randogoth/gsmol
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: recall-on-restore, logout, and mail/contact export-import

Browse source
This commit is contained in:
randogoth 2026-09-26 21:08:32 +03:00
parent a3378def50
commit 3576e48b99
4 changed files with 216 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

15
web/index.html
View file

@ -41,6 +41,8 @@
<button id="create-identity">create a new identity</button>
<span>or restore from a saved seed:</span>
<input id="restore-seed" placeholder="64 hex characters" spellcheck="false">
<input id="restore-address" placeholder="alice@example.org (if already registered)"
spellcheck="false">
<button id="restore-identity">restore</button>
</div>
</main>
@ -128,6 +130,19 @@
<div id="identity-card"></div>
</section>
<section>
<h3>backup</h3>
<p class="hint">Mail, once fetched, exists only here — the server deletes it as it's picked up
(SPEC.md §5). This backs up the local inbox, sent mail, contacts and pinned servers into one
file. It never includes the seed: that has its own reveal-and-copy flow above, meant for a
password manager, not a downloadable file.</p>
<div class="backup-row">
<button type="button" id="export-data">export</button>
<button type="button" id="import-data-trigger">import</button>
<input id="import-data" type="file" accept="application/json" hidden>
</div>
</section>
<footer><button id="settings-close">close</button></footer>
</dialog>

108
web/js/app.js
View file

@ -157,7 +157,7 @@ $("create-identity").onclick = () => {
openSettings();
};
$("restore-identity").onclick = () => {
$("restore-identity").onclick = async () => {
const text = $("restore-seed").value.trim();
if (!/^[0-9a-fA-F]{64}$/.test(text)) return status("a seed is 64 hex characters", true);
const seedBytes = Uint8Array.from(text.match(/../g), b => parseInt(b, 16));
@ -167,7 +167,23 @@ $("restore-identity").onclick = () => {
return status(err.message, true);
}
showApp();
status("identity restored.");
// The address field is optional: restoring must succeed on its own even if
// this fails (server not pinned yet, offline, typo) — recall can always be
// retried from settings afterward.
const addressText = $("restore-address").value.trim();
let message = "identity restored.", warn = false;
if (addressText) {
try {
const addr = await recallAccount(addressText);
message += `\nrecalled ${addr.short}`;
renderAccount();
renderSettings();
} catch (err) {
message += `\ncouldn't recall that address: ${err.message}`;
warn = true;
}
}
status(message, warn);
};
// --- header ---------------------------------------------------------------------
@ -824,7 +840,15 @@ function renderSettings() {
"Rotating issues a fresh key with a signed certificate proving it replaces this one. " +
"Contacts accept the change from that chain, and the old seed is kept, since mail sealed " +
"to it is readable with nothing else. Rotation is not revocation (SPEC.md \u00a77)." }),
el("button", { type: "button", textContent: "rotate identity", onclick: rotateIdentity })),
el("button", { type: "button", textContent: "rotate identity", onclick: rotateIdentity }),
el("p", { className: "hint", textContent:
"Log out to remove this identity from this browser entirely: the seed, pins, contacts and " +
"every cached message. Without a backup of the seed there is no way back in — same as any " +
"other loss of it. Fetching deletes from the server once acknowledged (SPEC.md §5), so a " +
"message already fetched here has no other copy anywhere; anything still unfetched stays " +
"on the server and comes back on the next fetch after logging back in." }),
el("button", { type: "button", className: "danger", textContent: "log out & erase this browser",
onclick: logout })),
].filter(node => node != null));
}
@ -887,24 +911,31 @@ $("register-form").onsubmit = async (event) => {
// *different* browser registered it under — "account" is local-only state,
