From 72373e86cea699c5fb69cfff436e390186cc9e4e Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sat, 18 Mar 2017 18:20:28 -0700 Subject: Add cmd_insert_uri; refactor tests --- test/insert.t | 40 ++++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) (limited to 'test/insert.t') diff --git a/test/insert.t b/test/insert.t index a78971f..e04914e 100755 --- a/test/insert.t +++ b/test/insert.t @@ -4,16 +4,44 @@ export test_description="Tests pass otp insert commands" . ./setup.sh +test_expect_success 'Inserts a key URI' ' + uri="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example" + + test_pass_init && + "$PASS" otp insert "$uri" passfile && + [[ $("$PASS" show passfile) == "$uri" ]] +' + +test_expect_success 'Prompts before overwriting key URI' ' + uri1="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Foo" + uri2="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Bar" + + test_pass_init && + "$PASS" otp insert "$uri1" passfile && + test_faketty "echo n | $PASS otp insert $uri2 passfile" && + [[ $("$PASS" show passfile) == "$uri1" ]] +' + +test_expect_success 'Force overwrites key URI' ' + uri1="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Foo" + uri2="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Bar" + + test_pass_init && + "$PASS" otp insert "$uri1" passfile && + "$PASS" otp insert -f "$uri2" passfile && + [[ $("$PASS" show passfile) == "$uri2" ]] +' + test_expect_success 'Inserts a basic TOTP key' ' - "$PASS" init $KEY1 && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA totp-secret + test_pass_init && + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile ' test_expect_success 'Commits insert to git' ' - git init "$PASSWORD_STORE_DIR" && - "$PASS" init $KEY1 && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA totp-secret2 && - git log --no-decorate -1 | grep "Add given OTP secret for totp-secret2 to store." + test_pass_init && + pass git init && + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile && + git log --no-decorate -1 | grep "Add given OTP secret for passfile to store." ' test_done -- cgit v1.2.3 From 8367284176c086d3bf203923bbd0abd9c0786e33 Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sat, 18 Mar 2017 23:56:24 -0700 Subject: Fix overwrite prompt test --- test/insert.t | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'test/insert.t') diff --git a/test/insert.t b/test/insert.t index e04914e..dbd6e2a 100755 --- a/test/insert.t +++ b/test/insert.t @@ -18,7 +18,7 @@ test_expect_success 'Prompts before overwriting key URI' ' test_pass_init && "$PASS" otp insert "$uri1" passfile && - test_faketty "echo n | $PASS otp insert $uri2 passfile" && + test_faketty "$PASS" otp insert "$uri2" passfile < <(echo n) && [[ $("$PASS" show passfile) == "$uri1" ]] ' -- cgit v1.2.3 From 3aeea0b8ab9c7bbbfdf403fe5e0908a1160ef08b Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sun, 19 Mar 2017 16:23:26 -0700 Subject: Replace cmd_insert_$type with cmd_insert_spec; insert key uris --- otp.bash | 465 +++++++++++++++++++++++++++++++--------------------------- test/insert.t | 28 +++- 2 files changed, 272 insertions(+), 221 deletions(-) (limited to 'test/insert.t') diff --git a/otp.bash b/otp.bash index 1d12c8b..dad46b8 100755 --- a/otp.bash +++ b/otp.bash @@ -18,6 +18,17 @@ OATH=$(which oathtool) +otp_urlencode() { + local LANG=C + for ((i=0; i<${#1}; i++)); do + if [[ ${1:$i:1} =~ ^[a-zA-Z0-9\.\~_-]$ ]]; then + printf "%s" "${1:$i:1}" + else + printf '%%%02X' "'${1:$i:1}" + fi + done +} + # Parse a Key URI per: https://github.com/google/google-authenticator/wiki/Key-Uri-Format # Vars are consumed by caller # shellcheck disable=SC2034 @@ -57,42 +68,83 @@ otp_parse_uri() { [[ "$otp_type" == 'hotp' && -z "$otp_counter" ]] && die "Invalid key URI (missing counter): $otp_uri" } +otp_build_uri() { + local type="$1" issuer="$2" accountname="$3" secret="$4" algorithm="$5" \ + digits="$6" period="$7" counter="$8" + + local uri="otpauth://$type/" + + local pattern='^[^:]+$' + if [[ -n "$issuer" ]]; then + [[ "$issuer" =~ $pattern ]] || die "Invalid character in issuer: ':'" + issuer=$(otp_urlencode "$issuer") + fi + + [[ -z "$accountname" ]] && die "Missing accountname" + [[ "$accountname" =~ $pattern ]] || die "Invalid character in accountname: ':'" + accountname=$(otp_urlencode "$accountname") + + if [[ -n "$issuer" ]]; then + uri+="$issuer:$accountname" + else + uri+="$accountname" + fi + + [[ -z "$secret" ]] && die "Missing secret"; uri+="?secret=$secret" + [[ -n "$algorithm" ]] && uri+="&algorithm=$algorithm" + + case "$1" in + totp) + [[ -n "$digits" ]] && uri+="&digits=$digits" + [[ -n "$period" ]] && uri+="&period=$period" + ;; + + hotp) + [[ -z "$counter" ]] && die "Missing counter"; uri+="&counter=$counter" + ;; + + *) die "Invalid OTP type '$1'" ;; + esac + + [[ -n "$issuer" ]] && uri+="&issuer=$issuer" + + echo "$uri" +} + otp_increment_counter() { - local ret=$1 - local counter=$2 contents="$3" path="$4" passfile="$5" + local ret=$1 + local counter=$2 contents="$3" path="$4" passfile="$5" - local inc=$((counter+1)) + local inc=$((counter+1)) - contents=${contents//otp_counter: $counter/otp_counter: $inc} + contents=${contents//otp_counter: $counter/otp_counter: $inc} - set_gpg_recipients "$(dirname "$path")" + set_gpg_recipients "$(dirname "$path")" - $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" <<<"$contents" || die "OTP secret encryption aborted." + $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" <<<"$contents" || die "OTP secret encryption aborted." - git_add_file "$passfile" "Update HOTP counter value for $path." + git_add_file "$passfile" "Update HOTP counter value for $path." - eval "$ret='$inc'" + eval "$ret='$inc'" } otp_insert() { - echo "args: $*" - - local