Recovery key
diff --git a/js/app.js b/js/app.js
index 8ccb813..57cabb9 100644
--- a/js/app.js
+++ b/js/app.js
@@ -85,6 +85,8 @@ const state = {
hibpEnabled: localStorage.getItem('hibpEnabled') === '1', // default OFF
// entry.id → count from HIBP (0 = clean, >0 = pwned, undefined = unchecked)
hibpResults: new Map(),
+ quickUnlockEnabled: localStorage.getItem('quickUnlockEnabled') === '1',
+ recoveryConfigured: false, // refreshed by refreshRecoveryStatus on Settings open
};
// ============================================================
@@ -630,6 +632,13 @@ async function doRegister(e) {
async function doLogout() {
try { await api('/logout', { method: 'POST', headers: authHeaders() }); } catch (e) {}
+ // Explicit logout → wipe the DPAPI quick-unlock blob too. Logout is the
+ // user saying "I'm done", quite different from a passive lock.
+ if (Bridge.active && localStorage.getItem('quickUnlockEnabled') === '1') {
+ window.location.href = 'cmd://quickunlock/clear';
+ localStorage.removeItem('quickUnlockEnabled');
+ state.quickUnlockEnabled = false;
+ }
sessionStorage.clear();
state.token = ''; state.csrf = ''; state.salt = ''; state.username = '';
state.cryptoKey = null; state.entries = []; state.trashed = []; state.folders = ['All'];
@@ -2409,6 +2418,180 @@ function closeReauth(ok) {
}
}
+// ============================================================
+// QUICK UNLOCK — remember on this device (DPAPI-backed)
+// ============================================================
+//
+// User-controlled convenience feature. When opted in, the current vault
+// state (raw AES key + salt + username + session token) is bundled into
+// a JSON blob and handed to the Delphi side, which DPAPI-encrypts it
+// (CRYPTPROTECT_CURRENT_USER) and stashes the blob on disk. Subsequent
+// app starts can recover the entire session without re-entering the
+// master password.
+//
+// Honest trade-off: the encrypted blob is readable by ANY process
+// running as the same Windows user. The protection is no stronger than
+// the Windows account itself. Users with Windows Hello / fingerprint /
+// PIN configured at the OS level get biometric gating transitively
+// (via login). Without that, this is "remember on trusted device".
+//
+// Only available when running inside the Delphi host (Bridge.active);
+// the PHP standalone has no DPAPI equivalent.
+
+// Resolver for the Delphi → JS callback. Delphi side fires
+// Bridge.onQuickUnlockResult(b64|null) after processing cmd://quickunlock/get.
+let quickUnlockResolver = null;
+
+// Same for the status query.
+let quickUnlockStatusResolver = null;
+
+function bridgeRequestQuickUnlock() {
+ if (!Bridge.active) return Promise.resolve(null);
+ return new Promise(resolve => {
+ quickUnlockResolver = resolve;
+ // Safety: if Delphi never responds, time out after 3 s so the auth
+ // screen doesn't hang. Falls back to master-pw login.
+ setTimeout(() => {
+ if (quickUnlockResolver === resolve) {
+ quickUnlockResolver = null;
+ resolve(null);
+ }
+ }, 3000);
+ window.location.href = 'cmd://quickunlock/get';
+ });
+}
+
+function bridgeQuickUnlockStatus() {
+ if (!Bridge.active) return Promise.resolve(false);
+ return new Promise(resolve => {
+ quickUnlockStatusResolver = resolve;
+ setTimeout(() => {
+ if (quickUnlockStatusResolver === resolve) {
+ quickUnlockStatusResolver = null;
+ resolve(false);
+ }
+ }, 2000);
+ window.location.href = 'cmd://quickunlock/status';
+ });
+}
+
+// Patch Bridge.onQuickUnlockResult / Status to feed the resolvers above.
