snapshot of https://github.com/tauri-apps/plugins-workspace.git (v2, 2026-09-23; blobs > 131072B omitted)
Some checks failed
integration tests / run-integration-tests (windows-latest) (push) Has been cancelled
Test Rust / test (push) Has been cancelled
test plugins e2e (mobile) / ios (push) Has been cancelled
test plugins e2e / test (map[name:Windows os:windows-latest]) (push) Has been cancelled
test plugins e2e / test (map[name:macOS os:macos-latest]) (push) Has been cancelled
integration tests / run-integration-tests (macos-latest) (push) Has been cancelled
version or publish / version-or-publish (push) Failing after 0s
integration tests / run-integration-tests (ubuntu-22.04) (push) Failing after 0s
Lint JavaScript / eslint (push) Failing after 0s
Sync / sync-to-mirrors (push) Failing after 0s
test plugins e2e (mobile) / android (push) Failing after 0s
test plugins e2e / test (map[name:Linux os:ubuntu-latest]) (push) Failing after 0s
Test Rust / changes (push) Failing after 0s
Lint Rust / changes (push) Failing after 0s
Lint Rust / clippy (push) Has been skipped
Audit Rust / audit-rust (push) Failing after 1s
Audit JavaScript / audit-js (push) Failing after 1s
Some checks failed
integration tests / run-integration-tests (windows-latest) (push) Has been cancelled
Test Rust / test (push) Has been cancelled
test plugins e2e (mobile) / ios (push) Has been cancelled
test plugins e2e / test (map[name:Windows os:windows-latest]) (push) Has been cancelled
test plugins e2e / test (map[name:macOS os:macos-latest]) (push) Has been cancelled
integration tests / run-integration-tests (macos-latest) (push) Has been cancelled
version or publish / version-or-publish (push) Failing after 0s
integration tests / run-integration-tests (ubuntu-22.04) (push) Failing after 0s
Lint JavaScript / eslint (push) Failing after 0s
Sync / sync-to-mirrors (push) Failing after 0s
test plugins e2e (mobile) / android (push) Failing after 0s
test plugins e2e / test (map[name:Linux os:ubuntu-latest]) (push) Failing after 0s
Test Rust / changes (push) Failing after 0s
Lint Rust / changes (push) Failing after 0s
Lint Rust / clippy (push) Has been skipped
Audit Rust / audit-rust (push) Failing after 1s
Audit JavaScript / audit-js (push) Failing after 1s
This commit is contained in:
upstream-mirror
111
plugins/stronghold/CHANGELOG.md
Normal file
111
plugins/stronghold/CHANGELOG.md
Normal file
@@ -0,0 +1,111 @@
|
||||
# Changelog
|
||||
|
||||
## [2.3.2]
|
||||
|
||||
- [`f8053e65`](https://github.com/tauri-apps/plugins-workspace/commit/f8053e659e4ccd85c1f52833411ff8417cbc5e69) ([#3527](https://github.com/tauri-apps/plugins-workspace/pull/3527) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Documented Cargo feature flags in each plugin's crate-level documentation.
|
||||
|
||||
## \[2.3.1]
|
||||
|
||||
- [`93426f85`](https://github.com/tauri-apps/plugins-workspace/commit/93426f85120f49beb9f40222bff45185a32d54a9) Fixed an issue that caused docs.rs builds to fail. No user facing changes.
|
||||
|
||||
## \[2.3.0]
|
||||
|
||||
- [`f209b2f2`](https://github.com/tauri-apps/plugins-workspace/commit/f209b2f23cb29133c97ad5961fb46ef794dbe063) ([#2804](https://github.com/tauri-apps/plugins-workspace/pull/2804) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Updated tauri to 2.6
|
||||
|
||||
## \[2.2.1]
|
||||
|
||||
- [`f634e524`](https://github.com/tauri-apps/plugins-workspace/commit/f634e5248ebe428f8305a59f74c13fc15147fb8e) This is an "empty" release to update the plugins' source files on crates.io and docs.rs. This should fix docs.rs build failures for projects using tauri plugins as dependencies.
|
||||
|
||||
## \[2.2.0]
|
||||
|
||||
- [`3a79266b`](https://github.com/tauri-apps/plugins-workspace/commit/3a79266b8cf96a55b1ae6339d725567d45a44b1d) ([#2173](https://github.com/tauri-apps/plugins-workspace/pull/2173) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Bumped all plugins to `v2.2.0`. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other.
|
||||
|
||||
## \[2.0.1]
|
||||
|
||||
- [`a1a82208`](https://github.com/tauri-apps/plugins-workspace/commit/a1a82208ed4ab87f83310be0dc95428aec9ab241) ([#1873](https://github.com/tauri-apps/plugins-workspace/pull/1873) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Downgrade MSRV to 1.77.2 to support Windows 7.
|
||||
|
||||
## \[2.0.0]
|
||||
|
||||
- [`e2c4dfb6`](https://github.com/tauri-apps/plugins-workspace/commit/e2c4dfb6af43e5dd8d9ceba232c315f5febd55c1) Update to tauri v2 stable release.
|
||||
|
||||
## \[2.0.0-rc.1]
|
||||
|
||||
- [`e2e97db5`](https://github.com/tauri-apps/plugins-workspace/commit/e2e97db51983267f5be84d4f6f0278d58834d1f5) ([#1701](https://github.com/tauri-apps/plugins-workspace/pull/1701) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri 2.0.0-rc.8
|
||||
|
||||
## \[2.0.0-rc.0]
|
||||
|
||||
- [`9887d1`](https://github.com/tauri-apps/plugins-workspace/commit/9887d14bd0e971c4c0f5c1188fc4005d3fc2e29e) Update to tauri RC.
|
||||
|
||||
## \[2.0.0-beta.8]
|
||||
|
||||
- [`99d6ac0f`](https://github.com/tauri-apps/plugins-workspace/commit/99d6ac0f9506a6a4a1aa59c728157190a7441af6) ([#1606](https://github.com/tauri-apps/plugins-workspace/pull/1606) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) The JS packages now specify the *minimum* `@tauri-apps/api` version instead of a single exact version.
|
||||
- [`6de87966`](https://github.com/tauri-apps/plugins-workspace/commit/6de87966ecc00ad9d91c25be452f1f46bd2b7e1f) ([#1597](https://github.com/tauri-apps/plugins-workspace/pull/1597) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Update to tauri beta.25.
|
||||
|
||||
## \[2.0.0-beta.7]
|
||||
|
||||
- [`22a17980`](https://github.com/tauri-apps/plugins-workspace/commit/22a17980ff4f6f8c40adb1b8f4ffc6dae2fe7e30) ([#1537](https://github.com/tauri-apps/plugins-workspace/pull/1537) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri beta.24.
|
||||
|
||||
## \[2.0.0-beta.6]
|
||||
|
||||
- [`76daee7a`](https://github.com/tauri-apps/plugins-workspace/commit/76daee7aafece34de3092c86e531cf9eb1138989) ([#1512](https://github.com/tauri-apps/plugins-workspace/pull/1512) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Update to tauri beta.23.
|
||||
|
||||
## \[2.0.0-beta.5]
|
||||
|
||||
- [`9013854f`](https://github.com/tauri-apps/plugins-workspace/commit/9013854f42a49a230b9dbb9d02774765528a923f)([#1382](https://github.com/tauri-apps/plugins-workspace/pull/1382)) Update to tauri beta.22.
|
||||
|
||||
## \[2.0.0-beta.4]
|
||||
|
||||
- [`430bd6f4`](https://github.com/tauri-apps/plugins-workspace/commit/430bd6f4f379bee5d232ae6b098ae131db7f178a)([#1363](https://github.com/tauri-apps/plugins-workspace/pull/1363)) Update to tauri beta.20.
|
||||
|
||||
## \[2.0.0-beta.3]
|
||||
|
||||
- [`bd1ed590`](https://github.com/tauri-apps/plugins-workspace/commit/bd1ed5903ffcce5500310dac1e59e8c67674ef1e)([#1237](https://github.com/tauri-apps/plugins-workspace/pull/1237)) Update to tauri beta.17.
|
||||
|
||||
## \[2.0.0-beta.3]
|
||||
|
||||
- [`a04ea2f`](https://github.com/tauri-apps/plugins-workspace/commit/a04ea2f38294d5a3987578283badc8eec87a7752)([#1071](https://github.com/tauri-apps/plugins-workspace/pull/1071)) The global API script is now only added to the binary when the `withGlobalTauri` config is true.
|
||||
|
||||
## \[2.0.0-beta.2]
|
||||
|
||||
- [`99bea25`](https://github.com/tauri-apps/plugins-workspace/commit/99bea2559c2c0648c2519c50a18cd124dacef57b)([#1005](https://github.com/tauri-apps/plugins-workspace/pull/1005)) Update to tauri beta.8.
|
||||
|
||||
## \[2.0.0-beta.1]
|
||||
|
||||
- [`569defb`](https://github.com/tauri-apps/plugins-workspace/commit/569defbe9492e38938554bb7bdc1be9151456d21) Update to tauri beta.4.
|
||||
|
||||
## \[2.0.0-beta.0]
|
||||
|
||||
- [`d198c01`](https://github.com/tauri-apps/plugins-workspace/commit/d198c014863ee260cb0de88a14b7fc4356ef7474)([#862](https://github.com/tauri-apps/plugins-workspace/pull/862)) Update to tauri beta.
|
||||
|
||||
## \[2.0.0-alpha.6]
|
||||
|
||||
- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.13.
|
||||
|
||||
## \[2.0.0-alpha.5]
|
||||
|
||||
- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.12.
|
||||
|
||||
## \[2.0.0-alpha.4]
|
||||
|
||||
- [`e438e0a`](https://github.com/tauri-apps/plugins-workspace/commit/e438e0a62d4b430a5159f05f13ecd397dd891a0d)([#676](https://github.com/tauri-apps/plugins-workspace/pull/676)) Update to @tauri-apps/api v2.0.0-alpha.11.
|
||||
|
||||
## \[2.0.0-alpha.3]
|
||||
|
||||
- [`5c13736`](https://github.com/tauri-apps/plugins-workspace/commit/5c137365c60790e8d4037d449e8237aa3fffdab0)([#673](https://github.com/tauri-apps/plugins-workspace/pull/673)) Update to @tauri-apps/api v2.0.0-alpha.9.
|
||||
|
||||
## \[2.0.0-alpha.2]
|
||||
|
||||
- [`4e2cef9`](https://github.com/tauri-apps/plugins-workspace/commit/4e2cef9b702bbbb9cf4ee17de50791cb21f1b2a4)([#593](https://github.com/tauri-apps/plugins-workspace/pull/593)) Update to alpha.12.
|
||||
|
||||
## \[2.0.0-alpha.2]
|
||||
|
||||
- [`aba07c2`](https://github.com/tauri-apps/plugins-workspace/commit/aba07c27b887c1cc54026024227cb3f74c91e21a)([#468](https://github.com/tauri-apps/plugins-workspace/pull/468)) Change the argument name of the `Stronghold.remove` from `location` to `recordPath` to match the Stronghold command argument
|
||||
- [`d74fc0a`](https://github.com/tauri-apps/plugins-workspace/commit/d74fc0a097996e90a37be8f57d50b7d1f6ca616f)([#555](https://github.com/tauri-apps/plugins-workspace/pull/555)) Update to alpha.11.
