Pure nix flake; replace crypto-simple with Saltine; update README and TODO

src/Feature/Sharing/SQLite.hs

@@ -4,18 +4,19 @@ import           Core.SQLite
 import           Core.Types
 import           Feature.Generation.Passwords (Password)
 
-import           Control.Monad.Reader         (ask, lift, liftIO)
-import           Crypto.Simple.CBC            (decrypt, encrypt)
-import           Data.List.Split              (splitOn)
-import           Data.Maybe                   (listToMaybe)
-import           Data.Time.Clock.POSIX        (getPOSIXTime)
+import           Control.Monad.Reader          (ask, lift, liftIO)
+import           Data.List.Split               (splitOn)
+import           Data.Maybe                    (listToMaybe, fromMaybe)
+import           Data.Time.Clock.POSIX         (getPOSIXTime)
 import           Database.SQLite.Simple
 
-import qualified Data.ByteString.Base64       as B64
-import qualified Data.ByteString.Char8        as B
-import qualified Data.Text                    as T
-import qualified Data.Text.Encoding           as ET
-import qualified Data.Text.Lazy               as LT
+import qualified Crypto.Saltine.Core.SecretBox     as Box
+import qualified Crypto.Saltine.Internal.SecretBox as IBox
+import qualified Data.ByteString.Base64            as B64
+import qualified Data.ByteString.Char8             as B
+import qualified Data.Text                         as T
+import qualified Data.Text.Encoding                as ET
+import qualified Data.Text.Lazy                    as LT
 
 findByLink :: String -> PurrAction (Maybe T.Text)
 findByLink link = do
@@ -30,7 +31,8 @@ insertNewSecret :: T.Text -> Integer -> T.Text -> Integer -> PurrAction ()
 insertNewSecret sec life link maxViews = do
   db     <- dbPath
   key    <- encKey
-  encSec <- liftIO $ encryptSecret key sec
+  nonce  <- liftIO $ Box.newNonce
+  let encSec = encryptSecret key sec nonce
   conn   <- liftIO $ open db
   time   <- liftIO $ epochTime
   liftIO  $ execute conn
@@ -41,12 +43,10 @@ insertNewSecret sec life link maxViews = do
 readEncryptedSecret :: String -> [SecretEntry] -> PurrAction (Maybe T.Text)
 readEncryptedSecret key sec = do
   db     <- dbPath
+  nonce  <- liftIO $ Box.newNonce
   liftIO  $ incViews sec db
   delete <- liftIO $ deleteExpiredSecret sec db
-  decKey <- liftIO ( sequence
-                   $ decryptSecret key
-                 <$> decodeSecret
-                 <$> listToMaybe sec )
+  let decKey = decryptSecret key nonce $ decodeSecret $ safeHead failedSecret sec
   if (delete)
     then return Nothing
     else return (ET.decodeLatin1 <$> decKey)
@@ -83,11 +83,19 @@ encodeSecret b = ET.decodeUtf8 $ B64.encode b
 decodeSecret :: SecretEntry -> B.ByteString
 decodeSecret s = B64.decodeLenient $ ET.encodeUtf8 (secret s)
 
-encryptSecret :: String -> T.Text -> IO B.ByteString
-encryptSecret k s = encrypt (B.pack k) (ET.encodeUtf8 s)
+encryptSecret :: String -> T.Text -> Box.Nonce ->  B.ByteString
+encryptSecret k s n = do 
+  Box.secretbox (IBox.Key $ B.pack k) n (ET.encodeUtf8 s)
 
-decryptSecret :: String -> B.ByteString -> IO B.ByteString
-decryptSecret k b = decrypt (B.pack k) b
+decryptSecret :: String -> Box.Nonce -> B.ByteString -> Maybe B.ByteString
+decryptSecret k n b = Box.secretboxOpen (IBox.Key $ B.pack k) n b
 
 epochTime :: IO Integer
 epochTime = fmap round getPOSIXTime
+
+failedSecret :: SecretEntry
+failedSecret = SecretEntry "fail" "fail" 0 0 0 0
+
+safeHead :: a -> [a] -> a
+safeHead x [] = x
+safeHead x l  = head l

src/Lib.hs

@@ -6,12 +6,14 @@ import qualified Core.SQLite          as DB
 import           Core.Types
 
 import           Control.Monad.Reader (lift, liftIO, runReaderT)
+import           Crypto.Saltine       (sodiumInit)
 import           GHC.Natural          (popCountNatural)
 import           Prelude              hiding (id)
 import           Web.Scotty.Trans     (scottyT)
 
 main :: IO ()
 main = do
+  sodiumInit
   dhallConf <- liftIO Configuration.main
   DB.main (dbFile dhallConf)
   scottyT (applicationPort dhallConf) (flip runApp dhallConf) HTTP.app where