path="${1%/}" - local passfile="$PREFIX/$path.gpg" - local force=$2 - local contents="$3" + local path="${1%/}" + local passfile="$PREFIX/$path.gpg" + local force=$2 + local contents="$3" - check_sneaky_paths "$path" - set_git "$passfile" + check_sneaky_paths "$path" + set_git "$passfile" - [[ $force -eq 0 && -e $passfile ]] && yesno "An entry already exists for $path. Overwrite it?" + [[ $force -eq 0 && -e $passfile ]] && yesno "An entry already exists for $path. Overwrite it?" - mkdir -p -v "$PREFIX/$(dirname "$path")" - set_gpg_recipients "$(dirname "$path")" + mkdir -p -v "$PREFIX/$(dirname "$path")" + set_gpg_recipients "$(dirname "$path")" - $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" <<<"$contents" || die "OTP secret encryption aborted." + $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" <<<"$contents" || die "OTP secret encryption aborted." - git_add_file "$passfile" "Add given OTP secret for $path to store." + git_add_file "$passfile" "Add given OTP secret for $path to store." } otp_insert_uri() { @@ -114,214 +166,187 @@ otp_insert_uri() { otp_insert "$2" $force "$otp_uri" } -otp_insert_totp() { - local opts contents secret="" algorithm="sha1" period=30 digits=6 force=0 - opts="$($GETOPT -o s:a:p:d:f -l secret:,algorithm:,period:,digits:,force -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case $1 in - -s|--secret) secret="$2"; shift 2 ;; - -a|--algorithm) algorithm="$2"; shift 2 ;; - -p|--period) period="$2"; shift 2 ;; - -d|--digits) digits="$2"; shift 2 ;; - -f|--force) force=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 && $# -ne 1 ]] && die "Usage: $PROGRAM $COMMAND insert totp [--secret=key,s key] [--algorithm=algorithm,-a algorithm] [--period=seconds,-p seconds] [--digits=digits,-d digits] [--force,-f] pass-name" - - case $algorithm in - sha1|sha256|sha512) ;; - *) die "Invalid algorithm '$algorithm'. May be one of 'sha1', 'sha256', or 'sha512'" ;; - esac - - case $digits in - 6|8) ;; - *) die "Invalid digits '$digits'. May be one of '6' or '8'" ;; - esac - - if [[ -z $secret ]]; then - read -r -p "Enter secret (base32-encoded): " -s secret || exit 1 - fi - - contents=$(cat <<-_EOF - otp_secret: $secret - otp_type: totp - otp_algorithm: $algorithm - otp_period: $period - otp_digits: $digits - _EOF - ) - - otp_insert "$1" $force "$contents" -} +otp_insert_spec() { + local opts contents secret issuer accountname algorithm period digits counter force=0 + local type="$1"; shift -otp_insert_hotp() { - local opts contents secret="" digits=6 force=0 - opts="$($GETOPT -o s:d:f -l secret:,digits:,force -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case $1 in - -s|--secret) secret="$2"; shift 2 ;; - -a|--algorithm) algorithm="$2"; shift 2 ;; - -d|--digits) digits="$2"; shift 2 ;; - -f|--force) force=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 || $# -ne 2 ]] && die "Usage: $PROGRAM $COMMAND insert hotp [--secret=key,s key] [--digits=digits,-d digits] [--force,-f] pass-name counter" - - case $digits in - 6|8) ;; - *) die "Invalid digits '$digits'. May be one of '6' or '8'" ;; - esac - - if [[ -z $secret ]]; then - read -r -p "Enter secret (base32-encoded): " -s secret || exit 1 - fi - - local counter="$2" - [[ $counter =~ ^[0-9]+$ ]] || die "Invalid counter '$counter'. Must be a positive number" - - contents=$(cat <<-_EOF - otp_secret: $secret - otp_type: hotp - otp_counter: $counter - otp_digits: $digits - _EOF - ) - - otp_insert "$1" $force "$contents" + opts="$($GETOPT -o s:i:n:a:p:d:f -l secret:,issuer:,accountname:,algorithm:,period:,digits:,force -n "$PROGRAM" -- "$@")" + local err=$? + eval set -- "$opts" + while true; do case "$1" in + -s|--secret) secret="$2"; shift 2 ;; + -i|--issuer) issuer="$2"; shift 2 ;; + -n|--accountname) accountname="$2"; shift 2 ;; + -a|--algorithm) algorithm="$2"; shift 2 ;; + -p|--period) period="$2"; shift 2 ;; + -d|--digits) digits="$2"; shift 2 ;; + -f|--force) force=1; shift ;; + --) shift; break ;; + esac done + + [[ $type == "totp" && ($err -ne 0 || $# -ne 1) ]] && + die "Usage: $PROGRAM $COMMAND insert totp [--secret=key,s key] [--algorithm=algorithm,-a algorithm] [--period=seconds,-p seconds] [--digits=digits,-d digits] [--force,-f] pass-name" + + [[ $type == "hotp" && ($err -ne 0 || $# -ne 2) ]] && + die "Usage: $PROGRAM $COMMAND insert hotp [--secret=key,s key] [--digits=digits,-d digits] [--force,-f] pass-name counter" + + local path="$1" counter="$2" + + [[ -n "$algorithm" ]] && case $algorithm in + sha1|sha256|sha512) ;; + *) die "Invalid algorithm '$algorithm'. May be one of 'sha1', 'sha256', or 'sha512'" ;; + esac + + [[ -n "$digits" ]] && case $digits in + 6|8) ;; + *) die "Invalid digits '$digits'. May be one of '6' or '8'" ;; + esac + + if [[ -z $secret ]]; then + read -r -p "Enter secret (base32-encoded): " -s secret || die "Missing secret" + fi + + # Populate issuer and accountname from either options or path + if [[ -z $accountname ]]; then + accountname="$(basename "$path")" + if [[ -z "$issuer" ]]; then + issuer="$(basename "$(dirname "$path")")" + [[ "$issuer" == "." ]] && unset issuer + fi + fi + + local uri; uri=$(otp_build_uri "$type" "$issuer" "$accountname" "$secret" "$algorithm" "$period" "$digits" "$counter") + + otp_insert "$1" $force "$uri" } cmd_otp_usage() { - cat <<-_EOF - Usage: - $PROGRAM otp [show] [--clip,-c] pass-name - Generate an OTP code and optionally put it on the clipboard. - If put on the clipboard, it will be cleared in $CLIP_TIME seconds. - $PROGRAM otp insert totp [--secret=key,-s key] [--algorithm alg,-a alg] - [--period=seconds,-p seconds] - [--digits=digits,-d digits] [--force,-f] pass-name - Insert new TOTP secret. Prompt before overwriting existing password - unless forced. - $PROGRAM otp insert