// never asked of the server. This binds it without REGISTER: RESOLVE the
// address and require it name this exact key, so a typo or someone else's
// address can't silently misfile outgoing Reply-To / fetch under it.
// address can't silently misfile outgoing Reply-To / fetch under it. Shared
// by the settings recall form and the optional address field on restore.
async function recallAccount(text) {
const me = store.identity();
if (!me) throw new SmolError("no identity yet");
const addr = parseAddress(text.trim());
const opened = await connect(addr, { requirePin: true });
let current;
try {
({ identity: current } = await resolveOp(opened.session, addr.user));
} finally {
opened.session.stream.close();
}
if (!timingSafeEqual(current, me.publicKey))
throw new SmolError(`${addr.short} resolves to a different key — not this identity`);
store.setAccount(addr);
return addr;
}
$("recall-form").onsubmit = async (event) => {
event.preventDefault();
const form = event.target;
try {
const me = store.identity();
if (!me) throw new SmolError("no identity yet");
const addr = parseAddress(form.address.value.trim());
const opened = await connect(addr, { requirePin: true });
let current;
try {
({ identity: current } = await resolveOp(opened.session, addr.user));
} finally {
opened.session.stream.close();
}
if (!timingSafeEqual(current, me.publicKey))
throw new SmolError(`${addr.short} resolves to a different key — not this identity`);
store.setAccount(addr);
const addr = await recallAccount(form.address.value);
status(`recalled ${addr.short}\nshare: ${addr.uri(me.publicKey)}`);
renderAccount();
renderSettings();
@ -914,6 +945,40 @@ $("recall-form").onsubmit = async (event) => {
}
};
$("export-data").onclick = async () => {
const data = await store.exportData();
const blob = new Blob([JSON.stringify(data)], { type: "application/json" });
const url = URL.createObjectURL(blob);
const stamp = new Date(data.exportedAt).toISOString().slice(0, 10);
Object.assign(document.createElement("a"), { href: url, download: `gsmol-export-${stamp}.json` }).click();
URL.revokeObjectURL(url);
status(`exported ${data.inbox.length + data.sent.length} messages, ` +
`${Object.keys(data.contacts).length} contacts, ${Object.keys(data.servers).length} server keys`);
};
$("import-data-trigger").onclick = () => $("import-data").click();
$("import-data").onchange = async (event) => {
const file = event.target.files[0];
event.target.value = ""; // same file re-selected twice must still fire change
if (!file) return;
try {
const data = JSON.parse(await file.text());
const s = await store.importData(data);
const conflicts = s.pinsConflicted + s.contactsConflicted;
status([
`imported ${s.mailAdded} message(s), ${s.pinsAdded} server key(s), ${s.contactsAdded} contact(s)`,
conflicts ? `${conflicts} entr${conflicts === 1 ? "y" : "ies"} already known under a ` +
"different key — kept what was already here, skipped the import's version" : null,
s.malformed ? `${s.malformed} malformed entr${s.malformed === 1 ? "y" : "ies"} skipped` : null,
].filter(Boolean).join("\n"), Boolean(conflicts || s.malformed));
renderSettings();
renderFolder();
} catch (err) {
status(`import failed: ${err.message}`, true);
}
};
async function rotateIdentity() {
const me = store.identity();
const addr = accountAddress();
@ -942,6 +1007,17 @@ async function rotateIdentity() {
}
}
// Unlike rotate, nothing is kept: this is the seed's only local copy, gone.
async function logout() {
if (!window.confirm(
"Log out and erase this browser?\n\n" +
"This deletes the seed, pins, contacts and every cached message from this browser. Make sure " +
"the seed is backed up elsewhere first — without it there is no way back in."
)) return;
await store.clearAll();
location.reload();
}
// --- boot --------------------------------------------------------------------------
// A deployment MAY bake in a server key (the NixOS module's `presetServer`),

