Zaki
8abb1c5ad0
- Inline password reveal on hover (controlled by showView setting, replaces eye button) - Drag an entry card onto a folder chip to move it (no modal needed) - Generator presets: Strong 16, Strong 20, Paranoid 32 buttons - Favorites: star toggle button per entry, entries sort to top - Add favorite column to vault_entries, toggle endpoint, star UI in all views - Gold border/background for favorited entries
477 lines
24 KiB
PHP
477 lines
24 KiB
PHP
<?php
|
|
error_reporting(0);
|
|
ini_set('display_errors', 0);
|
|
|
|
$logFile = __DIR__ . '/vault-error.log';
|
|
|
|
set_exception_handler(function($e) use ($logFile) {
|
|
file_put_contents($logFile, '[' . date('Y-m-d H:i:s') . '] FATAL: ' . $e->getMessage() . PHP_EOL, FILE_APPEND);
|
|
http_response_code(500);
|
|
header('Content-Type: application/json');
|
|
echo json_encode(['error' => 'Internal server error']);
|
|
exit;
|
|
});
|
|
|
|
header('Content-Type: application/json');
|
|
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
|
|
|
|
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
|
|
if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) {
|
|
header('Access-Control-Allow-Origin: ' . $origin);
|
|
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
|
|
header('Access-Control-Allow-Headers: Content-Type, Authorization');
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit(0);
|
|
|
|
$db_path = __DIR__ . '/vault.db';
|
|
$db = new SQLite3($db_path);
|
|
$db->enableExceptions(true);
|
|
$db->busyTimeout(5000);
|
|
|
|
$db->exec("
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
username TEXT UNIQUE NOT NULL,
|
|
password_hash TEXT NOT NULL,
|
|
salt TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS folders (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
name TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
|
|
UNIQUE(user_id, name)
|
|
);
|
|
CREATE TABLE IF NOT EXISTS vault_entries (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
site TEXT NOT NULL,
|
|
username TEXT NOT NULL,
|
|
encrypted_password TEXT NOT NULL,
|
|
iv TEXT NOT NULL,
|
|
encryption_method TEXT DEFAULT 'server',
|
|
folder TEXT DEFAULT 'All',
|
|
deleted INTEGER DEFAULT 0,
|
|
deleted_at DATETIME,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER NOT NULL,
|
|
token_hash TEXT UNIQUE NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
expires_at DATETIME NOT NULL,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
|
);
|
|
CREATE TABLE IF NOT EXISTS login_attempts (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
ip TEXT NOT NULL,
|
|
attempted_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS audit_log (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id INTEGER,
|
|
action TEXT NOT NULL,
|
|
ip TEXT,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
");
|
|
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN encryption_method TEXT DEFAULT 'server'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN folder TEXT DEFAULT 'All'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN deleted INTEGER DEFAULT 0"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN deleted_at DATETIME"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE users DROP COLUMN encryption_key"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE users ADD COLUMN hash_algo TEXT DEFAULT 'pbkdf2'"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE sessions ADD COLUMN csrf_token TEXT"); } catch (Exception $e) {}
|
|
try { $db->exec("ALTER TABLE vault_entries ADD COLUMN favorite INTEGER DEFAULT 0"); } catch (Exception $e) {}
|
|
|
|
$db->exec("DELETE FROM sessions WHERE expires_at < datetime('now')");
|
|
$db->exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-15 minutes')");
|
|
$db->exec("DELETE FROM audit_log WHERE created_at < datetime('now', '-30 days')");
|
|
|
|
function getClientIP() {
|
|
$headers = getallheaders();
|
|
return $headers['X-Forwarded-For'] ?? $_SERVER['REMOTE_ADDR'] ?? 'unknown';
|
|
}
|
|
|
|
function checkRateLimit($db) {
|
|
$ip = getClientIP();
|
|
$window = gmdate('Y-m-d H:i:s', strtotime('-15 minutes'));
|
|