hotp [--secret=secret,-s secret] - [--digits=digits,-d digits] [--force,-f] - pass-name counter - Insert new HOTP secret with initial counter. Prompt before overwriting - existing password unless forced. - $PROGRAM otp uri [--clip,-c] [--qrcode,-q] pass-name - Create a secret key URI suitable for importing into other TOTP clients. - Optionally, put it on the clipboard, or display a QR code. - - More information may be found in the pass-otp(1) man page. - _EOF - exit 0 + cat <<-_EOF +Usage: + $PROGRAM otp [show] [--clip,-c] pass-name + Generate an OTP code and optionally put it on the clipboard. + If put on the clipboard, it will be cleared in $CLIP_TIME seconds. + $PROGRAM otp insert totp [--secret=key,-s key] [--algorithm alg,-a alg] + [--period=seconds,-p seconds] + [--digits=digits,-d digits] [--force,-f] pass-name + Insert new TOTP secret. Prompt before overwriting existing password + unless forced. + $PROGRAM otp insert hotp [--secret=secret,-s secret] + [--digits=digits,-d digits] [--force,-f] + pass-name counter + Insert new HOTP secret with initial counter. Prompt before overwriting + existing password unless forced. + $PROGRAM otp uri [--clip,-c] [--qrcode,-q] pass-name + Create a secret key URI suitable for importing into other TOTP clients. + Optionally, put it on the clipboard, or display a QR code. + +More information may be found in the pass-otp(1) man page. +_EOF + exit 0 } cmd_otp_insert() { - case "$1" in - totp) shift; otp_insert_totp "$@" ;; - hotp) shift; otp_insert_hotp "$@" ;; - *) otp_insert_uri "$@" ;; - esac + case "$1" in + totp|hotp) otp_insert_spec "$@" ;; + *) otp_insert_uri "$@" ;; + esac } cmd_otp_show() { local opts contents clip=0 secret="" type="" algorithm="" counter="" period=30 digits=6 - opts="$($GETOPT -o c -l clip -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case $1 in - -c|--clip) clip=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 || $# -ne 1 ]] && die "Usage: $PROGRAM $COMMAND show [--clip,-c] pass-name" - - local path="$1" - local passfile="$PREFIX/$path.gpg" - check_sneaky_paths "$path" - [[ ! -f $passfile ]] && die "Passfile not found" - - contents=$($GPG -d "${GPG_OPTS[@]}" "$passfile") - while read -r -a line; do case ${line[0]} in - otp_secret:) secret=${line[1]} ;; - otp_type:) type=${line[1]} ;; - otp_algorithm:) algorithm=${line[1]} ;; - otp_period:) period=${line[1]} ;; - otp_counter:) counter=${line[1]} ;; - otp_digits:) digits=${line[1]} ;; - *) true ;; - esac done <<< "$contents" - - [[ -z $secret ]] && die "Missing otp_secret: line in $passfile" - [[ -z $type ]] && die "Missing otp_type: line in $passfile" - [[ $type = "totp" && -z $algorithm ]] && die "Missing otp_algorithm: line in $passfile" - [[ $type = "hotp" && -z $counter ]] && die "Missing otp_counter: line in $passfile" - - local out - case $type in - totp) out=$($OATH -b --totp="$algorithm" --time-step-size="$period"s --digits="$digits" "$secret") ;; - hotp) otp_increment_counter counter "$counter" "$contents" "$path" "$passfile" > /dev/null \ + opts="$($GETOPT -o c -l clip -n "$PROGRAM" -- "$@")" + local err=$? + eval set -- "$opts" + while true; do case $1 in + -c|--clip) clip=1; shift ;; + --) shift; break ;; + esac done + + [[ $err -ne 0 || $# -ne 1 ]] && die "Usage: $PROGRAM $COMMAND show [--clip,-c] pass-name" + + local path="$1" + local passfile="$PREFIX/$path.gpg" + check_sneaky_paths "$path" + [[ ! -f $passfile ]] && die "Passfile not found" + + contents=$($GPG -d "${GPG_OPTS[@]}" "$passfile") + while read -r -a line; do case ${line[0]} in + otp_secret:) secret=${line[1]} ;; + otp_type:) type=${line[1]} ;; + otp_algorithm:) algorithm=${line[1]} ;; + otp_period:) period=${line[1]} ;; + otp_counter:) counter=${line[1]} ;; + otp_digits:) digits=${line[1]} ;; + *) true ;; + esac done <<< "$contents" + + [[ -z $secret ]] && die "Missing otp_secret: line in $passfile" + [[ -z $type ]] && die "Missing otp_type: line in $passfile" + [[ $type = "totp" && -z $algorithm ]] && die "Missing otp_algorithm: line in $passfile" + [[ $type = "hotp" && -z $counter ]] && die "Missing otp_counter: line in $passfile" + + local out + case $type in + totp) out=$($OATH -b --totp="$algorithm" --time-step-size="$period"s --digits="$digits" "$secret") ;; + hotp) otp_increment_counter counter "$counter" "$contents" "$path" "$passfile" > /dev/null \ || die "Failed to increment HOTP counter for $passfile" - out=$($OATH -b --hotp --counter="$counter" --digits="$digits" "$secret") - ;; - *) die "Invalid OTP type '$type'. May be one of 'totp' or 'hotp'" ;; - esac - - if [[ $clip -ne 0 ]]; then - clip "$out" "OTP code for $path" - else - echo "$out" - fi + out=$($OATH -b --hotp --counter="$counter" --digits="$digits" "$secret") + ;; + *) die "Invalid OTP type '$type'. May be one of 'totp' or 'hotp'" ;; + esac + + if [[ $clip -ne 0 ]]; then + clip "$out" "OTP code for $path" + else + echo "$out" + fi } cmd_otp_uri() { - local contents qrcode=0 clip=0 - opts="$($GETOPT -o q -l qrcode -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case $1 in - -q|--qrcode) qrcode=1; shift ;; - -c|--clip) clip=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 || $# -ne 1 ]] && die "Usage: $PROGRAM $COMMAND uri [--clip,-c | --qrcode,-q] pass-name" - - local path="$1" - local passfile="$PREFIX/$path.gpg" - check_sneaky_paths "$path" - [[ ! -f $passfile ]] && die "Passfile not found" - - local secret="" type="" algorithm="" counter="" period=30 digits=6 - - contents=$($GPG -d "${GPG_OPTS[@]}" "$passfile") - while read -r -a line; do case ${line[0]} in - otp_secret:) secret=${line[1]} ;; - otp_type:) type=${line[1]} ;; - otp_algorithm:) algorithm=${line[1]} ;; - otp_period:) period=${line[1]} ;; - otp_counter:) counter=${line[1]} ;; - otp_digits:) digits=${line[1]} ;; - *) true ;; - esac done <<< "$contents" - - local uri - case $type in - totp) uri="otpauth://totp/$path?secret=$secret&algorithm=$algorithm&digits=$digits&period=$period" ;; - hotp) uri="otpauth://hotp/$path?secret=$secret&digits=$digits&counter=$counter" ;; - *) die "Invalid OTP type '$type'. Must be one of 'totp' or 'hotp'" ;; - esac - - if [[ clip -eq 1 ]]; then - clip "$uri" "OTP key URI for $path" - elif [[ qrcode -eq 1 ]]; then - qrcode "$uri" "OTP key URI for $path" - else - echo "$uri" - fi + local contents qrcode=0 clip=0 + opts="$($GETOPT -o q -l qrcode -n "$PROGRAM" -- "$@")" + local err=$? + eval set -- "$opts" + while true; do case $1 in + -q|--qrcode) qrcode=1; shift ;; + -c|--clip) clip=1; shift ;; + --) shift; break ;; + esac done + + [[ $err -ne 0 || $# -ne 1 ]] && die "Usage: $PROGRAM $COMMAND uri [--clip,-c | --qrcode,-q] pass-name" + + local path="$1" + local passfile="$PREFIX/$path.gpg" + check_sneaky_paths "$path" + [[ ! -f $passfile ]] && die "Passfile not found" + + local secret="" type="" algorithm="" counter="" period=30 digits=6 + + contents=$($GPG -d "${GPG_OPTS[@]}" "$passfile") + while read -r -a line; do case ${line[0]} in + otp_secret:) secret=${line[1]} ;; + otp_type:) type=${line[1]} ;; + otp_algorithm:) algorithm=${line[1]} ;; + otp_period:) period=${line[1]} ;; + otp_counter:) counter=${line[1]} ;; + otp_digits:) digits=${line[1]} ;; + *) true ;; + esac done <<< "$contents" + + local uri + case $type in + totp) uri="otpauth://totp/$path?secret=$secret&algorithm=$algorithm&digits=$digits&period=$period" ;; + hotp) uri="otpauth://hotp/$path?secret=$secret&digits=$digits&counter=$counter" ;; + *) die "Invalid OTP type '$type'. Must be one of 'totp' or 'hotp'" ;; + esac + + if [[ clip -eq 1 ]]; then + clip "$uri" "OTP key URI for $path" + elif [[ qrcode -eq 1 ]]; then + qrcode "$uri" "OTP key URI for $path" + else + echo "$uri" + fi } cmd_otp_validate() { @@ -329,11 +354,11 @@ cmd_otp_validate() { } case "$1" in - help|--help|-h) shift; cmd_otp_usage "$@" ;; - show) shift; cmd_otp_show "$@" ;; - insert|add) shift; cmd_otp_insert "$@" ;; - uri) shift; cmd_otp_uri "$@" ;; - validate) shift; cmd_otp_validate "$@" ;; - *) cmd_otp_show "$@" ;; + help|--help|-h) shift; cmd_otp_usage "$@" ;; + show) shift; cmd_otp_show "$@" ;; + insert|add) shift; cmd_otp_insert "$@" ;; + uri) shift; cmd_otp_uri "$@" ;; + validate) shift; cmd_otp_validate "$@" ;; + *) cmd_otp_show "$@" ;; esac exit 0 diff --git a/test/insert.t b/test/insert.t index dbd6e2a..eb04898 100755 --- a/test/insert.t +++ b/test/insert.t @@ -33,8 +33,34 @@ test_expect_success 'Force overwrites key URI' ' ' test_expect_success 'Inserts a basic TOTP key' ' + uri="otpauth://totp/passfile?secret=AAAAAAAAAAAAAAAAAAAAA" + + test_pass_init && + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile && + [[ $("$PASS" show passfile) == "$uri" ]] +' + +test_expect_success 'Inserts a TOTP key with issuer in path' ' + uri="otpauth://totp/example.com:passfile?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=example.com" + + test_pass_init && + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA example.com/passfile && + [[ $("$PASS" show example.com/passfile) == "$uri" ]] +' + +test_expect_success 'Inserts a TOTP key with issuer in nested path' ' + uri="otpauth://totp/foo:passfile?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=foo" + + test_pass_init && + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA example.com/foo/passfile && + [[ $("$PASS" show example.com/foo/passfile) == "$uri" ]] +' + +test_expect_success 'Inserts a TOTP key with spaces in path' ' + uri="otpauth://totp/example%20dot%20com:pass%20file?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=example%20dot%20com" test_pass_init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile + "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA "example dot com/pass file" && + [[ $("$PASS" show "example dot com/pass file") == "$uri" ]] ' test_expect_success 'Commits insert to git' ' -- cgit v1.2.3 From 698ae45a780bcc83d8dadc18aadfb049ec7c127c Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sun, 19 Mar 2017 20:58:45 -0700 Subject: Fix HOTP URI parsing --- otp.bash | 26 +++++++++++++++----------- test/insert.t | 2 +- test/validate.t | 4 ++++ 3 files changed, 20 insertions(+), 12 deletions(-) (limited to 'test/insert.t') diff --git a/otp.bash b/otp.bash index 539fc7e..b95e981 100755 --- a/otp.bash +++ b/otp.bash @@ -38,7 +38,7 @@ otp_parse_uri() { uri="${uri//\`/%60}" uri="${uri//\"/%22}" - local pattern='^otpauth:\/\/(totp|hotp)(\/(([^:?]+)?(:([^:?]*))?))?(\?([^#&?]+))(&([^#&?]+))*$' + local pattern='^otpauth:\/\/(totp|hotp)(\/(([^:?]+)?(:([^:?]*))?))?\?(.+)$' [[ "$uri" =~ $pattern ]] || die "Cannot parse OTP key URI: $uri" otp_uri=${BASH_REMATCH[0]} @@ -48,24 +48,28 @@ otp_parse_uri() { otp_accountname=${BASH_REMATCH[6]} [[ -z $otp_accountname ]] && otp_accountname=${BASH_REMATCH[4]} || otp_issuer=${BASH_REMATCH[4]} - local parameters=(${BASH_REMATCH[@]:7}) - pattern='^([^?&=]+)(=(.+))$' - for param in "${parameters[@]}"; do + local p=${BASH_REMATCH[7]} + local IFS=\&; local params=(${p[@]}); unset IFS + + pattern='^(.+)=(.