Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: entry templates + tag autocomplete + slideover push + robustness bundle

Browse Source 
- Entry templates: new vault_entries.template column drives a typed
  sub-kind ('credit-card', 'ssh-key', 'server', 'recovery-codes'). Card
  + table label off the template, badge reads "credit card" instead of
  "note". Templates seed kind=note (no site/password required), use
  custom_fields with optional dropdown options (brand, month/year,
  protocol). Round-tripped across export/import/duplicate/master-pw
  rotation, preserved by partial PUTs via a HasTemplate flag.
- Custom fields: support per-field `options[]` rendering as <select>
  (card brand, expiry MM/YYYY, SSH/server protocol).
- Tags: existing-tag autocomplete dropdown under the chip input,
  filtered against what's already selected.
- Search history: per-query X for individual delete + 1s debounced
  commit (no Enter required).
- Slideover: clicking outside closes again (drag-selection respected
  via mousedown origin tracker), Esc closes, X closes. App shell is
  pushed left by 420px when the panel is open so the table / pagination
  / sort / search stay visible and interactive.
- Export/import: JSON now round-trips custom_fields, attachments
  (decrypted to base64, re-encrypted under current key on restore),
  icon_b64, and template. CSV warning lists what's not included.
- Auto-backup: same payload shape as user-driven export.
- Notes: import (JSON + CSV) accepts kind=note with empty site,
  preserves title/template/custom_fields. CSV parser detects kind/
  template columns.
- Bulk-import response returns `ids[]` parallel to input so the
  client can map back to new entry IDs (drives attachment restore).
- Move-to-folder bugs fixed: moveEntryToFolder, batchMoveToFolder,
  addTag, batchAddTag were all silently wiping TOTP / custom_fields
  / kind / template via partial PUT. Now re-ship full payload.
- Master-pw rotation: server mints a fresh session token + csrf so
  the very next request after rotation no longer ESessionRejects.
  Client adopts the new pair. Attachments are re-encrypted client-side
  during rotation (GET old → decrypt with old key → encrypt with new
  → PUT). New endpoints: GET /attachments/all, PUT /attachments/:id.
- Duplicate: carries icon_b64 + template + attachments to the copy.
- HandleCreateEntry: accepts icon_b64.
- FireDAC param fix: all blob/icon/custom_fields params use ftMemo +
  .Value assignment so SQLite TEXT no longer truncates to 4000 chars
  (deepseek's 200+ KB favicon was being wiped on lock/unlock).
- HandleSetEntryIcon cap: 262144 → 524288 chars (base64 of a 256 KB
  raw fetch overflows the old cap, fails silently in saveEntryIcon).
- Native save dialog: surfaces server errors instead of swallowing.
- Modals: reauth (export) + backup-password prompt support inline
  error display, retry up to 5 attempts, then hard-stop.
- Keyboard cursor (j/k): bootstraps to current page, auto-paginates
  when the cursor crosses a page boundary, Enter opens slideover.
- Slideover focuses Title on edit-open so j/k → Enter → type Just
  Works.
- TOTP tool: Esc closes the modal.
- App version + launch mode (auto/manual): exposed via bridge,
  surfaced in Settings → Account. Autostart launches suppress the
  first-time tray balloon.
- Passkey button hidden (Delphi backend stubs WebAuthn at 501).
- TEST_PLAN.md captured for regression coverage.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
r-zakarya
2026-06-26 21:20:07 +01:00
parent fa7ea191be
commit e23a78dda7
14 changed files with 1752 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
delphi-backend/Handlers/PM.Handler.Attachments.pas
+121
View File
@@ -260,6 +260,125 @@ begin
end;
end;
// ===== GET /attachments/all ==================================================
// Lightweight listing of every attachment id+iv for the current user.
// Used by the master-pw rotation flow to enumerate what needs re-encryption.