|
||||
|
||||
## \[2.0.0-alpha.1]
|
||||
|
||||
- [`b3d7d11`](https://github.com/tauri-apps/plugins-workspace/commit/b3d7d11ae32e0970184f53be26e2c5530f78cdf0)([#416](https://github.com/tauri-apps/plugins-workspace/pull/416)) Added `Stronghold.load` and removed its constructor.
|
||||
|
||||
## \[2.0.0-alpha.0]
|
||||
|
||||
- [`717ae67`](https://github.com/tauri-apps/plugins-workspace/commit/717ae670978feb4492fac1f295998b93f2b9347f)([#371](https://github.com/tauri-apps/plugins-workspace/pull/371)) First v2 alpha release!
|
||||
49
plugins/stronghold/Cargo.toml
Normal file
49
plugins/stronghold/Cargo.toml
Normal file
@@ -0,0 +1,49 @@
|
||||
[package]
|
||||
name = "tauri-plugin-stronghold"
|
||||
version = "2.3.2"
|
||||
description = "Store secrets and keys using the IOTA Stronghold secret management engine."
|
||||
authors = { workspace = true }
|
||||
license = { workspace = true }
|
||||
edition = { workspace = true }
|
||||
rust-version = { workspace = true }
|
||||
repository = { workspace = true }
|
||||
links = "tauri-plugin-stronghold"
|
||||
exclude = [
|
||||
"/banner.png",
|
||||
"/guest-js",
|
||||
"/package.json",
|
||||
"/rollup.config.js",
|
||||
"/tsconfig.json",
|
||||
]
|
||||
|
||||
[package.metadata.platforms.support]
|
||||
windows = { level = "full", notes = "" }
|
||||
linux = { level = "full", notes = "" }
|
||||
macos = { level = "full", notes = "" }
|
||||
android = { level = "full", notes = "" }
|
||||
ios = { level = "full", notes = "" }
|
||||
|
||||
[build-dependencies]
|
||||
tauri-plugin = { workspace = true, features = ["build"] }
|
||||
|
||||
[dependencies]
|
||||
serde = { workspace = true }
|
||||
serde_json = { workspace = true }
|
||||
tauri = { workspace = true }
|
||||
log = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
iota_stronghold = "2"
|
||||
iota-crypto = "0.23"
|
||||
hex = "0.4"
|
||||
zeroize = { version = "1", features = ["zeroize_derive"] }
|
||||
rust-argon2 = { version = "2", optional = true }
|
||||
rand_chacha = { version = "0.9", optional = true }
|
||||
rand_core = { version = "0.9", features = ["os_rng"], optional = true }
|
||||
|
||||
[dev-dependencies]
|
||||
rand = "0.9"
|
||||
rusty-fork = "0.3"
|
||||
|
||||
[features]
|
||||
default = ["kdf"]
|
||||
kdf = ["dep:rust-argon2", "dep:rand_chacha", "dep:rand_core"]
|
||||
20
plugins/stronghold/LICENSE.spdx
Normal file
20
plugins/stronghold/LICENSE.spdx
Normal file
@@ -0,0 +1,20 @@
|
||||
SPDXVersion: SPDX-2.1
|
||||
DataLicense: CC0-1.0
|
||||
PackageName: tauri
|
||||
DataFormat: SPDXRef-1
|
||||
PackageSupplier: Organization: The Tauri Programme in the Commons Conservancy
|
||||
PackageHomePage: https://tauri.app
|
||||
PackageLicenseDeclared: Apache-2.0
|
||||
PackageLicenseDeclared: MIT
|
||||
PackageCopyrightText: 2019-2022, The Tauri Programme in the Commons Conservancy
|
||||
PackageSummary: <text>Tauri is a rust project that enables developers to make secure
|
||||
and small desktop applications using a web frontend.
|
||||
</text>
|
||||
PackageComment: <text>The package includes the following libraries; see
|
||||
Relationship information.
|
||||
</text>
|
||||
Created: 2019-05-20T09:00:00Z
|
||||
PackageDownloadLocation: git://github.com/tauri-apps/tauri
|
||||
PackageDownloadLocation: git+https://github.com/tauri-apps/tauri.git
|
||||
PackageDownloadLocation: git+ssh://github.com/tauri-apps/tauri.git
|
||||
Creator: Person: Daniel Thompson-Yvetot
|
||||
177
plugins/stronghold/LICENSE_APACHE-2.0
Normal file
177
plugins/stronghold/LICENSE_APACHE-2.0
Normal file
@@ -0,0 +1,177 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
21
plugins/stronghold/LICENSE_MIT
Normal file
21
plugins/stronghold/LICENSE_MIT
Normal file
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2017 - Present Tauri Apps Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
169
plugins/stronghold/README.md
Normal file
169
plugins/stronghold/README.md
Normal file
@@ -0,0 +1,169 @@
|
||||
|
||||
|
||||
Store secrets and keys using the [IOTA Stronghold](https://github.com/iotaledger/stronghold.rs) secret management engine.
|
||||
|
||||
| Platform | Supported |
|
||||
| -------- | --------- |
|
||||
| Linux | ✓ |
|
||||
| Windows | ✓ |
|
||||
| macOS | ✓ |
|
||||
| Android | ✓ |
|
||||
| iOS | ✓ |
|
||||
|
||||
## Install
|
||||
|
||||
_This plugin requires a Rust version of at least **1.77.2**_
|
||||
|
||||
There are three general methods of installation that we can recommend.
|
||||
|
||||
1. Use crates.io and npm (easiest, and requires you to trust that our publishing pipeline worked)
|
||||
2. Pull sources directly from Github using git tags / revision hashes (most secure)
|
||||
3. Git submodule install this repo in your tauri project and then use file protocol to ingest the source (most secure, but inconvenient to use)
|
||||
|
||||
Install the Core plugin by adding the following to your `Cargo.toml` file:
|
||||
|
||||
`src-tauri/Cargo.toml`
|
||||
|
||||
```toml
|
||||
[dependencies]
|
||||
tauri-plugin-stronghold = "2.0.0"
|
||||
# alternatively with Git:
|
||||
tauri-plugin-stronghold = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "v2" }
|
||||
```
|
||||
|
||||
Due to an [upstream bug](https://github.com/tauri-apps/plugins-workspace/issues/2048) we also recommend that you add this to your `Cargo.toml` file:
|
||||
|
||||
```toml
|
||||
[profile.dev.package.scrypt]
|
||||
opt-level = 3
|
||||
```
|
||||
|
||||
You can install the JavaScript Guest bindings using your preferred JavaScript package manager:
|
||||
|
||||
> Note: If your JavaScript package manager cannot install packages from git monorepos, you can still use the code by manually copying the [Guest bindings](./guest-js/index.ts) into your source files.
|
||||
|
||||
```sh
|
||||
pnpm add @tauri-apps/plugin-stronghold
|
||||
# or
|
||||
npm add @tauri-apps/plugin-stronghold
|
||||
# or
|
||||
yarn add @tauri-apps/plugin-stronghold
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
First you need to register the core plugin with Tauri:
|
||||
|
||||
`src-tauri/src/lib.rs`
|
||||
|
||||
```rust
|
||||
fn main() {
|
||||
tauri::Builder::default()
|
||||
.plugin(tauri_plugin_stronghold::Builder::new(|password| {
|
||||
// Hash the password here with e.g. argon2, blake2b or any other secure algorithm
|
||||
// Here is an example implementation using the `rust-argon2` crate for hashing the password
|
||||
|
||||
use argon2::{hash_raw, Config, Variant, Version};
|
||||
|
||||
let config = Config {
|
||||
lanes: 4,
|
||||
mem_cost: 10_000,
|
||||
time_cost: 10,
|
||||
variant: Variant::Argon2id,
|
||||
version: Version::Version13,
|
||||
..Default::default()
|
||||
};
|
||||
|
||||
let salt = "your-salt".as_bytes();
|
||||
|
||||
let key = hash_raw(password.as_ref(), salt, &config).expect("failed to hash password");
|
||||
|
||||
key.to_vec()
|
||||
})
|
||||
.build())
|
||||
.run(tauri::generate_context!())
|
||||
.expect("error while running tauri application");
|
||||
}
|
||||
```
|
||||
|
||||
Afterwards all the plugin's APIs are available through the JavaScript guest bindings:
|
||||
|
||||
```javascript
|
||||
import { Stronghold, Location, Client } from "tauri-plugin-stronghold-api";
|
||||
import { appDataDir } from "@tauri-apps/api/path";
|
||||
|
||||
const initStronghold = async () => {
|
||||
const vaultPath = `${await appDataDir()}/vault.hold`;
|
||||
|
||||
const vaultKey = "The key to the vault";
|
||||
|
||||
const stronghold = await Stronghold.load(vaultPath, vaultKey);
|
||||
|
||||
let client: Client;
|
||||
|
||||
const clientName = "name your client";
|
||||
|
||||
try {
|
||||
client = await hold.loadClient(clientName);
|
||||
} catch {
|
||||
client = await hold.createClient(clientName);
|
||||
}
|
||||
|
||||
return {
|
||||
stronghold,
|
||||
client,
|
||||
};
|
||||
};
|
||||
|
||||
const { stronghold, client } = await initStronghold();
|
||||
|
||||
const store = client.getStore();
|
||||
|
||||
const key = "my_key";
|
||||
|
||||
// Insert a record to the store
|
||||
|
||||
const data = Array.from(new TextEncoder().encode("Hello, World!"));
|
||||
|
||||
await store.insert(key, data);
|
||||
|
||||
// Read a record from store
|
||||
|
||||
const data = await store.get(key);
|
||||
|
||||
const value = new TextDecoder().decode(new Uint8Array(data));
|
||||
|
||||
// Save your updates
|
||||
|
||||
await stronghold.save();
|
||||
|
||||
// Remove a record from store
|
||||
|
||||
await store.remove(key);
|
||||
```
|
||||
|
||||
## Contributing
|
||||
|
||||
PRs accepted. Please make sure to read the Contributing Guide before making a pull request.
|
||||
|
||||
## Partners
|
||||
|
||||
<table>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td align="center" valign="middle">
|
||||
<a href="https://crabnebula.dev" target="_blank">
|
||||
<img src="https://github.com/tauri-apps/plugins-workspace/raw/v2/.github/sponsors/crabnebula.svg" alt="CrabNebula" width="283">
|
||||
</a>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
For the complete list of sponsors please visit our [website](https://tauri.app#sponsors) and [Open Collective](https://opencollective.com/tauri).
|
||||
|
||||
## License
|
||||
|
||||
Code: (c) 2015 - Present - The Tauri Programme within The Commons Conservancy.
|
||||
|
||||
MIT or MIT/Apache 2.0 where applicable.
|
||||
23
plugins/stronghold/SECURITY.md
Normal file
23
plugins/stronghold/SECURITY.md
Normal file
@@ -0,0 +1,23 @@
|
||||
# Security Policy
|
||||
|
||||
**Do not report security vulnerabilities through public GitHub issues.**
|
||||
|
||||
**Please use the [Private Vulnerability Disclosure](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability) feature of GitHub.**
|
||||
|
||||
Include as much of the following information:
|
||||
|
||||
- Type of issue (e.g. improper input parsing, privilege escalation, etc.)
|
||||
- The location of the affected source code (tag/branch/commit or direct URL)
|
||||
- Any special configuration required to reproduce the issue
|
||||
- The distribution affected or used to help us with reproduction of the issue
|
||||
- Step-by-step instructions to reproduce the issue
|
||||
- Ideally a reproduction repository
|
||||
- Impact of the issue, including how an attacker might exploit the issue
|
||||
|
||||
We prefer to receive reports in English.