+)$' + for param in "${params[@]}"; do if [[ "$param" =~ $pattern ]]; then case ${BASH_REMATCH[1]} in - secret) otp_secret=${BASH_REMATCH[3]} ;; - digits) otp_digits=${BASH_REMATCH[3]} ;; - algorithm) otp_algorithm=${BASH_REMATCH[3]} ;; - period) otp_period=${BASH_REMATCH[3]} ;; - counter) otp_counter=${BASH_REMATCH[3]} ;; - issuer) otp_issuer=${BASH_REMATCH[3]} ;; + secret) otp_secret=${BASH_REMATCH[2]} ;; + digits) otp_digits=${BASH_REMATCH[2]} ;; + algorithm) otp_algorithm=${BASH_REMATCH[2]} ;; + period) otp_period=${BASH_REMATCH[2]} ;; + counter) otp_counter=${BASH_REMATCH[2]} ;; + issuer) otp_issuer=${BASH_REMATCH[2]} ;; *) ;; esac fi done [[ -z "$otp_secret" ]] && die "Invalid key URI (missing secret): $otp_uri" - [[ "$otp_type" == 'hotp' && -z "$otp_counter" ]] && die "Invalid key URI (missing counter): $otp_uri" + + pattern='^[0-9]+$' + [[ "$otp_type" == 'hotp' ]] && [[ ! "$otp_counter" =~ $pattern ]] && die "Invalid key URI (missing counter): $otp_uri" } otp_build_uri() { diff --git a/test/insert.t b/test/insert.t index eb04898..228a8ec 100755 --- a/test/insert.t +++ b/test/insert.t @@ -67,7 +67,7 @@ test_expect_success 'Commits insert to git' ' test_pass_init && pass git init && "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile && - git log --no-decorate -1 | grep "Add given OTP secret for passfile to store." + git log --no-decorate -1 | grep "Add OTP secret for passfile to store." ' test_done diff --git a/test/validate.t b/test/validate.t index 9fbe66c..6d05fdf 100755 --- a/test/validate.t +++ b/test/validate.t @@ -12,6 +12,10 @@ test_expect_success 'Parses a complex TOTP URI' ' "$PASS" otp validate otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 ' +test_expect_success 'Parses a basic HOTP URI' ' + "$PASS" otp validate "otpauth://hotp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&counter=10&issuer=Example" +' + test_expect_success 'Fails for bogus URL' ' test_must_fail "$PASS" otp validate https://www.google.com/ ' -- cgit v1.2.3 From 318febc9ec78ab35ae4021472bd8ce29a5389c4b Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sun, 19 Mar 2017 22:01:42 -0700 Subject: Remove otp_insert_spec and related insert commands --- otp.bash | 175 ++++++++++------------------------------------------------ pass-otp.1 | 66 ++++++---------------- test/insert.t | 38 ------------- 3 files changed, 45 insertions(+), 234 deletions(-) (limited to 'test/insert.t') diff --git a/otp.bash b/otp.bash index 301ad99..664a37b 100755 --- a/otp.bash +++ b/otp.bash @@ -18,17 +18,6 @@ OATH=$(which oathtool) -otp_urlencode() { - local LANG=C - for ((i=0; i<${#1}; i++)); do - if [[ ${1:$i:1} =~ ^[a-zA-Z0-9\.\~_-]$ ]]; then - printf "%s" "${1:$i:1}" - else - printf '%%%02X' "'${1:$i:1}" - fi - done -} - # Parse a Key URI per: https://github.com/google/google-authenticator/wiki/Key-Uri-Format # Vars are consumed by caller # shellcheck disable=SC2034 @@ -47,6 +36,7 @@ otp_parse_uri() { otp_accountname=${BASH_REMATCH[6]} [[ -z $otp_accountname ]] && otp_accountname=${BASH_REMATCH[4]} || otp_issuer=${BASH_REMATCH[4]} + [[ -z $otp_accountname ]] && die "Invalid key URI (missing accountname): $otp_uri" local p=${BASH_REMATCH[7]} local IFS=\&; local params=(${p[@]}); unset IFS @@ -72,49 +62,6 @@ otp_parse_uri() { [[ "$otp_type" == 'hotp' ]] && [[ ! "$otp_counter" =~ $pattern ]] && die "Invalid key URI (missing counter): $otp_uri" } -otp_build_uri() { - local type="$1" issuer="$2" accountname="$3" secret="$4" algorithm="$5" \ - digits="$6" period="$7" counter="$8" - - local uri="otpauth://$type/" - - local pattern='^[^:]+$' - if [[ -n "$issuer" ]]; then - [[ "$issuer" =~ $pattern ]] || die "Invalid character in issuer: ':'" - issuer=$(otp_urlencode "$issuer") - fi - - [[ -z "$accountname" ]] && die "Missing accountname" - [[ "$accountname" =~ $pattern ]] || die "Invalid character in accountname: ':'" - accountname=$(otp_urlencode "$accountname") - - if [[ -n "$issuer" ]]; then - uri+="$issuer:$accountname" - else - uri+="$accountname" - fi - - [[ -z "$secret" ]] && die "Missing secret"; uri+="?secret=$secret" - - case "$1" in - totp) - [[ -n "$algorithm" ]] && uri+="&algorithm=$algorithm" - [[ -n "$digits" ]] && uri+="&digits=$digits" - [[ -n "$period" ]] && uri+="&period=$period" - ;; - - hotp) - [[ -z "$counter" ]] && die "Missing counter"; uri+="&counter=$counter" - ;; - - *) die "Invalid OTP type '$1'" ;; - esac - - [[ -n "$issuer" ]] && uri+="&issuer=$issuer" - - echo "$uri" -} - otp_insert() { local path="${1%/}" local passfile="$PREFIX/$path.gpg" @@ -132,103 +79,23 @@ otp_insert() { $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" <<<"$contents" || die "OTP secret encryption aborted." - [[ -z "$message" ]] && message="Add OTP secret for $path to store." - git_add_file "$passfile" "$message" } -otp_insert_uri() { - local opts force=0 - opts="$($GETOPT -o f -l force -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case $1 in - -f|--force) force=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 || $# -ne 2 ]] && die "Usage: $PROGRAM $COMMAND insert [--force,-f] uri pass-name" - - local uri="$1" - - otp_parse_uri "$uri" - - otp_insert "$2" $force "$otp_uri" -} - -otp_insert_spec() { - local opts contents secret issuer accountname algorithm period digits counter force=0 - local type="$1"; shift - - opts="$($GETOPT -o s:i:n:a:p:d:f -l secret:,issuer:,accountname:,algorithm:,period:,digits:,force -n "$PROGRAM" -- "$@")" - local err=$? - eval set -- "$opts" - while true; do case "$1" in - -s|--secret) secret="$2"; shift 2 ;; - -i|--issuer) issuer="$2"; shift 2 ;; - -n|--accountname) accountname="$2"; shift 2 ;; - -a|--algorithm) algorithm="$2"; shift 2 ;; - -p|--period) period="$2"; shift 2 ;; - -d|--digits) digits="$2"; shift 2 ;; - -f|--force) force=1; shift ;; - --) shift; break ;; - esac done - - [[ $type == "totp" && ($err -ne 0 || $# -ne 1) ]] && - die "Usage: $PROGRAM $COMMAND insert totp [--secret=key,s key] [--issuer=issuer,-i issuer] [--accountname=name,-n name] [--algorithm=algorithm,-a algorithm] [--period=seconds,-p seconds] [--digits=digits,-d digits] [--force,-f] pass-name" - - [[ $type == "hotp" && ($err -ne 0 || $# -ne 2) ]] && - die "Usage: $PROGRAM $COMMAND insert hotp [--secret=key,s key] [--issuer=issuer,-i issuer] [--accountname=accountname,-n