Added a reset-password command

Author: Auchrio

main.go

@@ -169,6 +169,81 @@ func main() {
 		},
 	}
 
+	// --- RESET PASSWORD ---
+	var resetPasswordCmd = &cobra.Command{
+		Use:     "reset-password",
+		Aliases: []string{"reset-pass", "change-password", "change-pass"},
+		Short:   "Change your vault password",
+		Args:    cobra.NoArgs,
+		Run: func(cmd *cobra.Command, args []string) {
+			// Check if the config file exists BEFORE starting
+			_, err := os.Stat("zephyrus.conf")
+			isPersistent := err == nil
+
+			session, err := getEffectiveSession()
+			if err != nil {
+				fmt.Printf("❌ Authentication failed: %v\n", err)
+				return
+			}
+
+			// Confirm current password
+			fmt.Println("For security, please confirm your current vault password.")
+			currentPass, err := utils.GetPassword("Current Vault Password: ")
+			if err != nil {
+				fmt.Printf("❌ Error reading password: %v\n", err)
+				return
+			}
+
+			if currentPass != session.Password {
+				fmt.Println("❌ Current password is incorrect.")
+				return
+			}
+
+			// Get new password
+			fmt.Println("\nCreate a new vault password.")
+			fmt.Println("⚠️  IMPORTANT: This password cannot be recovered. Please remember it!")
+			newPass, err := utils.GetPassword("New Vault Password: ")
+			if err != nil {
+				fmt.Printf("❌ Error reading password: %v\n", err)
+				return
+			}
+
+			if newPass == "" {
+				fmt.Println("❌ New password cannot be empty.")
+				return
+			}
+
+			// Confirm new password
+			passConfirm, err := utils.GetPassword("Confirm New Vault Password: ")
+			if err != nil {
+				fmt.Printf("❌ Error reading password: %v\n", err)
+				return
+			}
+
+			if newPass != passConfirm {
+				fmt.Println("❌ New passwords do not match.")
+				return
+			}
+
+			fmt.Println("\nResetting vault password...")
+
+			// Reset the password
+			err = utils.ResetPassword(session, newPass)
+			if err != nil {
+				fmt.Printf("❌ Password reset failed: %v\n", err)
+				return
+			}
+
+			// Only save the updated session if we were already in a persistent session
+			if isPersistent {
+				session.Save()
+			}
+
+			fmt.Println("✔ Password reset successful!")
+			fmt.Println("Your vault has been re-encrypted with the new password.")
+		},
+	}
+
 	// --- CONNECT ---
 	var connectCmd = &cobra.Command{
 		Use:     "connect [username]",
@@ -877,7 +952,7 @@ Examples:
 	}
 
 	rootCmd.AddCommand(
-		setupCmd, connectCmd, disconnectCmd,
+		setupCmd, connectCmd, resetPasswordCmd, disconnectCmd,
 		uploadCmd, downloadCmd, deleteCmd,
 		listCmd, searchCmd, purgeCmd, shareCmd, readCmd, sharedCmd, settingsCmd, infoCmd,
 		locallsCmd, localdirCmd,

