
http_response_code(500);
|
|
header('Content-Type: application/json');
|
|
echo json_encode(['error' => 'Internal server error']);
|
|
exit;
|
|
});
|
|
|
|
header('Content-Type: application/json');
|
|
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
|
|
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'");
|
|
|
|
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
|
|
if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) {
|
|
header('Access-Control-Allow-Origin: ' . $origin);
|
|
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
|
|
header('Access-Control-Allow-Headers: Content-Type, Authorization');
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit(0);
|
|
|
|
$db_path = __DIR__ . '/vault.db';
|
|
$db = new SQLite3($db_path);
|
|
$db->enableExceptions(true);
|
|
$db->busyTimeout(5000);
|
|
|
|
$db->exec("
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
username TEXT UNIQUE NOT NULL,
|
|
password_hash TEXT NOT NULL,
|
|
salt TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS folders (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
name TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
|
|
UNIQUE(user_id, name)
|
|
);
|
|
CREATE TABLE IF NOT EXISTS vault_entries (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
site TEXT NOT NULL,
|
|
username TEXT NOT NULL,
|
|
encrypted_password TEXT NOT NULL,
|
|
iv TEXT NOT NULL,
|
|
encryption_method TEXT DEFAULT 'server',
|
|
folder TEXT DEFAULT 'All',
|
|
deleted INTEGER DEFAULT 0,
|
|
deleted_at DATETIME,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
token_hash TEXT UNIQUE NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
expires_at DATETIME NOT NULL,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
|
);
|
|
CREATE TABLE IF NOT EXISTS login_attempts (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
ip TEXT NOT NULL,
|
|
attempted_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS audit_log (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER,
|
|
action TEXT NOT NULL,
|
|
ip TEXT,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
");
|
|
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN encryption_method TEXT DEFAULT 'server'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN folder TEXT DEFAULT 'All'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN deleted INTEGER DEFAULT 0"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN deleted_at DATETIME"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE users DROP COLUMN encryption_key"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE users ADD COLUMN hash_algo TEXT DEFAULT 'pbkdf2'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE sessions ADD COLUMN csrf_token TEXT"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN favorite INTEGER DEFAULT 0"); } catch (Exception $e) {}
|
|
|
|
$db->exec("
|
|
CREATE TABLE IF NOT EXISTS passkey_challenges (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER,
|
|
challenge BLOB NOT NULL,
|
|
type TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS passkey_credentials (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
credential_id BLOB NOT NULL UNIQUE,
|
|
public_key BLOB NOT NULL,
|
|
counter INTEGER DEFAULT 0,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
|
);
|
|
");
|
|
$db->exec("DELETE FROM sessions WHERE expires_at < datetime('now')");
|
|
$db->exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-15 minutes')");
|
|
$db->exec("DELETE FROM audit_log WHERE created_at < datetime('now', '-30 days')");
|
|
$db->exec("DELETE FROM passkey_challenges WHERE created_at < datetime('now', '-10 minutes')");
|
|
|
|
function getClientIP() {
|
|
$headers = getallheaders();
|
|
return $headers['X-Forwarded-For'] ?? $_SERVER['REMOTE_ADDR'] ?? 'unknown';
|
|
}
|
|
|
|