accountname] [--digits=digits,-d digits] [--force,-f] pass-name counter" - - local path="$1" counter="$2" - - [[ -n "$algorithm" ]] && case $algorithm in - sha1|sha256|sha512) ;; - *) die "Invalid algorithm '$algorithm'. May be one of 'sha1', 'sha256', or 'sha512'" ;; - esac - - [[ -n "$digits" ]] && case $digits in - 6|8) ;; - *) die "Invalid digits '$digits'. May be one of '6' or '8'" ;; - esac - - if [[ -z $secret ]]; then - read -r -p "Enter secret (base32-encoded): " -s secret || die "Missing secret" - fi - - # Populate issuer and accountname from either options or path - if [[ -z $accountname ]]; then - accountname="$(basename "$path")" - if [[ -z "$issuer" ]]; then - issuer="$(basename "$(dirname "$path")")" - [[ "$issuer" == "." ]] && unset issuer - fi - fi - - local uri; uri=$(otp_build_uri "$type" "$issuer" "$accountname" "$secret" "$algorithm" "$period" "$digits" "$counter") - - otp_insert "$1" $force "$uri" -} - cmd_otp_usage() { cat <<-_EOF Usage: $PROGRAM otp [show] [--clip,-c] pass-name Generate an OTP code and optionally put it on the clipboard. If put on the clipboard, it will be cleared in $CLIP_TIME seconds. - $PROGRAM otp insert totp [--secret=key,-s key] [--algorithm alg,-a alg] - [--period=seconds,-p seconds] - [--digits=digits,-d digits] [--force,-f] pass-name - Insert new TOTP secret. Prompt before overwriting existing password + $PROGRAM otp insert [--force,-f] uri pass-name + Insert new OTP key URI. Prompt before overwriting existing password unless forced. - $PROGRAM otp insert hotp [--secret=secret,-s secret] - [--digits=digits,-d digits] [--force,-f] - pass-name counter - Insert new HOTP secret with initial counter. Prompt before overwriting - existing password unless forced. $PROGRAM otp uri [--clip,-c] [--qrcode,-q] pass-name - Create a secret key URI suitable for importing into other TOTP clients. - Optionally, put it on the clipboard, or display a QR code. + Display the key URI stored in pass-name. Optionally, put it on the + clipboard, or display a QR code. + $PROGRAM otp validate uri + Test if the given URI is a valid OTP key URI. More information may be found in the pass-otp(1) man page. _EOF @@ -236,13 +103,27 @@ _EOF } cmd_otp_insert() { - case "$1" in - totp|hotp) otp_insert_spec "$@" ;; - *) otp_insert_uri "$@" ;; - esac + local opts force=0 + opts="$($GETOPT -o f -l force -n "$PROGRAM" -- "$@")" + local err=$? + eval set -- "$opts" + while true; do case $1 in + -f|--force) force=1; shift ;; + --) shift; break ;; + esac done + + [[ $err -ne 0 || $# -ne 2 ]] && die "Usage: $PROGRAM $COMMAND insert [--force,-f] uri pass-name" + + local uri="$1" + + otp_parse_uri "$uri" + + otp_insert "$2" $force "$otp_uri" "Add OTP secret for $2 to store." } cmd_otp_code() { + [[ -z "$OATH" ]] && die "Failed to generate OTP code: oathtool is not installed." + local opts clip=0 opts="$($GETOPT -o c -l clip -n "$PROGRAM" -- "$@")" local err=$? @@ -272,15 +153,15 @@ cmd_otp_code() { totp) cmd="$OATH -b --totp" [[ -n "$otp_algorithm" ]] && cmd+="=$otp_algorithm" - [[ -n "$otp_period" ]] && cmd+=" --time-step-size=$period"s - [[ -n "$otp_digits" ]] && cmd+=" --digits=$digits" + [[ -n "$otp_period" ]] && cmd+=" --time-step-size=$otp_period"s + [[ -n "$otp_digits" ]] && cmd+=" --digits=$otp_digits" cmd+=" $otp_secret" ;; hotp) local counter=$((otp_counter+1)) cmd="$OATH -b --hotp --counter=$counter" - [[ -n "$otp_digits" ]] && cmd+=" --digits=$digits" + [[ -n "$otp_digits" ]] && cmd+=" --digits=$otp_digits" cmd+=" $otp_secret" ;; esac diff --git a/pass-otp.1 b/pass-otp.1 index 8e67621..ca298dc 100644 --- a/pass-otp.1 +++ b/pass-otp.1 @@ -23,18 +23,18 @@ utility with the command for adding OTP secrets, generating OTP codes, and displaying secret key URIs using the standard \fIotpauth://\fP scheme. -If no COMMAND is specified, COMMAND defaults to \fBshow\fP. +If no COMMAND is specified, COMMAND defaults to \fBcode\fP. .SH COMMANDS .TP -\fBotp show\fP [ \fI--clip\fP, \fI-c\fP ] \fIpass-name\fP +\fBotp code\fP [ \fI--clip\fP, \fI-c\fP ] \fIpass-name\fP Generate and print an OTP code from the secret key stored in \fIpass-name\fP. If \fI--clip\fP or \fI-c\fP is specified, do not print the code but instead copy it to the clipboard using .BR xclip (1) and then restore the clipboard after 45 (or \fIPASSWORD_STORE_CLIP_TIME\fP) -seconds. +seconds. This command is alternatively named \fBshow\fP. .TP \fBotp insert\fP [ \fI--force\fP, \fI-f\fP ] \fIuri\fP \fIpass-name\fP @@ -49,31 +49,11 @@ Prompt before overwriting an existing password, unless \fBadd\fP. .TP -\fBotp insert totp\fP [ \fI--secret\fP=\fIkey\fP, \fI-s\fP \fIkey\fP ] [ \fI--issuer\fP=\fIissuer\fP, \fI-i\fP \fIissuer\fP ] [ \fI--accountname\fP=\fIname\fP, \fI-n\fP \fIname\fP ] [ \fI--algorithm\fP=\fIalgorithm\fP, \fI-a\fP \fIalgorithm\fP ] [ \fI--period\fP=\fIperiod\fP, \fI-p\fP \fIperiod\fP ] [ \fI--digits\fP=\fIdigits\fP, \fI-d\fP \fIdigits\fP ] [ \fI--force\fP, \fI-f\fP ] \fIpass-name\fP +\fBotp uri\fP [ \fI--clip\fP, \fI-c\fP | \fI--qrcode\fP, \fI-q\fP ] \fIpass-name\fP -Insert a new TOTP secret into the password store called \fIpass-name\fP. If -\fI--secret\fP or \fI-s\fP are not specified, this will read \fIKEY\fP from -standard in. Prompt before overwriting an existing password, unless -\fI--force\fP or \fI-f\fP is specified. This command is alternatively named -\fBadd totp\fP. - -.TP -\fBotp insert hotp\fP [ \fI--secret\fP=\fIkey\fP, \fI-s\fP \fIkey\fP ] [ \fI--issuer\fP=\fIissuer\fP, \fI-i\fP \fIissuer\fP ] [ \fI--accountname\fP=\fIname\fP, \fI-n\fP \fIname\fP ] [ \fI--digits\fP=\fIdigits\fP, \fI-d\fP \fIdigits\fP ] [ \fI--force\fP, \fI-f\fP ] \fIpass-name\fP \fIcounter\fP - -Insert a new HOTP secret into the password store called \fIpass-name\fP. A -\fIcounter\fP argument is required, which