0.0.10

merge enc to master

.gitattributes

@@ -0,0 +1,5 @@
+*.png filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text
+*.jpeg filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.enc filter=lfs diff=lfs merge=lfs -text

.github/workflows/auto-build.yml

@@ -0,0 +1,40 @@
+# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+
+name: BuildCI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [16.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+      - name: Checkout codes
+        uses: actions/checkout@v2
+        with:
+          lfs: true
+      - name: Checkout LFS
+        run: git lfs checkout
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm install
+      - run: npm test
+      - run: npm run build
+      - uses: actions/upload-artifact@v2
+        with:
+          name: my-dist
+          path: |
+            main.js
+            manifest.json

README.md

@@ -2,6 +2,14 @@
 
 This is yet another sync plugin for Obsidian.
 
+## Download and Install
+
+[![BuildCI](https://github.com/fyears/obsidian-save-remote/actions/workflows/auto-build.yml/badge.svg)](https://github.com/fyears/obsidian-save-remote/actions/workflows/auto-build.yml)
+
+Every artifacts are placed in the "Summary" under every successful builds.
+
+Besides manually download the files, you can also use [Obsidian42 - BRAT](https://github.com/TfTHacker/obsidian42-brat) to install this plugin.
+
 ## Disclaimer
 
 **This is NOT the official sync service provided by Obsidian.**
@@ -14,5 +22,5 @@ As of October 2021, the plugin is under development. **DO NOT USE IT for any ser
 
 Remote service in support list:
 
-- [ ] AWS S3
+- [x] AWS S3
 - [ ] webdav

docs/algorithm.md

@@ -14,16 +14,16 @@ Assuming all sources are reliable.
 
 We list all combinations mutually exclusive and collectively exhaustive.
 
-| ID  | Remote Files | Local files | Local delete rename history | Extra                                                      | Decision                                                                                          |
-| --- | ------------ | ----------- | --------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| 1   | exist        | exist       | ignore                      | mtime_remote > mtime_local                                 | download remote file, create local folder if not exists, clear local history if exists            |
-| 2   | exist        | exist       | ignore                      | mtime_remote < mtime_local                                 | upload local file, create remote folder if not exists, clear local history if exists              |
-| 3   | exist        | exist       | ignore                      | mtime_remote === mtime_local && size_remote === size_local | clear local history if exists (the file was synced and no changes after last sync)                |
-| 4   | exist        | exist       | ignore                      | mtime_remote === mtime_local && size_remote !== size_local | upload local file, clear local history if exists (we always prefer local to remote)               |
-| 5   | exist        | exist       | ignore                      | If local is a folder. mtime_local === undefined            | clear local history if exists. TODO: what if a folder and a previous file share the same name?    |
-| 6   | exist        | not exist   | exist                       | mtime_remote >= delete_time_local                          | download remote file, create folder if not exists                                                 |
-| 7   | exist        | not exist   | exist                       | mtime_remote < delete_time_local                           | delete remote file, clear local history                                                           |
-| 8   | exist        | not exist   | not exist                   |                                                            | download remote file, create folder if not exists                                                 |
-| 9   | not exist    | exist       | ignore                      | If local is a single file.                                 | upload local file, create remote folder if not exists, clear local history if exists              |
-| 10  | not exist    | exist       | ignore                      | If local is a folder.                                      | upload local files recursively, create remote folder if not exists, clear local history if exists |
-| 11  | not exist    | not exist   | ignore                      |                                                            | clear local history if exists                                                                     |
+| ID   | Remote Files | Local files | Local delete rename history | Extra                                                        | Decision                                                     |
+| ---- | ------------ | ----------- | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
+| 1    | exist        | exist       | ignore                      | mtime_remote > mtime_local                                   | download remote file, create local folder if not exists, clear local history if exists |
+| 2    | exist        | exist       | ignore                      | mtime_remote < mtime_local                                   | upload local file, create remote folder if not exists, clear local history if exists |
+| 3    | exist        | exist       | ignore                      | mtime_remote === mtime_local && password === "" && size_remote === size_local | clear local history if exists (the file was synced and no changes after last sync) |
+| 4    | exist        | exist       | ignore                      | mtime_remote === mtime_local && password === "" && size_remote !== size_local | upload local file, clear local history if exists (we always prefer local to remote) |
+| 5    | exist        | exist       | ignore                      | mtime_remote === mtime_local && password !== ""              | clear local history if exists (in encryption mode, file sizes are unequal. we can only rely on mtime(s)) |
+| 6    | exist        | exist       | ignore                      | If local is a folder. mtime_local === undefined              | clear local history if exists. TODO: what if a folder and a previous file share the same name? |
+| 7    | exist        | not exist   | exist                       | mtime_remote >= delete_time_local                            | download remote file, create folder if not exists            |
+| 8    | exist        | not exist   | exist                       | mtime_remote < delete_time_local                             | delete remote file, clear local history                      |
+| 9    | exist        | not exist   | not exist                   |                                                              | download remote file, create folder if not exists            |
+| 10   | not exist    | exist       | ignore                      | local may be folder or file                                  | upload local files recursively, create remote folder if not exists, clear local history if exists |
+| 11   | not exist    | not exist   | ignore                      |                                                              | clear local history if exists                                |

manifest.json

@@ -1,7 +1,7 @@
 {
   "id": "obsdian-save-remote",
   "name": "Save remote",
-  "version": "0.0.2",
+  "version": "0.0.10",
   "minAppVersion": "0.12.15",
   "description": "This is yet another plugin allowing users to sync notes between local device and the cloud.",
   "author": "fyears",

package.json

@@ -1,22 +1,30 @@
 {
   "name": "obsidian-save-remote",
-  "version": "0.0.1",
+  "version": "0.0.10",
   "description": "This is yet another sync plugin for Obsidian app.",
   "scripts": {
     "dev": "webpack --mode development --watch",
     "build": "webpack --mode production",
     "format": "npx prettier --write .",
-    "clean": "npx rimraf main.js"
+    "clean": "npx rimraf main.js",
+    "test": "cross-env TS_NODE_COMPILER_OPTIONS={\\\"module\\\":\\\"commonjs\\\"} mocha -r ts-node/register 'tests/**/*.ts'"
   },
   "source": "main.ts",
   "keywords": [],
   "author": "",
   "license": "Apache-2.0",
   "devDependencies": {
+    "@types/chai": "^4.2.22",
+    "@types/mime-types": "^2.1.1",
+    "@types/mocha": "^9.0.0",
     "@types/node": "^14.14.37",
+    "chai": "^4.3.4",
+    "cross-env": "^7.0.3",
+    "mocha": "^9.1.3",
     "prettier": "^2.4.1",
     "terser-webpack-plugin": "^5.2.4",
     "ts-loader": "^9.2.6",
+    "ts-node": "^10.4.0",
     "tslib": "^2.2.0",
     "typescript": "^4.4.4",
     "webdav-server": "^2.6.2",
@@ -26,13 +34,18 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.37.0",
     "@aws-sdk/signature-v4-crt": "^3.37.0",
-    "@types/mime-types": "^2.1.1",
+    "acorn": "^8.5.0",
     "aws-crt": "^1.10.1",
+    "buffer": "^6.0.3",
     "codemirror": "^5.63.1",
     "lovefield-ts": "^0.7.0",
     "mime-types": "^2.1.33",
     "obsidian": "^0.12.0",
+    "path-browserify": "^1.0.1",
+    "process": "^0.11.10",
+    "rfc4648": "^1.5.0",
     "rimraf": "^3.0.2",
+    "stream-browserify": "^3.0.0",
     "webdav": "^4.7.0",
     "webdav-fs": "^4.0.0"
   }