function checkRateLimit($db) {
|
|
$ip = getClientIP();
|
|
$window = gmdate('Y-m-d H:i:s', strtotime('-15 minutes'));
|
|
$st = $db->prepare('SELECT COUNT(*) as cnt FROM login_attempts WHERE ip=:ip AND attempted_at > :window');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->bindValue(':window', $window, SQLITE3_TEXT);
|
|
$row = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
return (int)($row['cnt'] ?? 0);
|
|
}
|
|
|
|
function recordAttempt($db) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('INSERT INTO login_attempts (ip) VALUES (:ip)');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function clearAttempts($db) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('DELETE FROM login_attempts WHERE ip=:ip');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function logAudit($db, $userId, $action) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('INSERT INTO audit_log (user_id, action, ip) VALUES (:uid, :action, :ip)');
|
|
$st->bindValue(':uid', $userId, SQLITE3_INTEGER);
|
|
$st->bindValue(':action', $action, SQLITE3_TEXT);
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function requireCSRF($db, $userId) {
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') return;
|
|
$headers = getallheaders();
|
|
$csrfToken = $headers['X-CSRF-Token'] ?? '';
|
|
if (!$csrfToken) { http_response_code(403); echo json_encode(['error'=>'Missing CSRF token']); exit; }
|
|
$st = $db->prepare('SELECT csrf_token FROM sessions WHERE user_id=:uid AND expires_at > datetime(\'now\') ORDER BY created_at DESC LIMIT 1');
|
|
$st->bindValue(':uid', $userId, SQLITE3_INTEGER);
|
|
$row = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$row || !hash_equals($row['csrf_token'], $csrfToken)) {
|
|
http_response_code(403); echo json_encode(['error'=>'Invalid CSRF token']); exit;
|
|
}
|
|
}
|
|
|
|
// ==================== WebAuthn helpers ====================
|
|
function b64url_encode($d) { return rtrim(strtr(base64_encode($d), '+/', '-_'), '='); }
|
|
function b64url_decode($d) { return base64_decode(strtr($d, '-_', '+/')); }
|
|
|
|
function cbor_decode(&$d, &$o=0) {
|
|
$b = ord($d[$o]); $m = ($b>>5)&7; $a = $b&0x1f; $o++;
|
|
if ($a < 24) $v = $a;
|
|
elseif ($a === 24) { $v = ord($d[$o]); $o++; }
|
|
elseif ($a === 25) { $v = unpack('n', substr($d,$o,2))[1]; $o+=2; }
|
|
elseif ($a === 26) { $v = unpack('N', substr($d,$o,4))[1]; $o+=4; }
|
|
elseif ($a === 27) { $v = unpack('J', substr($d,$o,8))[1]; $o+=8; }
|
|
else throw new Exception('CBOR: unsupported additional info');
|
|
switch ($m) {
|
|
case 0: return $v;
|
|
case 1: return -1-$v;
|
|
case 2: $s = substr($d,$o,$v); $o+=$v; return $s;
|
|
case 3: $s = substr($d,$o,$v); $o+=$v; return $s;
|
|
case 4: $r=[]; for($i=0;$i<$v;$i++) $r[]=cbor_decode($d,$o); return $r;
|
|
case 5: $r=[]; for($i=0;$i<$v;$i++){$k=cbor_decode($d,$o); $r[$k]=cbor_decode($d,$o);} return $r;
|
|
case 7: if($a===20)return false; if($a===21)return true; if($a===22)return null; return $v;
|
|
default: throw new Exception('CBOR: unsupported major type '.$m);
|
|
}
|
|
}
|
|
|
|
function derLen($l) {
|
|
if ($l < 128) return chr($l);
|
|
$b = ''; while ($l > 0) { $b = chr($l&0xff).$b; $l>>=8; }
|
|
return chr(0x80|strlen($b)).$b;
|
|
}
|
|
|
|
function coseToPem($key) {
|
|
$alg = $key[3] ?? 0;
|
|
if ($alg !== -7) return null; // only ES256
|
|
$x = $key[-2] ?? ''; $y = $key[-3] ?? '';
|
|
if (strlen($x) !== 32 || strlen($y) !== 32) return null;
|
|
$point = "\x04".$x.$y;
|
|
$algId = "\x06\x07\x2a\x86\x48\xce\x3d\x02\x01". // ecPublicKey OID
|
|
"\x06\x08\x2a\x86\x48\xce\x3d\x03\x01\x07"; // P-256 OID
|
|
$bs = "\x03".derLen(strlen($point)+1)."\x00".$point;
|
|
$inner = "\x30".derLen(strlen($algId)).$algId;
|
|
$outer = $inner.$bs;
|
|
$der = "\x30".derLen(strlen($outer)).$outer;
|
