feat: Remove herodo from monorepo and update dependencies
Some checks are pending
Rhai Tests / Run Rhai Tests (push) Waiting to run
Some checks are pending
Rhai Tests / Run Rhai Tests (push) Waiting to run
- Removed the `herodo` binary from the monorepo. This was done as part of the monorepo conversion process. - Updated the `Cargo.toml` file to reflect the removal of `herodo` and adjust dependencies accordingly. - Updated `src/lib.rs` and `src/rhai/mod.rs` to use the new `sal-vault` crate for vault functionality. This improves the modularity and maintainability of the project.
This commit is contained in:
Mahmoud-Emad
173
vault/src/kvs/README.md
Normal file
173
vault/src/kvs/README.md
Normal file
@@ -0,0 +1,173 @@
|
||||
# Hero Vault Key-Value Store Module
|
||||
|
||||
The Key-Value Store (KVS) module provides an encrypted key-value store for securely storing sensitive data.
|
||||
|
||||
## Module Structure
|
||||
|
||||
The KVS module is organized into:
|
||||
|
||||
- `store.rs` - Core implementation of the key-value store
|
||||
- `error.rs` - Error types specific to the KVS module
|
||||
- `mod.rs` - Module exports and public interface
|
||||
|
||||
## Key Types
|
||||
|
||||
### KvStore
|
||||
|
||||
The `KvStore` type represents an encrypted key-value store:
|
||||
|
||||
```rust
|
||||
pub struct KvStore {
|
||||
// Private fields
|
||||
// ...
|
||||
}
|
||||
|
||||
impl KvStore {
|
||||
// Create a new store
|
||||
pub fn new(name: &str, password: &str) -> Result<Self, CryptoError>;
|
||||
|
||||
// Load a store from disk
|
||||
pub fn load(name: &str, password: &str) -> Result<Self, CryptoError>;
|
||||
|
||||
// Save the store to disk
|
||||
pub fn save(&self) -> Result<(), CryptoError>;
|
||||
|
||||
// Set a value
|
||||
pub fn set(&mut self, key: &str, value: &str) -> Result<(), CryptoError>;
|
||||
|
||||
// Get a value
|
||||
pub fn get(&self, key: &str) -> Result<Option<String>, CryptoError>;
|
||||
|
||||
// Delete a value
|
||||
pub fn delete(&mut self, key: &str) -> Result<(), CryptoError>;
|
||||
|
||||
// Check if a key exists
|
||||
pub fn has(&self, key: &str) -> Result<bool, CryptoError>;
|
||||
|
||||
// List all keys
|
||||
pub fn keys(&self) -> Result<Vec<String>, CryptoError>;
|
||||
|
||||
// Clear all values
|
||||
pub fn clear(&mut self) -> Result<(), CryptoError>;
|
||||
|
||||
// Get the name of the store
|
||||
pub fn name(&self) -> &str;
|
||||
}
|
||||
```
|
||||
|
||||
## Key Features
|
||||
|
||||
### Store Management
|
||||
|
||||
The module provides functionality for creating, loading, and managing key-value stores:
|
||||
|
||||
```rust
|
||||
// Create a new store
|
||||
let mut store = KvStore::new("my_store", "secure_password")?;
|
||||
|
||||
// Save the store to disk
|
||||
store.save()?;
|
||||
|
||||
// Load a store from disk
|
||||
let mut loaded_store = KvStore::load("my_store", "secure_password")?;
|
||||
```
|
||||
|
||||
### Value Management
|
||||
|
||||
The module provides functionality for managing values in the store:
|
||||
|
||||
```rust
|
||||
// Set a value
|
||||
store.set("api_key", "secret_api_key")?;
|
||||
|
||||
// Get a value
|
||||
let api_key = store.get("api_key")?;
|
||||
|
||||
// Delete a value
|
||||
store.delete("api_key")?;
|
||||
|
||||
// Check if a key exists
|
||||
let exists = store.has("api_key")?;
|
||||
|
||||
// List all keys
|
||||
let keys = store.keys()?;
|
||||
|
||||
// Clear all values
|
||||
store.clear()?;
|
||||
```
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Encryption
|
||||
|
||||
The KVS module uses the Symmetric Encryption module to encrypt all values stored in the key-value store. This ensures that sensitive data is protected at rest.
|
||||
|
||||
The encryption process:
|
||||
|
||||
1. A master key is derived from the provided password using PBKDF2
|
||||
2. Each value is encrypted using ChaCha20Poly1305 with a unique key derived from the master key and the value's key
|
||||
3. The encrypted values are stored in a JSON file on disk
|
||||
|
||||
### Storage Format
|
||||
|
||||
The key-value store is stored in a JSON file with the following structure:
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "my_store",
|
||||
"salt": "base64-encoded-salt",
|
||||
"values": {
|
||||
"key1": "base64-encoded-encrypted-value",
|
||||
"key2": "base64-encoded-encrypted-value",
|
||||
...
