Documentation
¶
Overview ¶
Package remote stores this device's connection to a SyncMyEnv server (cloud or self-hosted) and syncs the vault with it.
Index ¶
- Constants
- Variables
- func Delete() error
- func FetchKeyring(ctx context.Context, cfg *Config, c *protocol.Client, wantFingerprint string) (*crypto.KeyFile, error)
- type Config
- type PullResult
- type Syncer
- func (s *Syncer) Authorize(ctx context.Context, key *crypto.VaultKey) error
- func (s *Syncer) Authorized(ctx context.Context) bool
- func (s *Syncer) EnsureVault(ctx context.Context) (created bool, err error)
- func (s *Syncer) Incoming(ctx context.Context) ([]protocol.StoredEntry, int64, error)
- func (s *Syncer) Pull(ctx context.Context, key *crypto.VaultKey, entries []protocol.StoredEntry, ...) (*PullResult, error)
- func (s *Syncer) Push(ctx context.Context) (int, error)
Constants ¶
const DefaultServer = "https://cloud.syncmyenv.com"
DefaultServer is SyncMyEnv Cloud.
Variables ¶
var ErrNoRemoteVault = errors.New("no vault on this account yet — run `sme init` on your main machine and `sme sync` there first")
ErrNoRemoteVault means the account has no vault yet and there's no local one to upload.
var ErrNotAuthorized = errors.New("this device isn't authorized to push yet — run `sme sync` once (asks for your master password)")
ErrNotAuthorized means this device has no certificate yet: run `sme sync` interactively once (it asks for the master password to certify the device).
var ErrNotLoggedIn = errors.New("not connected to a server — run `sme login`")
ErrNotLoggedIn means `sme login` hasn't been run.
Functions ¶
func FetchKeyring ¶
func FetchKeyring(ctx context.Context, cfg *Config, c *protocol.Client, wantFingerprint string) (*crypto.KeyFile, error)
FetchKeyring downloads the account's vault key file on a machine that has no local vault yet (new laptop). It picks the account's only vault, or the one matching wantFingerprint.
Types ¶
type Config ¶
type Config struct {
Server string `json:"server"`
Token string `json:"token"`
DeviceID string `json:"device_id"`
DeviceName string `json:"device_name"`
Email string `json:"email"`
VaultID string `json:"vault_id,omitempty"`
}
Config is ~/.syncmyenv/remote.json (0600).
The device token is a bearer secret. It can read/write this account's *ciphertext* only; it can't decrypt anything and can't approve devices. TODO: move the token to the OS keychain.
type PullResult ¶
type PullResult struct {
Imported []vault.ImportResult
Rejected int // entries that failed authentication (forged or corrupted) — skipped
}
PullResult summarizes a pull.
type Syncer ¶
type Syncer struct {
V *vault.Vault // nil on a fresh machine until the keyring is fetched
Cfg *Config
Client *protocol.Client
}
Syncer pushes local revisions to the server and pulls other devices' ones.
func (*Syncer) Authorize ¶
Authorize certifies this device's signing key with the unlocked vault key. Needed once per device; afterwards pushes are password-free.
func (*Syncer) Authorized ¶
Authorized reports whether this device has a certificate.
func (*Syncer) EnsureVault ¶
EnsureVault links the local vault to a server vault, creating it (and uploading the keyring) on first sync. Returns whether it was created.
func (*Syncer) Incoming ¶
Incoming counts log entries from other devices not yet pulled (no key needed).
func (*Syncer) Pull ¶
func (s *Syncer) Pull(ctx context.Context, key *crypto.VaultKey, entries []protocol.StoredEntry, cursor int64) (*PullResult, error)
Pull verifies and imports entries (from Incoming) with the unlocked vault key, then advances the cursor. Every entry must carry a device certificate made with *this vault's* key and a valid signature from that device; anything else — e.g. something the server made up — is rejected.
Source Files