From 555ddace308dba938047ec29ff8182f0f8be8414 Mon Sep 17 00:00:00 2001
From: Yogesh Choudhary Paliyal <paliyalyogesh@gmail.com>
Date: Sun, 23 Jul 2023 11:16:57 +0530
Subject: [PATCH] Added support for Encrypted database, migration from
 non-encrypted from encrypted DB (#626)

* security in db

* feat: add sqlite cipher

* feat: added support for db encryption

* feat: run spotless
---
 .../ui/nav/DashboardComposeActivity.kt        | 13 ++--
 app/src/main/res/layout/activity_crash.xml    | 17 +++--
 common/build.gradle.kts                       |  5 +-
 common/proguard-rules.pro                     |  5 +-
 .../com/yogeshpaliyal/common/AppDatabase.kt   |  3 +-
 .../yogeshpaliyal/common/data/UserSettings.kt |  1 +
 .../common/di/module/AppModule.kt             | 67 +++++++++++++++++--
 .../common/utils/SharedPreferenceUtils.kt     |  6 ++
 .../common/utils/UserSettingsDataStore.kt     |  7 +-
 .../common/utils/UserSettingsSerializer.kt    |  3 -
 .../utils/UserSettingsSerializerLegacy.kt     | 40 -----------
 .../common/worker/AutoBackupWorker.kt         |  2 +-
 12 files changed, 100 insertions(+), 69 deletions(-)
 delete mode 100644 common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializerLegacy.kt

diff --git a/app/src/main/java/com/yogeshpaliyal/keypass/ui/nav/DashboardComposeActivity.kt b/app/src/main/java/com/yogeshpaliyal/keypass/ui/nav/DashboardComposeActivity.kt
index 37c7c709..5d48e860 100644
--- a/app/src/main/java/com/yogeshpaliyal/keypass/ui/nav/DashboardComposeActivity.kt
+++ b/app/src/main/java/com/yogeshpaliyal/keypass/ui/nav/DashboardComposeActivity.kt
@@ -148,7 +148,7 @@ fun Dashboard() {
         Surface(modifier = Modifier.padding(paddingValues)) {
             CurrentPage()
 
-            OptionBottomBar()
+            BottomSheet()
         }
     }
 }
@@ -195,15 +195,20 @@ fun CurrentPage() {
 }
 
 @Composable
-fun OptionBottomBar(
-    viewModel: BottomNavViewModel = androidx.lifecycle.viewmodel.compose.viewModel()
-) {
+fun BottomSheet() {
     val bottomSheetState by selectState<KeyPassState, BottomSheetState?> { this.bottomSheet }
 
     if (bottomSheetState?.isBottomSheetOpen != true) {
         return
     }
 
+    OptionBottomBar()
+}
+
+@Composable
+fun OptionBottomBar(
+    viewModel: BottomNavViewModel = androidx.lifecycle.viewmodel.compose.viewModel()
+) {
     val dispatchAction = rememberDispatcher()
 
     val navigationItems by viewModel.navigationList.observeAsState()
diff --git a/app/src/main/res/layout/activity_crash.xml b/app/src/main/res/layout/activity_crash.xml
index 4d8b0c7e..367042f3 100644
--- a/app/src/main/res/layout/activity_crash.xml
+++ b/app/src/main/res/layout/activity_crash.xml
@@ -12,18 +12,25 @@
         android:layout_height="match_parent"
         tools:context=".ui.CrashActivity">
 
-        <com.google.android.material.textview.MaterialTextView
-            android:layout_width="wrap_content"
-            android:layout_height="wrap_content"
+        <ScrollView
+            android:layout_width="0dp"
+            android:layout_height="0dp"
             app:layout_constraintTop_toTopOf="parent"
             app:layout_constraintStart_toStartOf="parent"
             app:layout_constraintEnd_toEndOf="parent"
-            app:layout_constraintBottom_toTopOf="@id/btnSendFeedback"
-            android:layout_margin="@dimen/grid_4"
+            android:padding="@dimen/grid_4"
+            app:layout_constraintBottom_toTopOf="@id/btnSendFeedback">
+
+        <com.google.android.material.textview.MaterialTextView
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
             app:layout_constrainedWidth="true"
+            tools:text="@tools:sample/lorem/random"
             android:id="@+id/txtCrash"
             app:layout_constrainedHeight="true"/>
 