$st = $db->prepare('SELECT COUNT(*) as cnt FROM login_attempts WHERE ip=:ip AND attempted_at > :window');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->bindValue(':window', $window, SQLITE3_TEXT);
|
|
$row = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
return (int)($row['cnt'] ?? 0);
|
|
}
|
|
|
|
function recordAttempt($db) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('INSERT INTO login_attempts (ip) VALUES (:ip)');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function clearAttempts($db) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('DELETE FROM login_attempts WHERE ip=:ip');
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function logAudit($db, $userId, $action) {
|
|
$ip = getClientIP();
|
|
$st = $db->prepare('INSERT INTO audit_log (user_id, action, ip) VALUES (:uid, :action, :ip)');
|
|
$st->bindValue(':uid', $userId, SQLITE3_INTEGER);
|
|
$st->bindValue(':action', $action, SQLITE3_TEXT);
|
|
$st->bindValue(':ip', $ip, SQLITE3_TEXT);
|
|
$st->execute();
|
|
}
|
|
|
|
function requireCSRF($db, $userId) {
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') return;
|
|
$headers = getallheaders();
|
|
$csrfToken = $headers['X-CSRF-Token'] ?? '';
|
|
if (!$csrfToken) { http_response_code(403); echo json_encode(['error'=>'Missing CSRF token']); exit; }
|
|
$st = $db->prepare('SELECT csrf_token FROM sessions WHERE user_id=:uid AND expires_at > datetime(\'now\') ORDER BY created_at DESC LIMIT 1');
|
|
$st->bindValue(':uid', $userId, SQLITE3_INTEGER);
|
|
$row = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$row || !hash_equals($row['csrf_token'], $csrfToken)) {
|
|
http_response_code(403); echo json_encode(['error'=>'Invalid CSRF token']); exit;
|
|
}
|
|
}
|
|
|
|
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
|
|
$path = str_replace('/password-manager/api.php', '', $path);
|
|
$path = str_replace('/api.php', '', $path);
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$input = json_decode(file_get_contents('php://input'), true) ?? [];
|
|
|
|
function authenticate($db) {
|
|
$headers = getallheaders();
|
|
$token = str_replace('Bearer ', '', $headers['Authorization'] ?? '');
|
|
if (!$token) { http_response_code(401); echo json_encode(['error'=>'No token']); exit; }
|
|
$tokenHash = hash('sha256', $token);
|
|
$st = $db->prepare('SELECT user_id, expires_at FROM sessions WHERE token_hash=:th');
|
|
$st->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$session = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$session) { http_response_code(401); echo json_encode(['error'=>'Invalid session']); exit; }
|
|
if (strtotime($session['expires_at']) < time()) {
|
|
$del = $db->prepare('DELETE FROM sessions WHERE token_hash=:th');
|
|
$del->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$del->execute();
|
|
http_response_code(401); echo json_encode(['error'=>'Session expired']); exit;
|
|
}
|
|
return ['userId' => (int)$session['user_id']];
|
|
}
|
|
|
|
try {
|
|
switch (true) {
|
|
case ($path === '/register' && $method === 'POST'):
|
|
if (checkRateLimit($db) >= 5) { http_response_code(429); echo json_encode(['error'=>'Too many attempts. Try again later.']); break; }
|
|
$u = trim($input['username'] ?? '');
|
|
$p = $input['masterPassword'] ?? '';
|
|
if (strlen($u) < 3 || strlen($p) < 8) { http_response_code(400); echo json_encode(['error'=>'Min 3/8 chars']); break; }
|
|
$st = $db->prepare('SELECT id FROM users WHERE username=:u');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
if ($st->execute()->fetchArray()) { http_response_code(409); echo json_encode(['error'=>'Username exists']); break; }
|
|
$salt = bin2hex(random_bytes(32));
|
|
$hash = password_hash($p, PASSWORD_BCRYPT);
|
|
$st = $db->prepare('INSERT INTO users (username, password_hash, salt, hash_algo) VALUES (:u, :h, :s, :algo)');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
$st->bindValue(':h', $hash, SQLITE3_TEXT);
|
|
$st->bindValue(':s', $salt, SQLITE3_TEXT);
|
|
$st->bindValue(':algo', 'bcrypt', SQLITE3_TEXT);
|
|
$st->execute();
|
|
$uid = $db->lastInsertRowID();
|
|
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
|
|