utils/auth.go

@@ -1,6 +1,7 @@
 package utils
 
 import (
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -152,3 +153,120 @@ func FetchSessionStateless(username string, password string) (*Session, error) {
 		Settings:    settings,
 	}, nil
 }
+
+// ResetPassword changes the vault password and re-encrypts all protected data
+func ResetPassword(session *Session, newPassword string) error {
+	repoURL := fmt.Sprintf("git@github.com:%s/.zephyrus.git", session.Username)
+
+	PrintProgressStep(1, 5, "Validating new password...")
+	if newPassword == "" {
+		return fmt.Errorf("new password cannot be empty")
+	}
+	PrintCompletionLine("Password validated")
+
+	// Re-encrypt master key with new password
+	PrintProgressStep(2, 5, "Re-encrypting master key...")
+	newMasterKeyEncrypted, err := Encrypt(session.RawKey, newPassword)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt master key: %w", err)
+	}
+	PrintCompletionLine("Master key re-encrypted")
+
+	// Re-encrypt index with new password
+	// First, we need to update all file keys in the index
+	PrintProgressStep(3, 5, "Re-encrypting vault index...")
+	err = updateIndexFileKeysForPassword(session.Index, session.Password, newPassword)
+	if err != nil {
+		return fmt.Errorf("failed to update file keys: %w", err)
+	}
+
+	indexBytes, err := session.Index.ToBytes(newPassword)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt index: %w", err)
+	}
+	PrintCompletionLine("Vault index re-encrypted")
+
+	// Re-encrypt settings with new password
+	PrintProgressStep(4, 5, "Re-encrypting settings...")
+	settingsBytes, err := session.Settings.ToBytes(newPassword)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt settings: %w", err)
+	}
+	PrintCompletionLine("Settings re-encrypted")
+
+	// Re-encrypt shared index with new password
+	sharedIndexEncrypted, err := session.SharedIndex.EncryptForRemote(newPassword)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt shared index: %w", err)
+	}
+
+	// Push all re-encrypted files to GitHub
+	PrintProgressStep(5, 5, "Pushing updated files to GitHub...")
+	filesToPush := map[string][]byte{
+		".config/key":          newMasterKeyEncrypted,
+		".config/index":        indexBytes,
+		".config/settings":     settingsBytes,
+		"shared/.config/index": sharedIndexEncrypted,
+	}
+
+	err = PushFilesWithAuthor(repoURL, session.RawKey, filesToPush, session.Settings.CommitMessage, session.Settings.CommitAuthorName, session.Settings.CommitAuthorEmail)
+	if err != nil {
+		return fmt.Errorf("failed to push updated files: %w", err)
+	}
+	PrintCompletionLine("Files pushed to GitHub")
+
+	// Update session password and save locally if persistent
+	session.Password = newPassword
+	session.Save()
+
+	return nil
+}
+
+// updateIndexFileKeysForPassword recursively updates all file key encryption in the index
+func updateIndexFileKeysForPassword(vi VaultIndex, oldPassword string, newPassword string) error {
+	return updateIndexTreeFileKeys(vi, oldPassword, newPassword)
+}
+
+// updateIndexTreeFileKeys recursively walks the index and updates file key encryption
+func updateIndexTreeFileKeys(entries VaultIndex, oldPassword string, newPassword string) error {
+	for name, entry := range entries {
+		if entry.Type == "file" {
+			// Decrypt file key with old password
+			encryptedKey, err := DecryptHexString(entry.FileKey, oldPassword)
+			if err != nil {
+				return fmt.Errorf("failed to decrypt file key: %w", err)
+			}
+
+			// Re-encrypt with new password
+			newEncryptedKey, err := Encrypt(encryptedKey, newPassword)
+			if err != nil {
+				return fmt.Errorf("failed to re-encrypt file key: %w", err)
+			}
+
+			// Update the entry with hex-encoded new encrypted key
+			entry.FileKey = HexEncodeBytes(newEncryptedKey)
+			entries[name] = entry // Write back to map
+		} else if entry.Type == "folder" && entry.Contents != nil {
+			// Recurse into subdirectories
+			err := updateIndexTreeFileKeys(entry.Contents, oldPassword, newPassword)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// DecryptHexString decrypts a hex-encoded encrypted string
+func DecryptHexString(hexStr string, password string) ([]byte, error) {
+	encryptedData, err := hex.DecodeString(hexStr)
+	if err != nil {
+		return nil, err
+	}
+	return Decrypt(encryptedData, password)
+}
+
+// HexEncodeBytes encodes bytes as a hex string
+func HexEncodeBytes(data []byte) string {
+	return hex.EncodeToString(data)
+}