Makes the offline-first vault installable as a standalone PWA, and enforces
"no network access aside from the app's own resources" once installed.
PWA:
- public/manifest.webmanifest: scope ./ (confined to the app's own dir), three
icons (192/512 + transparent maskable), standalone display, brand theme. No
push/shortcuts (deliberate: offline-first vault, nothing to push).
- public/sw.js: a NETWORK SANDBOX service worker. Allows only same-origin
requests inside the worker's own directory (index, manifest, icons); returns
403 for every cross-origin request and for same-origin paths outside the app
dir. This blocks in-app <img>/<script>/fetch exfiltration at the source.
- src/lib/pwa.js + main.js: register the worker (relative path, works at / in
dev and under /password_manager/ in prod).
- index.html: dev CSP (permits Vite HMR WebSocket) + PWA meta/link tags.
Security:
- scripts/inline-assets.js swaps the dev CSP for the STRICT production CSP in
the shipped dist: connect-src 'none' (no fetch/XHR/WebSockets anywhere),
form-action 'none', object-src/base-uri 'none', img/font/media 'self' data:.
The browser-native connect-src closes the WebSocket gap the SW cannot see.
- Known boundary documented in-file: frame-ancestors / X-Frame-Options is
HTTP-header-only (ignored in meta) and not set by the static host, so
clickjacking is permissive; all exfiltration channels are closed regardless.
Build/deploy:
- inline-assets.js now PRESERVES manifest/sw.js/icons in dist (was deleting).
- deploy.yml uploads + byte-verifies index.html, manifest, sw.js, and all three
icons to WebDAV.
Tests:
- tests/lib/sw-policy.test.js: 5 tests for the sandbox allow/deny logic
(in-scope allowed; cross-origin, out-of-scope, scheme/port mismatch denied).
- Verified in headless Chromium against the built dist: SW registers + is
active, and both a cross-origin fetch and a same-origin-out-of-scope fetch
are refused by the CSP before leaving the device.
Fixup: dropped 'frame-ancestors' from the meta CSP after confirming the browser
ignores it there (it is a header-only directive).
The crypto suite's deriveKey tests exceeded vitest's default 5s per-test
timeout in CI (passed locally only because the host is faster). Set a 30s
per-test timeout so the PBKDF2-heavy tests don't flake the pipeline.
- .gitea/workflows/deploy.yml: test+build on every push; auto-deploy
dist/index.html to /password_manager via WebDAV on push to main (DELETE-
then-PUT to bypass stale-file cache), verifying deployed bytes match.
- Build injects __VAULT_COMMIT__ (from VITE_COMMIT_HASH=github.sha in CI,
git HEAD locally) and main.js logs console.info({ commit_hash }) on
startup so a deploy is verifiable against its source commit.
- Visibility is now driven entirely by the persisted dismissedLocalWarning
setting, loaded directly on mount (via getSetting) so the banner reflects the
stored choice immediately when the lock screen renders — before any unlock.
- Removed the ephemeral default-true local flag that caused the banner to
reappear on reload until the user unlocked. A warningReady guard prevents a
one-frame flash while the value loads.
- totp.js: add validateTotpSecret(input, { minBytes = 10 }). Secret is
optional (blank ok); when provided it must decode to a base32 key of at
least 80 bits, rejecting bad characters, typos, wrong format, and
too-short secrets.
- EntryForm: validate the TOTP secret on submit; if invalid, show an inline
error (⚠) and a red input border and block saving. Error clears as the
user types.
- Tests: blank ok, valid bare/grouped/otpauth URIs, invalid chars, too-short,
URI without a secret. 163 total pass.
- Settings dialog gains a 'Show web-server warning' toggle that maps to the
persisted dismissedLocalWarning flag, letting the user re-show the banner
after dismissing it (or hide it proactively).
- The security banner (shown when opened over http(s), not file://) now has a
close button.
- Dismissal persists via the settings store (dismissedLocalWarning), so it
stays hidden across reloads on this browser, while still appearing fresh by
default.
- Rephrased text kept; banner made flex with a hoverable, accessible close
button.
- New src/lib/crypto/totp.js: native RFC 6238 TOTP using Web Crypto HMAC-SHA1
(no external crypto). base32Decode, extractSecret (bare base32 or otpauth://
URI), generateTotp, totpRemainingSeconds.
- Entries gain an optional encryptedTotpSecret, stored AES-GCM-encrypted like
passwords. schema.js createEntry/updateEntry/docs updated.
- Export/import re-key the TOTP secret alongside passwords when sealing with a
separate password, and decrypt/re-encrypt on import so TOTP survives moves.
- EntryForm: optional 'TOTP Secret (2FA)' field (base32 or otpauth:// URI).
- EntryDetail: live 6-digit TOTP display updating every second with a countdown
and urgency indicator, plus copy; guarded cleanup timer on unmount.
- Tests: RFC 6238 SHA-1 vectors (6 & 8 digit), base32/extractSecret, remaining
seconds, schema round-trip. 157 total pass.
- validateEntry no longer requires encryptedPassword; only title is required
(schema.js). encryptedPassword documented as optional.
- EntryForm: decrypt-guards empty password on edit; stores empty string (no
encryption) when the password field is blank; label is 'Password' (no *).
- EntryDetail: only renders the Password field when the entry has one;
decrypt guards empty.
- Tests: schema validation updated (password optional); 143 total pass.
- exportSelected(groupIds, { vaultKey, password, useExistingPassword }) replaces the
positional (groupIds, vaultKey, exportPassword) form. Protection is now an explicit
choice, never an ambiguous optional field.
- password mode: re-key entries under a fresh export-derived key (unchanged semantics).
- reuseExistingPassword mode: seal with the vault's own key, keep vault salt embedded,
so import derives the key from the vault master password. No second password required.
- ImportExport.svelte: replaces the long-placeholder free-text field with two radio
options (Use a new password / Reuse my vault password); short placeholder, with
client-side validation that a new password isn't empty.
- Cryptography importAll unchanged: derives the envelope key from the supplied password +
embedded salt, which covers both sealed modes; wrong password still rejects import.
- Tests: updated call sites to options object; added round-trip + wrong-password tests for
reuseExistingPassword.
- exportSelected(groupIds, vaultKey, exportPassword=''): plain JSON export unchanged when
no export password; when one is set, re-keys each entry's password to a key derived from
the export password and AES-256-GCM-seals the entire payload (titles/usernames/notes
protected too). Returns a { format: 'encrypted-export', salt, data } envelope.
- importAll() detects sealed exports and treats the supplied password as the EXPORT password,
so it may differ from any vault's master password. Wrong password rejects import instead of
silently skipping entries.
- ImportExport.svelte: optional 'separate password' field in the export dialog; import dialog's
field reworded as a generic file password covering both plain and sealed files.
- Tests for sealed export/import round-trip incl. wrong-password & missing-password rejects.