is an integer specifying the initial -HOTP counter stored alongside the secret. If -\fI--secret\fP or \fI-s\fP are not specified, this will read \fIKEY\fP from -standard in. Prompt before overwriting an existing password, unless -\fI--force\fP or \fI-f\fP is specified. This command is alternatively named -\fBadd hotp\fP. - -.TP -\fBotp uri\fP [ \fI--clip\fP, \fI-c\fP | \fI--qrcode\fP, \fI-q\fP ] pass-name - -Create and print a URI encoding the secret key and OTP parameters using the -standard \fIotpauth://\fP scheme. If \fI--clip\fP or \fI-c\fP is specified, do -not print the URI but instead copy it to the clipboard using +Print the key URI stored in \fIpass-name\fP to stdout. If \fI--clip\fP or +\fI-c\fP is specified, do not print the URI but instead copy it to the clipboard +using .BR xclip (1) and then restore the clipboard after 45 (or \fIPASSWORD_STORE_CLIP_TIME\fP) seconds. If \fI--qrcode\fP or \fI-q\fP is specified, do not print the URI but @@ -81,6 +61,14 @@ instead display a QR code using .BR qrencode (1) either to the terminal or graphically if supported. +.TP +\fBotp validate\fP \fIuri\fP + +Test a URI string for validity according to the Key Uri Format. For more +information about this format, see the documentation at +.UR https://\:github.\:com/\:google/\:google-authenticator/\:wiki/\:Key-Uri-Format +.UE . + .SH OPTIONS .TP @@ -89,30 +77,10 @@ Put the OTP code in the clipboard. .TP \fB\-f\fP, \fB--force\fP -Force to update and do not wait for user instruction. - -.TP -\fB-s\fP \fIkey\fP, \fB--secret\fR=\fIkey\fP -Provide a secret \fIkey\fP. This key must be base32-encoded. - -.TP -\fB-a\fP \fIalgorithm\fP, \fB--algorithm\fP=\fIalgorithm\fP -Specify the \fIalgorithm\fP for a TOTP secret. Accepted values are \fIsha1\fP, -\fIsha256\fP, and \fIsha512\fP. This option defaults to \fIsha1\fP. - -.TP -\fB-p\fP \fIperiod\fP, \fB--period\fP=\fIperiod\fP -Specify the \fIperiod\fP for a TOTP secret, in seconds. This option defaults to -\fI30\fP. - -.TP -\fB-d\fP \fIdigits\fP, \fB--digits\fP=\fIdigits\fP -Specify the number of \fIdigits\fP this secret should generate when used with -\fBshow\fP. Accepted values are \fI6\fP and \fI8\fP. This option defaults to -\fI6\fP. +Force update and do not wait for user instruction. .TP -\fB\-h\fB, \-\-help\fR +\fBhelp\fP, \fB\-h\fB, \-\-help\fR Show usage message. .SH SEE ALSO diff --git a/test/insert.t b/test/insert.t index 228a8ec..da6477c 100755 --- a/test/insert.t +++ b/test/insert.t @@ -32,42 +32,4 @@ test_expect_success 'Force overwrites key URI' ' [[ $("$PASS" show passfile) == "$uri2" ]] ' -test_expect_success 'Inserts a basic TOTP key' ' - uri="otpauth://totp/passfile?secret=AAAAAAAAAAAAAAAAAAAAA" - - test_pass_init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile && - [[ $("$PASS" show passfile) == "$uri" ]] -' - -test_expect_success 'Inserts a TOTP key with issuer in path' ' - uri="otpauth://totp/example.com:passfile?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=example.com" - - test_pass_init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA example.com/passfile && - [[ $("$PASS" show example.com/passfile) == "$uri" ]] -' - -test_expect_success 'Inserts a TOTP key with issuer in nested path' ' - uri="otpauth://totp/foo:passfile?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=foo" - - test_pass_init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA example.com/foo/passfile && - [[ $("$PASS" show example.com/foo/passfile) == "$uri" ]] -' - -test_expect_success 'Inserts a TOTP key with spaces in path' ' - uri="otpauth://totp/example%20dot%20com:pass%20file?secret=AAAAAAAAAAAAAAAAAAAAA&issuer=example%20dot%20com" - test_pass_init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA "example dot com/pass file" && - [[ $("$PASS" show "example dot com/pass file") == "$uri" ]] -' - -test_expect_success 'Commits insert to git' ' - test_pass_init && - pass git init && - "$PASS" otp insert totp -s AAAAAAAAAAAAAAAAAAAAA passfile && - git log --no-decorate -1 | grep "Add OTP secret for passfile to store." -' - test_done -- cgit v1.2.3 From acfab191e6bb33f840f0a7106c3eb4cd1ab76267 Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sun, 19 Mar 2017 23:09:24 -0700 Subject: Support --echo and reading key from stdin --- otp.bash | 50 +++++++++++++++++++++++++++++++++++++------------- pass-otp.1 | 14 ++++++++------ test/insert.t | 24 ++++++++++++++++++++++++ 3 files changed, 69 insertions(+), 19 deletions(-) (limited to 'test/insert.t') diff --git a/otp.bash b/otp.bash index 664a37b..8b80554 100755 --- a/otp.bash +++ b/otp.bash @@ -88,9 +88,10 @@ Usage: $PROGRAM otp [show] [--clip,-c] pass-name Generate an OTP code and optionally put it on the clipboard. If put on the clipboard, it will be cleared in $CLIP_TIME seconds. - $PROGRAM otp insert [--force,-f] uri pass-name - Insert new OTP key URI. Prompt before overwriting existing password - unless forced. + $PROGRAM otp insert [--force,-f] [--echo,-e] [uri] pass-name + Insert a new OTP key URI. If one is not supplied, it will be read from + stdin. Optionally, echo the input. Prompt before overwriting existing + password unless forced. $PROGRAM otp uri [--clip,-c] [--qrcode,-q] pass-name Display the key URI stored in pass-name. Optionally, put it on the clipboard, or display a QR code. @@ -103,22 +104,45 @@ _EOF } cmd_otp_insert() { - local opts force=0 - opts="$($GETOPT -o f -l force -n "$PROGRAM" -- "$@")" + local opts force=0 echo=0 + opts="$($GETOPT -o fe -l force,echo -n "$PROGRAM" -- "$@")" local err=$? eval set -- "$opts" while true; do case $1 in - -f|--force) force=1; shift ;; - --) shift; break ;; - esac done - - [[ $err -ne 0 || $# -ne 2 ]] && die "Usage: $PROGRAM $COMMAND insert [--force,-f] uri