Project: Password Manager with Encryption

# Encryption and Security Core

import os
import json
import hashlib
import base64
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2
import secrets
import string

# Configuration
MASTER_PASSWORD_FILE = 'master.hash'
SALT_FILE = 'salt.key'
PASSWORDS_FILE = 'passwords.enc'

# === Master password hashing ===

def hash_master_password(password, salt=None):
    """
    Hash master password with salt.
    
    Args:
        password (str): Master password
        salt (bytes): Salt for hashing (generates if None)
    
    Returns:
        tuple: (hash, salt) as bytes
    """
    if salt is None:
        salt = os.urandom(32)  # 256-bit salt
    
    # Use SHA-256 with many iterations
    password_hash = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        100000  # 100,000 iterations
    )
    
    return password_hash, salt

def verify_master_password(password, stored_hash, salt):
    """
    Verify master password against stored hash.
    
    Args:
        password (str): Password to verify
        stored_hash (bytes): Stored password hash
        salt (bytes): Salt used for hashing
    
    Returns:
        bool: True if password matches
    """
    password_hash, _ = hash_master_password(password, salt)
    return password_hash == stored_hash

# === Encryption key derivation ===

def derive_key_from_password(password, salt):
    """
    Derive encryption key from master password.
    
    Args:
        password (str): Master password
        salt (bytes): Salt for key derivation
    
    Returns:
        bytes: Encryption key for Fernet
    """
    kdf = PBKDF2(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=100000
    )
    
    key = base64.urlsafe_b64encode(
        kdf.derive(password.encode('utf-8'))
    )
    
    return key

def initialize_cipher(master_password, salt):
    """
    Initialize Fernet cipher with master password.
    
    Args:
        master_password (str): Master password
        salt (bytes): Salt for key derivation
    
    Returns:
        Fernet: Initialized cipher
    """
    key = derive_key_from_password(master_password, salt)
    return Fernet(key)

# === Encryption and decryption ===

def encrypt_password(cipher, password):
    """
    Encrypt password.
    
    Args:
        cipher (Fernet): Initialized cipher
        password (str): Password to encrypt
    
    Returns:
        str: Encrypted password (base64)
    """
    encrypted = cipher.encrypt(password.encode('utf-8'))
    return encrypted.decode('utf-8')

def decrypt_password(cipher, encrypted_password):
    """
    Decrypt password.
    
    Args:
        cipher (Fernet): Initialized cipher
        encrypted_password (str): Encrypted password
    
    Returns:
        str: Decrypted password
    """
    try:
        decrypted = cipher.decrypt(encrypted_password.encode('utf-8'))
        return decrypted.decode('utf-8')
    except Exception:
        raise ValueError("Failed to decrypt password. Wrong master password?")

# === Password generation ===

def generate_password(length=16, use_uppercase=True, use_lowercase=True,
                     use_digits=True, use_special=True):
    """
    Generate secure random password.
    
    Args:
        length (int): Password length
        use_uppercase (bool): Include uppercase letters
        use_lowercase (bool): Include lowercase letters
        use_digits (bool): Include digits
        use_special (bool): Include special characters
    
    Returns:
        str: Generated password
    """
    if length < 8:
        raise ValueError("Password must be at least 8 characters")
    
    # Build character set
    characters = ''
    if use_uppercase:
        characters += string.ascii_uppercase
    if use_lowercase:
        characters += string.ascii_lowercase
    if use_digits:
        characters += string.digits
    if use_special:
        characters += string.punctuation
    
    if not characters:
        raise ValueError("Must include at least one character type")
    
    # Generate password using secrets (cryptographically strong)
    password = ''.join(secrets.choice(characters) for _ in range(length))
    
    return password

def assess_password_strength(password):
    """
    Assess password strength.
    
    Args:
        password (str): Password to assess
    
    Returns:
        tuple: (strength_score, feedback)
    """
    score = 0
    feedback = []
    
    # Length check
    if len(password) >= 12:
        score += 2
    elif len(password) >= 8:
        score += 1
    else:
        feedback.append("Password should be at least 8 characters")
    
    # Character variety
    if any(c.isupper() for c in password):
        score += 1
    else:
        feedback.append("Add uppercase letters")
    
    if any(c.islower() for c in password):
        score += 1
    else:
        feedback.append("Add lowercase letters")
    
    if any(c.isdigit() for c in password):
        score += 1
    else:
        feedback.append("Add numbers")
    
    if any(c in string.punctuation for c in password):
        score += 1
    else:
        feedback.append("Add special characters")
    
    # Determine strength level
    if score >= 6:
        strength = "Strong"
    elif score >= 4:
        strength = "Medium"
    else:
        strength = "Weak"
    
    return strength, feedback

# === File operations ===

def save_salt(salt):
    """
    Save salt to file.
    
