Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: native save + auto-backup + folder customization + attachments + UX bundle

Browse Source 
- File: native Save As dialog via Bridge.saveFile (replaces WebView2
  browser download popup) for encrypted JSON + CSV exports.
- Auto-backup: silent periodic encrypted JSON to a chosen folder,
  user-set interval + retention, separate DPAPI-stored password, runs
  5s after unlock if due. New file/* bridge cmds (folder/pick,
  file/write, file/listMatch, file/delete).
- Folders: per-folder color + icon (8-swatch palette, 8 icon presets),
  drag-reorder via HTML5 DnD with insert-line indicators, edit pencil
  on hover. New POST /folders/reorder + PUT /folders/{name}. Folder
  chip on cards inherits custom icon + color.
- Recently used: vault_entries.accessed_at + POST /entries/{id}/touch
  (debounced 2s), sidebar Tools entry showing top-10 by accessed_at.
- Encrypted attachments: per-entry file storage (5MB cap), AES-GCM
  with vault key, native Save As download, paperclip upload in
  slideover. New entry_attachments table + PM.Handler.Attachments.
- Password expiry: vault_entries.password_changed_at (conditional bump
  via SQL CASE only when ciphertext differs), passwordExpiryDays
  setting, "Aged" badge on cards + matching Filters chip.
- Recovery: Print button on generated code modal (A4 printable sheet
  via @media print, code in 32px monospace + instructions).
- Audit log viewer (sidebar Tools, GET /audit with pagination cursor).
- Plaintext CSV export + Filters dropdown with 9 predicates.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Zaki
2026-06-21 23:12:06 +01:00
parent 63fac5b3b7
commit fa7ea191be
13 changed files with 3927 additions and 1378 deletions
Download Patch File Download Diff File Expand all files Collapse all files
delphi-backend/Handlers/PM.Handler.Attachments.pas
+317
View File
@@ -0,0 +1,317 @@
unit PM.Handler.Attachments;
(*
Encrypted file attachments per entry.
GET /entries/{id}/attachments -> [{id, filename, mime, size_bytes, created_at}, ...]
POST /entries/{id}/attachments body {filename, mime, encrypted_blob, iv, size_bytes}
-> {id, filename, mime, size_bytes, created_at}
GET /attachments/{id} -> {id, filename, mime, size_bytes, encrypted_blob, iv}
DELETE /attachments/{id} -> {message}
encrypted_blob is the base64-encoded AES-GCM ciphertext of the raw file
bytes, produced by the JS client with the per-user vault key. Server
never sees plaintext.
Per-attachment cap: ~10 MB of ciphertext-as-base64 (≈ 7.5 MB raw file).
Heavier attachments aren't appropriate for SQLite TEXT storage anyway.
*)
interface
implementation
uses
System.SysUtils, System.JSON,
FireDAC.Comp.Client, FireDAC.Stan.Param,
IdCustomHTTPServer,
PM.Router, PM.JSON, PM.Database, PM.Session, PM.Audit;
const
MAX_ATTACHMENT_B64 = 10 * 1024 * 1024; // 10 MB of base64 text
function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
begin
Result := ARequest.RemoteIP;
if Result = '' then Result := '127.0.0.1';
end;
// Ownership check: returns True iff the entry exists and belongs to LUserId.
