Skip to content

Commit 83f426b

Browse files
aeltorioaeltorio
committed
feat: update _sensitive_datas
1 parent 24ef292 commit 83f426b

File tree

7 files changed

+341
-20
lines changed

7 files changed

+341
-20
lines changed

‎_sensitive_datas/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
_sensitive_datas.tar.xz

‎_sensitive_datas/_sensitive_datas.tar.xz.enc‎

6.39 MB
Binary file not shown.

‎_sensitive_datas/_sensitive_datas.tar.xz.sha256‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
da0c31374d149b7e6d271c589c6b241fd3bf9ff012a0d8f99860675751e500d9

‎_sensitive_datas/restore_sensitive_datas‎

Lines changed: 171 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,185 @@
11
#!/bin/bash
2+
#
3+
# Copyright (c) 2025 Ronan Le Meillat - SCTG Development
4+
#
5+
# Permission is hereby granted, free of charge, to anyone obtaining a copy
6+
# of this software and associated documentation files (the "Software"), to deal
7+
# in the Software without restriction, including without limitation the rights
8+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
# copies of the Software, and to permit persons to whom the Software is
10+
# furnished to do so, subject to the following conditions:
11+
#
12+
# The above copyright notice and this permission notice shall be included in all
13+
# copies or substantial portions of the Software.
14+
#
15+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
# SOFTWARE.
22+
23+
# =============================================================================
24+
# Secure Restore Script for Sensitive Data
25+
# =============================================================================
26+
#
27+
# This script decrypts and displays the contents of an encrypted backup archive
28+
# created by the store_sensitive_datas script. It provides a preview of what
29+
# will be restored without actually performing the restoration.
30+
#
31+
# The restore process:
32+
# 1. Validates PROJECT_ROOT environment variable
33+
# 2. Ensures .gitignore excludes the archive from version control
34+
# 3. Decrypts the AES-256-CBC encrypted archive
35+
# 4. Verifies archive integrity using SHA256 hash
36+
# 5. Lists the contents of the decrypted archive
37+
# 6. Provides manual restoration instructions
38+
#
39+
# Requirements:
40+
# - PROJECT_ROOT environment variable must be set
41+
# - CRYPTOKEN environment variable must be set for decryption (if encrypted)
42+
# - OpenSSL must be installed
43+
# - tar must be installed
44+
# - Encrypted backup file must exist: _sensitive_datas/_sensitive_datas.tar.xz.enc
45+
#
46+
# Usage:
47+
# export PROJECT_ROOT="/path/to/project"
48+
# export CRYPTOKEN="your-encryption-key" # Only if backup was encrypted
49+
# ./restore_sensitive_datas
50+
#
51+
# Note: This script only decrypts and shows contents. Manual restoration required.
52+
# =============================================================================
53+
54+
# Configuration Section
55+
# ====================
56+
57+
# Encryption configuration (must match store_sensitive_datas)
58+
# AES-256-CBC with PBKDF2 provides strong encryption with key derivation
59+
# Note: AES-GCM would be preferred for authenticated encryption, but may not be
60+
# supported in all OpenSSL versions. AES-CBC with PBKDF2 is widely compatible.
61+
CIPHER_ALGO="aes-256-cbc"
62+
63+
# PBKDF2 iterations for key derivation (must match encryption settings)
64+
PBKDF2_ITERATIONS=100000
65+
66+
# =============================================================================
67+
# Main Script Logic
68+
# =============================================================================
69+
70+
# .env file is located one level from this script
71+
# load it
72+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
73+
if [ -f "$SCRIPT_DIR/../.env" ]; then
74+
set -a
75+
source "$SCRIPT_DIR/../.env"
76+
set +a
77+
fi
78+
79+
# Step 1: Validate PROJECT_ROOT
80+
# -----------------------------
281
if [ ! -n "$PROJECT_ROOT" ]; then
3-
echo "If you restore for a cloned repo you may declare a PROJECT_ROOT environment variable before running this"
82+
echo "INFO: PROJECT_ROOT environment variable not set"
83+
echo "For restoring in a cloned repository, set PROJECT_ROOT to the project root directory"
84+
echo "Example: export PROJECT_ROOT=\"/path/to/project\""
485
exit 0
586
fi
87+
688
echo "PROJECT_ROOT is set to '$PROJECT_ROOT'"
89+
90+
# Interactive confirmation (can be disabled for automation)
91+
echo "This will decrypt and show the contents of the backup archive."
792
read -p "Press any key to continue... " -n1 -s
93+
echo "" # New line after user input
94+
95+
# Save current directory and navigate to home (safety measure)
896
PWD=`pwd`
997
cd ~
10-
#1-decrypt
98+
99+
# Step 2: Ensure .gitignore excludes the archive
100+
