add api calls to create, delete, update, and sync cipher items

.gitignore

···
 .bundle
-db.sqlite3
+db/*.sqlite3
 jwt-rsa.key
 vendor/

API.md

···
 
 The following notes were made by analyzing traffic between the Firefox
 extension and the Bitwarden servers by running
-[mitm.rb](mitm.rb)
+[tools/mitm.rb](mitm.rb)
 and having the Firefox extension use `http://127.0.0.1:4567/` as its
 base URL.
 

Gemfile

···
 gem "jwt"
 
 gem "sqlite3"
+
+gem "minitest"
+gem "rack-test"

Gemfile.lock

···
     backports (3.10.3)
     json (2.1.0)
     jwt (2.1.0)
+    minitest (5.10.3)
     multi_json (1.12.2)
     mustermann (1.0.1)
     pbkdf2-ruby (0.2.1)
     rack (2.0.3)
     rack-protection (2.0.0)
       rack
+    rack-test (0.7.0)
+      rack (>= 1.0, < 3)
     rotp (3.3.0)
     sinatra (2.0.0)
       mustermann (~> 1.0)
···
 DEPENDENCIES
   json
   jwt
+  minitest
   pbkdf2-ruby
+  rack-test
   rotp
   sinatra
   sinatra-contrib

LICENSE

···
+Copyright (c) 2017 joshua stein <[e-mail]>
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

README.md

···
 [Bitwarden apps](https://github.com/bitwarden).
 
 Data is stored in a local SQLite database.
+This means you can easily run it locally and have your data never leave
+your device, or run it on your own web server via Rack and some front-end
+HTTP server with TLS to support logging in from multiple devices.
+Backing up your data is as easy as copying the `db/production.sqlite3` file
+somewhere.
 
 ### API Documentation
 
···
 documentation available other than the
 [.NET Bitwarden code](https://github.com/bitwarden/core)
 itself.
+
+## Usage
+
+Run `bundle install` at least once.
+
+To run via Rack on port 4567:
+
+	env RAILS_ENV=production bundle exec rackup config.ru
+
+You'll probably want to run it once with signups enabled, to allow yourself
+to create an account:
+
+	env RAILS_ENV=production ALLOW_SIGNUPS=1 bundle exec rackup config.ru
+
+Run test suite:
+
+	bundle exec rake test
 
 ### License
 

Rakefile

···
+require "rake/testtask"
+
+Rake::TestTask.new do |t|
+  t.pattern = "spec/*_spec.rb"
+end

bitwarden.rb

···
-#!/usr/bin/env ruby
-
-APP_ROOT = File.dirname(__FILE__)
-
-require "sinatra"
-require "sinatra/namespace"
-require "cgi"
-
-require "#{APP_ROOT}/lib/bitwarden.rb"
-require "#{APP_ROOT}/lib/helper.rb"
-
-require "#{APP_ROOT}/lib/db.rb"
-require "#{APP_ROOT}/lib/dbmodel.rb"
-require "#{APP_ROOT}/lib/user.rb"
-require "#{APP_ROOT}/lib/device.rb"
-
-ALLOW_SIGNUPS = true
-
-BASE_URL = "/api"
-IDENTITY_BASE_URL = "/identity"
-ICONS_URL = "/icons"
-
-# create/load JWT signing keys
-Bitwarden.load_jwt_keys
-
-# create/update tables
-Db.connection
-
-before do
-  # import JSON params
-  if request.request_method.upcase == "POST" &&
-  request.content_type.to_s.match(/^application\/json[$;]/)
-    params.merge!(JSON.parse(request.body.read))
-  end
-end
-
-namespace IDENTITY_BASE_URL do
-  # login with a username and password, register/update the device, and get an
-  # oauth token in response
-  post "/connect/token" do
-    content_type :json
-
-    need_params(
-      :client_id,
-      :grant_type,
-      :deviceIdentifier,
-      :deviceName,
-      :deviceType,
-      :password,
-      :scope,
-      :username,
-    ) do |p|
-      return validation_error("#{p} cannot be blank")
-    end
-
-    if params[:grant_type] != "password"
-      return validation_error("grant type not supported")
-    end
-
-    if params[:scope] != "api offline_access"
-      return validation_error("scope not supported")
-    end
-
-    u = User.find_by_email(params[:username])
-    if !u
-      return validation_error("Invalid username")
-    end
-
-    if !u.has_password_hash?(params[:password])
-      return validation_error("Invalid password")
-    end
-
-    if u.totp_secret.present?
-      if params[:twoFactorToken].blank? ||
-      !u.verifies_totp_code?(params[:twoFactorToken])
-        return [ 400, {
-          "error" => "invalid_grant",
-          "error_description" => "Two factor required.",
-          "TwoFactorProviders" => [ 0 ], # authenticator
-          "TwoFactorProviders2" => { "0" => nil }
-        }.to_json ]
-      end
-    end
-
-    d = Device.find_by_device_uuid(params[:deviceIdentifier])
-    if d && d.user_id != u.id
-      # wat
-      d.destroy
-      d = nil
-    end
-
-    if !d
-      d = Device.new
-      d.user_id = u.id
-      d.device_uuid = params[:deviceIdentifier]
-    end
-
-    d.device_type = params[:deviceType]
-    d.name = params[:deviceName]
-    d.device_push_token = params[:devicePushToken]
-
-    d.generate_tokens!
-
-    User.transaction do
-      if d.save
-        return tee({
-          :access_token => d.access_token,
-          :expires_in => (d.token_expiry - Time.now.to_i),
-          :token_type => "Bearer",
-          :refresh_token => d.refresh_token,
-          :Key => d.user.key,
-          # TODO: :privateKey and :TwoFactorToken
-        }.to_json)
-      else
-        return validation_error("Unknown error")
-      end
-    end
-  end
-end
-
-namespace BASE_URL do
-  # create a new user
-  post "/accounts/register" do
-    content_type :json
-
-    if !ALLOW_SIGNUPS
-      return validation_error("Signups are not permitted")
-    end
-
-    need_params(:masterPasswordHash) do |p|
-      return validation_error("#{p} cannot be blank")
-    end
-
-    if !params[:email].to_s.match(/^.+@.+\..+$/)
-      return validation_error("Invalid e-mail address")
-    end
-
-    if !params[:key].to_s.match(/^0\..+\|.+/)
-      return validation_error("Invalid key")
-    end
-
-    User.transaction do
-      if User.find_by_email(params[:email])
-        return validation_error("E-mail is already in use")
-      end
-
-      u = User.new
-      u.email = params[:email]
-      u.password_hash = params[:masterPasswordHash]
-      u.key = params[:key]
-
-      if u.save
-        return ""
-      else
-        return validation_error("User save failed")
-      end
-    end
-  end
-end

config.ru

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+require File.dirname(__FILE__) + "/lib/bitwarden_ruby.rb"
+require "#{APP_ROOT}/lib/api.rb"
+
+run Sinatra::Application