function EntryBelongsToUser(LEntryId, LUserId: Integer): Boolean;
var
LQ: TFDQuery;
begin
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'SELECT 1 FROM vault_entries WHERE id = :id AND user_id = :uid';
LQ.ParamByName('id').AsInteger := LEntryId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
Result := not LQ.Eof;
finally
LQ.Free;
end;
end;
// ===== GET /entries/{id}/attachments =========================================
procedure HandleListAttachments(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LEntryId: Integer;
LQ: TFDQuery;
LArr: TJSONArray;
LObj: TJSONObject;
begin
try
LUserId := Authenticate(ARequest, AResponse);
except
on ESessionRejected do Exit;
end;
LEntryId := StrToIntDef(AParams[0], 0);
if LEntryId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid entry id');
Exit;
end;
LArr := TJSONArray.Create;
DB.Lock;
try
if not EntryBelongsToUser(LEntryId, LUserId) then
begin
TJSONHelper.SendError(AResponse, 404, 'Entry not found');
LArr.Free;
Exit;
end;
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'SELECT id, filename, mime, size_bytes, created_at ' +
'FROM entry_attachments WHERE entry_id = :eid AND user_id = :uid ' +
'ORDER BY created_at DESC';
LQ.ParamByName('eid').AsInteger := LEntryId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
while not LQ.Eof do
begin
LObj := TJSONObject.Create;
LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
LObj.AddPair('filename', LQ.FieldByName('filename').AsString);
LObj.AddPair('mime', LQ.FieldByName('mime').AsString);
LObj.AddPair('size_bytes', TJSONNumber.Create(LQ.FieldByName('size_bytes').AsInteger));
LObj.AddPair('created_at',
FormatDateTime('yyyy-mm-dd"T"hh:nn:ss', LQ.FieldByName('created_at').AsDateTime));
LArr.Add(LObj);
LQ.Next;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
TJSONHelper.SendJSON(AResponse, LArr);
end;
// ===== POST /entries/{id}/attachments ========================================
procedure HandleCreateAttachment(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LEntryId, LNewId: Integer;
LBody: TJSONObject;
LFilename, LMime, LBlob, LIv: string;
LSize: Integer;
LQ: TFDQuery;
LObj: TJSONObject;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
LEntryId := StrToIntDef(AParams[0], 0);
if LEntryId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid entry id');
Exit;
end;
LBody := TJSONHelper.ReadBody(ARequest);
try
LFilename := Trim(LBody.GetValue<string>('filename', ''));
LMime := LBody.GetValue<string>('mime', '');
LBlob := LBody.GetValue<string>('encrypted_blob', '');
LIv := LBody.GetValue<string>('iv', '');
LSize := LBody.GetValue<Integer>('size_bytes', 0);
finally
LBody.Free;
end;
if (LFilename = '') or (LBlob = '') or (LIv = '') then
begin
TJSONHelper.SendError(AResponse, 400, 'Missing required fields');
Exit;
end;
if Length(LBlob) > MAX_ATTACHMENT_B64 then
begin
TJSONHelper.SendError(AResponse, 413, 'Attachment too large (max ~7.5 MB raw)');
Exit;
end;
DB.Lock;
try
if not EntryBelongsToUser(LEntryId, LUserId) then
begin
TJSONHelper.SendError(AResponse, 404, 'Entry not found');
Exit;
end;
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'INSERT INTO entry_attachments ' +
'(user_id, entry_id, filename, mime, size_bytes, encrypted_blob, iv) ' +
'VALUES (:uid, :eid, :name, :mime, :sz, :blob, :iv)';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('eid').AsInteger := LEntryId;
LQ.ParamByName('name').AsString := LFilename;
LQ.ParamByName('mime').AsString := LMime;
LQ.ParamByName('sz').AsInteger := LSize;
LQ.ParamByName('blob').AsString := LBlob;
LQ.ParamByName('iv').AsString := LIv;
LQ.ExecSQL;
LNewId := DB.Connection.GetLastAutoGenValue('entry_attachments');
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
LogAudit(LUserId, 'add_attachment', GetClientIP(ARequest));
LObj := TJSONObject.Create;
LObj.AddPair('id', TJSONNumber.Create(LNewId));
LObj.AddPair('filename', LFilename);
LObj.AddPair('mime', LMime);
LObj.AddPair('size_bytes', TJSONNumber.Create(LSize));
LObj.AddPair('created_at', FormatDateTime('yyyy-mm-dd"T"hh:nn:ss', Now));
TJSONHelper.SendJSON(AResponse, LObj);
end;
// ===== GET /attachments/{id} =================================================
procedure HandleGetAttachment(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LId: Integer;
LQ: TFDQuery;
LObj: TJSONObject;
begin
try
LUserId := Authenticate(ARequest, AResponse);
except
on ESessionRejected do Exit;
end;
LId := StrToIntDef(AParams[0], 0);
if LId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid id');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'SELECT id, filename, mime, size_bytes, encrypted_blob, iv ' +
'FROM entry_attachments WHERE id = :id AND user_id = :uid';
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
if LQ.Eof then
begin
TJSONHelper.SendError(AResponse, 404, 'Not found');
Exit;
end;
LObj := TJSONObject.Create;
LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
LObj.AddPair('filename', LQ.FieldByName('filename').AsString);
LObj.AddPair('mime', LQ.FieldByName('mime').AsString);
LObj.AddPair('size_bytes', TJSONNumber.Create(LQ.FieldByName('size_bytes').AsInteger));
LObj.AddPair('encrypted_blob', LQ.FieldByName('encrypted_blob').AsString);
LObj.AddPair('iv', LQ.FieldByName('iv').AsString);
TJSONHelper.SendJSON(AResponse, LObj);
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
end;
// ===== DELETE /attachments/{id} ==============================================
procedure HandleDeleteAttachment(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LId: Integer;
LQ: TFDQuery;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
LId := StrToIntDef(AParams[0], 0);
if LId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid id');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'DELETE FROM entry_attachments WHERE id = :id AND user_id = :uid';
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ExecSQL;
if LQ.RowsAffected = 0 then
begin
TJSONHelper.SendError(AResponse, 404, 'Not found');
Exit;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
LogAudit(LUserId, 'delete_attachment', GetClientIP(ARequest));
TJSONHelper.SendOK(AResponse, 'Deleted');
end;
initialization
Router.Register('GET', '/entries/(\d+)/attachments', HandleListAttachments);
Router.Register('POST', '/entries/(\d+)/attachments', HandleCreateAttachment);
Router.Register('GET', '/attachments/(\d+)', HandleGetAttachment);
Router.Register('DELETE', '/attachments/(\d+)', HandleDeleteAttachment);
end.
