From d72f41418cca3982459ec874565f6671a5620dc6 Mon Sep 17 00:00:00 2001
From: hermes-explorigin <tim+hermes@thecookiejar.me>
Date: Thu, 27 Aug 2026 01:33:45 +0000
Subject: [PATCH] Make the lock-screen warning persist based on the stored
 setting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Visibility is now driven entirely by the persisted dismissedLocalWarning
  setting, loaded directly on mount (via getSetting) so the banner reflects the
  stored choice immediately when the lock screen renders — before any unlock.
- Removed the ephemeral default-true local flag that caused the banner to
  reappear on reload until the user unlocked. A warningReady guard prevents a
  one-frame flash while the value loads.
---
 dist/index.html                  | 15 ++++++++++++---
 src/components/LockScreen.svelte | 25 +++++++++++++++++++------
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/dist/index.html b/dist/index.html
index 67c3d54..4f375ec 100644
--- a/dist/index.html
+++ b/dist/index.html
@@ -5953,10 +5953,19 @@ function LockScreen($$anchor, $$props) {
 		set(isSetup, !await isVaultInitialized());
 	}
 	checkVault();
-	let showLocalWarning = /* @__PURE__ */ state(true);
+	let warningReady = /* @__PURE__ */ state(false);
+	async function loadWarningSetting() {
+		try {
+			settings.dismissedLocalWarning = Boolean(await getSetting("dismissedLocalWarning"));
+		} catch (e) {
+			console.warn("Failed to load warning setting:", e);
+		}
+		set(warningReady, true);
+	}
+	loadWarningSetting();
 	async function dismissLocalWarning() {
 		settings.dismissedLocalWarning = true;
-		set(showLocalWarning, false);
+		set(warningReady, true);
 		try {
 			await settings.save();
 		} catch (e) {
@@ -6027,7 +6036,7 @@ function LockScreen($$anchor, $$props) {
 		append($$anchor, div_2);
 	};
 	if_block(node, ($$render) => {
-		if (get(notLocal) && get(showLocalWarning) && !settings.dismissedLocalWarning) $$render(consequent);
+		if (get(notLocal) && get(warningReady) && !settings.dismissedLocalWarning) $$render(consequent);
 	});
 	var node_1 = sibling(node, 2);
 	var consequent_1 = ($$anchor) => {
diff --git a/src/components/LockScreen.svelte b/src/components/LockScreen.svelte
index e2eb039..786f63d 100644
--- a/src/components/LockScreen.svelte
+++ b/src/components/LockScreen.svelte
@@ -1,7 +1,7 @@
 <script>
   import { app } from '../lib/stores/app.svelte.js'
   import { deriveKey, createTestPayload, verifyPassword } from '../lib/crypto/crypto.js'
-  import { saveVaultMeta, loadVaultMeta, isVaultInitialized, ensureTrashGroup } from '../lib/storage/db.js'
+  import { saveVaultMeta, loadVaultMeta, isVaultInitialized, ensureTrashGroup, getSetting } from '../lib/storage/db.js'
   import { startAutoLock } from '../lib/stores/security.svelte.js'
   import { settings } from '../lib/stores/settings.svelte.js'
   import { autofocus } from '../lib/autofocus.js'
@@ -19,13 +19,26 @@
   }
   checkVault()
 
-  // Dismissed warning state loads from the settings store (which loads on
-  // unlock/setup). Track locally so the banner hides immediately on click.
-  let showLocalWarning = $state(true)
+  // Visibility of the web-server warning is driven by the persisted setting
+  // (dismissedLocalWarning). It is loaded directly on mount so the banner
+  // reflects the user's stored choice immediately when the lock screen shows,
+  // before any unlock happens. `warningReady` avoids a one-frame flash while
+  // the value is read from IndexedDB.
+  let warningReady = $state(false)
+
+  async function loadWarningSetting() {
+    try {
+      settings.dismissedLocalWarning = Boolean(await getSetting('dismissedLocalWarning'))
+    } catch (e) {
+      console.warn('Failed to load warning setting:', e)
+    }
+    warningReady = true
+  }
+  loadWarningSetting()
 
   async function dismissLocalWarning() {
     settings.dismissedLocalWarning = true
-    showLocalWarning = false
+    warningReady = true
     try { await settings.save() } catch (e) { console.warn('Failed to persist warning dismissal:', e) }
   }
 
@@ -98,7 +111,7 @@
     <h1>Password Vault</h1>
     <p class="subtitle">{isSetup ? 'Create your vault' : 'Unlock your vault'}</p>
 
-    {#if notLocal && showLocalWarning && !settings.dismissedLocalWarning}
+    {#if notLocal && warningReady && !settings.dismissedLocalWarning}
       <div class="warning-banner" role="alert">
         <span class="warning-text">You're viewing this from a web server. For best security, download this HTML file and open it locally on your computer instead.</span>
         <button class="warning-dismiss" onclick={dismissLocalWarning} aria-label="Dismiss warning">✕</button>