mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-11-02 10:52:05 +00:00
thePR0M3TH3ANandClaude Opus 5
2aed95a687
Passwords are never stored -- they are re-derived on demand from (seed, index, length, policy) -- and entries carried no algorithm version. Any change to generate_password therefore changed every existing password in every vault, unrecoverably. This adds the version field that makes such changes possible at all, then makes three. Safety net first (M4). test_entropy_integrity.py freezes 18 v1 vectors spanning every policy and both sides of the 32-byte stream-wrap boundary, and asserts the RNG fails closed: os.urandom raising must abort seed generation, short reads must abort, AES-GCM nonces must be fresh. Each guard was mutation-verified rather than assumed -- removing _balance_distribution, perturbing the stream wrap, or altering the character mapping each turns all 18 vectors red, and adding a hash-of-timestamp fallback to generate_bip85_seed turns the fail-closed test red. generate_password now takes gen_version, defaulting to 1. Existing entries carry no field and keep deriving v1 byte-identically; the argument is only forwarded when non-legacy, so all 13 call sites across CLI, API and both TUIs are untouched. New password entries are stamped gen_version 2. An unreadable version raises rather than guessing which algorithm produced a password. v2 fixes three findings: - M1: drops the forced equal-quarters class quota. 1 -> 82 distinct class compositions at length 16 over 200 samples; per-character entropy 6.42 -> 6.53 bits against a 6.555 ceiling. - M2: rejection sampling instead of byte % len(alphabet). Chi-square 96.1 against df=93 (p<0.001 critical value ~147). - M3: an unbounded HMAC-expanded stream instead of cycling a 32-byte key, which was a repeating pad for passwords over 32 characters. Lag-32 repeat rate now sits within one standard error of chance. Dropping the quota removed an accidental backstop: v1's minimum enforcement overwrites uniformly random positions, so raising one class minimum could destroy another, and only the quota's near-total rewrite hid it. v2 chooses donor positions solely from classes that currently have a surplus, and rejects a policy whose minima cannot fit the requested length. Also removes a dead HKDF derivation whose result was discarded while the docstrings named it as the algorithm in use (L1); PBKDF2 was and remains the real one. Verified as a negative control -- the vectors stayed green. Six test doubles are updated to the real generate_password signature; they began receiving gen_version once new entries carried it. Existing entries stay on v1 by design. An opt-in per-entry upgrade, with a confirmation making the consequence unmissable, is still to come. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u
339 lines
12 KiB
Python
339 lines
12 KiB
Python
import sys
|
|
from pathlib import Path
|
|
from tempfile import TemporaryDirectory
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
|
|
from helpers import create_vault, TEST_SEED, TEST_PASSWORD
|
|
|
|
sys.path.append(str(Path(__file__).resolve().parents[1]))
|
|
|
|
from seedpass.core.entry_management import EntryManager
|
|
from seedpass.core.backup import BackupManager
|
|
from seedpass.core.manager import PasswordManager, EncryptionMode
|
|
from seedpass.core.config_manager import ConfigManager
|
|
from constants import DEFAULT_PASSWORD_LENGTH
|
|
|
|
|
|
class FakePasswordGenerator:
|
|
def generate_password(self, length: int, index: int, gen_version: int = 1) -> str: # noqa: D401
|
|
return f"pw-{index}-{length}"
|
|
|
|
|
|
def test_handle_add_password(monkeypatch, dummy_nostr_client, capsys):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = False
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter(
|
|
[
|
|
"a", # advanced mode
|
|
"Example", # label
|
|
"", # username
|
|
"", # url
|
|
"", # notes
|
|
"", # tags
|
|
"n", # add custom field
|
|
"", # length (default)
|
|
"", # include special default
|
|
"", # allowed special default
|
|
"", # special mode default
|
|
"", # exclude ambiguous default
|
|
"", # min uppercase
|
|
"", # min lowercase
|
|
"", # min digits
|
|
"", # min special
|
|
]
|
|
)
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
pm.handle_add_password()
|
|
out = capsys.readouterr().out
|
|
|
|
entries = entry_mgr.list_entries(verbose=False)
|
|
assert entries == [(0, "Example", "", "", False)]
|
|
|
|
entry = entry_mgr.retrieve_entry(0)
|
|
assert entry["label"] == "Example"
|
|
assert entry["length"] == DEFAULT_PASSWORD_LENGTH
|
|
assert entry["username"] == ""
|
|
assert entry["url"] == ""
|
|
assert entry["archived"] is False
|
|
assert entry["type"] == "password"
|
|
assert entry["kind"] == "password"
|
|
assert entry["notes"] == ""
|
|
assert entry["custom_fields"] == []
|
|
assert entry["tags"] == []