delphi-backend/Handlers/PM.Handler.Audit.pas
+66 -7
View File
@@ -1,13 +1,11 @@
unit PM.Handler.Audit;
(*
POST /audit body {action, site} -> {ok:true}
POST /audit body {action, site} -> {ok:true}
GET /audit?limit=N&before=<id> -> [{id, action, ip, created_at}, ...]
Light-weight endpoint that lets the JS layer append an entry to audit_log
without going through the full entries pipeline. Used by the autofill
feature to record which site was filled (action = "autofill:<site>").
The bearer token identifies the user — no data beyond the action string
is stored.
audit_log is auto-purged after 30 days by Database init. The viewer
reads page-by-page via the `before` cursor (id < before).
*)
interface
@@ -17,7 +15,8 @@ implementation
uses
System.SysUtils, System.JSON,
IdCustomHTTPServer,
PM.Router, PM.JSON, PM.Session, PM.Audit;
Data.DB, FireDAC.Comp.Client, FireDAC.Stan.Param,
PM.Router, PM.JSON, PM.Session, PM.Audit, PM.Database;
function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
begin
@@ -59,7 +58,67 @@ begin
TJSONHelper.SendOK(AResponse);
end;
// GET /audit — return up to `limit` log entries for the current user,
// optionally newer-than-cursor (`before` = id). Most-recent first.
procedure HandleGetAudit(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LLimit, LBefore: Integer;
LQ: TFDQuery;
LArr: TJSONArray;
LObj: TJSONObject;
begin
LUserId := Authenticate(ARequest, AResponse);
LLimit := StrToIntDef(ARequest.Params.Values['limit'], 100);
if LLimit <= 0 then LLimit := 100;
if LLimit > 500 then LLimit := 500;
LBefore := StrToIntDef(ARequest.Params.Values['before'], 0);
LArr := TJSONArray.Create;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
if LBefore > 0 then
LQ.SQL.Text :=
'SELECT id, action, ip, created_at FROM audit_log ' +
'WHERE user_id = :uid AND id < :b ' +
'ORDER BY id DESC LIMIT :l'
else
LQ.SQL.Text :=
'SELECT id, action, ip, created_at FROM audit_log ' +
'WHERE user_id = :uid ' +
'ORDER BY id DESC LIMIT :l';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('l').AsInteger := LLimit;
if LBefore > 0 then
LQ.ParamByName('b').AsInteger := LBefore;
LQ.Open;
while not LQ.Eof do
begin
LObj := TJSONObject.Create;
LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
LObj.AddPair('action', LQ.FieldByName('action').AsString);
LObj.AddPair('ip', LQ.FieldByName('ip').AsString);
LObj.AddPair('created_at',
FormatDateTime('yyyy-mm-dd hh:nn:ss',
LQ.FieldByName('created_at').AsDateTime));
LArr.Add(LObj);
LQ.Next;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
TJSONHelper.SendJSON(AResponse, LArr);
end;
initialization
Router.Register('POST', '/audit', HandlePostAudit);
Router.Register('GET', '/audit', HandleGetAudit);
end.
delphi-backend/Handlers/PM.Handler.Entries.pas
+61 -3
View File
@@ -139,6 +139,14 @@ begin
LObj.AddPair('custom_fields_iv', LQ.FieldByName('custom_fields_iv').AsString);
LObj.AddPair('created_at', ISODateTimeField(LQ.FieldByName('created_at')));
LObj.AddPair('updated_at', ISODateTimeField(LQ.FieldByName('updated_at')));
if LQ.FieldByName('accessed_at').IsNull then
LObj.AddPair('accessed_at', TJSONNull.Create)
else
LObj.AddPair('accessed_at', ISODateTimeField(LQ.FieldByName('accessed_at')));
if LQ.FieldByName('password_changed_at').IsNull then
LObj.AddPair('password_changed_at', TJSONNull.Create)
else
LObj.AddPair('password_changed_at', ISODateTimeField(LQ.FieldByName('password_changed_at')));
LArr.Add(LObj);
LQ.Next;
end;
@@ -213,9 +221,9 @@ begin
'INSERT INTO vault_entries ' +
'(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
' created_at, updated_at) ' +
' created_at, updated_at, password_changed_at) ' +
'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
' :cf, :cfiv, :c, :c2)';
' :cf, :cfiv, :c, :c2, :c)';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('s').AsString := LSite;
LQ.ParamByName('tt').AsString := LTitle;
@@ -355,12 +363,16 @@ begin
LQ.ParamByName('id').AsInteger := LId;
LQ.ExecSQL;
// password_changed_at fires only when the ciphertext actually
// changes — same conditional used above for history insertion.