// No blob shipped — fetched per-id only when the client is ready to re-encrypt.
procedure HandleListAllAttachments(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId: Integer;
LQ: TFDQuery;
LArr: TJSONArray;
LObj: TJSONObject;
begin
try
LUserId := Authenticate(ARequest, AResponse);
except
on ESessionRejected do Exit;
end;
LArr := TJSONArray.Create;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'SELECT id, entry_id FROM entry_attachments ' +
'WHERE user_id = :uid';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
while not LQ.Eof do
begin
LObj := TJSONObject.Create;
LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
LObj.AddPair('entry_id', TJSONNumber.Create(LQ.FieldByName('entry_id').AsInteger));
LArr.Add(LObj);
LQ.Next;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
TJSONHelper.SendJSON(AResponse, LArr);
end;
// ===== PUT /attachments/{id} =================================================
// Update only the ciphertext + iv. Used by master-pw rotation to swap to
// the new vault key. Filename/mime/size stay untouched.
procedure HandleUpdateAttachmentBlob(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LId: Integer;
LBody: TJSONObject;
LBlob, LIv: string;
LQ: TFDQuery;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
LId := StrToIntDef(AParams[0], 0);
if LId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid id');
Exit;
end;
LBody := TJSONHelper.ReadBody(ARequest);
try
LBlob := LBody.GetValue<string>('encrypted_blob', '');
LIv := LBody.GetValue<string>('iv', '');
finally
LBody.Free;
end;
if (LBlob = '') or (LIv = '') then
begin
TJSONHelper.SendError(AResponse, 400, 'Missing encrypted_blob / iv');
Exit;
end;
if Length(LBlob) > MAX_ATTACHMENT_B64 then
begin
TJSONHelper.SendError(AResponse, 413, 'Attachment too large');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'UPDATE entry_attachments SET encrypted_blob = :blob, iv = :iv ' +
'WHERE id = :id AND user_id = :uid';
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('blob').AsString := LBlob;
LQ.ParamByName('iv').AsString := LIv;
LQ.ExecSQL;
if LQ.RowsAffected = 0 then
begin
TJSONHelper.SendError(AResponse, 404, 'Not found');
Exit;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
TJSONHelper.SendOK(AResponse, 'Updated');
end;
// ===== DELETE /attachments/{id} ==============================================
procedure HandleDeleteAttachment(ARequest: TIdHTTPRequestInfo;
@@ -311,7 +430,9 @@ end;
initialization
Router.Register('GET', '/entries/(\d+)/attachments', HandleListAttachments);
Router.Register('POST', '/entries/(\d+)/attachments', HandleCreateAttachment);
Router.Register('GET', '/attachments/all', HandleListAllAttachments);
Router.Register('GET', '/attachments/(\d+)', HandleGetAttachment);
Router.Register('PUT', '/attachments/(\d+)', HandleUpdateAttachmentBlob);
Router.Register('DELETE', '/attachments/(\d+)', HandleDeleteAttachment);
end.
delphi-backend/Handlers/PM.Handler.Auth.pas
+16 -8
View File
@@ -772,6 +772,7 @@ var
LValid: Boolean;
LEntryId: Integer;
LEncPwd, LIv, LTotpSec, LTotpIv: string;
LNewToken, LNewCsrf: string;
begin
try
LUserId := Authenticate(ARequest, AResponse);
@@ -941,18 +942,18 @@ begin
LQ.ParamByName('iv').AsString := LIv;
// TOTP / custom_fields are optional per entry — clear when
// empty so existing-NULL rows don't get stomped with empty strings.
LQ.ParamByName('ts').DataType := ftString;
LQ.ParamByName('tiv').DataType := ftString;
LQ.ParamByName('cf').DataType := ftString;
LQ.ParamByName('cfiv').DataType := ftString;
LQ.ParamByName('ts').DataType := ftMemo;
LQ.ParamByName('tiv').DataType := ftMemo;
LQ.ParamByName('cf').DataType := ftMemo;
LQ.ParamByName('cfiv').DataType := ftMemo;
if LTotpSec.IsEmpty then LQ.ParamByName('ts').Clear
else LQ.ParamByName('ts').AsString := LTotpSec;
else LQ.ParamByName('ts').Value := LTotpSec;
if LTotpIv = '' then LQ.ParamByName('tiv').Clear
else LQ.ParamByName('tiv').AsString := LTotpIv;
else LQ.ParamByName('tiv').Value := LTotpIv;
if LCf = '' then LQ.ParamByName('cf').Clear
else LQ.ParamByName('cf').AsString := LCf;
else LQ.ParamByName('cf').Value := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear
else LQ.ParamByName('cfiv').AsString := LCfIv;
else LQ.ParamByName('cfiv').Value := LCfIv;
LQ.ExecSQL;
end;
// Password history is encrypted with the OLD vault key — we
@@ -993,6 +994,11 @@ begin
end;
DeleteAllUserSessions(LUserId);
// Immediately mint a fresh session for the calling client so the
// very next request doesn't bounce with ESessionRejected. The user
// hasn't logged out — they rotated their key, the UI session is
// still legitimate.
