Passman vault backup script (with decryption proof of concept)

passman-dump.py

#!/usr/bin/env python3

import base64
import json
import logging
import os
import sys
from datetime import datetime as dt

import click
import requests
from sjcl import SJCL

logging.basicConfig(format='%(levelname)s:%(message)s', level=logging.DEBUG)

url = os.getenv("NEXTCLOUD_URL")
user = os.getenv("NEXTCLOUD_USER")
password = os.getenv("NEXTCLOUD_PASSWORD")
vault_name = os.getenv("PASSMAN_VAULT")
vault_password = os.getenv("PASSMAN_VAULT_PASSWORD")
decrypt = os.getenv("PASSMAN_DECRYPT", False)

# Get list of vaults
r = requests.get(f"https://{user}:{password}@{url}/apps/passman/api/v2/vaults")
vaults = r.json()

if r.status_code != 200:
    logging.error(r.text)
    sys.exit(1)

# Check if requested vault is found
guid = None
for v in vaults:
    if v.get("name") == vault_name:
        guid = v.get("guid")

if not guid:
    logging.error(f"Error, vault {vault_name} not in vaults!")
    sys.exit(1)

# Get requested vault by its GUID
r = requests.get(f"https://{user}:{password}@{url}/apps/passman/api/v2/vaults/{guid}")
vault = r.json()

if not decrypt:
    with open(f"{dt.now().isoformat()}-{vault_name}-dump", "w") as f:
        json.dump(vault, f)
    logging.info(f"Sucessfully created backup of passman vault '{vault_name}'")
    sys.exit(0)

# ToDo: nice decryptor
#    for item in vault.get("credentials"):
#        print(item.get("label"))
#        print(item.get("password"))
#        p = json.loads(base64.b64decode(item.get("password")))
#        print(p)
#        print(SJCL().decrypt(p, vault_password))