|
return "-----BEGIN PUBLIC KEY-----\n".chunk_split(base64_encode($der), 64, "\n")."-----END PUBLIC KEY-----";
|
|
}
|
|
|
|
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
|
|
$path = str_replace('/password-manager/api.php', '', $path);
|
|
$path = str_replace('/api.php', '', $path);
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$input = json_decode(file_get_contents('php://input'), true) ?? [];
|
|
|
|
function authenticate($db) {
|
|
$headers = getallheaders();
|
|
$token = str_replace('Bearer ', '', $headers['Authorization'] ?? '');
|
|
if (!$token) { http_response_code(401); echo json_encode(['error'=>'No token']); exit; }
|
|
$tokenHash = hash('sha256', $token);
|
|
$st = $db->prepare('SELECT user_id, expires_at FROM sessions WHERE token_hash=:th');
|
|
$st->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$session = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$session) { http_response_code(401); echo json_encode(['error'=>'Invalid session']); exit; }
|
|
if (strtotime($session['expires_at']) < time()) {
|
|
$del = $db->prepare('DELETE FROM sessions WHERE token_hash=:th');
|
|
$del->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$del->execute();
|
|
http_response_code(401); echo json_encode(['error'=>'Session expired']); exit;
|
|
}
|
|
return ['userId' => (int)$session['user_id']];
|
|
}
|
|
|
|
try {
|
|
switch (true) {
|
|
case ($path === '/register' && $method === 'POST'):
|
|
if (checkRateLimit($db) >= 5) { http_response_code(429); echo json_encode(['error'=>'Too many attempts. Try again later.']); break; }
|
|
$u = trim($input['username'] ?? '');
|
|
$p = $input['masterPassword'] ?? '';
|
|
if (strlen($u) < 3 || strlen($p) < 8) { http_response_code(400); echo json_encode(['error'=>'Min 3/8 chars']); break; }
|
|
$st = $db->prepare('SELECT id FROM users WHERE username=:u');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
if ($st->execute()->fetchArray()) { http_response_code(409); echo json_encode(['error'=>'Username exists']); break; }
|
|
$salt = bin2hex(random_bytes(32));
|
|
$hash = password_hash($p, PASSWORD_BCRYPT);
|
|
$st = $db->prepare('INSERT INTO users (username, password_hash, salt, hash_algo) VALUES (:u, :h, :s, :algo)');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
$st->bindValue(':h', $hash, SQLITE3_TEXT);
|
|
$st->bindValue(':s', $salt, SQLITE3_TEXT);
|
|
$st->bindValue(':algo', 'bcrypt', SQLITE3_TEXT);
|
|
$st->execute();
|
|
$uid = $db->lastInsertRowID();
|
|
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
|
|
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
foreach ($defaultFolders as $name) {
|
|
$stFolder->bindValue(':uid', $uid, SQLITE3_INTEGER);
|
|
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
|
|
$stFolder->execute();
|
|
}
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$csrfToken = bin2hex(random_bytes(32));
|
|
$expires = date('Y-m-d H:i:s', strtotime('+24 hours'));
|
|
$stS = $db->prepare('INSERT INTO sessions (user_id, token_hash, csrf_token, expires_at) VALUES (:uid, :th, :csrf, :exp)');
|
|
$stS->bindValue(':uid', $uid, SQLITE3_INTEGER);
|
|
$stS->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$stS->bindValue(':csrf', $csrfToken, SQLITE3_TEXT);
|
|
$stS->bindValue(':exp', $expires, SQLITE3_TEXT);
|
|
$stS->execute();
|
|
logAudit($db, $uid, 'register');
|
|
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$uid,'salt'=>$salt,'csrfToken'=>$csrfToken]);
|
|
break;
|
|
|
|
case ($path === '/login' && $method === 'POST'):
|
|
if (checkRateLimit($db) >= 10) { http_response_code(429); echo json_encode(['error'=>'Too many attempts. Try again later.']); break; }
|
|
$u = trim($input['username'] ?? '');
|
|
$p = $input['masterPassword'] ?? '';
|
|