src/debugMode.ts

@@ -0,0 +1,37 @@
+import { TAbstractFile, TFolder, TFile, Vault } from "obsidian";
+
+import * as lf from "lovefield-ts/dist/es6/lf.js";
+
+import type { SyncPlanType } from "./sync";
+import {
+  insertSyncPlanRecord,
+  clearAllSyncPlanRecords,
+  readAllSyncPlanRecordTexts,
+} from "./localdb";
+import { mkdirpInVault } from "./misc";
+
+const DEFAULT_DEBUG_FOLDER = "_debug_save_remote/";
+const DEFAULT_SYNC_PLANS_HISTORY_FILE_PREFIX = "sync_plans_hist_exported_on_";
+
+export const exportSyncPlansToFiles = async (
+  db: lf.DatabaseConnection,
+  vault: Vault
+) => {
+  console.log("exporting");
+  await mkdirpInVault(DEFAULT_DEBUG_FOLDER, vault);
+  const records = await readAllSyncPlanRecordTexts(db);
+  let md = "";
+  if (records.length === 0) {
+    md = "No sync plans history found";
+  } else {
+    md =
+      "Sync plans found:\n\n" +
+      records.map((x) => "```json\n" + x + "\n```\n").join("\n");
+  }
+  const ts = Date.now();
+  const filePath = `${DEFAULT_DEBUG_FOLDER}${DEFAULT_SYNC_PLANS_HISTORY_FILE_PREFIX}${ts}.md`;
+  await vault.create(filePath, md, {
+    mtime: ts,
+  });
+  console.log("finish exporting");
+};

src/encrypt.ts

@@ -0,0 +1,135 @@
+import { base32, base64 } from "rfc4648";
+import {
+  bufferToArrayBuffer,
+  arrayBufferToBuffer,
+  hexStringToTypedArray,
+  arrayBufferToHex,
+} from "./misc";
+
+const DEFAULT_ITER = 10000;
+
+const getKeyIVFromPassword = async (
+  salt: Uint8Array,
+  password: string,
+  rounds: number = DEFAULT_ITER
+) => {
+  const k1 = await window.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    { name: "PBKDF2" },
+    false,
+    ["deriveKey", "deriveBits"]
+  );
+
+  const k2 = await window.crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: salt,
+      iterations: rounds,
+      hash: "SHA-256",
+    },
+    k1,
+    256 + 128
+  );
+
+  return k2;
+};
+
+export const encryptArrayBuffer = async (
+  arrBuf: ArrayBuffer,
+  password: string,
+  rounds: number = DEFAULT_ITER,
+  saltHex: string = ""
+) => {
+  let salt: Uint8Array;
+  if (saltHex !== "") {
+    salt = hexStringToTypedArray(saltHex);
+  } else {
+    salt = window.crypto.getRandomValues(new Uint8Array(8));
+  }
+
+  const derivedKey = await getKeyIVFromPassword(salt, password, rounds);
+  const key = derivedKey.slice(0, 32);
+  const iv = derivedKey.slice(32, 32 + 16);
+
+  const keyCrypt = await window.crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "AES-CBC" },
+    false,
+    ["encrypt", "decrypt"]
+  );
+
+  const enc = (await window.crypto.subtle.encrypt(
+    { name: "AES-CBC", iv },
+    keyCrypt,
+    arrBuf
+  )) as ArrayBuffer;
+
+  const prefix = new TextEncoder().encode("Salted__");
+
+  const res = new Uint8Array([...prefix, ...salt, ...new Uint8Array(enc)]);
+
+  return bufferToArrayBuffer(res);
+};
+
+export const decryptArrayBuffer = async (
+  arrBuf: ArrayBuffer,
+  password: string,
+  rounds: number = DEFAULT_ITER
+) => {
+  const prefix = arrBuf.slice(0, 8);
+  const salt = arrBuf.slice(8, 16);
+  const derivedKey = await getKeyIVFromPassword(
+    new Uint8Array(salt),
+    password,
+    rounds
+  );
+  const key = derivedKey.slice(0, 32);
+  const iv = derivedKey.slice(32, 32 + 16);
+
+  const keyCrypt = await window.crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "AES-CBC" },
+    false,
+    ["encrypt", "decrypt"]
+  );
+
+  const dec = (await window.crypto.subtle.decrypt(
+    { name: "AES-CBC", iv },
+    keyCrypt,
+    arrBuf.slice(16)
+  )) as ArrayBuffer;
+
+  return dec;
+};
+
+export const encryptStringToBase32 = async (
+  text: string,
+  password: string,
+  rounds: number = DEFAULT_ITER,
+  saltHex: string = ""
+) => {
+  const enc = await encryptArrayBuffer(
+    bufferToArrayBuffer(new TextEncoder().encode(text)),
+    password,
+    rounds,
+    saltHex
+  );
+  return base32.stringify(new Uint8Array(enc));
+};
+
+export const decryptBase32ToString = async (
+  text: string,
+  password: string,
+  rounds: number = DEFAULT_ITER
+) => {
+  return new TextDecoder().decode(
+    await decryptArrayBuffer(
+      bufferToArrayBuffer(base32.parse(text)),
+      password,
+      rounds
+    )
+  );
+};

src/localdb.ts

@@ -2,12 +2,14 @@ import * as lf from "lovefield-ts/dist/es6/lf.js";
 import { TAbstractFile, TFile, TFolder } from "obsidian";
 
 import type { SUPPORTED_SERVICES_TYPE } from "./misc";
+import type { SyncPlanType } from "./sync";
 
 export type DatabaseConnection = lf.DatabaseConnection;
 
 export const DEFAULT_DB_NAME = "saveremotedb";
 export const DEFAULT_TBL_DELETE_HISTORY = "filefolderoperationhistory";
 export const DEFAULT_TBL_SYNC_MAPPING = "syncmetadatahistory";
+export const DEFAULT_SYNC_PLANS_HISTORY = "syncplanshistory";
 
 export interface FileFolderHistoryRecord {
   key: string;
@@ -32,6 +34,12 @@ export interface SyncMetaMappingRecord {
   key_type: "folder" | "file";
 }
 
+interface SyncPlanRecord {
+  ts: number;
+  remote_type: string;
+  sync_plan: string;
+}
+
 export const prepareDBs = async () => {
   const schemaBuilder = lf.schema.create(DEFAULT_DB_NAME, 1);
   schemaBuilder
@@ -68,6 +76,15 @@ export const prepareDBs = async () => {
     .addPrimaryKey(["id"], true)
     .addIndex("idxkey", ["local_key", "remote_key"]);
 