LQ.SQL.Text :=
'UPDATE vault_entries ' +
'SET site=:s, title=:tt, username=:u, encrypted_password=:e, iv=:i, ' +
' folder=:f, tags=:t, totp_secret=:ts, totp_iv=:tiv, kind=:k, ' +
' custom_fields=:cf, custom_fields_iv=:cfiv, ' +
' updated_at=:c ' +
' updated_at=:c, ' +
' password_changed_at = CASE WHEN encrypted_password <> :e ' +
' THEN :c ELSE password_changed_at END ' +
'WHERE id=:id AND user_id=:uid';
LQ.ParamByName('s').AsString := LSite;
LQ.ParamByName('tt').AsString := LTitle;
@@ -546,6 +558,51 @@ begin
TJSONHelper.SendOK(AResponse, 'Toggled');
end;
// ===== POST /entries/{id}/touch ==============================================
// Bumps accessed_at. Called from JS on copy / slideover-open so the sidebar
// "Recent" view can show what the user actually uses. Auth-only (no CSRF
// requirement — this is a write but harmless to forge across sessions, and
// the call is fire-and-forget from clipboard handlers where blocking on
// CSRF would be visibly laggy).
procedure HandleTouchEntry(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId, LId: Integer;
LQ: TFDQuery;
begin
try
LUserId := Authenticate(ARequest, AResponse);
except
on ESessionRejected do Exit;
end;
LId := StrToIntDef(AParams[0], 0);
if LId = 0 then
begin
TJSONHelper.SendError(AResponse, 400, 'Invalid id');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'UPDATE vault_entries SET accessed_at = CURRENT_TIMESTAMP ' +
'WHERE id = :id AND user_id = :uid AND deleted = 0';
LQ.ParamByName('id').AsInteger := LId;
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ExecSQL;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
TJSONHelper.SendOK(AResponse);
end;
// ===== POST /entries/{id}/icon ===============================================
// Stores (or clears) a cached favicon for one entry. Separate endpoint so the
// client can save the icon without re-PUT-ing the full entry (which would
@@ -968,6 +1025,7 @@ initialization
Router.Register('POST', '/entries/bulk-import', HandleBulkImport);
Router.Register('POST', '/entries/(\d+)/restore', HandleRestoreEntry);
Router.Register('POST', '/entries/(\d+)/favorite', HandleToggleFavorite);
Router.Register('POST', '/entries/(\d+)/touch', HandleTouchEntry);
Router.Register('POST', '/entries/(\d+)/icon', HandleSetEntryIcon);
Router.Register('GET', '/entries/(\d+)/history', HandleGetEntryHistory);
Router.Register('GET', '/entries/count', HandleEntriesCount);
delphi-backend/Handlers/PM.Handler.Folders.pas
+180 -11
View File
@@ -1,9 +1,10 @@
unit PM.Handler.Folders;
(*
GET /folders -> JSON array of folder names
POST /folders body {name} -> {message,name}
DELETE /folders/{name} -> {message}
GET /folders -> [{name, color, icon}, ...]
