add KeyPass provider (tellerops#92)

* add KeyPass provider

* change  jondot review: change all fields to be default in env_sync

* alignment test after change all fields behavior

Author: kaplanelad

README.md

@@ -1062,6 +1062,37 @@ providers:
 
 ```
 
+## KeyPass
+
+### Authentication
+
+requires the following environment variables to be set:
+
+`KEYPASS_PASSWORD`: Password database credentials
+`KEYPASS_DB_PATH`: Database path
+
+### Features
+
+* Sync - `no`
+* Mapping - `yes`
+* Modes - `read`
+
+### Example Config
+
+```yaml
+
+providers:
+  keypass:
+    env_sync:
+      path: redis/config
+      # source: Optional, all fields is the default. Supported fields: Notes, Title, Password, URL, UserName
+    env:
+      ETC_DSN:
+        path: redis/config/foobar
+        # source: Optional, Password is the default. Supported fields: Notes, Title, Password, URL, UserName
+
+```
+
 # Semantics
 
 ## Addressing

go.mod

@@ -30,8 +30,10 @@ require (
 	github.com/mattn/lastpass-go v0.0.0-20160926001517-82bef8502f75
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/samber/lo v1.11.0
+	github.com/sirupsen/logrus v1.7.0
 	github.com/stretchr/testify v1.7.0
 	github.com/testcontainers/testcontainers-go v0.10.1-0.20210331130832-54854fb15ccb
+	github.com/tobischo/gokeepasslib/v3 v3.2.5
 	go.etcd.io/etcd/api/v3 v3.5.0-alpha.0
 	go.etcd.io/etcd/client/v3 v3.5.0-alpha.0
 	go.etcd.io/etcd/pkg/v3 v3.5.0-alpha.0
@@ -57,6 +59,8 @@ require (
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3 // indirect
 	github.com/Microsoft/hcsshim v0.8.15 // indirect
+	github.com/aead/argon2 v0.0.0-20180111183520-a87724528b07 // indirect
+	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
 	github.com/alecthomas/colour v0.1.0 // indirect
 	github.com/alecthomas/repr v0.0.0-20201120212035-bb82daffcca2 // indirect
 	github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da // indirect
@@ -130,7 +134,6 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/sirupsen/logrus v1.7.0 // indirect
 	github.com/spf13/cobra v0.0.5 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/uber/jaeger-client-go v2.25.0+incompatible // indirect
@@ -142,7 +145,6 @@ require (
 	go.uber.org/multierr v1.5.0 // indirect
 	go.uber.org/zap v1.16.0 // indirect
 	golang.org/x/exp v0.0.0-20220303212507-bbda1eaf7a17 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20211013180041-c96bc1413d57 // indirect
 	golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 // indirect
 	golang.org/x/sync v0.0.0-20201207232520-09787c993a3a // indirect
 	golang.org/x/sys v0.0.0-20211113001501-0c823b97ae02 // indirect

go.sum

@@ -108,6 +108,10 @@ github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/aead/argon2 v0.0.0-20180111183520-a87724528b07 h1:i9/M2RadeVsPBMNwXFiaYkXQi9lY9VuZeI4Onavd3pA=
+github.com/aead/argon2 v0.0.0-20180111183520-a87724528b07/go.mod h1:Tnm/osX+XXr9R+S71o5/F0E60sRkPVALdhWw25qPImQ=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da/go.mod h1:eHEWzANqSiWQsof+nXEI9bUVUyV6F53Fp89EuCh2EAA=
 github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm+0dGI2AIUHY+w0BUc+4tn40djz7+6U=
 github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
 github.com/alecthomas/colour v0.1.0 h1:nOE9rJm6dsZ66RGWYSFrXw461ZIt9A6+nHgL7FRrDUk=
@@ -417,7 +421,6 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
@@ -831,6 +834,8 @@ github.com/thoas/go-funk v0.9.1 h1:O549iLZqPpTUQ10ykd26sZhzD+rmR5pWhuElrhbC20M=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/tobischo/gokeepasslib/v3 v3.2.5 h1:BW0HorAp/Eo5XsjA3pgyrLaRzn9J5tGq8NBOADpE39g=
+github.com/tobischo/gokeepasslib/v3 v3.2.5/go.mod h1:iwxOzUuk/ccA0mitrFC4MovT1p0IRY8EA35L4u1x/ug=
 github.com/uber/jaeger-client-go v2.25.0+incompatible h1:IxcNZ7WRY1Y3G4poYlx24szfsn/3LvK9QHCq9oQw8+U=
 github.com/uber/jaeger-client-go v2.25.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
 github.com/uber/jaeger-lib v2.4.0+incompatible h1:fY7QsGQWiCt8pajv4r7JEvmATdCVaWxXbjwyYwsNaLQ=