|
|
assert "date_added" in entry
|
|
assert "date_modified" in entry
|
|
|
|
assert f"pw-0-{DEFAULT_PASSWORD_LENGTH}" in out
|
|
|
|
|
|
def test_handle_add_password_secret_mode(monkeypatch, dummy_nostr_client, capsys):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = True
|
|
pm.clipboard_clear_delay = 5
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter(
|
|
[
|
|
"a", # advanced mode
|
|
"Example", # label
|
|
"", # username
|
|
"", # url
|
|
"", # notes
|
|
"", # tags
|
|
"n", # add custom field
|
|
"", # length (default)
|
|
"", # include special default
|
|
"", # allowed special default
|
|
"", # special mode default
|
|
"", # exclude ambiguous default
|
|
"", # min uppercase
|
|
"", # min lowercase
|
|
"", # min digits
|
|
"", # min special
|
|
]
|
|
)
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
called = []
|
|
monkeypatch.setattr(
|
|
"seedpass.core.manager.copy_to_clipboard",
|
|
lambda text, delay: (called.append((text, delay)), True)[1],
|
|
)
|
|
|
|
pm.handle_add_password()
|
|
out = capsys.readouterr().out
|
|
|
|
assert f"pw-0-{DEFAULT_PASSWORD_LENGTH}" not in out
|
|
assert "copied to clipboard" in out
|
|
assert called == [(f"pw-0-{DEFAULT_PASSWORD_LENGTH}", 5)]
|
|
|
|
|
|
def test_handle_add_password_quick_mode(monkeypatch, dummy_nostr_client, capsys):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = False
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter(
|
|
[
|
|
"q", # quick mode
|
|
"Example", # label
|
|
"", # username
|
|
"", # url
|
|
"", # length (default)
|
|
"", # include special default
|
|
]
|
|
)
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
pm.handle_add_password()
|
|
out = capsys.readouterr().out
|
|
|
|
entries = entry_mgr.list_entries(verbose=False)
|
|
assert entries == [(0, "Example", "", "", False)]
|
|
|
|
entry = entry_mgr.retrieve_entry(0)
|
|
assert entry["label"] == "Example"
|
|
assert entry["length"] == DEFAULT_PASSWORD_LENGTH
|
|
assert entry["username"] == ""
|
|
assert entry["url"] == ""
|
|
assert entry["archived"] is False
|
|
assert entry["type"] == "password"
|
|
assert entry["kind"] == "password"
|
|
assert entry["notes"] == ""
|
|
assert entry["custom_fields"] == []
|
|
assert entry["tags"] == []
|
|
assert "date_added" in entry
|
|
assert "date_modified" in entry
|
|
|
|
assert f"pw-0-{DEFAULT_PASSWORD_LENGTH}" in out
|
|
|
|
|
|
def test_handle_add_password_quick_mode_reprompts_invalid_length(
|
|
monkeypatch, dummy_nostr_client, capsys
|
|
):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = False
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter(
|
|
[
|
|
"q",
|
|
"Example",
|
|
"",
|
|
"",
|
|
"3",
|
|
"abc",
|
|
"12",
|
|
"",
|
|
]
|
|
)
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
pm.handle_add_password()
|
|
out = capsys.readouterr().out
|
|
|
|
assert "Error: Password length must be between" in out
|
|
assert "Error: Password length must be a number." in out
|
|
entries = entry_mgr.list_entries(verbose=False)
|
|
assert entries == [(0, "Example", "", "", False)]
|
|
entry = entry_mgr.retrieve_entry(0)
|
|
assert entry["length"] == 12
|
|
|
|
|
|
def test_handle_add_password_reprompts_invalid_mode(
|
|
monkeypatch, dummy_nostr_client, capsys
|
|
):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = False
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter(
|
|
[
|
|
"z", # invalid mode
|
|
"q", # then quick mode
|
|
"Example",
|
|
"",
|
|
"",
|
|
"",
|
|
"",
|
|
]
|
|
)
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
pm.handle_add_password()
|
|
out = capsys.readouterr().out
|
|
|
|
assert "Invalid mode. Enter 'q' for quick or 'a' for advanced." in out
|
|
entries = entry_mgr.list_entries(verbose=False)
|
|
assert entries == [(0, "Example", "", "", False)]
|
|
|
|
|
|
def test_handle_add_password_empty_mode_cancels(monkeypatch, dummy_nostr_client):
|
|
client, _relay = dummy_nostr_client
|
|
with TemporaryDirectory() as tmpdir:
|
|
tmp_path = Path(tmpdir)
|
|
vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
|
|
cfg_mgr = ConfigManager(vault, tmp_path)
|
|
backup_mgr = BackupManager(tmp_path, cfg_mgr)
|
|
entry_mgr = EntryManager(vault, backup_mgr)
|
|
|
|
pm = PasswordManager.__new__(PasswordManager)
|
|
pm.encryption_mode = EncryptionMode.SEED_ONLY
|
|
pm.encryption_manager = enc_mgr
|
|
pm.vault = vault
|
|
pm.entry_manager = entry_mgr
|
|
pm.backup_manager = backup_mgr
|
|
pm.password_generator = FakePasswordGenerator()
|
|
pm.parent_seed = TEST_SEED
|
|
pm.nostr_client = client
|
|
pm.fingerprint_dir = tmp_path
|
|
pm.secret_mode_enabled = False
|
|
pm.is_dirty = False
|
|
|
|
inputs = iter([""])
|
|
monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
|
|
monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
|
|
|
|
pm.handle_add_password()
|
|
assert entry_mgr.list_entries(verbose=False) == []
|