POST /folders body {name, color?, icon?} -> {message, name}
PUT /folders/{name} body {color?, icon?} -> {message}
DELETE /folders/{name} -> {message}
*)
interface
@@ -12,6 +13,7 @@ implementation
uses
System.SysUtils, System.JSON, System.NetEncoding,
System.Generics.Collections,
FireDAC.Comp.Client, FireDAC.Stan.Param,
IdCustomHTTPServer,
PM.Router, PM.JSON, PM.Database, PM.Session, PM.Audit, PM.RateLimit;
@@ -24,6 +26,7 @@ var
LUserId: Integer;
LQ: TFDQuery;
LArr: TJSONArray;
LObj: TJSONObject;
begin
try
LUserId := Authenticate(ARequest, AResponse);
@@ -37,12 +40,18 @@ begin
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text := 'SELECT name FROM folders WHERE user_id = :uid ORDER BY name';
LQ.SQL.Text :=
'SELECT name, color, icon FROM folders ' +
'WHERE user_id = :uid ORDER BY sort_order, name';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.Open;
while not LQ.Eof do
begin
LArr.Add(LQ.FieldByName('name').AsString);
LObj := TJSONObject.Create;
LObj.AddPair('name', LQ.FieldByName('name').AsString);
LObj.AddPair('color', LQ.FieldByName('color').AsString);
LObj.AddPair('icon', LQ.FieldByName('icon').AsString);
LArr.Add(LObj);
LQ.Next;
end;
finally
@@ -61,7 +70,7 @@ procedure HandleCreateFolder(ARequest: TIdHTTPRequestInfo;
var
LUserId: Integer;
LBody: TJSONObject;
LName: string;
LName, LColor, LIcon: string;
LQ: TFDQuery;
LObj: TJSONObject;
begin
@@ -74,7 +83,9 @@ begin
LBody := TJSONHelper.ReadBody(ARequest);
try
LName := Trim(LBody.GetValue<string>('name', ''));
LName := Trim(LBody.GetValue<string>('name', ''));
LColor := Trim(LBody.GetValue<string>('color', ''));
LIcon := Trim(LBody.GetValue<string>('icon', ''));
finally
LBody.Free;
end;
@@ -95,9 +106,15 @@ begin
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text := 'INSERT INTO folders (user_id, name) VALUES (:uid, :name)';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('name').AsString := LName;
LQ.SQL.Text :=
'INSERT INTO folders (user_id, name, color, icon) ' +
'VALUES (:uid, :name, :color, :icon)';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('name').AsString := LName;
if LColor = '' then LQ.ParamByName('color').Clear
else LQ.ParamByName('color').AsString := LColor;
if LIcon = '' then LQ.ParamByName('icon').Clear
else LQ.ParamByName('icon').AsString := LIcon;
try
LQ.ExecSQL;
except
@@ -121,6 +138,156 @@ begin
TJSONHelper.SendJSON(AResponse, LObj);
end;
// ===== PUT /folders/{name} ===================================================
// Body: {color?, icon?} — pass empty string to clear.
procedure HandleUpdateFolder(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId: Integer;
LBody: TJSONObject;
LName, LColor, LIcon: string;
LHasColor, LHasIcon: Boolean;
LQ: TFDQuery;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
if Length(AParams) < 1 then
begin
TJSONHelper.SendError(AResponse, 400, 'Folder name required');
Exit;
end;
LName := TNetEncoding.URL.Decode(AParams[0]);
if SameText(LName, 'All') then
begin
TJSONHelper.SendError(AResponse, 400, 'Cannot customise All');
Exit;
end;
LBody := TJSONHelper.ReadBody(ARequest);
try
LHasColor := LBody.GetValue('color') <> nil;
LHasIcon := LBody.GetValue('icon') <> nil;
LColor := LBody.GetValue<string>('color', '');
LIcon := LBody.GetValue<string>('icon', '');
finally
LBody.Free;
end;
if not (LHasColor or LHasIcon) then
begin
TJSONHelper.SendOK(AResponse, 'No change');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
// Build SET clause dynamically based on which fields the caller sent.
var LSet := '';
if LHasColor then LSet := 'color = :color';
if LHasIcon then
begin
if LSet <> '' then LSet := LSet + ', ';
LSet := LSet + 'icon = :icon';
end;
LQ.SQL.Text :=
'UPDATE folders SET ' + LSet +
' WHERE user_id = :uid AND name = :name';
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('name').AsString := LName;
if LHasColor then
begin
if LColor = '' then LQ.ParamByName('color').Clear
else LQ.ParamByName('color').AsString := LColor;
end;
if LHasIcon then
begin
if LIcon = '' then LQ.ParamByName('icon').Clear
else LQ.ParamByName('icon').AsString := LIcon;
end;
LQ.ExecSQL;
if LQ.RowsAffected = 0 then
begin
TJSONHelper.SendError(AResponse, 404, 'Not found');
Exit;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
LogAudit(LUserId, 'update_folder', GetClientIP(ARequest));
TJSONHelper.SendOK(AResponse, 'Updated');
end;
// ===== POST /folders/reorder =================================================
// Body: {names: ["Work", "Personal", "Misc"]} — write sort_order = index+1
// for each. Names not in the list keep their previous sort_order (so a
// partial reorder still works after another tab created a folder).