+Bridge.onQuickUnlockResult = function(b64) {
+ if (quickUnlockResolver) {
+ const cb = quickUnlockResolver;
+ quickUnlockResolver = null;
+ cb(b64);
+ }
+};
+Bridge.onQuickUnlockStatus = function(configured) {
+ if (quickUnlockStatusResolver) {
+ const cb = quickUnlockStatusResolver;
+ quickUnlockStatusResolver = null;
+ cb(!!configured);
+ }
+};
+
+async function enableQuickUnlock() {
+ if (!Bridge.active) return toast('Quick unlock requires the Delphi app', 'warning');
+ if (!state.cryptoKey) return toast('Unlock the vault first', 'warning');
+
+ const masterPwd = await askReauth(
+ 'Confirm your master password to enable Quick unlock on this device.');
+ if (!masterPwd) return;
+ try {
+ await api('/reauth', {
+ method: 'POST',
+ headers: authHeaders({ 'Content-Type': 'application/json' }),
+ body: JSON.stringify({ masterPassword: masterPwd }),
+ });
+ } catch (err) {
+ return toast('Wrong master password', 'error');
+ }
+
+ // Export the raw key + bundle session pieces needed for a cold-start
+ // restore (no master pw available). Send as base64-encoded UTF-8 JSON.
+ const raw = await crypto.subtle.exportKey('raw', state.cryptoKey);
+ const blob = JSON.stringify({
+ v: 1,
+ username: state.username,
+ salt: state.salt,
+ token: state.token,
+ csrf: state.csrf,
+ key: bytesToBase64(raw),
+ });
+ const b64 = bytesToBase64(new TextEncoder().encode(blob));
+ window.location.href = 'cmd://quickunlock/store?data=' + encodeURIComponent(b64);
+
+ localStorage.setItem('quickUnlockEnabled', '1');
+ state.quickUnlockEnabled = true;
+ if ($('#quickUnlockStatus')) updateQuickUnlockUI();
+ toast('Quick unlock enabled');
+}
+
+async function disableQuickUnlock() {
+ window.location.href = 'cmd://quickunlock/clear';
+ localStorage.removeItem('quickUnlockEnabled');
+ state.quickUnlockEnabled = false;
+ if ($('#quickUnlockStatus')) updateQuickUnlockUI();
+ toast('Quick unlock disabled');
+}
+
+function updateQuickUnlockUI() {
+ const lbl = $('#quickUnlockStatus');
+ const btn = $('#quickUnlockToggleBtn');
+ if (!lbl || !btn) return;
+ if (state.quickUnlockEnabled) {
+ lbl.textContent = 'Enabled on this device.';
+ btn.textContent = 'Disable';
+ btn.classList.add('is-danger');
+ } else {
+ lbl.textContent = 'Disabled.';
+ btn.textContent = 'Enable on this device';
+ btn.classList.remove('is-danger');
+ }
+}
+
+// Try to unlock via DPAPI. Returns true if the vault is now unlocked,
+// false otherwise (caller falls back to master-pw login).
+async function tryQuickUnlock() {
+ if (!Bridge.active) return false;
+ if (localStorage.getItem('quickUnlockEnabled') !== '1') return false;
+
+ const b64 = await bridgeRequestQuickUnlock();
+ if (!b64) return false;
+
+ let parsed;
+ try {
+ const jsonStr = new TextDecoder().decode(base64ToBytes(b64));
+ parsed = JSON.parse(jsonStr);
+ } catch (e) {
+ return false;
+ }
+ if (!parsed || !parsed.key || !parsed.salt || !parsed.username) return false;
+
+ // Restore session state from the blob.
