webylib 0.3.0

Webcash HD wallet library — bearer e-cash with BIP32-style key derivation, SQLite storage, AES-256-GCM encryption, and full C FFI for cross-platform SDKs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225

//! Wallet encryption — database-level and seed-level encryption.

use std::fs;
use std::path::PathBuf;

use super::Wallet;
use crate::error::{Error, Result};
use crate::passkey::{
    decrypt_with_password, encrypt_with_password, EncryptedData, EncryptionConfig,
    PasskeyEncryption,
};

impl Wallet {
    /// Check if a database file is encrypted (not a valid SQLite header).
    pub fn is_database_encrypted(path: &PathBuf) -> Result<bool> {
        if !path.exists() {
            return Ok(false);
        }
        let bytes = fs::read(path)
            .map_err(|e| Error::wallet(format!("Failed to read database file: {}", e)))?;
        if bytes.len() < 16 {
            return Ok(false);
        }
        let sqlite_magic = b"SQLite format 3\0";
        Ok(!bytes.starts_with(sqlite_magic))
    }

    /// Decrypt database for runtime use (returns path to temp decrypted file).
    pub(crate) async fn decrypt_database_for_runtime(encrypted_path: &PathBuf) -> Result<PathBuf> {
        let encrypted_bytes = fs::read(encrypted_path)
            .map_err(|e| Error::wallet(format!("Failed to read encrypted database: {}", e)))?;
        let encrypted_data: EncryptedData = serde_json::from_slice(&encrypted_bytes)
            .map_err(|e| Error::wallet(format!("Invalid encrypted database format: {}", e)))?;

        let file_name = encrypted_path
            .file_name()
            .and_then(|n| n.to_str())
            .unwrap_or("default");
        let mut passkey = PasskeyEncryption::new(EncryptionConfig {
            app_identifier: "com.webycash.webylib".to_string(),
            service_name: format!("WalletEncryption_{}", file_name),
            ..EncryptionConfig::default()
        })?;
        let decrypted_bytes = passkey
            .decrypt_with_passkey(&encrypted_data)
            .await
            .map_err(|e| Error::wallet(format!("Failed to decrypt database: {}", e)))?;
        let temp_path = encrypted_path.with_extension("temp.db");
        fs::write(&temp_path, decrypted_bytes)
            .map_err(|e| Error::wallet(format!("Failed to write decrypted database: {}", e)))?;
        Ok(temp_path)
    }

    /// Encrypt the wallet database with a password.
    pub async fn encrypt_database_with_password(&self, password: &str) -> Result<()> {
        let db_bytes = fs::read(&self.path)
            .map_err(|e| Error::wallet(format!("Failed to read database: {}", e)))?;
        let encrypted_data = encrypt_with_password(&db_bytes, password)?;
        let encrypted_json = serde_json::to_vec_pretty(&encrypted_data)
            .map_err(|e| Error::wallet(format!("Failed to serialize encrypted data: {}", e)))?;
        fs::write(&self.path, encrypted_json)
            .map_err(|e| Error::wallet(format!("Failed to write encrypted database: {}", e)))?;
        Ok(())
    }

    /// Decrypt the wallet database with a password.
    pub async fn decrypt_database_with_password(&self, password: &str) -> Result<()> {
        let encrypted_bytes = fs::read(&self.path)
            .map_err(|e| Error::wallet(format!("Failed to read encrypted database: {}", e)))?;
        let encrypted_data: EncryptedData = serde_json::from_slice(&encrypted_bytes)
            .map_err(|e| Error::wallet(format!("Invalid encrypted database format: {}", e)))?;
        let decrypted_bytes = decrypt_with_password(&encrypted_data, password)
            .map_err(|e| Error::wallet(format!("Failed to decrypt database: {}", e)))?;
        fs::write(&self.path, decrypted_bytes)
            .map_err(|e| Error::wallet(format!("Failed to write decrypted database: {}", e)))?;
        Ok(())
    }

    /// Encrypt the wallet database using passkey keys.
    pub async fn encrypt_database(&self) -> Result<()> {
        if !self.is_encrypted {
            return Err(Error::wallet("Wallet is not configured for encryption"));
        }
        let mut passkey = self
            .passkey_encryption
            .as_ref()
            .ok_or_else(|| Error::wallet("Passkey encryption not available"))?
            .lock()
            .map_err(|_| Error::wallet("Failed to acquire passkey lock"))?;

        let db_bytes = if let Some(temp_path) = &self.temp_db_path {
            fs::read(temp_path)
                .map_err(|e| Error::wallet(format!("Failed to read temp database: {}", e)))?
        } else {
            fs::read(&self.path)
                .map_err(|e| Error::wallet(format!("Failed to read database: {}", e)))?
        };

        let encrypted_data = passkey.encrypt_with_passkey(&db_bytes).await?;
        let encrypted_json = serde_json::to_vec_pretty(&encrypted_data)
            .map_err(|e| Error::wallet(format!("Failed to serialize encrypted data: {}", e)))?;
        fs::write(&self.path, encrypted_json)
            .map_err(|e| Error::wallet(format!("Failed to write encrypted database: {}", e)))?;

        if let Some(temp_path) = &self.temp_db_path {
            let _ = fs::remove_file(temp_path);
        }
        Ok(())
    }

