mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
a641d9b6ba
Argon2id turns the vault password into a key that seals a random master key; only the sealed copy is kept. Each file gets its own key, sealed under the master key in its header with its media id, and its bytes are AES-256-GCM STREAM records, so a swapped, cut or altered file refuses to open. Uploads with ?encrypt=true are sealed as they stream in. :vault, :unlock, :lock, :passwd, :encrypt, :decrypt and :upload! drive it. The vault locks after WORKSPACE_VAULT_IDLE_MIN idle minutes, on logout and on restart; while locked, sealed files answer 423, share links never serve them, and :export! refuses rather than leave them out. Sealing an existing file rewrites it under a new id and retires the old one: the mirror deletes the plaintext from Proton Drive outright, trash included, whatever WORKSPACE_BACKUP_PRUNE says, and drops it from the readable files/ view. The mirror now compares on-disk sizes, so sealed files are not re-hashed every run.
26 lines
1.1 KiB
SQL
26 lines
1.1 KiB
SQL
-- The vault: a password that is never stored, unlocking a master key that
|
|
-- seals files at rest. One row at most. The master key is kept here only
|
|
-- sealed under a key Argon2id derives from the password, with the costs it was
|
|
-- derived at, so raising them later does not lock an existing vault out.
|
|
CREATE TABLE vault (
|
|
id INTEGER PRIMARY KEY CHECK (id = 1),
|
|
salt BLOB NOT NULL,
|
|
m_cost INTEGER NOT NULL,
|
|
t_cost INTEGER NOT NULL,
|
|
p_cost INTEGER NOT NULL,
|
|
nonce BLOB NOT NULL,
|
|
sealed BLOB NOT NULL,
|
|
created_at INTEGER NOT NULL
|
|
);
|
|
|
|
-- A sealed file's bytes on disk are ciphertext; `size` stays the size of what
|
|
-- was uploaded, which is what a download of it is.
|
|
ALTER TABLE media ADD COLUMN encrypted INTEGER NOT NULL DEFAULT 0;
|
|
|
|
-- Remote copies the mirror has to take off Drive whatever
|
|
-- WORKSPACE_BACKUP_PRUNE says: the plaintext of a file that has since been
|
|
-- sealed. Keeping it would undo the sealing for anyone who reads the mirror.
|
|
CREATE TABLE backup_retired (
|
|
path TEXT PRIMARY KEY
|
|
) WITHOUT ROWID;
|