mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 16:41:25 +00:00
thePR0M3TH3ANandClaude Sonnet 5
9e3787d301
Every reload previously destroyed the crypto worker, forcing the full login-name + password flow again -- re-running Argon2id and a relay quorum read, both deliberately expensive (the whole point of Argon2id is to resist offline brute force), on every single page navigation. No real site can expect users to accept that. After a successful register/login/completeRecovery/changePassword, cache the everyday private key plus the active credential/recovery capsule events in IndexedDB (persistSession() in cryptoWorker.ts). connectedCallback() now calls a new "restoreSession" worker action right after "configure", before rendering the welcome screen; if a valid cache exists, the widget lands straight on the dashboard and fires "bitlogin-login" exactly as a fresh login would, with no password prompt. Logout clears the cache. This trades "nothing persists locally" for "the everyday private key sits decrypted in this browser's IndexedDB until logout" -- the same tradeoff every NIP-07 extension and crypto wallet already makes for the same reason, and scoped by IndexedDB's own per-origin isolation (one site's cached session is never visible to another, same boundary window.nostr already relies on). The recovery phrase and login name/password are never cached. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01DY9UMTuF43Ekc2U4E1eDwX