chore: replace json config with database

src-tauri/src/config.rs

@@ -0,0 +1,219 @@
+use aes_gcm::aead::rand_core::RngCore;
+use aes_gcm::{
+    Aes256Gcm, Key, Nonce,
+    aead::{Aead, KeyInit, OsRng},
+};
+use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
+use rusqlite::{Connection, OptionalExtension, params};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use std::path::PathBuf;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum ConfigError {
+    #[error("SQLite error: {0}")]
+    Sqlite(#[from] rusqlite::Error),
+    #[error("Encryption error: {0}")]
+    Encryption(String),
+    #[error("JSON error: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("Base64 error: {0}")]
+    Base64(#[from] base64::DecodeError),
+    #[error("Config not initialized")]
+    NotInitialized,
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+}
+
+impl serde::Serialize for ConfigError {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(&self.to_string())
+    }
+}
+
+pub struct Config {
+    db_path: PathBuf,
+    conn: Option<Connection>,
+    hwid_key: Option<[u8; 32]>,
+}
+
+impl Config {
+    pub fn new(db_path: impl Into<PathBuf>) -> Self {
+        Self {
+            db_path: db_path.into(),
+            conn: None,
+            hwid_key: None,
+        }
+    }
+
+    pub fn init(&mut self, hwid: &str) -> Result<bool, ConfigError> {
+        let mut hasher = Sha256::new();
+        hasher.update(hwid.as_bytes());
+        let key_bytes: [u8; 32] = hasher.finalize().into();
+        self.hwid_key = Some(key_bytes);
+
+        let is_new = !self.db_path.exists();
+
+        if let Some(parent) = self.db_path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+
+        let conn = Connection::open(&self.db_path)?;
+
+        conn.execute_batch(
+            "
+            PRAGMA journal_mode=WAL;
+            CREATE TABLE IF NOT EXISTS config (
+                key       TEXT PRIMARY KEY,
+                value     TEXT NOT NULL,
+                encrypted INTEGER NOT NULL DEFAULT 0
+            );
+        ",
+        )?;
+
+        self.conn = Some(conn);
+        Ok(is_new)
+    }
+
+    pub fn get(&self, key: &str) -> Result<Option<Value>, ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+
+        let mut stmt = conn.prepare("SELECT value, encrypted FROM config WHERE key = ?1")?;
+
+        let row: Option<(String, bool)> = stmt
+            .query_row(params![key], |r| Ok((r.get(0)?, r.get(1)?)))
+            .optional()?;
+
+        match row {
+            None => Ok(None),
+            Some((raw, false)) => Ok(Some(serde_json::from_str::<Value>(&raw)?)),
+            Some((raw, true)) => {
+                let plaintext = self
+                    .decrypt_value(&raw)
+                    .map_err(|_| ConfigError::Encryption(format!("failed to decrypt '{}'", key)))?;
+
+                serde_json::from_str::<Value>(&plaintext)
+                    .map(Some)
+                    .map_err(|_| {
+                        ConfigError::Encryption(format!("decrypted '{}' is not valid JSON", key))
+                    })
+            }
+        }
+    }
+
+    pub fn exists(&self, key: &str) -> Result<bool, ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM config WHERE key = ?1",
+            params![key],
+            |r| r.get(0),
+        )?;
+        Ok(count > 0)
+    }
+
+    /// Return all key/value pairs (decrypting encrypted ones).
+    pub fn all(&self) -> Result<Vec<(String, Value)>, ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+        let mut stmt = conn.prepare("SELECT key, value, encrypted FROM config")?;
+
+        let rows = stmt.query_map([], |r| {
+            Ok((
+                r.get::<_, String>(0)?,
+                r.get::<_, String>(1)?,
+                r.get::<_, bool>(2)?,
+            ))
+        })?;
+
+        let mut out = Vec::new();
+        for row in rows {
+            let (k, raw, enc) = row?;
+            let v: Value = if enc {
+                let pt = self.decrypt_value(&raw)?;
+                serde_json::from_str(&pt)?
+            } else {
+                serde_json::from_str(&raw)?
+            };
+            out.push((k, v));
+        }
+        Ok(out)
+    }
+
+    pub fn set<T: serde::Serialize>(
+        &self,
+        key: &str,
+        value: T,
+        encrypt: bool,
+    ) -> Result<(), ConfigError> {
+        let json = serde_json::to_string(&value)?;
+        if encrypt {
+            let blob = self.encrypt_value(&json)?;
+            self.upsert(key, &blob, true)
+        } else {
+            self.upsert(key, &json, false)
+        }
+    }
+
+    pub fn delete(&self, key: &str) -> Result<(), ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+        conn.execute("DELETE FROM config WHERE key = ?1", params![key])?;
+        Ok(())
+    }
+
+    pub fn clear(&self) -> Result<(), ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+        conn.execute("DELETE FROM config", [])?;
+        Ok(())
+    }
+
+    fn upsert(&self, key: &str, raw: &str, encrypted: bool) -> Result<(), ConfigError> {
+        let conn = self.conn.as_ref().ok_or(ConfigError::NotInitialized)?;
+        conn.execute(
+            "INSERT INTO config (key, value, encrypted)
+             VALUES (?1, ?2, ?3)
+             ON CONFLICT(key) DO UPDATE SET value = excluded.value,
+                                            encrypted = excluded.encrypted",
+            params![key, raw, encrypted as i32],
+        )?;
+        Ok(())
+    }
+
+    fn cipher(&self) -> Result<Aes256Gcm, ConfigError> {
+        let key_bytes = self.hwid_key.ok_or(ConfigError::NotInitialized)?;
+        let key = Key::<Aes256Gcm>::from_slice(&key_bytes);
+        Ok(Aes256Gcm::new(key))
+    }
+
+    fn encrypt_value(&self, plaintext: &str) -> Result<String, ConfigError> {
+        let cipher = self.cipher()?;
+        let mut nonce_bytes = [0u8; 12];
+        OsRng.fill_bytes(&mut nonce_bytes);
+        let nonce = Nonce::from_slice(&nonce_bytes);
+
+        let ciphertext = cipher
+            .encrypt(nonce, plaintext.as_bytes())
+            .map_err(|e| ConfigError::Encryption(e.to_string()))?;
+
+        let mut combined = nonce_bytes.to_vec();
+        combined.extend_from_slice(&ciphertext);
+        Ok(BASE64.encode(&combined))
+    }
+
+    fn decrypt_value(&self, blob: &str) -> Result<String, ConfigError> {
+        let cipher = self.cipher()?;
+        let combined = BASE64.decode(blob)?;
+
+        if combined.len() < 12 {
+            return Err(ConfigError::Encryption("blob too short".into()));
+        }
+
+        let (nonce_bytes, ciphertext) = combined.split_at(12);
+        let nonce = Nonce::from_slice(nonce_bytes);
+
+        let plaintext = cipher
+            .decrypt(nonce, ciphertext)
+            .map_err(|e| ConfigError::Encryption(e.to_string()))?;
+
+        String::from_utf8(plaintext).map_err(|e| ConfigError::Encryption(e.to_string()))
+    }
+}