PasswordVault.hpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#pragma once
 
#include <string>
#include <vector>
#include <functional>
#include <utility>
#include <unordered_map>
#include <mutex>
#include <atomic>
#include "PasswordEntry.hpp"
 
class PasswordVault {
public:
    PasswordVault();
 
    bool initialize();
    bool isUnlocked() const;
 
    bool isFirstRun() const;
    bool createMasterPassword(const std::string& masterPassword);
    bool unlock(const std::string& masterPassword);
    void lock();
 
    std::vector<PasswordEntry> loadIndex() const;
    bool saveIndex(const std::vector<PasswordEntry>& entries) const;
 
    bool addEntry(const PasswordEntry& entry, const std::string& secret);
    bool updateEntry(const PasswordEntry& entry, const std::string& secret);
    bool deleteEntry(const std::string& id);
    void deleteAllEntries(std::function<void(bool)> onDone);
    void addEntriesBulk(
        const std::vector<std::pair<PasswordEntry, std::string>>& items,
        std::function<void(int ok, int fail)> onDone);
    void exportToCSV(
        std::function<void(std::string csv, std::string err)> onDone) const;
    void getSecretAsync(const std::string& id,
                        std::function<void(std::string)> callback) const;
 
    bool setSecret(const std::string& id, const std::string& secret);
 
    bool isCacheReady() const { return cacheReady_.load(); }
 
    std::string generateId() const;
    std::string nowIso() const;
    std::string getIndexPath() const;
 
private:
    // atomic: letto/scritto sia dal main thread (lock/unlock) sia dal
    // thread di caricamento cache lanciato in unlock() → senza atomic
    // sarebbe una data race (UB).
    std::atomic<bool> unlocked_{ false };
    std::string masterPassword_;
    mutable std::unordered_map<std::string, std::string> secretCache_;
    mutable std::mutex cacheMutex_;
    mutable std::atomic<bool> cacheReady_{ false };
 
    // Percorsi
    std::string getHashPath() const;
    std::string getSecretsPath() const;
 
    // Crypto
    std::string pbkdf2Hex(const std::string& password,
                          const std::string& saltHex,
                          int iterations = 200000) const;
    std::string generateSaltHex() const;
    std::string generateNonceHex() const;
    bool saveSecretsFile(const std::unordered_map<std::string,std::string>& secrets) const;
    bool loadSecretsFile(std::unordered_map<std::string,std::string>& secrets) const;
    bool aesEncrypt(const std::string& key32,
                    const std::string& nonce12,
                    const std::string& plaintext,
                    std::string& ciphertext,
                    std::string& tag16) const;
 
    bool aesDecrypt(const std::string& key32,
                    const std::string& nonce12,
                    const std::string& ciphertext,
                    const std::string& tag16,
                    std::string& plaintext) const;
    std::string deriveKey(const std::string& saltHex) const;
    static bool atomicWriteFile(const std::string& path, const std::string& content);
    void flushAsync(std::unordered_map<std::string,std::string> snapshot) const;
 
    std::string makeSecretKey(const std::string& id) const;
};