CreateSession(LUserId, LNewToken, LNewCsrf);
finally
LBody.Free;
end;
@@ -1004,6 +1010,8 @@ begin
LObj.AddPair('message', 'Master password changed');
LObj.AddPair('salt', LNewSalt);
LObj.AddPair('kdfIterations', TJSONNumber.Create(PBKDF2_ITERATIONS_TARGET));
LObj.AddPair('token', LNewToken);
LObj.AddPair('csrf', LNewCsrf);
TJSONHelper.SendJSON(AResponse, LObj);
end;
delphi-backend/Handlers/PM.Handler.Entries.pas
+159 -44
View File
@@ -104,6 +104,7 @@ begin
else
LObj.AddPair('deleted_at', ISODateTimeField(LQ.FieldByName('deleted_at')));
LObj.AddPair('favorite', TJSONNumber.Create(LQ.FieldByName('favorite').AsInteger));
LObj.AddPair('pinned', TJSONNumber.Create(LQ.FieldByName('pinned').AsInteger));
LObj.AddPair('tags', LQ.FieldByName('tags').AsString);
// TOTP fields are NULL when the entry has no 2FA configured. We emit
// JSON null instead of '' so the client can distinguish "no TOTP" from
@@ -126,6 +127,11 @@ begin
var LKindVal := LQ.FieldByName('kind').AsString;
if LKindVal = '' then LKindVal := 'login';
LObj.AddPair('kind', LKindVal);
// Template subtype. Empty = generic; otherwise drives UI labels.
if LQ.FieldByName('template').IsNull then
LObj.AddPair('template', TJSONNull.Create)
else
LObj.AddPair('template', LQ.FieldByName('template').AsString);
// Custom fields: opaque ciphertext + IV, treated identically to
// password / totp_secret. NULL → JSON null so the client can
// distinguish "never set" from "empty array stored".
@@ -167,7 +173,7 @@ var
LUserId, LNewId: Integer;
LBody, LObj: TJSONObject;
LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LNow, LTotpSec, LTotpIv,
LKind, LCf, LCfIv: string;
LKind, LCf, LCfIv, LIcon, LTemplate: string;
LQ: TFDQuery;
begin
try
@@ -192,6 +198,8 @@ begin
LKind := LBody.GetValue<string>('kind', 'login');
LCf := LBody.GetValue<string>('custom_fields', '');
LCfIv := LBody.GetValue<string>('custom_fields_iv', '');
LIcon := LBody.GetValue<string>('icon_b64', '');
LTemplate:= Trim(LBody.GetValue<string>('template', ''));
finally
LBody.Free;
end;
@@ -221,9 +229,9 @@ begin
'INSERT INTO vault_entries ' +
'(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
' created_at, updated_at, password_changed_at) ' +
' icon_b64, template, created_at, updated_at, password_changed_at) ' +
'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
' :cf, :cfiv, :c, :c2, :c)';
' :cf, :cfiv, :ic, :tpl, :c, :c2, :c)';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('s').AsString := LSite;
LQ.ParamByName('tt').AsString := LTitle;
@@ -236,23 +244,28 @@ begin
// assigned a string and sometimes Clear()ed to NULL — without a
// prior typed assignment, .Clear raises "data type unknown" on
// SQLite. Declare ftString up front for the optional TOTP fields.
