Skip to content

CHANGELOG.md

Latest commit

 

History

History
471 lines (357 loc) · 26.9 KB

CHANGELOG.md

File metadata and controls

471 lines (357 loc) · 26.9 KB

📝 Changelog

All notable changes to Keyper will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.1.1] - 2026-03-12 - 🔍 Credential Detail UX · 🗄️ SQLite Local Database Support

🖥️ Desktop Distribution

  • Added published Windows installer download for the current release (KeyperSetup.v1.1.1.exe)
  • Updated documentation and docs site download tables to include the Windows installer alongside the published Linux desktop packages

🗄️ SQLite Local Database Support

  • Added full SQLite provider as an alternative to Supabase for completely local, zero-network credential storage
    • Works in both browser/PWA and Electron desktop modes
    • Browser/PWA stores the database locally in IndexedDB (with localStorage fallback)
    • Electron desktop can additionally target a custom file path on disk
    • No account, server, or internet connection required — ideal for fully offline and air-gapped use
  • Added src/integrations/database/sqlite-client.ts — browser-native SQL.js-backed SQLite engine
    • SqliteQueryBuilder — Supabase-compatible query builder so all existing supabase.from(...) callsites transparently route to SQLite with zero refactoring
    • In-memory database with IndexedDB persistence per named database key
    • Full CRUD support: select, insert, update, upsert, delete with chained .eq(), .order(), .limit(), .single()
    • Automatic schema creation (ensureSqliteSchema) on first open: credentials, vault_config, and categories tables with all indexes
    • Default categories seeded automatically on first-run: Development, Personal, Work, Social Media, Finance, Cloud Services, Security
  • Added multi-provider routing in src/integrations/supabase/client.ts:
    • getDatabaseProvider() / saveDatabaseProvider() — persists provider choice in localStorage
    • supabase export now transparently delegates to the active provider (Supabase or SQLite)
    • initializeSqliteProvider() and testSqliteProviderConnection() helpers
  • Added SQLite configuration UI in Settings.tsx:
    • Database Provider selector (Supabase / SQLite)
    • Optional SQLite path/name field (empty = default browser-local database)
    • Provider-aware connection test and status messages
    • Provider-aware setup instructions (SQLite auto-creates schema; Supabase requires SQL Editor run)
  • Updated DashboardSettings.tsx passphrase reset instructions to show provider-specific steps:
    • SQLite users: guided to DB Browser for SQLite to edit vault_config.bcrypt_hash directly
    • Supabase users: existing Supabase Dashboard-based reset flow unchanged
  • Updated reset-local-config message to be provider-agnostic ("database connection settings")

👥 Multi-User Registration & User Management

  • Added self-service multi-user registration flow with no admin involvement:
    • src/components/UserRegistration.tsx provides username + passphrase registration with live username availability checks and passphrase confirmation
    • Username validation now enforces 3-50 characters with letters, numbers, hyphens, and underscores
    • Registration creates an isolated vault per user and seeds default categories for that user context
  • Added registration entrypoint in PassphraseGate.tsx:
    • New Create New User action on the lock screen
    • Successful registration immediately initializes/unlocks the new user vault
  • Added user management UI in dashboard settings:
    • New User Management area with registered-user listing (vault_config.user_id)
    • Current user indicator and one-click user switching workflow
    • Add New User action from user management that routes directly into registration flow
  • Added VaultManager.registerNewUser(username, passphrase) for secure self-service onboarding:
    • Duplicate username protection
    • Per-user vault creation (raw_dek + bcrypt_hash) in existing zero-knowledge model
    • Per-user default category initialization
  • Updated app security messaging to explicitly document:
    • No admin backdoors
    • Passphrase remains user-controlled
    • Switching user context does not bypass passphrase verification

🧪 Multi-User Validation

  • Added SQLite-focused multi-user tests in src/services/multi-user-sqlite.test.ts covering:
    • Creating multiple users in the same instance
    • Per-user vault isolation and access boundaries
    • Switching between user contexts with independent passphrase checks