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The file is stored in the `~/.hero-vault/stores/` directory by default.
|
||||
|
||||
## Security Considerations
|
||||
|
||||
- Use strong passwords to protect the key-value store
|
||||
- The security of the store depends on the strength of the password
|
||||
- Consider the security implications of storing sensitive data on disk
|
||||
- Regularly backup the store to prevent data loss
|
||||
|
||||
## Error Handling
|
||||
|
||||
The module uses the `CryptoError` type for handling errors that can occur during key-value store operations:
|
||||
|
||||
- `EncryptionFailed` - Encryption failed
|
||||
- `DecryptionFailed` - Decryption failed
|
||||
- `SerializationError` - Serialization error
|
||||
|
||||
## Examples
|
||||
|
||||
For examples of how to use the KVS module, see the `examples/hero_vault` directory. While there may not be specific examples for the KVS module, the general pattern of usage is similar to the key space management examples.
|
||||
|
||||
A basic usage example:
|
||||
|
||||
```rust
|
||||
// Create a new store
|
||||
let mut store = KvStore::new("my_store", "secure_password")?;
|
||||
|
||||
// Set some values
|
||||
store.set("api_key", "secret_api_key")?;
|
||||
store.set("access_token", "secret_access_token")?;
|
||||
|
||||
// Save the store to disk
|
||||
store.save()?;
|
||||
|
||||
// Later, load the store
|
||||
let loaded_store = KvStore::load("my_store", "secure_password")?;
|
||||
|
||||
// Get a value
|
||||
let api_key = loaded_store.get("api_key")?;
|
||||
println!("API Key: {}", api_key.unwrap_or_default());
|
||||
```
|
||||
|
||||
## to test
|
||||
|
||||
```bash
|
||||
cargo test --lib vault::keypair
|
||||
```
|
||||
65
vault/src/kvs/error.rs
Normal file
65
vault/src/kvs/error.rs
Normal file
@@ -0,0 +1,65 @@
|
||||
//! Error types for the key-value store.
|
||||
|
||||
use thiserror::Error;
|
||||
|
||||
/// Errors that can occur when using the key-value store.
|
||||
#[derive(Debug, Error)]
|
||||
pub enum KvsError {
|
||||
/// I/O error
|
||||
#[error("I/O error: {0}")]
|
||||
Io(#[from] std::io::Error),
|
||||
|
||||
/// Key not found
|
||||
#[error("Key not found: {0}")]
|
||||
KeyNotFound(String),
|
||||
|
||||
/// Store not found
|
||||
#[error("Store not found: {0}")]
|
||||
StoreNotFound(String),
|
||||
|
||||
/// Serialization error
|
||||
#[error("Serialization error: {0}")]
|
||||
Serialization(String),
|
||||
|
||||
/// Deserialization error
|
||||
#[error("Deserialization error: {0}")]
|
||||
Deserialization(String),
|
||||
|
||||
/// Encryption error
|
||||
#[error("Encryption error: {0}")]
|
||||
Encryption(String),
|
||||
|
||||
/// Decryption error
|
||||
#[error("Decryption error: {0}")]
|
||||
Decryption(String),
|
||||
|
||||
/// Other error
|
||||
#[error("Error: {0}")]
|
||||
Other(String),
|
||||
}
|
||||
|
||||
impl From<serde_json::Error> for KvsError {
|
||||
fn from(err: serde_json::Error) -> Self {
|
||||
KvsError::Serialization(err.to_string())
|
||||
}
|
||||
}
|
||||
|
||||
impl From<KvsError> for crate::error::CryptoError {
|
||||
fn from(err: KvsError) -> Self {
|
||||
crate::error::CryptoError::SerializationError(err.to_string())
|
||||
}
|
||||
}
|
||||
|
||||
impl From<crate::error::CryptoError> for KvsError {
|
||||
fn from(err: crate::error::CryptoError) -> Self {
|
||||
match err {
|
||||
crate::error::CryptoError::EncryptionFailed(msg) => KvsError::Encryption(msg),
|
||||
crate::error::CryptoError::DecryptionFailed(msg) => KvsError::Decryption(msg),
|
||||
crate::error::CryptoError::SerializationError(msg) => KvsError::Serialization(msg),
|
||||
_ => KvsError::Other(err.to_string()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Result type for key-value store operations.
