# Decrypt and echo the value of key1
cred -e key1 my-vault

# Alternatively, pipe the password directly:
echo "mypassword" | cred -e key1 my-vault

# Create a new vault:
cred -n my-vault

# Open the vault interactively
cred my-vault

# Pipe a password and open the vault
echo "mypassword" | cred my-vault

# Extract the value of a specific key
cred -e key1 my-vault

# Extract values of multiple keys
cred -e "key1 key2 key3" my-vault

# Pipe a password and extract a specific key
echo "mypassword" | cred -e key1 my-vault

``
## A note on remote files

`cred` can open vault files from remote locations. If the file path provided is a URL, `cred` will use `curl` to fetch the file.

Care was taken to pipe the output of `curl` to a variable and not to a temp file on disk.

```bash
content=$(curl -fSL "$file")

cred --upload "some data related to upload" target-vault-file

custom_encrypt_data() {
  data="$1"
  password="$2"
  iter="$3"

  # Generate random values
  salt=$(openssl rand -base64 16)

  iv=$(openssl rand -hex 16)

  hmac_key=$(openssl rand -hex 32)

  # Derive key using Argon2 and extract the hash portion
  encoded_key=$(echo -n "$password" | argon2 "$salt" -id -t "$iter" -m 16 -p 2 -l 32 | grep -oP '(?<=Encoded:).*' | xargs)

  # Extract the actual Base64-encoded hash (last segment)
  base64_hash=$(echo "$encoded_key" | awk -F'$' '{print $NF}')

  # Decode Base64-encoded hash into hexadecimal
  key=$(echo "$base64_hash" | base64 -d | xxd -p -c 256)

  # Encrypt the data and Base64 encode the result
  encrypted=$(echo -n "$data" | openssl enc -aes-256-cbc -K "$key" -iv "$iv" -e | base64 -w 0)

  # Generate HMAC
  hmac=$(echo -n "$encrypted" | openssl dgst -sha256 -mac HMAC -macopt hexkey:$hmac_key | awk '{print $2}')

  # Create an associative array
  declare -A encryption_result
  encryption_result["salt"]=$salt
  encryption_result["iv"]=$iv
  encryption_result["encrypted_data"]=$encrypted
  encryption_result["hmac"]=$hmac
  encryption_result["hmac_key"]=$hmac_key

  # Serialize and return the array
  echo -n $(declare -p encryption_result)
}

custom_decrypt_data() {
  serialized_data="$1"
  password="$2"
  iter="$3"

  # Deserialize the serialized array
  eval "$(echo "$serialized_data")"

  # Extract values from the associative array
  salt="${encryption_result["salt"]}"
  iv="${encryption_result["iv"]}"
  encrypted="${encryption_result["encrypted_data"]}"
  hmac="${encryption_result["hmac"]}"
  hmac_key="${encryption_result["hmac_key"]}"

  # Derive the encryption key using Argon2 and extract the hash portion
  encoded_key=$(echo -n "$password" | argon2 "$salt" -id -t "$iter" -m 16 -p 2 -l 32 | grep -oP '(?<=Encoded:).*' | xargs)

  # Extract the actual Base64-encoded hash (last segment)
  base64_hash=$(echo "$encoded_key" | awk -F'$' '{print $NF}')

  # Decode Base64-encoded hash into hexadecimal
  key=$(echo "$base64_hash" | base64 -d | xxd -p -c 256)

  # Validate the HMAC
  calculated_hmac=$(echo -n "$encrypted" | openssl dgst -sha256 -mac HMAC -macopt hexkey:$hmac_key | awk '{print $2}')
  if [[ "$calculated_hmac" != "$hmac" ]]; then
    echo "Error: HMAC validation failed. Data integrity compromised."
    return 1
  fi

