CLI access to Codebook vault or via SQLCipher

Codebook
1

We use Codebook and want to use access our entries from developer tooling. Could you clarify:

I don’t think there is but is there CLI or API to allow reading entries/fields non-interactively: `cb get “Entry” --field password` etc. On macOS it would be useful to have those reachable from scripts via Shortcuts actions, applescript, url scheme, hopefully gated by touch id.

Can we read the local SQLCipher db directly? Is its schema or KDF params documented?

Another thing on my mind: Of course we can share with other users now via Codebook Cloud, but can we revoke those? And would it be possible to share a set of entries, grouped by tag etc?

2

Hi @rickcogley,

Thanks for reaching out, those are good questions. We do not have a Codebook-specific CLI tool, however, as you mentioned, a SQLCipher command line shell could be used to access the content. We would caution you not to make modifications to the database itself as those changes in the shell would not be captured by the Codebook session tracking system which would prevent proper sync replication. That said, you can get started using a query like this:

SELECT e.id AS 'Entry Id', e.name AS 'Entry Name', t.name AS 'Field Label', f.value AS 'Field Value', f.idx AS 'Field Index'
FROM entries e 
INNER JOIN fields f on e.id = f.entry_id
INNER JOIN types t on f.type_id = t.id
WHERE e.name = 'Gmail'
ORDER BY f.idx ASC;

If you’re looking for something more specific, please reach out to us directly and we’d be happy to help. We do not publicly document the schema used for Codebook.

You can revoke the user relationship to prevent future sharing, however, you are unable to recall access to the data. Once you have shared the data, you are no longer in control of it. The user could copy or otherwise exfiltrate the data you have shared.

Unfortunately, the current sharing implementation is limited to sharing individual entries at a time. The desktop platforms (and now iOS) expose the ability to perform a search based on a label, so you could use that to narrow the list of entries you wish to share, however, it would still require sending those entries individually.

3

Thanks, well noted. Appreciate it Nick!