# -----------------------------------------------
101+
GITIGNORE_FILE="$PROJECT_ROOT/_sensitive_datas/.gitignore"
102+
if [ ! -f "$GITIGNORE_FILE" ]; then
103+
echo "Creating .gitignore file to exclude sensitive archive..."
104+
# Ensure the directory exists
105+
mkdir -p "$PROJECT_ROOT/_sensitive_datas"
106+
echo "_sensitive_datas.tar.xz" > "$GITIGNORE_FILE"
107+
echo "✓ Created $GITIGNORE_FILE with archive exclusion rules"
108+
elif ! grep -q "^_sensitive_datas\.tar\.xz$" "$GITIGNORE_FILE"; then
109+
echo "Adding archive exclusion to existing .gitignore..."
110+
echo "_sensitive_datas.tar.xz" >> "$GITIGNORE_FILE"
111+
echo "✓ Updated $GITIGNORE_FILE with archive exclusion rules"
112+
else
113+
echo "✓ Archive exclusion already present in .gitignore"
114+
fi
115+
116+
# Step 3: Decrypt the archive
117+
# ---------------------------
118+
echo "Decrypting backup archive..."
119+
120+
# Build decryption command based on whether CRYPTOKEN is provided
11121
DECRYPT=""
12122
if [ -n "$CRYPTOKEN" ]; then
13123
DECRYPT="-pass pass:$CRYPTOKEN"
14-
echo "Decrypting with 'openssl aes-256-cbc -a -d -md sha256 $DECRYPT -in $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.enc -out $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz'"
124+
echo "Using encryption key for decryption..."
125+
echo "Command: openssl enc -${CIPHER_ALGO} -d -pbkdf2 -iter ${PBKDF2_ITERATIONS} $DECRYPT -in $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.enc -out $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz"
126+
else
127+
echo "No encryption key provided - attempting unencrypted restore..."
128+
fi
129+
130+
# Perform the decryption
131+
openssl enc -${CIPHER_ALGO} -d -pbkdf2 -iter ${PBKDF2_ITERATIONS} $DECRYPT \
132+
-in $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.enc \
133+
-out $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz
134+
135+
# Check if decryption was successful
136+
if [ $? -ne 0 ]; then
137+
echo "ERROR: Decryption failed!"
138+
echo "Possible causes:"
139+
echo " - Wrong encryption key (CRYPTOKEN)"
140+
echo " - Corrupted backup file"
141+
echo " - File not found: $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.enc"
142+
exit 1
143+
fi
144+
145+
# Step 4: Verify archive integrity
146+
# ----------------------------------
147+
echo "Verifying archive integrity..."
148+
if [ -f "$PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.sha256" ]; then
149+
EXPECTED_HASH=$(cat "$PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.sha256")
150+
ACTUAL_HASH=$(sha256sum "$PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz" | cut -d' ' -f1)
151+
152+
if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
153+
echo "⚠️ WARNING: Archive integrity check FAILED!"
154+
echo "Expected: $EXPECTED_HASH"
155+
echo "Actual: $ACTUAL_HASH"
156+
echo "The archive may be corrupted. Proceed with caution!"
157+
else
158+
echo "✓ Archive integrity verified"
159+
fi
15160
else
16-
DECRYPT=""
161+
echo "⚠️ WARNING: No integrity hash file found. Cannot verify archive integrity."
17162
fi
18-
openssl aes-256-cbc -a -d -md sha256 $DECRYPT -in $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz.enc -out $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz
19-
#2-show content
20-
echo "++++++++++++++++++++++++++++++++++++++++++++++++++"
21-
echo "_sensitive_datas/_sensitive_datas.tar.xz contains:"
163+
164+
# Step 5: Display archive contents
165+
# --------------------------------
166+
echo ""
167+
echo "=================================================================================="
168+
echo "✓ Decryption successful! Archive contents:"
169+
echo "=================================================================================="
22170
tar -tvJf $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz
23-
#3 show help
24-
echo "if you want to restore enter:"
25-
echo "cd $PROJECT_ROOT && tar -xvJf $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz && rm $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz"
171+
172+
# Step 6: Provide restoration instructions
173+
# ----------------------------------------
174+
echo ""
175+
echo "=================================================================================="
176+
echo "RESTORATION INSTRUCTIONS"
177+
echo "=================================================================================="
178+
echo "To complete the restoration, run these commands manually:"
179+
echo ""
180+
echo " cd $PROJECT_ROOT"
181+
echo " tar -xvJf $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz"
182+
echo " rm $PROJECT_ROOT/_sensitive_datas/_sensitive_datas.tar.xz"
183+
echo ""
184+
echo "WARNING: This will overwrite existing files with the same names!"
185+
echo "=================================================================================="