+ state.username = parsed.username;
+ state.salt = parsed.salt;
+ state.token = parsed.token || sessionStorage.getItem('authToken') || '';
+ state.csrf = parsed.csrf || sessionStorage.getItem('csrfToken') || '';
+ sessionStorage.setItem('username', state.username);
+ sessionStorage.setItem('salt', state.salt);
+ if (state.token) sessionStorage.setItem('authToken', state.token);
+ if (state.csrf) sessionStorage.setItem('csrfToken', state.csrf);
+
+ try {
+ state.cryptoKey = await crypto.subtle.importKey(
+ 'raw', base64ToBytes(parsed.key),
+ { name: 'AES-GCM' }, true, ['encrypt', 'decrypt']);
+ await persistCryptoKey();
+ } catch (e) {
+ return false;
+ }
+
+ state.locked = false;
+ return true;
+}
+
// ============================================================
// RECOVERY KEY — one-shot emergency access
// ============================================================
@@ -2788,6 +2971,15 @@ async function doChangeMasterPassword() {
state.entries[i].totp_iv = nc.totp_iv || null;
}
+ // The DPAPI quick-unlock blob (if any) still holds the OLD AES key
+ // bundle, which would unlock to entries encrypted with the new key
+ // → unreadable. Clear it; user can re-enable from Settings.
+ if (Bridge.active && localStorage.getItem('quickUnlockEnabled') === '1') {
+ window.location.href = 'cmd://quickunlock/clear';
+ localStorage.removeItem('quickUnlockEnabled');
+ state.quickUnlockEnabled = false;
+ }
+
closeChangeMasterModal();
toast('Master password changed · other sessions signed out');
} catch (err) {
@@ -3296,6 +3488,23 @@ function openSettings() {
$('#settingUser').textContent = state.username;
// Async: query server for recovery key state and update the label
refreshRecoveryStatus();
+
+ // Sync the quick-unlock UI from the actual DPAPI file (in case the
+ // user cleared the file outside the app or the file is gone for some
+ // other reason like a Windows profile reset).
+ if (Bridge.active) {
+ bridgeQuickUnlockStatus().then(actual => {
+ if (!actual && state.quickUnlockEnabled) {
+ // Drift: localStorage said enabled but Delphi has no blob.
+ localStorage.removeItem('quickUnlockEnabled');
+ state.quickUnlockEnabled = false;
+ }
+ updateQuickUnlockUI();
+ });
+ } else {
+ updateQuickUnlockUI();
+ }
+
$('#settingsPanel').classList.add('is-open');
}
function closeSettings() {
@@ -3594,6 +3803,12 @@ async function init() {
$('#recoveryRemoveBtn').addEventListener('click', doRemoveRecoveryKey);
$('#recoveryBtn').addEventListener('click', doRecoveryRedeem);
+ // Quick unlock (DPAPI)
+ $('#quickUnlockToggleBtn').addEventListener('click', () => {
+ if (state.quickUnlockEnabled) disableQuickUnlock();
+ else enableQuickUnlock();
+ });
+
// Re-auth modal
$('#reauthForm').addEventListener('submit', e => { e.preventDefault(); closeReauth(true); });
$$('#reauthModal [data-close]').forEach(b => b.addEventListener('click', () => closeReauth(false)));
@@ -3639,12 +3854,25 @@ async function init() {
if (ok) {
await enterApp();
} else {
- // session token exists but crypto key gone — user must re-enter master pw
- showAuth();
- $('#loginUsername').value = state.username;
+ // sessionStorage still has token+salt but the crypto key was
+ // cleared (locked / tab closed). Try the DPAPI quick-unlock
+ // path before falling back to the master-pw prompt.
+ if (await tryQuickUnlock()) {
+ await enterApp();
+ } else {
+ showAuth();
+ $('#loginUsername').value = state.username;
+ }
}
} else {
- showAuth();
+ // Cold start: no sessionStorage at all. Quick unlock can still
+ // restore everything (token + salt + key + username) from the
+ // DPAPI blob.
+ if (await tryQuickUnlock()) {
+ await enterApp();
+ } else {
+ showAuth();
+ }
}
}