Update src/streamlit_app.py

src/streamlit_app.py

@@ -1,3 +1,22 @@
+#!/usr/bin/env python3
+"""
+SmartPass — Streamlit Password Manager (Hugging Face Spaces–ready, uploads-enabled)
+
+• Zero-knowledge: Argon2id KDF → HKDF subkeys → AES-GCM per-item + HMAC integrity
+• Excel/CSV import (auto-maps common headers)
+• Quick Password Lookup (type a site/app and reveal password)
+• Writes to /data by default on Spaces; configurable via UPLOAD_DIR/TMPDIR env vars
+
+Run locally:
+  pip install streamlit cryptography argon2-cffi pandas openpyxl
+  streamlit run streamlit_app.py
+
+On Hugging Face Spaces (recommended flags):
+  STREAMLIT_SERVER_ENABLE_XSRF_PROTECTION=false
+  STREAMLIT_SERVER_ENABLE_CORS=false
+
+"""
+from __future__ import annotations
 import json
 import time
 import base64
@@ -8,10 +27,9 @@ from dataclasses import dataclass, asdict
 from typing import List, Optional, Dict, Any
 
 import streamlit as st
-import pandas as pd  # for Excel/CSV import
+import pandas as pd  # Excel/CSV import
 
 # ---- Crypto deps ----
-# pip install: streamlit cryptography argon2-cffi pandas openpyxl
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
@@ -19,17 +37,35 @@ from cryptography.hazmat.primitives.hmac import HMAC
 from cryptography.hazmat.backends import default_backend
 from argon2.low_level import hash_secret_raw, Type
 
-APP_TITLE = "SmartPass — Local, Zero‑Knowledge Password Manager (uploads-enabled)"
+APP_TITLE = "SmartPass — Local, Zero‑Knowledge Password Manager"
 VERSION = 1
 
 # -------------------------- Uploads / temp dirs --------------------------
-UPLOAD_DIR = Path(os.environ.get("UPLOAD_DIR", "./uploads")).resolve()
-TMP_DIR = Path(os.environ.get("TMPDIR", "./tmp")).resolve()
+# Detect Hugging Face Spaces and default to /data (writable). Allow env overrides.
+IS_HF = any(os.environ.get(k) for k in ("HUGGINGFACE_SPACE", "SPACE_ID", "HF_SPACE_ID"))
+DEFAULT_UPLOAD = "/data/uploads" if IS_HF else "./uploads"
+DEFAULT_TMP = "/data/tmp" if IS_HF else "./tmp"
+UPLOAD_DIR = Path(os.environ.get("UPLOAD_DIR", DEFAULT_UPLOAD)).resolve()
+TMP_DIR = Path(os.environ.get("TMPDIR", DEFAULT_TMP)).resolve()
 for p in (UPLOAD_DIR, TMP_DIR):
     p.mkdir(parents=True, exist_ok=True)
 
 # -------------------------- Utility helpers --------------------------
 
+def safe_write_text(path: Path, text: str) -> Path:
+    """Write text to path, creating parents. If it fails (e.g., perms),
+    retry under TMP_DIR. Returns the final Path written."""
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+        return path
+    except Exception:
+        alt = TMP_DIR / path.name
+        alt.parent.mkdir(parents=True, exist_ok=True)
+        alt.write_text(text, encoding="utf-8")
+        return alt
+
+
 def b64e(b: bytes) -> str:
     return base64.b64encode(b).decode("utf-8")
 
@@ -235,13 +271,15 @@ def update_item(data_key: bytes, it: VaultItem, payload: Dict[str, Any]) -> Vaul
 # -------------------------- Import helpers (Excel/CSV) --------------------------
 
 def _read_tabular(file_or_path) -> pd.DataFrame:
-    # Accept a file-like object or a path
+    # Accept file-like or path
     if hasattr(file_or_path, "read"):
-        # Try both excel/csv from buffer name fallback
         try:
             return pd.read_excel(file_or_path)
         except Exception:
-            file_or_path.seek(0)
+            try:
+                file_or_path.seek(0)
+            except Exception:
+                pass
             return pd.read_csv(file_or_path)
     name = str(file_or_path).lower()
     if name.endswith(".csv"):
@@ -330,7 +368,6 @@ with st.sidebar:
             st.error("Please enter your master password.")
         else:
             try:
-                # Persist a copy of uploaded vault and load from disk
                 saved_vault_path = UPLOAD_DIR / (up.name or "uploaded_vault.json")
                 with open(saved_vault_path, "wb") as f:
                     f.write(up.getbuffer())
@@ -369,11 +406,11 @@ with st.sidebar:
             st.session_state.vault = vdict
             st.session_state.keys = unlock_vault(vdict, new_pw)
             st.session_state.unlocked = True
-            # Immediately save a new vault file under uploads
+            # Persist the new vault to uploads (fallback to TMP if needed)
             new_path = UPLOAD_DIR / "vault.smartpass.json"
-            new_path.write_text(json.dumps(vdict, separators=(",", ":")), encoding="utf-8")
+            _written = safe_write_text(new_path, json.dumps(vdict, separators=(",", ":")))
             touch()
-            st.success(f"New vault created, unlocked, and saved at {new_path}.")
+            st.success(f"New vault created, unlocked, and saved at {_written}.")
 