LQ.ParamByName('ts').DataType := ftString;
LQ.ParamByName('tiv').DataType := ftString;
LQ.ParamByName('ts').DataType := ftMemo;
LQ.ParamByName('tiv').DataType := ftMemo;
// Store empty TOTP fields as NULL so the GET endpoint emits JSON null
// rather than '' — keeps client-side "has TOTP?" checks unambiguous.
if LTotpSec = '' then
LQ.ParamByName('ts').Clear
else
LQ.ParamByName('ts').AsString := LTotpSec;
LQ.ParamByName('ts').Value := LTotpSec;
if LTotpIv = '' then
LQ.ParamByName('tiv').Clear
else
LQ.ParamByName('tiv').AsString := LTotpIv;
LQ.ParamByName('tiv').Value := LTotpIv;
LQ.ParamByName('k').AsString := LKind;
LQ.ParamByName('cf').DataType := ftString;
LQ.ParamByName('cfiv').DataType := ftString;
if LCf = '' then LQ.ParamByName('cf').Clear else LQ.ParamByName('cf').AsString := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').AsString := LCfIv;
LQ.ParamByName('cf').DataType := ftMemo;
LQ.ParamByName('cfiv').DataType := ftMemo;
if LCf = '' then LQ.ParamByName('cf').Clear else LQ.ParamByName('cf').Value := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
LQ.ParamByName('ic').DataType := ftMemo;
if LIcon = '' then LQ.ParamByName('ic').Clear else LQ.ParamByName('ic').Value := LIcon;
LQ.ParamByName('tpl').DataType := ftString;
if LTemplate = '' then LQ.ParamByName('tpl').Clear
else LQ.ParamByName('tpl').AsString := LTemplate;
LQ.ParamByName('c').AsString := LNow;
LQ.ParamByName('c2').AsString := LNow;
LQ.ExecSQL;
@@ -284,7 +297,8 @@ var
LUserId, LId: Integer;
LBody: TJSONObject;
LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LNow, LTotpSec, LTotpIv,
LKind, LCf, LCfIv: string;
LKind, LCf, LCfIv, LTemplate: string;
LHasTemplate: Boolean;
LQ: TFDQuery;
begin
try
@@ -315,6 +329,10 @@ begin
LKind := LBody.GetValue<string>('kind', 'login');
LCf := LBody.GetValue<string>('custom_fields', '');
LCfIv := LBody.GetValue<string>('custom_fields_iv', '');
// Template is only updated when the caller explicitly sends it —
// partial PUTs (drag-to-folder) must not wipe it.
LHasTemplate := LBody.GetValue('template') <> nil;
LTemplate := Trim(LBody.GetValue<string>('template', ''));
finally
LBody.Free;
end;
@@ -365,6 +383,10 @@ begin
// password_changed_at fires only when the ciphertext actually
// changes — same conditional used above for history insertion.
// template column is updated only when the caller sent it, so a
// partial PUT (drag-to-folder, move-to-folder) doesn't wipe it.
var LTemplateSet := '';
if LHasTemplate then LTemplateSet := ', template=:tpl';
LQ.SQL.Text :=
'UPDATE vault_entries ' +
'SET site=:s, title=:tt, username=:u, encrypted_password=:e, iv=:i, ' +
@@ -372,7 +394,8 @@ begin
' custom_fields=:cf, custom_fields_iv=:cfiv, ' +
' updated_at=:c, ' +
' password_changed_at = CASE WHEN encrypted_password <> :e ' +
' THEN :c ELSE password_changed_at END ' +
' THEN :c ELSE password_changed_at END' +
LTemplateSet + ' ' +
'WHERE id=:id AND user_id=:uid';
LQ.ParamByName('s').AsString := LSite;
LQ.ParamByName('tt').AsString := LTitle;
@@ -383,23 +406,29 @@ begin
LQ.ParamByName('t').AsString := LTags;
// Declare TOTP param types so .Clear works on first use (FireDAC
// needs an inferred or explicit DataType before NULL binding).