$st = $db->prepare('SELECT * FROM users WHERE username=:u');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$user) { recordAttempt($db); http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break; }
|
|
$algo = $user['hash_algo'] ?? 'pbkdf2';
|
|
if ($algo === 'bcrypt') {
|
|
$valid = password_verify($p, $user['password_hash']);
|
|
} else {
|
|
$valid = hash_equals($user['password_hash'], hash_pbkdf2('sha256', $p, $user['salt'], 100000));
|
|
}
|
|
if (!$valid) { recordAttempt($db); logAudit($db, $user['id'], 'failed_login'); http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break; }
|
|
if ($algo !== 'bcrypt') {
|
|
$newHash = password_hash($p, PASSWORD_BCRYPT);
|
|
$upd = $db->prepare('UPDATE users SET password_hash=:h, hash_algo=:algo WHERE id=:uid');
|
|
$upd->bindValue(':h', $newHash, SQLITE3_TEXT);
|
|
$upd->bindValue(':algo', 'bcrypt', SQLITE3_TEXT);
|
|
$upd->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$upd->execute();
|
|
}
|
|
clearAttempts($db);
|
|
$delSessions = $db->prepare('DELETE FROM sessions WHERE user_id=:uid');
|
|
$delSessions->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$delSessions->execute();
|
|
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
|
|
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
foreach ($defaultFolders as $name) {
|
|
$stFolder->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
|
|
$stFolder->execute();
|
|
}
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$csrfToken = bin2hex(random_bytes(32));
|
|
$expires = date('Y-m-d H:i:s', strtotime('+24 hours'));
|
|
$stS = $db->prepare('INSERT INTO sessions (user_id, token_hash, csrf_token, expires_at) VALUES (:uid, :th, :csrf, :exp)');
|
|
$stS->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$stS->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$stS->bindValue(':csrf', $csrfToken, SQLITE3_TEXT);
|
|
$stS->bindValue(':exp', $expires, SQLITE3_TEXT);
|
|
$stS->execute();
|
|
logAudit($db, $user['id'], 'login');
|
|
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$user['id'],'salt'=>$user['salt'],'csrfToken'=>$csrfToken]);
|
|
break;
|
|
|
|
case ($path === '/folders' && $method === 'GET'):
|
|
$auth = authenticate($db);
|
|
$st = $db->prepare('SELECT name FROM folders WHERE user_id=:uid ORDER BY name');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$res = $st->execute();
|
|
$folders = [];
|
|
while ($row = $res->fetchArray(SQLITE3_ASSOC)) { $folders[] = $row['name']; }
|
|
echo json_encode($folders);
|
|
break;
|
|
|
|
case ($path === '/folders' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$name = trim($input['name'] ?? '');
|
|
if (!$name) { http_response_code(400); echo json_encode(['error'=>'Folder name required']); break; }
|
|
if (strtolower($name) === 'all') { http_response_code(400); echo json_encode(['error'=>'Cannot use All']); break; }
|
|
$st = $db->prepare('INSERT INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':name', $name, SQLITE3_TEXT);
|
|
try { $st->execute(); } catch (Exception $e) { http_response_code(409); echo json_encode(['error'=>'Folder exists']); break; }
|
|
logAudit($db, $auth['userId'], 'add_folder');
|
|
echo json_encode(['message'=>'Created','name'=>$name]);
|
|
break;
|
|
|
|
case (preg_match('/^\/folders\/(.+)$/', $path, $m) && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$folderName = urldecode($m[1]);
|
|
if ($folderName === 'All') { http_response_code(400); echo json_encode(['error'=>'Cannot delete All']); break; }
|
|
$st = $db->prepare('DELETE FROM folders WHERE user_id=:uid AND name=:name');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':name', $folderName, SQLITE3_TEXT);
|
|
$st->execute();
|
|
if ($db->changes() === 0) { http_response_code(404); echo json_encode(['error'=>'Not found']); break; }
|
|
$stUp = $db->prepare("UPDATE vault_entries SET folder='All' WHERE user_id=:uid AND folder=:f");