    Args:
        salt (bytes): Salt to save
    """
    with open(SALT_FILE, 'wb') as f:
        f.write(salt)

def load_salt():
    """
    Load salt from file.
    
    Returns:
        bytes: Loaded salt or None
    """
    try:
        with open(SALT_FILE, 'rb') as f:
            return f.read()
    except FileNotFoundError:
        return None

def save_master_hash(password_hash):
    """
    Save master password hash.
    
    Args:
        password_hash (bytes): Hash to save
    """
    with open(MASTER_PASSWORD_FILE, 'wb') as f:
        f.write(password_hash)

def load_master_hash():
    """
    Load master password hash.
    
    Returns:
        bytes: Loaded hash or None
    """
    try:
        with open(MASTER_PASSWORD_FILE, 'rb') as f:
            return f.read()
    except FileNotFoundError:
        return None

def save_passwords(passwords):
    """
    Save encrypted passwords.
    
    Args:
        passwords (dict): Password dictionary
    
    Returns:
        bool: True if successful
    """
    try:
        with open(PASSWORDS_FILE, 'w') as f:
            json.dump(passwords, f, indent=2)
        return True
    except Exception as e:
        print(f"Error saving passwords: {e}")
        return False

def load_passwords():
    """
    Load encrypted passwords.
    
    Returns:
        dict: Password dictionary
    """
    try:
        with open(PASSWORDS_FILE, 'r') as f:
            return json.load(f)
    except FileNotFoundError:
        return {}
    except json.JSONDecodeError:
        print("Warning: Password file corrupted")
        return {}

# === Security utilities ===

def clear_sensitive_data(data):
    """
    Securely clear sensitive data from memory.
    
    Args:
        data (str): Data to clear
    
    Note: This is best-effort in Python
    """
    # Overwrite memory (best effort in Python)
    if isinstance(data, str):
        data = '0' * len(data)

def is_first_time_setup():
    """
    Check if this is first time setup.
    
    Returns:
        bool: True if no master password exists
    """
    return not os.path.exists(MASTER_PASSWORD_FILE)

print("Encryption core implementation completed!")

# Password Management Operations

import uuid
from datetime import datetime
import getpass

# Import encryption functions
from encryption_core import (
    encrypt_password, decrypt_password,
    load_passwords, save_passwords
)

# === Password entry structure ===

"""
Password Entry:
{
    'id': 'unique-uuid',
    'service': 'Service name',
    'username': 'Username/email',
    'password': 'encrypted_password',
    'url': 'Optional URL',
    'notes': 'Optional notes',
    'created_at': 'timestamp',
    'updated_at': 'timestamp'
}
"""

# === CRUD operations ===

def add_password_entry(cipher, service, username, password, 
                       url='', notes=''):
    """
    Add new password entry.
    
    Args:
        cipher (Fernet): Encryption cipher
        service (str): Service name
        username (str): Username
        password (str): Password to encrypt
        url (str): Optional URL
        notes (str): Optional notes
    
    Returns:
        bool: True if successful
    """
    # Validate inputs
    if not service or not username or not password:
        print("\n✗ Service, username, and password are required")
        return False
    
    # Load existing passwords
    passwords = load_passwords()
    
    # Check for duplicate
    for entry in passwords.values():
        if (entry['service'].lower() == service.lower() and 
            entry['username'].lower() == username.lower()):
            print("\n⚠ Entry already exists for this service and username")
            overwrite = input("Overwrite? (yes/no): ").strip().lower()
            if overwrite != 'yes':
                return False
            # Remove old entry
            passwords = {k: v for k, v in passwords.items() 
                        if not (v['service'].lower() == service.lower() and
                               v['username'].lower() == username.lower())}
    
    # Encrypt password
    encrypted_password = encrypt_password(cipher, password)
    
    # Create entry
    entry_id = str(uuid.uuid4())
    timestamp = datetime.now().isoformat()
    
    entry = {
        'id': entry_id,
        'service': service.strip(),
        'username': username.strip(),
        'password': encrypted_password,
        'url': url.strip(),
        'notes': notes.strip(),
        'created_at': timestamp,
        'updated_at': timestamp
    }
    
    # Add to passwords
    passwords[entry_id] = entry
    
    # Save
    if save_passwords(passwords):
        print(f"\n✓ Password saved successfully!")
        return True
    else:
        print("\n✗ Failed to save password")
        return False

def get_password_entry(cipher, service, username=None):
    """
    Retrieve and decrypt password.
    