LQ.ParamByName('ts').DataType := ftString;
LQ.ParamByName('tiv').DataType := ftString;
LQ.ParamByName('ts').DataType := ftMemo;
LQ.ParamByName('tiv').DataType := ftMemo;
// Clearing TOTP (user removed 2FA from this entry) is signaled by an
// empty string in the request → store NULL in the DB.
if LTotpSec = '' then
LQ.ParamByName('ts').Clear
else
LQ.ParamByName('ts').AsString := LTotpSec;
LQ.ParamByName('ts').Value := LTotpSec;
if LTotpIv = '' then
LQ.ParamByName('tiv').Clear
else
LQ.ParamByName('tiv').AsString := LTotpIv;
LQ.ParamByName('tiv').Value := LTotpIv;
LQ.ParamByName('k').AsString := LKind;
LQ.ParamByName('cf').DataType := ftString;
LQ.ParamByName('cfiv').DataType := ftString;
if LCf = '' then LQ.ParamByName('cf').Clear else LQ.ParamByName('cf').AsString := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').AsString := LCfIv;
LQ.ParamByName('cf').DataType := ftMemo;
LQ.ParamByName('cfiv').DataType := ftMemo;
if LCf = '' then LQ.ParamByName('cf').Clear else LQ.ParamByName('cf').Value := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
if LHasTemplate then
begin
LQ.ParamByName('tpl').DataType := ftString;
if LTemplate = '' then LQ.ParamByName('tpl').Clear
else LQ.ParamByName('tpl').AsString := LTemplate;
end;
LQ.ParamByName('c').AsString := LNow;
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
@@ -558,6 +587,51 @@ begin
TJSONHelper.SendOK(AResponse, 'Toggled');
end;
// ===== POST /entries/{id}/pin ================================================
// Same shape as /favorite: flip the pinned bit, no body required.
procedure HandleTogglePin(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LId: Integer;
LQ: TFDQuery;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
LId := StrToIntDef(AParams[0], 0);
if LId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid id');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'UPDATE vault_entries ' +
'SET pinned = CASE WHEN pinned=1 THEN 0 ELSE 1 END ' +
'WHERE id=:id AND user_id=:uid';
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ExecSQL;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
LogAudit(LUserId, 'toggle_pin', GetClientIP(ARequest));
TJSONHelper.SendOK(AResponse, 'Toggled');
end;
// ===== POST /entries/{id}/touch ==============================================
// Bumps accessed_at. Called from JS on copy / slideover-open so the sidebar
// "Recent" view can show what the user actually uses. Auth-only (no CSRF
@@ -637,12 +711,12 @@ begin
LBody.Free;
end;
// Soft cap to prevent a misbehaving fetcher from ballooning the DB.
// 32x32 PNG favicons rarely exceed 4 KB; 64 KB leaves room for SVG / 64x64.
// Soft cap. Most favicons are < 10 KB; bumped to 256 KB because DDG
// occasionally serves the brand's full-resolution PNG (deepseek.com
// came back at 200+ KB) and we want those to be cacheable too.
if Length(LIcon) > 262144 then
// Soft cap on the SERIALISED data URI ('data:image/...;base64,...'). The
// favicon fetcher allows 256 KB raw, which becomes ~350 KB after base64
// + prefix overhead. Cap at 512 KB chars so a max-raw fetch + a bit of
// headroom still passes (the silent 413 here was deleting deepseek's
// 200+ KB icon on lock/unlock since saveEntryIcon swallows the error).
if Length(LIcon) > 524288 then
begin
TJSONHelper.SendError(AResponse, 413, 'Icon too large');
Exit;
@@ -658,7 +732,7 @@ begin
'WHERE id=:id AND user_id=:uid';
LQ.ParamByName('ic').DataType := ftMemo; // long text → ftMemo on SQLite
if LIcon = '' then LQ.ParamByName('ic').Clear
else LQ.ParamByName('ic').AsString := LIcon;
else LQ.ParamByName('ic').Value := LIcon;
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ExecSQL;
@@ -862,10 +936,11 @@ end;
procedure HandleBulkImport(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, I, LImported: Integer;
LUserId, I, LImported, LNewId: Integer;
LBody, LObj, LEntry: TJSONObject;
LArr: TJSONArray;
LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LTotpSec, LTotpIv, LNow: string;
LArr, LIds: TJSONArray;
LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LTotpSec, LTotpIv, LNow,
LKind, LCf, LCfIv, LIcon, LTemplate: string;
LQ: TFDQuery;
begin
try
@@ -894,6 +969,10 @@ begin
LNow := FormatDateTime('yyyy-mm-dd hh:nn:ss', Now);
LImported := 0;
// Track newly-inserted IDs in input order so the client can upload
// attachments to the right entry afterwards. Skipped rows emit -1
// so the array remains positionally aligned with the input.