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
foreach ($defaultFolders as $name) {
|
|
$stFolder->bindValue(':uid', $uid, SQLITE3_INTEGER);
|
|
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
|
|
$stFolder->execute();
|
|
}
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$csrfToken = bin2hex(random_bytes(32));
|
|
$expires = date('Y-m-d H:i:s', strtotime('+24 hours'));
|
|
$stS = $db->prepare('INSERT INTO sessions (user_id, token_hash, csrf_token, expires_at) VALUES (:uid, :th, :csrf, :exp)');
|
|
$stS->bindValue(':uid', $uid, SQLITE3_INTEGER);
|
|
$stS->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$stS->bindValue(':csrf', $csrfToken, SQLITE3_TEXT);
|
|
$stS->bindValue(':exp', $expires, SQLITE3_TEXT);
|
|
$stS->execute();
|
|
logAudit($db, $uid, 'register');
|
|
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$uid,'salt'=>$salt,'csrfToken'=>$csrfToken]);
|
|
break;
|
|
|
|
case ($path === '/login' && $method === 'POST'):
|
|
if (checkRateLimit($db) >= 10) { http_response_code(429); echo json_encode(['error'=>'Too many attempts. Try again later.']); break; }
|
|
$u = trim($input['username'] ?? '');
|
|
$p = $input['masterPassword'] ?? '';
|
|
$st = $db->prepare('SELECT * FROM users WHERE username=:u');
|
|
$st->bindValue(':u', $u, SQLITE3_TEXT);
|
|
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$user) { recordAttempt($db); http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break; }
|
|
$algo = $user['hash_algo'] ?? 'pbkdf2';
|
|
if ($algo === 'bcrypt') {
|
|
$valid = password_verify($p, $user['password_hash']);
|
|
} else {
|
|
$valid = hash_equals($user['password_hash'], hash_pbkdf2('sha256', $p, $user['salt'], 100000));
|
|
}
|
|
if (!$valid) { recordAttempt($db); logAudit($db, $user['id'], 'failed_login'); http_response_code(401); echo json_encode(['error'=>'Invalid credentials']); break; }
|
|
if ($algo !== 'bcrypt') {
|
|
$newHash = password_hash($p, PASSWORD_BCRYPT);
|
|
$upd = $db->prepare('UPDATE users SET password_hash=:h, hash_algo=:algo WHERE id=:uid');
|
|
$upd->bindValue(':h', $newHash, SQLITE3_TEXT);
|
|
$upd->bindValue(':algo', 'bcrypt', SQLITE3_TEXT);
|
|
$upd->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$upd->execute();
|
|
}
|
|
clearAttempts($db);
|
|
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
|
|
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
foreach ($defaultFolders as $name) {
|
|
$stFolder->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$stFolder->bindValue(':name', $name, SQLITE3_TEXT);
|
|
$stFolder->execute();
|
|
}
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$csrfToken = bin2hex(random_bytes(32));
|
|
$expires = date('Y-m-d H:i:s', strtotime('+24 hours'));
|
|
$stS = $db->prepare('INSERT INTO sessions (user_id, token_hash, csrf_token, expires_at) VALUES (:uid, :th, :csrf, :exp)');
|
|
$stS->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
|
|
$stS->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$stS->bindValue(':csrf', $csrfToken, SQLITE3_TEXT);
|
|
$stS->bindValue(':exp', $expires, SQLITE3_TEXT);
|
|
$stS->execute();
|
|
logAudit($db, $user['id'], 'login');
|
|
echo json_encode(['message'=>'OK','token'=>$token,'userId'=>$user['id'],'salt'=>$user['salt'],'csrfToken'=>$csrfToken]);
|
|
break;
|
|
|
|
case ($path === '/folders' && $method === 'GET'):
|
|
$auth = authenticate($db);
|
|
$st = $db->prepare('SELECT name FROM folders WHERE user_id=:uid ORDER BY name');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$res = $st->execute();
|
|
$folders = [];
|
|
while ($row = $res->fetchArray(SQLITE3_ASSOC)) { $folders[] = $row['name']; }
|
|
echo json_encode($folders);
|
|
break;
|
|
|
|
case ($path === '/folders' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$name = trim($input['name'] ?? '');
|
|
if (!$name) { http_response_code(400); echo json_encode(['error'=>'Folder name required']); break; }
|
|
if (strtolower($name) === 'all') { http_response_code(400); echo json_encode(['error'=>'Cannot use All']); break; }
|
|
$st = $db->prepare('INSERT INTO folders (user_id, name) VALUES (:uid, :name)');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':name', $name, SQLITE3_TEXT);