lib/api.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+#
+# helper methods
+#
+
+def device_from_bearer
+  if m = request.env["HTTP_AUTHORIZATION"].to_s.match(/^Bearer (.+)/)
+    token = m[1]
+    if (d = Device.find_by_access_token(token))
+      if d.token_expires_at >= Time.now
+        return d
+      end
+    end
+  end
+
+  nil
+end
+
+def need_params(*ps)
+  ps.each do |p|
+    if params[p].to_s.blank?
+      yield(p)
+    end
+  end
+end
+
+def validation_error(msg)
+  [ 400, {
+    "ValidationErrors" => { "" => [
+      msg,
+    ]},
+    "Object" => "error",
+  }.to_json ]
+end
+
+#
+# begin sinatra routing
+#
+
+# import JSON params for every request
+before do
+  if request.content_type.to_s.match(/\Aapplication\/json(;|\z)/)
+    js = request.body.read.to_s
+    if !js.strip.blank?
+      params.merge!(JSON.parse(js))
+    end
+  end
+
+  # we're always going to reply with json
+  content_type :json
+end
+
+namespace IDENTITY_BASE_URL do
+  # depending on grant_type:
+  #  password: login with a username/password, register/update the device
+  #  refresh_token: just generate a new access_token
+  # respond with an access_token and refresh_token
+  post "/connect/token" do
+    d = nil
+
+    case params[:grant_type]
+    when "refresh_token"
+      need_params(:refresh_token) do |p|
+        return validation_error("#{p} cannot be blank")
+      end
+
+      d = Device.find_by_refresh_token(params[:refresh_token])
+      if !d
+        return validation_error("Invalid refresh token")
+      end
+
+    when "password"
+      need_params(
+        :client_id,
+        :grant_type,
+        :deviceIdentifier,
+        :deviceName,
+        :deviceType,
+        :password,
+        :scope,
+        :username,
+      ) do |p|
+        return validation_error("#{p} cannot be blank")
+      end
+
+      if params[:scope] != "api offline_access"
+        return validation_error("scope not supported")
+      end
+
+      u = User.find_by_email(params[:username])
+      if !u
+        return validation_error("Invalid username")
+      end
+
+      if !u.has_password_hash?(params[:password])
+        return validation_error("Invalid password")
+      end
+
+      if u.two_factor_enabled? &&
+      (params[:twoFactorToken].blank? ||
+      !u.verifies_totp_code?(params[:twoFactorToken]))
+        return [ 400, {
+          "error" => "invalid_grant",
+          "error_description" => "Two factor required.",
+          "TwoFactorProviders" => [ 0 ], # authenticator
+          "TwoFactorProviders2" => { "0" => nil }
+        }.to_json ]
+      end
+
+      d = Device.find_by_uuid(params[:deviceIdentifier])
+      if d && d.user_uuid != u.uuid
+        # wat
+        d.destroy
+        d = nil
+      end
+
+      if !d
+        d = Device.new
+        d.user_uuid = u.uuid
+        d.uuid = params[:deviceIdentifier]
+      end
+
+      d.type = params[:deviceType]
+      d.name = params[:deviceName]
+      if params[:devicePushToken].present?
+        d.push_token = params[:devicePushToken]
+      end
+    else
+      return validation_error("grant type not supported")
+    end
+
+    d.regenerate_tokens!
+
+    User.transaction do
+      if !d.save
+        return validation_error("Unknown error")
+      end
+
+      {
+        :access_token => d.access_token,
+        :expires_in => (d.token_expires_at - Time.now).floor,
+        :token_type => "Bearer",
+        :refresh_token => d.refresh_token,
+        :Key => d.user.key,
+        # TODO: when to include :privateKey and :TwoFactorToken?
+      }.to_json
+    end
+  end
+end
+
+namespace BASE_URL do
+  # create a new user
+  post "/accounts/register" do
+    content_type :json
+
+    if !ALLOW_SIGNUPS
+      return validation_error("Signups are not permitted")
+    end
+
+    need_params(:masterPasswordHash) do |p|
+      return validation_error("#{p} cannot be blank")
+    end
+
+    if !params[:email].to_s.match(/^.+@.+\..+$/)
+      return validation_error("Invalid e-mail address")
+    end
+
+    if !params[:key].to_s.match(/^0\..+\|.+/)
+      return validation_error("Invalid key")
+    end
+
+    begin
+      if !Bitwarden::CipherString.parse(params[:key])
+        raise
+      end
+    rescue
+      return validation_error("Invalid key")
+    end
+
+    User.transaction do
+      params[:email].downcase!
+
+      if User.find_by_email(params[:email])
+        return validation_error("E-mail is already in use")
+      end
+
+      u = User.new
+      u.email = params[:email]
+      u.password_hash = params[:masterPasswordHash]
+      u.password_hint = params[:masterPasswordHint]
+      u.key = params[:key]
+
+      # is this supposed to come from somewhere?
+      u.culture = "en-US"
+
+      # i am a fair and just god
+      u.premium = true
+
+      if !u.save
+        return validation_error("User save failed")
+      end
+
+      ""
+    end
+  end
+
+  # fetch profile and ciphers
+  get "/sync" do
+    d = device_from_bearer
+    if !d
+      return validation_error("invalid bearer")
+    end
+
+    {
+      "Profile" => d.user.to_hash,
+      "Folders" => [],
+      "Ciphers" => d.user.ciphers.map{|c|
+        c.to_hash
+      },
+      "Domains" => {
+        "Object" => "domains"
+      },
+      "Object" => "sync"
+    }.to_json
+  end
+
+  # create a new cipher
+	post "/ciphers" do
+    d = device_from_bearer
+    if !d
+      return validation_error("invalid bearer")
+    end
+
+    need_params(:type, :name) do |p|
+      return validation_error("#{p} cannot be blank")
+    end
+
+    c = Cipher.new
+    c.user_uuid = d.user_uuid
+    c.update_from_params(params)
+
+    Cipher.transaction do
+      if !c.save
+        return validation_error("error saving")
+      end
+
+      c.to_hash.merge({
+        "Edit" => true,
+      }).to_json
+    end
+  end
+
+  # update a cipher
+	put "/ciphers/:uuid" do
+    d = device_from_bearer
+    if !d
+      return validation_error("invalid bearer")
+    end
+
+    c = nil
+    if params[:uuid].blank? || !(c = Cipher.find_by_uuid(params[:uuid]))
+      return validation_error("invalid cipher")
+    end
+
+    if c.user_uuid != d.user_uuid
+      return validation_error("invalid cipher")
+    end
+
+    need_params(:type, :name) do |p|
+      return validation_error("#{p} cannot be blank")
+    end
+
+    c.update_from_params(params)
+
+    Cipher.transaction do
+      if !c.save
+        return validation_error("error saving")
+      end
+
+      c.to_hash.merge({
+        "Edit" => true,
+      }).to_json
+    end
+  end
+
+  # delete a cipher
+	delete "/ciphers/:uuid" do
+    d = device_from_bearer
+    if !d
+      return validation_error("invalid bearer")
+    end
+
+    c = nil
+    if params[:uuid].blank? || !(c = Cipher.find_by_uuid(params[:uuid]))
+      return validation_error("invalid cipher")
+    end
+
+    if c.user_uuid != d.user_uuid
+      return validation_error("invalid cipher")
+    end
+
+    c.destroy
+
+    ""
+  end
+end
+
+namespace ICONS_URL do
+  get "/icons/:domain/icon.png" do
+    content_type "image/x-icon"
+
+    # TODO
+
+    ""
+  end
+end

lib/bitwarden.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 require "jwt"
+require "pbkdf2"
+require "openssl"
 
 class Bitwarden
+  # convenience methods for hashing/encryption/decryption that the apps do,
+  # just so we can test against
   class << self
-    attr_reader :jwt_rsa
+    # pbkdf2 stretch a password+salt
+    def makeKey(password, salt)
+      PBKDF2.new(:password => password, :salt => salt,
+        :iterations => 5000, :hash_function => OpenSSL::Digest::SHA256,
+        :key_length => (256 / 8)).bin_string
+    end
 