|
|
$stUp->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$stUp->bindValue(':f', $folderName, SQLITE3_TEXT);
|
|
$stUp->execute();
|
|
logAudit($db, $auth['userId'], 'delete_folder');
|
|
echo json_encode(['message'=>'Deleted']);
|
|
break;
|
|
|
|
// Entries - exclude deleted by default
|
|
case ($path === '/entries' && $method === 'GET'):
|
|
$auth = authenticate($db);
|
|
$q = $_GET['search'] ?? '';
|
|
$showDeleted = $_GET['deleted'] ?? '0';
|
|
if ($q) {
|
|
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid AND deleted=:del AND (site LIKE :q OR username LIKE :q) ORDER BY updated_at DESC');
|
|
$st->bindValue(':q', "%$q%", SQLITE3_TEXT);
|
|
} else {
|
|
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid AND deleted=:del ORDER BY updated_at DESC');
|
|
}
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':del', $showDeleted === '1' ? 1 : 0, SQLITE3_INTEGER);
|
|
$res = $st->execute();
|
|
$entries = [];
|
|
while ($r = $res->fetchArray(SQLITE3_ASSOC)) {
|
|
$entries[] = [
|
|
'id' => $r['id'],
|
|
'site' => $r['site'],
|
|
'username' => $r['username'],
|
|
'encrypted_password' => $r['encrypted_password'],
|
|
'iv' => $r['iv'],
|
|
'encryption_method' => $r['encryption_method'] ?? 'server',
|
|
'folder' => $r['folder'] ?? 'All',
|
|
'deleted' => $r['deleted'],
|
|
'deleted_at' => $r['deleted_at'],
|
|
'favorite' => (int)($r['favorite'] ?? 0),
|
|
'created_at' => $r['created_at'],
|
|
'updated_at' => $r['updated_at']
|
|
];
|
|
}
|
|
echo json_encode($entries);
|
|
break;
|
|
|
|
case ($path === '/entries' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$site = trim($input['site'] ?? '');
|
|
$username = trim($input['username'] ?? '');
|
|
$folder = trim($input['folder'] ?? 'All');
|
|
$encPwd = $input['encrypted_password'] ?? '';
|
|
$iv = $input['iv'] ?? '';
|
|
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
|
|
$now = date('Y-m-d H:i:s');
|
|
$st = $db->prepare('INSERT INTO vault_entries (user_id, site, username, encrypted_password, iv, encryption_method, folder, created_at, updated_at) VALUES (:uid,:s,:u,:e,:i,:m,:f,:c,:c)');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':s', $site, SQLITE3_TEXT);
|
|
$st->bindValue(':u', $username, SQLITE3_TEXT);
|
|
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
|
|
$st->bindValue(':i', $iv, SQLITE3_TEXT);
|
|
$st->bindValue(':m', 'client', SQLITE3_TEXT);
|
|
$st->bindValue(':f', $folder, SQLITE3_TEXT);
|
|
$st->bindValue(':c', $now, SQLITE3_TEXT);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'add_entry');
|
|
echo json_encode(['id'=>$db->lastInsertRowID(), 'site'=>$site, 'username'=>$username, 'folder'=>$folder]);
|
|
break;
|
|
|
|
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'PUT'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$site = trim($input['site'] ?? '');
|
|
$username = trim($input['username'] ?? '');
|
|
$encPwd = $input['encrypted_password'] ?? '';
|
|
$iv = $input['iv'] ?? '';
|
|
$folder = trim($input['folder'] ?? 'All');
|
|
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
|
|
$now = date('Y-m-d H:i:s');
|
|
$st = $db->prepare('UPDATE vault_entries SET site=:s, username=:u, encrypted_password=:e, iv=:i, folder=:f, updated_at=:c WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':s', $site, SQLITE3_TEXT);
|
|
$st->bindValue(':u', $username, SQLITE3_TEXT);
|
|
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
|
|
$st->bindValue(':i', $iv, SQLITE3_TEXT);
|
|
$st->bindValue(':f', $folder, SQLITE3_TEXT);
|
|
$st->bindValue(':c', $now, SQLITE3_TEXT);
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'edit_entry');
|
|
echo json_encode(['message'=>'Updated']);
|
|
break;
|
|
|
|
// Soft delete
|
|
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$permanent = $_GET['permanent'] ?? '0';