+  schemaBuilder
+    .createTable(DEFAULT_SYNC_PLANS_HISTORY)
+    .addColumn("id", lf.Type.INTEGER)
+    .addColumn("ts", lf.Type.INTEGER)
+    .addColumn("remote_type", lf.Type.STRING)
+    .addColumn("sync_plan", lf.Type.STRING)
+    .addPrimaryKey(["id"], true)
+    .addIndex("tskey", ["ts"]);
+
   const db = await schemaBuilder.connect({
     storeType: lf.DataStoreType.INDEXED_DB,
   });
@@ -258,3 +275,37 @@ export const getSyncMetaMappingByRemoteKeyS3 = async (
 
   throw Error("something bad in sync meta mapping!");
 };
+
+export const insertSyncPlanRecord = async (
+  db: lf.DatabaseConnection,
+  syncPlan: SyncPlanType
+) => {
+  const schema = db.getSchema().table(DEFAULT_SYNC_PLANS_HISTORY);
+  const row = schema.createRow({
+    ts: syncPlan.ts,
+    remote_type: syncPlan.remoteType,
+    sync_plan: JSON.stringify(syncPlan, null, 2),
+  } as SyncPlanRecord);
+  await db.insertOrReplace().into(schema).values([row]).exec();
+};
+
+export const clearAllSyncPlanRecords = async (db: lf.DatabaseConnection) => {
+  const tbl = db.getSchema().table(DEFAULT_SYNC_PLANS_HISTORY);
+  await db.delete().from(tbl).exec();
+};
+
+export const readAllSyncPlanRecordTexts = async (db: lf.DatabaseConnection) => {
+  const schema = db.getSchema().table(DEFAULT_SYNC_PLANS_HISTORY);
+
+  const records = (await db
+    .select()
+    .from(schema)
+    .orderBy(schema.col("ts"), lf.Order.DESC)
+    .exec()) as SyncPlanRecord[];
+
+  if (records === undefined) {
+    return [] as string[];
+  } else {
+    return records.map((x) => x.sync_plan);
+  }
+};

src/main.ts

@@ -11,7 +11,7 @@ import {
   TFolder,
 } from "obsidian";
 import * as CodeMirror from "codemirror";
-import type { DatabaseConnection } from "./localdb";
+import { clearAllSyncPlanRecords, DatabaseConnection } from "./localdb";
 import {
   prepareDBs,
   destroyDBs,
@@ -19,18 +19,22 @@ import {
   insertDeleteRecord,
   insertRenameRecord,
   getAllDeleteRenameRecords,
+  insertSyncPlanRecord,
 } from "./localdb";
 
 import type { SyncStatusType } from "./sync";
-import { ensembleMixedStates, getOperation, doActualSync } from "./sync";
+import { getSyncPlan, doActualSync } from "./sync";
 import { DEFAULT_S3_CONFIG, getS3Client, listFromRemote, S3Config } from "./s3";
+import { exportSyncPlansToFiles } from "./debugMode";
 
 interface SaveRemotePluginSettings {
   s3?: S3Config;
+  password?: string;
 }
 
 const DEFAULT_SETTINGS: SaveRemotePluginSettings = {
   s3: DEFAULT_S3_CONFIG,
+  password: "",
 };
 
 export default class SaveRemotePlugin extends Plugin {
@@ -60,57 +64,67 @@ export default class SaveRemotePlugin extends Plugin {
       })
     );
 
-    // this.addRibbonIcon("dice", "Misc", async () => {
-    //   const a = this.app.vault.getAllLoadedFiles();
-    //   console.log(a);
-    //   const h = await getAllRecords(this.db);
-    //   console.log(h);
-    // });
-
     this.addRibbonIcon("switch", "Save Remote", async () => {
       if (this.syncStatus !== "idle") {
-        new Notice("Save Remote already running!");
+        new Notice(`Save Remote already running in stage ${this.syncStatus}!`);
         return;
       }
 
-      new Notice("Save Remote Sync Preparing");
-      this.syncStatus = "preparing";
-      const s3Client = getS3Client(this.settings.s3);
-      const remoteRsp = await listFromRemote(s3Client, this.settings.s3);
-      const local = this.app.vault.getAllLoadedFiles();
-      const localHistory = await loadDeleteRenameHistoryTable(this.db);
-      // console.log(remoteRsp);
-      // console.log(local);
-      // console.log(localHistory);
+      try {
+        new Notice("1/6 Save Remote Sync Preparing");
+        this.syncStatus = "preparing";
 
-      const mixedStates = await ensembleMixedStates(
-        remoteRsp.Contents,
-        local,
-        localHistory,
-        this.db
-      );
+        new Notice("2/6 Starting to fetch remote meta data.");
+        this.syncStatus = "getting_remote_meta";
+        const s3Client = getS3Client(this.settings.s3);
+        const remoteRsp = await listFromRemote(s3Client, this.settings.s3);
 
-      for (const [key, val] of Object.entries(mixedStates)) {
-        getOperation(val, true);
+        new Notice("3/6 Starting to fetch local meta data.");
+        this.syncStatus = "getting_local_meta";
+        const local = this.app.vault.getAllLoadedFiles();
+        const localHistory = await loadDeleteRenameHistoryTable(this.db);
+        // console.log(remoteRsp);
+        // console.log(local);
+        // console.log(localHistory);
+
+        new Notice("4/6 Starting to generate sync plan.");
+        this.syncStatus = "generating_plan";
+        const syncPlan = await getSyncPlan(
+          remoteRsp.Contents,
+          local,
+          localHistory,
+          this.db,
+          this.settings.password
+        );
+        console.log(syncPlan.mixedStates); // for debugging
+        await insertSyncPlanRecord(this.db, syncPlan);
+
+        // The operations above are read only and kind of safe.
+        // The operations below begins to write or delete (!!!) something.
+
+        new Notice("5/6 Save Remote Sync data exchanging!");
+
+        this.syncStatus = "syncing";
+        await doActualSync(
+          s3Client,
+          this.settings.s3,
+          this.db,
+          this.app.vault,
+          syncPlan,
+          this.settings.password
+        );
+
+        new Notice("6/6 Save Remote finish!");
+        this.syncStatus = "finish";
+        this.syncStatus = "idle";
+      } catch (error) {
+        const msg = `Save Remote error while ${this.syncStatus}`;
+        console.log(msg);
+        console.log(error);
+        new Notice(msg);
+        new Notice(error);
+        this.syncStatus = "idle";
       }
-
-      console.log(mixedStates);
-
-      // The operations above are read only and kind of safe.
-      // The operations below begins to write or delete (!!!) something.
-
-      new Notice("Save Remote Sync data exchanging!");
-
-      await doActualSync(
-        s3Client,
-        this.settings.s3,
-        this.db,
-        this.app.vault,
-        mixedStates
-      );
-
-      new Notice("Save Remote finish!");
-      this.syncStatus = "idle";
     });
 
     this.addSettingTab(new SaveRemoteSettingTab(this.app, this));
@@ -147,7 +161,7 @@ export default class SaveRemotePlugin extends Plugin {
   }
 
   destroyDBs() {
-    destroyDBs(this.db);
+    /* destroyDBs(this.db); */
   }
 }
 
@@ -164,7 +178,9 @@ class SaveRemoteSettingTab extends PluginSettingTab {
 
     containerEl.empty();
 