-    JWT_KEY = "#{APP_ROOT}/jwt-rsa.key"
+    # encrypt random bytes with a key to make new encryption key
+    def makeEncKey(key)
+      pt = OpenSSL::Random.random_bytes(64)
+      iv = OpenSSL::Random.random_bytes(16)
 
-    # load or create RSA pair used for JWT signing
-    def load_jwt_keys
-      if File.exists?(JWT_KEY)
-        @jwt_rsa = OpenSSL::PKey::RSA.new File.read(JWT_KEY)
+      cipher = OpenSSL::Cipher.new "AES-256-CBC"
+      cipher.encrypt
+      cipher.key = key
+      cipher.iv = iv
+      ct = cipher.update(pt)
+      ct << cipher.final
+
+      CipherString.new(
+        CipherString::TYPE_AESCBC256_B64,
+        Base64.strict_encode64(iv),
+        Base64.strict_encode64(ct),
+      ).to_s
+    end
+
+    # base64-encode a wrapped, stretched password+salt for signup/login
+    def hashPassword(password, salt)
+      key = makeKey(password, salt)
+      Base64.strict_encode64(PBKDF2.new(:password => key, :salt => password,
+        :iterations => 1, :key_length => 256/8,
+        :hash_function => OpenSSL::Digest::SHA256).bin_string)
+    end
+
+    # encrypt+mac a value with a key and mac key and random iv, return a
+    # CipherString of it
+    def encrypt(pt, key, macKey)
+      iv = OpenSSL::Random.random_bytes(16)
+
+      cipher = OpenSSL::Cipher.new "AES-256-CBC"
+      cipher.encrypt
+      cipher.key = key
+      cipher.iv = iv
+      ct = cipher.update(pt)
+      ct << cipher.final
+
+      mac = OpenSSL::HMAC.digest(OpenSSL::Digest.new("SHA256"), macKey,
+        iv + ct)
+
+      CipherString.new(
+        CipherString::TYPE_AESCBC256_HMACSHA256_B64,
+        Base64.strict_encode64(iv),
+        Base64.strict_encode64(ct),
+        Base64.strict_encode64(mac),
+      )
+    end
+
+    # compare two hmacs, with double hmac verification
+    # https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/
+    def macsEqual(macKey, mac1, mac2)
+      hmac1 = OpenSSL::HMAC.digest(OpenSSL::Digest.new("SHA256"), macKey, mac1)
+      hmac2 = OpenSSL::HMAC.digest(OpenSSL::Digest.new("SHA256"), macKey, mac2)
+      return hmac1 == hmac2
+    end
+
+    # decrypt a CipherString and return plaintext
+    def decrypt(str, key, macKey)
+      c = CipherString.parse(str)
+
+      case c.type
+      when CipherString::TYPE_AESCBC256_HMACSHA256_B64
+        iv = Base64.decode64(c.iv)
+        ct = Base64.decode64(c.ct)
+        mac = Base64.decode64(c.mac)
+
+        cmac = OpenSSL::HMAC.digest(OpenSSL::Digest.new("SHA256"),
+          macKey, iv + ct)
+        if !self.macsEqual(macKey, mac, cmac)
+          raise "invalid mac"
+        end
+
+        cipher = OpenSSL::Cipher.new "AES-256-CBC"
+        cipher.decrypt
+        cipher.iv = iv
+        cipher.key = key
+        pt = cipher.update(ct)
+        pt << cipher.final
+        return pt
+
       else
-        @jwt_rsa = OpenSSL::PKey::RSA.generate 2048
+        raise "TODO implement #{c.type}"
+      end
+    end
+  end
 
-        f = File.new(JWT_KEY, File::CREAT|File::TRUNC|File::RDWR, 0600)
-        f.write @jwt_rsa.to_pem
-        f.write @jwt_rsa.public_key.to_pem
-        f.close
+  class CipherString
+    TYPE_AESCBC256_B64                     = 0
+    TYPE_AESCBC128_HMACSHA256_B64          = 1
+    TYPE_AESCBC256_HMACSHA256_B64          = 2
+    TYPE_RSA2048_OAEPSHA256_B64            = 3
+    TYPE_RSA2048_OAEPSHA1_B64              = 4
+    TYPE_RSA2048_OAEPSHA256_HMACSHA256_B64 = 5
+    TYPE_RSA2048_OAEPSHA1_HMACSHA256_B64   = 6
+
+    attr_reader :type, :iv, :ct, :mac
+
+    def self.parse(str)
+      if !(m = str.to_s.match(/\A(\d)\.([^|]+)\|(.+)\z/))
+        raise "invalid CipherString: #{str.inspect}"
       end
+
+      type = m[1].to_i
+      iv = m[2]
+      ct, mac = m[3].split("|", 2)
+      CipherString.new(type, iv, ct, mac)
     end
 
-    def jwt_sign(payload)
-      JWT.encode(payload, @jwt_rsa, "RS256")
+    def initialize(type, iv, ct, mac = nil)
+      @type = type
+      @iv = iv
+      @ct = ct
+      @mac = mac
+    end
+
+    def to_s
+      [ self.type.to_s + "." + self.iv, self.ct, self.mac ].
+        reject{|p| !p }.
+        join("|")
+    end
+  end
+
+  class Token
+    class << self
+      KEY = "#{APP_ROOT}/jwt-rsa.key"
+
+      attr_reader :rsa
+
+      # load or create RSA pair used for JWT signing
+      def load_keys
+        if File.exists?(KEY)
+          @rsa = OpenSSL::PKey::RSA.new File.read(KEY)
+        else
+          @rsa = OpenSSL::PKey::RSA.generate 2048
+
+          f = File.new(KEY, File::CREAT|File::TRUNC|File::RDWR, 0600)
+          f.write @rsa.to_pem
+          f.write @rsa.public_key.to_pem
+          f.close
+        end
+      end
+
+      def sign(payload)
+        JWT.encode(payload, @rsa, "RS256")
+      end
     end
   end
 end