LIds := TJSONArray.Create;
DB.Lock;
try
@@ -905,14 +984,24 @@ begin
LQ.SQL.Text :=
'INSERT INTO vault_entries ' +
'(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
' folder, tags, totp_secret, totp_iv, created_at, updated_at) ' +
'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :c, :c2)';
// Declare optional TOTP param types ONCE — the prepared statement
// is reused across every imported entry, and FireDAC needs the
' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
' icon_b64, template, created_at, updated_at) ' +
'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
' :cf, :cfiv, :ic, :tpl, :c, :c2)';
// Declare optional param types ONCE — the prepared statement is
// reused across every imported entry, and FireDAC needs the
// type set before the first .Clear call would otherwise fail
// for a row without TOTP.
LQ.ParamByName('ts').DataType := ftString;
LQ.ParamByName('tiv').DataType := ftString;
// for a row that omits the field. ftMemo (unlimited TEXT) is
// mandatory for icon_b64 + custom_fields which often exceed
// FireDAC's default ftString cap (~4000 chars) — a 256 KB
// icon would otherwise be silently truncated to nothing on
// the next read.
LQ.ParamByName('ts').DataType := ftMemo;
LQ.ParamByName('tiv').DataType := ftMemo;
LQ.ParamByName('cf').DataType := ftMemo;
LQ.ParamByName('cfiv').DataType := ftMemo;
LQ.ParamByName('ic').DataType := ftMemo;
LQ.ParamByName('tpl').DataType := ftString;
for I := 0 to LArr.Count - 1 do
begin
@@ -926,11 +1015,27 @@ begin
LTags := Trim(LEntry.GetValue<string>('tags', ''));
LTotpSec := LEntry.GetValue<string>('totp_secret', '');
LTotpIv := LEntry.GetValue<string>('totp_iv', '');
LKind := LEntry.GetValue<string>('kind', 'login');
if (LKind <> 'login') and (LKind <> 'note') then LKind := 'login';
LCf := LEntry.GetValue<string>('custom_fields', '');
LCfIv := LEntry.GetValue<string>('custom_fields_iv', '');
LIcon := LEntry.GetValue<string>('icon_b64', '');
LTemplate:= Trim(LEntry.GetValue<string>('template', ''));
// Skip silently if a row is missing the minimum required fields
// (site + ciphertext). Better than failing the whole batch on
// one bad row when the user is importing 500+ entries.
if (LSite = '') or (LEnc = '') or (LIV = '') then Continue;
// Ciphertext is always required. Site is required only for
// logins — notes legitimately have no site (their body lives
// inside the encrypted blob). Skip silently rather than fail
// the whole batch on one bad row.
if (LEnc = '') or (LIV = '') then
begin
LIds.AddElement(TJSONNumber.Create(-1));
Continue;
end;
if (LKind = 'login') and (LSite = '') then
begin
LIds.AddElement(TJSONNumber.Create(-1));
Continue;
end;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('s').AsString := LSite;
@@ -941,12 +1046,20 @@ begin
LQ.ParamByName('f').AsString := LFolder;
LQ.ParamByName('t').AsString := LTags;
if LTotpSec = '' then LQ.ParamByName('ts').Clear
else LQ.ParamByName('ts').AsString := LTotpSec;
else LQ.ParamByName('ts').Value := LTotpSec;
if LTotpIv = '' then LQ.ParamByName('tiv').Clear
else LQ.ParamByName('tiv').AsString := LTotpIv;
else LQ.ParamByName('tiv').Value := LTotpIv;
LQ.ParamByName('k').AsString := LKind;
if LCf = '' then LQ.ParamByName('cf').Clear else LQ.ParamByName('cf').Value := LCf;