  # Decode Base64 and decrypt the data
  decrypted=$(echo -n "$encrypted" | base64 -d | openssl enc -aes-256-cbc -K "$key" -iv "$iv" -d)

  # Output the decrypted data
  echo -n "$decrypted"
}

> cred https://f003.backblazeb2.com/file/my-bucket/the-cred-file

# First check what file we try to save
if [[ "{{__data_file_path}}" == "https://f003.backblazeb2.com/file/my-bucket/the-cred-file" ]]; then

    # Knowing the file, we know how and where to upload it
    # I use b2ctl to upload to Backblaze B2
    # It requires 2 environment variables to be set
	export B2CTL_APP_KEY="{{B2CTL_INMYVAULT_APP_KEY}}"
	export B2CTL_KEY_ID="{{B2CTL_INMYVAULT_ENTRYBUCKET_KEY_ID}}"

    # Upload the file
    # The content to be saved is piped to b2ctl which is capable of uploading to Backblaze B2
	echo -n "{{__data_file_content}}" | b2ctl --up {{__data_file_name}}
else
	echo "The variable does not equal the string."
fi

# Example API Credentials
ACCESS_KEY="{{MY_ACCESS_KEY}}"
SECRET_KEY="{{MY_SECRET_KEY}}"

# Bucket and File Information
BUCKET_NAME="my-bucket"
FILE_NAME="my-file.txt"

# API Endpoint
URL="https://cloud-example.com/${BUCKET_NAME}/${FILE_NAME}"

# Authorization Header (Basic Authentication)
AUTH_HEADER="Authorization: ${ACCESS_KEY}:${SECRET_KEY}"

# Make the API call to download the file
curl -s -H "${AUTH_HEADER}" "${URL}" -o "${FILE_NAME}"

# Check if the file was downloaded successfully
if [[ $? -eq 0 ]]; then
    echo "File downloaded successfully: ${FILE_NAME}"
else
    echo "Failed to download the file."
fi

#!/bin/bash

custom_encrypt_data() {
	data="$1"
	password="$2"
	iter="$3"
	output_file="$4"

	# If the fourth argument is not set, default to $data.enc
	if [[ -z "$output_file" && -f "$data" ]]; then
		output_file="${data}.enc"
	fi

	# Generate random values
	salt=$(openssl rand -base64 16)
	iv=$(openssl rand -hex 16)
	hmac_key=$(openssl rand -hex 32)

	# Derive key using Argon2 and extract the hash portion
	encoded_key=$(echo -n "$password" | argon2 "$salt" -id -t "$iter" -m 16 -p 2 -l 32 | grep -oP '(?<=Encoded:).*' | xargs)

	# Extract the actual Base64-encoded hash (last segment)
	base64_hash=$(echo "$encoded_key" | awk -F'$' '{print $NF}')

	# Because the Base64 encoding is not padded from argon
	# we need to add the correct padding for older versions of base64, like 9.3
	# Calculate the missing padding
	padding=$(((4 - (${#base64_hash} % 4)) % 4))

	# Add the correct number of '=' padding characters
	base64_hash="${base64_hash}$(printf '=%.0s' $(seq 1 $padding))"

	# Decode Base64-encoded hash into hexadecimal
	key=$(echo "$base64_hash" | base64 -d | xxd -p -c 256)

	if [[ -f "$data" ]]; then
		# Set output file
		output_file="${data}.enc"

		# Pack metadata into a binary format (salt, iv, hmac_key)
		{
			printf "%-24s" "$salt"     # 24 bytes for salt (base64)
			printf "%-32s" "$iv"       # 32 bytes for IV (hex)
			printf "%-64s" "$hmac_key" # 64 bytes for HMAC key (hex)
			openssl enc -aes-256-cbc -K "$key" -iv "$iv" -e -in "$data"
		} >"$output_file"

		echo "File encrypted with embedded metadata: $output_file"
	else
		# For raw data, proceed as before
		encrypted=$(echo -n "$data" | openssl enc -aes-256-cbc -K "$key" -iv "$iv" -e | base64 -w 0)