|
|
if ($permanent === '1') {
|
|
$st = $db->prepare('DELETE FROM vault_entries WHERE id=:id AND user_id=:uid');
|
|
} else {
|
|
$st = $db->prepare("UPDATE vault_entries SET deleted=1, deleted_at=datetime('now') WHERE id=:id AND user_id=:uid");
|
|
}
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], $permanent === '1' ? 'permanent_delete' : 'delete_entry');
|
|
echo json_encode(['message'=>'Deleted']);
|
|
break;
|
|
|
|
// Restore
|
|
case (preg_match('/^\/entries\/(\d+)\/restore$/', $path, $m) && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('UPDATE vault_entries SET deleted=0, deleted_at=NULL, updated_at=datetime(\'now\') WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'restore_entry');
|
|
echo json_encode(['message'=>'Restored']);
|
|
break;
|
|
|
|
// Favorite toggle
|
|
case (preg_match('/^\/entries\/(\d+)\/favorite$/', $path, $m) && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('UPDATE vault_entries SET favorite = CASE WHEN favorite=1 THEN 0 ELSE 1 END WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'toggle_favorite');
|
|
echo json_encode(['message'=>'Toggled']);
|
|
break;
|
|
|
|
case ($path === '/logout' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$headers = getallheaders();
|
|
$token = str_replace('Bearer ', '', $headers['Authorization'] ?? '');
|
|
if ($token) {
|
|
$tokenHash = hash('sha256', $token);
|
|
$del = $db->prepare('DELETE FROM sessions WHERE token_hash=:th');
|
|
$del->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$del->execute();
|
|
}
|
|
logAudit($db, $auth['userId'], 'logout');
|
|
echo json_encode(['message'=>'Logged out']);
|
|
break;
|
|
|
|
case ($path === '/entries/trash/empty' && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('DELETE FROM vault_entries WHERE user_id=:uid AND deleted=1');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'empty_trash');
|
|
echo json_encode(['message'=>'Trash emptied']);
|
|
break;
|
|
|
|
case ($path === '/reauth' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
if (checkRateLimit($db) >= 5) { http_response_code(429); echo json_encode(['error'=>'Too many attempts. Try again later.']); break; }
|
|
$p = $input['masterPassword'] ?? '';
|
|
$st = $db->prepare('SELECT * FROM users WHERE id=:uid');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$user) { recordAttempt($db); http_response_code(401); echo json_encode(['error'=>'User not found']); break; }
|
|
$algo = $user['hash_algo'] ?? 'pbkdf2';
|
|
if ($algo === 'bcrypt') {
|
|
$valid = password_verify($p, $user['password_hash']);
|
|
} else {
|
|
$valid = hash_equals($user['password_hash'], hash_pbkdf2('sha256', $p, $user['salt'], 100000));
|
|
}
|
|
if (!$valid) { recordAttempt($db); logAudit($db, $auth['userId'], 'failed_reauth'); http_response_code(401); echo json_encode(['error'=>'Invalid password']); break; }
|
|
clearAttempts($db);
|
|
logAudit($db, $auth['userId'], 'reauth');
|
|
echo json_encode(['message'=>'OK']);
|
|
break;
|
|
|
|
// ==================== WebAuthn passkey ====================
|
|
case ($path === '/passkey/register/begin' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$challenge = random_bytes(32);
|
|
$stC = $db->prepare('INSERT INTO passkey_challenges (user_id, challenge, type) VALUES (:uid, :ch, :t)');
|
|
$stC->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$stC->bindValue(':ch', $challenge, SQLITE3_BLOB);
|
|
$stC->bindValue(':t', 'register', SQLITE3_TEXT);
|
|
$stC->execute();
|
|
$stU = $db->prepare('SELECT username FROM users WHERE id=:uid');
|
|
$stU->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$uRow = $stU->execute()->fetchArray(SQLITE3_ASSOC);
|
|
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
|
|
echo json_encode([
|
|
