Users wanted to type things like "unbekannt" or comments for the date
fields. Start/End are now plain text inputs (max 120 chars) and are
stored/displayed verbatim - no Date parsing, no formatting. Existing
records that contain ISO strings keep working: they render exactly as
stored and refill the edit form unchanged. Also removes a duplicated
block in setup() that had slipped in earlier (double reload/flash).
Verified: node --check, no datetime-local/Date-parsing remnants,
crypto roundtrip with free-text and legacy ISO timestamps, pytest 3/3.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The shared el() helper passed every attr through setAttribute(); for
event handlers like onclick a function value gets stringified into an
attribute the DOM compiles as an expression that is evaluated but never
called - so Bearbeiten/Löschen (wired through el()) were silent no-ops,
while addEventListener-wired buttons (Neuer Datensatz, Sperren) worked.
el() now assigns on*-function attrs as properties (node[k] = v), preserving
the real handler. Verified with a DOM-semantics shim: fixed path fires,
legacy setAttribute path provably compiles but never calls.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The #editor-backdrop rule set display:flex, which has higher specificity
than the UA style for the hidden attribute - so the modal overlay was
permanently visible on load and blocked the whole UI underneath (user-
reported: "the new record field hides everything"). Adding
#editor-backdrop[hidden] { display:none } makes the attribute win again;
opening/closing the editor still uses flex centering.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
ui.js now (a) decides setup-vs-unlock from GET /api/records emptiness,
(b) runs the setup flow (double entry check, min length, TOCTOU re-check
that the DB stayed empty), (c) detects a fully failed unlock (all rows
undecryptable = wrong passphrase) and returns to a clean state, and
(d) blocks double submits while Argon2id derives the key.
Verified: node --check passes, live server serves both screens and a
crypto roundtrip proves setup passphrase unlocks on second visit while
a wrong passphrase is rejected.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
UX fix from user feedback: previously the app only showed an "Entsperren"
form, leaving first-time users without any passphrase confused. The page
now loads with two distinct pre-screens decided by an initial API call:
- empty DB -> "Willkommen" setup form: new passphrase, typed twice,
minimum 8 characters, with no-reset warning
- existing ciphertext records -> unlock form as before
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Aligns the example curl-and-start snippet with the 8085 default that
run.py, the systemd unit and the architecture docs already use.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
deploy/crushdb.service runs run.py on 127.0.0.1:8085 with auto-restart
and hardening (ProtectSystem=strict, ReadWritePaths only for the SQLite
dir, no capabilities, restricted address families). Verified with
systemd-analyze verify against locally substituted paths (exit 0); the
only remaining warning on the un-substituted unit is the expected
path-not-found for the deployment location in this dev checkout.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
User's proxy expects the upstream on port 8085; defaults are aligned
across run.py, the systemd unit and the docs.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds deploy/crushdb.service: plain HTTP on 127.0.0.1:5000 (HOST/PORT
env), auto-restart on failure, hardened with ProtectSystem/strict,
NoNewPrivileges, capability drop and restricted address families so
only the SQLite dir and private tmp are writable. Passes
systemd-analyze verify (the one reported warning is the expected
/path-in-this-repo venv path of the source checkout, not the deployed
one).
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
TLS termination belongs to the trusted reverse proxy in front
(nginx/caddy/...), not the app. run.py now binds plain HTTP to
127.0.0.1 (HOST/PORT configurable) and the dirty rollback of the
reverted self-signed-cert logic was cleaned up. README updated.
Verified: all endpoints 200 over HTTP, integrity tests 3/3 passing.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
run.py now ensures a self-signed TLS certificate exists (openssl,
SAN localhost/127.0.0.1, 365 days) and serves on https://127.0.0.1:8443.
Falls back to plain HTTP with a loud warning only when openssl is
unavailable. Verified end-to-end with curl over TLS.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds pytest suite proving server-side tamper/replay guarantees:
stale-version updates and deletes are refused (409), duplicate uuids
are rejected, and post-delete resurrection scenarios are documented.
Combined with the client-side AEAD binding of uuid+salt any server-side
manipulation surfaces as an undecryptable row in the UI. 3/3 passing.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Vanilla HTML/CSS/JS frontend served by Flask:
- Unlock screen: passphrase -> Argon2id session key, held in memory
only (never sent to the server); "Sperren" wipes key and DOM rows.
- Records table (Person A/B, start/end, action) rendered via
textContent only (no HTML injection); undecryptable rows are flagged.
- Create/edit modal encrypts payloads with XChaCha20-Poly1305 before
any network call; updates carry the server version (optimistic lock,
conflict toast on 409); delete fetches current version first.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds a vanilla ES-module crypto layer for the browser:
- Argon2id (t=2, m=16 MiB, p=1) derives a 256-bit session key from the
passphrase; the passphrase never leaves the client.
- Records are encrypted with XChaCha20-Poly1305, fresh 24-byte nonce
per record, per-record salt bound into the AEAD associated data
together with the uuid (tamper/swap detection).
- Vendored audited @noble/hashes + @noble/ciphers ES modules; verified
end-to-end in node (encrypt/decrypt roundtrip, wrong key, tampered
salt, swapped uuid all rejected).
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Exposes a ciphertext-only REST API: list/get/create/update/delete of
records as opaque base64 blobs. Enforces base64/size validation,
rejects duplicates, and uses patch-version checks server-side so
replayed or stale updates are refused. Includes run.py entry point
that enables TLS when certs/ are present. Verified via test client.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds the base project setup (requirements, README, gitignore entries)
and a SQLite storage layer that persists only encrypted records:
uuid, ciphertext, nonce, salt, plus a monotonic version counter used
later for tamper/replay detection. Includes a smoke test run.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
jhkaktus