+        </ScrollView>
+
 
 
         <com.google.android.material.button.MaterialButton
diff --git a/common/build.gradle.kts b/common/build.gradle.kts
index 08f8f5b5..04af5e7b 100644
--- a/common/build.gradle.kts
+++ b/common/build.gradle.kts
@@ -11,7 +11,7 @@ android {
     compileSdk = 33
 
     defaultConfig {
-        minSdk = 21
+        minSdk = 23
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -72,4 +72,7 @@ dependencies {
     implementation("androidx.test.ext:junit-ktx:1.1.5")
     androidTestApi("androidx.test:rules:1.5.0")
 
+    implementation("net.zetetic:android-database-sqlcipher:4.5.4")
+    implementation("androidx.sqlite:sqlite:2.3.1")
+
 }
diff --git a/common/proguard-rules.pro b/common/proguard-rules.pro
index ff59496d..448138ce 100644
--- a/common/proguard-rules.pro
+++ b/common/proguard-rules.pro
@@ -18,4 +18,7 @@
 
 # If you keep the line number information, uncomment this to
 # hide the original source file name.
-#-renamesourcefileattribute SourceFile
\ No newline at end of file
+#-renamesourcefileattribute SourceFile
+
+-keep,includedescriptorclasses class net.sqlcipher.** { *; }
+-keep,includedescriptorclasses interface net.sqlcipher.** { *; }
\ No newline at end of file
diff --git a/common/src/main/java/com/yogeshpaliyal/common/AppDatabase.kt b/common/src/main/java/com/yogeshpaliyal/common/AppDatabase.kt
index 13c16d11..0ebcb4a9 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/AppDatabase.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/AppDatabase.kt
@@ -15,10 +15,11 @@ import com.yogeshpaliyal.common.db.DbDao
 const val DB_VERSION_3 = 3
 const val DB_VERSION_4 = 4
 const val DB_VERSION_5 = 5
+const val DB_VERSION_6 = 6
 
 @Database(
     entities = [AccountModel::class],
-    version = 5,
+    version = DB_VERSION_6,
     exportSchema = false
 )
 abstract class AppDatabase : RoomDatabase() {
diff --git a/common/src/main/java/com/yogeshpaliyal/common/data/UserSettings.kt b/common/src/main/java/com/yogeshpaliyal/common/data/UserSettings.kt
index f125e217..dd141fa5 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/data/UserSettings.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/data/UserSettings.kt
@@ -9,6 +9,7 @@ const val DEFAULT_PASSWORD_LENGTH = 10f
 @Serializable
 data class UserSettings(
     val keyPassPassword: String? = null,
+    val dbPassword: String? = null,
     val defaultPasswordLength: Float = DEFAULT_PASSWORD_LENGTH,
     val backupKey: String? = null,
     val isBiometricEnable: Boolean = false,
diff --git a/common/src/main/java/com/yogeshpaliyal/common/di/module/AppModule.kt b/common/src/main/java/com/yogeshpaliyal/common/di/module/AppModule.kt
index 5bfc3ab2..f508104d 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/di/module/AppModule.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/di/module/AppModule.kt
@@ -1,6 +1,7 @@
 package com.yogeshpaliyal.common.di.module
 
 import android.content.Context
+import android.database.sqlite.SQLiteException
 import androidx.room.Room
 import androidx.room.migration.Migration
 import androidx.sqlite.db.SupportSQLiteDatabase
@@ -10,11 +11,16 @@ import com.yogeshpaliyal.common.DB_VERSION_4
 import com.yogeshpaliyal.common.DB_VERSION_5
 import com.yogeshpaliyal.common.R
 import com.yogeshpaliyal.common.utils.getRandomString
+import com.yogeshpaliyal.common.utils.getUserSettingsOrNull
+import com.yogeshpaliyal.common.utils.setDatabasePassword
 import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn
 import dagger.hilt.android.qualifiers.ApplicationContext
 import dagger.hilt.components.SingletonComponent
+import kotlinx.coroutines.runBlocking
+import net.sqlcipher.database.SQLiteDatabase
+import net.sqlcipher.database.SupportFactory
 import javax.inject.Singleton
 
