Keeshare Support

.gitignore

@@ -48,6 +48,8 @@ Thumbs.db
 
 /src/java/kp2akeytransform/.settings
 
+/src/java/PluginQR/.settings
+
 /src/java/workspace/UITest
 /src/java/JavaFileStorage/gen/keepass2android/javafilestorage/BuildConfig.java
 /src/java/JavaFileStorage/gen/keepass2android/javafilestorage/R.java

src/KeeShare.Tests/HasKeeShareGroupsTests.cs

@@ -0,0 +1,73 @@
+using KeePassLib;
+using keepass2android;
+
+namespace KeeShare.Tests
+{
+    public class HasKeeShareGroupsTests
+    {
+        [Fact]
+        public void HasKeeShareGroups_WithNoGroups_ReturnsFalse()
+        {
+            var root = new PwGroup();
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.False(result);
+        }
+
+        [Fact]
+        public void HasKeeShareGroups_WithKeeShareActiveTrue_ReturnsTrue()
+        {
+            var root = new PwGroup();
+            root.CustomData.Set("KeeShare.Active", "true");
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void HasKeeShareGroups_WithKeeShareActiveFalse_ReturnsFalse()
+        {
+            var root = new PwGroup();
+            root.CustomData.Set("KeeShare.Active", "false");
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.False(result);
+        }
+
+        [Fact]
+        public void HasKeeShareGroups_WithNestedKeeShareGroup_ReturnsTrue()
+        {
+            var root = new PwGroup();
+            var child1 = new PwGroup();
+            var child2 = new PwGroup();
+            child2.CustomData.Set("KeeShare.Active", "true");
+            child1.AddGroup(child2, true);
+            root.AddGroup(child1, true);
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void HasKeeShareGroups_WithMultipleNonKeeShareGroups_ReturnsFalse()
+        {
+            var root = new PwGroup();
+            root.AddGroup(new PwGroup(), true);
+            root.AddGroup(new PwGroup(), true);
+            root.AddGroup(new PwGroup(), true);
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.False(result);
+        }
+
+        [Fact]
+        public void HasKeeShareGroups_WithDeeplyNestedKeeShareGroup_ReturnsTrue()
+        {
+            var root = new PwGroup();
+            var level1 = new PwGroup();
+            var level2 = new PwGroup();
+            var level3 = new PwGroup();
+            level3.CustomData.Set("KeeShare.Active", "true");
+            level2.AddGroup(level3, true);
+            level1.AddGroup(level2, true);
+            root.AddGroup(level1, true);
+            bool result = keepass2android.KeeShare.HasKeeShareGroups(root);
+            Assert.True(result);
+        }
+    }
+}

src/KeeShare.Tests/KeeShare.Tests.csproj

@@ -0,0 +1,41 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
+    <PackageReference Include="Moq" Version="4.20.70" />
+    <PackageReference Include="xunit" Version="2.5.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.3" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Remove="TestData\*.kdbx" />
+    <None Remove="TestData\*.zip" />
+    <None Remove="TestData\*.sig" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <EmbeddedResource Include="TestData\**\*">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </EmbeddedResource>
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\keepass2android-app\keepass2android-app.csproj" />
+    <ProjectReference Include="..\KeePassLib2Android\KeePassLib2Android.csproj" />
+  </ItemGroup>
+
+</Project>

