feat: add KeePass plugin for KDBX 4.0 database support#413
feat: add KeePass plugin for KDBX 4.0 database support#413QaDeS wants to merge 1 commit intodmno-dev:mainfrom
Conversation
* feat: add KeePass plugin for KDBX 4.0 database and KeePassXC CLI support
Adds @varlock/keepass-plugin with two modes: direct KDBX file reading via
kdbxweb (production) and keepassxc-cli integration (development). Registers
@initKeePass decorator, kp()/kpBulk() resolvers, and kdbxPassword data type.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add argon2 support for KDBX 4.0, plugin README, root README update
- Register argon2 implementation in kdbxweb CryptoEngine for KDBX 4.0
key derivation (kdbxweb does not bundle one)
- Add argon2 as external dependency (native addon, not bundleable)
- Add createRequire banner in tsup for kdbxweb's require("crypto")
- Add comprehensive plugin README with usage examples
- Update root README plugin count and table
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: sanitize kpBulk keys into valid env var names
KeePass entry paths like "DB/itest" contain characters invalid in env
var names. Sanitize by replacing non-alphanumeric chars with underscores
and uppercasing. Non-default attributes (e.g. UserName) are appended as
a suffix to avoid collisions between bulk loads of different attributes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fixed spawnAsync to take an input option that gets streamed into the process stdin. Necessary for keepassxc-cli to work properly.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Full test folder, with executable "test" script. |
theoephraim
left a comment
theoephraim
left a comment
There was a problem hiding this comment.
Thanks for this! Looks pretty good :)
Left a few small comments.
| return; | ||
| } | ||
|
|
||
| // keepassxc-cli doesn't have a built-in batch mode, so we run individual `show` commands |
There was a problem hiding this comment.
Im not sure I follow whats going on with the batching - we already parallelize resolutions so likely not necessary.
| /** | ||
| * Find an entry by its path (e.g., "Group/SubGroup/EntryTitle"). | ||
| */ | ||
| private findEntry(db: kdbxweb.Kdbx, entryPath: string): kdbxweb.KdbxEntry | undefined { |
There was a problem hiding this comment.
Is it worth doing a single pass putting everything into a hash with keys being the format used by the plugin? Make sure its only on the first actual read though, because we dont ever want to trigger an error if the plugin is not being used in the current resolution.
| private dbPath?: string; | ||
| private password?: string; | ||
| private keyFile?: string; | ||
| private useDesktopApp?: boolean; |
There was a problem hiding this comment.
should probably be called useCli
| } | ||
|
|
||
| // useDesktopApp (optional, static) - when true, uses keepassxc-cli instead of reading the file directly | ||
| if (objArgs.useDesktopApp && !objArgs.useDesktopApp.isStatic) { |
There was a problem hiding this comment.
for some options you dont necessarily need to make sure they are static. Like you could want to do something like useCli=forEnv(dev) to ensure it can only use for dev.
2 participants
Adds @varlock/keepass-plugin with two modes: direct KDBX file reading via kdbxweb (production) and keepassxc-cli integration (development). Registers @initKeePass decorator, kp()/kpBulk() resolvers, and kdbxPassword data type.
KeePass entry paths like "DB/itest" contain characters invalid in env var names. Sanitize by replacing non-alphanumeric chars with underscores and uppercasing. Non-default attributes (e.g. UserName) are appended as a suffix to avoid collisions between bulk loads of different attributes.