|
||||
|
||||
## Contact
|
||||
|
||||
Please disclose a vulnerability or security relevant issue here: [https://github.com/tauri-apps/plugins-workspace/security/advisories/new](https://github.com/tauri-apps/plugins-workspace/security/advisories/new).
|
||||
|
||||
Alternatively, you can also contact us by email via [security@tauri.app](mailto:security@tauri.app).
|
||||
1
plugins/stronghold/api-iife.js
Normal file
1
plugins/stronghold/api-iife.js
Normal file
@@ -0,0 +1 @@
|
||||
if("__TAURI__"in window){var __TAURI_PLUGIN_STRONGHOLD__=function(t,e){"use strict";class r{constructor(t,e){this.type=t,this.payload=e}static generic(t,e){return new r("Generic",{vault:t,record:e})}static counter(t,e){return new r("Counter",{vault:t,counter:e})}}class n{constructor(t){this.procedureArgs=t}async generateSLIP10Seed(t,r){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"SLIP10Generate",payload:{output:t,sizeBytes:r}}}).then(t=>Uint8Array.from(t))}async deriveSLIP10(t,r,n,a){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"SLIP10Derive",payload:{chain:t,input:{type:r,payload:n},output:a}}}).then(t=>Uint8Array.from(t))}async recoverBIP39(t,r,n){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"BIP39Recover",payload:{mnemonic:t,passphrase:n,output:r}}}).then(t=>Uint8Array.from(t))}async generateBIP39(t,r){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"BIP39Generate",payload:{output:t,passphrase:r}}}).then(t=>Uint8Array.from(t))}async getEd25519PublicKey(t){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"PublicKey",payload:{type:"Ed25519",privateKey:t}}}).then(t=>Uint8Array.from(t))}async signEd25519(t,r){return await e.invoke("plugin:stronghold|execute_procedure",{...this.procedureArgs,procedure:{type:"Ed25519Sign",payload:{privateKey:t,msg:r}}}).then(t=>Uint8Array.from(t))}}class a{constructor(t,e){this.path=t,this.name=e}getVault(t){return new s(this.path,this.name,t)}getStore(){return new o(this.path,this.name)}}class o{constructor(t,e){this.path=t,this.client=e}async get(t){return await e.invoke("plugin:stronghold|get_store_record",{snapshotPath:this.path,client:this.client,key:t}).then(t=>t&&Uint8Array.from(t))}async insert(t,r,n){await e.invoke("plugin:stronghold|save_store_record",{snapshotPath:this.path,client:this.client,key:t,value:r,lifetime:n})}async remove(t){return await e.invoke("plugin:stronghold|remove_store_record",{snapshotPath:this.path,client:this.client,key:t}).then(t=>t&&Uint8Array.from(t))}}class s extends n{constructor(t,e,r){super({snapshotPath:t,client:e,vault:r}),this.path=t,this.client=e,this.name=r}async insert(t,r){await e.invoke("plugin:stronghold|save_secret",{snapshotPath:this.path,client:this.client,vault:this.name,recordPath:t,secret:r})}async remove(t){await e.invoke("plugin:stronghold|remove_secret",{snapshotPath:this.path,client:this.client,vault:this.name,recordPath:t.payload.record})}}class i{constructor(t){this.path=t}static async load(t,r){return await e.invoke("plugin:stronghold|initialize",{snapshotPath:t,password:r}).then(()=>new i(t))}async unload(){await e.invoke("plugin:stronghold|destroy",{snapshotPath:this.path})}async loadClient(t){return await e.invoke("plugin:stronghold|load_client",{snapshotPath:this.path,client:t}).then(()=>new a(this.path,t))}async createClient(t){return await e.invoke("plugin:stronghold|create_client",{snapshotPath:this.path,client:t}).then(()=>new a(this.path,t))}async save(){await e.invoke("plugin:stronghold|save",{snapshotPath:this.path})}}return t.Client=a,t.Location=r,t.Store=o,t.Stronghold=i,t.Vault=s,t}({},window.__TAURI__.core);Object.defineProperty(window.__TAURI__,"stronghold",{value:__TAURI_PLUGIN_STRONGHOLD__})}
|
||||
BIN
plugins/stronghold/banner.png
Normal file
BIN
plugins/stronghold/banner.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
23
plugins/stronghold/build.rs
Normal file
23
plugins/stronghold/build.rs
Normal file
@@ -0,0 +1,23 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
const COMMANDS: &[&str] = &[
|
||||
"initialize",
|
||||
"destroy",
|
||||
"save",
|
||||
"create_client",
|
||||
"load_client",
|
||||
"get_store_record",
|
||||
"save_store_record",
|
||||
"remove_store_record",
|
||||
"save_secret",
|
||||
"remove_secret",
|
||||
"execute_procedure",
|
||||
];
|
||||
|
||||
fn main() {
|
||||
tauri_plugin::Builder::new(COMMANDS)
|
||||
.global_api_script_path("./api-iife.js")
|
||||
.build();
|
||||
}
|
||||
768
plugins/stronghold/guest-js/index.ts
Normal file
768
plugins/stronghold/guest-js/index.ts
Normal file
@@ -0,0 +1,768 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
/**
|
||||
* Store secrets and keys using the [IOTA Stronghold](https://github.com/iotaledger/stronghold.rs)
|
||||
* encrypted database and secure runtime.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { invoke } from '@tauri-apps/api/core'
|
||||
|
||||
/**
|
||||
* The name of a Stronghold client, either as a UTF-8 string or as its raw byte representation.
|
||||
*/
|
||||
export type ClientPath =
|
||||
| string
|
||||
| Iterable<number>
|
||||
| ArrayLike<number>
|
||||
| ArrayBuffer
|
||||
/**
|
||||
* The path of a vault inside a client, either as a UTF-8 string or as its raw byte representation.
|
||||
*/
|
||||
export type VaultPath =
|
||||
| string
|
||||
| Iterable<number>
|
||||
| ArrayLike<number>
|
||||
| ArrayBuffer
|
||||
/**
|
||||
* The path of a record inside a vault, either as a UTF-8 string or as its raw byte representation.
|
||||
*/
|
||||
export type RecordPath =
|
||||
| string
|
||||
| Iterable<number>
|
||||
| ArrayLike<number>
|
||||
| ArrayBuffer
|
||||
/**
|
||||
* The key of a record in a client store. Note that the store commands read the
|
||||
* key as a string on the Rust side, so string keys are the safe choice.
|
||||
*/
|
||||
export type StoreKey =
|
||||
| string
|
||||
| Iterable<number>
|
||||
| ArrayLike<number>
|
||||
| ArrayBuffer
|
||||
|
||||
/**
|
||||
* The limits applied to the connections of a Stronghold peer-to-peer network.
|
||||
* See {@link NetworkConfig} for a note on how these definitions are used.
|
||||
*/
|
||||
export interface ConnectionLimits {
|
||||
/** The maximum number of incoming connections that can be pending at the same time. */
|
||||
maxPendingIncoming?: number
|
||||
/** The maximum number of outgoing connections that can be pending at the same time. */
|
||||
maxPendingOutgoing?: number
|
||||
/** The maximum number of established incoming connections. */
|
||||
maxEstablishedIncoming?: number
|
||||
/** The maximum number of established outgoing connections. */
|
||||
maxEstablishedOutgoing?: number
|
||||
/** The maximum number of established connections per peer. */
|
||||
maxEstablishedPerPeer?: number
|
||||
/** The maximum number of established connections, incoming and outgoing combined. */
|
||||
maxEstablishedTotal?: number
|
||||
}
|
||||
|
||||
/**
|
||||
* The addresses on which a remote peer can be reached.
|
||||
* See {@link NetworkConfig} for a note on how these definitions are used.
|
||||
*/
|
||||
export interface PeerAddress {
|
||||
/** The addresses that are known for the peer, in the multiaddr format. */
|
||||
known: string[] // multiaddr
|
||||
/** Whether the peer may be reached through a relay when its known addresses cannot be used. */
|
||||
use_relay_fallback: boolean
|
||||
}
|
||||
|
||||
/**
|
||||
* The address book of the peer-to-peer network.
|
||||
* See {@link NetworkConfig} for a note on how these definitions are used.
|
||||
*/
|
||||
export interface AddressInfo {
|
||||
/** The known addresses of each peer, keyed by the peer identifier. */
|
||||
peers: Map<string, PeerAddress>
|
||||
/** The identifiers of the peers that can be used as relays. */
|
||||
relays: string[] // peers
|
||||
}
|
||||
|
||||
/**
|
||||
* The operations a remote peer is allowed to perform on a client.
|
||||
* See {@link NetworkConfig} for a note on how these definitions are used.
|
||||
*/
|
||||
export interface ClientAccess {
|
||||
/** The default permission to use the secrets stored in a vault. */
|
||||
useVaultDefault?: boolean
|
||||
/** Per-vault overrides of {@link ClientAccess.useVaultDefault}. */
|
||||
useVaultExceptions?: Map<VaultPath, boolean>
|
||||
/** The default permission to write secrets to a vault. */
|
||||
writeVaultDefault?: boolean
|
||||
/** Per-vault overrides of {@link ClientAccess.writeVaultDefault}. */
|
||||
writeVaultExceptions?: Map<VaultPath, boolean>
|
||||
/** The default permission to clone the secrets of a vault. */
|
||||
cloneVaultDefault?: boolean
|
||||
/** Per-vault overrides of {@link ClientAccess.cloneVaultDefault}. */
|
||||
cloneVaultExceptions?: Map<VaultPath, boolean>
|
||||
/** Whether the store of the client can be read. */
|
||||
readStore?: boolean
|
||||
/** Whether the store of the client can be written to. */
|
||||
writeStore?: boolean
|
||||
}
|
||||
|
||||
/**
|
||||
* The access a remote peer is granted on the clients of a snapshot.
|
||||
* See {@link NetworkConfig} for a note on how these definitions are used.
|
||||
*/
|
||||
export interface Permissions {
|
||||
/** The access granted when no exception matches. */
|
||||
default?: ClientAccess
|
||||
/** The access granted for specific paths, overriding {@link Permissions.default}. */
|
||||
exceptions?: Map<VaultPath, ClientAccess>
|
||||
}
|
||||
|
||||
/**
|
||||
* The configuration of the Stronghold peer-to-peer network.
|
||||
*
|
||||
* These definitions mirror the networking options of IOTA Stronghold. The plugin
|
||||
* does not currently expose a command that consumes them, so they are only useful
|
||||
* as type definitions.
|
||||
*/
|
||||
export interface NetworkConfig {
|
||||
/** The maximum time to wait for the response to an outbound request. */
|
||||
requestTimeout?: Duration
|
||||
/** The maximum time to wait when establishing a connection to a peer. */
|
||||
connectionTimeout?: Duration
|
||||
/** The limits applied to pending and established connections. */
|
||||
connectionsLimit?: ConnectionLimits
|
||||
/** Whether peers on the local network are discovered through mDNS. */
|
||||
enableMdns?: boolean
|
||||
/** Whether connections relayed by another peer are enabled. */
|
||||
enableRelay?: boolean
|
||||
/** The addresses of the known peers and of the available relays. */
|
||||
addresses?: AddressInfo
|
||||
/** The permissions granted to specific peers, keyed by the peer identifier. */
|
||||
peerPermissions?: Map<string, Permissions>
|
||||
/** The permissions granted to the peers that have no entry in {@link NetworkConfig.peerPermissions}. */
|
||||
permissionsDefault?: Permissions
|
||||
}
|
||||
|
||||
/** A duration definition. */
|
||||
export interface Duration {
|
||||
/** The number of whole seconds contained by this Duration. */
|
||||
secs: number
|
||||
/** The fractional part of this Duration, in nanoseconds. Must be greater or equal to 0 and smaller than 1e+9 (the max number of nanoseoncds in a second) */
|
||||
nanos: number
|
||||
}
|
||||
|
||||
/**
|
||||
* A pointer to a record inside a vault, either addressed by its record path
|
||||
* ({@link Location.generic}) or by a counter ({@link Location.counter}).