lib/bitwarden_ruby.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+Encoding.default_internal = Encoding.default_external = Encoding::UTF_8
+
+APP_ROOT = File.realpath(File.dirname(__FILE__) + "/../")
+
+RACK_ENV ||= (ENV["RACK_ENV"] || "development")
+
+require "sinatra"
+require "sinatra/namespace"
+require "cgi"
+
+require "#{APP_ROOT}/lib/bitwarden.rb"
+require "#{APP_ROOT}/lib/helper.rb"
+
+require "#{APP_ROOT}/lib/db.rb"
+require "#{APP_ROOT}/lib/dbmodel.rb"
+require "#{APP_ROOT}/lib/user.rb"
+require "#{APP_ROOT}/lib/device.rb"
+require "#{APP_ROOT}/lib/cipher.rb"
+
+BASE_URL ||= "/api"
+IDENTITY_BASE_URL ||= "/identity"
+ICONS_URL ||= "/icons"
+
+# whether to allow new users
+if !defined?(ALLOW_SIGNUPS)
+  ALLOW_SIGNUPS = (ENV["ALLOW_SIGNUPS"] || false)
+end
+
+# create/load JWT signing keys
+Bitwarden::Token.load_keys
+
+# create/update tables
+Db.connect("#{APP_ROOT}/db/#{RACK_ENV}.sqlite3")

lib/cipher.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+class Cipher < DBModel
+  set_table_name "ciphers"
+  set_primary_key "uuid"
+
+  attr_writer :user
+
+  TYPE_LOGIN = 1
+  TYPE_NOTE  = 2
+  TYPE_CARD  = 3
+
+  def to_hash
+    {
+      "Id" => self.uuid,
+      "Type" => self.type,
+      "RevisionDate" => self.updated_at.strftime("%Y-%m-%dT%H:%M:%S.000000Z"),
+      "FolderId" => self.folder_uuid,
+      "Favorite" => self.favorite,
+      "OrganizationId" => nil,
+      "Attachments" => self.attachments,
+      "OrganizationUseTotp" => false,
+      "Data" => JSON.parse(self.data.to_s),
+      "Object" => "cipher",
+    }
+  end
+
+  def update_from_params(params)
+    self.folder_uuid = params[:folderId]
+    self.organization_uuid = params[:organizationId]
+    self.favorite = params[:favorite]
+    self.type = params[:type].to_i
+
+    cdata = {
+      "Name" => params[:name]
+    }
+
+    case self.type
+    when TYPE_LOGIN
+      params[:login].each do |k,v|
+        cdata[k.to_s.ucfirst] = v
+      end
+
+    when TYPE_CARD
+      params[:card].each do |k,v|
+        cdata[k.to_s.ucfirst] = v
+      end
+    end
+
+    cdata["Notes"] = params[:notes]
+
+    if params[:fields] && params[:fields].is_a?(Array)
+      cdata["Fields"] = params[:fields].map{|f|
+        fh = {}
+        f.each do |k,v|
+          fh[k.ucfirst] = v
+        end
+        fh
+      }
+    else
+      cdata["Fields"] = nil
+    end
+
+    self.data = cdata.to_json
+  end
+
+  def user
+    @user ||= User.find_by_uuid(self.user_uuid)
+  end
+end

lib/db.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 require "sqlite3"
 
 class Db
-  @@db = nil
+  class << self
+    attr_reader :db, :db_file
 
-  def self.db_file
-    "#{APP_ROOT}/db.sqlite3"
-  end
+    def connect(db_file)
+      @db_file = db_file
+
+      @db = SQLite3::Database.new(@db_file)
+
+      @db.execute("
+        CREATE TABLE IF NOT EXISTS
+        users
+        (uuid STRING PRIMARY KEY,
+        created_at DATETIME,
+        updated_at DATETIME,
+        email TEXT UNIQUE,
+        email_verified BOOLEAN,
+        premium BOOLEAN,
+        name TEXT,
+        password_hash TEXT,
+        password_hint TEXT,
+        key TEXT,
+        private_key BLOB,
+        public_key BLOB,
+        totp_secret STRING,
+        security_stamp STRING,
+        culture STRING)
+      ")
+
+      @db.execute("
+        CREATE TABLE IF NOT EXISTS
+        devices
+        (uuid STRING PRIMARY KEY,
+        created_at DATETIME,
+        updated_at DATETIME,
+        user_uuid STRING,
+        name STRING,
+        type INTEGER,
+        push_token STRING UNIQUE,
+        access_token STRING UNIQUE,
+        refresh_token STRING UNIQUE,
+        token_expires_at DATETIME)
+      ")
+
+      @db.execute("
+        CREATE TABLE IF NOT EXISTS
+        ciphers
+        (uuid STRING PRIMARY KEY,
+        created_at DATETIME,
+        updated_at DATETIME,
+        user_uuid STRING,
+        folder_uuid STRING,
+        organization_uuid STRING,
+        type INTEGER,
+        data BLOB,
+        favorite BOOLEAN,
+        attachments BLOB)
+      ")
+
+      @db.results_as_hash = true
+
+      @db.execute("
+        CREATE TABLE IF NOT EXISTS
+        schema_version
+        (version INTEGER)
+      ")
 
-  def self.connection
-    if @@db
-      return @@db
-    end
+      v = @db.execute("SELECT version FROM schema_version").first
+      if !v
+        v = { "version" => 0 }
+      end
 
-    @@db = SQLite3::Database.new(self.db_file)
+      case v["version"]
+      when 0
+        @db.execute("INSERT INTO schema_version (version) VALUES (1)")
+      end
 
-    @@db.execute("
-      CREATE TABLE IF NOT EXISTS
-      users
-      (id INTEGER PRIMARY KEY ASC,
-      email TEXT UNIQUE,
-      name TEXT,
-      password_hash TEXT,
-      key TEXT,
-      totp_secret STRING,
-      security_stamp STRING,
-      culture STRING)
-    ")
+      # eagerly cache column definitions
+      ObjectSpace.each_object(Class).each do |klass|
+        if klass < DBModel
+          klass.fetch_columns
+        end
+      end
 
-    @@db.execute("
-      CREATE TABLE IF NOT EXISTS
-      devices
-      (id INTEGER PRIMARY KEY ASC,
-      device_uuid STRING UNIQUE,
-      user_id INTEGER,
-      name STRING,
-      device_type INTEGER,
-      device_push_token STRING,
-      access_token STRING UNIQUE,
-      refresh_token STRING UNIQUE,
-      token_expiry INTEGER)
-    ")
+      @db
+    end
 
-    @@db.execute("
-      CREATE TABLE IF NOT EXISTS
-      ciphers
-      (id INTEGER PRIMARY KEY ASC,
-      cipher_uuid STRING UNIQUE,
-      updated_at INTEGER,
-      user_id INTEGER,
-      data STRING,
-      cipher_type INTEGER,
-      cipher_attachments STRING)
-    ")
+    def connection
+      @db
+    end
 
-    @@db.results_as_hash = true
+    def execute(query, params = [])
+      caster = proc{|a|
+        if a.is_a?(String) && a.encoding != Encoding::BINARY
+          a = a.encode(Encoding::UTF_8)
+        elsif a.is_a?(TrueClass) || a.is_a?(FalseClass)
+          a = (a ? 1 : 0)
+        end
+        a
+      }
 