procedure HandleReorderFolders(ARequest: TIdHTTPRequestInfo;
AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
var
LUserId: Integer;
LBody: TJSONObject;
LArr: TJSONArray;
LQ: TFDQuery;
I: Integer;
begin
try
LUserId := Authenticate(ARequest, AResponse);
RequireCSRF(ARequest, AResponse, LUserId);
except
on ESessionRejected do Exit;
end;
LBody := TJSONHelper.ReadBody(ARequest);
try
LArr := LBody.GetValue<TJSONArray>('names');
if (LArr = nil) or (LArr.Count = 0) then
begin
TJSONHelper.SendError(AResponse, 400, 'names array required');
Exit;
end;
DB.Lock;
try
LQ := TFDQuery.Create(nil);
try
LQ.Connection := DB.Connection;
LQ.SQL.Text :=
'UPDATE folders SET sort_order = :ord ' +
'WHERE user_id = :uid AND name = :name';
for I := 0 to LArr.Count - 1 do
begin
LQ.ParamByName('uid').AsInteger := LUserId;
LQ.ParamByName('ord').AsInteger := I + 1;
LQ.ParamByName('name').AsString := LArr.Items[I].Value;
LQ.ExecSQL;
end;
finally
LQ.Free;
end;
finally
DB.Unlock;
end;
finally
LBody.Free;
end;
LogAudit(LUserId, 'reorder_folders', GetClientIP(ARequest));
TJSONHelper.SendOK(AResponse, 'Reordered');
end;
// ===== DELETE /folders/{name} ================================================
procedure HandleDeleteFolder(ARequest: TIdHTTPRequestInfo;
@@ -194,7 +361,9 @@ end;
initialization
Router.Register('GET', '/folders', HandleGetFolders);
Router.Register('POST', '/folders', HandleCreateFolder);
Router.Register('POST', '/folders', HandleCreateFolder);
Router.Register('POST', '/folders/reorder', HandleReorderFolders);
Router.Register('PUT', '/folders/(.+)', HandleUpdateFolder);
Router.Register('DELETE', '/folders/(.+)', HandleDeleteFolder);
end.
delphi-backend/PMServer.dpr
+2 -1
View File
@@ -28,7 +28,8 @@ uses
PM.Handler.Passkey in 'Handlers\PM.Handler.Passkey.pas',
PM.Handler.Recovery in 'Handlers\PM.Handler.Recovery.pas',
PM.Handler.Audit in 'Handlers\PM.Handler.Audit.pas',
PM.Handler.Settings in 'Handlers\PM.Handler.Settings.pas';
PM.Handler.Settings in 'Handlers\PM.Handler.Settings.pas',
PM.Handler.Attachments in 'Handlers\PM.Handler.Attachments.pas';
{$R *.res}
{$R assets\assets.res}
delphi-backend/PMServer.dproj
+1260 -1259
View File
File diff suppressed because it is too large Load Diff
delphi-backend/Source/PM.Database.pas
+38
View File
@@ -208,6 +208,28 @@ begin
FConn.ExecSQL(
'CREATE INDEX IF NOT EXISTS idx_history_entry ' +
' ON entries_password_history(entry_id, changed_at DESC)');
// Per-entry encrypted file attachments (PDFs, images of backup codes,
// etc.). encrypted_blob is the AES-GCM ciphertext of the raw file bytes,
// base64-encoded. Filename + mime + size_bytes are stored in cleartext
// for the listing UI — knowingly leaked metadata in exchange for not
// having to decrypt every entry on list render.
FConn.ExecSQL(
'CREATE TABLE IF NOT EXISTS entry_attachments (' +
' id INTEGER PRIMARY KEY AUTOINCREMENT,' +
' user_id INTEGER NOT NULL,' +
' entry_id INTEGER NOT NULL,' +
' filename TEXT NOT NULL,' +
' mime TEXT,' +
' size_bytes INTEGER NOT NULL,' +
' encrypted_blob TEXT NOT NULL,' +
' iv TEXT NOT NULL,' +
' created_at DATETIME DEFAULT CURRENT_TIMESTAMP,' +
' FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,' +
' FOREIGN KEY (entry_id) REFERENCES vault_entries(id) ON DELETE CASCADE' +
')');
FConn.ExecSQL(
'CREATE INDEX IF NOT EXISTS idx_attachments_entry ' +
' ON entry_attachments(entry_id)');
end;
function TPMDatabase.ColumnExists(const ATable, AColumn: string): Boolean;
@@ -275,6 +297,22 @@ begin
// Fetched on demand by the Delphi favicon proxy when the user opts in.
// NULL = no icon cached → JS falls back to the first-letter avatar.
AddColumnIfMissing('vault_entries', 'icon_b64', 'TEXT');
// Tracked client-side via POST /entries/:id/touch on copy/open. Powers
// the sidebar "Recent" view. NULL = never accessed since the column
// landed (legacy rows).
