feat: Proton pass-cli provider

[alexsavio]

Hi,

Would you be open for a PR for supporting Proton Pass storage?

[mbevc1]

Hey @alexsavio . I didn't notice any Go library for ProtonPass, but feel free to give it a go. I'd be happy to review and add it to list of supported backends.

[alexsavio]

Oh, good point. They have the pass-cli and a proton-pass-common library, but they are in Rust.
I was thinking aws-vault could use the pass-cli tool. But if all storage integrations are pure Go SDK integrations, then let me think of this in another way.
Thank you!

[mbevc1]

Yeah, no worries. I'd suggest we avoid just calling a cli, which is very fragile as integration. I've noticed there is a Golang for ProtonMail. But might be worth checking the API and just call HTTP calls 🤔 .

[alexsavio]

I am still researching, however Proton does not provide an SDK or API specs. I tried a small client, and it seems they want to hide and make the API exclusive for the pass-cli.
I wonder if I try to wire capture the protocol and implement a working client here there might be licensing issues.
Whatever you decide, now I am curious about hacking this :D

[mbevc1]

Sure if you want to give it a go feel free to write a library for their API protocol. I reckon without the specs it might be harder. Perhaps you could look at the CLI and what they are doing there.

[alexsavio]

I have been working on it, including an API client in keyring, however the Terms and Conditions of the Proton API does not allow for programmatic access. WDYT?

[mbevc1]

That might be difficult then, what do you mean T&Cs don't allow programmatic access?

[alexsavio]

This is what I saw in Proton's Terms of Service(https://proton.me/legal/terms) (Section 2, "Authorized use of the Services") prohibit accessing the Services "through automated means (including but not limited to bots, scripts, or similar technologies)".

[mbevc1]

Well, if you read it further it explains what constitutes as unauthorised used:
"...in a manner that is distinguishable from the standard client behavior of human users, that deviates significantly from normal usage patterns, that exhibits characteristics of abuse, or that attempts to circumvent the Company's security controls;"

I'm not a lawyer, but I think using it for normal operation should be fine.

[alexsavio]

ok, given that you agree, I will continue. :D. Thank you for checking it with me.

[mbevc1]

I believe this was implemented and released as part of 7.13. Feel free to open a new issue if there is more work following.