if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
if LIcon = '' then LQ.ParamByName('ic').Clear else LQ.ParamByName('ic').Value := LIcon;
if LTemplate = '' then LQ.ParamByName('tpl').Clear
else LQ.ParamByName('tpl').AsString := LTemplate;
LQ.ParamByName('c').AsString := LNow;
LQ.ParamByName('c2').AsString := LNow;
LQ.ExecSQL;
LNewId := DB.Connection.GetLastAutoGenValue('vault_entries');
LIds.AddElement(TJSONNumber.Create(LNewId));
Inc(LImported);
end;
finally
@@ -967,6 +1080,7 @@ begin
LogAudit(LUserId, Format('bulk_import %d entries', [LImported]), GetClientIP(ARequest));
LObj := TJSONObject.Create;
LObj.AddPair('imported', TJSONNumber.Create(LImported));
LObj.AddPair('ids', LIds);
TJSONHelper.SendJSON(AResponse, LObj);
end;
@@ -1026,6 +1140,7 @@ initialization
Router.Register('POST', '/entries/(\d+)/restore', HandleRestoreEntry);
Router.Register('POST', '/entries/(\d+)/favorite', HandleToggleFavorite);
Router.Register('POST', '/entries/(\d+)/touch', HandleTouchEntry);
Router.Register('POST', '/entries/(\d+)/pin', HandleTogglePin);
Router.Register('POST', '/entries/(\d+)/icon', HandleSetEntryIcon);
Router.Register('GET', '/entries/(\d+)/history', HandleGetEntryHistory);
Router.Register('GET', '/entries/count', HandleEntriesCount);
delphi-backend/Source/PM.Bridge.pas
+5
View File
@@ -178,6 +178,11 @@ type
// the tray icon mute. Configured from the JS settings panel.
property ShowNotifications: Boolean
read FShowNotifications write FShowNotifications;
// Already-shown flag for the one-time "still running in the tray"
// balloon. Exposed so the host can pre-mark it true on autostart
// launches (the user didn't actively minimise — no need to inform them).
property BalloonShown: Boolean
read FBalloonShown write FBalloonShown;
// Fired on main thread when the autofill hotkey fires.
// Args: (ATargetHWND, AWindowTitle). Handler calls ExecuteJavaScript
// to let JS match the title against vault entries.
delphi-backend/Source/PM.Database.pas
+8
View File
@@ -306,6 +306,14 @@ begin
// the "aged password" badge. Legacy rows: NULL → JS falls back to
// updated_at, then created_at.
AddColumnIfMissing('vault_entries', 'password_changed_at', 'DATETIME');
// Pinned entries float to the top of every view, regardless of sort.
// Independent from favorite (which is a filter, not a sort override).
AddColumnIfMissing('vault_entries', 'pinned', 'INTEGER DEFAULT 0');
// Template identifier: empty/NULL = generic login or note; otherwise a
// string like 'credit-card', 'ssh-key', 'server', 'recovery-codes'.
// Drives the card/table label so notes-with-fields read as "Credit card"
// instead of the generic "Encrypted note" placeholder.
AddColumnIfMissing('vault_entries', 'template', 'TEXT');
// Per-folder customisation. NULL = no override → JS uses the default
// accent + i-folder symbol.
AddColumnIfMissing('folders', 'color', 'TEXT');
delphi-backend/Source/PM.Favicon.pas
+2 -2
View File
@@ -1,4 +1,4 @@
unit PM.Favicon;
unit PM.Favicon;
{
Favicon proxy — fetches a website's icon and returns a base64 data URI
@@ -44,7 +44,7 @@ const
HTTP_TIMEOUT_MS = 5000;
// DDG returns a generic placeholder for unknown domains. Bigger threshold
// than 100 to avoid treating its blank globe glyph as a real icon.