     st.divider()
     st.subheader("Export / Backup")
@@ -388,8 +425,8 @@ with st.sidebar:
         )
         if st.button("Save vault to uploads/", use_container_width=True):
             path = UPLOAD_DIR / "vault.smartpass.json"
-            path.write_text(export_json, encoding="utf-8")
-            st.success(f"Saved: {path}")
+            final_path = safe_write_text(path, export_json)
+            st.success(f"Saved: {final_path}")
 
     st.divider()
     st.subheader("Import from Excel/CSV")
@@ -421,9 +458,8 @@ with st.sidebar:
                 added += 1
             st.session_state.vault["items"] = [it.to_dict() for it in items_local]
             re_hmac(st.session_state.vault, st.session_state.keys["mac_key"])
-            # Save updated vault immediately
-            (UPLOAD_DIR / "vault.smartpass.json").write_text(json.dumps(st.session_state.vault, separators=(",", ":")), encoding="utf-8")
-            st.success(f"Imported {added} item(s). Saved updated vault to uploads/.")
+            safe_write_text(UPLOAD_DIR / "vault.smartpass.json", json.dumps(st.session_state.vault, separators=(",", ":")))
+            st.success(f"Imported {added} item(s). Updated vault saved.")
             st.experimental_rerun()
         except Exception as e:
             st.error(f"Import failed: {e}")
@@ -498,8 +534,6 @@ if lookup.strip():
                         }
                         st.experimental_rerun()
 
-touch()
-
 # Decrypt all for listing
 vault_dict = st.session_state.vault
 keys = st.session_state.keys
@@ -549,8 +583,7 @@ for r in rows:
                 items = [it for it in items if it.id != r['_id']]
                 vault_dict["items"] = [it.to_dict() for it in items]
                 re_hmac(vault_dict, keys["mac_key"])
-                # Save updated vault immediately
-                (UPLOAD_DIR / "vault.smartpass.json").write_text(json.dumps(vault_dict, separators=(",", ":")), encoding="utf-8")
+                safe_write_text(UPLOAD_DIR / "vault.smartpass.json", json.dumps(vault_dict, separators=(",", ":")))
                 st.session_state.vault = vault_dict
                 st.success("Deleted and saved.")
                 st.experimental_rerun()
@@ -579,7 +612,7 @@ if st.session_state.get("add_type"):
             items.append(new_item)
             vault_dict["items"] = [it.to_dict() for it in items]
             re_hmac(vault_dict, keys["mac_key"])
-            (UPLOAD_DIR / "vault.smartpass.json").write_text(json.dumps(vault_dict, separators=(",", ":")), encoding="utf-8")
+            safe_write_text(UPLOAD_DIR / "vault.smartpass.json", json.dumps(vault_dict, separators=(",", ":")))
             st.session_state.vault = vault_dict
             st.session_state["add_type"] = None
             st.success("Item added and saved.")
@@ -614,7 +647,7 @@ if st.session_state.get("edit_id"):
             items = [updated if it.id == eid else it for it in items]
             vault_dict["items"] = [it.to_dict() for it in items]
             re_hmac(vault_dict, keys["mac_key"])
-            (UPLOAD_DIR / "vault.smartpass.json").write_text(json.dumps(vault_dict, separators=(",", ":")), encoding="utf-8")
+            safe_write_text(UPLOAD_DIR / "vault.smartpass.json", json.dumps(vault_dict, separators=(",", ":")))
             st.session_state.vault = vault_dict
             st.session_state["edit_id"] = None
             st.success("Updated and saved.")
@@ -633,4 +666,4 @@ with st.expander("Security Notes & Tips"):
 - **KDF tuning:** If your device is slow, reduce Argon2 memory/iterations in the sidebar.
 - **Backups:** Keep copies of your exported vault JSON in safe places.
         """
-    )
+    )