mini_vault

#! /bin/bash
#    mini_bomba vault: encrypted file storage utility
#
#    Copyright (C) 2021-2022 mini_bomba
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <https://www.gnu.org/licenses/>.

# Set the default variables if not specified
if [ -z "$MBV_RAMDISK_SIZE" ]
then
    MBV_RAMDISK_SIZE=1G
fi
if [ -z "$MBV_FILE_LOCATION" ]
then
    MBV_FILE_LOCATION=$HOME/.mini_bomba_vault
fi
if [ -z "$MBV_RAMDISK_LOCATION" ]
then
    MBV_RAMDISK_LOCATION=/tmp/mini_bomba_vault-$USER
fi
# Get the program used for privilege elevation
FAIL=0
if [[ $EUID == 0 ]]
then
    # running as root, does not need to elevate privileges
    echo "Note: You're running this as root, and therefore you're accessing root's vaults." >&2
    echo "If you want to access your own vaults, do not run this as root." >&2
    root_auth=
elif ! [ -z "$MBV_USE_SUDO" ] || ! which pkexec > /dev/null 2>&1
then
    # Use sudo (CLI auth)
    if ! which sudo > /dev/null 2>&1
    then
        echo "Missing required dependency: sudo (or pkexec, if MBV_USE_SUDO is not set)" >&2
        FAIL=1
    fi
    root_auth=$(which sudo)
else
    # Use pkexec (GUI auth)
    root_auth=$(which pkexec)
fi
# Check for dependencies
if ! which gpg > /dev/null 2>&1
then
    echo "Missing required dependency: gpg" >&2
    FAIL=1
fi
if ! which tar > /dev/null 2>&1
then
    echo "Missing required dependency: tar" >&2
    FAIL=1
fi
if ! which gzip > /dev/null 2>&1
then
    echo "Missing recommended dependency: gzip" >&2
fi
if ! which zstd > /dev/null 2>&1
then
    echo "Missing required dependency: zstd" >&2
    FAIL=1
fi
if ! which pv > /dev/null 2>&1
then
    echo "Missing required dependency: pv" >&2
    FAIL=1
fi
if ! which du > /dev/null 2>&1
then
    echo "Missing required dependency: du" >&2
    FAIL=1
fi
if ! which awk > /dev/null 2>&1
then
    echo "Missing required dependency: awk" >&2
    FAIL=1
fi
if [ -z "$MBV_SKIP_OPEN" ] && ! which xdg-open > /dev/null 2>&1
then
    echo "Missing optional dependency: xdg-open" >&2
    echo "Ramdisk location will not be shown in the file manager." >&2
    MBV_SKIP_OPEN=1
fi

if [ $FAIL -ne 0 ]
then
    exit 1
fi
# Create the encrypted file directory if it is not there
if ! [ -d $MBV_FILE_LOCATION ]
then
    mkdir $MBV_FILE_LOCATION
fi
chmod 700 $MBV_FILE_LOCATION
if ! [ -z "$(ls $MBV_FILE_LOCATION)" ]
then
    chmod 600 $MBV_FILE_LOCATION/*.mbv{,2} 2> /dev/null
fi
# ... and the ramdisk directory
if ! [ -d $MBV_RAMDISK_LOCATION ]
then
    mkdir $MBV_RAMDISK_LOCATION
    chmod 700 $MBV_RAMDISK_LOCATION
fi
shopt -s dotglob

# Save current directory, for later
initial_wd=$PWD

if [[ $1 == "help" ]]
then
    echo "mini_bomba vault: encrypted file storage utility"
    echo "This program comes with ABSOLUTELY NO WARRANTY; for details use the 'license' subcommand."
    echo "Available subcommands:"
    echo "  help - show this help message"
    echo "  list - list your vaults"
    echo "  create <name> [gpg key ID] - creates a new vault"
    echo "  open <name> - decrypts & mounts the vault"
    echo "  import <directory> <name> [gpg key ID] - imports the contents of the directory into a vault file"
    echo "  export <name> <directory> - exports the contents of the vault file into a directory"
    echo "  convert <name> - converts an mbv vault to mbv2 (gzip -> ZStandard compression)"
    echo "  license - shows more info about the warranty & license"
    exit 0
elif [[ $1 == "warranty" ]] || [[ $1 == "license" ]]
then
echo "   mini_bomba vault"
echo "   Copyright (C) 2021 mini_bomba"
echo
echo "   This program is free software: you can redistribute it and/or modify"
echo "   it under the terms of the GNU General Public License as published by"
echo "   the Free Software Foundation, either version 3 of the License, or"
echo "   (at your option) any later version."