 @Module
@@ -24,27 +30,74 @@ object AppModule {
     @Provides
     @Singleton
     fun getDb(@ApplicationContext context: Context): AppDatabase {
-        return Room.databaseBuilder(
+        val dbName = context.getString(R.string.app_name)
+        val dbNameEncrypted = "$dbName.encrypted"
+
+        val builder = Room.databaseBuilder(
             context,
             AppDatabase::class.java,
-            context.getString(R.string.app_name)
-        ).addMigrations(object : Migration(DB_VERSION_3, DB_VERSION_4) {
+            dbNameEncrypted
+        )
+
+        var userEnteredPassphrase: String
+        var isMigratedFromNonEncryption = false
+
+        runBlocking {
+            val userSettings = context.getUserSettingsOrNull()
+            if (userSettings?.dbPassword == null) {
+                userEnteredPassphrase = getRandomString()
+                isMigratedFromNonEncryption = true
+                context.setDatabasePassword(userEnteredPassphrase)
+            } else {
+                userEnteredPassphrase = userSettings.dbPassword
+            }
+        }
+
+        SQLiteDatabase.loadLibs(context)
+
+        if (isMigratedFromNonEncryption) {
+            context.migrateNonEncryptedToEncryptedDb(dbName, dbNameEncrypted, userEnteredPassphrase)
+        }
+
+        val passphrase: ByteArray = SQLiteDatabase.getBytes(userEnteredPassphrase.toCharArray())
+        val factory = SupportFactory(passphrase)
+        builder.openHelperFactory(factory)
+        builder.addMigrations(object : Migration(DB_VERSION_3, DB_VERSION_4) {
             override fun migrate(database: SupportSQLiteDatabase) {
                 database.execSQL("ALTER TABLE `account` ADD COLUMN `unique_id` TEXT")
                 database.query("select id,unique_id from `account` where unique_id IS NULL")
-                    ?.use {
+                    .use {
                         while (it.moveToNext()) {
                             val id = it.getInt(0)
-                            val query = "update `account` set `unique_id` = '${getRandomString()}' where `id` = '$id'"
+                            val query =
+                                "update `account` set `unique_id` = '${getRandomString()}' where `id` = '$id'"
                             database.execSQL(query)
                         }
                     }
             }
-        }).addMigrations(object : Migration(DB_VERSION_4, DB_VERSION_5) {
+        })
+        builder.addMigrations(object : Migration(DB_VERSION_4, DB_VERSION_5) {
             override fun migrate(database: SupportSQLiteDatabase) {
                 database.execSQL("ALTER TABLE `account` ADD COLUMN `type` INT DEFAULT 0")
             }
         })
-            .build()
+        return builder.build()
+    }
+
+    private fun Context.migrateNonEncryptedToEncryptedDb(nonEncryptedDbName: String, encryptedDbName: String, userEnteredPassphrase: String) {
+        try {
+            val oldDb = getDatabasePath(nonEncryptedDbName)
+            val database = SQLiteDatabase.openOrCreateDatabase(oldDb, "", null)
+            val encryptedDbPath = getDatabasePath(encryptedDbName).path
+            database.rawExecSQL(
+                "ATTACH DATABASE '$encryptedDbPath' AS encrypted KEY '$userEnteredPassphrase'"
+            )
+            database.rawExecSQL("select sqlcipher_export('encrypted')")
+            database.rawExecSQL("DETACH DATABASE encrypted")
+            database.close()
+            oldDb.delete()
+        } catch (e: SQLiteException) {
+            e.printStackTrace()
+        }
     }
 }
diff --git a/common/src/main/java/com/yogeshpaliyal/common/utils/SharedPreferenceUtils.kt b/common/src/main/java/com/yogeshpaliyal/common/utils/SharedPreferenceUtils.kt
index 46109d91..5fbf7d30 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/utils/SharedPreferenceUtils.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/utils/SharedPreferenceUtils.kt
@@ -74,6 +74,12 @@ suspend fun Context.setBackupKey(backupKey: String?) {
     }
 }
 
+suspend fun Context.setDatabasePassword(databasePassword: String) {
+    getUserSettingsDataStore().updateData {
+        it.copy(dbPassword = databasePassword)
+    }
+}
+
 suspend fun Context.setBackupTime(backupTime: Long?) {
     getUserSettingsDataStore().updateData {
         it.copy(backupTime = backupTime)
diff --git a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsDataStore.kt b/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsDataStore.kt
index 7a0630c2..bd1894cb 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsDataStore.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsDataStore.kt
@@ -1,7 +1,6 @@
 package com.yogeshpaliyal.common.utils
 
 import android.content.Context
-import android.os.Build
 import androidx.datastore.core.Serializer
 import androidx.datastore.dataStore
 import com.yogeshpaliyal.common.data.UserSettings
@@ -9,11 +8,7 @@ import com.yogeshpaliyal.common.data.UserSettings
 class UserSettingsDataStore(val context: Context) {
 
     private fun getSerializer(context: Context): Serializer<UserSettings> {
-        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-            UserSettingsSerializer(CryptoManager())
-        } else {
-            UserSettingsSerializerLegacy(context)
-        }
+        return UserSettingsSerializer(CryptoManager())
     }
 
     private val Context.dataStoreSerializer by dataStore(
diff --git a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializer.kt b/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializer.kt
index 8debe076..e87df356 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializer.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializer.kt
@@ -1,7 +1,5 @@
 package com.yogeshpaliyal.common.utils
 