'challenge' => b64url_encode($challenge),
|
|
'rp' => ['id' => parse_url($host, PHP_URL_HOST) ?: $host, 'name' => 'Vault'],
|
|
'user' => ['id' => b64url_encode(pack('N', $auth['userId'])), 'name' => $uRow['username'], 'displayName' => $uRow['username']],
|
|
'pubKeyCredParams' => [['type'=>'public-key','alg'=>-7],['type'=>'public-key','alg'=>-257]],
|
|
'authenticatorSelection' => ['authenticatorAttachment'=>'platform','residentKey'=>'required','userVerification'=>'required']
|
|
]);
|
|
break;
|
|
|
|
case ($path === '/passkey/register/complete' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$credId = b64url_decode($input['id'] ?? '');
|
|
$cdj = b64url_decode($input['response']['clientDataJSON'] ?? '');
|
|
$ao = b64url_decode($input['response']['attestationObject'] ?? '');
|
|
if (!$credId || !$cdj || !$ao) { http_response_code(400); echo json_encode(['error'=>'Missing data']); break; }
|
|
$cd = json_decode($cdj, true);
|
|
$stCh = $db->prepare("SELECT id, challenge FROM passkey_challenges WHERE user_id=:uid AND type='register' ORDER BY created_at DESC LIMIT 1");
|
|
$stCh->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$chRow = $stCh->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$chRow) { http_response_code(400); echo json_encode(['error'=>'No challenge']); break; }
|
|
if (!hash_equals(b64url_encode($chRow['challenge']), $cd['challenge'] ?? '')) { http_response_code(400); echo json_encode(['error'=>'Challenge mismatch']); break; }
|
|
$att = cbor_decode($ao);
|
|
$ad = $att['authData'] ?? '';
|
|
if (strlen($ad) < 37) { http_response_code(400); echo json_encode(['error'=>'Invalid authData']); break; }
|
|
$off = 32; $flags = ord($ad[$off]); $off += 5;
|
|
if (!($flags & 0x40)) { http_response_code(400); echo json_encode(['error'=>'No attested data']); break; }
|
|
$off += 16; $cidLen = unpack('n', substr($ad,$off,2))[1]; $off += 2;
|
|
$storedCredId = substr($ad,$off,$cidLen); $off += $cidLen;
|
|
if (!hash_equals($credId, $storedCredId)) { http_response_code(400); echo json_encode(['error'=>'Credential ID mismatch']); break; }
|
|
$pkCOSE = substr($ad, $off);
|
|
$stIns = $db->prepare('INSERT INTO passkey_credentials (user_id, credential_id, public_key) VALUES (:uid, :cid, :pk)');
|
|
$stIns->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$stIns->bindValue(':cid', $credId, SQLITE3_BLOB);
|
|
$stIns->bindValue(':pk', $pkCOSE, SQLITE3_BLOB);
|
|
try { $stIns->execute(); } catch (Exception $e) { http_response_code(409); echo json_encode(['error'=>'Passkey already registered']); break; }
|
|
$del = $db->prepare('DELETE FROM passkey_challenges WHERE id=:id');
|
|
$del->bindValue(':id', $chRow['id'], SQLITE3_INTEGER);
|
|
$del->execute();
|
|
logAudit($db, $auth['userId'], 'register_passkey');
|
|
echo json_encode(['message'=>'OK']);
|
|
break;
|
|
|
|
case ($path === '/passkey/login/begin' && $method === 'POST'):
|
|
$u = trim($input['username'] ?? '');
|
|
if (!$u) { http_response_code(400); echo json_encode(['error'=>'Username required']); break; }
|
|
$stU = $db->prepare('SELECT id FROM users WHERE username=:u');
|
|
$stU->bindValue(':u', $u, SQLITE3_TEXT);
|
|
$user = $stU->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$user) { http_response_code(404); echo json_encode(['error'=>'User not found']); break; }
|
|
$stCr = $db->prepare('SELECT credential_id FROM passkey_credentials WHERE user_id=:uid');
|
|
$stCr->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$res = $stCr->execute();
|
|
$allow = [];
|
|
while ($row = $res->fetchArray(SQLITE3_ASSOC)) $allow[] = ['type'=>'public-key','id'=>b64url_encode($row['credential_id'])];
|
|
if (!$allow) { http_response_code(404); echo json_encode(['error'=>'No passkey registered']); break; }
|
|
$challenge = random_bytes(32);
|
|