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
export class Location {
|
||||
/** The location kind, either `Generic` or `Counter`. */
|
||||
type: string
|
||||
/** The location data, holding the vault path and the record path or counter. */
|
||||
payload: Record<string, unknown>
|
||||
|
||||
/**
|
||||
* Creates a location of the given kind. Prefer the {@link Location.generic}
|
||||
* and {@link Location.counter} helpers, which fill the payload for you.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Location } from '@tauri-apps/plugin-stronghold';
|
||||
* const location = new Location('Generic', { vault: 'my-vault', record: 'my-record' });
|
||||
* ```
|
||||
*
|
||||
* @param type The location kind, either `Generic` or `Counter`.
|
||||
* @param payload The data identifying the record inside the vault.
|
||||
*/
|
||||
constructor(type: string, payload: Record<string, unknown>) {
|
||||
this.type = type
|
||||
this.payload = payload
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a location addressing a record of a vault by its record path.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Location } from '@tauri-apps/plugin-stronghold';
|
||||
* const location = Location.generic('my-vault', 'my-record');
|
||||
* ```
|
||||
*
|
||||
* @param vault The path of the vault holding the record.
|
||||
* @param record The path of the record inside the vault.
|
||||
* @returns The location of the record.
|
||||
*/
|
||||
static generic(vault: VaultPath, record: RecordPath): Location {
|
||||
return new Location('Generic', {
|
||||
vault,
|
||||
record
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a location addressing a record of a vault by a counter.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Location } from '@tauri-apps/plugin-stronghold';
|
||||
* const location = Location.counter('my-vault', 0);
|
||||
* ```
|
||||
*
|
||||
* @param vault The path of the vault holding the record.
|
||||
* @param counter The counter identifying the record inside the vault.
|
||||
* @returns The location of the record.
|
||||
*/
|
||||
static counter(vault: VaultPath, counter: number): Location {
|
||||
return new Location('Counter', {
|
||||
vault,
|
||||
counter
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
class ProcedureExecutor {
|
||||
procedureArgs: Record<string, unknown>
|
||||
|
||||
constructor(procedureArgs: Record<string, unknown>) {
|
||||
this.procedureArgs = procedureArgs
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a SLIP10 seed for the given location.
|
||||
* @param outputLocation Location of the record where the seed will be stored.
|
||||
* @param sizeBytes The size in bytes of the SLIP10 seed.
|
||||
* @returns A promise resolving to the bytes returned by the procedure.
|
||||
*/
|
||||
async generateSLIP10Seed(
|
||||
outputLocation: Location,
|
||||
sizeBytes?: number
|
||||
): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'SLIP10Generate',
|
||||
payload: {
|
||||
output: outputLocation,
|
||||
sizeBytes
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
|
||||
/**
|
||||
* Derive a SLIP10 private key using a seed or key. The derivation is always
|
||||
* performed on the Ed25519 curve.
|
||||
* @param chain The chain path.
|
||||
* @param source The source type, either 'Seed' or 'Key'.
|
||||
* @param sourceLocation The source location, must be the `outputLocation` of a previous call to `generateSLIP10Seed` or `deriveSLIP10`.
|
||||
* @param outputLocation Location of the record where the private key will be stored.
|
||||
* @returns A promise resolving to the bytes returned by the procedure.
|
||||
*/
|
||||
async deriveSLIP10(
|
||||
chain: number[],
|
||||
source: 'Seed' | 'Key',
|
||||
sourceLocation: Location,
|
||||
outputLocation: Location
|
||||
): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'SLIP10Derive',
|
||||
payload: {
|
||||
chain,
|
||||
input: {
|
||||
type: source,
|
||||
payload: sourceLocation
|
||||
},
|
||||
output: outputLocation
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
|
||||
/**
|
||||
* Store a BIP39 mnemonic.
|
||||
* @param mnemonic The mnemonic string.
|
||||
* @param outputLocation The location of the record where the BIP39 mnemonic will be stored.
|
||||
* @param passphrase The optional mnemonic passphrase.
|
||||
* @returns A promise resolving to the bytes returned by the procedure.
|
||||
*/
|
||||
async recoverBIP39(
|
||||
mnemonic: string,
|
||||
outputLocation: Location,
|
||||
passphrase?: string
|
||||
): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'BIP39Recover',
|
||||
payload: {
|
||||
mnemonic,
|
||||
passphrase,
|
||||
output: outputLocation
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a BIP39 seed. The mnemonic is generated in English.
|
||||
* @param outputLocation The location of the record where the BIP39 seed will be stored.
|
||||
* @param passphrase The optional mnemonic passphrase.
|
||||
* @returns A promise resolving to the bytes returned by the procedure.
|
||||
*/
|
||||
async generateBIP39(
|
||||
outputLocation: Location,
|
||||
passphrase?: string
|
||||
): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'BIP39Generate',
|
||||
payload: {
|
||||
output: outputLocation,
|
||||
passphrase
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the Ed25519 public key of a SLIP10 private key.
|
||||
* @param privateKeyLocation The location of the private key. Must be the `outputLocation` of a previous call to `deriveSLIP10`.
|
||||
* @returns A promise resolving to the public key hex string.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
async getEd25519PublicKey(privateKeyLocation: Location): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'PublicKey',
|
||||
payload: {
|
||||
type: 'Ed25519',
|
||||
privateKey: privateKeyLocation
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a Ed25519 signature from a private key.
|
||||
* @param privateKeyLocation The location of the record where the private key is stored. Must be the `outputLocation` of a previous call to `deriveSLIP10`.
|
||||
* @param msg The message to sign.
|
||||
* @returns A promise resolving to the signature hex string.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
async signEd25519(
|
||||
privateKeyLocation: Location,
|
||||
msg: string
|
||||
): Promise<Uint8Array> {
|
||||
return await invoke<number[]>('plugin:stronghold|execute_procedure', {
|
||||
...this.procedureArgs,
|
||||
procedure: {
|
||||
type: 'Ed25519Sign',
|
||||
payload: {
|
||||
privateKey: privateKeyLocation,
|
||||
msg
|
||||
}
|
||||
}
|
||||
}).then((n) => Uint8Array.from(n))
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A client of a stronghold snapshot, owning a set of vaults and a key-value store.
|
||||
* Clients are obtained with {@link Stronghold.loadClient} and {@link Stronghold.createClient}.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
export class Client {
|
||||
/** The path of the snapshot file this client belongs to. */
|
||||
path: string
|
||||
/** The name identifying this client inside the snapshot. */
|
||||
name: ClientPath
|
||||
|
||||
/**
|
||||
* Creates a client handle for a client that was already loaded or created.
|
||||
* Prefer {@link Stronghold.loadClient} and {@link Stronghold.createClient},
|
||||
* which also register the client on the Rust side.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Client } from '@tauri-apps/plugin-stronghold';
|
||||
* const client = new Client('/path/to/snapshot.hold', 'my-client');
|
||||
* ```
|
||||
*
|
||||
* @param path The path of the snapshot file the client belongs to.
|
||||
* @param name The name identifying the client inside the snapshot.
|
||||
*/
|
||||
constructor(path: string, name: ClientPath) {
|
||||
this.path = path
|
||||
this.name = name
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a handle to the vault with the given name. The vault is created on the
|
||||
* Rust side when the first secret is written to it.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* const vault = client.getVault('my-vault');
|
||||
* ```
|
||||
*
|
||||
* @param name The path of the vault.
|
||||
* @returns The vault handle.
|
||||
*/
|
||||
getVault(name: VaultPath): Vault {
|
||||
return new Vault(this.path, this.name, name)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a handle to the key-value store of this client.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* const store = client.getStore();
|
||||
* ```
|
||||
*
|
||||
* @returns The store handle.
|
||||
*/
|
||||
getStore(): Store {
|
||||
return new Store(this.path, this.name)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The key-value store of a {@link Client}. Unlike a {@link Vault}, the values
|
||||
* stored here can be read back directly.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
export class Store {
|
||||
/** The path of the snapshot file this store belongs to. */
|
||||
path: string
|
||||
/** The name of the client owning this store. */
|
||||
client: ClientPath
|
||||
|
||||
/**
|
||||
* Creates a store handle for a client that was already loaded or created.
|
||||
* Prefer {@link Client.getStore}.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Store } from '@tauri-apps/plugin-stronghold';
|
||||
* const store = new Store('/path/to/snapshot.hold', 'my-client');
|
||||
* ```
|
||||
*
|
||||
* @param path The path of the snapshot file the store belongs to.
|
||||
* @param client The name of the client owning the store.
|
||||
*/
|
||||
constructor(path: string, client: ClientPath) {
|
||||
this.path = path
|
||||
this.client = client
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads the value of a record of this store.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* const value = await client.getStore().get('my-key');
|
||||
* ```
|
||||
*
|
||||
* @param key The key of the record.
|
||||
* @returns A promise resolving to the stored value, or `null` if the key does not exist.
|
||||
*/
|
||||
async get(key: StoreKey): Promise<Uint8Array | null> {
|
||||
return await invoke<number[] | null>('plugin:stronghold|get_store_record', {
|
||||
snapshotPath: this.path,
|
||||
client: this.client,
|
||||
key
|
||||
}).then((v) => v && Uint8Array.from(v))
|
||||
}
|
||||
|
||||
/**
|
||||
* Inserts a record in this store, replacing the previous value of the key.
|
||||
* Note that the snapshot is only persisted when {@link Stronghold.save} is called.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* const data = Array.from(new TextEncoder().encode('Hello, World!'));
|
||||
* await client.getStore().insert('my-key', data);
|
||||
* await stronghold.save();
|
||||
* ```
|
||||
*
|
||||
* @param key The key of the record.
|
||||
* @param value The value of the record, as an array of bytes.
|
||||
* @param lifetime The optional duration after which the record expires.
|
||||
*/
|
||||
async insert(
|
||||
key: StoreKey,
|
||||
value: number[],
|
||||
lifetime?: Duration
|
||||
): Promise<void> {
|
||||
await invoke('plugin:stronghold|save_store_record', {
|
||||
snapshotPath: this.path,
|
||||
client: this.client,
|
||||
key,
|
||||
value,
|
||||
lifetime
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Deletes a record from this store.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* await client.getStore().remove('my-key');
|
||||
* ```
|
||||
*
|
||||
* @param key The key of the record.
|
||||
* @returns A promise resolving to the deleted value, or `null` if the key did not exist.
|
||||
*/
|
||||
async remove(key: StoreKey): Promise<Uint8Array | null> {
|
||||
return await invoke<number[] | null>(
|
||||
'plugin:stronghold|remove_store_record',
|
||||
{
|
||||
snapshotPath: this.path,
|
||||
client: this.client,
|
||||
key
|
||||
}
|
||||
).then((v) => v && Uint8Array.from(v))
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A key-value storage that allows create, update and delete operations.