‎_sensitive_datas/store_sensitive_datas‎

Lines changed: 161 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,169 @@
11
#!/bin/bash
2-
#1-store
2+
#
3+
# Copyright (c) 2025 Ronan Le Meillat - SCTG Development
4+
#
5+
# Permission is hereby granted, free of charge, to any person obtaining a copy
6+
# of this software and associated documentation files (the "Software"), to deal
7+
# in the Software without restriction, including without limitation the rights
8+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
# copies of the Software, and to permit persons to whom the Software is
10+
# furnished to do so, subject to the following conditions:
11+
#
12+
# The above copyright notice and this permission notice shall be included in all
13+
# copies or substantial portions of the Software.
14+
#
15+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
# SOFTWARE.
22+
23+
# =============================================================================
24+
# Secure Backup Script for Sensitive Data
25+
# =============================================================================
26+
#
27+
# This script creates an encrypted backup of sensitive project files including:
28+
# - Environment variables (.env files)
29+
# - Cloudflare Worker configuration (.wrangler)
30+
# - VS Code settings and launch configurations
31+
# - Launch scripts
32+
#
33+
# The backup process:
34+
# 1. Validates required environment variables
35+
# 2. Creates a compressed tar.xz archive of specified files
36+
# 3. Calculates SHA256 integrity hash for verification
37+
# 4. Ensures .gitignore excludes the archive from version control
38+
# 5. Encrypts the archive using AES-256-CBC with PBKDF2 key derivation
39+
# 6. Removes the unencrypted archive for security
40+
#
41+
# Requirements:
42+
# - PROJECT_ROOT environment variable must be set
43+
# - CRYPTOKEN environment variable must be set for encryption
44+
# - OpenSSL must be installed
45+
# - tar must be installed
46+
#
47+
# Usage:
48+
# export PROJECT_ROOT="/path/to/project"
49+
# export CRYPTOKEN="your-encryption-key"
50+
# ./store_sensitive_datas
51+
#
52+
# Output:
53+
# _sensitive_datas/_sensitive_datas.tar.xz.enc (encrypted backup)
54+
# =============================================================================
55+
56+
# Configuration Section
57+
# ====================
58+
59+
# List of files and directories to include in the backup
60+
# Uses glob patterns for flexible file matching
61+
FILES_TO_BACKUP=(
62+
".env" # Environment variables
63+
"cloudflare-worker/.wrangler"
64+
"cloudflare-worker/.vscode/launch.json"
65+
"cloudflare-worker/.vscode/settings.json"
66+
client/.vscode/launch.json client/.vscode/settings.json
67+
./launch-* .env # Launch scripts
68+
)
69+
70+
# .env file is located one level from this script
71+
# load it
72+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
73+
if [ -f "$SCRIPT_DIR/../.env" ]; then
74+
set -a
75+
source "$SCRIPT_DIR/../.env"
76+
set +a
77+
fi
78+
79+
# Encryption configuration
80+
# AES-256-CBC with PBKDF2 provides strong encryption with key derivation
81+
# Note: AES-GCM would be preferred for authenticated encryption, but may not be
82+
# supported in all OpenSSL versions. AES-CBC with PBKDF2 is widely compatible.
83+
CIPHER_ALGO="aes-256-cbc"
84+
85+
# PBKDF2 iterations for key derivation (higher = more secure but slower)
86+
# 100,000 iterations provides good security while remaining practical
87+
PBKDF2_ITERATIONS=100000
88+
89+
# =============================================================================
90+
# Main Script Logic
91+
# =============================================================================
92+
93+
# Step 1: Validate environment variables
94+
# --------------------------------------
95+
if [ -z "${PROJECT_ROOT}" ]; then
96+
echo "ERROR: PROJECT_ROOT is empty: $PROJECT_ROOT"
97+
echo "Please set PROJECT_ROOT to the project root directory"
98+
exit -1
99+
fi
100+
3101