-    containerEl.createEl("h2", { text: "Settings for Save Remote" });
+    containerEl.createEl("h1", { text: "Save Remote" });
+
+    containerEl.createEl("h2", { text: "S3" });
 
     new Setting(containerEl)
       .setName("s3Endpoint")
@@ -174,7 +190,7 @@ class SaveRemoteSettingTab extends PluginSettingTab {
           .setPlaceholder("")
           .setValue(this.plugin.settings.s3.s3Endpoint)
           .onChange(async (value) => {
-            this.plugin.settings.s3.s3Endpoint = value;
+            this.plugin.settings.s3.s3Endpoint = value.trim();
             await this.plugin.saveSettings();
           })
       );
@@ -187,7 +203,7 @@ class SaveRemoteSettingTab extends PluginSettingTab {
           .setPlaceholder("")
           .setValue(`${this.plugin.settings.s3.s3Region}`)
           .onChange(async (value) => {
-            this.plugin.settings.s3.s3Region = value;
+            this.plugin.settings.s3.s3Region = value.trim();
             await this.plugin.saveSettings();
           })
       );
@@ -200,7 +216,7 @@ class SaveRemoteSettingTab extends PluginSettingTab {
           .setPlaceholder("")
           .setValue(`${this.plugin.settings.s3.s3AccessKeyID}`)
           .onChange(async (value) => {
-            this.plugin.settings.s3.s3AccessKeyID = value;
+            this.plugin.settings.s3.s3AccessKeyID = value.trim();
             await this.plugin.saveSettings();
           })
       );
@@ -213,7 +229,7 @@ class SaveRemoteSettingTab extends PluginSettingTab {
           .setPlaceholder("")
           .setValue(`${this.plugin.settings.s3.s3SecretAccessKey}`)
           .onChange(async (value) => {
-            this.plugin.settings.s3.s3SecretAccessKey = value;
+            this.plugin.settings.s3.s3SecretAccessKey = value.trim();
             await this.plugin.saveSettings();
           })
       );
@@ -226,9 +242,47 @@ class SaveRemoteSettingTab extends PluginSettingTab {
           .setPlaceholder("")
           .setValue(`${this.plugin.settings.s3.s3BucketName}`)
           .onChange(async (value) => {
-            this.plugin.settings.s3.s3BucketName = value;
+            this.plugin.settings.s3.s3BucketName = value.trim();
             await this.plugin.saveSettings();
           })
       );
+
+    containerEl.createEl("h2", { text: "General" });
+    new Setting(containerEl)
+      .setName("encryption password")
+      .setDesc("Password for E2E encryption. Empty for no password.")
+      .addText((text) =>
+        text
+          .setPlaceholder("")
+          .setValue(`${this.plugin.settings.password}`)
+          .onChange(async (value) => {
+            this.plugin.settings.password = value.trim();
+            await this.plugin.saveSettings();
+          })
+      );
+
+    containerEl.createEl("h2", { text: "Debug" });
+
+    new Setting(containerEl)
+      .setName("export sync plans")
+      .setDesc("export sync plans")
+      .addButton(async (button) => {
+        button.setButtonText("Export");
+        button.onClick(async () => {
+          await exportSyncPlansToFiles(this.plugin.db, this.app.vault);
+          new Notice("sync plans history exported");
+        });
+      });
+
+    new Setting(containerEl)
+      .setName("delete sync plans history in db")
+      .setDesc("delete sync plans history in db")
+      .addButton(async (button) => {
+        button.setButtonText("Delete History");
+        button.onClick(async () => {
+          await clearAllSyncPlanRecords(this.plugin.db);
+          new Notice("sync plans history (in db) deleted");
+        });
+      });
   }
 }

src/misc.ts

@@ -1,11 +1,32 @@
 import { Vault } from "obsidian";
 import * as path from "path";
 
+import { base32 } from "rfc4648";
+
 export type SUPPORTED_SERVICES_TYPE = "s3" | "webdav" | "ftp";
 
-export const ignoreHiddenFiles = (item: string) => {
-  const basename = path.basename(item);
-  return basename === "." || basename[0] !== ".";
+/**
+ * If any part of the file starts with '.' or '_' then it's a hidden file.
+ * @param item
+ * @param loose
+ * @returns
+ */
+export const isHiddenPath = (item: string, loose: boolean = true) => {
+  const k = path.posix.normalize(item); // TODO: only unix path now
+  const k2 = k.split("/"); // TODO: only unix path now
+  // console.log(k2)
+  for (const singlePart of k2) {
+    if (singlePart === "." || singlePart === ".." || singlePart === "") {
+      continue;
+    }
+    if (singlePart[0] === ".") {
+      return true;
+    }
+    if (loose && singlePart[0] === "_") {
+      return true;
+    }
+  }
+  return false;
 };
 
 /**
@@ -31,9 +52,12 @@ export const getFolderLevels = (x: string) => {
 };
 
 export const mkdirpInVault = async (thePath: string, vault: Vault) => {
+  // console.log(thePath);
   const foldersToBuild = getFolderLevels(thePath);
+  // console.log(foldersToBuild);
   for (const folder of foldersToBuild) {
     const r = await vault.adapter.exists(folder);
+    // console.log(r);
     if (!r) {
       console.log(`mkdir ${folder}`);
       await vault.adapter.mkdir(folder);
@@ -46,6 +70,44 @@ export const mkdirpInVault = async (thePath: string, vault: Vault) => {
  * @param b Buffer
  * @returns ArrayBuffer
  */
-export const bufferToArrayBuffer = (b: Buffer) => {
+export const bufferToArrayBuffer = (b: Buffer | Uint8Array) => {
   return b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength);
 };
+
+/**
+ * Simple func.
+ * @param b
+ * @returns
+ */
+export const arrayBufferToBuffer = (b: ArrayBuffer) => {
+  return Buffer.from(b);
+};
+
+export const arrayBufferToBase64 = (b: ArrayBuffer) => {
+  return arrayBufferToBuffer(b).toString("base64");
+};
+
+export const arrayBufferToHex = (b: ArrayBuffer) => {
+  return arrayBufferToBuffer(b).toString("hex");
+};
+
+export const base64ToArrayBuffer = (b64text: string) => {
+  return bufferToArrayBuffer(Buffer.from(b64text, "base64"));
+};
+
+/**
+ * https://stackoverflow.com/questions/43131242
+ * @param hex
+ * @returns
+ */
+export const hexStringToTypedArray = (hex: string) => {
+  return new Uint8Array(
+    hex.match(/[\da-f]{2}/gi).map(function (h) {
+      return parseInt(h, 16);
+    })
+  );
+};
+
+export const base64ToBase32 = (a: string) => {
+  return base32.stringify(Buffer.from(a, "base64"));
+};

src/s3.ts

@@ -14,8 +14,13 @@ import {
 
 import type { _Object } from "@aws-sdk/client-s3";
 