src/KeeShare.Tests/SignatureVerificationTests.cs

@@ -0,0 +1,206 @@
+using System.Security.Cryptography;
+using System.Text;
+using keepass2android;
+
+namespace KeeShare.Tests
+{
+    public class SignatureVerificationTests
+    {
+        /// <summary>
+        /// Helper to convert bytes to hex string (KeeShare format)
+        /// </summary>
+        private static string BytesToHex(byte[] bytes)
+        {
+            return BitConverter.ToString(bytes).Replace("-", "").ToLowerInvariant();
+        }
+
+        /// <summary>
+        /// Helper to format signature in KeeShare format: "rsa|<hex>"
+        /// </summary>
+        private static byte[] FormatKeeShareSignature(byte[] signature)
+        {
+            string hex = BytesToHex(signature);
+            return Encoding.UTF8.GetBytes($"rsa|{hex}");
+        }
+
+        [Fact]
+        public void VerifySignature_WithValidSignature_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            byte[] signatureData = FormatKeeShareSignature(signature);
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.True(result, "Signature verification should succeed with valid signature");
+        }
+
+        [Fact]
+        public void VerifySignature_WithValidSignatureWithoutPrefix_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            // Hex without "rsa|" prefix should also work
+            string signatureHex = BytesToHex(signature);
+            byte[] signatureData = Encoding.UTF8.GetBytes(signatureHex);
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.True(result, "Signature verification should succeed with hex signature without prefix");
+        }
+
+        [Fact]
+        public void VerifySignature_WithInvalidSignature_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] invalidSignature = new byte[256];
+            new Random().NextBytes(invalidSignature);
+            byte[] signatureData = FormatKeeShareSignature(invalidSignature);
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.False(result, "Signature verification should fail with invalid signature");
+        }
+
+        [Fact]
+        public void VerifySignature_WithTamperedData_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] originalData = Encoding.UTF8.GetBytes("Original KDBX data");
+            byte[] hash = SHA256.HashData(originalData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            byte[] signatureData = FormatKeeShareSignature(signature);
+            byte[] tamperedData = Encoding.UTF8.GetBytes("Tampered KDBX data");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, tamperedData, signatureData);
+            Assert.False(result, "Signature verification should fail when data is tampered");
+        }
+
+        [Fact]
+        public void VerifySignature_WithPemFormattedCertificate_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCertBase64 = Convert.ToBase64String(publicKeyBytes);
+            string publicKeyCertPem = $"-----BEGIN PUBLIC KEY-----\n{publicKeyCertBase64}\n-----END PUBLIC KEY-----";
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            byte[] signatureData = FormatKeeShareSignature(signature);
+            bool result = KeeShare.VerifySignatureCore(publicKeyCertPem, testData, signatureData);
+            Assert.True(result, "Signature verification should work with PEM formatted certificate");
+        }
+
+        [Fact]
+        public void VerifySignature_WithEmptyCertificate_ReturnsFalse()
+        {
+            byte[] testData = Encoding.UTF8.GetBytes("Test data");
+            byte[] signatureData = Encoding.UTF8.GetBytes("rsa|abcd1234");
+            bool result = KeeShare.VerifySignatureCore("", testData, signatureData);
+            Assert.False(result, "Signature verification should fail with empty certificate");
+        }
+
+        [Fact]
+        public void VerifySignature_WithNullData_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] signatureData = Encoding.UTF8.GetBytes("rsa|abcd1234");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, null, signatureData);
+            Assert.False(result, "Signature verification should fail with null data");
+        }
+
+        [Fact]
+        public void VerifySignature_WithEmptyData_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] signatureData = Encoding.UTF8.GetBytes("rsa|abcd1234");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, new byte[0], signatureData);
+            Assert.False(result, "Signature verification should fail with empty data");
+        }
+
+        [Fact]
+        public void VerifySignature_WithMalformedHexSignature_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test data");
+            // Invalid hex characters
+            byte[] signatureData = Encoding.UTF8.GetBytes("rsa|not-valid-hex!@#$GHIJ");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.False(result, "Signature verification should fail with malformed hex");
+        }
+
+        [Fact]
+        public void VerifySignature_WithOddLengthHex_ReturnsFalse()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test data");
+            // Odd-length hex string (invalid)
+            byte[] signatureData = Encoding.UTF8.GetBytes("rsa|abc");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.False(result, "Signature verification should fail with odd-length hex");
+        }
+
+        [Fact]
+        public void VerifySignature_WithSignatureContainingWhitespace_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            string signatureHex = BytesToHex(signature);
+            // Add whitespace around the signature
+            string signatureWithWhitespace = $"\r\n  rsa|{signatureHex}  \r\n";
+            byte[] signatureData = Encoding.UTF8.GetBytes(signatureWithWhitespace);
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.True(result, "Signature verification should handle whitespace in signature");
+        }
+
+        [Fact]
+        public void VerifySignature_WithUppercaseHex_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            // Use uppercase hex
+            string signatureHex = BitConverter.ToString(signature).Replace("-", "").ToUpperInvariant();
+            byte[] signatureData = Encoding.UTF8.GetBytes($"rsa|{signatureHex}");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.True(result, "Signature verification should handle uppercase hex");
+        }
+
+        [Fact]
+        public void VerifySignature_WithUppercaseRsaPrefix_ReturnsTrue()
+        {
+            using var rsa = RSA.Create(2048);
+            var publicKeyBytes = rsa.ExportSubjectPublicKeyInfo();
+            var publicKeyCert = Convert.ToBase64String(publicKeyBytes);
+            byte[] testData = Encoding.UTF8.GetBytes("Test KDBX data content");
+            byte[] hash = SHA256.HashData(testData);
+            byte[] signature = rsa.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+            string signatureHex = BytesToHex(signature);
+            // Use uppercase "RSA|" prefix
+            byte[] signatureData = Encoding.UTF8.GetBytes($"RSA|{signatureHex}");
+            bool result = KeeShare.VerifySignatureCore(publicKeyCert, testData, signatureData);
+            Assert.True(result, "Signature verification should handle uppercase RSA prefix");
+        }
+    }
+}