|
||||
* It does not allow reading the data, so one of the procedures must be used to manipulate
|
||||
* the stored data, allowing secure storage of secrets.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
export class Vault extends ProcedureExecutor {
|
||||
/** The path of the snapshot file this vault belongs to. */
|
||||
path: string
|
||||
/** The name of the client owning this vault. */
|
||||
client: ClientPath
|
||||
/** The path identifying this vault inside the client. */
|
||||
name: VaultPath
|
||||
|
||||
/**
|
||||
* Creates a vault handle for a client that was already loaded or created.
|
||||
* Prefer {@link Client.getVault}.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Vault } from '@tauri-apps/plugin-stronghold';
|
||||
* const vault = new Vault('/path/to/snapshot.hold', 'my-client', 'my-vault');
|
||||
* ```
|
||||
*
|
||||
* @param path The path of the snapshot file the vault belongs to.
|
||||
* @param client The name of the client owning the vault.
|
||||
* @param name The path identifying the vault inside the client.
|
||||
*/
|
||||
constructor(path: string, client: ClientPath, name: VaultPath) {
|
||||
super({
|
||||
snapshotPath: path,
|
||||
client,
|
||||
vault: name
|
||||
})
|
||||
this.path = path
|
||||
this.client = client
|
||||
this.name = name
|
||||
}
|
||||
|
||||
/**
|
||||
* Writes a secret to this vault. Note that the snapshot is only persisted
|
||||
* when {@link Stronghold.save} is called.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* const secret = Array.from(new TextEncoder().encode('secret value'));
|
||||
* await client.getVault('my-vault').insert('my-record', secret);
|
||||
* await stronghold.save();
|
||||
* ```
|
||||
*
|
||||
* @param recordPath The path of the record inside this vault.
|
||||
* @param secret The secret to store, as an array of bytes.
|
||||
*/
|
||||
async insert(recordPath: RecordPath, secret: number[]): Promise<void> {
|
||||
await invoke('plugin:stronghold|save_secret', {
|
||||
snapshotPath: this.path,
|
||||
client: this.client,
|
||||
vault: this.name,
|
||||
recordPath,
|
||||
secret
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Deletes a secret from this vault. Only the record path of the given
|
||||
* location is used, the vault is always this one.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold, Location } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* await client
|
||||
* .getVault('my-vault')
|
||||
* .remove(Location.generic('my-vault', 'my-record'));
|
||||
* ```
|
||||
*
|
||||
* @param location The location of the record to delete.
|
||||
*/
|
||||
async remove(location: Location): Promise<void> {
|
||||
await invoke('plugin:stronghold|remove_secret', {
|
||||
snapshotPath: this.path,
|
||||
client: this.client,
|
||||
vault: this.name,
|
||||
recordPath: location.payload.record
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A representation of an access to a stronghold.
|
||||
*
|
||||
* @since 2.0.0
|
||||
*/
|
||||
export class Stronghold {
|
||||
/** The path of the snapshot file backing this stronghold. */
|
||||
path: string
|
||||
|
||||
/**
|
||||
* Creates a handle to the stronghold initialized for the given snapshot path.
|
||||
* @param path The path of the snapshot file.
|
||||
*/
|
||||
private constructor(path: string) {
|
||||
this.path = path
|
||||
}
|
||||
|
||||
/**
|
||||
* Load the snapshot if it exists (password must match), or start a fresh stronghold instance otherwise.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* import { appDataDir } from '@tauri-apps/api/path';
|
||||
* const stronghold = await Stronghold.load(`${await appDataDir()}/vault.hold`, 'password');
|
||||
* ```
|
||||
*
|
||||
* @param path The path of the snapshot file.
|
||||
* @param password The password used to encrypt and decrypt the snapshot.
|
||||
* @returns A promise resolving to the stronghold instance.
|
||||
*/
|
||||
static async load(path: string, password: string): Promise<Stronghold> {
|
||||
return await invoke('plugin:stronghold|initialize', {
|
||||
snapshotPath: path,
|
||||
password
|
||||
}).then(() => new Stronghold(path))
|
||||
}
|
||||
|
||||
/**
|
||||
* Saves the snapshot and removes this instance from the cache.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* await stronghold.unload();
|
||||
* ```
|
||||
*/
|
||||
async unload(): Promise<void> {
|
||||
await invoke('plugin:stronghold|destroy', {
|
||||
snapshotPath: this.path
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Loads an existing client from the snapshot. The promise rejects if the
|
||||
* client does not exist in the snapshot or was already loaded.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.loadClient('my-client');
|
||||
* ```
|
||||
*
|
||||
* @param client The name of the client.
|
||||
* @returns A promise resolving to the loaded client.
|
||||
*/
|
||||
async loadClient(client: ClientPath): Promise<Client> {
|
||||
return await invoke('plugin:stronghold|load_client', {
|
||||
snapshotPath: this.path,
|
||||
client
|
||||
}).then(() => new Client(this.path, client))
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a new empty client on this stronghold.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* let client;
|
||||
* try {
|
||||
* client = await stronghold.loadClient('my-client');
|
||||
* } catch {
|
||||
* client = await stronghold.createClient('my-client');
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* @param client The name of the client.
|
||||
* @returns A promise resolving to the created client.
|
||||
*/
|
||||
async createClient(client: ClientPath): Promise<Client> {
|
||||
return await invoke('plugin:stronghold|create_client', {
|
||||
snapshotPath: this.path,
|
||||
client
|
||||
}).then(() => new Client(this.path, client))
|
||||
}
|
||||
|
||||
/**
|
||||
* Persists the stronghold state to the snapshot.
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* import { Stronghold } from '@tauri-apps/plugin-stronghold';
|
||||
* const stronghold = await Stronghold.load('/path/to/snapshot.hold', 'password');
|
||||
* const client = await stronghold.createClient('my-client');
|
||||
* await client.getStore().insert('my-key', [1, 2, 3]);
|
||||
* await stronghold.save();
|
||||
* ```
|
||||
*/
|
||||
async save(): Promise<void> {
|
||||
await invoke('plugin:stronghold|save', {
|
||||
snapshotPath: this.path
|
||||
})
|
||||
}
|
||||
}
|
||||
30
plugins/stronghold/package.json
Normal file
30
plugins/stronghold/package.json
Normal file
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"name": "@tauri-apps/plugin-stronghold",
|
||||
"version": "2.3.2",
|
||||
"description": "Store secrets and keys using the IOTA Stronghold encrypted database.",
|
||||
"license": "MIT OR Apache-2.0",
|
||||
"authors": [
|
||||
"Tauri Programme within The Commons Conservancy"
|
||||
],
|
||||
"repository": "https://github.com/tauri-apps/plugins-workspace",
|
||||
"type": "module",
|
||||
"types": "./dist-js/index.d.ts",
|
||||
"main": "./dist-js/index.cjs",
|
||||
"module": "./dist-js/index.js",
|
||||
"exports": {
|
||||
"types": "./dist-js/index.d.ts",
|
||||
"import": "./dist-js/index.js",
|
||||
"require": "./dist-js/index.cjs"
|
||||
},
|
||||
"scripts": {
|
||||
"build": "rollup -c"
|
||||
},
|
||||
"files": [
|
||||
"dist-js",
|
||||
"README.md",
|
||||
"LICENSE"
|
||||
],
|
||||
"dependencies": {
|
||||
"@tauri-apps/api": "^2.11.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-create-client"
|
||||
description = "Enables the create_client command without any pre-configured scope."
|
||||
commands.allow = ["create_client"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-create-client"
|
||||
description = "Denies the create_client command without any pre-configured scope."
|
||||
commands.deny = ["create_client"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-destroy"
|
||||
description = "Enables the destroy command without any pre-configured scope."
|
||||
commands.allow = ["destroy"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-destroy"
|
||||
description = "Denies the destroy command without any pre-configured scope."
|
||||
commands.deny = ["destroy"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-execute-procedure"
|
||||
description = "Enables the execute_procedure command without any pre-configured scope."
|
||||
commands.allow = ["execute_procedure"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-execute-procedure"
|
||||
description = "Denies the execute_procedure command without any pre-configured scope."
|
||||
commands.deny = ["execute_procedure"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-get-store-record"
|
||||
description = "Enables the get_store_record command without any pre-configured scope."
|
||||
commands.allow = ["get_store_record"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-get-store-record"
|
||||
description = "Denies the get_store_record command without any pre-configured scope."
|
||||
commands.deny = ["get_store_record"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-initialize"
|
||||
description = "Enables the initialize command without any pre-configured scope."
|
||||
commands.allow = ["initialize"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-initialize"
|
||||
description = "Denies the initialize command without any pre-configured scope."
|
||||
commands.deny = ["initialize"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-load-client"
|
||||
description = "Enables the load_client command without any pre-configured scope."
|
||||
commands.allow = ["load_client"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-load-client"
|
||||
description = "Denies the load_client command without any pre-configured scope."
|
||||
commands.deny = ["load_client"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-remove-secret"
|
||||
description = "Enables the remove_secret command without any pre-configured scope."
|
||||
commands.allow = ["remove_secret"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-remove-secret"
|
||||
description = "Denies the remove_secret command without any pre-configured scope."
|
||||
commands.deny = ["remove_secret"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-remove-store-record"
|
||||
description = "Enables the remove_store_record command without any pre-configured scope."
|
||||
commands.allow = ["remove_store_record"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-remove-store-record"
|
||||
description = "Denies the remove_store_record command without any pre-configured scope."
|
||||
commands.deny = ["remove_store_record"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-save"
|
||||
description = "Enables the save command without any pre-configured scope."
|
||||
commands.allow = ["save"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-save"
|
||||
description = "Denies the save command without any pre-configured scope."
|
||||
commands.deny = ["save"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-save-secret"
|
||||
description = "Enables the save_secret command without any pre-configured scope."
|
||||
commands.allow = ["save_secret"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-save-secret"
|
||||
description = "Denies the save_secret command without any pre-configured scope."
|
||||
commands.deny = ["save_secret"]
|
||||
@@ -0,0 +1,13 @@
|
||||
# Automatically generated - DO NOT EDIT!
|
||||
|
||||
"$schema" = "../../schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
identifier = "allow-save-store-record"
|
||||
description = "Enables the save_store_record command without any pre-configured scope."
|
||||
commands.allow = ["save_store_record"]
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-save-store-record"
|
||||
description = "Denies the save_store_record command without any pre-configured scope."
|
||||
commands.deny = ["save_store_record"]
|
||||
315
plugins/stronghold/permissions/autogenerated/reference.md
Normal file
315
plugins/stronghold/permissions/autogenerated/reference.md
Normal file
@@ -0,0 +1,315 @@
|
||||
## Default Permission
|
||||
|
||||
This permission set configures what kind of
|
||||
operations are available from the stronghold plugin.
|
||||
|
||||
#### Granted Permissions
|
||||
|
||||
All non-destructive operations are enabled by default.