-import { bufferToArrayBuffer, mkdirpInVault } from "./misc";
+import {
+  arrayBufferToBuffer,
+  bufferToArrayBuffer,
+  mkdirpInVault,
+} from "./misc";
 import * as mime from "mime-types";
+import { decryptArrayBuffer, encryptArrayBuffer } from "./encrypt";
 
 export interface S3Config {
   s3Endpoint: string;
@@ -65,8 +70,14 @@ export const uploadToRemote = async (
   s3Config: S3Config,
   fileOrFolderPath: string,
   vault: Vault,
-  isRecursively: boolean = false
+  isRecursively: boolean = false,
+  password: string = "",
+  remoteEncryptedKey: string = ""
 ) => {
+  let uploadFile = fileOrFolderPath;
+  if (password !== "") {
+    uploadFile = remoteEncryptedKey;
+  }
   const isFolder = fileOrFolderPath.endsWith("/");
 
   const DEFAULT_CONTENT_TYPE = "application/octet-stream";
@@ -79,7 +90,7 @@ export const uploadToRemote = async (
     await s3Client.send(
       new PutObjectCommand({
         Bucket: s3Config.s3BucketName,
-        Key: fileOrFolderPath,
+        Key: uploadFile,
         Body: "",
         ContentType: contentType,
       })
@@ -88,20 +99,28 @@ export const uploadToRemote = async (
   } else {
     // file
     // we ignore isRecursively parameter here
-    const contentType =
-      mime.contentType(mime.lookup(fileOrFolderPath) || DEFAULT_CONTENT_TYPE) ||
-      DEFAULT_CONTENT_TYPE;
-    const content = await vault.adapter.readBinary(fileOrFolderPath);
-    const body = Buffer.from(content);
+    let contentType = DEFAULT_CONTENT_TYPE;
+    if (password === "") {
+      contentType =
+        mime.contentType(
+          mime.lookup(fileOrFolderPath) || DEFAULT_CONTENT_TYPE
+        ) || DEFAULT_CONTENT_TYPE;
+    }
+    const localContent = await vault.adapter.readBinary(fileOrFolderPath);
+    let remoteContent = localContent;
+    if (password !== "") {
+      remoteContent = await encryptArrayBuffer(localContent, password);
+    }
+    const body = arrayBufferToBuffer(remoteContent);
     await s3Client.send(
       new PutObjectCommand({
         Bucket: s3Config.s3BucketName,
-        Key: fileOrFolderPath,
+        Key: uploadFile,
         Body: body,
         ContentType: contentType,
       })
     );
-    return await getRemoteMeta(s3Client, s3Config, fileOrFolderPath);
+    return await getRemoteMeta(s3Client, s3Config, uploadFile);
   }
 };
 
@@ -169,22 +188,35 @@ export const downloadFromRemote = async (
   s3Config: S3Config,
   fileOrFolderPath: string,
   vault: Vault,
-  mtime: number
+  mtime: number,
+  password: string = "",
+  remoteEncryptedKey: string = ""
 ) => {
   const isFolder = fileOrFolderPath.endsWith("/");
 
   await mkdirpInVault(fileOrFolderPath, vault);
 
+  // the file is always local file
+  // we need to encrypt it
+
   if (isFolder) {
     // mkdirp locally is enough
     // do nothing here
   } else {
-    const content = await downloadFromRemoteRaw(
+    let downloadFile = fileOrFolderPath;
+    if (password !== "") {
+      downloadFile = remoteEncryptedKey;
+    }
+    const remoteContent = await downloadFromRemoteRaw(
       s3Client,
       s3Config,
-      fileOrFolderPath
+      downloadFile
     );
-    await vault.adapter.writeBinary(fileOrFolderPath, content, {
+    let localContent = remoteContent;
+    if (password !== "") {
+      localContent = await decryptArrayBuffer(remoteContent, password);
+    }
+    await vault.adapter.writeBinary(fileOrFolderPath, localContent, {
       mtime: mtime,
     });
   }
@@ -200,12 +232,25 @@ export const downloadFromRemote = async (
 export const deleteFromRemote = async (
   s3Client: S3Client,
   s3Config: S3Config,
-  fileOrFolderPath: string
+  fileOrFolderPath: string,
+  password: string = "",
+  remoteEncryptedKey: string = ""
 ) => {
   if (fileOrFolderPath === "/") {
     return;
   }
-  if (fileOrFolderPath.endsWith("/")) {
+  let remoteFileName = fileOrFolderPath;
+  if (password !== "") {
+    remoteFileName = remoteEncryptedKey;
+  }
+  await s3Client.send(
+    new DeleteObjectCommand({
+      Bucket: s3Config.s3BucketName,
+      Key: remoteFileName,
+    })
+  );
+
+  if (fileOrFolderPath.endsWith("/") && password === "") {
     const x = await listFromRemote(s3Client, s3Config, fileOrFolderPath);
     x.Contents.forEach(async (element) => {
       await s3Client.send(
@@ -215,12 +260,9 @@ export const deleteFromRemote = async (
         })
       );
     });
+  } else if (fileOrFolderPath.endsWith("/") && password !== "") {
+    // TODO
   } else {
-    await s3Client.send(
-      new DeleteObjectCommand({
-        Bucket: s3Config.s3BucketName,
-        Key: fileOrFolderPath,
-      })
-    );
+    // pass
   }
 };

src/sync.ts

@@ -16,7 +16,17 @@ import {
   deleteFromRemote,
   downloadFromRemote,
 } from "./s3";
-import { mkdirpInVault } from "./misc";
+import { mkdirpInVault, SUPPORTED_SERVICES_TYPE, isHiddenPath } from "./misc";
+import { decryptBase32ToString, encryptStringToBase32 } from "./encrypt";
+
+export type SyncStatusType =
+  | "idle"
+  | "preparing"
+  | "getting_remote_meta"
+  | "getting_local_meta"
+  | "generating_plan"
+  | "syncing"
+  | "finish";
 
 type DecisionType =
   | "undecided"
@@ -30,8 +40,6 @@ type DecisionType =
   | "mkdirplocal"
   | "skip";
 
-export type SyncStatusType = "idle" | "preparing" | "syncing";
-
 interface FileOrFolderMixedState {
   key: string;
   exist_local?: boolean;
@@ -44,26 +52,38 @@ interface FileOrFolderMixedState {
   decision?: DecisionType;
   syncDone?: "done";
   decision_branch?: number;
+  remote_encrypted_key?: string;
 }
 
-export const ensembleMixedStates = async (
+export interface SyncPlanType {
+  ts: number;
+  remoteType: SUPPORTED_SERVICES_TYPE;
+  mixedStates: Record<string, FileOrFolderMixedState>;
+}
+
+const ensembleMixedStates = async (
   remote: S3ObjectType[],
   local: TAbstractFile[],
   deleteHistory: FileFolderHistoryRecord[],
-  db: lf.DatabaseConnection
+  db: lf.DatabaseConnection,
+  password: string = ""
 ) => {
   const results = {} as Record<string, FileOrFolderMixedState>;
 
   if (remote !== undefined) {
     for (const entry of remote) {
+      const remoteEncryptedKey = entry.Key;
+      let key = remoteEncryptedKey;
+      if (password !== "") {
+        key = await decryptBase32ToString(remoteEncryptedKey, password);
+      }
       const backwardMapping = await getSyncMetaMappingByRemoteKeyS3(
         db,
-        entry.Key,
+        key,
         entry.LastModified.valueOf(),
         entry.ETag
       );
 