echo
echo "   This program is distributed in the hope that it will be useful,"
echo "   but WITHOUT ANY WARRANTY; without even the implied warranty of"
echo "   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the"
echo "   GNU General Public License for more details."
echo
echo "   You should have received a copy of the GNU General Public License"
echo "   along with this program.  If not, see <https://www.gnu.org/licenses/>."
elif [[ $1 == "list" ]]
then
    echo "Your vault files:"
    ls -lAh $MBV_FILE_LOCATION
    echo
    echo "Your unlocked vaults:"
    ls -lAh $MBV_RAMDISK_LOCATION
    exit 0
elif [[ $1 == "create" ]]
then
    if [ -z "$2" ]
    then 
        echo "Missing required param: name" >&2
        exit 1 
    fi
    if [[ $2 =~ ^~ ]]
    then
        echo "The vault name may not start with '~'!" >&2
        echo "Vault files starting with '~' are reserved for partially saved vaults." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/$2.mbv" ] || [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        echo "Vault '$2' already exists!" >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv" ] || [ -e "$MBV_FILE_LOCATION/~$2.mbv2" ]
    then
        echo "Vault '$2' has a partially saved vault file!" >&2
        exit 1
    fi
    echo -n "Creating... "
    if [ -z "$3" ]
    then
        tar --zstd  -cT/dev/null | gpg --encrypt --default-recipient-self -o $MBV_FILE_LOCATION/$2.mbv2 && chmod 600 $MBV_FILE_LOCATION/$2.mbv2 && echo "Created!" || echo "Failed!"
    else
        tar --zstd -cT /dev/null | gpg --encrypt -o $MBV_FILE_LOCATION/$2.mbv2 -u $3 -r $3 && chmod 600 $MBV_FILE_LOCATION/$2.mbv2 && echo "Created!" || echo "Failed!"
    fi
    exit $?
elif [[ $1 == "import" ]]
then
    if [ -z "$2" ]
    then 
        echo "Missing required params: input directory, vault name" >&2
        exit 1 
    fi
    if [ -z "$3" ]
    then 
        echo "Missing required param: vault name" >&2
        exit 1 
    fi
    if ! [ -d "$2" ]
    then
        echo "'$2' is not a directory!" >&2
        exit 1
    fi
    if [[ -z "$(ls -A $2)" ]]
    then
        echo "Input directory '$2' is empty!" >&2
        echo "Use 'mini_vault create' to create an empty vault instead." >&2
        exit 1
    fi
    if [[ $3 =~ ^~ ]]
    then
        echo "The vault name may not start with '~'!" >&2
        echo "Vault files starting with '~' are reserved for partially saved vaults." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$3.mbv" ]
    then
        echo "Vault '$3' has a partially saved vault file '~$3.mbv'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$3.mbv2" ]
    then
        echo "Vault '$3' has a partially saved vault file '~$3.mbv2'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/$3.mbv" ] || [ -e "$MBV_FILE_LOCATION/$3.mbv2" ]
    then
        echo "Vault '$3' already exists!" >&2
        echo "Importing into this vault will cause its previous content to be overwritten!" >&2
        echo -n "Enter 'YES' to continue: " >&2
        read confirm
        if [[ "$confirm" == "YES" ]]
        then
            echo "Overwriting previous vault..." >&2
        else
            echo "Aborted." >&2
            exit 1
        fi
    fi
    echo "Importing..."
