vault.py

"""
vault.py — CLI Password Vault
A terminal-based password manager that stores encrypted entries locally.
"""

import os
import pickle
import hashlib
import secrets
import string
import getpass

import pyperclip


VAULT_FILE = "vault.pkl"


# ── Hashing ──────────────────────────────────────────────────────────────────

def hash_password(password: str) -> str:
    """Return the SHA-256 hex digest of *password*."""
    return hashlib.sha256(password.encode()).hexdigest()


def verify_password(stored_hash: str, attempt: str) -> bool:
    """Return True if *attempt* matches *stored_hash*."""
    return stored_hash == hash_password(attempt)


# ── Persistence ───────────────────────────────────────────────────────────────

def save_vault(data: dict) -> None:
    """Persist *data* to disk."""
    with open(VAULT_FILE, "wb") as fh:
        pickle.dump(data, fh)


def load_vault() -> dict:
    """Load vault from disk, or return an empty vault if none exists."""
    if os.path.exists(VAULT_FILE):
        with open(VAULT_FILE, "rb") as fh:
            return pickle.load(fh)
    return {"master_hash": None, "entries": {}}


# ── CRUD operations ───────────────────────────────────────────────────────────

def add_entry(vault: dict) -> None:
    """Prompt the user for site credentials and save them to *vault*."""
    site = input("Site: ").strip()
    username = input("Username: ").strip()
    password = input("Password (leave blank to generate one): ").strip()
    if not password:
        password = generate_password()
        print(f"Generated password: {password}")
    notes = input("Notes: ").strip()
    vault["entries"][site] = {
        "username": username,
        "password": password,
        "notes": notes,
    }
    print(f"Entry for '{site}' saved.")


def delete_entry(vault: dict) -> None:
    """Remove a site entry from *vault* after user confirmation."""
    site = input("Site to delete: ").strip()
    if site in vault["entries"]:
        confirm = input(f"Delete '{site}'? (y/n): ").strip().lower()
        if confirm == "y":
            del vault["entries"][site]
            print(f"'{site}' deleted.")
    else:
        print("Site not found.")


def search_entry(vault: dict) -> None:
    """Search entries by site name and optionally copy the password."""
    query = input("Search site: ").strip().lower()
    matches = [s for s in vault["entries"] if query in s.lower()]

    if not matches:
        print("No matching entries found.")
        return

    for site in matches:
        entry = vault["entries"][site]
        print(f"\n  Site     : {site}")
        print(f"  Username : {entry['username']}")
        print(f"  Notes    : {entry['notes']}")
        copy = input("  Copy password to clipboard? (y/n): ").strip().lower()
        if copy == "y":
            pyperclip.copy(entry["password"])
            print("  Password copied to clipboard.")


def list_entries(vault: dict) -> None:
    """Print all stored site names."""
    if not vault["entries"]:
        print("No entries yet.")
        return
    print("\nStored sites:")
    for site in vault["entries"]:
        print(f"  - {site}")


# ── Password generator ────────────────────────────────────────────────────────

def generate_password() -> str:
    """Generate a cryptographically secure random password."""
    try:
        length = int(input("Length (default 16): ").strip() or 16)
    except ValueError:
        length = 16
    chars = string.ascii_letters + string.digits + string.punctuation
    return "".join(secrets.choice(chars) for _ in range(length))


# ── Entry point ───────────────────────────────────────────────────────────────

def main() -> None:
    vault = load_vault()

    # First-time setup
    if not vault["master_hash"]:
        pw = getpass.getpass("Create a master password: ")
        vault["master_hash"] = hash_password(pw)
        save_vault(vault)
        print("Vault created. Remember your master password — it cannot be recovered.\n")

    # Authenticate
    attempt = getpass.getpass("Master password: ")
    if not verify_password(vault["master_hash"], attempt):
        print("Incorrect password.")
        return
    print("Unlocked.\n")

    menu = "\n[1] Add  [2] Search  [3] List  [4] Delete  [5] Quit"
    while True:
        print(menu)
        choice = input("> ").strip()
        if choice == "1":
            add_entry(vault)
            save_vault(vault)
        elif choice == "2":
            search_entry(vault)
        elif choice == "3":
            list_entries(vault)
        elif choice == "4":
            delete_entry(vault)
            save_vault(vault)
        elif choice == "5":
            print("Goodbye.")
            break
        else:
            print("Invalid choice.")


if __name__ == "__main__":
    main()