-      let key = entry.Key;
       let r = {} as FileOrFolderMixedState;
       if (backwardMapping !== undefined) {
         key = backwardMapping.local_key;
@@ -72,6 +92,7 @@ export const ensembleMixedStates = async (
           exist_remote: true,
           mtime_remote: backwardMapping.local_mtime,
           size_remote: backwardMapping.local_size,
+          remote_encrypted_key: remoteEncryptedKey,
         };
       } else {
         r = {
@@ -79,13 +100,18 @@ export const ensembleMixedStates = async (
           exist_remote: true,
           mtime_remote: entry.LastModified.valueOf(),
           size_remote: entry.Size,
+          remote_encrypted_key: remoteEncryptedKey,
         };
       }
+      if (isHiddenPath(key)) {
+        continue;
+      }
       if (results.hasOwnProperty(key)) {
         results[key].key = r.key;
         results[key].exist_remote = r.exist_remote;
         results[key].mtime_remote = r.mtime_remote;
         results[key].size_remote = r.size_remote;
+        results[key].remote_encrypted_key = r.remote_encrypted_key;
       } else {
         results[key] = r;
       }
@@ -118,6 +144,9 @@ export const ensembleMixedStates = async (
       throw Error(`unexpected ${entry}`);
     }
 
+    if (isHiddenPath(key)) {
+      continue;
+    }
     if (results.hasOwnProperty(key)) {
       results[key].key = r.key;
       results[key].exist_local = r.exist_local;
@@ -145,6 +174,9 @@ export const ensembleMixedStates = async (
       delete_time_local: entry.action_when,
     } as FileOrFolderMixedState;
 
+    if (isHiddenPath(key)) {
+      continue;
+    }
     if (results.hasOwnProperty(key)) {
       results[key].key = r.key;
       results[key].delete_time_local = r.delete_time_local;
@@ -156,9 +188,10 @@ export const ensembleMixedStates = async (
   return results;
 };
 
-export const getOperation = (
+const getOperation = (
   origRecord: FileOrFolderMixedState,
-  inplace: boolean = false
+  inplace: boolean = false,
+  password: string = ""
 ) => {
   let r = origRecord;
   if (!inplace) {
@@ -206,6 +239,7 @@ export const getOperation = (
     r.mtime_remote !== undefined &&
     r.mtime_local !== undefined &&
     r.mtime_remote === r.mtime_local &&
+    password === "" &&
     r.size_local === r.size_remote
   ) {
     r.decision = "skip";
@@ -216,17 +250,31 @@ export const getOperation = (
     r.mtime_remote !== undefined &&
     r.mtime_local !== undefined &&
     r.mtime_remote === r.mtime_local &&
+    password === "" &&
     r.size_local !== r.size_remote
   ) {
     r.decision = "upload_clearhist";
     r.decision_branch = 4;
+  } else if (
+    r.exist_remote &&
+    r.exist_local &&
+    r.mtime_remote !== undefined &&
+    r.mtime_local !== undefined &&
+    r.mtime_remote === r.mtime_local &&
+    password !== ""
+  ) {
+    // if we have encryption,
+    // the size is always unequal
+    // only mtime(s) are reliable
+    r.decision = "skip";
+    r.decision_branch = 5;
   } else if (r.exist_remote && r.exist_local && r.mtime_local === undefined) {
     // this must be a folder!
     if (!r.key.endsWith("/")) {
       throw Error(`${r.key} is not a folder but lacks local mtime`);
     }
     r.decision = "skip";
-    r.decision_branch = 5;
+    r.decision_branch = 6;
   } else if (
     r.exist_remote &&
     !r.exist_local &&
@@ -236,7 +284,7 @@ export const getOperation = (
     r.mtime_remote >= r.delete_time_local
   ) {
     r.decision = "download_clearhist";
-    r.decision_branch = 6;
+    r.decision_branch = 7;
   } else if (
     r.exist_remote &&
     !r.exist_local &&
@@ -246,7 +294,7 @@ export const getOperation = (
     r.mtime_remote < r.delete_time_local
   ) {
     r.decision = "delremote_clearhist";
-    r.decision_branch = 7;
+    r.decision_branch = 8;
   } else if (
     r.exist_remote &&
     !r.exist_local &&
@@ -255,10 +303,10 @@ export const getOperation = (
     r.delete_time_local == undefined
   ) {
     r.decision = "download";
-    r.decision_branch = 8;
+    r.decision_branch = 9;
   } else if (!r.exist_remote && r.exist_local && r.mtime_remote === undefined) {
     r.decision = "upload_clearhist";
-    r.decision_branch = 9;
+    r.decision_branch = 10;
   } else if (
     !r.exist_remote &&
     !r.exist_local &&
@@ -266,95 +314,145 @@ export const getOperation = (
     r.mtime_local === undefined
   ) {
     r.decision = "clearhist";
-    r.decision_branch = 10;
+    r.decision_branch = 11;
   }
 
   return r;
 };
 
+export const getSyncPlan = async (
+  remote: S3ObjectType[],
+  local: TAbstractFile[],
+  deleteHistory: FileFolderHistoryRecord[],
+  db: lf.DatabaseConnection,
+  password: string = ""
+) => {
+  const mixedStates = await ensembleMixedStates(
+    remote,
+    local,
+    deleteHistory,
+    db,
+    password
+  );
+  for (const [key, val] of Object.entries(mixedStates)) {
+    getOperation(val, true, password);
+  }
+  const plan = {
+    ts: Date.now(),
+    remoteType: "s3",
+    mixedStates: mixedStates,
+  } as SyncPlanType;
+  return plan;
+};
+
 export const doActualSync = async (
   s3Client: S3Client,
   s3Config: S3Config,
   db: lf.DatabaseConnection,
   vault: Vault,
-  keyStates: Record<string, FileOrFolderMixedState>
+  syncPlan: SyncPlanType,
+  password: string = ""
 ) => {
-  Object.entries(keyStates)
-    .sort((k, v) => -(k as string).length)
-    .map(async ([k, v]) => {
-      const key = k as string;
-      const state = v as FileOrFolderMixedState;
+  const keyStates = syncPlan.mixedStates;
+  await Promise.all(
+    Object.entries(keyStates)
+      .sort((k, v) => -(k as string).length)
+      .map(async ([k, v]) => {
+        const key = k as string;
+        const state = v as FileOrFolderMixedState;
+        let remoteEncryptedKey = key;
+        if (password !== "") {
+          remoteEncryptedKey = state.remote_encrypted_key;
+          if (remoteEncryptedKey === undefined || remoteEncryptedKey === "") {
+            remoteEncryptedKey = await encryptStringToBase32(key, password);
+          }
+        }
 