105
web/js/store.js
View file

@ -234,3 +234,108 @@ export async function unreadCount() {
const read = load().read || {};
return ids.filter(id => !read[id]).length;
}
// --- export / import: mail, contacts, pins — never the seed ---------------------
// btoa/atob work on JS's UTF-16 "binary string" convention (one code unit per
// byte); this just bridges that to Uint8Array. Browser-only, like the rest of
// this file — no Node test exercises store.js, unlike crypto.js/proto.js.
const toBase64 = (bytes) => btoa(String.fromCharCode(...bytes));
const fromBase64 = (text) => Uint8Array.from(atob(text), c => c.charCodeAt(0));
// Deliberately excludes the seed: it already has its own reveal-and-copy flow
// in settings, meant for a password manager, not a downloadable file. This
// covers what fetching makes irreplaceable (SPEC.md §5 deletes mail from the
// server once acknowledged) plus the trust state that took real verification
// (RESOLVE, key comparison) to build up — pins and contacts.
export async function exportData() {
const [inbox, sent] = await Promise.all([listMessages("inbox"), listMessages("sent")]);
return {
gsmolExport: 1,
exportedAt: Date.now(),
servers: Object.fromEntries(allPins().map(({ host, key }) => [host, key])),
contacts: Object.fromEntries(allContacts().map(({ address, key, verified, history }) =>
[address, { key, verified, history }])),
inbox: inbox.map(row => ({ id: row.id, receivedAt: row.receivedAt, envelope: toBase64(row.envelope) })),
sent: sent.map(row =>
({ id: row.id, recipient: row.recipient, sentAt: row.sentAt, envelope: toBase64(row.envelope) })),
};
}
// Never overwrites a trust binding that already differs locally — the same
// rule refreshContact()/saveReplyAddress() apply elsewhere: an existing pin
// or contact key changes only by explicit user action, never silently. A
// malformed entry (hand-edited file, corruption) is skipped, not fatal — one
// bad record cannot abort the rest of the import, matching describe()'s
// per-message fail-open elsewhere in the app.
// A plain object, as JSON.parse would produce for `{...}`; Object.entries()
// on a string iterates its characters rather than failing, which is exactly
// the kind of malformed input this rejects as one unit instead of one per char.
const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
export async function importData(data) {
if (!data || data.gsmolExport !== 1) throw new Error("not a gsmol export file");
const summary = { pinsAdded: 0, pinsConflicted: 0, contactsAdded: 0, contactsConflicted: 0,
mailAdded: 0, malformed: 0 };
update(state => {
const servers = { ...(state.servers || {}) };
if (data.servers !== undefined && !isRecord(data.servers)) summary.malformed++;
for (const [host, key] of Object.entries(isRecord(data.servers) ? data.servers : {})) {
try {
if (b32decode(key).length !== 32) throw new Error("bad length");
} catch { summary.malformed++; continue; }
if (!(host in servers)) { servers[host] = key; summary.pinsAdded++; }
else if (servers[host] !== key) summary.pinsConflicted++;
}
state.servers = servers;
const contacts = { ...(state.contacts || {}) };
if (data.contacts !== undefined && !isRecord(data.contacts)) summary.malformed++;
for (const [address, c] of Object.entries(isRecord(data.contacts) ? data.contacts : {})) {
try {
if (typeof c.key !== "string" || b32decode(c.key).length !== 32) throw new Error("bad key");
} catch { summary.malformed++; continue; }
if (!(address in contacts)) {
contacts[address] = { key: c.key, verified: Boolean(c.verified), seenAt: Date.now(),
...(Array.isArray(c.history) && c.history.length && { history: c.history }) };
summary.contactsAdded++;
} else if (contacts[address].key !== c.key) {
summary.contactsConflicted++;
}
}
state.contacts = contacts;
});
for (const [box, rows] of [["inbox", data.inbox], ["sent", data.sent]]) {
if (rows !== undefined && !Array.isArray(rows)) summary.malformed++;
for (const row of Array.isArray(rows) ? rows : []) {
try {
const record = box === "inbox"
? { id: row.id, receivedAt: row.receivedAt, envelope: fromBase64(row.envelope) }
: { id: row.id, recipient: row.recipient, sentAt: row.sentAt, envelope: fromBase64(row.envelope) };
if (await storeIfNew(box, record)) summary.mailAdded++;
} catch { summary.malformed++; }
}
}
return summary;
}
// Logout: erases the seed, pins, contacts and every cached message from this
// browser. Closes the held connection first so the delete isn't left
// "blocked" waiting for a handle that never closes on its own.
export async function clearAll() {
localStorage.removeItem(KEY);
cached = derived = null;
if (dbPromise) {
(await dbPromise).close();
dbPromise = null;
}
await new Promise((resolve, reject) => {
const request = indexedDB.deleteDatabase(DB_NAME);
request.onsuccess = () => resolve();
request.onerror = () => reject(request.error);
request.onblocked = () => resolve(); // still completes once the reload closes every handle
});
}

4
web/style.css
View file

@ -349,6 +349,9 @@ dialog::backdrop { background: var(--backdrop); }
.filled { background: var(--accent); color: var(--on-accent); font-weight: 500; padding: 8px 20px; }
.filled:hover { background: var(--accent); box-shadow: var(--shadow); }
.filled:disabled { background: var(--hover); color: var(--muted); box-shadow: none; }
/* Irreversible, not just consequential — rotate stays plain-text, this doesn't. */
.danger { background: var(--warn); color: var(--on-warn); font-weight: 500; padding: 8px 20px; }
.danger:hover { background: var(--warn); box-shadow: var(--shadow); }
.error { color: var(--warn); font-size: 13px; }
#settings section { margin-bottom: 26px; }
@ -407,6 +410,7 @@ dialog::backdrop { background: var(--backdrop); }
color: var(--warn);
}
.seed-card .row { display: flex; align-items: center; gap: 8px; }
.backup-row { display: flex; align-items: center; gap: 8px; margin-top: 6px; }
.seed-card .seed { flex: 1; min-width: 0; font-family: var(--mono); font-size: 12px; word-break: break-all; }
.seed-card p { margin: 10px 0 0; font-size: 12px; color: var(--muted); }