🐛 SQLite Bug Fixes

  • Fixed critical bug where SqliteQueryBuilder.select() was overwriting the in-flight mutation action (insert, update, upsert, delete) with select, causing vault creation to silently fail
    • Root cause: chained .upsert({...}).select().single() — standard Supabase pattern for "write and return row" — was being treated as a plain SELECT; the query returned PGRST116 → "Failed to save vault configuration: Unknown error"
    • Fix: select() no longer changes the action when a mutation has already been set, correctly matching Supabase client semantics
    • All other mutation chains (e.g., .insert().select() in EncryptedCredentialsApi) are also fixed by this change
  • Fixed empty categories dropdown when creating a new vault via SQLite
    • Root cause: ensureSqliteSchema created the categories table but never seeded default rows — so the first-time vault creation had no categories to display
    • Fix: default categories are now seeded on first database initialisation when the table is empty

✨ Improved Credential Detail Experience

  • Added secure secret reveal in CredentialDetailModal by decrypting secret_blob when the vault is unlocked
    • Users can now inspect encrypted values directly from the detail view without entering edit mode
  • Improved copy workflow in detail view for sensitive fields (password, API key, secret value, token, certificate)
    • Existing eye/copy controls now work with encrypted-only records
  • Added vault-state guidance in detail view
    • Clear helper message when the vault is locked and encrypted values cannot be shown yet

🎨 Layout & Readability Fixes

  • Improved detail modal width for better credential visibility on desktop
  • Fixed horizontal overflow/cutoff in sensitive field rows
  • Added robust wrapping for long revealed values (keys/secrets/certificates) so they stay within the modal instead of clipping

🆕 New Credential Types & Data Capture

  • Added document credential type
    • Upload support in add/edit flows for common formats: .pdf, .doc, .docx, .odt, .txt, .md
    • Uploaded files are stored in encrypted secret_blob payload as base64 + metadata (document_name, document_mime_type, document_size_bytes)
  • Added misc credential type
    • Dedicated large multiline secure field for scripts/commands and other non-standard sensitive text
  • Added certificate upload parity in edit flow (file upload + paste experience now aligned with add flow)

🔐 Security & Type Isolation Fixes

  • Fixed type-specific secret leakage issue where unrelated secret keys could appear in other credential types
    • Add/edit encryption paths now strictly encrypt only fields relevant to the selected credential_type
    • Detail view now renders sensitive blocks conditionally by credential_type to prevent incorrect fields (for example API Key showing on document records)
  • Fixed document-save encryption reliability for new uploads by using type-scoped payload construction in add/edit submit flows

📄 Document Detail UX

  • Added secure download action in credential detail view for document credentials
  • Added inline preview toggle (eye button) for text-like documents (text/*, .txt, .md)
    • Binary formats (for example PDF/DOCX/ODT) intentionally remain download-only in current release

🗄️ Database & Migration Updates

  • Updated setup schema to allow new credential types in credentials_credential_type_check:
    • document, misc
  • Added migration script for existing installations:
    • migration-add-document-misc-types.sql
    • Safely updates the credential_type CHECK constraint without recreating tables/data
  • Updated in-app SQL surfaces:
    • Setup screen now includes both full setup script and update script (copy + preview)
    • Dashboard settings now includes a dedicated Database SQL tab with both scripts and upgrade warnings