|
|
try { $st->execute(); } catch (Exception $e) { http_response_code(409); echo json_encode(['error'=>'Folder exists']); break; }
|
|
logAudit($db, $auth['userId'], 'add_folder');
|
|
echo json_encode(['message'=>'Created','name'=>$name]);
|
|
break;
|
|
|
|
case (preg_match('/^\/folders\/(.+)$/', $path, $m) && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$folderName = urldecode($m[1]);
|
|
if ($folderName === 'All') { http_response_code(400); echo json_encode(['error'=>'Cannot delete All']); break; }
|
|
$st = $db->prepare('DELETE FROM folders WHERE user_id=:uid AND name=:name');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':name', $folderName, SQLITE3_TEXT);
|
|
$st->execute();
|
|
if ($db->changes() === 0) { http_response_code(404); echo json_encode(['error'=>'Not found']); break; }
|
|
$stUp = $db->prepare("UPDATE vault_entries SET folder='All' WHERE user_id=:uid AND folder=:f");
|
|
$stUp->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$stUp->bindValue(':f', $folderName, SQLITE3_TEXT);
|
|
$stUp->execute();
|
|
logAudit($db, $auth['userId'], 'delete_folder');
|
|
echo json_encode(['message'=>'Deleted']);
|
|
break;
|
|
|
|
// Entries - exclude deleted by default
|
|
case ($path === '/entries' && $method === 'GET'):
|
|
$auth = authenticate($db);
|
|
$q = $_GET['search'] ?? '';
|
|
$showDeleted = $_GET['deleted'] ?? '0';
|
|
if ($q) {
|
|
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid AND deleted=:del AND (site LIKE :q OR username LIKE :q) ORDER BY updated_at DESC');
|
|
$st->bindValue(':q', "%$q%", SQLITE3_TEXT);
|
|
} else {
|
|
$st = $db->prepare('SELECT * FROM vault_entries WHERE user_id=:uid AND deleted=:del ORDER BY updated_at DESC');
|
|
}
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':del', $showDeleted === '1' ? 1 : 0, SQLITE3_INTEGER);
|
|
$res = $st->execute();
|
|
$entries = [];
|
|
while ($r = $res->fetchArray(SQLITE3_ASSOC)) {
|
|
$entries[] = [
|
|
'id' => $r['id'],
|
|
'site' => $r['site'],
|
|
'username' => $r['username'],
|
|
'encrypted_password' => $r['encrypted_password'],
|
|
'iv' => $r['iv'],
|
|
'encryption_method' => $r['encryption_method'] ?? 'server',
|
|
'folder' => $r['folder'] ?? 'All',
|
|
'deleted' => $r['deleted'],
|
|
'deleted_at' => $r['deleted_at'],
|
|
'favorite' => (int)($r['favorite'] ?? 0),
|
|
'created_at' => $r['created_at'],
|
|
'updated_at' => $r['updated_at']
|
|
];
|
|
}
|
|
echo json_encode($entries);
|
|
break;
|
|
|
|
case ($path === '/entries' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$site = trim($input['site'] ?? '');
|
|
$username = trim($input['username'] ?? '');
|
|
$folder = trim($input['folder'] ?? 'All');
|
|
$encPwd = $input['encrypted_password'] ?? '';
|
|
$iv = $input['iv'] ?? '';
|
|
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
|
|
$now = date('Y-m-d H:i:s');
|
|
$st = $db->prepare('INSERT INTO vault_entries (user_id, site, username, encrypted_password, iv, encryption_method, folder, created_at, updated_at) VALUES (:uid,:s,:u,:e,:i,:m,:f,:c,:c)');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->bindValue(':s', $site, SQLITE3_TEXT);
|
|
$st->bindValue(':u', $username, SQLITE3_TEXT);
|
|
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
|
|
$st->bindValue(':i', $iv, SQLITE3_TEXT);
|
|
$st->bindValue(':m', 'client', SQLITE3_TEXT);
|
|
$st->bindValue(':f', $folder, SQLITE3_TEXT);
|
|
$st->bindValue(':c', $now, SQLITE3_TEXT);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'add_entry');
|
|
echo json_encode(['id'=>$db->lastInsertRowID(), 'site'=>$site, 'username'=>$username, 'folder'=>$folder]);
|
|
break;
|
|
|
|
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'PUT'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$site = trim($input['site'] ?? '');
|
|
$username = trim($input['username'] ?? '');
|
|
$encPwd = $input['encrypted_password'] ?? '';
|
|
$iv = $input['iv'] ?? '';
|
|
$folder = trim($input['folder'] ?? 'All');
|
|
if (empty($site) || empty($encPwd)) { http_response_code(400); echo json_encode(['error'=>'Site & password required']); break; }
|
|
$now = date('Y-m-d H:i:s');
|
|
