feat: import passkeys from CXF (FIDO Alliance / Google Password Manager) exports (v2.10.3)

@@ -1 +1 @@1-2.10.21+2.10.3

@@ -10,6 +10,7 @@1010  * Supported providers (detected from header / content shape):1111  *   - "Bitwarden CSV"  (folder,favorite,type,name,login_uri,login_username,login_password,login_totp,notes)1212  *   - "Bitwarden JSON" ({"items":[...]})13+ *   - "Credential Exchange JSON" (CXF / FIDO Alliance: {"accounts":[{"items":[{"credentials":[...]}]}]} — passkey import)1314  *   - "Proton Pass JSON" ({"vaults":{...}})1415  *   - "1Password CSV"  (Title,Url,Username,Password,... — 1Password v8 export)1516  *   - "Chrome CSV"     (name,url,username,password)@@ -82,6 +83,7 @@8283     // Display labels used both for detection return values and "Detected: X export".8384     const val BITWARDEN_CSV = "Bitwarden CSV"8485     const val BITWARDEN_JSON = "Bitwarden JSON"86+    const val CXF_JSON = "Credential Exchange JSON"8587     const val PROTONPASS_JSON = "Proton Pass JSON"8688     const val ONEPASSWORD_CSV = "1Password CSV"8789     const val CHROME_CSV = "Chrome CSV"@@ -97,6 +99,13 @@9799         val trimmed = content.trim()98100         if (trimmed.isEmpty()) return null99101 102+        // CXF (FIDO Alliance Credential Exchange Format): an object carrying an103+        // "accounts" array. Must be checked before the Bitwarden "items" sniff —104+        // a CXF file nests "items" under each account and would otherwise105+        // misclassify as Bitwarden JSON.106+        if (trimmed.startsWith("{") && Regex("\"accounts\"\\s*:\\s*\\[").containsMatchIn(trimmed)) {107+            return CXF_JSON108+        }100109         // Proton Pass JSON: an object carrying a "vaults" map.101110         if (trimmed.startsWith("{") && Regex("\"vaults\"\\s*:\\s*\\{").containsMatchIn(trimmed)) {102111             return PROTONPASS_JSON@@ -138,6 +147,7 @@138147     fun parse(content: String, provider: String): List<ParsedEntry> = when (provider) {139148         PROTONPASS_JSON -> parseProtonPassJson(content)140149         BITWARDEN_JSON -> parseBitwardenJson(content)150+        CXF_JSON -> parseCxfJson(content)141151         BITWARDEN_CSV -> parseCsvByHeader(content, BitwardenCsvMap)142152         CHROME_CSV, EDGE_CSV -> parseCsvByHeader(content, ChromeCsvMap)143153         SAFARI_CSV -> parseCsvByHeader(content, SafariCsvMap)@@ -360,6 +370,126 @@360370         -7 -> "{\"kty\":\"EC\",\"crv\":\"P-256\",\"d\":\"" + keyValue + "\"}"361371         -8 -> "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"d\":\"" + keyValue + "\"}"362372         else -> "{}"373+    }374+375+    // ---- Credential Exchange Format (CXF / FIDO Alliance) -----------------376+377+    /**378+     * CXF — the JSON shape Google Password Manager (and other managers) export379+     * passkeys in: an `accounts` array, each with `items`, each with380+     * `credentials`. Only `type == "passkey"` credentials are imported. Mirrors381+     * the browser extension's `parseCredentialExchangeJSON`: the same six fields382+     * are required, and an unreadable private key skips just that credential383+     * rather than failing the whole import.384+     */385+    private fun parseCxfJson(content: String): List<ParsedEntry> {386+        val accounts = extractArray(content, "accounts") ?: return emptyList()387+        val entries = mutableListOf<ParsedEntry>()388+        for (account in splitTopLevelObjects(accounts)) {389+            val items = extractArray(account, "items") ?: continue390+            for (item in splitTopLevelObjects(items)) {391+                val creds = extractArray(item, "credentials") ?: continue392+                val itemTitle = jsonString(item, "title")393+                val passkeys = mutableListOf<ParsedPasskey>()394+                var firstRpId: String? = null395+                for (cred in splitTopLevelObjects(creds)) {396+                    if (!jsonString(cred, "type").equals("passkey", ignoreCase = true)) continue397+                    val credentialId = jsonString(cred, "credentialId") ?: continue398+                    val rpId = jsonString(cred, "rpId") ?: continue399+                    val userName = jsonString(cred, "username") ?: continue400+                    val userDisplayName = jsonString(cred, "userDisplayName") ?: continue401+                    val userHandle = jsonString(cred, "userHandle") ?: continue402+                    val key = jsonString(cred, "key") ?: continue403+                    val (jwk, algorithm) = cxfKeyToJwk(key) ?: continue404+                    if (firstRpId == null) firstRpId = rpId405+                    passkeys += ParsedPasskey(406+                        credentialId = credentialId,407+                        rpId = rpId,408+                        rpName = itemTitle ?: rpId,409+                        privateKeyJwk = jwk,410+                        algorithm = algorithm,411+                        userHandle = userHandle,412+                        userName = userName,413+                        userDisplayName = userDisplayName,414+                        signCount = 0,415+                    )416+                }417+                if (passkeys.isEmpty()) continue418+                // Passkey-only: leave login fields null so the UI does not spawn419+                // an empty login entry (the browser creates a