[1.1.0] - 2026-03-01 - 🐳 Docker Build & ⚡ Electron Desktop App

🐳 Docker Support

  • Added Dockerfile – optimised multi-stage build (Node 22 Alpine builder → nginx 1.27 Alpine server)
    • Stage 1 compiles the Vite/React app; Stage 2 serves only the static output → lean final image
    • WASM MIME type (application/wasm) patched so argon2-browser works inside the container
    • Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp headers added to satisfy SharedArrayBuffer requirements
  • Added nginx.conf – production-hardened nginx server block
    • SPA fallback routing (try_files ... /index.html) for React Router
    • Gzip compression for JS/CSS/WASM/SVG/fonts
    • Long-lived cache headers (Cache-Control: public, immutable) for hashed assets
    • Security headers: X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
    • /healthz endpoint for container health checks
  • Added docker-compose.yml – single-command stack launch with configurable HOST_PORT (default 8080)
    • Built-in healthcheck using the nginx /healthz endpoint
    • Optional Caddy reverse-proxy snippet (commented out) for automatic HTTPS
  • Added .dockerignore – excludes node_modules/, dist/, electron/, VCS files, secrets, and tooling to keep the build context lean

⚡ Electron Desktop App

  • Added electron/main.ts – Electron main process
    • Custom app:// protocol serves the compiled dist/ bundle with full SPA routing support
    • WASM Content-Type patched for argon2-browser inside the Electron sandbox
    • Cross-Origin-Opener-Policy / Cross-Origin-Embedder-Policy injected via session.webRequest headers
    • External link interception: all https:// links open in the system browser via shell.openExternal
    • Security hardening: contextIsolation: true, nodeIntegration: false
    • macOS traffic-light title bar; auto-hiding menu bar on Windows/Linux
  • Added electron/preload.ts – minimal context-bridge exposing window.keyperElectron to the renderer
    • isElectron: true flag for UI feature detection
    • platform and version fields
  • Added electron/tsconfig.json – TypeScript config targeting CommonJS (required for Electron main process)
  • Added electron scripts to package.json:
    • electron:compile – compiles electron/*.ts → electron-dist/*.js
    • electron:preview – build + compile + launch locally
    • electron:dev – same but opens DevTools
    • electron:build – full cross-platform distributables via electron-builder
    • electron:build:linux / electron:build:win / electron:build:mac – platform-specific builds
  • Added electron-builder.yml – electron-builder configuration
    • Linux: AppImage (x64/arm64), deb (x64/arm64)
    • macOS: DMG + zip (Universal / Intel + Apple Silicon)
  • Added electron ^33.3.0 and electron-builder ^25.1.8 to devDependencies

🌐 Website & Downloads

  • Added direct download links for Linux desktop installers (AppImage, deb x86_64, deb ARM64) hosted on Cloudflare R2 via the Keyper docs site

🔧 Housekeeping

  • Updated .gitignore – added dist-electron/ and electron-dist/ output directories

[1.0.9] - 2026-03-01 - 🐛 Bug Fixes: Multi-Session Credential Saving & Edit Modal

🐛 Bug Fixes

  • Fixed Critical error "can't access property 'trim', t.token_value is undefined" when adding a second credential in the same session

    • Root Cause: resetForm() in AddCredentialModal was missing token_value and certificate_data fields, leaving them as undefined after the first save
    • Fix: Added the two missing fields back to resetForm() so all state is properly cleared between submissions

  • Fixed Critical error "could not find the 'api_key' column of 'credentials' in the schema cache" when editing a credential

    • Root Cause: EditCredentialModal.handleSubmit() was spreading the entire formData object directly into the Supabase .update() call, including legacy column names (api_key, password, secret_value, etc.) that do not exist in the current schema — all sensitive data lives in secret_blob
    • Fix: Rewrote the submit handler to build an explicit update object with only valid DB columns, and properly encrypt sensitive data into secret_blob using the vault

  • Improved EditCredentialModal now correctly decrypts existing secret_blob data when the edit form opens, so current secret values are pre-populated and editable

  • Improved EditCredentialModal now properly handles all five credential types with their correct sensitive field names: password (login), api_key (api_key), secret_value (secret), token_value (token), certificate_data (certificate) — previously token was incorrectly sharing the secret_value field and certificate type had no dedicated input