|
||||
|
||||
#### This default permission set includes the following:
|
||||
|
||||
- `allow-create-client`
|
||||
- `allow-get-store-record`
|
||||
- `allow-initialize`
|
||||
- `allow-execute-procedure`
|
||||
- `allow-load-client`
|
||||
- `allow-save-secret`
|
||||
- `allow-save-store-record`
|
||||
- `allow-save`
|
||||
|
||||
## Permission Table
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Identifier</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-create-client`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the create_client command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-create-client`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the create_client command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-destroy`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the destroy command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-destroy`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the destroy command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-execute-procedure`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the execute_procedure command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-execute-procedure`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the execute_procedure command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-get-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the get_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-get-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the get_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-initialize`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the initialize command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-initialize`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the initialize command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-load-client`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the load_client command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-load-client`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the load_client command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-remove-secret`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the remove_secret command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-remove-secret`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the remove_secret command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-remove-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the remove_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-remove-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the remove_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-save`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the save command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-save`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the save command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-save-secret`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the save_secret command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-save-secret`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the save_secret command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:allow-save-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Enables the save_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
`stronghold:deny-save-store-record`
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
Denies the save_store_record command without any pre-configured scope.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
22
plugins/stronghold/permissions/default.toml
Normal file
22
plugins/stronghold/permissions/default.toml
Normal file
@@ -0,0 +1,22 @@
|
||||
"$schema" = "schemas/schema.json"
|
||||
|
||||
[default]
|
||||
description = """
|
||||
This permission set configures what kind of
|
||||
operations are available from the stronghold plugin.
|
||||
|
||||
#### Granted Permissions
|
||||
|
||||
All non-destructive operations are enabled by default.
|
||||
|
||||
"""
|
||||
permissions = [
|
||||
"allow-create-client",
|
||||
"allow-get-store-record",
|
||||
"allow-initialize",
|
||||
"allow-execute-procedure",
|
||||
"allow-load-client",
|
||||
"allow-save-secret",
|
||||
"allow-save-store-record",
|
||||
"allow-save",
|
||||
]
|
||||
438
plugins/stronghold/permissions/schemas/schema.json
Normal file
438
plugins/stronghold/permissions/schemas/schema.json
Normal file
@@ -0,0 +1,438 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"title": "PermissionFile",
|
||||
"description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"default": {
|
||||
"description": "The default permission set for the plugin",
|
||||
"anyOf": [
|
||||
{
|
||||
"$ref": "#/definitions/DefaultPermission"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"set": {
|
||||
"description": "A list of permissions sets defined",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/PermissionSet"
|
||||
}
|
||||
},
|
||||
"permission": {
|
||||
"description": "A list of inlined permissions",
|
||||
"default": [],
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/Permission"
|
||||
}
|
||||
}
|
||||
},
|
||||
"definitions": {
|
||||
"DefaultPermission": {
|
||||
"description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"permissions"
|
||||
],
|
||||
"properties": {
|
||||
"version": {
|
||||
"description": "The version of the permission.",
|
||||
"type": [
|
||||
"integer",
|
||||
"null"
|
||||
],
|
||||
"format": "uint64",
|
||||
"minimum": 1.0
|
||||
},
|
||||
"description": {
|
||||
"description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"permissions": {
|
||||
"description": "All permissions this set contains.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"PermissionSet": {
|
||||
"description": "A set of direct permissions grouped together under a new name.",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"description",
|
||||
"identifier",
|
||||
"permissions"
|
||||
],
|
||||
"properties": {
|
||||
"identifier": {
|
||||
"description": "A unique identifier for the permission.",
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "Human-readable description of what the permission does.",
|
||||
"type": "string"
|
||||
},
|
||||
"permissions": {
|
||||
"description": "All permissions this set contains.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/PermissionKind"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Permission": {
|
||||
"description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"identifier"
|
||||
],
|
||||
"properties": {
|
||||
"version": {
|
||||
"description": "The version of the permission.",
|
||||
"type": [
|
||||
"integer",
|
||||
"null"
|
||||
],
|
||||
"format": "uint64",
|
||||
"minimum": 1.0
|
||||
},
|
||||
"identifier": {
|
||||
"description": "A unique identifier for the permission.",
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"commands": {
|
||||
"description": "Allowed or denied commands when using this permission.",
|
||||
"default": {
|
||||
"allow": [],
|
||||
"deny": []
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/Commands"
|
||||
}
|
||||
]
|
||||
},
|
||||
"scope": {
|
||||
"description": "Allowed or denied scoped when using this permission.",
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/Scopes"
|
||||
}
|
||||
]
|
||||
},
|
||||
"platforms": {
|
||||
"description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
|
||||
"type": [
|
||||
"array",
|
||||
"null"
|
||||
],
|
||||
"items": {
|
||||
"$ref": "#/definitions/Target"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Commands": {
|
||||
"description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allow": {
|
||||
"description": "Allowed command.",
|
||||
"default": [],
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"deny": {
|
||||
"description": "Denied command, which takes priority.",
|
||||
"default": [],
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Scopes": {
|
||||
"description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allow": {
|
||||
"description": "Data that defines what is allowed by the scope.",
|
||||
"type": [
|
||||
"array",
|
||||
"null"
|
||||
],
|
||||
"items": {
|
||||
"$ref": "#/definitions/Value"
|
||||
}
|
||||
},
|
||||
"deny": {
|
||||
"description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
|
||||
"type": [
|
||||
"array",
|
||||
"null"
|
||||
],
|
||||
"items": {
|
||||
"$ref": "#/definitions/Value"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Value": {
|
||||
"description": "All supported ACL values.",
|
||||
"anyOf": [
|
||||
{
|
||||
"description": "Represents a null JSON value.",
|
||||
"type": "null"
|
||||
},
|
||||
{
|
||||
"description": "Represents a [`bool`].",
|
||||
"type": "boolean"
|
||||
},
|
||||
{
|
||||
"description": "Represents a valid ACL [`Number`].",
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/Number"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": "Represents a [`String`].",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"description": "Represents a list of other [`Value`]s.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/Value"
|
||||
}
|
||||
},
|
||||
{
|
||||
"description": "Represents a map of [`String`] keys to [`Value`]s.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/Value"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"Number": {
|
||||
"description": "A valid ACL number.",
|
||||
"anyOf": [
|
||||
{
|
||||
"description": "Represents an [`i64`].",
|
||||
"type": "integer",
|
||||
"format": "int64"
|
||||
},
|
||||
{
|
||||
"description": "Represents a [`f64`].",
|
||||
"type": "number",
|
||||
"format": "double"
|
||||
}
|
||||
]
|
||||
},
|
||||
"Target": {
|
||||
"description": "Platform target.",
|
||||
"oneOf": [
|
||||
{
|
||||
"description": "MacOS.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"macOS"
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": "Windows.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"windows"
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": "Linux.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"linux"
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": "Android.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"android"
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": "iOS.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"iOS"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"PermissionKind": {
|
||||
"type": "string",
|
||||
"oneOf": [
|
||||
{
|
||||
"description": "Enables the create_client command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-create-client",
|
||||
"markdownDescription": "Enables the create_client command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the create_client command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-create-client",
|
||||
"markdownDescription": "Denies the create_client command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the destroy command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-destroy",
|
||||
"markdownDescription": "Enables the destroy command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the destroy command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-destroy",
|
||||
"markdownDescription": "Denies the destroy command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the execute_procedure command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-execute-procedure",
|
||||
"markdownDescription": "Enables the execute_procedure command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the execute_procedure command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-execute-procedure",
|
||||
"markdownDescription": "Denies the execute_procedure command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the get_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-get-store-record",
|
||||
"markdownDescription": "Enables the get_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the get_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-get-store-record",
|
||||
"markdownDescription": "Denies the get_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the initialize command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-initialize",
|
||||
"markdownDescription": "Enables the initialize command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the initialize command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-initialize",
|
||||
"markdownDescription": "Denies the initialize command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the load_client command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-load-client",
|
||||
"markdownDescription": "Enables the load_client command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the load_client command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-load-client",
|
||||
"markdownDescription": "Denies the load_client command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the remove_secret command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-remove-secret",
|
||||
"markdownDescription": "Enables the remove_secret command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the remove_secret command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-remove-secret",
|
||||
"markdownDescription": "Denies the remove_secret command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the remove_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-remove-store-record",
|
||||
"markdownDescription": "Enables the remove_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the remove_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-remove-store-record",
|
||||
"markdownDescription": "Denies the remove_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the save command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-save",
|
||||
"markdownDescription": "Enables the save command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the save command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-save",
|
||||
"markdownDescription": "Denies the save command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the save_secret command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-save-secret",
|
||||
"markdownDescription": "Enables the save_secret command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the save_secret command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-save-secret",
|
||||
"markdownDescription": "Denies the save_secret command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Enables the save_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "allow-save-store-record",
|
||||
"markdownDescription": "Enables the save_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "Denies the save_store_record command without any pre-configured scope.",
|
||||
"type": "string",
|
||||
"const": "deny-save-store-record",
|
||||
"markdownDescription": "Denies the save_store_record command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "This permission set configures what kind of\noperations are available from the stronghold plugin.\n\n#### Granted Permissions\n\nAll non-destructive operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-create-client`\n- `allow-get-store-record`\n- `allow-initialize`\n- `allow-execute-procedure`\n- `allow-load-client`\n- `allow-save-secret`\n- `allow-save-store-record`\n- `allow-save`",
|
||||
"type": "string",
|
||||
"const": "default",
|
||||
"markdownDescription": "This permission set configures what kind of\noperations are available from the stronghold plugin.\n\n#### Granted Permissions\n\nAll non-destructive operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-create-client`\n- `allow-get-store-record`\n- `allow-initialize`\n- `allow-execute-procedure`\n- `allow-load-client`\n- `allow-save-secret`\n- `allow-save-store-record`\n- `allow-save`"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
7
plugins/stronghold/rollup.config.js
Normal file
7
plugins/stronghold/rollup.config.js
Normal file
@@ -0,0 +1,7 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
import { createConfig } from '../../shared/rollup.config.js'
|
||||
|
||||
export default createConfig()
|
||||
52
plugins/stronghold/src/kdf.rs
Normal file
52
plugins/stronghold/src/kdf.rs
Normal file
@@ -0,0 +1,52 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
//! Key derivation used to turn the user password into the key that encrypts a snapshot.
|
||||
//!
|
||||
//! Only available when the **kdf** Cargo feature is enabled, which is the case by default.
|
||||
|
||||
use rand_chacha::ChaCha20Rng;
|
||||
use rand_core::{RngCore, SeedableRng};
|
||||
use std::path::Path;
|
||||
|
||||
/// NOTE: Hash supplied to Stronghold must be 32bits long.
|
||||
/// This is a current limitation of Stronghold.
|
||||
const HASH_LENGTH: usize = 32;
|
||||
|
||||
/// Password hashing functions that can be used as the key derivation function of
|
||||
/// [`Builder::new`](crate::Builder::new).
|
||||
pub struct KeyDerivation {}
|
||||
|
||||
impl KeyDerivation {
|
||||
/// Hashes `password` with Argon2 using the salt stored in `salt_path`, returning the
|
||||
/// 32 bytes key used to encrypt a snapshot.
|
||||
///
|
||||
/// The salt is read from `salt_path` when that file already exists, otherwise a new
|
||||
/// random salt is generated and written to it.
|
||||
///
|
||||
/// # Panics
|
||||
///
|
||||
/// Panics when the salt file cannot be read or written, when its contents are not
|
||||
/// 32 bytes long, or when hashing the password fails.
|
||||
pub fn argon2(password: &str, salt_path: &Path) -> Vec<u8> {
|
||||
let mut salt = [0u8; HASH_LENGTH];
|
||||
create_or_get_salt(&mut salt, salt_path);
|
||||
|
||||
argon2::hash_raw(password.as_bytes(), &salt, &Default::default())
|
||||
.expect("Failed to generate hash for password")
|
||||
}
|
||||
}
|
||||
|
||||
fn create_or_get_salt(salt: &mut [u8], salt_path: &Path) {
|
||||
if salt_path.is_file() {
|
||||
// Get existing salt
|
||||
let tmp = std::fs::read(salt_path).unwrap();
|
||||
salt.clone_from_slice(&tmp);
|
||||
} else {
|
||||
// Generate new salt
|
||||
let mut gen = ChaCha20Rng::from_os_rng();
|
||||
gen.fill_bytes(salt);
|
||||
std::fs::write(salt_path, salt).expect("Failed to write salt for Stronghold")
|
||||
}
|
||||
}
|
||||
533
plugins/stronghold/src/lib.rs
Normal file
533
plugins/stronghold/src/lib.rs
Normal file
@@ -0,0 +1,533 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
//! Store secrets and keys using the [IOTA Stronghold](https://github.com/iotaledger/stronghold.rs) encrypted database and secure runtime.