@@ -908,6 +913,7 @@ golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
@@ -951,7 +957,6 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20211013180041-c96bc1413d57 h1:LQmS1nU0twXLA96Kt7U9qtHJEbBk3z6Q0V4UXjZkpr4=
-golang.org/x/mod v0.6.0-dev.0.20211013180041-c96bc1413d57/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1023,8 +1028,6 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a h1:DcqTD9SDLc+1P/r1EmRBwnVsrOwW+kk2vWf9n+1sGhs=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1081,6 +1084,7 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200513112337-417ce2331b5c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

pkg/providers.go

@@ -36,6 +36,7 @@ func (p *BuiltinProviders) ProviderHumanToMachine() map[string]string {
 		"Gopass":                      "gopass",
 		"LastPass":                    "lastpass",
 		"GitHub":                      "github",
+		"KeyPass":                     "keypass",
 	}
 }
 
@@ -78,6 +79,8 @@ func (p *BuiltinProviders) GetProvider(name string) (core.Provider, error) {
 		return providers.NewLastPass(logger)
 	case "github":
 		return providers.NewGitHub(logger)
+	case "keypass":
+		return providers.NewKeyPass(logger)
 	default:
 		return nil, fmt.Errorf("provider '%s' does not exist", name)
 	}

pkg/providers/keypass.go

@@ -0,0 +1,167 @@
+package providers
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spectralops/teller/pkg/core"
+
+	"github.com/spectralops/teller/pkg/logging"
+	"github.com/tobischo/gokeepasslib/v3"
+)
+
+var (
+	// keyPathFields describe all the available fields in KeyPass entry
+	keyPathFields = []string{"Notes", "Password", "URL", "UserName"}
+)
+
+type KeyPass struct {
+	logger logging.Logger
+	data   map[string]gokeepasslib.Entry
+}
+
+// NewKeyPass creates new provider instance
+func NewKeyPass(logger logging.Logger) (core.Provider, error) {
+
+	password := os.Getenv("KEYPASS_PASSWORD")
+	if password == "" {
+		return nil, errors.New("missing `KEYPASS_PASSWORD`")
+	}
+	dbPath := os.Getenv("KEYPASS_DB_PATH")
+	if dbPath == "" {
+		return nil, errors.New("missing `KEYPASS_DB_PATH`")
+	}
+
+	file, err := os.Open(dbPath)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	db := gokeepasslib.NewDatabase()
+	db.Credentials = gokeepasslib.NewPasswordCredentials(password)
+	err = gokeepasslib.NewDecoder(file).Decode(db)
+
+	if err != nil {
+		return nil, err
+	}
+
+	err = db.UnlockProtectedEntries()
+	if err != nil {
+		return nil, err
+	}
+	keyPass := &KeyPass{
+		logger: logger,
+	}
+	keyPass.data = keyPass.prepareGroups("", db.Content.Root.Groups, nil)
+	return keyPass, nil
+}
+
+// Name return the provider name
+func (k *KeyPass) Name() string {
+	return "KeyPass"
+}
+
+// Put will create a new single entry
+func (k *KeyPass) Put(p core.KeyPath, val string) error {
+	return fmt.Errorf("provider %q does not implement write yet", k.Name())
+}
+
+// PutMapping will create a multiple entries
+func (k *KeyPass) PutMapping(p core.KeyPath, m map[string]string) error {
+	return fmt.Errorf("provider %q does not implement write yet", k.Name())
+}
+
+// GetMapping returns a multiple entries
+func (k *KeyPass) GetMapping(p core.KeyPath) ([]core.EnvEntry, error) {
+
+	results := []core.EnvEntry{}
+	for path, entry := range k.data { //nolint
+		// get entries that start with the given path
+		if strings.HasPrefix(path, p.Path) {
+			if p.Source == "" {
+				// getting all entries fields
+				for _, field := range keyPathFields {
+					val := entry.Get(field).Value.Content
+					// skip on empty field
+					if val == "" {
+						k.logger.WithFields(map[string]interface{}{
+							"field": field,
+							"path":  path,
+						}).Debug("empty field")
+						continue
+					}
+					results = append(results, p.FoundWithKey(fmt.Sprintf("%s/%s", path, strings.ToLower(field)), val))
+				}
+			} else {
+				fieldContent := entry.Get(p.Source)
+				if fieldContent == nil {