✨ New Features

  • Added "No expiration" checkbox next to the Expires At date field in AddCredentialModal
    • Checking it clears any selected date and disables the date picker (visually greyed out)
    • Unchecking re-enables the date picker for normal use
    • Resets automatically when the form is cleared after a save

🏷️ UX / Labels

  • Updated Supabase API key field label from "Supabase Anon Key" to "Supabase Anon or Publishable Key" to reflect Supabase's updated naming convention (both key types remain fully supported)
    • Updated in: Settings configuration screen, SQL setup script comment, and database setup wizard description

[1.0.8] - 2025-08-28 - 🎨 CLI Enhancement: Beautiful ASCII Banner & Deprecation Fix

🎨 CLI Visual Improvements

  • Added Stunning gradient KEYPER ASCII art banner for professional startup experience
    • Beautiful Typography: Large block-letter KEYPER logo in gradient cyan/blue colors
    • Brand Colors: Matching cyan/blue gradient that complements the app's glassmorphism UI theme
    • Clean Layout: Removed cluttered box borders for modern, minimal aesthetic
    • Professional Branding: Enhanced Pink Pixel branding with "Dream it, Pixel it" tagline

🔧 Security & Compatibility Fixes

  • Fixed Node.js deprecation warning (DEP0190) for enhanced security
    • Eliminated Insecure shell: true + arguments array combination
    • Implemented Cross-platform spawn solution for Windows/Unix systems
    • Enhanced Security by preventing argument injection vulnerabilities
    • Improved Command execution reliability across all platforms

🚀 Technical Enhancements

  • Added Platform detection for optimal command execution strategy:
    • Windows: Uses properly escaped command string with shell: true
    • Unix/Linux/Mac: Uses secure argument array with shell: false
  • Enhanced Error handling and process management
  • Maintained Full backward compatibility with existing CLI functionality
  • Improved Developer experience with clean, warning-free startup

🌈 User Experience

  • Enhanced Visual brand consistency between CLI and web application
  • Removed Annoying deprecation warnings during server startup
  • Improved Professional appearance for enterprise deployments
  • Maintained All existing CLI functionality and features

🛡️ Security Benefits

  • Eliminated Potential command injection attack vectors
  • Enhanced Cross-platform security posture
  • Improved Node.js compliance with latest security recommendations
  • Maintained Zero-trust architecture principles

[1.0.6] - 2025-08-28 - 🔧 Critical Fix: Local Supabase Instance Support

🚨 Major: Local Database Connection Support

  • Fixed Critical issue preventing local Supabase instances from connecting
    • Removed Overly restrictive URL validation in createTestSupabaseClient
    • Enhanced Connection logic to accept any valid HTTP/HTTPS URL
    • Added Comprehensive support for localhost, IP addresses, and custom domains
    • Improved Error messages and debugging information for connection issues

🌐 Universal Database Compatibility

  • Added Support for all local and self-hosted Supabase deployments:
    • ✅ Localhost: http://localhost:54321, https://localhost:8443
    • ✅ IP Addresses: http://192.168.1.100:8000, http://127.0.0.1:54321
    • ✅ Private Networks: http://10.0.0.5:54321, http://172.17.0.1:8000
    • ✅ Docker Networks: Complete support for all Docker IP ranges (172.16-31.*)
    • ✅ Custom Domains: https://supabase.mydomain.com, https://db.company.local
    • ✅ Supabase Cloud: Existing *.supabase.co instances continue to work seamlessly

🛡️ Smart Content Security Policy

  • Enhanced CSP configuration with intelligent environment detection:
    • Development: Fully permissive for maximum flexibility during development
    • Self-hosted: Balanced security with custom domain support for production
    • Cloud: Optimized security for Supabase Cloud deployments
  • Added Dynamic CSP selection based on configured database credentials
  • Improved Network support for all private IP ranges and custom domains

🔧 Architecture Improvements

  • Added hasCustomSupabaseCredentials() helper function for clean configuration detection
  • Enhanced Connection validation with informational logging instead of blocking
  • Improved Error handling and debugging information throughout connection flow
  • Refactored Hardcoded configuration checks to use proper helper functions

