60ceea41d7
Two issues: 1. Verlauf-Export CSV put the opaque file_code in the Link column when the upload had no real URL, so the column looked like just a bunch of IDs. Now only real http(s) URLs land in that column. 2. Hoster passwords and API keys were stored as plaintext in electron-config.json. Now wrapped with Electron's safeStorage (DPAPI on Windows, Keychain on macOS, libsecret on Linux) and stored as 'enc:v1:<base64>'. Credentials are decrypted on load so in-memory flows stay unchanged, and backups still export plaintext inside the existing .mhu envelope so they remain portable between machines/users. Legacy plaintext configs auto-migrate on next write.
76 lines
2.4 KiB
JavaScript
76 lines
2.4 KiB
JavaScript
// Wraps Electron's safeStorage (OS-level credential encryption: DPAPI on
|
|
// Windows, Keychain on macOS, libsecret on Linux) to keep hoster passwords and
|
|
// API keys out of the plaintext electron-config.json.
|
|
//
|
|
// On Windows the DPAPI key is tied to the current user profile, so credentials
|
|
// encrypted here are only readable by the same Windows user. For backups we
|
|
// export to plaintext (the .mhu envelope has its own AES-GCM layer) so moving
|
|
// between machines/users works transparently.
|
|
|
|
const SENTINEL = 'enc:v1:';
|
|
const CRED_FIELDS = ['password', 'apiKey'];
|
|
|
|
let _safeStorageCache = undefined;
|
|
function getSafeStorage() {
|
|
if (_safeStorageCache !== undefined) return _safeStorageCache;
|
|
try {
|
|
const { safeStorage } = require('electron');
|
|
if (safeStorage && typeof safeStorage.isEncryptionAvailable === 'function'
|
|
&& safeStorage.isEncryptionAvailable()) {
|
|
_safeStorageCache = safeStorage;
|
|
return _safeStorageCache;
|
|
}
|
|
} catch {}
|
|
_safeStorageCache = null;
|
|
return null;
|
|
}
|
|
|
|
function isEncrypted(value) {
|
|
return typeof value === 'string' && value.startsWith(SENTINEL);
|
|
}
|
|
|
|
function encryptField(value) {
|
|
if (!value || typeof value !== 'string') return value;
|
|
if (isEncrypted(value)) return value;
|
|
const ss = getSafeStorage();
|
|
if (!ss) return value;
|
|
try {
|
|
const buf = ss.encryptString(value);
|
|
return SENTINEL + buf.toString('base64');
|
|
} catch {
|
|
return value;
|
|
}
|
|
}
|
|
|
|
function decryptField(value) {
|
|
if (!value || typeof value !== 'string') return value;
|
|
if (!isEncrypted(value)) return value;
|
|
const ss = getSafeStorage();
|
|
if (!ss) return '';
|
|
try {
|
|
const buf = Buffer.from(value.slice(SENTINEL.length), 'base64');
|
|
return ss.decryptString(buf);
|
|
} catch {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
function mapHosterAccounts(config, fn) {
|
|
if (!config || !config.hosters || typeof config.hosters !== 'object') return config;
|
|
for (const accounts of Object.values(config.hosters)) {
|
|
if (!Array.isArray(accounts)) continue;
|
|
for (const acc of accounts) {
|
|
if (!acc || typeof acc !== 'object') continue;
|
|
for (const f of CRED_FIELDS) {
|
|
if (acc[f]) acc[f] = fn(acc[f]);
|
|
}
|
|
}
|
|
}
|
|
return config;
|
|
}
|
|
|
|
function encryptCredentials(config) { return mapHosterAccounts(config, encryptField); }
|
|
function decryptCredentials(config) { return mapHosterAccounts(config, decryptField); }
|
|
|
|
module.exports = { encryptField, decryptField, encryptCredentials, decryptCredentials, isEncrypted };
|