MIN_REAL_ICON_BYTES = 500;
MIN_REAL_ICON_BYTES = 300;
// Privacy stance: DDG-only fetches. We don't fall back to the site's
// own /favicon.ico because that would leak DNS to every domain stored
// in the vault. For sites DDG doesn't index, the user can upload a
delphi-backend/Source/PM.QuickUnlock.pas
+29 -5
View File
@@ -1,4 +1,4 @@
unit PM.QuickUnlock;
unit PM.QuickUnlock;
{
Quick unlock — persistent on-device cache of the vault key, encrypted
@@ -85,18 +85,42 @@ function CryptUnprotectData(pDataIn: PDataBlob; ppszDataDescr: PPWideChar;
function LocalFree(hMem: HLOCAL): HLOCAL; stdcall;
external 'kernel32.dll' name 'LocalFree';
var LoadedConfig:Boolean=False;
StorageDir_:String='';
// ---------------------------------------------------------------------------
// Storage helpers
// ---------------------------------------------------------------------------
procedure LoadConfig;
begin
if LoadedConfig then
exit;
Var ConfigList := TStringList.Create;
try
StorageDir_ := TPath.Combine(ExtractFileDir(ParamStr(0)),'config.txt');
if TFile.Exists(StorageDir_) then
begin
ConfigList.LoadFromFile(StorageDir_);
StorageDir_ := ConfigList.Values['PathUnlock'];
if StorageDir_.ToLower.Equals('same') then
StorageDir_ := ExtractFileDir(ParamStr(0))
end
else
StorageDir_ := '';
finally
FreeAndNil(ConfigList);
LoadedConfig :=True;
end;
end;
function StorageDir: string;
begin
// %LOCALAPPDATA%\PMServer — per-user, roaming-disabled. DPAPI keys live
// alongside the user profile so they survive Windows updates but not
// a profile reset.
Result := TPath.Combine(
GetEnvironmentVariable('LOCALAPPDATA'),
'PMServer');
LoadConfig;
if StorageDir_.IsEmpty then
Result := TPath.Combine(GetEnvironmentVariable('LOCALAPPDATA'),'PMServer')
else
Result :=StorageDir_;
end;
function StorageFile: string;
delphi-backend/UMainForm.pas
+29 -2
View File
@@ -13,6 +13,8 @@
interface
uses
System.SysUtils, System.Classes, System.UITypes, System.NetEncoding,
System.StrUtils, System.Generics.Collections, System.IOUtils, System.JSON,
@@ -33,7 +35,10 @@ uses
PM.HTTPServer, PM.Bridge, PM.QuickUnlock, PM.UserPrefs, PM.AutoStart,
PM.Favicon,
FMX.Platform.Win, FMX.Menus; // WindowHandleToPlatform → HWND for visibility check
const
// Bump on each release. Surfaced to JS via cmd://app/version, displayed
// in Settings → Account so users can report bugs with the right build.
APP_VERSION = '1.0.0';
type
// Concrete class chosen at compile time. Both inherit from
// TTMSFNCCustomWebBrowser so we use that as the field type — events
@@ -212,11 +217,15 @@ begin
// initial Show before we hide it — minimises the visible flash.
if FindCmdLineSwitch('tray', True) then
begin
// Suppress the first-time tray balloon for autostart launches —
// it's noise when Windows itself put us in the tray (the user
// didn't actively minimise). Manual launches still see it once.
FBridge.BalloonShown := True;
TThread.ForceQueue(nil,
procedure
begin
FBridge.MinimizeToTray;
LogLine('Launched with --tray, minimised at startup');
LogLine('Launched with --tray, minimised at startup (balloon suppressed)');
end);
end;
end;
@@ -742,6 +751,24 @@ begin
else if ACmd = 'app/theme' then
FBridge.ApplyTitleBarTheme(GetParam('mode') = 'dark')
// Build/version string exposed to JS for the Settings → About panel.
// Hardcoded const — bump manually on releases. Kept simple to avoid
// pulling Windows resource version info at runtime.
else if ACmd = 'app/version' then
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onVersionResult)' +
'Bridge.onVersionResult("' + APP_VERSION + '")')
// Launch context: the HKCU Run entry passes -tray so we can tell
// "Windows started me at boot" from "user double-clicked the exe".
// Useful for Settings → Account display and for conditional behavior
// (e.g. skip first-time tooltips on autostart).
else if ACmd = 'app/launch-mode' then
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onLaunchModeResult)' +
'Bridge.onLaunchModeResult("' +
IfThen(FindCmdLineSwitch('tray', True), 'auto', 'manual') + '")')
// Open the entry's site in the user's default browser. We restrict the
// scheme to http(s) so JS can't smuggle a file:// or other handler that
// would invoke arbitrary Windows applications.
delphi-backend/assets/assets.res
BIN
View File
Binary file not shown.