|
||||
pub type Result<T> = std::result::Result<T, KvsError>;
|
||||
14
vault/src/kvs/mod.rs
Normal file
14
vault/src/kvs/mod.rs
Normal file
@@ -0,0 +1,14 @@
|
||||
//! Key-Value Store functionality
|
||||
//!
|
||||
//! This module provides a simple key-value store with encryption support.
|
||||
|
||||
pub mod error;
|
||||
pub mod store;
|
||||
|
||||
// Re-export public types and functions
|
||||
pub use error::KvsError;
|
||||
pub use store::{
|
||||
create_store, delete_store, get_store_path, list_stores, open_store, KvPair, KvStore,
|
||||
};
|
||||
|
||||
// Tests are now in the tests/ directory
|
||||
370
vault/src/kvs/store.rs
Normal file
370
vault/src/kvs/store.rs
Normal file
@@ -0,0 +1,370 @@
|
||||
//! Implementation of a simple key-value store using the filesystem.
|
||||
|
||||
use crate::kvs::error::{KvsError, Result};
|
||||
use crate::symmetric::implementation::{
|
||||
decrypt_symmetric, derive_key_from_password, encrypt_symmetric,
|
||||
};
|
||||
use serde::{de::DeserializeOwned, Deserialize, Serialize};
|
||||
use std::collections::HashMap;
|
||||
use std::fs;
|
||||
use std::path::PathBuf;
|
||||
use std::sync::{Arc, Mutex};
|
||||
|
||||
/// A key-value pair.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct KvPair {
|
||||
pub key: String,
|
||||
pub value: String,
|
||||
}
|
||||
|
||||
/// A simple key-value store.
|
||||
///
|
||||
/// This implementation uses the filesystem to store key-value pairs.
|
||||
#[derive(Clone)]
|
||||
pub struct KvStore {
|
||||
/// The name of the store
|
||||
name: String,
|
||||
/// The path to the store file
|
||||
path: PathBuf,
|
||||
/// In-memory cache of the store data
|
||||
data: Arc<Mutex<HashMap<String, String>>>,
|
||||
/// Whether the store is encrypted
|
||||
encrypted: bool,
|
||||
/// The password for encryption (if encrypted)
|
||||
password: Option<String>,
|
||||
}
|
||||
|
||||
/// Gets the path to the key-value store directory.
|
||||
pub fn get_store_path() -> PathBuf {
|
||||
let home_dir = dirs::home_dir().unwrap_or_else(|| PathBuf::from("."));
|
||||
home_dir.join(".hero-vault").join("kvs")
|
||||
}
|
||||
|
||||
/// Creates a new key-value store with the given name.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `name` - The name of the store
|
||||
/// * `encrypted` - Whether to encrypt the store
|
||||
/// * `password` - The password for encryption (required if encrypted is true)
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// A new `KvStore` instance
|
||||
pub fn create_store(name: &str, encrypted: bool, password: Option<&str>) -> Result<KvStore> {
|
||||
// Check if password is provided when encryption is enabled
|
||||
if encrypted && password.is_none() {
|
||||
return Err(KvsError::Other(
|
||||
"Password required for encrypted store".to_string(),
|
||||
));
|
||||
}
|
||||
|
||||
// Create the store directory if it doesn't exist
|
||||
let store_dir = get_store_path();
|
||||
if !store_dir.exists() {
|
||||
fs::create_dir_all(&store_dir)?;
|
||||
}
|
||||
|
||||
// Create the store file path
|
||||
let store_path = store_dir.join(format!("{}.json", name));
|
||||
|
||||
// Create an empty store
|
||||
let store = KvStore {
|
||||
name: name.to_string(),
|
||||
path: store_path,
|
||||
data: Arc::new(Mutex::new(HashMap::new())),
|
||||
encrypted,
|
||||
password: password.map(|s| s.to_string()),
|
||||
};
|
||||
|
||||
// Save the empty store
|
||||
store.save()?;
|
||||
|
||||
Ok(store)
|
||||
}
|
||||
|
||||