    file_size=$(du -sb $2 | awk '{print $1}')
    if [ -z "$4" ]
    then
        cd $2 && ls -A | tar --verbatim-files-from --zstd -cT - | pv -s $file_size | gpg --encrypt -o $MBV_FILE_LOCATION/~$3.mbv2 --default-recipient-self --yes && chmod 600 $MBV_FILE_LOCATION/~$3.mbv2
    else
        cd $2 && ls -A | tar --verbatim-files-from --zstd -cT - | pv -s $file_size | gpg --encrypt -o $MBV_FILE_LOCATION/~$3.mbv2 -u $4 -r $4 --yes && chmod 600 $MBV_FILE_LOCATION/~$3.mbv2
    fi
    if [[ $? -eq 0 ]]
    then
        echo "Moving vault into place..."
        mv $MBV_FILE_LOCATION/~$3.mbv2 $MBV_FILE_LOCATION/$3.mbv2 && (echo "Done!" && exit 0) || (echo "Failed!" && exit 1)
        if [ -e "$MBV_FILE_LOCATION/$3.mbv" ]
        then
            echo "Removing old vault..."
            rm "$MBV_FILE_LOCATION/$3.mbv"
        fi
    else
        echo "Failed!"
        exit 1
    fi
elif [[ $1 == "export" ]] || [[ $1 == "extract" ]]
then
    if [ -z "$2" ]
    then 
        echo "Missing required params: vault name, output directory" >&2
        exit 1 
    fi
    if [ -z "$3" ]
    then 
        echo "Missing required param: output directory" >&2
        exit 1 
    fi
    if [[ $2 =~ ^~ ]]
    then
        echo "The vault name may not start with '~'!" >&2
        echo "Vault files starting with '~' are reserved for partially saved vaults." >&2
        echo "If you're looking to open the partially saved vault file, please manually rename it in $MBV_FILE_LOCATION" >&2
        exit 1
    fi
    if ! [ -e "$MBV_FILE_LOCATION/$2.mbv" ] && ! [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        echo "Vault '$2' does not exist! Use mini_vault create to create a new one!" >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv2" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv2'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/$2.mbv" ] && [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        echo "Vault '$2' has two versions: '$2.mbv' and '$2.mbv2'!" >&2
        echo "Please manually rename or delete one of the versions in $MBV_FILE_LOCATION" >&2
        exit 1
    fi
    if ! [ -d "$3" ]
    then
        echo "'$3' is not a directory!" >&2
        exit 1
    fi
    if [ -n "$(ls -A $3)" ]
    then
        echo "'$3' is not empty!" >&2
        exit 1
    fi
    echo "Exporting..."
    cd $3
    if [ -e "$MBV_FILE_LOCATION/$2.mbv" ]
    then
        file_size=$(du -sb $MBV_FILE_LOCATION/$2.mbv | awk '{print $1}')
        gpg --decrypt -q $MBV_FILE_LOCATION/$2.mbv | pv -s $file_size | tar -xz
    elif [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        file_size=$(du -sb $MBV_FILE_LOCATION/$2.mbv2 | awk '{print $1}')
        gpg --decrypt -q $MBV_FILE_LOCATION/$2.mbv2 | pv -s $file_size | tar -x --zstd
    fi
    if [ -z "$MBV_SKIP_OPEN" ]
    then
        xdg-open . &
    fi
    cd $initial_wd
    echo "Done!"
elif [[ $1 == "open" ]] || [[ $1 == "mount" ]]
then
    if [ -z "$2" ]
    then 
        echo "Missing required param: name" >&2
        exit 1 
    fi
    if [[ $2 =~ ^~ ]]
    then
        echo "The vault name may not start with '~'!" >&2
        echo "Vault files starting with '~' are reserved for partially saved vaults." >&2
        echo "If you're looking to open the partially saved vault file, please manually rename it in $MBV_FILE_LOCATION" >&2
        exit 1
    fi
    if ! [ -e $MBV_FILE_LOCATION/$2.mbv ] && ! [ -e $MBV_FILE_LOCATION/$2.mbv2 ]
    then
        echo "Vault '$2' does not exist! Use mini_vault create to create a new one!" >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv2" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv2'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/$2.mbv" ] && [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        echo "Vault '$2' has two versions: '$2.mbv' and '$2.mbv2'!" >&2
        echo "Please manually rename or delete one of the versions in $MBV_FILE_LOCATION" >&2
        exit 1
    fi
    echo "Checking used gpg key..."
