mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
7d2209d706
Authored by ChatGPT/Codex in a separate review pass. Reviewed and verified here before committing rather than taken on trust; findings below. The substantive change is that the vault sudo key now lives ONLY in the phrase-gated recovery capsule. A newly written password credential capsule carries just connection_vault_root, so an ordinary login restores connectable-tier records without putting personal-tier material behind a password capsule that is downloadable and therefore offline-guessable forever. Pre-hardening capsules stay readable, password login does not return their sudo key, and the next rotation scrubs it. That closes the gate this project had explicitly set on personal-tier UI. Legacy vault-enable migration now derives roots deterministically from phrase-protected material and account_id, so two concurrent attempts cannot mint divergent roots -- the failure mode the docs previously mitigated with "enable the vault once, from one device". Manual (user-chosen) passwords are REMOVED, not merely discouraged, and a new securityPolicy.test.ts pins that along with several things tests do not usually reach: the deployment CSP (default-src 'none', frame-ancestors 'none') plus six baseline headers, demo pages free of inline scripts and remote fonts, and README documenting same-origin self-hosting only rather than a remote demo embed. llms.txt was updated to match, which I checked because that test only reads README. What I verified, since a passing suite proves less than it appears to: - All 12 fixes from the 2026-07-30 audit survived the rewrite of recover.ts, changePassword.ts, validation.ts, relay.ts, session.ts and element.ts. Checked semantically where grep cannot help: changePassword still checks publish success BEFORE building the tombstone, and vaultSetBinding still unbinds on origin === null rather than silently rebinding to the worker global. - No dependency changes; the package.json diff is scripts only. - Argon2id and KDF parameters unchanged. The NIP-44 diff ADDS a base64 length cap before decoding, a memory-DoS guard. - Validation increased rather than decreased: 44 throws added, 33 removed. - No disabled or skipped tests, no secrets in the diff. typecheck clean, 165/165 tests, build green, and the account manager exercised in a browser: creation correctly refused when relay quorum could not be met, and on retry failed at the recovery capsule with "No login credential was published" -- the §18.1 fail-closed ordering doing its job against a flaky public relay set. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1
28 lines
949 B
JSON
28 lines
949 B
JSON
{
|
|
"name": "bitlogin-monorepo",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "MIT",
|
|
"description": "BitLogin — static, relay-backed portable Nostr account protocol and embeddable login widget",
|
|
"workspaces": [
|
|
"packages/core",
|
|
"packages/widget",
|
|
"packages/demo"
|
|
],
|
|
"scripts": {
|
|
"build": "npm run build -w @bitlogin/core && npm run build -w @bitlogin/widget",
|
|
"build:demo": "npm run build && npm run build -w @bitlogin/demo",
|
|
"dev:demo": "npm run dev -w @bitlogin/demo",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "npm run typecheck -w @bitlogin/core && npm run typecheck -w @bitlogin/widget",
|
|
"security:audit": "npm audit --audit-level=high && npm audit signatures",
|
|
"security:ci": "npm run build:demo && npm run typecheck && npm test && npm run security:audit"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.1.0",
|
|
"vitest": "^3.0.5"
|
|
}
|
|
}
|