skarbiec password rules

Invocation#

skarbiec password rules <id>
skarbiec password rules <id> --set '<password rules>'
skarbiec password rules <id> --lookup
skarbiec password rules <id> --clear

Purpose#

Remember what a site accepts — its length cap, the symbols it allows — so every value generated for it is one it takes.

Required inputs and options#

• One item id. --set takes the rules in the Password Rules language Apple's passwordrules attribute and Password Manager Resources use (https://developer.apple.com/password-rules/); --lookup takes them instead from Password Manager Resources' list of the rules sites are known to enforce, https://raw.githubusercontent.com/apple/password-manager-resources/main/quirks/password-rules.json, downloaded whole with curl so no site name leaves; --clear removes them. POST /v1/operator/items/password-rules reads them with id; POST /v1/operator/items/password-rules/change takes id and set, lookup or clear.

Output and state effects#

• Alone it opens the item and prints ok, item, password_rules (null when it keeps none) and generator, the generate options the rules ask for. --set first turns the rules into generator options, so rules the generator could not follow are refused before anything is written, then stores them as the context's password_rules in a new revision, appends password-rules-set and prints ok, item, removed false, revision and generator. --lookup finds the first entry of the list for one of the sites the login's context names, a listed site matching its subdomains too, records its rules as --set does and adds found_for (the listed site), password_rules, source and attribution, the credit the list's MIT licence asks for. --clear removes them as a new revision and appends password-rules-cleared. The rules travel with the item's encryption; generate --rules-of <id> reads them, and Desktop's item inspector shows them as Password rules, with Save, Look up the site's rules, Clear and Replace the password following them.

Refusals#

• Anything but one id exits 2 with the usage; more than one of --set, --lookup and --clear exits 2, and --set with nothing exits 2. Rules generate --rules would refuse are refused in the same words, the list's included. --lookup refuses a login naming no site with `<id> names no site, so no site's rules can be looked up`, a site the list does not hold with `Password Manager Resources lists no password rules for <sites>`, and a list that cannot be reached with curl's reason. An item that does not exist, will not open, is lifecycle-controlled or lives in a replica vault is refused as for any owner write.