+					k.logger.WithFields(map[string]interface{}{
+						"source": p.Source,
+						"path":   path,
+					}).Debug("field not found")
+					continue
+				}
+				val := fieldContent.Value.Content
+				if val != "" {
+					results = append(results, p.FoundWithKey(path, val))
+				}
+			}
+		}
+	}
+	return results, nil
+}
+
+// Get returns a single entry
+func (k *KeyPass) Get(p core.KeyPath) (*core.EnvEntry, error) {
+	ent := p.Missing()
+	entry, found := k.data[p.Path]
+	if !found {
+		k.logger.WithField("path", p.Path).Debug("secret not found in path")
+		return nil, fmt.Errorf("%v path: %s not exists", k.Name(), p.Path)
+	}
+	source := p.Source
+	if source == "" {
+		k.logger.WithField("path", p.Path).Debug("source attribute is empty, setting default field")
+		source = "Password"
+	}
+	k.logger.WithFields(map[string]interface{}{
+		"path":   p.Path,
+		"source": source,
+	}).Debug("get keypass field")
+	ent = p.Found(entry.Get(source).Value.Content)
+
+	return &ent, nil
+}
+
+// Delete will delete entry
+func (k *KeyPass) Delete(kp core.KeyPath) error {
+	return fmt.Errorf("provider %s does not implement delete yet", k.Name())
+}
+
+// DeleteMapping will delete the given path recessively
+func (k *KeyPass) DeleteMapping(kp core.KeyPath) error {
+	return fmt.Errorf("provider %s does not implement delete yet", k.Name())
+}
+
+// prepareGroups all KeyPass entries for easy seearch
+func (k *KeyPass) prepareGroups(path string, groups []gokeepasslib.Group, mapData map[string]gokeepasslib.Entry) map[string]gokeepasslib.Entry {
+	if mapData == nil {
+		mapData = map[string]gokeepasslib.Entry{}
+	}
+	for _, group := range groups { //nolint
+		// if entries found, adding the entry data fo the list
+		if len(group.Entries) > 0 {
+			for _, entry := range group.Entries { //nolint
+				mapData[fmt.Sprintf("%s/%s/%s", path, group.Name, entry.GetTitle())] = entry
+			}
+		}
+		if len(group.Groups) > 0 {
+			// call recursively prepareGroups function get collect entries
+			return k.prepareGroups(strings.TrimPrefix(fmt.Sprintf("%s/%s", path, group.Name), "/"), group.Groups, mapData)
+		}
+	}
+	return mapData
+}

pkg/providers/keypass_test.go

@@ -0,0 +1,41 @@
+package providers
+
+import (
+	"os"
+	"path"
+	"runtime"
+	"testing"
+
+	"github.com/alecthomas/assert"
+	"github.com/spectralops/teller/pkg/core"
+)
+
+func TestKetPass(t *testing.T) {
+
+	_, filename, _, _ := runtime.Caller(0) //nolint
+	os.Setenv("KEYPASS_PASSWORD", "1234")
+
+	os.Setenv("KEYPASS_DB_PATH", path.Join(path.Dir(filename), "mock_providers", "keypass.kdbx"))
+
+	k, err := NewKeyPass(GetTestLogger())
+	assert.Nil(t, err)
+	AssertProvider(t, k, false)
+	p := core.NewPopulate(map[string]string{"stage": "prod"})
+	kpmap := p.KeyPath(core.KeyPath{Field: "MG_KEY", Path: "settings/{{stage}}/billing-svc/all", Decrypt: true})
+	ents, err := k.GetMapping(kpmap)
+	assert.Nil(t, err)
+	assert.Equal(t, len(ents), 4)
+}
+
+func TestKeypassFailures(t *testing.T) {
+
+	_, filename, _, _ := runtime.Caller(0) //nolint
+	os.Setenv("KEYPASS_PASSWORD", "1234")
+
+	os.Setenv("KEYPASS_DB_PATH", path.Join(path.Dir(filename), "mock_providers", "keypass.kdbx"))
+
+	k, _ := NewKeyPass(GetTestLogger())
+	_, err := k.Get(core.KeyPath{Env: "NOT_EXISTS", Path: "settings"})
+	assert.NotNil(t, err)
+
+}

pkg/providers/mock_providers/keypass.kdbx

@@ -228,5 +228,22 @@ providers:
       script-value:
         path: owner/github-repo
 
+{{end}}
+
+{{- if index .ProviderKeys "keypass" }}
+
+  # Configure via environment variables for integration:
+  # KEYPASS_PASSWORD: KeyPass password
+  # KEYPASS_DB_PATH: Path to DB file
+
+  keypass:
+    env_sync:
+      path: redis/config
+      # source: Optional, all fields is the default. Supported fields: Notes, Title, Password, URL, UserName
+    env:
+      ETC_DSN:
+        path: redis/config/foobar
+        # source: Optional, Password is the default. Supported fields: Notes, Title, Password, URL, UserName
+
 {{end}}
 `