-      if (
-        state.decision === undefined ||
-        state.decision === "unknown" ||
-        state.decision === "undecided"
-      ) {
-        throw Error(`unknown decision in ${JSON.stringify(state)}`);
-      } else if (state.decision === "skip") {
-        // do nothing
-      } else if (state.decision === "download_clearhist") {
-        await downloadFromRemote(
-          s3Client,
-          s3Config,
-          state.key,
-          vault,
-          state.mtime_remote
-        );
-        await clearDeleteRenameHistoryOfKey(db, state.key);
-      } else if (state.decision === "upload_clearhist") {
-        const remoteObjMeta = await uploadToRemote(
-          s3Client,
-          s3Config,
-          state.key,
-          vault,
-          false
-        );
-        await upsertSyncMetaMappingDataS3(
-          db,
-          state.key,
-          state.mtime_local,
-          state.size_local,
-          state.key,
-          remoteObjMeta.LastModified.valueOf(),
-          remoteObjMeta.ContentLength,
-          remoteObjMeta.ETag
-        );
-        await clearDeleteRenameHistoryOfKey(db, state.key);
-      } else if (state.decision === "download") {
-        await mkdirpInVault(state.key, vault);
-        await downloadFromRemote(
-          s3Client,
-          s3Config,
-          state.key,
-          vault,
-          state.mtime_remote
-        );
-      } else if (state.decision === "delremote_clearhist") {
-        await deleteFromRemote(s3Client, s3Config, state.key);
-        await clearDeleteRenameHistoryOfKey(db, state.key);
-      } else if (state.decision === "upload") {
-        const remoteObjMeta = await uploadToRemote(
-          s3Client,
-          s3Config,
-          state.key,
-          vault,
-          false
-        );
-        await upsertSyncMetaMappingDataS3(
-          db,
-          state.key,
-          state.mtime_local,
-          state.size_local,
-          state.key,
-          remoteObjMeta.LastModified.valueOf(),
-          remoteObjMeta.ContentLength,
-          remoteObjMeta.ETag
-        );
-      } else if (state.decision === "clearhist") {
-        await clearDeleteRenameHistoryOfKey(db, state.key);
-      } else {
-        throw Error("this should never happen!");
-      }
-    });
+        if (
+          state.decision === undefined ||
+          state.decision === "unknown" ||
+          state.decision === "undecided"
+        ) {
+          throw Error(`unknown decision in ${JSON.stringify(state)}`);
+        } else if (state.decision === "skip") {
+          // do nothing
+        } else if (state.decision === "download_clearhist") {
+          await downloadFromRemote(
+            s3Client,
+            s3Config,
+            state.key,
+            vault,
+            state.mtime_remote,
+            password,
+            remoteEncryptedKey
+          );
+          await clearDeleteRenameHistoryOfKey(db, state.key);
+        } else if (state.decision === "upload_clearhist") {
+          const remoteObjMeta = await uploadToRemote(
+            s3Client,
+            s3Config,
+            state.key,
+            vault,
+            false,
+            password,
+            remoteEncryptedKey
+          );
+          await upsertSyncMetaMappingDataS3(
+            db,
+            state.key,
+            state.mtime_local,
+            state.size_local,
+            state.key,
+            remoteObjMeta.LastModified.valueOf(),
+            remoteObjMeta.ContentLength,
+            remoteObjMeta.ETag
+          );
+          await clearDeleteRenameHistoryOfKey(db, state.key);
+        } else if (state.decision === "download") {
+          await mkdirpInVault(state.key, vault);
+          await downloadFromRemote(
+            s3Client,
+            s3Config,
+            state.key,
+            vault,
+            state.mtime_remote,
+            password,
+            remoteEncryptedKey
+          );
+        } else if (state.decision === "delremote_clearhist") {
+          await deleteFromRemote(
+            s3Client,
+            s3Config,
+            state.key,
+            password,
+            remoteEncryptedKey
+          );
+          await clearDeleteRenameHistoryOfKey(db, state.key);
+        } else if (state.decision === "upload") {
+          const remoteObjMeta = await uploadToRemote(
+            s3Client,
+            s3Config,
+            state.key,
+            vault,
+            false,
+            password,
+            remoteEncryptedKey
+          );
+          await upsertSyncMetaMappingDataS3(
+            db,
+            state.key,
+            state.mtime_local,
+            state.size_local,
+            state.key,
+            remoteObjMeta.LastModified.valueOf(),
+            remoteObjMeta.ContentLength,
+            remoteObjMeta.ETag
+          );
+        } else if (state.decision === "clearhist") {
+          await clearDeleteRenameHistoryOfKey(db, state.key);
+        } else {
+          throw Error("this should never happen!");
+        }
+      })
+  );
 };

tests/encrypt.test.ts

@@ -0,0 +1,98 @@
+import * as fs from "fs";
+import * as path from "path";
+import { expect } from "chai";
+import { base64ToBase32, bufferToArrayBuffer } from "../src/misc";
+import {
+  decryptArrayBuffer,
+  decryptBase32ToString,
+  encryptArrayBuffer,
+  encryptStringToBase32,
+} from "../src/encrypt";
+
+describe("Encryption tests", () => {
+  beforeEach(function () {
+    global.window = {
+      crypto: require("crypto").webcrypto,
+    } as any;
+  });
+
+  it("should encrypt string", async () => {
+    const k = "dkjdhkfhdkjgsdklxxd";
+    const password = "hey";
+    expect(await encryptStringToBase32(k, password)).to.not.equal(k);
+  });
+
+  it("should encrypt and decrypt string and get the same result returned", async () => {
+    const k = "jfkkjkjbce7983ycdeknkkjckooAIUHIDIBIE((*BII)njD/d/dd/d/sjxhux";
+    const password = "hfiuibec989###oiu982bj1`";
+    const enc = await encryptStringToBase32(k, password);
+    // console.log(enc);
+    const dec = await decryptBase32ToString(enc, password);
+    // console.log(dec);
+    expect(dec).equal(k);
+  });
+
+  it("should encrypt text file and get the same result as openssl", async () => {
+    const fileContent = (
+      await fs.readFileSync(
+        path.join(__dirname, "static_assets", "sometext.txt")
+      )
+    ).toString("utf-8");
+    const password = "somepassword";
+    const saltHex = "8302F586FAB491EC";
+    const enc = await encryptStringToBase32(
+      fileContent,
+      password,
+      undefined,
+      saltHex
+    );
+
+    // two command returns same result:
+    // cat ./sometext.txt | openssl enc -p -aes-256-cbc -S 8302F586FAB491EC -pbkdf2 -iter 10000 -base64 -pass pass:somepassword
+    // openssl enc -p -aes-256-cbc -S 8302F586FAB491EC -pbkdf2 -iter 10000 -base64 -pass pass:somepassword -in ./sometext.txt
+    const opensslBase64Res =
+      "U2FsdGVkX1+DAvWG+rSR7MSa+yJav1zCE7SSXiBooqwI5Q+LMpIthpk/pXkLj+25";
+    // we output base32, so we need some transformation
+    const opensslBase32Res = base64ToBase32(opensslBase64Res);
+
+    expect(enc).equal(opensslBase32Res);
+  });
+
+  it("should encrypt binary file and get the same result as openssl", async () => {
+    const testFolder = path.join(__dirname, "static_assets", "mona_lisa");
+    const testFileName =
+      "1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg";
+    const fileArrBuf = bufferToArrayBuffer(
+      await fs.readFileSync(path.join(testFolder, testFileName))
+    );
+    const password = "somepassword";
+    const saltHex = "8302F586FAB491EC";
+    const enc = await encryptArrayBuffer(
+      fileArrBuf,
+      password,
+      undefined,
+      saltHex
+    );
+    const opensslArrBuf = bufferToArrayBuffer(
+      await fs.readFileSync(path.join(testFolder, testFileName + ".enc"))
+    );
+
+    expect(Buffer.from(enc).equals(Buffer.from(opensslArrBuf))).to.be.true;
+  });
+
+  it("should descypt binary file and get the same result as openssl", async () => {
+    const testFolder = path.join(__dirname, "static_assets", "mona_lisa");
+    const testFileName =
+      "1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg";
+    const fileArrBuf = bufferToArrayBuffer(
+      await fs.readFileSync(path.join(testFolder, testFileName + ".enc"))
+    );
+    const password = "somepassword";
+    const dec = await decryptArrayBuffer(fileArrBuf, password);
+    const opensslArrBuf = bufferToArrayBuffer(
+      await fs.readFileSync(path.join(testFolder, testFileName))
+    );
+
+    expect(Buffer.from(dec).equals(Buffer.from(opensslArrBuf))).to.be.true;
+  });
+});

