Matrix Music Bot Dev
ecc40beed8
依赖新增：
- aes-gcm 0.11
- argon2 0.5.3
- getrandom 0.3 (std feature)
- base64 0.22.1
- serde_json 1.0
- zeroize 1.9
- rand_core (尝试后移除：rand 0.10 / 0.9 的 OsRng API 都复杂，改为更底层的 getrandom)
文件格式（JSON 包装）：
{
"version": 1,
"kdf": "argon2id",
"salt_b64": "...", // 16 bytes
"nonce_b64": "...", // 12 bytes
"ciphertext_b64": "..." // AES-256-GCM(plaintext, AAD="matrix-music-bot secret v1")
}
安全参数：
- KDF: Argon2id (m=19456 KiB, t=2, p=1) — OWASP 推荐
- 加密: AES-256-GCM（认证加密，任何篡改都会被检测）
- AAD: 标识文件版本与 KDF，防止 ciphertext 重放到不同上下文
- 每次加密随机 salt + nonce，确保同样明文产生不同 ciphertext
- 写入采用 .bin.tmp → rename 原子操作，避免半写状态
API:
save(path, &secrets, passphrase) -> AppResult<()>
load(path, passphrase) -> AppResult<SessionSecrets>
exists(path) -> bool
SessionSecrets 包含 access_token / device_id / user_id 三个字段，
实现 Zeroize on drop。
测试：
cargo test → 4 passed
- secret_store::roundtrip_via_disk: 加密 + 解密往返，错误口令被 AES-GCM 拒绝
- secret_store::ciphertext_differs_each_time: 同样明文两次加密 ciphertext 不同
后续 M1.3b：在 src/bootstrap.rs 中调用 matrix-sdk 的 Client::builder() + login_username，
拿到 access_token 后调 secret_store::save() 写入 ./data/secret.bin。
31 lines
912 B
TOML
31 lines
912 B
TOML
[package]
|
|
name = "matrix-music-bot"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
|
|
[dependencies]
|
|
aes-gcm = "0.11.0"
|
|
anyhow = "1.0.103"
|
|
argon2 = "0.5.3"
|
|
async-trait = "0.1.89"
|
|
base64 = "0.22.1"
|
|
clap = { version = "4.6.1", features = ["derive", "env"] }
|
|
getrandom = { version = "0.3", features = ["std"] }
|
|
matrix-sdk = "0.18.0"
|
|
matrix-sdk-crypto = "0.18.0"
|
|
matrix-sdk-ui = "0.18.0"
|
|
serde = { version = "1.0.228", features = ["derive"] }
|
|
serde_json = "1.0.150"
|
|
thiserror = "2.0.18"
|
|
tokio = { version = "1.52.3", features = ["full"] }
|
|
toml = "1.1.2"
|
|
tracing = "0.1.44"
|
|
tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
|
|
zeroize = "1.9.0"
|
|
|
|
# 推迟到对应 milestone 添加（避免 libsqlite3-sys 与 matrix-sdk-sqlite 冲突）：
|
|
# - rusqlite → M5 (SqliteQueue)
|
|
# - reqwest → M3 (yt-dlp HTTP) / M5 (音频下载)
|
|
#
|
|
# 这些依赖会在对应 milestone 的 commit 里单独添加。
|