standalone passkey).420+                entries += ParsedEntry(421+                    title = itemTitle ?: firstRpId ?: "Untitled",422+                    url = firstRpId?.let { "https://$it" },423+                    passkeys = passkeys,424+                )425+            }426+        }427+        return entries428+    }429+430+    /**431+     * Decode a CXF `key` (base64url PKCS#8 DER) into the minimal signing JWK the432+     * assertion engine consumes (`kty`/`crv`/`d`). Ed25519 vs EC P-256 is read433+     * from the PKCS#8 AlgorithmIdentifier OID. Returns null for any key we cannot434+     * parse — the caller skips that credential.435+     */436+    private fun cxfKeyToJwk(keyB64url: String): Pair<String, Int>? = runCatching {437+        val der = java.util.Base64.getUrlDecoder().decode(keyB64url)438+        val r = DerReader(der)439+        r.expect(0x30); r.readLength()                       // PrivateKeyInfo SEQUENCE440+        r.expect(0x02); r.skip(r.readLength())               // version INTEGER441+        r.expect(0x30)                                       // AlgorithmIdentifier442+        val algLen = r.readLength()443+        val algEnd = r.pos + algLen                          // pos is past the length byte here444+        r.expect(0x06); val oid = r.readValue(r.readLength())445+        r.pos = algEnd446+        r.expect(0x04); val privKey = r.readValue(r.readLength())  // privateKey OCTET STRING447+        when {448+            oid.contentEquals(ED25519_OID) -> {449+                // RFC 8410: privateKey wraps the 32-byte seed as an inner OCTET STRING.450+                val inner = DerReader(privKey)451+                inner.expect(0x04)452+                val d = inner.readValue(inner.readLength())453+                "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"d\":\"" + b64Url(d) + "\"}" to -8454+            }455+            oid.contentEquals(EC_PUBLIC_KEY_OID) -> {456+                // RFC 5915 ECPrivateKey: SEQUENCE { version, privateKey OCTET STRING, ... }.457+                val inner = DerReader(privKey)458+                inner.expect(0x30); inner.readLength()459+                inner.expect(0x02); inner.skip(inner.readLength())  // version == 1460+                inner.expect(0x04)461+                val d = inner.readValue(inner.readLength())462+                "{\"kty\":\"EC\",\"crv\":\"P-256\",\"d\":\"" + b64Url(d) + "\"}" to -7463+            }464+            else -> null465+        }466+    }.getOrNull()467+468+    private fun b64Url(bytes: ByteArray): String =469+        java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)470+471+    // PKCS#8 AlgorithmIdentifier OIDs (DER content, without the 06 <len> prefix).472+    private val ED25519_OID = byteArrayOf(0x2B, 0x65, 0x70)                                          // 1.3.101.112473+    private val EC_PUBLIC_KEY_OID = byteArrayOf(0x2A, 0x86.toByte(), 0x48, 0xCE.toByte(), 0x3D, 0x02, 0x01) // 1.2.840.10045.2.1474+475+    /** Minimal DER tag-length-value walker — just enough for PKCS#8 private keys. */476+    private class DerReader(private val bytes: ByteArray) {477+        var pos = 0478+        fun expect(tag: Int) {479+            if (pos >= bytes.size || (bytes[pos].toInt() and 0xFF) != tag) {480+                throw IllegalArgumentException("unexpected DER tag at $pos")481+            }482+            pos++483+        }484+        fun readLength(): Int {485+            val first = bytes[pos++].toInt() and 0xFF486+            if (first < 0x80) return first487+            var len = 0488+            repeat(first and 0x7F) { len = (len shl 8) or (bytes[pos++].toInt() and 0xFF) }489+            return len490+        }491+        fun readValue(len: Int): ByteArray = bytes.copyOfRange(pos, pos + len).also { pos += len }492+        fun skip(len: Int) { pos += len }363493     }364494 365495     private fun extractItemsArray(content: String): String? {

@@ -320,7 +320,12 @@320320                     if (mode == ImportMode.REPLACE) fulls else fulls.map { it.copy(id = "") }321321                 } else {322322                     preview.entries.flatMap { p ->323-                        val login = VaultEntry(323+                        // A passkey-only entry (CXF) carries no login fields; spawning324+                        // an empty login for it would leave junk the browser never creates.325+                        val passkeyOnly = p.passkeys.isNotEmpty() &&326+                            p.password == null && p.username == null &&327+                            p.totp == null && p.notes == null328+                        val login = if (passkeyOnly) null else VaultEntry(324329                             id = "", type = "login", title = p.title, username = p.username,325330                             password = p.password, url = p.url, notes = p.notes, totp = p.totp,326331                             createdAt = now, modifiedAt = now,@@ -340,7 +345,7 @@340345                                 createdAt = now, modifiedAt = now,341346                             )342347                         }343-                        listOf(login) + passkeyEntries348+                        listOfNotNull(login) + passkeyEntries344349                     }345350                 }346351                 _state.value = ImportUiState.Working("saving ${drafts.size} entries…")