oli/vaultwarden-ssh-agent
1
0
Fork 0
Code Actions Packages Releases Activity

fix: resolve session corruption and sync issues

Browse Source 
- Use BW_SESSION environment variable because commands don't support `--session` parameter anymore
- Suppress output from bw login and cmdkey to prevent pipeline pollution
- Set/unset BW_SESSION immediately in try/finally blocks for security
This commit is contained in:
Oli
2025-11-01 14:32:17 +01:00
parent 5daf68237d
commit d34142eef0
1 changed files with 34 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
vaultwarden_ssh-agent.ps1
View File

@@ -143,10 +143,9 @@ function Get-BWSession {
# bw status is always locked when using --session # bw status is always locked when using --session
# https://github.com/bitwarden/clients/issues/9254 # https://github.com/bitwarden/clients/issues/9254
[Environment]::SetEnvironmentVariable("BW_SESSION", $Session, [System.EnvironmentVariableTarget]::Process) [Environment]::SetEnvironmentVariable("BW_SESSION", $Session, [System.EnvironmentVariableTarget]::Process)
$StatusResult = & bw status 2>&1 $Status = & bw status | ConvertFrom-Json
[Environment]::SetEnvironmentVariable("BW_SESSION", $null, [System.EnvironmentVariableTarget]::Process) [Environment]::SetEnvironmentVariable("BW_SESSION", $null, [System.EnvironmentVariableTarget]::Process)
if ($LASTEXITCODE -eq 0) { if ($LASTEXITCODE -eq 0) {
$Status = $StatusResult | ConvertFrom-Json
if ($Status.status -eq "unlocked") { if ($Status.status -eq "unlocked") {
Write-Debug "Stored session is valid" Write-Debug "Stored session is valid"
Write-Host "Using stored session" Write-Host "Using stored session"
@@ -173,10 +172,13 @@ function Get-BWSession {
if ($Status.status -eq "unauthenticated") { if ($Status.status -eq "unauthenticated") {
Write-Debug "Not logged in, attempting API key login" Write-Debug "Not logged in, attempting API key login"
& bw login --apikey & bw login --apikey | Out-Null
if ($LASTEXITCODE -ne 0) { if ($LASTEXITCODE -ne 0) {
throw "Login failed" throw "Login failed"
} }
# Get status again after login to retrieve user email
Write-Debug "Getting user info after login"
$Status = & bw status | ConvertFrom-Json
} }
else { else {
Write-Debug "Already logged in as $($Status.userEmail)" Write-Debug "Already logged in as $($Status.userEmail)"
@@ -189,8 +191,8 @@ function Get-BWSession {
} }
# Store session in Windows Credential Manager # Store session in Windows Credential Manager
Write-Debug "Storing session in Windows Credential Manager" Write-Debug "Storing session in Windows Credential Manager for user: $($Status.userEmail)"
$Result = & cmdkey /generic:"Vaultwarden_Session" /user:$($Status.userEmail) /pass:$NewSession $Result = & cmdkey /generic:"Vaultwarden_Session" /user:"$($Status.userEmail)" /pass:"$NewSession" | Out-Null
if ($LASTEXITCODE -ne 0) { if ($LASTEXITCODE -ne 0) {
throw "Failed to store session: $Result" throw "Failed to store session: $Result"
} }
@@ -243,7 +245,13 @@ function Get-FolderId {
) )
Write-Debug "Getting folder: $FolderName" Write-Debug "Getting folder: $FolderName"
$Folders = & bw list folders --session $Session --search $FolderName | ConvertFrom-Json try {
[Environment]::SetEnvironmentVariable("BW_SESSION", $Session, [System.EnvironmentVariableTarget]::Process)
$Folders = & bw list folders --search $FolderName | ConvertFrom-Json
}
finally {
[Environment]::SetEnvironmentVariable("BW_SESSION", $null, [System.EnvironmentVariableTarget]::Process)
}
$Folder = $Folders | Where-Object { $_.name -eq $FolderName } $Folder = $Folders | Where-Object { $_.name -eq $FolderName }
if (-not $Folder) { if (-not $Folder) {
@@ -262,8 +270,14 @@ function Get-FolderItems {
) )
Write-Debug "Getting items from folder: $FolderId" Write-Debug "Getting items from folder: $FolderId"
try {
[Environment]::SetEnvironmentVariable("BW_SESSION", $Session, [System.EnvironmentVariableTarget]::Process)
$Items = & bw list items --folderid $FolderId | ConvertFrom-Json
}
finally {
[Environment]::SetEnvironmentVariable("BW_SESSION", $null, [System.EnvironmentVariableTarget]::Process)
}
# Add filter for SSH key type (type=5) # Add filter for SSH key type (type=5)
$Items = & bw list items --session $Session --folderid $FolderId | ConvertFrom-Json
$SshKeyItems = $Items | Where-Object { $_.type -eq 5 } $SshKeyItems = $Items | Where-Object { $_.type -eq 5 }
Write-Debug "Found $($SshKeyItems.Count) SSH key items" Write-Debug "Found $($SshKeyItems.Count) SSH key items"
return $SshKeyItems return $SshKeyItems
@@ -361,6 +375,9 @@ function Add-PrivateKeyToSSHAgent {
if ($PrivateKeyPlain) { if ($PrivateKeyPlain) {
Clear-SensitiveData $PrivateKeyPlain Clear-SensitiveData $PrivateKeyPlain
} }
if ($SSHKey.PrivateKey) {
Clear-SensitiveData $SSHKey.PrivateKey
}
if ($Process) { if ($Process) {
$Process.Dispose() $Process.Dispose()
} }
@@ -384,9 +401,16 @@ try {
$Session = Get-BWSession $Session = Get-BWSession
# Sync vault # Sync vault
Write-Debug "Syncing vault" Write-Host "Syncing vault"
& bw sync --session $Session --quiet try {
if ($LASTEXITCODE -ne 0) { [Environment]::SetEnvironmentVariable("BW_SESSION", $Session, [System.EnvironmentVariableTarget]::Process)
& bw sync | Out-Null
$SyncExitCode = $LASTEXITCODE
}
finally {
[Environment]::SetEnvironmentVariable("BW_SESSION", $null, [System.EnvironmentVariableTarget]::Process)
}
if ($SyncExitCode -ne 0) {
throw "Failed to sync vault" throw "Failed to sync vault"
} }