-    @@db
+      self.connection.execute(*[
+        caster.call(query), params.map{|a| caster.call(a) }
+      ])
+    end
   end
 end

lib/dbmodel.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 class DBModel
   class << self
-    attr_accessor :table_name, :table_attrs
+    attr_reader :table_name, :columns, :primary_key
+
+    def method_missing(method, *args, &block)
+      if m = method.to_s.match(/^find_by_(.+)/)
+        return find_by_column(m[1], args[0])
+      elsif m = method.to_s.match(/^find_all_by_(.+)/)
+        return find_all_by_column(m[1], args[0])
+      else
+        super
+      end
+    end
+
+    # transform ruby data into sql
+    def cast_data_for_column(data, col)
+      if !@columns
+        raise "need to fetch columns but in a query"
+      end
 
-    def set_table_name(table)
-      @table_name = table
+      case @columns[col][:type]
+      when /boolean/i
+        return data == true ? 1 : 0
+      when /datetime/i
+        return (data == nil ? nil : data.to_i)
+      when /integer/i
+        return (data == nil ? nil : data.to_i)
+      else
+        return data
+      end
+    end
+
+    def fetch_columns
+      return if @columns
+
+      @columns = {}
+
+      Db.execute("SELECT sql FROM sqlite_master WHERE tbl_name = ?",
+      [ self.table_name ]).first["sql"].
+      gsub("\n", " ").
+      gsub(/^\s*CREATE\s+TABLE\s+#{self.table_name}\s*\(/i, "").
+      split(",").
+      each do |f|
+        if !(m = f.match(/^\s*([A-Za-z0-9_-]+)\s+([A-Za-z ]+)/))
+          raise "can't parse column definition #{f.inspect}"
+        end
+
+        @columns[m[1]] = {
+          :type => m[2].strip.upcase,
+        }
+      end
+
+      attr_accessor *(columns.keys)
+    end
+
+    def find_all_by_column(column, value, limit = nil)
+      fetch_columns
+
+      Db.execute("SELECT * FROM `#{table_name}` WHERE " <<
+      "`#{column}` = ? #{limit}", [ value.encode("utf-8") ]).map do |rec|
+        obj = self.new
+        obj.new_record = false
+
+        rec.each do |k,v|
+          next if !k.is_a?(String)
+          obj.send("#{k}=", uncast_data_from_column(v, k))
+        end
+
+        obj
+      end
+    end
+
+    def find_by_column(column, value)
+      find_all_by_column(column, value, "LIMIT 1").first
+    end
+
+    def primary_key
+      @primary_key || "id"
+    end
+
+    def primary_key_uuid?
+      !!primary_key.match(/uuid$/)
+    end
+
+    def set_primary_key(col)
+      @primary_key = col
     end
 
     def set_table_attrs(attrs)
       @table_attrs = attrs
       attr_accessor *attrs
     end
-  end
 
-  def self.method_missing(method, *args, &block)
-    if m = method.to_s.match(/^find_by_(.+)/)
-      return self.find_by_column(m[1], args[0])
-    elsif m = method.to_s.match(/^find_all_by_(.+)/)
-      return self.find_all_by_column(m[1], args[0])
-    else
-      super
+    def set_table_name(table)
+      @table_name = table
     end
-  end
 
-  def self.find_by_column(column, value)
-    self.find_all_by_column(column, value, "LIMIT 1").first
-  end
+    # transform database data into ruby
+    def uncast_data_from_column(data, col)
+      if !@columns
+        raise "need to fetch columns but in a query"
+      end
 
-  def self.find_all_by_column(column, value, limit = nil)
-    Db.connection.execute("SELECT * FROM `#{self.table_name}` WHERE " <<
-    "`#{column}` = ? #{limit}", [ value ]).map do |rec|
-      obj = self.new
+      case @columns[col][:type]
+      when /boolean/i
+        return (data >= 1)
+      when /datetime/i
+        return (data == nil ? nil : Time.at(data.to_i))
+      when /integer/i
+        return (data == nil ? nil : data.to_i)
+      else
+        return data
+      end
+    end
 
-      rec.each do |k,v|
-        next if !k.is_a?(String)
-        obj.send("#{k}=", v)
+    def writable_columns_for(what)
+      k = columns.keys
+
+      # normally we don't want to include `id` in the insert/update because
+      # the db handles that for us, but when we have uuid primary keys, we
+      # need to generate them ourselves, so include the column
+      unless what == :insert && primary_key_uuid?
+        k.reject!{|a| a == primary_key }
       end
 
-      obj
+      k
     end
   end
 
+  attr_accessor :new_record
+
   def self.transaction(&block)
+    ret = true
+
     Db.connection.transaction do
-      yield block
+      ret = yield block
     end
+
+    ret
+  end
+
+  def initialize
+    @new_record = true
+  end
+
+  def method_missing(method, *args, &block)
+    self.class.fetch_columns
+    super
+  end
+
+  def actual_before_create
+    if self.class.primary_key_uuid? && self.send(self.class.primary_key).blank?
+      self.send("#{self.class.primary_key}=", SecureRandom.uuid)
+    end
+
+    if self.class.columns["created_at"]
+      self.created_at = Time.now
+    end
+
+    before_create
+  end
+
+  def actual_before_save
+    if self.class.columns["updated_at"]
+      self.updated_at = Time.now
+    end
+
+    before_save
+  end
+
+  def before_create
+    true
   end
 
   def before_save
···
   end
 
   def destroy
-    if self.id
-      Db.connection.execute("DELETE FROM `#{self.class.table_name}` WHERE " <<
-        "id = ?", [ self.id ])
+    if !self.new_record && self.send(self.class.primary_key)
+      Db.execute("DELETE FROM `#{self.class.table_name}` WHERE " <<
+        "`#{self.class.primary_key}` = ?",
+        [ self.send(self.class.primary_key) ])
     end
   end
 
   def save
-    return false if !self.before_save
+    self.class.fetch_columns
+
+    return false if !self.actual_before_save
+
+    if self.new_record
+      return false if !self.actual_before_create
 
-    if self.id
-      Db.connection.execute("UPDATE `#{self.class.table_name}` SET " +
-        self.class.table_attrs.reject{|a| a == :id }.
-          map{|a| "#{a.to_s} = ?" }.join(", ") <<
-        " WHERE `id` = ?",
-        self.class.table_attrs.reject{|a| a == :id }.
-          map{|a| self.send(a) } + [ self.id ])
-    else
-      Db.connection.execute("INSERT INTO `#{self.class.table_name}` (" <<
-        self.class.table_attrs.reject{|a| a == :id }.
-          map{|a| a.to_s }.join(", ") <<
+      Db.execute("INSERT INTO `#{self.class.table_name}` (" <<
+        self.class.writable_columns_for(:insert).map{|a| a.to_s }.join(", ") <<
         ") VALUES (" <<
-        self.class.table_attrs.reject{|a| a == :id }.
-          map{|a| "?" }.join(", ") <<
+        self.class.writable_columns_for(:insert).map{|a| "?" }.join(", ") <<
         ")",
-        self.class.table_attrs.reject{|a| a == :id }.map{|a| self.send(a) })
+        self.class.writable_columns_for(:insert).map{|a|
+          self.class.cast_data_for_column(self.send(a), a)
+        })
+
+      self.new_record = false
+    else
+      Db.execute("UPDATE `#{self.class.table_name}` SET " +
+        self.class.writable_columns_for(:update).map{|a| "#{a.to_s} = ?" }.
+        join(", ") <<
+        " WHERE `#{self.class.primary_key}` = ?",
+        self.class.writable_columns_for(:update).map{|a|
+          self.class.cast_data_for_column(self.send(a), a)
+        } + [ self.send(self.class.primary_key) ])
     end
+
+    true
   end
 end