		# Generate HMAC
		hmac=$(echo -n "$encrypted" | openssl dgst -sha256 -mac HMAC -macopt hexkey:$hmac_key | awk '{print $2}')

		# Create an associative array
		declare -A encryption_result
		encryption_result["salt"]=$salt
		encryption_result["iv"]=$iv
		encryption_result["encrypted_data"]=$encrypted
		encryption_result["hmac"]=$hmac
		encryption_result["hmac_key"]=$hmac_key

		# Serialize and return the array
		echo -n $(declare -p encryption_result)
	fi
}

#!/bin/bash
custom_decrypt_data() {
	data="$1"
	password="$2"
	iter="$3"
	output_file="$4"

	# If the fourth argument is not set, default to $data.enc
	if [[ -z "$output_file" && -f "$data" ]]; then
		output_file="${data}.dec"
	fi

	if [[ -f "$data" ]]; then
		# File decryption mode
		input_file="$data"

		# Extract metadata (salt, iv, hmac_key)
		salt=$(head -c 24 "$input_file" | tr -d ' ')
		iv=$(dd if="$input_file" bs=1 skip=24 count=32 2>/dev/null | tr -d ' ')
		hmac_key=$(dd if="$input_file" bs=1 skip=56 count=64 2>/dev/null | tr -d ' ')

		# Derive the encryption key using Argon2
		encoded_key=$(echo -n "$password" | argon2 "$salt" -id -t "$iter" -m 16 -p 2 -l 32 | grep -oP '(?<=Encoded:).*' | xargs)
		base64_hash=$(echo "$encoded_key" | awk -F'$' '{print $NF}')

		# Correct Base64 padding
		padding=$(((4 - (${#base64_hash} % 4)) % 4))
		base64_hash="${base64_hash}$(printf '=%.0s' $(seq 1 $padding))"

		# Decode Base64-encoded hash into hexadecimal
		key=$(echo "$base64_hash" | base64 -d | xxd -p -c 256)

		# Decrypt the file
		#encrypted_data=$(dd if="$input_file" bs=1 skip=120 2>/dev/null)
		#echo -n "$encrypted_data" | openssl enc -aes-256-cbc -K "$key" -iv "$iv" -d > "$output_file"

        # Use command substitution as bash can not handle binary data

		openssl enc -aes-256-cbc -K "$key" -iv "$iv" -d -in <(dd if="$input_file" bs=1 skip=120 2>/dev/null) >"$output_file"

	else
		# Raw data decryption mode
		serialized_data="$data"

		# Deserialize the serialized array
		eval "$(echo "$serialized_data")"

		# Extract values from the associative array
		salt="${encryption_result["salt"]}"
		iv="${encryption_result["iv"]}"
		encrypted="${encryption_result["encrypted_data"]}"
		hmac="${encryption_result["hmac"]}"
		hmac_key="${encryption_result["hmac_key"]}"

		# Derive the encryption key using Argon2
		encoded_key=$(echo -n "$password" | argon2 "$salt" -id -t "$iter" -m 16 -p 2 -l 32 | grep -oP '(?<=Encoded:).*' | xargs)
		base64_hash=$(echo "$encoded_key" | awk -F'$' '{print $NF}')

		# Correct Base64 padding
		padding=$(((4 - (${#base64_hash} % 4)) % 4))
		base64_hash="${base64_hash}$(printf '=%.0s' $(seq 1 $padding))"

		# Decode Base64-encoded hash into hexadecimal
		key=$(echo "$base64_hash" | base64 -d | xxd -p -c 256)

		# Validate the HMAC
		calculated_hmac=$(echo -n "$encrypted" | openssl dgst -sha256 -mac HMAC -macopt hexkey:$hmac_key | awk '{print $2}')
		if [[ "$calculated_hmac" != "$hmac" ]]; then
			echo "Error: HMAC validation failed. Data integrity compromised."
			return 1
		fi

		# Decrypt the raw data
		decrypted=$(echo -n "$encrypted" | base64 -d | openssl enc -aes-256-cbc -K "$key" -iv "$iv" -d)

		# Output the decrypted data
		echo -n "$decrypted"
	fi
}