    if [ -e "$MBV_FILE_LOCATION/$2.mbv" ]
    then
        VAULT_VERSION=1
        key_id=$(gpg --list-packets $MBV_FILE_LOCATION/$2.mbv | grep -oP "[A-F0-9]{16}" | head -n 1)
    elif [ -e "$MBV_FILE_LOCATION/$2.mbv2" ]
    then
        VAULT_VERSION=2
        key_id=$(gpg --list-packets $MBV_FILE_LOCATION/$2.mbv2 | grep -oP "[A-F0-9]{16}" | head -n 1)
    fi
    if [ -z "$key_id" ]
    then
        echo "Unable to get key used, aborting" >&2
        exit 1
    fi
    echo -n "Creating ramdisk... "
    if [ -e $MBV_RAMDISK_LOCATION/$2 ]
    then
        echo "Error: Ramdisk location ($MBV_RAMDISK_LOCATION/$2) already exists!" >&2
        exit 1
    fi
    mkdir $MBV_RAMDISK_LOCATION/$2
    $root_auth bash -c "mount -t tmpfs -o size=$MBV_RAMDISK_SIZE mbv-$USER-$2 $MBV_RAMDISK_LOCATION/$2 && chown $USER:$USER $MBV_RAMDISK_LOCATION/$2 && chmod 700 $MBV_RAMDISK_LOCATION/$2"
    if [[ $? -eq 0 ]]
    then
        echo "Done!"
    else
        echo "Failed, aborting!" >&2
        rmdir $MBV_RAMDISK_LOCATION/$2
        exit 1
    fi
    trap "echo 'Received SIGINT/TERM, aborting'; cd $initial_wd; $root_auth umount $MBV_RAMDISK_LOCATION/$2; rmdir $MBV_RAMDISK_LOCATION/$2; exit 1" SIGINT SIGTERM
    echo "Decrypting & extracting files... "
    cd $MBV_RAMDISK_LOCATION/$2
    if [ $VAULT_VERSION -eq 1 ]
    then
        file_size=$(du -sb $MBV_FILE_LOCATION/$2.mbv | awk '{print $1}')
        gpg --decrypt -q $MBV_FILE_LOCATION/$2.mbv | pv -s $file_size | tar -xz
    elif [ $VAULT_VERSION -eq 2 ]
    then
        file_size=$(du -sb $MBV_FILE_LOCATION/$2.mbv2 | awk '{print $1}')
        gpg --decrypt -q $MBV_FILE_LOCATION/$2.mbv2 | pv -s $file_size | tar -x --zstd
    fi
    cd $initial_wd
    echo "Done!"
    echo "Files ready in $MBV_RAMDISK_LOCATION/$2"
    if [ -z "$MBV_SKIP_OPEN" ]
    then
        xdg-open $MBV_RAMDISK_LOCATION/$2 &
    fi
    d=0
    while true
    do
        trap "echo -e '\nReceived SIGINT/TERM, unmounting without saving'; $root_auth umount $MBV_RAMDISK_LOCATION/$2; rmdir $MBV_RAMDISK_LOCATION/$2; exit 1" SIGINT SIGTERM
        echo -n "Press return to save & unmount vault."
        read
        trap "echo 'CTRL+C is currently disabled to prevent data loss.' >&2" SIGINT SIGTERM
        echo "Saving... "
        if [ -z "$(ls -A $MBV_RAMDISK_LOCATION/$2)" ]
        then
            echo -n "Directory empty, creating empty vault... " >&2
            if [ $VAULT_VERSION -eq 1 ]
            then
                tar -czT /dev/null | gpg --encrypt -o $MBV_FILE_LOCATION/~$2.mbv -u $key_id -r $key_id --yes
            elif [ $VAULT_VERSION -eq 2 ]
            then
                tar --zstd -cT /dev/null | gpg --encrypt -o $MBV_FILE_LOCATION/~$2.mbv2 -u $key_id -r $key_id --yes
            fi
        else
            file_size=$(du -sb $MBV_RAMDISK_LOCATION/$2 | awk '{print $1}')
            if [ $VAULT_VERSION -eq 1 ]
            then
                cd $MBV_RAMDISK_LOCATION/$2 && ls -A | tar --verbatim-files-from -czT - | pv -s $file_size | gpg --encrypt -o $MBV_FILE_LOCATION/~$2.mbv -u $key_id -r $key_id --yes && chmod 600 $MBV_FILE_LOCATION/~$2.mbv
            elif [ $VAULT_VERSION -eq 2 ]
            then
                cd $MBV_RAMDISK_LOCATION/$2 && ls -A | tar --verbatim-files-from --zstd -cT - | pv -s $file_size | gpg --encrypt -o $MBV_FILE_LOCATION/~$2.mbv2 -u $key_id -r $key_id --yes && chmod 600 $MBV_FILE_LOCATION/~$2.mbv2
            fi
        fi
        if [[ $? -ne 0 ]]
        then
            echo "Failed!" >&2
            cd $initial_wd
            continue
        fi
        cd $initial_wd
        echo "Saved!"