cd $PROJECT_ROOT
102+
4103
if [ -z "${CRYPTOKEN}" ]; then
5-
echo "CRYPTOKEN is empty: $CRYPTOKEN"
104+
echo "ERROR: CRYPTOKEN is empty: $CRYPTOKEN"
105+
echo "Please set CRYPTOKEN to your encryption passphrase"
6106
exit -1
7107
fi
108+
109+
# Step 2: Create compressed archive
110+
# ---------------------------------
111+
echo "Creating compressed archive of sensitive files..."
112+
rm -f _sensitive_datas/_sensitive_datas.tar.xz
8113
tar -cvJf _sensitive_datas/_sensitive_datas.tar.xz \
9-
cloudflare-worker/.wrangler cloudflare-worker/.vscode/launch.json cloudflare-worker/.vscode/settings.json \
10-
client/.vscode/launch.json client/.vscode/settings.json \
11-
./launch-* .env
12-
#2-encrypt
13-
openssl aes-256-cbc -base64 -md sha256 -pass pass:"$CRYPTOKEN" -in _sensitive_datas/_sensitive_datas.tar.xz -out _sensitive_datas/_sensitive_datas.tar.xz.enc
14-
#3-delete
114+
"${FILES_TO_BACKUP[@]}"
115+
116+
# Verify archive was created successfully
117+
if [ -z _sensitive_datas/_sensitive_datas.tar.xz ]; then
118+
echo "ERROR: Failed to create archive"
119+
exit 1
120+
fi
121+
122+
# Step 3: Calculate integrity hash
123+
# -----------------------------------
124+
echo "Calculating SHA256 integrity hash..."
125+
ARCHIVE_HASH=$(sha256sum _sensitive_datas/_sensitive_datas.tar.xz | cut -d' ' -f1)
126+
echo "$ARCHIVE_HASH" > _sensitive_datas/_sensitive_datas.tar.xz.sha256
127+
echo "✓ Integrity hash saved: $ARCHIVE_HASH"
128+
129+
# Step 4: Ensure .gitignore excludes the archive
130+
# -----------------------------------------------
131+
GITIGNORE_FILE="$PROJECT_ROOT/_sensitive_datas/.gitignore"
132+
if [ ! -f "$GITIGNORE_FILE" ]; then
133+
echo "Creating .gitignore file to exclude sensitive archive..."
134+
# Ensure the directory exists
135+
mkdir -p "$PROJECT_ROOT/_sensitive_datas"
136+
echo "_sensitive_datas.tar.xz" > "$GITIGNORE_FILE"
137+
echo "✓ Created $GITIGNORE_FILE with archive exclusion rules"
138+
elif ! grep -q "^_sensitive_datas\.tar\.xz$" "$GITIGNORE_FILE"; then
139+
echo "Adding archive exclusion to existing .gitignore..."
140+
echo "_sensitive_datas.tar.xz" >> "$GITIGNORE_FILE"
141+
echo "✓ Updated $GITIGNORE_FILE with archive exclusion rules"
142+
else
143+
echo "✓ Archive exclusion already present in .gitignore"
144+
fi
145+
146+
# Step 5: Encrypt the archive
147+
# ---------------------------
148+
echo "Encrypting archive with ${CIPHER_ALGO}..."
149+
openssl enc -${CIPHER_ALGO} -pbkdf2 -iter ${PBKDF2_ITERATIONS} -salt -pass pass:"$CRYPTOKEN" \
150+
-in _sensitive_datas/_sensitive_datas.tar.xz \
151+
-out _sensitive_datas/_sensitive_datas.tar.xz.enc
152+
153+
# Verify encryption was successful
154+
if [ $? -ne 0 ]; then
155+
echo "ERROR: Encryption failed"
156+
# Don't delete the unencrypted file if encryption failed
157+
exit 1
158+
fi
159+
160+
# Step 6: Clean up unencrypted archive
161+
# ------------------------------------
162+
echo "Removing unencrypted archive for security..."
15163
rm _sensitive_datas/_sensitive_datas.tar.xz
16164

17-
echo "CRYPTED with 'openssl aes-256-cbc -base64 -md sha256 -pass pass:\"$CRYPTOKEN\"'"
165+
# Step 7: Confirmation
166+
# -------------------
167+
echo "✓ Backup completed successfully!"
168+
echo "Encrypted backup saved as: _sensitive_datas/_sensitive_datas.tar.xz.enc"
169+
echo "Algorithm used: ${CIPHER_ALGO} with PBKDF2 (${PBKDF2_ITERATIONS} iterations)"

‎client/vite.config.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ export default defineConfig({
9999
"import.meta.env.AMAZON_BASE_URL": JSON.stringify(
100100
process.env.AMAZON_BASE_URL || "https://www.amazon.fr/gp/your-account/order-details?orderID=",
101101
),
102+
"import.meta.env.PAYPAL_TRANSACTION_BASE_URL": JSON.stringify(
103+
process.env.PAYPAL_TRANSACTION_BASE_URL || "https://www.paypal.com/myaccount/activities/details/",
104+
),
102105
},
103106
plugins: [react(), tsconfigPaths(), tailwindcss(), githubPagesSpa()],
104107
build: {

0 commit comments

Comments
 (0)