Start security item 6: API lock access control and unlock route

docs/auth_lock_unlock_access_review.md

@@ -0,0 +1,52 @@
+# SeedPass Auth, Lock/Unlock & Access-Control Review (Item 6)
+
+Status: `In Progress`  
+Date: `2026-02-25`
+
+## Scope Reviewed
+
+1. `src/seedpass/core/manager.py`
+2. `src/seedpass/api.py`
+3. `src/seedpass/core/api.py`
+4. `src/seedpass/core/config_manager.py`
+
+## Exit Criteria Check (Item 6)
+
+1. Lock/unlock/timeout/quick unlock behavior reviewed with tests: `In Progress`
+
+## Findings
+
+### Completed in this pass
+
+1. Added explicit locked-state gate for protected HTTP API routes.
+   - Sensitive endpoints now reject access with `423 Vault is locked` when lock flags are set.
+2. Added explicit HTTP unlock endpoint.
+   - New route: `POST /api/v1/vault/unlock` using `X-SeedPass-Password`.
+3. Added API regression tests for lock enforcement and unlock flow.
+   - Entry/password endpoints blocked while locked.
+   - Unlock endpoint clears locked state path.
+
+### Validation
+
+1. `pytest -q src/tests/test_api_new_endpoints.py src/tests/test_api.py src/tests/test_vault_lock_flag.py src/tests/test_inactivity_lock.py src/tests/test_unlock_sync.py`
+2. Result: `62 passed`
+
+### Existing posture
+
+1. Core manager has `lock_vault()` / `unlock_vault()` and publishes lock events.
+2. Inactivity timeout enforcement exists via `AuthGuard`.
+3. Quick unlock behavior is configurable and covered by existing tests.
+
+### Remaining follow-up
+
+1. Decide whether non-sensitive API routes (config/fingerprint/relays) should also require unlocked state.
+2. Add API-level test coverage for timeout-triggered lock then unlock flow.
+3. Evaluate rate-limit tuning and brute-force controls for repeated password attempts on unlock endpoints.
+
+## Evidence
+
+1. `src/tests/test_api_new_endpoints.py`
+2. `src/tests/test_vault_lock_flag.py`
+3. `src/tests/test_inactivity_lock.py`
+4. `src/seedpass/api.py`
+5. `src/seedpass/core/manager.py`

docs/security_readiness_checklist.md

@@ -9,7 +9,7 @@ Status legend: `Not Started`, `In Progress`, `Blocked`, `Done`
 | 3 | Secret handling and local data exposure hardening | Done | Core | `docs/secret_handling_local_exposure_review.md`, `src/tests/test_memory_protection.py`, `src/tests/test_clipboard_utils.py`, `src/tests/test_fingerprint_encryption.py`, `src/tests/test_api_new_endpoints.py`, `src/tests/test_bip85_derivation_path.py` |
 | 4 | Backup and restore integrity validation | In Progress | Core / QA | `src/tests/test_account_roundtrip_restore.py`, `src/tests/test_portable_backup.py` |
 | 5 | Nostr sync security and resilience validation | In Progress | Core / QA | `src/tests/test_nostr_real.py`, `src/tests/test_nostr_index_size.py` |
-| 6 | Auth, lock/unlock, and access-control hardening | Not Started | Core | |
+| 6 | Auth, lock/unlock, and access-control hardening | In Progress | Core | `docs/auth_lock_unlock_access_review.md`, `src/tests/test_api_new_endpoints.py`, `src/tests/test_vault_lock_flag.py`, `src/tests/test_inactivity_lock.py` |
 | 7 | Testing gates and quality thresholds | In Progress | QA | `scripts/check_critical_coverage.py`, CI workflows |
 | 8 | Supply chain and release integrity | Not Started | DevOps | |
 | 9 | Operational readiness and incident runbooks | Not Started | Security / Ops | |