|
||||
//!
|
||||
//! ## Cargo features
|
||||
//!
|
||||
//! - **kdf** *(enabled by default)*: Exposes the key-derivation module and provides the default Argon2-based password-to-key derivation.
|
||||
|
||||
#![doc(
|
||||
html_logo_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png",
|
||||
html_favicon_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png"
|
||||
)]
|
||||
|
||||
use std::{
|
||||
collections::HashMap,
|
||||
fmt,
|
||||
path::PathBuf,
|
||||
sync::{Arc, Mutex},
|
||||
time::Duration,
|
||||
};
|
||||
|
||||
use crypto::keys::bip39;
|
||||
use iota_stronghold::{
|
||||
procedures::{
|
||||
BIP39Generate, BIP39Recover, Curve, Ed25519Sign, KeyType as StrongholdKeyType,
|
||||
MnemonicLanguage, PublicKey, Slip10Derive, Slip10DeriveInput, Slip10Generate,
|
||||
StrongholdProcedure,
|
||||
},
|
||||
Client, Location,
|
||||
};
|
||||
use serde::{de::Visitor, Deserialize, Deserializer};
|
||||
use stronghold::{Error, Result, Stronghold};
|
||||
use tauri::{
|
||||
plugin::{Builder as PluginBuilder, TauriPlugin},
|
||||
Manager, Runtime, State,
|
||||
};
|
||||
use zeroize::{Zeroize, Zeroizing};
|
||||
|
||||
#[cfg(feature = "kdf")]
|
||||
pub mod kdf;
|
||||
|
||||
pub mod stronghold;
|
||||
|
||||
type PasswordHashFn = dyn Fn(&str) -> Vec<u8> + Send + Sync;
|
||||
|
||||
#[derive(Default)]
|
||||
struct StrongholdCollection(Arc<Mutex<HashMap<PathBuf, Stronghold>>>);
|
||||
|
||||
struct PasswordHashFunction(Box<PasswordHashFn>);
|
||||
|
||||
#[derive(Deserialize, Hash, Eq, PartialEq, Ord, PartialOrd)]
|
||||
#[serde(untagged)]
|
||||
enum BytesDto {
|
||||
Text(String),
|
||||
Raw(Vec<u8>),
|
||||
}
|
||||
|
||||
impl AsRef<[u8]> for BytesDto {
|
||||
fn as_ref(&self) -> &[u8] {
|
||||
match self {
|
||||
Self::Text(t) => t.as_ref(),
|
||||
Self::Raw(b) => b.as_ref(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl From<BytesDto> for Vec<u8> {
|
||||
fn from(v: BytesDto) -> Self {
|
||||
match v {
|
||||
BytesDto::Text(t) => t.as_bytes().to_vec(),
|
||||
BytesDto::Raw(b) => b,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
#[serde(tag = "type", content = "payload")]
|
||||
enum LocationDto {
|
||||
Generic { vault: BytesDto, record: BytesDto },
|
||||
Counter { vault: BytesDto, counter: usize },
|
||||
}
|
||||
|
||||
impl From<LocationDto> for Location {
|
||||
fn from(dto: LocationDto) -> Location {
|
||||
match dto {
|
||||
LocationDto::Generic { vault, record } => Location::generic(vault, record),
|
||||
LocationDto::Counter { vault, counter } => Location::counter(vault, counter),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
#[serde(tag = "type", content = "payload")]
|
||||
#[allow(clippy::upper_case_acronyms)]
|
||||
enum Slip10DeriveInputDto {
|
||||
Seed(LocationDto),
|
||||
Key(LocationDto),
|
||||
}
|
||||
|
||||
impl From<Slip10DeriveInputDto> for Slip10DeriveInput {
|
||||
fn from(dto: Slip10DeriveInputDto) -> Slip10DeriveInput {
|
||||
match dto {
|
||||
Slip10DeriveInputDto::Seed(location) => Slip10DeriveInput::Seed(location.into()),
|
||||
Slip10DeriveInputDto::Key(location) => Slip10DeriveInput::Key(location.into()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The type of a key pair handled by the plugin procedures.
|
||||
///
|
||||
/// Deserialized from the strings `ed25519` and `x25519`, ignoring case.
|
||||
pub enum KeyType {
|
||||
/// The Ed25519 signature scheme.
|
||||
Ed25519,
|
||||
/// The X25519 key exchange scheme.
|
||||
X25519,
|
||||
}
|
||||
|
||||
impl From<KeyType> for StrongholdKeyType {
|
||||
fn from(ty: KeyType) -> StrongholdKeyType {
|
||||
match ty {
|
||||
KeyType::Ed25519 => StrongholdKeyType::Ed25519,
|
||||
KeyType::X25519 => StrongholdKeyType::X25519,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl<'de> Deserialize<'de> for KeyType {
|
||||
fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
|
||||
where
|
||||
D: Deserializer<'de>,
|
||||
{
|
||||
struct KeyTypeVisitor;
|
||||
|
||||
impl Visitor<'_> for KeyTypeVisitor {
|
||||
type Value = KeyType;
|
||||
|
||||
fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
|
||||
formatter.write_str("ed25519 or x25519")
|
||||
}
|
||||
|
||||
fn visit_str<E>(self, value: &str) -> std::result::Result<Self::Value, E>
|
||||
where
|
||||
E: serde::de::Error,
|
||||
{
|
||||
match value.to_lowercase().as_str() {
|
||||
"ed25519" => Ok(KeyType::Ed25519),
|
||||
"x25519" => Ok(KeyType::X25519),
|
||||
_ => Err(serde::de::Error::custom("unknown key type")),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_str(KeyTypeVisitor)
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
#[serde(tag = "type", content = "payload")]
|
||||
#[allow(clippy::upper_case_acronyms)]
|
||||
enum ProcedureDto {
|
||||
SLIP10Generate {
|
||||
output: LocationDto,
|
||||
#[serde(rename = "sizeBytes")]
|
||||
size_bytes: Option<usize>,
|
||||
},
|
||||
SLIP10Derive {
|
||||
chain: Vec<u32>,
|
||||
input: Slip10DeriveInputDto,
|
||||
output: LocationDto,
|
||||
},
|
||||
BIP39Recover {
|
||||
mnemonic: String,
|
||||
passphrase: Option<String>,
|
||||
output: LocationDto,
|
||||
},
|
||||
BIP39Generate {
|
||||
passphrase: Option<String>,
|
||||
output: LocationDto,
|
||||
},
|
||||
PublicKey {
|
||||
#[serde(rename = "type")]
|
||||
ty: KeyType,
|
||||
#[serde(rename = "privateKey")]
|
||||
private_key: LocationDto,
|
||||
},
|
||||
Ed25519Sign {
|
||||
#[serde(rename = "privateKey")]
|
||||
private_key: LocationDto,
|
||||
msg: String,
|
||||
},
|
||||
}
|
||||
|
||||
impl From<ProcedureDto> for StrongholdProcedure {
|
||||
fn from(dto: ProcedureDto) -> StrongholdProcedure {
|
||||
match dto {
|
||||
ProcedureDto::SLIP10Generate { output, size_bytes } => {
|
||||
StrongholdProcedure::Slip10Generate(Slip10Generate {
|
||||
output: output.into(),
|
||||
size_bytes,
|
||||
})
|
||||
}
|
||||
ProcedureDto::SLIP10Derive {
|
||||
chain,
|
||||
input,
|
||||
output,
|
||||
} => StrongholdProcedure::Slip10Derive(Slip10Derive {
|
||||
curve: Curve::Ed25519,
|
||||
chain,
|
||||
input: input.into(),
|
||||
output: output.into(),
|
||||
}),
|
||||
ProcedureDto::BIP39Recover {
|
||||
mnemonic,
|
||||
passphrase,
|
||||
output,
|
||||
} => StrongholdProcedure::BIP39Recover(BIP39Recover {
|
||||
mnemonic: bip39::Mnemonic::from(mnemonic),
|
||||
passphrase: bip39::Passphrase::from(passphrase.unwrap_or_default()),
|
||||
output: output.into(),
|
||||
}),
|
||||
ProcedureDto::BIP39Generate { passphrase, output } => {
|
||||
StrongholdProcedure::BIP39Generate(BIP39Generate {
|
||||
passphrase: bip39::Passphrase::from(passphrase.unwrap_or_default()),
|
||||
output: output.into(),
|
||||
language: MnemonicLanguage::English,
|
||||
})
|
||||
}
|
||||
ProcedureDto::PublicKey { ty, private_key } => {
|
||||
StrongholdProcedure::PublicKey(PublicKey {
|
||||
ty: ty.into(),
|
||||
private_key: private_key.into(),
|
||||
})
|
||||
}
|
||||
ProcedureDto::Ed25519Sign { private_key, msg } => {
|
||||
StrongholdProcedure::Ed25519Sign(Ed25519Sign {
|
||||
private_key: private_key.into(),
|
||||
msg: msg.as_bytes().to_vec(),
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn initialize(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
hash_function: State<'_, PasswordHashFunction>,
|
||||
snapshot_path: PathBuf,
|
||||
mut password: String,
|
||||
) -> Result<()> {
|
||||
let hash = (hash_function.0)(&password);
|
||||
password.zeroize();
|
||||
let stronghold = Stronghold::new(snapshot_path.clone(), hash)?;
|
||||
|
||||
collection
|
||||
.0
|
||||
.lock()
|
||||
.unwrap()
|
||||
.insert(snapshot_path, stronghold);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn destroy(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
) -> Result<()> {
|
||||
let mut collection = collection.0.lock().unwrap();
|
||||
if let Some(stronghold) = collection.remove(&snapshot_path) {
|
||||
if let Err(e) = stronghold.save() {
|
||||
collection.insert(snapshot_path, stronghold);
|
||||
return Err(e);
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn save(collection: State<'_, StrongholdCollection>, snapshot_path: PathBuf) -> Result<()> {
|
||||
let collection = collection.0.lock().unwrap();
|
||||
if let Some(stronghold) = collection.get(&snapshot_path) {
|
||||
stronghold.save()?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn create_client(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
) -> Result<()> {
|
||||
let stronghold = get_stronghold(collection, snapshot_path)?;
|
||||
stronghold.create_client(client)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn load_client(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
) -> Result<()> {
|
||||
let stronghold = get_stronghold(collection, snapshot_path)?;
|
||||
stronghold.load_client(client)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn get_store_record(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
key: String,
|
||||
) -> Result<Option<Vec<u8>>> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client.store().get(key.as_ref()).map_err(Into::into)
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn save_store_record(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
key: String,
|
||||
value: Vec<u8>,
|
||||
lifetime: Option<Duration>,
|
||||
) -> Result<Option<Vec<u8>>> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client
|
||||
.store()
|
||||
.insert(key.as_bytes().to_vec(), value, lifetime)
|
||||
.map_err(Into::into)
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn remove_store_record(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
key: String,
|
||||
) -> Result<Option<Vec<u8>>> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client.store().delete(key.as_ref()).map_err(Into::into)
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn save_secret(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
vault: BytesDto,
|
||||
record_path: BytesDto,
|
||||
secret: Vec<u8>,
|
||||
) -> Result<()> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client
|
||||
.vault(&vault)
|
||||
.write_secret(
|
||||
Location::generic(vault, record_path),
|
||||
Zeroizing::new(secret),
|
||||
)
|
||||
.map_err(Into::into)
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn remove_secret(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
vault: BytesDto,
|
||||
record_path: BytesDto,
|
||||
) -> Result<()> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client
|
||||
.vault(vault)
|
||||
.delete_secret(record_path)
|
||||
.map(|_| ())
|
||||
.map_err(Into::into)
|
||||
}
|
||||
|
||||
#[tauri::command]
|
||||
async fn execute_procedure(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
procedure: ProcedureDto,
|
||||
) -> Result<Vec<u8>> {
|
||||
let client = get_client(collection, snapshot_path, client)?;
|
||||
client
|
||||
.execute_procedure(StrongholdProcedure::from(procedure))
|
||||
.map(Into::into)
|
||||
.map_err(Into::into)
|
||||
}
|
||||
|
||||
fn get_stronghold(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
) -> Result<iota_stronghold::Stronghold> {
|
||||
let collection = collection.0.lock().unwrap();
|
||||
if let Some(stronghold) = collection.get(&snapshot_path) {
|
||||
Ok(stronghold.inner().clone())
|
||||
} else {
|
||||
Err(Error::StrongholdNotInitialized)
|
||||
}
|
||||
}
|
||||
|
||||
fn get_client(
|
||||
collection: State<'_, StrongholdCollection>,
|
||||
snapshot_path: PathBuf,
|
||||
client: BytesDto,
|
||||
) -> Result<Client> {
|
||||
let collection = collection.0.lock().unwrap();
|
||||
if let Some(stronghold) = collection.get(&snapshot_path) {
|
||||
stronghold.get_client(client).map_err(Into::into)
|
||||
} else {
|
||||
Err(Error::StrongholdNotInitialized)
|
||||
}
|
||||
}
|
||||
|
||||
enum PasswordHashFunctionKind {
|
||||
#[cfg(feature = "kdf")]
|
||||
Argon2(PathBuf),
|
||||
Custom(Box<PasswordHashFn>),
|
||||
}
|
||||
|
||||
/// Builder for the stronghold plugin.