$stCh = $db->prepare('INSERT INTO passkey_challenges (user_id, challenge, type) VALUES (:uid, :ch, :t)');
|
|
$stCh->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$stCh->bindValue(':ch', $challenge, SQLITE3_BLOB);
|
|
$stCh->bindValue(':t', 'login', SQLITE3_TEXT);
|
|
$stCh->execute();
|
|
echo json_encode(['challenge'=>b64url_encode($challenge),'allowCredentials'=>$allow,'userVerification'=>'required']);
|
|
break;
|
|
|
|
case ($path === '/passkey/login/complete' && $method === 'POST'):
|
|
$credId = b64url_decode($input['id'] ?? '');
|
|
$cdj = b64url_decode($input['response']['clientDataJSON'] ?? '');
|
|
$ad = b64url_decode($input['response']['authenticatorData'] ?? '');
|
|
$sig = b64url_decode($input['response']['signature'] ?? '');
|
|
if (!$credId || !$cdj || !$ad || !$sig) { http_response_code(400); echo json_encode(['error'=>'Missing assertion data']); break; }
|
|
$stCr = $db->prepare('SELECT id, user_id, public_key FROM passkey_credentials WHERE credential_id=:cid');
|
|
$stCr->bindValue(':cid', $credId, SQLITE3_BLOB);
|
|
$cred = $stCr->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$cred) { http_response_code(401); echo json_encode(['error'=>'Credential not found']); break; }
|
|
$stCh = $db->prepare("SELECT id, challenge FROM passkey_challenges WHERE user_id=:uid AND type='login' ORDER BY created_at DESC LIMIT 1");
|
|
$stCh->bindValue(':uid', $cred['user_id'], SQLITE3_INTEGER);
|
|
$chRow = $stCh->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$chRow) { http_response_code(400); echo json_encode(['error'=>'No challenge']); break; }
|
|
$cd = json_decode($cdj, true);
|
|
if (!hash_equals(b64url_encode($chRow['challenge']), $cd['challenge'] ?? '')) { http_response_code(400); echo json_encode(['error'=>'Challenge mismatch']); break; }
|
|
$coseKey = cbor_decode($cred['public_key']);
|
|
$pem = coseToPem($coseKey);
|
|
if (!$pem) { http_response_code(500); echo json_encode(['error'=>'Unsupported key type']); break; }
|
|
$pk = openssl_get_publickey($pem);
|
|
if (!$pk) { http_response_code(500); echo json_encode(['error'=>'Failed to parse public key']); break; }
|
|
$signedData = $ad . hash('sha256', $cdj, true);
|
|
$ok = openssl_verify($signedData, $sig, $pk, OPENSSL_ALGO_SHA256);
|
|
if (!$ok) { http_response_code(401); echo json_encode(['error'=>'Invalid signature']); break; }
|
|
$del = $db->prepare('DELETE FROM passkey_challenges WHERE id=:id');
|
|
$del->bindValue(':id', $chRow['id'], SQLITE3_INTEGER);
|
|
$del->execute();
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$csrfToken = bin2hex(random_bytes(32));
|
|
$expires = date('Y-m-d H:i:s', strtotime('+24 hours'));
|
|
$stS = $db->prepare('INSERT INTO sessions (user_id, token_hash, csrf_token, expires_at) VALUES (:uid, :th, :csrf, :exp)');
|
|
$stS->bindValue(':uid', $cred['user_id'], SQLITE3_INTEGER);
|
|
$stS->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$stS->bindValue(':csrf', $csrfToken, SQLITE3_TEXT);
|
|
$stS->bindValue(':exp', $expires, SQLITE3_TEXT);
|
|
$stS->execute();
|
|
$stU = $db->prepare('SELECT username, salt FROM users WHERE id=:uid');
|
|
$stU->bindValue(':uid', $cred['user_id'], SQLITE3_INTEGER);
|
|
$user = $stU->execute()->fetchArray(SQLITE3_ASSOC);
|
|
logAudit($db, $cred['user_id'], 'passkey_login');
|
|
echo json_encode(['message'=>'OK','token'=>$token,'csrfToken'=>$csrfToken,'userId'=>$cred['user_id'],'username'=>$user['username'],'salt'=>$user['salt']]);
|
|
break;
|
|
|
|
default:
|
|
http_response_code(404);
|
|
echo json_encode(['error'=>'Not found']);
|
|
}
|
|
} catch (Exception $e) {
|
|
file_put_contents($logFile, '[' . date('Y-m-d H:i:s') . '] ' . $e->getMessage() . PHP_EOL, FILE_APPEND);
|
|
http_response_code(500);
|
|
echo json_encode(['error' => 'Internal server error']);
|
|
}
|
|
|
|
$db->close();
|
|
?>
|