lib/device.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 class Device < DBModel
   set_table_name "devices"
-  set_table_attrs [ :id, :device_uuid, :user_id, :name, :device_type,
-    :device_push_token, :access_token, :refresh_token, :token_expiry ]
+  set_primary_key "uuid"
 
   attr_writer :user
 
-  def generate_tokens!
-    self.token_expiry = (Time.now + (60 * 60)).to_i
-    self.refresh_token = SecureRandom.urlsafe_base64(64)[0, 64]
+  DEFAULT_TOKEN_VALIDITY = (60 * 60)
+
+  def regenerate_tokens!(validity = DEFAULT_TOKEN_VALIDITY)
+    if self.refresh_token.blank?
+      self.refresh_token = SecureRandom.urlsafe_base64(64)[0, 64]
+    end
+
+    self.token_expires_at = Time.now + validity
 
     # the official clients parse this JWT and checks for the existence of some
     # of these fields
-    self.access_token = Bitwarden.jwt_sign({
-      :nbf => (Time.now - (60 * 5)).to_i,
-      :exp => self.token_expiry.to_i,
+    self.access_token = Bitwarden::Token.sign({
+      :nbf => (Time.now - (60 * 2)).to_i,
+      :exp => self.token_expires_at.to_i,
       :iss => IDENTITY_BASE_URL,
-      :sub => self.device_uuid,
-      :premium => true,
+      :sub => self.user.uuid,
+      :premium => self.user.premium,
       :name => self.user.name,
       :email => self.user.email,
+      :email_verified => self.user.email_verified,
       :sstamp => self.user.security_stamp,
-      :device => self.device_uuid,
+      :device => self.uuid,
       :scope => [ "api", "offline_access" ],
       :amr => [ "Application" ],
     })
   end
 
   def user
-    @user ||= User.find_by_id(self.user_id)
+    @user ||= User.find_by_uuid(self.user_uuid)
   end
 end

lib/helper.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 class NilClass
   def blank?
     true
···
 
     res == 0
   end
-end
 
-def need_params(*ps)
-  ps.each do |p|
-    if params[p].blank?
-      yield(p)
+  def ucfirst
+    if self.length == 0
+      ""
+    else
+      self[0].upcase << self[1 .. -1].to_s
     end
   end
 end
-
-def tee(d)
-  STDERR.puts d
-  d
-end
-
-def validation_error(msg)
-  [ 400, {
-    "ValidationErrors" => { "" => [
-      msg,
-    ]},
-    "Object" => "error",
-  }.to_json ]
-end

lib/user.rb

···
+#
+# Copyright (c) 2017 joshua stein <[e-mail]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
 class User < DBModel
   set_table_name "users"
-  set_table_attrs [ :id, :email, :name, :password_hash, :key, :totp_secret,
-    :security_stamp, :culture ]
+  set_primary_key "uuid"
+
+  def before_save
+    if self.security_stamp.blank?
+      self.security_stamp = SecureRandom.uuid
+    end
+  end
+
+  def ciphers
+    @ciphers ||= Cipher.find_all_by_user_uuid(self.uuid).
+      each{|d| d.user = self }
+  end
 
   def devices
-    @devices ||= Device.find_all_by_user_id(self.id).each{|d| d.user = self }
+    @devices ||= Device.find_all_by_user_uuid(self.uuid).
+      each{|d| d.user = self }
   end
 
   def has_password_hash?(hash)
     self.password_hash.timingsafe_equal_to(hash)
+  end
+
+  # TODO: password_hash=() should update security_stamp when it changes, I
+  # think
+
+  def to_hash
+    {
+      "Id" => self.uuid,
+      "Name" => self.name,
+      "Email" => self.email,
+      "EmailVerified" => self.email_verified,
+      "Premium" => self.premium,
+      "MasterPasswordHint" => self.password_hint,
+      "Culture" => self.culture,
+      "TwoFactorEnabled" => self.two_factor_enabled?,
+      "Key" => self.key,
+      "PrivateKey" => nil,
+      "SecurityStamp" => self.security_stamp,
+      "Organizations" => [],
+      "Object" => "profile"
+    }
+  end
+
+  def two_factor_enabled?
+    self.totp_secret.present?
   end
 
   def verifies_totp_code?(code)