pass-name" + -f|--force) force=1; shift ;; + -e|--echo) echo=1; shift ;; + --) shift; break ;; + esac done - local uri="$1" + [[ $err -ne 0 || ($# -ne 1 && $# -ne 2) ]] && die "Usage: $PROGRAM $COMMAND insert [--force,-f] [uri] pass-name" + + local path uri + if [[ $# -eq 1 ]]; then + path="$1" + if [[ -t 0 ]]; then + if [[ $echo -eq 0 ]]; then + while true; do + read -r -p "Enter otpauth:// URI for $path: " -s uri || exit 1 + echo + read -r -p "Retype otpauth:// URI for $path: " -s uri_again || exit 1 + echo + [[ "$uri" == "$uri_again" ]] && break + die "Error: the entered URIs do not match." + done + else + read -r -p "Enter otpauth:// URI for $path: " -e uri + fi + else + read -r uri + fi + else + uri="$1" + path="$2" + fi otp_parse_uri "$uri" - otp_insert "$2" $force "$otp_uri" "Add OTP secret for $2 to store." + otp_insert "$path" $force "$otp_uri" "Add OTP secret for $2 to store." } cmd_otp_code() { @@ -217,7 +241,7 @@ cmd_otp_uri() { } cmd_otp_validate() { - otp_parse_uri "$1" + otp_parse_uri "$1" } case "$1" in diff --git a/pass-otp.1 b/pass-otp.1 index ca298dc..69ff10d 100644 --- a/pass-otp.1 +++ b/pass-otp.1 @@ -1,4 +1,4 @@ -.TH PASS-OTP 1 "2017 February 14" "Password store OTP extension" +.TH PASS-OTP 1 "2017 March 19" "Password store OTP extension" .SH NAME pass-otp - A \fBpass\fP(1) extension for managing one-time-password (OTP) tokens. @@ -30,21 +30,23 @@ If no COMMAND is specified, COMMAND defaults to \fBcode\fP. .TP \fBotp code\fP [ \fI--clip\fP, \fI-c\fP ] \fIpass-name\fP -Generate and print an OTP code from the secret key stored in \fIpass-name\fP. If -\fI--clip\fP or \fI-c\fP is specified, do not print the code but instead copy it to the clipboard using -.BR xclip (1) +Generate and print an OTP code from the secret key stored in \fIpass-name\fP +using \fBoathtool\fP(1). If \fI--clip\fP or \fI-c\fP is specified, do not print +the code but instead copy it to the clipboard using \fBxclip\fP(1) and then restore the clipboard after 45 (or \fIPASSWORD_STORE_CLIP_TIME\fP) seconds. This command is alternatively named \fBshow\fP. .TP -\fBotp insert\fP [ \fI--force\fP, \fI-f\fP ] \fIuri\fP \fIpass-name\fP +\fBotp insert\fP [ \fI--force\fP, \fI-f\fP ] [ \fI--echo\fP, \fI-e\fP ] [ \fIuri\fP ] \fIpass-name\fP Insert a new OTP secret specified by \fIuri\fP into the password store at \fIpass-name\fP. \fIuri\fP must be formatted according to the Key Uri Format; see the documentation at .UR https://\:github.\:com/\:google/\:google-authenticator/\:wiki/\:Key-Uri-Format .UE . -Prompt before overwriting an existing password, unless +If \fIuri\fP is not specified, it will be consumed from stdin; specify +\fI--echo\fP or \fI-e\fP to show a visible prompt when running this command +interactively. Prompt before overwriting an existing password, unless \fI--force\fP or \fI-f\fP is specified. This command is alternatively named \fBadd\fP. diff --git a/test/insert.t b/test/insert.t index da6477c..0c19d11 100755 --- a/test/insert.t +++ b/test/insert.t @@ -32,4 +32,28 @@ test_expect_success 'Force overwrites key URI' ' [[ $("$PASS" show passfile) == "$uri2" ]] ' +test_expect_success 'Reads non-terminal input' ' + uri="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example" + + test_pass_init && + "$PASS" otp insert passfile <<< "$uri" && + [[ $("$PASS" show passfile) == "$uri" ]] +' + +test_expect_success 'Reads terminal input in noecho mode' ' + uri="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example" + + test_pass_init && + test_faketty "$PASS" otp insert passfile < <(echo -ne "$uri\n$uri\n") && + [[ $("$PASS" show passfile) == "$uri" ]] +' + +test_expect_success 'Reads terminal input in echo mode' ' + uri="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example" + + test_pass_init && + test_faketty "$PASS" otp insert -e passfile <<< "$uri" && + [[ $("$PASS" show passfile) == "$uri" ]] +' + test_done -- cgit v1.2.3 From 224c4dc57ee42215806c6fb8b92e64ddebaa7fd7 Mon Sep 17 00:00:00 2001 From: Tad Fisher Date: Sun, 19 Mar 2017 23:48:03 -0700 Subject: Use expect for interactive tests --- .travis.yml | 1 + otp.bash | 14 ++++++-------- test/insert.t | 45 ++++++++++++++++++++++++++++++++++++++------- test/setup.sh | 6 ++---- 4 files changed, 47 insertions(+), 19 deletions(-) (limited to 'test/insert.t') diff --git a/.travis.yml b/.travis.yml index cd537e0..4122f71 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,6 +7,7 @@ addons: sources: - debian-sid packages: + - expect - oathtool - shellcheck diff --git a/otp.bash b/otp.bash index 8b80554..91661d8 100755 --- a/otp.bash +++ b/otp.bash @@ -121,16 +121,14 @@ cmd_otp_insert() { path="$1" if [[ -t 0 ]]; then if [[ $echo -eq 0 ]]; then - while true; do - read -r -p "Enter otpauth:// URI for $path: " -s uri || exit 1 - echo - read -r -p "Retype otpauth:// URI for $path: " -s uri_again || exit 1 - echo - [[ "$uri" == "$uri_again" ]] && break - die "Error: the entered URIs do not match." - done + read -r -p "Enter otpauth:// URI for $path: " -s uri || exit 1 + echo + read -r -p "Retype otpauth:// URI for $path: " -s uri_again || exit 1 + echo + [[ "$uri" == "$uri_again" ]] || die "Error: the entered URIs do not match." else read -r -p "Enter otpauth:// URI for $path: " -e uri + echo fi else read -r uri diff --git a/test/insert.t b/test/insert.t index 0c19d11..b4af4f5 100755 --- a/test/insert.t +++ b/test/insert.t @@ -16,9 +16,18 @@ test_expect_success 'Prompts before overwriting key URI' ' uri1="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Foo" uri2="otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Bar" - test_pass_init && - "$PASS" otp insert "$uri1" passfile && - test_faketty "$PASS" otp insert "$uri2" passfile < <(echo n) && + test_pass_init + "$PASS" otp insert "$uri1" passfile + expect <