tests/misc.test.ts

@@ -0,0 +1,72 @@
+import * as fs from "fs";
+import * as path from "path";
+import { expect } from "chai";
+
+import * as misc from "../src/misc";
+
+describe("Misc: hidden file", () => {
+  it("should find hidden file correctly", () => {
+    let item = "";
+    expect(misc.isHiddenPath(item)).to.be.false;
+
+    item = ".";
+    expect(misc.isHiddenPath(item)).to.be.false;
+
+    item = "..";
+    expect(misc.isHiddenPath(item)).to.be.false;
+
+    item = "/x/y/z/../././../a/b/c";
+    expect(misc.isHiddenPath(item)).to.be.false;
+
+    item = ".hidden";
+    expect(misc.isHiddenPath(item)).to.be.true;
+
+    item = "_hidden_loose";
+    expect(misc.isHiddenPath(item)).to.be.true;
+    expect(misc.isHiddenPath(item, false)).to.be.false;
+
+    item = "/sdd/_hidden_loose";
+    expect(misc.isHiddenPath(item)).to.be.true;
+
+    item = "what/../_hidden_loose/what/what/what";
+    expect(misc.isHiddenPath(item)).to.be.true;
+
+    item = "what/../_hidden_loose/what/what/what";
+    expect(misc.isHiddenPath(item, false)).to.be.false;
+
+    item = "what/../_hidden_loose/../.hidden/what/what/what";
+    expect(misc.isHiddenPath(item, false)).to.be.true;
+  });
+});
+
+describe("Misc: get folder levels", () => {
+  it("should ignore empty path", () => {
+    const item = "";
+    expect(misc.getFolderLevels(item)).to.be.empty;
+  });
+
+  it("should ignore single file", () => {
+    const item = "xxx";
+    expect(misc.getFolderLevels(item)).to.be.empty;
+  });
+
+  it("should detect path ending with /", () => {
+    const item = "xxx/";
+    const res = ["xxx"];
+    expect(misc.getFolderLevels(item)).to.deep.equal(res);
+  });
+
+  it("should correctly split folders and files", () => {
+    const item = "xxx/yyy/zzz.md";
+    const res = ["xxx", "xxx/yyy"];
+    expect(misc.getFolderLevels(item)).to.deep.equal(res);
+
+    const item2 = "xxx/yyy/zzz";
+    const res2 = ["xxx", "xxx/yyy"];
+    expect(misc.getFolderLevels(item2)).to.deep.equal(res2);
+
+    const item3 = "xxx/yyy/zzz/";
+    const res3 = ["xxx", "xxx/yyy", "xxx/yyy/zzz"];
+    expect(misc.getFolderLevels(item3)).to.deep.equal(res3);
+  });
+});

tests/static_assets/mona_lisa/1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.LICENSE.txt

@@ -0,0 +1,3 @@
+The file 1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg is downloaded from Wikimedia Commons: https://commons.wikimedia.org/wiki/File:Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg .
+
+Quoted from the web address: ... This photographic reproduction is therefore also considered to be in the public domain in the United States. In other jurisdictions, re-use of this content may be restricted ...

tests/static_assets/mona_lisa/1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b332c298be98be9968715952822431a051f9d07e67460cdcf91a5a3a305b5df1
+size 1141550

tests/static_assets/mona_lisa/1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg.enc

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cf67abd791f1e230bce57dd47150f262424247cbefb8be16efcd57d13955576a
+size 1141568

tests/static_assets/mona_lisa/openssl_command.sh

@@ -0,0 +1,3 @@
+# The encryption file is produced by the following command.
+# A salt is explictly provided because we need reproducible output in tests.
+openssl enc -p -aes-256-cbc -S 8302F586FAB491EC -pbkdf2 -iter 10000 -pass pass:somepassword -in '1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg' -out 1374px-Mona_Lisa,_by_Leonardo_da_Vinci,_from_C2RMF_retouched.jpg.enc

tests/static_assets/sometext.txt

@@ -0,0 +1 @@
+A secret text 你好世界

versions.json

@@ -1,3 +1,3 @@
 {
-  "0.0.2": "0.12.15"
+  "0.0.10": "0.12.15"
 }

webpack.config.js

@@ -1,4 +1,5 @@
 const path = require("path");
+const webpack = require("webpack");
 const TerserPlugin = require("terser-webpack-plugin");
 
 module.exports = {
@@ -9,6 +10,16 @@ module.exports = {
     path: __dirname,
     libraryTarget: "commonjs",
   },
+  plugins: [
+    // Work around for Buffer is undefined:
+    // https://github.com/webpack/changelog-v5/issues/10
+    new webpack.ProvidePlugin({
+      Buffer: ["buffer", "Buffer"],
+    }),
+    new webpack.ProvidePlugin({
+      process: "process/browser",
+    }),
+  ],
   module: {
     rules: [
       {
@@ -20,31 +31,31 @@ module.exports = {
   },
   resolve: {
     extensions: [".tsx", ".ts", ".js"],
-    mainFields: ["module", "main"],
+    mainFields: ["browser", "module", "main"],
     fallback: {
-      assert: require.resolve("assert"),
-      buffer: require.resolve("buffer/"),
-      console: require.resolve("console-browserify"),
-      constants: require.resolve("constants-browserify"),
-      crypto: require.resolve("crypto-browserify"),
-      domain: require.resolve("domain-browser"),
-      events: require.resolve("events"),
-      http: require.resolve("stream-http"),
-      https: require.resolve("https-browserify"),
-      os: require.resolve("os-browserify/browser"),
+      // assert: require.resolve("assert"),
+      // buffer: require.resolve("buffer/"),
+      // console: require.resolve("console-browserify"),
+      // constants: require.resolve("constants-browserify"),
+      // crypto: require.resolve("crypto-browserify"),
+      // domain: require.resolve("domain-browser"),
+      // events: require.resolve("events"),
+      // http: require.resolve("stream-http"),
+      // https: require.resolve("https-browserify"),
+      // os: require.resolve("os-browserify/browser"),
       path: require.resolve("path-browserify"),
-      punycode: require.resolve("punycode"),
+      // punycode: require.resolve("punycode"),
       process: require.resolve("process/browser"),
-      querystring: require.resolve("querystring-es3"),
+      // querystring: require.resolve("querystring-es3"),
       stream: require.resolve("stream-browserify"),
-      string_decoder: require.resolve("string_decoder"),
-      sys: require.resolve("util"),
-      timers: require.resolve("timers-browserify"),
-      tty: require.resolve("tty-browserify"),
-      url: require.resolve("url"),
-      util: require.resolve("util"),
-      vm: require.resolve("vm-browserify"),
-      zlib: require.resolve("browserify-zlib"),
+      // string_decoder: require.resolve("string_decoder"),
+      // sys: require.resolve("util"),
+      // timers: require.resolve("timers-browserify"),
+      // tty: require.resolve("tty-browserify"),
+      // url: require.resolve("url"),
+      // util: require.resolve("util"),
+      // vm: require.resolve("vm-browserify"),
+      // zlib: require.resolve("browserify-zlib"),
     },
   },
   externals: {