        echo "Replacing current vault file with the new one..."
        if [ $VAULT_VERSION -eq 1 ]
        then
            mv $MBV_FILE_LOCATION/~$2.mbv $MBV_FILE_LOCATION/$2.mbv
        elif [ $VAULT_VERSION -eq 2 ]
        then
            mv $MBV_FILE_LOCATION/~$2.mbv2 $MBV_FILE_LOCATION/$2.mbv2
        fi
        echo -n "Unmounting ramdisk... "
        $root_auth umount $MBV_RAMDISK_LOCATION/$2
        if [[ $? -ne 0 ]]
        then
            echo "Failed!" >&2
            continue
        fi
        echo "Unmounted!"
        echo "Cleaning up..."
        rmdir $MBV_RAMDISK_LOCATION/$2
        break
    done
    trap - SIGINT SIGTERM
elif [[ $1 == "convert" ]] || [[ $1 == "update" ]]
then
    if [ -z "$2" ]
    then 
        echo "Missing required param: name" >&2
        exit 1 
    fi
    if [[ $2 =~ ^~ ]]
    then
        echo "The vault name may not start with '~'!" >&2
        echo "Vault files starting with '~' are reserved for partially saved vaults." >&2
        echo "If you're looking to open the partially saved vault file, please manually rename it in $MBV_FILE_LOCATION" >&2
        exit 1
    fi
    if [ -e $MBV_FILE_LOCATION/$2.mbv2 ]
    then
        echo "Vault '$2' is already in the latest format!" >&2
        exit 1
    fi
    if ! [ -e $MBV_FILE_LOCATION/$2.mbv ]
    then
        echo "Vault '$2' does not exist!" >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    if [ -e "$MBV_FILE_LOCATION/~$2.mbv2" ]
    then
        echo "Vault '$2' has a partially saved vault file '~$2.mbv2'!" >&2
        echo "Please manually delete or move it in $MBV_FILE_LOCATION." >&2
        exit 1
    fi
    echo "Checking used gpg key..."
    key_id=$(gpg --list-packets $MBV_FILE_LOCATION/$2.mbv | grep -oP "[A-F0-9]{16}" | head -n 1)
    if [ -z "$key_id" ]
    then
        echo "Unable to get key used, aborting" >&2
        exit 1
    fi
    echo "Updating vault..."
    file_size=$(du -sb $MBV_FILE_LOCATION/$2.mbv | awk '{print $1}')
    gpg --decrypt -q $MBV_FILE_LOCATION/$2.mbv | pv -s $file_size | gzip -dc | zstd | gpg --encrypt -o $MBV_FILE_LOCATION/~$2.mbv2 -u $key_id -r $key_id --yes && chmod 600 $MBV_FILE_LOCATION/~$2.mbv2
    if [[ $? -eq 0 ]]
    then
        echo "Moving vault into place & removing old vault version..."
        mv $MBV_FILE_LOCATION/~$2.mbv2 $MBV_FILE_LOCATION/$2.mbv2 && rm "$MBV_FILE_LOCATION/$2.mbv" && (echo "Done!" && exit 0) || (echo "Failed!" && exit 1)
    else
        echo "Failed!"
        exit 1
    fi
else
    echo "Invalid subcommand, use mini_vault help to see subcommands."
    exit 1
fi