fix: derive encryption key from GitHub token instead of random per-machine key

Previous approach uploaded the encryption key alongside the encrypted
data to the Gist, which defeats the purpose of encryption. Now the
encryption key is deterministically derived from the GitHub OAuth
token via Argon2 — same account produces the same key on every device,
and nothing secret is stored in the cloud.

Author: fjh1997

crates/hostsync-core/src/crypto.rs

@@ -57,19 +57,6 @@ pub fn decrypt(encoded: &str, passphrase: &str) -> Result<String, &'static str>
     String::from_utf8(plaintext).map_err(|_| "invalid utf8")
 }
 
-/// Generates a random 64-char hex key for first-time setup.
-pub fn generate_random_key() -> String {
-    let mut bytes = [0u8; 32];
-    OsRng.fill_bytes(&mut bytes);
-    hex::encode(&bytes)
-}
-
-mod hex {
-    pub fn encode(bytes: &[u8]) -> String {
-        bytes.iter().map(|b| format!("{:02x}", b)).collect()
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

crates/hostsync-core/src/storage.rs

@@ -12,10 +12,6 @@ fn servers_path() -> PathBuf {
     data_dir().join("servers.enc")
 }
 
-fn key_path() -> PathBuf {
-    data_dir().join("enc.key")
-}
-
 fn token_path() -> PathBuf {
     data_dir().join("github.json")
 }
@@ -25,23 +21,12 @@ fn ensure_dir() -> std::io::Result<()> {
     std::fs::create_dir_all(data_dir())
 }
 
-/// Returns or generates the local encryption key.
+/// Derives the encryption key from the GitHub OAuth token.
+/// Same account → same token → same key on every device.
 pub fn get_encryption_key() -> String {
-    if let Ok(key) = std::fs::read_to_string(key_path()) {
-        if !key.trim().is_empty() {
-            return key.trim().to_string();
-        }
-    }
-    let key = crypto::generate_random_key();
-    let _ = ensure_dir();
-    let _ = std::fs::write(key_path(), &key);
-    key
-}
-
-/// Sets the encryption key (used when syncing key from cloud).
-pub fn set_encryption_key(key: &str) -> std::io::Result<()> {
-    ensure_dir()?;
-    std::fs::write(key_path(), key.trim())
+    load_github_state()
+        .token
+        .unwrap_or_default()
 }
 
 pub fn load_servers() -> Vec<Server> {

crates/hostsync-core/src/sync.rs

@@ -2,7 +2,6 @@ use crate::storage;
 use reqwest::Client;
 
 const GIST_FILE_NAME: &str = "hostsync_data.enc";
-const GIST_KEY_FILE: &str = "hostsync_key.dat";
 const GIST_DESCRIPTION: &str = "HostSync Encrypted Server Data";
 
 fn headers(token: &str) -> reqwest::header::HeaderMap {
@@ -17,21 +16,17 @@ fn make_client() -> Result<Client, String> {
     crate::http::client()
 }
 
-/// Uploads encrypted server data and encryption key to a GitHub Gist.
+/// Uploads encrypted server data to a GitHub Gist.
 pub async fn upload() -> Result<(), String> {
     let state = storage::load_github_state();
     let token = state.token.as_deref().ok_or("not logged in")?;
     let data = storage::get_raw_encrypted().ok_or("no data to upload")?;
-    let enc_key = storage::get_encryption_key();
     let client = make_client()?;
 
-    let files = serde_json::json!({
-        GIST_FILE_NAME: { "content": data },
-        GIST_KEY_FILE: { "content": enc_key }
-    });
-
     if let Some(ref gist_id) = state.gist_id {
-        let body = serde_json::json!({ "files": files });
+        let body = serde_json::json!({
+            "files": { GIST_FILE_NAME: { "content": data } }
+        });
         let resp = client
             .patch(format!("https://api.github.com/gists/{}", gist_id))
             .headers(headers(token))
@@ -46,7 +41,7 @@ pub async fn upload() -> Result<(), String> {
         let body = serde_json::json!({
             "description": GIST_DESCRIPTION,
             "public": false,
-            "files": files
+            "files": { GIST_FILE_NAME: { "content": data } }
         });
         let resp = client
             .post("https://api.github.com/gists")
@@ -114,10 +109,5 @@ pub async fn download() -> Result<(), String> {
         .as_str()
         .ok_or("file not found in gist")?;
 
-    // Sync encryption key from cloud so other devices can decrypt
-    if let Some(key) = gist["files"][GIST_KEY_FILE]["content"].as_str() {
-        storage::set_encryption_key(key).map_err(|e| e.to_string())?;
-    }
-
     storage::set_raw_encrypted(content).map_err(|e| e.to_string())
 }