/// Opens an existing key-value store with the given name.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `name` - The name of the store
|
||||
/// * `password` - The password for decryption (required if the store is encrypted)
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// The opened `KvStore` instance
|
||||
pub fn open_store(name: &str, password: Option<&str>) -> Result<KvStore> {
|
||||
// Get the store file path
|
||||
let store_dir = get_store_path();
|
||||
let store_path = store_dir.join(format!("{}.json", name));
|
||||
|
||||
// Check if the store exists
|
||||
if !store_path.exists() {
|
||||
return Err(KvsError::StoreNotFound(name.to_string()));
|
||||
}
|
||||
|
||||
// Read the store file
|
||||
let file_content = fs::read_to_string(&store_path)?;
|
||||
|
||||
// Check if the file is encrypted (simple heuristic)
|
||||
let is_encrypted = !file_content.starts_with('{');
|
||||
|
||||
// If encrypted, we need a password
|
||||
if is_encrypted && password.is_none() {
|
||||
return Err(KvsError::Other(
|
||||
"Password required for encrypted store".to_string(),
|
||||
));
|
||||
}
|
||||
|
||||
// Parse the store data
|
||||
let data: HashMap<String, String> = if is_encrypted {
|
||||
// Decrypt the file content
|
||||
let password = password.unwrap();
|
||||
let encrypted_data: Vec<u8> = serde_json::from_str(&file_content)?;
|
||||
let key = derive_key_from_password(password);
|
||||
let decrypted_data = decrypt_symmetric(&key, &encrypted_data)?;
|
||||
let decrypted_str = String::from_utf8(decrypted_data)
|
||||
.map_err(|e| KvsError::Deserialization(e.to_string()))?;
|
||||
serde_json::from_str(&decrypted_str)?
|
||||
} else {
|
||||
serde_json::from_str(&file_content)?
|
||||
};
|
||||
|
||||
// Create the store
|
||||
let store = KvStore {
|
||||
name: name.to_string(),
|
||||
path: store_path,
|
||||
data: Arc::new(Mutex::new(data)),
|
||||
encrypted: is_encrypted,
|
||||
password: password.map(|s| s.to_string()),
|
||||
};
|
||||
|
||||
Ok(store)
|
||||
}
|
||||
|
||||
/// Deletes a key-value store with the given name.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `name` - The name of the store to delete
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// `Ok(())` if the operation was successful
|
||||
pub fn delete_store(name: &str) -> Result<()> {
|
||||
// Get the store file path
|
||||
let store_dir = get_store_path();
|
||||
let store_path = store_dir.join(format!("{}.json", name));
|
||||
|
||||
// Check if the store exists
|
||||
if !store_path.exists() {
|
||||
return Err(KvsError::StoreNotFound(name.to_string()));
|
||||
}
|
||||
|
||||
// Delete the store file
|
||||
fs::remove_file(store_path)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Lists all available key-value stores.
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// A vector of store names
|
||||
pub fn list_stores() -> Result<Vec<String>> {
|
||||
// Get the store directory
|
||||
let store_dir = get_store_path();
|
||||
if !store_dir.exists() {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
|
||||
// List all JSON files in the directory
|
||||
let mut stores = Vec::new();
|
||||
for entry in fs::read_dir(store_dir)? {
|
||||
let entry = entry?;
|
||||
let path = entry.path();
|
||||
if path.is_file() && path.extension().map_or(false, |ext| ext == "json") {
|
||||
if let Some(name) = path.file_stem() {
|
||||
if let Some(name_str) = name.to_str() {
|
||||
stores.push(name_str.to_string());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(stores)
|
||||
}
|
||||
|
||||
impl KvStore {
|
||||
/// Saves the store to disk.