src/Kp2aBusinessLogic/database/edit/LoadDB.cs

@@ -46,7 +46,7 @@ public class LoadDb : OperationWithFinishHandler
 
     public LoadDb(IKp2aApp app, IOConnectionInfo ioc, Task<MemoryStream> databaseData, CompositeKey compositeKey,
         string keyfileOrProvider, OnOperationFinishedHandler operationFinishedHandler,
-        bool updateLastUsageTimestamp, bool makeCurrent, IDatabaseModificationWatcher modificationWatcher = null) : base(app, operationFinishedHandler)
+        bool updateLastUsageTimestamp, bool makeCurrent, IDatabaseModificationWatcher modificationWatcher = null) : base(app, WrapHandlerForKeeShare(app, operationFinishedHandler))
     {
       _modificationWatcher = modificationWatcher ?? new NullDatabaseModificationWatcher();
       _app = app;
@@ -59,6 +59,26 @@ public LoadDb(IKp2aApp app, IOConnectionInfo ioc, Task<MemoryStream> databaseDat
       _rememberKeyfile = app.GetBooleanPreference(PreferenceKey.remember_keyfile);
     }
 
+    private static OnOperationFinishedHandler WrapHandlerForKeeShare(IKp2aApp app, OnOperationFinishedHandler originalHandler)
+    {
+      if (originalHandler == null)
+        return null;
+
+      return new ActionOnOperationFinished(app, (success, message, context) =>
+      {
+        originalHandler.SetResult(success, message, false, null);
+        if (success && app.CurrentDb?.KpDatabase?.IsOpen == true && 
+            KeeShare.HasKeeShareGroups(app.CurrentDb.KpDatabase.RootGroup))
+        {
+          KeeShare.Check(app, originalHandler);
+        }
+        else
+        {
+          originalHandler.Run();
+        }
+      });
+    }
+
     protected bool success = false;
     private bool _updateLastUsageTimestamp;
     private readonly bool _makeCurrent;

src/keepass2android-app/AssemblyInfo.cs

@@ -15,7 +15,8 @@ You should have received a copy of the GNU General Public License
   along with Keepass2Android.  If not, see <http://www.gnu.org/licenses/>.
   */
 
+using System.Runtime.CompilerServices;
 
-
+[assembly: InternalsVisibleTo("KeeShare.Tests")]
 
 

src/keepass2android-app/EntryActivity.cs

@@ -238,7 +238,7 @@ protected void SetEntryView()
     protected void SetupEditButtons()
     {
       View edit = FindViewById(Resource.Id.entry_edit);
-      if (App.Kp2a.CurrentDb.CanWrite && _historyIndex < 0)
+      if (App.Kp2a.CurrentDb.CanWrite && _historyIndex < 0 && !KeeShare.IsReadOnlyBecauseKeeShareImport(Entry))
       {
         edit.Visibility = ViewStates.Visible;
         edit.Click += (sender, e) =>