Ole-Morten Duesund
47963c9225
Foundation for an E2E-encrypted activity list per winter-list-claude-code-prompt.md. Server (Bun + Hono): - bun:sqlite with WAL and the spec's schema (idempotent migration) - opaque server-stored sessions, httpOnly cookie - signup / challenge / login / logout / me / password / recovery-challenge / recovery-complete - activity CRUD with strict visibility rules: private uses ciphertext+nonce, semi never serializes owner_id, public attributes the owner - tag store with normalisation + autocomplete (semi/public only) Frontend (Svelte 5 + Vite): - libsodium-wrappers-sumo for client crypto (Argon2id + XChaCha20-Poly1305). SUMO is required because the standard build omits crypto_pwhash. - IndexedDB-backed private tag index (never leaves the browser) - in-memory DEK (no localStorage); page reload re-prompts for password - signup shows the recovery code once; tag input merges server + private sources with clear labelling - Bokmål UI Crypto module (shared/crypto.ts): - pure, runs in both Bun and the browser via a runtime-conditional loader that papers over libsodium-wrappers-sumo's broken ESM entry (createRequire on server, Vite alias in the browser) - DEK wrap/unwrap, AEAD payload encryption, recovery code generation with a visually-unambiguous alphabet Verification: - 22 crypto round-trip tests (wrap/unwrap, AEAD tamper rejection, password change preserves ciphertexts, recovery still works after rotation) - typecheck passes for server and frontend - Vite production build succeeds; libsodium SUMO chunk is ~315 KB gzipped Single-image Containerfile for podman: builds frontend in a builder stage, runs Bun in a slim runtime; one volume for the SQLite file; BUILD_DATE / GIT_REVISION baked into OCI labels and /etc/build-info. Known limitation deferred for this commit: the recovery endpoint has no server-side proof of the recovery code (anyone who knows an email can lock out the legitimate user, though they can't read any data). Closed in the next commit.
29 lines
885 B
JSON
29 lines
885 B
JSON
{
|
|
"name": "vinterliste",
|
|
"version": "0.1.0",
|
|
"description": "End-to-end encrypted winter activity list",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev:server": "bun run --hot server/index.ts",
|
|
"dev:frontend": "vite --config frontend/vite.config.ts",
|
|
"build:frontend": "vite build --config frontend/vite.config.ts",
|
|
"start": "NODE_ENV=production bun run server/index.ts",
|
|
"test": "bun test",
|
|
"typecheck": "tsc --noEmit && tsc --noEmit -p frontend/tsconfig.json"
|
|
},
|
|
"dependencies": {
|
|
"hono": "^4.6.0",
|
|
"libsodium-wrappers-sumo": "^0.7.15"
|
|
},
|
|
"devDependencies": {
|
|
"@sveltejs/vite-plugin-svelte": "^5.0.0",
|
|
"@tsconfig/svelte": "^5.0.4",
|
|
"@types/bun": "^1.1.0",
|
|
"@types/libsodium-wrappers-sumo": "^0.7.8",
|
|
"svelte": "^5.0.0",
|
|
"svelte-check": "^4.0.0",
|
|
"typescript": "^5.6.0",
|
|
"vite": "^6.0.0"
|
|
}
|
|
}
|