AddColumnIfMissing('vault_entries', 'accessed_at', 'DATETIME');
// Bumped to CURRENT_TIMESTAMP only when encrypted_password actually
// changes (distinct from updated_at which fires on any edit). Powers
// the "aged password" badge. Legacy rows: NULL → JS falls back to
// updated_at, then created_at.
AddColumnIfMissing('vault_entries', 'password_changed_at', 'DATETIME');
// Per-folder customisation. NULL = no override → JS uses the default
// accent + i-folder symbol.
AddColumnIfMissing('folders', 'color', 'TEXT');
AddColumnIfMissing('folders', 'icon', 'TEXT');
// Manual sort order from drag-reorder. 0 = legacy/never reordered →
// falls back to alphabetical secondary sort in GET /folders.
AddColumnIfMissing('folders', 'sort_order', 'INTEGER DEFAULT 0');
AddColumnIfMissing('users', 'hash_algo', 'TEXT DEFAULT ''pbkdf2''');
// PBKDF2 iteration count per user. Legacy rows (predating this column)
// default to 100000 — the value used by api.php / the early Delphi build.
delphi-backend/UMainForm.pas
+177 -1
View File
@@ -15,7 +15,7 @@ interface
uses
System.SysUtils, System.Classes, System.UITypes, System.NetEncoding,
System.StrUtils, System.Generics.Collections,
System.StrUtils, System.Generics.Collections, System.IOUtils, System.JSON,
Winapi.Windows, Winapi.ShellAPI,
FMX.Forms, FMX.Controls, FMX.Controls.Presentation, FMX.StdCtrls,
FMX.Memo, FMX.Memo.Types, FMX.ScrollBox, FMX.Edit, FMX.Layouts, FMX.Types,
@@ -860,6 +860,182 @@ begin
BoolToStr(PM.AutoStart.IsAutoStartEnabled, True).ToLower + ')');
end
// ---- Native file save (bypasses WebView2's browser download UI) ------
// JS sends: cmd://file/save?name=<filename>&data=<base64>&reqId=<id>
// Delphi opens GetSaveFileName, writes the decoded bytes, then calls
// Bridge.onFileSaveResult(reqId, ok, path). All synchronous on the UI
// thread — payloads are small (a vault JSON export is well under 1 MB).
else if ACmd = 'file/save' then
begin
var LName := GetParam('name');
var LData := GetParam('data');
var LReqId := GetParam('reqId');
var LOk := False;
var LPath := '';
var LErr := '';
try
var LBytes := TNetEncoding.Base64.DecodeStringToBytes(LData);
var LDlg := TSaveDialog.Create(nil);
try
LDlg.FileName := LName;
var LExt := ExtractFileExt(LName);
if LExt = '.json' then LDlg.Filter := 'JSON file (*.json)|*.json|All files (*.*)|*.*'
else if LExt = '.csv' then LDlg.Filter := 'CSV file (*.csv)|*.csv|All files (*.*)|*.*'
else LDlg.Filter := 'All files (*.*)|*.*';
LDlg.DefaultExt := LExt.TrimLeft(['.']);
LDlg.Options := LDlg.Options + [TOpenOption.ofOverwritePrompt];
if LDlg.Execute then
begin
LPath := LDlg.FileName;
var LStream := TFileStream.Create(LPath, fmCreate);
try
if Length(LBytes) > 0 then
LStream.WriteBuffer(LBytes[0], Length(LBytes));
finally
LStream.Free;
end;
LOk := True;
LogLine(Format('File saved: %s (%d bytes)', [LPath, Length(LBytes)]));
end
else
LogLine('File save cancelled by user');
finally
LDlg.Free;
end;
except
on E: Exception do
begin
LErr := E.Message;
LogLine('File save FAILED: ' + LErr);
end;
end;
var LEscReq := StringReplace(LReqId, '"', '\"', [rfReplaceAll]);
var LEscPath := StringReplace(LPath, '\', '\\', [rfReplaceAll]);
LEscPath := StringReplace(LEscPath, '"', '\"', [rfReplaceAll]);
var LEscErr := StringReplace(LErr, '\', '\\', [rfReplaceAll]);
LEscErr := StringReplace(LEscErr, '"', '\"', [rfReplaceAll]);
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onFileSaveResult)' +
'Bridge.onFileSaveResult("' + LEscReq + '",' +
BoolToStr(LOk, True).ToLower + ',"' + LEscPath + '","' + LEscErr + '")');
end
// ---- Auto-backup: folder picker (modal Win32 dialog) -----------------
// cmd://folder/pick?reqId=<id>
// Callback: Bridge.onFolderPickResult(reqId, path) (path = '' on cancel)