spec/cipher_spec.rb

···
+require_relative "spec_helper.rb"
+
+@access_token = nil
+
+describe "cipher module" do
+  before do
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => Bitwarden.hashPassword("asdf", "[e-mail]"),
+      :masterPasswordHint => nil,
+      :key => Bitwarden.makeEncKey(
+        Bitwarden.makeKey("adsf", "[e-mail]")
+      ),
+    }
+
+    post "/identity/connect/token", {
+      :grant_type => "password",
+      :username => "[e-mail]",
+      :password => Bitwarden.hashPassword("asdf", "[e-mail]"),
+      :scope => "api offline_access",
+      :client_id => "browser",
+      :deviceType => 3,
+      :deviceIdentifier => SecureRandom.uuid,
+      :deviceName => "firefox",
+      :devicePushToken => ""
+    }
+
+    @access_token = last_json_response["access_token"]
+  end
+
+  it "should not allow access with bogus bearer token" do
+    post_json "/api/ciphers", {
+      :type => 1,
+      :folderId => nil,
+      :organizationId => nil,
+      :name => "2.d7MttWzJTSSKx1qXjHUxlQ==|01Ath5UqFZHk7csk5DVtkQ==|EMLoLREgCUP5Cu4HqIhcLqhiZHn+NsUDp8dAg1Xu0Io=",
+      :notes => nil,
+      :favorite => false,
+      :login => {
+        :uri => "2.T57BwAuV8ubIn/sZPbQC+A==|EhUSSpJWSzSYOdJ/AQzfXuUXxwzcs/6C4tOXqhWAqcM=|OWV2VIqLfoWPs9DiouXGUOtTEkVeklbtJQHkQFIXkC8=",
+        :username => "2.JbFkAEZPnuMm70cdP44wtA==|fsN6nbT+udGmOWv8K4otgw==|JbtwmNQa7/48KszT2hAdxpmJ6DRPZst0EDEZx5GzesI=",
+        :password => "2.e83hIsk6IRevSr/H1lvZhg==|48KNkSCoTacopXRmIZsbWg==|CIcWgNbaIN2ix2Fx1Gar6rWQeVeboehp4bioAwngr0o=",
+        :totp => nil
+      }
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token.upcase}",
+    }
+
+    last_response.status.wont_equal 200
+  end
+
+  it "should allow creating, updating, and deleting ciphers" do
+    post_json "/api/ciphers", {
+      :type => 1,
+      :folderId => nil,
+      :organizationId => nil,
+      :name => "2.d7MttWzJTSSKx1qXjHUxlQ==|01Ath5UqFZHk7csk5DVtkQ==|EMLoLREgCUP5Cu4HqIhcLqhiZHn+NsUDp8dAg1Xu0Io=",
+      :notes => nil,
+      :favorite => false,
+      :login => {
+        :uri => "2.T57BwAuV8ubIn/sZPbQC+A==|EhUSSpJWSzSYOdJ/AQzfXuUXxwzcs/6C4tOXqhWAqcM=|OWV2VIqLfoWPs9DiouXGUOtTEkVeklbtJQHkQFIXkC8=",
+        :username => "2.JbFkAEZPnuMm70cdP44wtA==|fsN6nbT+udGmOWv8K4otgw==|JbtwmNQa7/48KszT2hAdxpmJ6DRPZst0EDEZx5GzesI=",
+        :password => "2.e83hIsk6IRevSr/H1lvZhg==|48KNkSCoTacopXRmIZsbWg==|CIcWgNbaIN2ix2Fx1Gar6rWQeVeboehp4bioAwngr0o=",
+        :totp => nil
+      }
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+
+    last_response.status.must_equal 200
+    uuid = last_json_response["Id"]
+    uuid.to_s.wont_equal ""
+
+    c = Cipher.find_by_uuid(uuid)
+    c.wont_be_nil
+    c.uuid.must_equal uuid
+    JSON.parse(c.data)["Name"].must_equal "2.d7MttWzJTSSKx1qXjHUxlQ==|01Ath5UqFZHk7csk5DVtkQ==|EMLoLREgCUP5Cu4HqIhcLqhiZHn+NsUDp8dAg1Xu0Io="
+
+    # update
+
+    ik = Bitwarden.makeKey("asdf", "[e-mail]")
+    k = Bitwarden.makeEncKey(ik)
+    new_name = Bitwarden.encrypt("some new name", ik[0, 32], ik[32, 32]).to_s
+
+    put_json "/api/ciphers/#{uuid}", {
+      :type => 1,
+      :folderId => nil,
+      :organizationId => nil,
+      :name => new_name,
+      :notes => nil,
+      :favorite => false,
+      :login => {
+        :uri => "2.T57BwAuV8ubIn/sZPbQC+A==|EhUSSpJWSzSYOdJ/AQzfXuUXxwzcs/6C4tOXqhWAqcM=|OWV2VIqLfoWPs9DiouXGUOtTEkVeklbtJQHkQFIXkC8=",
+        :username => "2.JbFkAEZPnuMm70cdP44wtA==|fsN6nbT+udGmOWv8K4otgw==|JbtwmNQa7/48KszT2hAdxpmJ6DRPZst0EDEZx5GzesI=",
+        :password => "2.e83hIsk6IRevSr/H1lvZhg==|48KNkSCoTacopXRmIZsbWg==|CIcWgNbaIN2ix2Fx1Gar6rWQeVeboehp4bioAwngr0o=",
+        :totp => nil
+      }
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+
+    last_response.status.must_equal 200
+    last_json_response["Id"].to_s.wont_equal ""
+
+    c = Cipher.find_by_uuid(last_json_response["Id"])
+    JSON.parse(c.data)["Name"].must_equal new_name
+
+    uuid = c.uuid
+
+    # delete
+
+    delete_json "/api/ciphers/#{uuid}", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+    last_response.status.must_equal 200
+
+    Cipher.find_by_uuid(uuid).must_be_nil
+  end
+
+  it "should not allow creating, updating, or deleting bogus ciphers" do
+    post_json "/api/ciphers", {
+      :type => -5,
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+
+    last_response.status.wont_equal 200
+
+    # create, then bogus update
+
+    post_json "/api/ciphers", {
+      :type => 1,
+      :folderId => nil,
+      :organizationId => nil,
+      :name => "2.d7MttWzJTSSKx1qXjHUxlQ==|01Ath5UqFZHk7csk5DVtkQ==|EMLoLREgCUP5Cu4HqIhcLqhiZHn+NsUDp8dAg1Xu0Io=",
+      :notes => nil,
+      :favorite => false,
+      :login => {
+        :uri => "2.T57BwAuV8ubIn/sZPbQC+A==|EhUSSpJWSzSYOdJ/AQzfXuUXxwzcs/6C4tOXqhWAqcM=|OWV2VIqLfoWPs9DiouXGUOtTEkVeklbtJQHkQFIXkC8=",
+        :username => "2.JbFkAEZPnuMm70cdP44wtA==|fsN6nbT+udGmOWv8K4otgw==|JbtwmNQa7/48KszT2hAdxpmJ6DRPZst0EDEZx5GzesI=",
+        :password => "2.e83hIsk6IRevSr/H1lvZhg==|48KNkSCoTacopXRmIZsbWg==|CIcWgNbaIN2ix2Fx1Gar6rWQeVeboehp4bioAwngr0o=",
+        :totp => nil
+      }
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+
+    last_response.status.must_equal 200
+    uuid = last_json_response["Id"]
+
+    put_json "/api/ciphers/#{uuid}", {
+      :type => -5,
+    }, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+
+    last_response.status.wont_equal 200
+
+    # bogus delete
+
+    delete_json "/api/ciphers/something-bogus", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{@access_token}",
+    }
+    last_response.status.wont_equal 200
+  end
+end

spec/cipherstring_spec.rb

···
+require_relative "spec_helper.rb"
+
+describe "bitwarden encryption stuff" do
+  it "should make a key from a password and salt" do
+    b64 = "2K4YP5Om9r5NpA7FCS4vQX5t+IC4hKYdTJN/C20cz9c="
+
+    k = Bitwarden.makeKey("this is a password", "[e-mail]")
+    Base64.strict_encode64(k).encode("utf-8").must_equal b64
+
+    # make sure key and salt affect it
+    k = Bitwarden.makeKey("this is a password", "[e-mail]")
+    Base64.strict_encode64(k).encode("utf-8").wont_equal b64
+
+    k = Bitwarden.makeKey("this is A password", "[e-mail]")
+    Base64.strict_encode64(k).encode("utf-8").wont_equal b64
+  end
+
+  it "should make a cipher string from a key" do
+    cs = Bitwarden.makeEncKey(
+      Bitwarden.makeKey("this is a password", "[e-mail]")
+    )
+
+    cs.must_match /^0\.[^|]+|[^|]+$/
+  end
+
+  it "should hash a password" do
+    #def hashedPassword(password, salt)
+    Bitwarden.hashPassword("secret password", "[e-mail]").
+      must_equal "VRlYxg0x41v40mvDNHljqpHcqlIFwQSzegeq+POW1ww="
+  end
+
+  it "should parse a cipher string" do
+    cs = Bitwarden::CipherString.parse(
+      "0.u7ZhBVHP33j7cud6ImWFcw==|WGcrq5rTEMeyYkWywLmxxxSgHTLBOWThuWRD/6gVKj77+Vd09DiZ83oshVS9+gxyJbQmzXWilZnZRD/52tah1X0MWDRTdI5bTnTf8KfvRCQ="
+    )
+
+    cs.type.must_equal Bitwarden::CipherString::TYPE_AESCBC256_B64
+    cs.iv.must_equal "u7ZhBVHP33j7cud6ImWFcw=="
+    cs.ct.must_equal "WGcrq5rTEMeyYkWywLmxxxSgHTLBOWThuWRD/6gVKj77+Vd09DiZ83oshVS9+gxyJbQmzXWilZnZRD/52tah1X0MWDRTdI5bTnTf8KfvRCQ="
+    cs.mac.must_be_nil
+  end
+
+  it "should parse a type-3 cipher string" do
+    cs = Bitwarden::CipherString.parse("2.ftF0nH3fGtuqVckLZuHGjg==|u0VRhH24uUlVlTZd/uD1lA==|XhBhBGe7or/bXzJRFWLUkFYqauUgxksCrRzNmJyigfw=")
+    cs.type.must_equal 2
+  end
+
+  it "should encrypt and decrypt properly" do
+    ik = Bitwarden.makeKey("password", "[e-mail]")
+    k = Bitwarden.makeEncKey(ik)
+    j = Bitwarden.encrypt("hi there", ik[0, 32], ik[32, 32])
+
+    cs = Bitwarden::CipherString.parse(j)
+
+    ik = Bitwarden.makeKey("password", "[e-mail]")
+    Bitwarden.decrypt(cs.to_s, ik[0, 32], ik[32, 32]).must_equal "hi there"
+  end
+
+  it "should test mac equality" do
+    Bitwarden.macsEqual("asdfasdfasdf", "hi", "hi").must_equal true
+  end
+end