|
||||
///
|
||||
/// It defines how the password sent by the frontend is hashed into the key that
|
||||
/// encrypts the snapshot file.
|
||||
pub struct Builder {
|
||||
password_hash_function: PasswordHashFunctionKind,
|
||||
}
|
||||
|
||||
impl Builder {
|
||||
/// Initializes [`Self`] with a custom password hash function.
|
||||
///
|
||||
/// The function is called with the password sent by the frontend and must return the
|
||||
/// key used to encrypt the snapshot, which must be 32 bytes long.
|
||||
///
|
||||
/// # Examples
|
||||
///
|
||||
/// ```rust
|
||||
/// fn init<R: tauri::Runtime>(builder: tauri::Builder<R>) -> tauri::Builder<R> {
|
||||
/// builder.plugin(
|
||||
/// tauri_plugin_stronghold::Builder::new(|_password| {
|
||||
/// // hash the password with a secure algorithm such as argon2 or blake2b
|
||||
/// // and return the resulting 32 bytes hash
|
||||
/// unimplemented!()
|
||||
/// })
|
||||
/// .build(),
|
||||
/// )
|
||||
/// }
|
||||
/// ```
|
||||
pub fn new<F: Fn(&str) -> Vec<u8> + Send + Sync + 'static>(password_hash_function: F) -> Self {
|
||||
Self {
|
||||
password_hash_function: PasswordHashFunctionKind::Custom(Box::new(
|
||||
password_hash_function,
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
/// Initializes [`Self`] with argon2 as password hash function.
|
||||
///
|
||||
/// # Examples
|
||||
///
|
||||
/// ```rust
|
||||
/// use tauri::Manager;
|
||||
///
|
||||
/// fn init<R: tauri::Runtime>(builder: tauri::Builder<R>) -> tauri::Builder<R> {
|
||||
/// builder.setup(|app| {
|
||||
/// let salt_path = app
|
||||
/// .path()
|
||||
/// .app_local_data_dir()
|
||||
/// .expect("could not resolve app local data path")
|
||||
/// .join("salt.txt");
|
||||
/// app.handle()
|
||||
/// .plugin(tauri_plugin_stronghold::Builder::with_argon2(&salt_path).build())?;
|
||||
/// Ok(())
|
||||
/// })
|
||||
/// }
|
||||
/// ```
|
||||
#[cfg(feature = "kdf")]
|
||||
pub fn with_argon2(salt_path: &std::path::Path) -> Self {
|
||||
Self {
|
||||
password_hash_function: PasswordHashFunctionKind::Argon2(salt_path.to_owned()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Builds the plugin, registering the password hash function and the commands used
|
||||
/// by the JavaScript guest bindings.
|
||||
pub fn build<R: Runtime>(self) -> TauriPlugin<R> {
|
||||
let password_hash_function = self.password_hash_function;
|
||||
|
||||
let plugin_builder = PluginBuilder::new("stronghold").setup(move |app, _api| {
|
||||
app.manage(StrongholdCollection::default());
|
||||
app.manage(PasswordHashFunction(match password_hash_function {
|
||||
#[cfg(feature = "kdf")]
|
||||
PasswordHashFunctionKind::Argon2(path) => {
|
||||
Box::new(move |p| kdf::KeyDerivation::argon2(p, &path))
|
||||
}
|
||||
PasswordHashFunctionKind::Custom(f) => f,
|
||||
}));
|
||||
Ok(())
|
||||
});
|
||||
|
||||
Builder::invoke_stronghold_handlers_and_build(plugin_builder)
|
||||
}
|
||||
|
||||
fn invoke_stronghold_handlers_and_build<R: Runtime>(
|
||||
builder: PluginBuilder<R>,
|
||||
) -> TauriPlugin<R> {
|
||||
builder
|
||||
.invoke_handler(tauri::generate_handler![
|
||||
initialize,
|
||||
destroy,
|
||||
save,
|
||||
create_client,
|
||||
load_client,
|
||||
get_store_record,
|
||||
save_store_record,
|
||||
remove_store_record,
|
||||
save_secret,
|
||||
remove_secret,
|
||||
execute_procedure,
|
||||
])
|
||||
.build()
|
||||
}
|
||||
}
|
||||
103
plugins/stronghold/src/stronghold.rs
Normal file
103
plugins/stronghold/src/stronghold.rs
Normal file
@@ -0,0 +1,103 @@
|
||||
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
//! Types to load, modify and persist an [IOTA Stronghold](https://github.com/iotaledger/stronghold.rs)
|
||||
//! snapshot file.
|
||||
|
||||
use std::{convert::TryFrom, ops::Deref, path::Path};
|
||||
|
||||
use iota_stronghold::{KeyProvider, SnapshotPath};
|
||||
use serde::{Serialize, Serializer};
|
||||
use zeroize::Zeroizing;
|
||||
|
||||
/// Alias for a [`std::result::Result`] with the error type [`Error`].
|
||||
pub type Result<T> = std::result::Result<T, Error>;
|
||||
|
||||
/// Errors returned by the stronghold plugin.
|
||||
///
|
||||
/// Serialized as the error message string when returned to the frontend.
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum Error {
|
||||
/// No stronghold was initialized for the given snapshot path.
|
||||
#[error("stronghold not initialized")]
|
||||
StrongholdNotInitialized,
|
||||
/// An error from the underlying Stronghold client, e.g. when loading a snapshot
|
||||
/// with the wrong password or when addressing a client that does not exist.
|
||||
#[error(transparent)]
|
||||
Stronghold(#[from] iota_stronghold::ClientError),
|
||||
/// An error from the Stronghold secure memory implementation, e.g. when the
|
||||
/// password hash is not a key size Stronghold accepts.
|
||||
#[error(transparent)]
|
||||
Memory(#[from] iota_stronghold::MemoryError),
|
||||
/// A Stronghold procedure (key generation, key derivation, signing, ...) failed.
|
||||
#[error(transparent)]
|
||||
Procedure(#[from] iota_stronghold::procedures::ProcedureError),
|
||||
}
|
||||
|
||||
impl Serialize for Error {
|
||||
fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
|
||||
where
|
||||
S: Serializer,
|
||||
{
|
||||
serializer.serialize_str(self.to_string().as_str())
|
||||
}
|
||||
}
|
||||
|
||||
/// A Stronghold instance bound to a snapshot file and to the key it is encrypted with.
|
||||
///
|
||||
/// Dereferences to the underlying [`iota_stronghold::Stronghold`], so all of its client
|
||||
/// and vault operations are available on this type.
|
||||
pub struct Stronghold {
|
||||
inner: iota_stronghold::Stronghold,
|
||||
path: SnapshotPath,
|
||||
keyprovider: KeyProvider,
|
||||
}
|
||||
|
||||
impl Stronghold {
|
||||
/// Creates a Stronghold instance for the snapshot file at `path`, encrypted with
|
||||
/// `password` as the key.
|
||||
///
|
||||
/// When the file already exists its snapshot is loaded, which requires `password` to
|
||||
/// be the key it was encrypted with. Otherwise an empty instance is created and
|
||||
/// nothing is written to disk until [`Self::save`] is called.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns [`Error::Memory`] when `password` is not a key size Stronghold accepts
|
||||
/// (it must be 32 bytes long) and [`Error::Stronghold`] when an existing snapshot
|
||||
/// cannot be loaded with it.
|
||||
pub fn new<P: AsRef<Path>>(path: P, password: Vec<u8>) -> Result<Self> {
|
||||
let path = SnapshotPath::from_path(path);
|
||||
let stronghold = iota_stronghold::Stronghold::default();
|
||||
let keyprovider = KeyProvider::try_from(Zeroizing::new(password))?;
|
||||
if path.exists() {
|
||||
stronghold.load_snapshot(&keyprovider, &path)?;
|
||||
}
|
||||
Ok(Self {
|
||||
inner: stronghold,
|
||||
path,
|
||||
keyprovider,
|
||||
})
|
||||
}
|
||||
|
||||
/// Writes the state of all clients to the snapshot file, encrypted with the key
|
||||
/// this instance was created with.
|
||||
pub fn save(&self) -> Result<()> {
|
||||
self.inner
|
||||
.commit_with_keyprovider(&self.path, &self.keyprovider)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Returns a reference to the underlying [`iota_stronghold::Stronghold`] instance.
|
||||
pub fn inner(&self) -> &iota_stronghold::Stronghold {
|
||||
&self.inner
|
||||
}
|
||||
}
|
||||
|
||||
impl Deref for Stronghold {
|
||||
type Target = iota_stronghold::Stronghold;
|
||||
fn deref(&self) -> &Self::Target {
|
||||
&self.inner
|
||||
}
|
||||
}
|
||||
7
plugins/stronghold/tsconfig.json
Normal file
7
plugins/stronghold/tsconfig.json
Normal file
@@ -0,0 +1,7 @@
|
||||
{
|
||||
"extends": "../../tsconfig.base.json",
|
||||
"compilerOptions": {
|
||||
"rootDir": "guest-js"
|
||||
},
|
||||
"include": ["guest-js/*.ts"]
|
||||
}
|
||||
Reference in New Issue
Block a user