-import android.os.Build
-import androidx.annotation.RequiresApi
 import androidx.datastore.core.Serializer
 import com.yogeshpaliyal.common.data.UserSettings
 import kotlinx.serialization.SerializationException
@@ -9,7 +7,6 @@ import kotlinx.serialization.json.Json
 import java.io.InputStream
 import java.io.OutputStream
 
-@RequiresApi(Build.VERSION_CODES.M)
 class UserSettingsSerializer(
     private val cryptoManager: CryptoManager
 ) : Serializer<UserSettings> {
diff --git a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializerLegacy.kt b/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializerLegacy.kt
deleted file mode 100644
index 525645d5..00000000
--- a/common/src/main/java/com/yogeshpaliyal/common/utils/UserSettingsSerializerLegacy.kt
+++ /dev/null
@@ -1,40 +0,0 @@
-package com.yogeshpaliyal.common.utils
-
-import android.content.Context
-import androidx.datastore.core.Serializer
-import com.yogeshpaliyal.common.data.DEFAULT_PASSWORD_LENGTH
-import com.yogeshpaliyal.common.data.UserSettings
-import java.io.InputStream
-import java.io.OutputStream
-
-class UserSettingsSerializerLegacy constructor(
-    private val applicationContext: Context
-) : Serializer<UserSettings> {
-
-    override val defaultValue: UserSettings
-        get() = UserSettings()
-
-    override suspend fun readFrom(input: InputStream): UserSettings {
-        return UserSettings(
-            autoBackupEnable = applicationContext.isAutoBackupEnabledLegacy(),
-            backupDirectory = applicationContext.getBackupDirectoryLegacy(),
-            backupTime = applicationContext.getBackupTimeLegacy(),
-            defaultPasswordLength = applicationContext.getKeyPassPasswordLengthLegacy() ?: DEFAULT_PASSWORD_LENGTH,
-            isBiometricEnable = applicationContext.isBiometricEnableLegacy(),
-            keyPassPassword = applicationContext.getKeyPassPasswordLegacy(),
-            overrideAutoBackup = applicationContext.overrideAutoBackupLegacy(),
-            backupKey = applicationContext.getOrCreateBackupKey(false).second
-        )
-    }
-
-    override suspend fun writeTo(t: UserSettings, output: OutputStream) {
-        applicationContext.setBiometricEnableLegacy(t.isBiometricEnable)
-        applicationContext.setAutoBackupEnabledLegacy(t.autoBackupEnable)
-        applicationContext.setBackupDirectoryLegacy(t.backupDirectory ?: "")
-        applicationContext.setBackupTimeLegacy(t.backupTime ?: 0L)
-        applicationContext.setKeyPassPasswordLengthLegacy(t.defaultPasswordLength)
-        applicationContext.setKeyPassPasswordLegacy(t.keyPassPassword)
-        applicationContext.setOverrideAutoBackupLegacy(t.overrideAutoBackup)
-        applicationContext.saveKeyphraseLegacy(t.backupKey ?: "")
-    }
-}
diff --git a/common/src/main/java/com/yogeshpaliyal/common/worker/AutoBackupWorker.kt b/common/src/main/java/com/yogeshpaliyal/common/worker/AutoBackupWorker.kt
index f3a6fe71..05d29fe8 100644
--- a/common/src/main/java/com/yogeshpaliyal/common/worker/AutoBackupWorker.kt
+++ b/common/src/main/java/com/yogeshpaliyal/common/worker/AutoBackupWorker.kt
@@ -24,7 +24,7 @@ class AutoBackupWorker @AssistedInject constructor(
     override suspend fun doWork(): Result {
         return withContext(Dispatchers.IO) {
             if (appContext.canUserAccessBackupDirectory()) {
-                val userSettings = appContext.getUserSettings() ?: return@withContext Result.failure()
+                val userSettings = appContext.getUserSettings()
                 val selectedDirectory = Uri.parse(userSettings.backupDirectory)
                 appContext.backupAccounts(
                     appDatabase,