spec/identity_spec.rb

···
+require_relative "spec_helper.rb"
+
+describe "identity module" do
+  it "should return successful response to account creation" do
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => Bitwarden.hashPassword("asdf",
+        "[e-mail]"),
+      :masterPasswordHint => nil,
+      :key => Bitwarden.makeEncKey(
+        Bitwarden.makeKey("adsf", "[e-mail]")
+      ),
+    }
+    last_response.status.must_equal 200
+  end
+
+  it "should not allow duplicate signups" do
+    2.times do |x|
+      post "/api/accounts/register", {
+        :name => nil,
+        :email => "[e-mail]",
+        :masterPasswordHash => Bitwarden.hashPassword("asdf",
+          "[e-mail]"),
+        :masterPasswordHint => nil,
+        :key => Bitwarden.makeEncKey(
+          Bitwarden.makeKey("adsf", "[e-mail]")
+        ),
+      }
+      if x == 0
+        last_response.status.must_equal 200
+      else
+        last_response.status.wont_equal 200
+      end
+    end
+  end
+
+  it "validates required parameters" do
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => "",
+      :masterPasswordHint => nil,
+      :key => Bitwarden.makeEncKey(
+        Bitwarden.makeKey("adsf", "[e-mail]")
+      ),
+    }
+    last_response.status.wont_equal 200
+
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => Bitwarden.hashPassword("asdf",
+        "[e-mail]"),
+      :masterPasswordHint => nil,
+      :key => "junk",
+    }
+    last_response.status.wont_equal 200
+  end
+
+  it "actually creates the user account and allows logging in" do
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => Bitwarden.hashPassword("asdf",
+        "[e-mail]"),
+      :masterPasswordHint => nil,
+      :key => Bitwarden.makeEncKey(
+        Bitwarden.makeKey("adsf", "[e-mail]")
+      ),
+    }
+    last_response.status.must_equal 200
+
+    (u = User.find_by_email("[e-mail]")).wont_be_nil
+    u.uuid.wont_be_nil
+    u.password_hash.must_equal "PGC1vNJZUL3z5wTKAgpXsODf6KzIPcr0XCzTplceXQU="
+
+    post "/identity/connect/token", {
+      :grant_type => "password",
+      :username => "[e-mail]",
+      :password => Bitwarden.hashPassword("asdf", "[e-mail]"),
+      :scope => "api offline_access",
+      :client_id => "browser",
+      :deviceType => 3,
+      :deviceIdentifier => SecureRandom.uuid,
+      :deviceName => "firefox",
+      :devicePushToken => ""
+    }
+
+    last_response.status.must_equal 200
+    (access_token = last_json_response["access_token"]).wont_be_nil
+
+    get "/api/sync", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{access_token}",
+    }
+    last_response.status.must_equal 200
+  end
+
+  it "enforces token validity period" do
+    post "/api/accounts/register", {
+      :name => nil,
+      :email => "[e-mail]",
+      :masterPasswordHash => Bitwarden.hashPassword("asdf",
+        "[e-mail]"),
+      :masterPasswordHint => nil,
+      :key => Bitwarden.makeEncKey(
+        Bitwarden.makeKey("adsf", "[e-mail]")
+      ),
+    }
+    last_response.status.must_equal 200
+
+    post "/identity/connect/token", {
+      :grant_type => "password",
+      :username => "[e-mail]",
+      :password => Bitwarden.hashPassword("asdf", "[e-mail]"),
+      :scope => "api offline_access",
+      :client_id => "browser",
+      :deviceType => 3,
+      :deviceIdentifier => SecureRandom.uuid,
+      :deviceName => "firefox",
+      :devicePushToken => ""
+    }
+
+    access_token = last_json_response["access_token"]
+
+    get "/api/sync", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{access_token}",
+    }
+    last_response.status.must_equal 200
+
+    d = Device.find_by_access_token(access_token)
+    d.regenerate_tokens!(1)
+    d.save
+
+    get "/api/sync", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{d.access_token}",
+    }
+    last_response.status.must_equal 200
+
+    sleep 2
+
+    get "/api/sync", {}, {
+      "HTTP_AUTHORIZATION" => "Bearer #{d.access_token}",
+    }
+    last_response.status.wont_equal 200
+  end
+end

spec/spec_helper.rb

···
+ENV["RACK_ENV"] = "test"
+
+require "minitest/autorun"
+require "rack/test"
+
+# clear out test db
+if File.exists?(f = File.dirname(__FILE__) + "/../db/test.sqlite3")
+  File.unlink(f)
+end
+
+# most tests require this to be on
+ALLOW_SIGNUPS = true
+
+require File.realpath(File.dirname(__FILE__) + "/../lib/bitwarden_ruby.rb")
+require "#{APP_ROOT}/lib/api.rb"
+
+include Rack::Test::Methods
+
+def last_json_response
+  JSON.parse(last_response.body)
+end
+
+def get_json(path, params = {}, headers = {})
+  json_request :get, path, params, headers
+end
+
+def post_json(path, params = {}, headers = {})
+  json_request :post, path, params, headers
+end
+
+def put_json(path, params = {}, headers = {})
+  json_request :put, path, params, headers
+end
+
+def delete_json(path, params = {}, headers = {})
+  json_request :delete, path, params, headers
+end
+
+def json_request(verb, path, params = {}, headers = {})
+  send verb, path, params.to_json,
+    headers.merge({ "CONTENT_TYPE" => "application/json" })
+end
+
+def app
+  Sinatra::Application
+end