Password-Manager

Zaki/Password-Manager

Fork 0

Commit Graph

Author	SHA1	Message	Date
r-zakarya	a42e4b205d	feat(entries): encrypt template at rest, guided tour, import fixes, cleanup Batched session work sharing app.js / index.html / Entries.pas, so it can't split cleanly without interactive hunk staging. - feat: encrypt `template` metadata at rest (template_enc/iv, added to ENCRYPTED_META_FIELDS). withEncryptedMeta skips an absent template key so partial re-ships (add-tag, move-to-folder) don't wipe it via LHasTemplate. Cleartext column kept as migration fallback. +3 unit tests. - feat: first-run guided tour ("How it works") — spotlight + bubble, no GIFs, re-launchable from Settings, seen-flag in DPAPI prefs. - fix(import): preserve original created_at on restore (was stamped to import time); restore entry icons on overwrite (PUT ignores icon_b64). - fix(settings): correct clipboard-privacy copy (already excluded from Win+V); PIN text 4-6 -> 4-12; reorder Set-PIN above unlock-method; move tray/startup toggles to General; dedicated backup-password button + warning status; tab icons. - chore: remove dead legacy monolith (app-legacy.js, index-legacy.html, style-legacy.css) + unused passkeyBtn stub. - docs: full-source review (CODE_AUDIT 6b), template + favorite/pinned notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 18:32:37 +01:00
r-zakarya	9e424efaf4	refactor(js): extract quick-search overlay cluster from app.js (§3.1) Eighth slice. Quick search wasn't contiguous — its functions sat on both sides of the cheatsheet and password-history modals (lines 725-1104). Rather than a fiddly non-contiguous cut, the whole overlay cluster is extracted as one byte-identical block: js/app.overlays.js (quick search + cheatsheet + password history). Pure declarations, no top-level side effects → loads before app.js; all state/api/Bridge/render/decryptPwd refs resolve via shared global scope at call time. - Byte-for-byte identical; syntax OK on all nine app parts; 62/62 tests green. - index.html + BuildAssets whitelist + harness APP_PARTS updated. app.js: 11936 → 9170 lines (8 modules extracted, ~2770 lines). Load order: argon2 → crypto → totp → favicon → import → backup → health → overlays → app → sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 18:43:55 +01:00

Author

SHA1

Message

Date

r-zakarya

a42e4b205d

feat(entries): encrypt template at rest, guided tour, import fixes, cleanup

Batched session work sharing app.js / index.html / Entries.pas, so it can't
split cleanly without interactive hunk staging.

- feat: encrypt `template` metadata at rest (template_enc/iv, added to
  ENCRYPTED_META_FIELDS). withEncryptedMeta skips an absent template key so
  partial re-ships (add-tag, move-to-folder) don't wipe it via LHasTemplate.
  Cleartext column kept as migration fallback. +3 unit tests.
- feat: first-run guided tour ("How it works") — spotlight + bubble, no GIFs,
  re-launchable from Settings, seen-flag in DPAPI prefs.
- fix(import): preserve original created_at on restore (was stamped to import
  time); restore entry icons on overwrite (PUT ignores icon_b64).
- fix(settings): correct clipboard-privacy copy (already excluded from Win+V);
  PIN text 4-6 -> 4-12; reorder Set-PIN above unlock-method; move tray/startup
  toggles to General; dedicated backup-password button + warning status; tab icons.
- chore: remove dead legacy monolith (app-legacy.js, index-legacy.html,
  style-legacy.css) + unused passkeyBtn stub.
- docs: full-source review (CODE_AUDIT 6b), template + favorite/pinned notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-11 18:32:37 +01:00

r-zakarya

9e424efaf4

refactor(js): extract quick-search overlay cluster from app.js (§3.1)

Eighth slice. Quick search wasn't contiguous — its functions sat on both
sides of the cheatsheet and password-history modals (lines 725-1104). Rather
than a fiddly non-contiguous cut, the whole overlay cluster is extracted as
one byte-identical block: js/app.overlays.js (quick search + cheatsheet +
password history). Pure declarations, no top-level side effects → loads
before app.js; all state/api/Bridge/render/decryptPwd refs resolve via shared
global scope at call time.

- Byte-for-byte identical; syntax OK on all nine app parts; 62/62 tests green.
- index.html + BuildAssets whitelist + harness APP_PARTS updated.

app.js: 11936 → 9170 lines (8 modules extracted, ~2770 lines). Load order:
argon2 → crypto → totp → favicon → import → backup → health → overlays →
app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-08 18:43:55 +01:00

2 Commits