🏗️ Technical Enhancements

  • Modified src/integrations/supabase/client.ts:
    • Removed restrictive hostname validation that blocked valid URLs
    • Added comprehensive IP range support for private networks
    • Enhanced logging for better debugging experience
  • Updated src/components/SelfHostedDashboard.tsx:
    • Replaced hardcoded string comparisons with helper functions
    • Improved configuration state detection
  • Enhanced src/security/ContentSecurityPolicy.ts:
    • Added three-tier CSP system (Development, Self-hosted, Production)
    • Comprehensive network range support for all deployment scenarios
    • Dynamic policy selection based on configuration

✅ Connection Support Matrix

Instance Type Before v1.0.6 After v1.0.6
Supabase Cloud (*.supabase.co) ✅ Working ✅ Working
Localhost (http://localhost:*) ❌ Blocked ✅ FIXED
Local IP (http://192.168.1.100:*) ❌ Blocked ✅ FIXED
Custom Domain (https://db.company.com) ❌ Blocked ✅ FIXED
Docker Network (http://172.17.*:*) ❌ Blocked ✅ FIXED

🛡️ Security & Compatibility

  • ✅ Backward Compatible: All existing Supabase Cloud setups continue working unchanged
  • ✅ Security Maintained: Enhanced CSP policies maintain strong security posture
  • ✅ No Breaking Changes: Seamless upgrade path with zero configuration changes required
  • ✅ Enhanced Debugging: Better error messages and connection diagnostics

📚 Documentation

  • Added SUPABASE_FIXES.md - Comprehensive documentation of all fixes applied
  • Updated Connection troubleshooting guides with new supported formats
  • Enhanced Self-hosting instructions with local instance setup examples

🎯 User Impact

  • Resolved Connection failures for local Supabase instances
  • Eliminated "URL does not appear to be a Supabase instance" errors
  • Enabled Full self-hosting flexibility with any domain or IP configuration
  • Improved Developer experience with better error messages and debugging

[1.0.4] - 2025-08-23 - 🔐 Major Security Overhaul: Simplified bcrypt-Only Passphrase System

🚨 Revolutionary Passphrase Reset System

  • Added Simplified bcrypt-only master passphrase authentication
    • Eliminated complex Argon2/AES key derivation for passphrase validation
    • Implemented direct bcrypt hash verification for instant authentication
    • Removed all backdoors, admin overrides, and security vulnerabilities
    • Created user-controlled passphrase reset via direct database access
    • Enhanced Security through elimination of attack vectors

🔓 User-Controlled Emergency Reset

  • Added docs/EMERGENCY_PASSPHRASE_RESET.md - Comprehensive reset guide
    • Instructions for bcrypt hash generation using online tools
    • Step-by-step database update procedure via Supabase dashboard
    • Security explanations why this approach is safe and user-controlled
    • Troubleshooting section for common reset issues

🏗️ Architecture Transformation

  • Simplified Vault encryption system:
    • New Users: raw_dek (base64) + bcrypt_hash storage
    • Legacy Users: Continue using existing wrapped_dek system (backwards compatible)
    • Dual Support: Automatic detection and handling of both vault formats
    • Migration Path: Optional upgrade path for existing users

🛡️ Enhanced Security Model

  • Removed Emergency access systems and backdoors:
    • Deleted src/security/HatchGate.ts - Eliminated backdoor access
    • Removed src/components/ResetKeyper.tsx - No admin reset capability
    • Cleaned All references to emergency admin access
    • Updated Documentation to reflect new security-first approach

🔧 Technical Improvements

  • Created src/crypto/bcrypt.ts - Secure bcrypt utility functions
  • Enhanced src/services/VaultStorage.ts - Dual format support
  • Updated src/services/VaultManager.ts - Smart vault type detection
  • Simplified src/services/SecureVault.ts - Maintains legacy compatibility
  • Improved Type definitions with legacy/new vault config types