$st = $db->prepare('UPDATE vault_entries SET site=:s, username=:u, encrypted_password=:e, iv=:i, folder=:f, updated_at=:c WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':s', $site, SQLITE3_TEXT);
|
|
$st->bindValue(':u', $username, SQLITE3_TEXT);
|
|
$st->bindValue(':e', $encPwd, SQLITE3_TEXT);
|
|
$st->bindValue(':i', $iv, SQLITE3_TEXT);
|
|
$st->bindValue(':f', $folder, SQLITE3_TEXT);
|
|
$st->bindValue(':c', $now, SQLITE3_TEXT);
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'edit_entry');
|
|
echo json_encode(['message'=>'Updated']);
|
|
break;
|
|
|
|
// Soft delete
|
|
case (preg_match('/^\/entries\/(\d+)$/', $path, $m) && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$permanent = $_GET['permanent'] ?? '0';
|
|
if ($permanent === '1') {
|
|
$st = $db->prepare('DELETE FROM vault_entries WHERE id=:id AND user_id=:uid');
|
|
} else {
|
|
$st = $db->prepare("UPDATE vault_entries SET deleted=1, deleted_at=datetime('now') WHERE id=:id AND user_id=:uid");
|
|
}
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], $permanent === '1' ? 'permanent_delete' : 'delete_entry');
|
|
echo json_encode(['message'=>'Deleted']);
|
|
break;
|
|
|
|
// Restore
|
|
case (preg_match('/^\/entries\/(\d+)\/restore$/', $path, $m) && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('UPDATE vault_entries SET deleted=0, deleted_at=NULL, updated_at=datetime(\'now\') WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'restore_entry');
|
|
echo json_encode(['message'=>'Restored']);
|
|
break;
|
|
|
|
// Favorite toggle
|
|
case (preg_match('/^\/entries\/(\d+)\/favorite$/', $path, $m) && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('UPDATE vault_entries SET favorite = CASE WHEN favorite=1 THEN 0 ELSE 1 END WHERE id=:id AND user_id=:uid');
|
|
$st->bindValue(':id', $m[1], SQLITE3_INTEGER);
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'toggle_favorite');
|
|
echo json_encode(['message'=>'Toggled']);
|
|
break;
|
|
|
|
case ($path === '/logout' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$headers = getallheaders();
|
|
$token = str_replace('Bearer ', '', $headers['Authorization'] ?? '');
|
|
if ($token) {
|
|
$tokenHash = hash('sha256', $token);
|
|
$del = $db->prepare('DELETE FROM sessions WHERE token_hash=:th');
|
|
$del->bindValue(':th', $tokenHash, SQLITE3_TEXT);
|
|
$del->execute();
|
|
}
|
|
logAudit($db, $auth['userId'], 'logout');
|
|
echo json_encode(['message'=>'Logged out']);
|
|
break;
|
|
|
|
case ($path === '/entries/trash/empty' && $method === 'DELETE'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$st = $db->prepare('DELETE FROM vault_entries WHERE user_id=:uid AND deleted=1');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$st->execute();
|
|
logAudit($db, $auth['userId'], 'empty_trash');
|
|
echo json_encode(['message'=>'Trash emptied']);
|
|
break;
|
|
|
|
case ($path === '/reauth' && $method === 'POST'):
|
|
$auth = authenticate($db);
|
|
requireCSRF($db, $auth['userId']);
|
|
$p = $input['masterPassword'] ?? '';
|
|
$st = $db->prepare('SELECT * FROM users WHERE id=:uid');
|
|
$st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
|
|
$user = $st->execute()->fetchArray(SQLITE3_ASSOC);
|
|
if (!$user) { http_response_code(401); echo json_encode(['error'=>'User not found']); break; }
|
|
$algo = $user['hash_algo'] ?? 'pbkdf2';
|
|
if ($algo === 'bcrypt') {
|
|
$valid = password_verify($p, $user['password_hash']);
|
|
} else {
|
|
$valid = hash_equals($user['password_hash'], hash_pbkdf2('sha256', $p, $user['salt'], 100000));
|
|
}
|
|
if (!$valid) { logAudit($db, $auth['userId'], 'failed_reauth'); http_response_code(401); echo json_encode(['error'=>'Invalid password']); break; }
|
|
logAudit($db, $auth['userId'], 'reauth');
|
|
echo json_encode(['message'=>'OK']);
|
|
break;
|
|
|
|
default:
|
|
http_response_code(404);
|
|
echo json_encode(['error'=>'Not found']);
|
|
}
|
|
} catch (Exception $e) {
|
|
file_put_contents($logFile, '[' . date('Y-m-d H:i:s') . '] ' . $e->getMessage() . PHP_EOL, FILE_APPEND);
|
|
http_response_code(500);
|
|
echo json_encode(['error' => 'Internal server error']);
|
|
}
|
|
|
|
$db->close();
|
|
?>
|