    /// Decrypt the wallet database (must be done during open).
    pub async fn decrypt_database(&self) -> Result<()> {
        if !self.is_encrypted {
            return Err(Error::wallet("Wallet is not encrypted"));
        }
        if self.temp_db_path.is_some() {
            return Ok(());
        }
        Err(Error::wallet(
            "Database decryption must be done during wallet opening",
        ))
    }

    /// Encrypt the entire wallet using passkey authentication.
    /// Creates a PasskeyEncryption instance on the fly if not already present.
    pub async fn encrypt_with_passkey(&self) -> Result<EncryptedData> {
        use crate::passkey::{EncryptionConfig, PasskeyEncryption};

        let wallet_data = self.export_wallet_data().await?;

        if let Some(ref passkey_mutex) = self.passkey_encryption {
            let mut passkey = passkey_mutex
                .lock()
                .map_err(|_| Error::wallet("Failed to acquire passkey lock"))?;
            passkey
                .encrypt_with_passkey(&wallet_data)
                .await
                .map_err(|e| Error::wallet(format!("Passkey encryption failed: {}", e)))
        } else {
            // Create passkey on the fly for one-shot encryption
            let mut passkey = PasskeyEncryption::new(EncryptionConfig {
                app_identifier: "com.webycash.webylib".to_string(),
                service_name: format!(
                    "WalletEncryption_{}",
                    self.path
                        .file_name()
                        .and_then(|n| n.to_str())
                        .unwrap_or("default")
                ),
                ..EncryptionConfig::default()
            })?;
            passkey
                .encrypt_with_passkey(&wallet_data)
                .await
                .map_err(|e| Error::wallet(format!("Passkey encryption failed: {}", e)))
        }
    }

    /// Decrypt and restore wallet data using passkey authentication.
    /// Creates a PasskeyEncryption instance on the fly if not already present.
    pub async fn decrypt_with_passkey(&self, encrypted_data: &EncryptedData) -> Result<()> {
        use crate::passkey::{EncryptionConfig, PasskeyEncryption};

        if let Some(ref passkey_mutex) = self.passkey_encryption {
            let mut passkey = passkey_mutex
                .lock()
                .map_err(|_| Error::wallet("Failed to acquire passkey lock"))?;
            let wallet_data = passkey
                .decrypt_with_passkey(encrypted_data)
                .await
                .map_err(|e| Error::wallet(format!("Passkey decryption failed: {}", e)))?;
            self.import_wallet_data(&wallet_data).await
        } else {
            let mut passkey = PasskeyEncryption::new(EncryptionConfig {
                app_identifier: "com.webycash.webylib".to_string(),
                service_name: format!(
                    "WalletEncryption_{}",
                    self.path
                        .file_name()
                        .and_then(|n| n.to_str())
                        .unwrap_or("default")
                ),
                ..EncryptionConfig::default()
            })?;
            let wallet_data = passkey
                .decrypt_with_passkey(encrypted_data)
                .await
                .map_err(|e| Error::wallet(format!("Passkey decryption failed: {}", e)))?;
            self.import_wallet_data(&wallet_data).await
        }
    }

    /// Encrypt wallet with password (fallback when passkeys unavailable).
    pub async fn encrypt_with_password(&self, password: &str) -> Result<EncryptedData> {
        let wallet_data = self.export_wallet_data().await?;
        crate::passkey::encrypt_with_password(&wallet_data, password)
    }

    /// Decrypt wallet with password.
    pub async fn decrypt_with_password(
        &self,
        encrypted_data: &EncryptedData,
        password: &str,
    ) -> Result<()> {
        let wallet_data = crate::passkey::decrypt_with_password(encrypted_data, password)?;
        self.import_wallet_data(&wallet_data).await
    }

    /// Check if passkey encryption is enabled for this wallet.
    pub fn is_passkey_enabled(&self) -> bool {
        self.passkey_encryption.is_some()
    }

    /// Check if passkey authentication is available on the current device.
    pub async fn is_passkey_available(&self) -> Result<bool> {
        if let Some(ref passkey_mutex) = self.passkey_encryption {
            let passkey = passkey_mutex
                .lock()
                .map_err(|_| Error::wallet("Failed to acquire passkey lock"))?;
            passkey.is_passkey_available().await
        } else {
            Ok(false)
        }
    }
}