🗄️ Database Schema Evolution

  • Updated supabase-setup.sql and src/components/Settings.tsx:
    • Added raw_dek TEXT column (nullable for backwards compatibility)
    • Enhanced bcrypt_hash TEXT column for new passphrase system
    • Maintained wrapped_dek JSONB for existing users
    • Secured All PostgreSQL functions with proper SECURITY DEFINER settings

📋 Migration Support

  • Created migration-bcrypt.sql - Database migration script
    • Adds new columns to existing vault_config table
    • Provides detailed migration instructions for existing users
    • Maintains full backwards compatibility
    • Guides users through optional upgrade process

✨ User Experience

  • New Users: Automatic bcrypt-only system with instant reset capability
  • Existing Users: No changes required, everything continues working
  • Reset Process: Simple 4-step process using any bcrypt generator website
  • No Downtime: Seamless deployment with zero breaking changes

🎯 Security Benefits

  • Eliminated All potential backdoors and admin overrides
  • Simplified Attack surface by removing complex key derivation chains
  • Enhanced User control - only database owner can reset passphrases
  • Maintained Strong AES-256-GCM encryption for actual credential data
  • Preserved Zero-knowledge architecture principles

📚 Documentation Updates

  • Removed All emergency access and backdoor documentation
  • Added User-controlled passphrase reset instructions
  • Updated Security model documentation throughout project
  • Enhanced Setup instructions with new migration procedures

[1.0.3] - 2025-08-23 - 🔒 Security Enhancement: PostgreSQL Function Hardening

🔒 Security Improvements

  • Fixed PostgreSQL function search_path security warnings (function_search_path_mutable)
    • update_updated_at_column: Added SET search_path = '' security parameter
    • get_credential_stats: Added SET search_path = '' + fully qualified schema references
    • check_rls_status: Added SET search_path = '' + fully qualified schema references
    • Protection: Prevents search path injection attacks and ensures consistent behavior
    • Compliance: Meets PostgreSQL security best practices and OWASP guidelines

🛡️ Enhanced Database Security

  • Added rls-security-fixes.sql - Standalone security patch for existing databases
  • Updated supabase-setup.sql - Main setup script now includes secure function definitions
  • Improved All functions now use SECURITY DEFINER with empty search_path
  • Qualified All database object references use explicit schema.table notation
  • Documented Comprehensive security implementation details in updated files

🔧 Technical Details

  • Search Path Security: All PostgreSQL functions now set search_path = '' to prevent path manipulation
  • Schema Qualification: Database objects referenced with explicit public.tablename format
  • Consistent Context: Functions execute with predictable, secure environment
  • Best Practices: Aligned with PostgreSQL security recommendations and industry standards

📚 Documentation Updates

  • Updated RLS_FIXES_NEEDED.md - Now shows resolved status with implementation details
  • Added Security fix implementation guide with verification queries
  • Enhanced Database setup instructions with security considerations

[1.0.1] - 2025-08-16 - 🚨 Emergency Troubleshooting System

🚨 Major: Panic Hatch System

  • Added Emergency diagnostic and reset system for stuck configurations
    • HatchGate.ts: Session-based temporary access control with short-lived session TTL
    • ResetKeyper.tsx: Comprehensive diagnostic page for troubleshooting
    • Hidden Route: Secure diagnostic route only accessible when armed
    • Health Checks: Database table verification and connection testing
    • Config Reset: Selective clearing of Keyper configuration keys
    • Origin Reset: Complete site data clearing for extreme cases

🛡️ Enhanced Security

  • Added Obscurity-based emergency access without compromising authentication
  • Added Session storage with automatic expiration for temporary access
  • Added Optional admin marker requirement for additional protection
  • Added Professional ops procedures with encryption recommendations
  • Security Note: Emergency system uses security-by-obscurity, not authentication bypass