kleidos/web_src/ at main · jmrp.io/kleidos

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

Fork 0

kleidos / web_src /

at main 1 file

José M. Requena Plens Add admin-portal change PIN / passphrase (rekey) endpoint 6d ago

2316c6db

index.html

Add admin-portal change PIN / passphrase (rekey) endpoint Expose vault re-keying over the WiFi admin portal (Tier-2 Phase 3): POST /api/rekey re-derives the master key from a new PIN or passphrase and re-encrypts the whole vault via VaultStore::rekey. Security bar beyond the admin session: - Verifies the CURRENT unlock secret with VaultStore::unlockVault before re-keying, so a hijacked session cannot silently change the secret. - Feeds the shared BruteForceGuard exactly like an on-device unlock: a lockout window rejects with 429 before any KDF; a wrong current secret is counted (escalating lockout, vault wipe at the threshold) and returns a generic 403. - Never returns or logs any secret; every transient (current, new, derived key) is zeroized. - Relies on rekey's atomic STAGE/COMMIT/SWEEP: a mid-rekey failure leaves the vault fully under the OLD secret. On success the live session master key is re-derived in place so the admin session stays unlocked. Adds a "Change unlock secret" card to the admin web UI and regenerates the gzipped HTML header. Native coverage: new web/test_admin_api_rekey suite (validation, wrong-current + counter, lockout gate, full round-trip); backup suite gains link-only BruteForceGuard stubs since it amalgamates admin_api_handlers.cpp. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

Configure Feed

Configure Feed