Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
150 Commits 1 Branch 0 Tags
064ad14156c85a77c4c020a4eacee5db5cfae062
Commit Graph

8 Commits

Author SHA1 Message Date
Zaki 46d7ca3694 Add CSP header and session rotation on login 
Content-Security-Policy: default-src 'self'; restricts external resource loading. Session rotation: delete all existing sessions for a user on login, so re-logging invalidates any leaked tokens.
 2026-05-09 22:24:08 +01:00
Zaki 6915ce518b Rate-limit /reauth endpoint: 5 attempts per 15min 2026-05-09 22:17:03 +01:00
Zaki 367b85e991 Add WebAuthn passkey biometric unlock + dark toggle on auth screen 
- Dark/light theme toggle now always visible (moved outside auth/vault sections)
- New passkey_challenges and passkey_credentials tables
- /passkey/register/begin + /passkey/register/complete endpoints
- /passkey/login/begin + /passkey/login/complete endpoints
- CBOR decoder + COSE key parser for WebAuthn attestation/assertion
- ES256 (P-256) signature verification via OpenSSL
- Client-side: register passkey button in settings, passkey login on auth screen
- First passkey login prompts for master password once to derive AES-GCM key
- Passkey login requires username input before biometric prompt
 2026-05-09 13:01:59 +01:00
Zaki 8abb1c5ad0 Add hover reveal, drag-to-folder, generator presets, favorites 
- Inline password reveal on hover (controlled by showView setting, replaces eye button)
- Drag an entry card onto a folder chip to move it (no modal needed)
- Generator presets: Strong 16, Strong 20, Paranoid 32 buttons
- Favorites: star toggle button per entry, entries sort to top
- Add favorite column to vault_entries, toggle endpoint, star UI in all views
- Gold border/background for favorited entries
 2026-05-08 23:53:47 +01:00
Zaki c8c7b69ae0 Phase 5: CSRF, bcrypt hashing, audit logging, export re-auth 
- Add CSRF token per session, validated on all state-changing requests (POST/PUT/DELETE)
- Upgrade password hashing from PBKDF2 to bcrypt; auto-upgrade old hashes on login
- Add audit_log table tracking all security events (login, export, delete, etc.)
- Add /reauth endpoint requiring master password before export
- Client-side: re-auth modal before export, X-CSRF-Token header on mutations
 2026-05-08 23:14:07 +01:00
Zaki 86fc568bda Fix 500 error on batch delete + add SQLite busyTimeout 
- Set SQLite busyTimeout(5000) to prevent 'database is locked' on concurrent requests
- Await all loadEntries() in mutation functions to eliminate race conditions
- Remove redundant loadEntries() from batch operations
 2026-05-08 22:50:41 +01:00
Zaki 8743f023b2 Fix refresh logout+ add trash (undo deleted) 2026-05-08 14:39:24 +01:00
Zaki a4528eb1f7 Standard password manager 2026-05-06 20:49:51 +01:00