    Args:
        cipher (Fernet): Decryption cipher
        service (str): Service name
        username (str): Optional username filter
    
    Returns:
        list: Matching entries with decrypted passwords
    """
    passwords = load_passwords()
    
    matches = []
    for entry in passwords.values():
        if entry['service'].lower() == service.lower():
            if username is None or entry['username'].lower() == username.lower():
                # Decrypt password
                try:
                    decrypted = decrypt_password(cipher, entry['password'])
                    entry_copy = entry.copy()
                    entry_copy['password'] = decrypted
                    matches.append(entry_copy)
                except ValueError as e:
                    print(f"\n✗ Error decrypting password: {e}")
    
    return matches

def update_password_entry(cipher, entry_id, password=None, 
                          username=None, url=None, notes=None):
    """
    Update existing password entry.
    
    Args:
        cipher (Fernet): Encryption cipher
        entry_id (str): Entry ID to update
        password (str): New password (optional)
        username (str): New username (optional)
        url (str): New URL (optional)
        notes (str): New notes (optional)
    
    Returns:
        bool: True if successful
    """
    passwords = load_passwords()
    
    if entry_id not in passwords:
        print(f"\n✗ Entry with ID '{entry_id}' not found")
        return False
    
    entry = passwords[entry_id]
    
    # Update fields
    if password:
        entry['password'] = encrypt_password(cipher, password)
    if username:
        entry['username'] = username.strip()
    if url is not None:
        entry['url'] = url.strip()
    if notes is not None:
        entry['notes'] = notes.strip()
    
    entry['updated_at'] = datetime.now().isoformat()
    
    # Save
    if save_passwords(passwords):
        print("\n✓ Entry updated successfully!")
        return True
    else:
        print("\n✗ Failed to update entry")
        return False

def delete_password_entry(entry_id):
    """
    Delete password entry.
    
    Args:
        entry_id (str): Entry ID to delete
    
    Returns:
        bool: True if successful
    """
    passwords = load_passwords()
    
    if entry_id not in passwords:
        print(f"\n✗ Entry with ID '{entry_id}' not found")
        return False
    
    # Remove entry
    del passwords[entry_id]
    
    # Save
    if save_passwords(passwords):
        print("\n✓ Entry deleted successfully!")
        return True
    else:
        print("\n✗ Failed to delete entry")
        return False

def list_all_entries():
    """
    List all password entries (without passwords).
    
    Returns:
        list: List of entries without passwords
    """
    passwords = load_passwords()
    
    entries = []
    for entry in passwords.values():
        # Create copy without password
        safe_entry = {
            'id': entry['id'],
            'service': entry['service'],
            'username': entry['username'],
            'url': entry.get('url', ''),
            'created_at': entry['created_at']
        }
        entries.append(safe_entry)
    
    return sorted(entries, key=lambda x: x['service'].lower())

def search_entries(query):
    """
    Search entries by service name.
    
    Args:
        query (str): Search query
    
    Returns:
        list: Matching entries
    """
    passwords = load_passwords()
    query_lower = query.lower()
    
    matches = []
    for entry in passwords.values():
        if (query_lower in entry['service'].lower() or
            query_lower in entry['username'].lower() or
            query_lower in entry.get('notes', '').lower()):
            
            safe_entry = {
                'id': entry['id'],
                'service': entry['service'],
                'username': entry['username'],
                'url': entry.get('url', '')
            }
            matches.append(safe_entry)
    
    return matches

# === Display functions ===

def display_entry(entry, show_password=False):
    """
    Display password entry.
    
    Args:
        entry (dict): Entry to display
        show_password (bool): Whether to show password
    """
    print(f"\nService: {entry['service']}")
    print(f"Username: {entry['username']}")
    
    if show_password and 'password' in entry:
        print(f"Password: {entry['password']}")
    
    if entry.get('url'):
        print(f"URL: {entry['url']}")
    
    if entry.get('notes'):
        print(f"Notes: {entry['notes']}")
    
    print(f"ID: {entry['id']}")
    print(f"Created: {entry.get('created_at', 'N/A')}")

def display_entry_list(entries):
    """
    Display list of entries.
    
    Args:
        entries (list): List of entries
    """
    if not entries:
        print("\nNo entries found.")
        return
    
    print("\n" + "="*60)
    print("  STORED PASSWORDS")
    print("="*60)
    
    for i, entry in enumerate(entries, 1):
        print(f"\n{i}. {entry['service']}")
        print(f"   Username: {entry['username']}")
        print(f"   ID: {entry['id']}")
    
    print()

print("Password management operations completed!")