|
||||
fn save(&self) -> Result<()> {
|
||||
// Get the store data
|
||||
let data = self.data.lock().unwrap();
|
||||
|
||||
// Serialize the data
|
||||
let serialized = serde_json::to_string(&*data)?;
|
||||
|
||||
// Write to file
|
||||
if self.encrypted {
|
||||
if let Some(password) = &self.password {
|
||||
// Encrypt the data
|
||||
let key = derive_key_from_password(password);
|
||||
let encrypted_data = encrypt_symmetric(&key, serialized.as_bytes())?;
|
||||
let encrypted_json = serde_json::to_string(&encrypted_data)?;
|
||||
fs::write(&self.path, encrypted_json)?;
|
||||
} else {
|
||||
return Err(KvsError::Other(
|
||||
"Password required for encrypted store".to_string(),
|
||||
));
|
||||
}
|
||||
} else {
|
||||
fs::write(&self.path, serialized)?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Stores a value with the given key.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `key` - The key to store the value under
|
||||
/// * `value` - The value to store
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// `Ok(())` if the operation was successful
|
||||
pub fn set<K, V>(&self, key: K, value: &V) -> Result<()>
|
||||
where
|
||||
K: ToString,
|
||||
V: Serialize,
|
||||
{
|
||||
let key_str = key.to_string();
|
||||
let serialized = serde_json::to_string(value)?;
|
||||
|
||||
// Update in-memory data
|
||||
{
|
||||
let mut data = self.data.lock().unwrap();
|
||||
data.insert(key_str, serialized);
|
||||
}
|
||||
|
||||
// Save to disk
|
||||
self.save()?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Retrieves a value for the given key.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `key` - The key to retrieve the value for
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// The value if found, or `Err(KvsError::KeyNotFound)` if not found
|
||||
pub fn get<K, V>(&self, key: K) -> Result<V>
|
||||
where
|
||||
K: ToString,
|
||||
V: DeserializeOwned,
|
||||
{
|
||||
let key_str = key.to_string();
|
||||
let data = self.data.lock().unwrap();
|
||||
|
||||
match data.get(&key_str) {
|
||||
Some(serialized) => {
|
||||
let value: V = serde_json::from_str(serialized)?;
|
||||
Ok(value)
|
||||
}
|
||||
None => Err(KvsError::KeyNotFound(key_str)),
|
||||
}
|
||||
}
|
||||
|
||||
/// Deletes a value for the given key.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `key` - The key to delete
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// `Ok(())` if the operation was successful
|
||||
pub fn delete<K>(&self, key: K) -> Result<()>
|
||||
where
|
||||
K: ToString,
|
||||
{
|
||||
let key_str = key.to_string();
|
||||
|
||||
// Update in-memory data
|
||||
{
|
||||
let mut data = self.data.lock().unwrap();
|
||||
if data.remove(&key_str).is_none() {
|
||||
return Err(KvsError::KeyNotFound(key_str));
|
||||
}
|
||||
}
|
||||
|
||||
// Save to disk
|
||||
self.save()?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Checks if a key exists in the store.
|
||||
///
|
||||
/// # Arguments
|
||||
///
|
||||
/// * `key` - The key to check
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// `true` if the key exists, `false` otherwise
|
||||
pub fn contains<K>(&self, key: K) -> Result<bool>
|
||||
where
|
||||
K: ToString,
|
||||
{
|
||||
let key_str = key.to_string();
|
||||
let data = self.data.lock().unwrap();
|
||||
|
||||
Ok(data.contains_key(&key_str))
|
||||
}
|
||||
|
||||
/// Lists all keys in the store.
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// A vector of keys as strings
|
||||
pub fn keys(&self) -> Result<Vec<String>> {
|
||||
let data = self.data.lock().unwrap();
|
||||
|
||||
Ok(data.keys().cloned().collect())
|
||||
}
|
||||
|
||||
/// Clears all key-value pairs from the store.
|
||||
///
|
||||
/// # Returns
|
||||
///
|
||||
/// `Ok(())` if the operation was successful
|
||||
pub fn clear(&self) -> Result<()> {
|
||||
// Update in-memory data
|
||||
{
|
||||
let mut data = self.data.lock().unwrap();
|
||||
data.clear();
|
||||
}
|
||||
|
||||
// Save to disk
|
||||
self.save()?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Gets the name of the store.
|
||||
pub fn name(&self) -> &str {
|
||||
&self.name
|
||||
}
|
||||
|
||||
/// Gets whether the store is encrypted.
|
||||
pub fn is_encrypted(&self) -> bool {
|
||||
self.encrypted
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user