SentraShare REST API

<?php
$plaintext  = 'My super secret message';
$passphrase = 'correct horse battery staple';   // share this separately with the recipient

$key   = sodium_crypto_secretbox_keygen();      // 32 random bytes
$nonce = random_bytes(12);                       // 12 bytes for AES-GCM

// Encrypt with AES-256-GCM
$ciphertext = openssl_encrypt(
    $plaintext,
    'aes-256-gcm',
    $key,
    OPENSSL_RAW_DATA,
    $nonce,
    $tag                          // 16-byte auth tag, appended to ciphertext
);
$ciphertextWithTag = $ciphertext . $tag;

// Build passphrase verifier: HMAC-SHA256(passphrase, key) - raw binary, then base64
$verifier = base64_encode(hash_hmac('sha256', $passphrase, $key, true));

$scheme  = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$baseUrl = $scheme . '://' . $_SERVER['HTTP_HOST'];

// POST to API
$payload = json_encode([
    'ciphertext'          => base64_encode($ciphertextWithTag),
    'nonce'               => base64_encode($nonce),
    'ttl_hours'           => 24,
    'max_views'           => 1,
    'passphrase_verifier' => $verifier,
]);

$ch = curl_init($baseUrl . '/api/secrets');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: Bearer sk_your_api_key_here',
    ],
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

// Build share URL - key in URL fragment, passphrase sent separately (e.g. by phone/SMS)
$keyB64Url = rtrim(strtr(base64_encode($key), '+/', '-_'), '=');
$shareUrl  = $baseUrl . '/s/' . $response['id'] . '#key=' . $keyB64Url;

// Send $shareUrl to recipient via email
// Send $passphrase to recipient via a DIFFERENT channel (SMS, phone call, etc.)
echo "URL: {$shareUrl}
";
echo "Passphrase (send separately!): {$passphrase}
";

<?php
$filePath   = '/path/to/document.pdf';
$fileName   = basename($filePath);
$fileBytes  = file_get_contents($filePath);
$mimeType   = mime_content_type($filePath) ?: 'application/octet-stream';
$passphrase = 'optional-passphrase';           // set to '' or null to skip

$key   = sodium_crypto_secretbox_keygen();     // 32 random bytes
$nonce = random_bytes(12);                      // 12 bytes for AES-GCM

// ── Step 1: Build payload (metadata header + raw file bytes) ─────────────────
// The browser uses this header to restore the filename and offer a download.
$meta     = json_encode(['name' => $fileName, 'size' => strlen($fileBytes), 'type' => $mimeType]);
$combined = $meta . "" . $fileBytes;        // null byte separates header from content

// ── Step 2: Encrypt with AES-256-GCM ─────────────────────────────────────────
$ciphertext = openssl_encrypt(
    $combined,
    'aes-256-gcm',
    $key,
    OPENSSL_RAW_DATA,
    $nonce,
    $tag
);
$ciphertextWithTag = $ciphertext . $tag;        // tag is always 16 bytes

// ── Step 3: Build passphrase verifier (optional) ─────────────────────────────
$verifier = $passphrase
    ? base64_encode(hash_hmac('sha256', $passphrase, $key, true))
    : null;

// ── Step 4: Create secret record with is_file = true ─────────────────────────
$apiKey  = 'sk_your_api_key_here';
$scheme  = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$baseUrl = $scheme . '://' . $_SERVER['HTTP_HOST'];

$secretPayload = array_filter([
    'ciphertext'          => base64_encode($ciphertextWithTag),
    'nonce'               => base64_encode($nonce),
    'ttl_hours'           => 48,
    'max_views'           => 1,
    'is_file'             => true,
    'passphrase_verifier' => $verifier,
]);

$ch = curl_init($baseUrl . '/api/secrets');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($secretPayload),
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: Bearer ' . $apiKey,
    ],
]);
$secretData = json_decode(curl_exec($ch), true);
curl_close($ch);

$secretId = $secretData['id'];

// ── Step 5: Upload the encrypted chunk (chunk index 0) ────────────────────────
// For files larger than your memory limit, split into chunks and upload each
// with an incrementing chunk_index (0, 1, 2, …).
$ch = curl_init("{$baseUrl}/api/files/{$secretId}/0");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode(['ciphertext' => base64_encode($ciphertextWithTag)]),
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: Bearer ' . $apiKey,
    ],
]);
$chunkResult = json_decode(curl_exec($ch), true);
curl_close($ch);

if (empty($chunkResult['stored'])) {
    throw new RuntimeException('Chunk upload failed: ' . json_encode($chunkResult));
}

// ── Step 6: Build share URL ───────────────────────────────────────────────────
$keyB64Url = rtrim(strtr(base64_encode($key), '+/', '-_'), '=');
$shareUrl  = "{$baseUrl}/s/{$secretId}#key={$keyB64Url}";

echo "Share URL: {$shareUrl}
";
if ($passphrase) {
    echo "Passphrase (send via separate channel): {$passphrase}
";
}