else if ACmd = 'folder/pick' then
begin
var LReqId := GetParam('reqId');
var LDir := '';
SelectDirectory('Choose backup folder', '', LDir);
var LEscReq := StringReplace(LReqId, '"', '\"', [rfReplaceAll]);
var LEscDir := StringReplace(LDir, '\', '\\', [rfReplaceAll]);
LEscDir := StringReplace(LEscDir, '"', '\"', [rfReplaceAll]);
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onFolderPickResult)' +
'Bridge.onFolderPickResult("' + LEscReq + '","' + LEscDir + '")');
if LDir <> '' then LogLine('Folder picked: ' + LDir);
end
// ---- Auto-backup: silent file write (no dialog) ----------------------
// cmd://file/write?path=<full>&data=<base64>&reqId=<id>
// Callback: Bridge.onFileWriteResult(reqId, ok, error)
else if ACmd = 'file/write' then
begin
var LPath := GetParam('path');
var LData := GetParam('data');
var LReqId := GetParam('reqId');
var LOk := False;
var LErr := '';
try
var LBytes := TNetEncoding.Base64.DecodeStringToBytes(LData);
var LStream := TFileStream.Create(LPath, fmCreate);
try
if Length(LBytes) > 0 then
LStream.WriteBuffer(LBytes[0], Length(LBytes));
finally
LStream.Free;
end;
LOk := True;
LogLine(Format('File written: %s (%d bytes)', [LPath, Length(LBytes)]));
except
on E: Exception do
begin
LErr := E.Message;
LogLine('File write FAILED for "' + LPath + '": ' + LErr);
end;
end;
var LEscReq := StringReplace(LReqId, '"', '\"', [rfReplaceAll]);
var LEscErr := StringReplace(LErr, '\', '\\', [rfReplaceAll]);
LEscErr := StringReplace(LEscErr, '"', '\"', [rfReplaceAll]);
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onFileWriteResult)' +
'Bridge.onFileWriteResult("' + LEscReq + '",' +
BoolToStr(LOk, True).ToLower + ',"' + LEscErr + '")');
end
// ---- Auto-backup: list files in dir matching name prefix --------------
// cmd://file/listMatch?dir=<full>&prefix=<str>&reqId=<id>
// Callback: Bridge.onFileListResult(reqId, jsonArr)
// Each item: {name, size, mtime} (mtime = ISO).
else if ACmd = 'file/listMatch' then
begin
var LDir := GetParam('dir');
var LPrefix := GetParam('prefix');
var LReqId := GetParam('reqId');
var LArr := TJSONArray.Create;
try
if (LDir <> '') and TDirectory.Exists(LDir) then
begin
var LFiles := TDirectory.GetFiles(LDir, LPrefix + '*');
for var F in LFiles do
begin
var LObj := TJSONObject.Create;
LObj.AddPair('name', ExtractFileName(F));
LObj.AddPair('size', TJSONNumber.Create(TFile.GetSize(F)));
LObj.AddPair('mtime',
FormatDateTime('yyyy-mm-dd"T"hh:nn:ss', TFile.GetLastWriteTime(F)));
LArr.Add(LObj);
end;
end;
var LJSON := LArr.ToString;
var LEscReq := StringReplace(LReqId, '"', '\"', [rfReplaceAll]);
var LEscJson := StringReplace(LJSON, '\', '\\', [rfReplaceAll]);
LEscJson := StringReplace(LEscJson, '"', '\"', [rfReplaceAll]);
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onFileListResult)' +
'Bridge.onFileListResult("' + LEscReq + '","' + LEscJson + '")');
finally
LArr.Free;
end;
end
// ---- Auto-backup: delete a single file (for retention pruning) -------
// cmd://file/delete?path=<full>&reqId=<id>
// Callback: Bridge.onFileDeleteResult(reqId, ok)
else if ACmd = 'file/delete' then
begin
var LPath := GetParam('path');
var LReqId := GetParam('reqId');
var LOk := False;
try
if TFile.Exists(LPath) then
begin
TFile.Delete(LPath);
LOk := True;
LogLine('File deleted: ' + LPath);
end;
except
on E: Exception do
LogLine('File delete FAILED for "' + LPath + '": ' + E.Message);
end;
var LEscReq := StringReplace(LReqId, '"', '\"', [rfReplaceAll]);
WebBrowser.ExecuteJavaScript(
'if(window.Bridge&&Bridge.onFileDeleteResult)' +
'Bridge.onFileDeleteResult("' + LEscReq + '",' +
BoolToStr(LOk, True).ToLower + ')');
end
else
LogLine('Bridge: unknown command "' + ACmd + '"');
end;
delphi-backend/assets/assets.res
BIN
View File
Binary file not shown.