29 Commits

Include renames

Author	SHA1	Message	Date
bruno	60da957f13	fix: section Securite du compte incomplete BUG-068 (boutons theme, QR local, mot de passe, recovery WebAuthn)	2026-09-22 20:07:25 -04:00
bruno	162a5b4acc	fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034) ... - sanitizer XSS serveur (markdown + page de partage) [BUG-021/022] - rate-limit/lockout MFA [BUG-023] - isolation vaults par segments [BUG-024] - caps regex ReDoS [BUG-025] - SSRF webhooks + secrets externalises [BUG-026] - rotation/revocation des jetons [BUG-027] - politique de mot de passe + invalidation sessions [BUG-028] - verrous users.json [BUG-029] - IP reelle dans les audits [BUG-030] - rate-limit par compte [BUG-031] - symlinks hors vault ignores [BUG-032] - recherche simple via inverted index [BUG-033] - token en memoire + cookie HttpOnly, CSP durcie [BUG-034] Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.	2026-09-13 10:51:42 -04:00
bruno	ab795ec9e0	feat(mfa): #64 WebAuthn complet — enregistrement/clé/verify login + gestion clés dans Sécurité (backend+frontend+i18n+tests)	2026-09-07 23:55:35 -04:00
bruno	46be24f6a3	feat(admin): frontend dashboard complet pour #71 ... Page admin standalone + widgets temps réel + CRUD users via AdminPanel existant. - frontend/admin.html : page admin (header + 4 sections : stats temps réel, audit logs, backups, gestion utilisateurs + footer) - frontend/js/admin.js : module ES avec init(), connectSSE(), loadStatsOnce(), loadAuditLogs(), loadBackupStats(), renderStatsWidget(), renderAuditTable(), renderBackups() + helpers (formatBytes, formatUptime, severityColor) - frontend/locales/{fr,en}.json : 36 clés admin.* identiques (diff vérifié) - frontend/js/auth.js : adminRow.onclick redirige vers /admin.html (au lieu de AdminPanel.show() qui reste fonctionnel) - tests/frontend/unit.test.mjs : 3 nouveaux tests (admin.js existe + exports + parse) - tests/test_auth_api.py : 2 nouveaux tests smoke (PATCH + DELETE /api/auth/admin/users) Vérifié : - pytest : 494 passed, 5 skipped (492 baseline + 2 nouveaux) - frontend unit : 7 passed (4 baseline + 3 admin) - validate-imports : 30 modules validated (29 + admin.js) - pane-manager JSDOM : 9/9 passed - ruff check backend/ : All checks passed	2026-09-07 11:14:46 -04:00
bruno	83063d3a18	feat(auth): v2.1.0 - MFA TOTP avec QR code, recovery codes ... - backend/auth/mfa.py: TOTP (pyotp), recovery codes SHA-256 - Login flow: mfa_required → totp/verify → token (ou recovery) - 6 nouveaux endpoints /api/auth/mfa/* - Frontend: QR code setup, 6-digit auto-submit, recovery codes - Settings: section Sécurité avec enable/disable MFA - CSS: mfa-challenge, setup-card, recovery-list, badges - i18n: 36 nouvelles clés EN/FR - pyotp ajouté aux dépendances - 30 tests (TOTP, recovery, API endpoints, login flow) - 439 tests passent au total	2026-09-06 18:42:32 -04:00
bruno	88b73f663f	fix: header logout button dynamically recreated by renderUserMenu ... - renderUserMenu() rebuilds #logout-btn with innerHTML, wiping inline onclick - Added onclick='window.handleLogout()' to the dynamic innerHTML string - Restored addEventListener as double safety - Settings #profile-logout already has onclick to handleLogout	2026-07-24 10:04:13 -04:00
bruno	d2dec1be06	fix: both logout buttons now use inline onclick — no JS handlers ... - Header #logout-btn: inline fetch+clear localStorage+redirect - Settings #profile-logout: inline window.handleLogout or fetch fallback - Removed all JS event listeners that were causing race conditions - Zero dependency on ES module loading order	2026-07-24 09:55:43 -04:00
bruno	c3c5f11e9b	Move sidebar and offline imports to lazy loading	2026-07-20 22:31:07 -04:00
bruno	cc22ffe6df	fix: SW-killer script in index.html — auto-unregister stale Service Worker ... The SW was the root cause of all persistent French text issues. Even after rebuild, browsers with a registered SW would serve cached old files (viewer.js without data-i18n, old locale JSONs). SW-killer runs before any module script: 1. Detects if SW is controlling the page 2. Unregisters all SW registrations 3. Clears all caches 4. Reloads the page once (sessionStorage flag to prevent loop) Other fixes in this commit: - auth.js: import setLocale statically (was dynamic import) - auth.js: import loadVaults/loadTags from sidebar.js - sw.js: add JS modules + locales to STATIC_ASSETS for versioning - sw.js: CACHE_VERSION v4→v5	2026-06-21 23:12:45 -04:00
bruno	bea23820ab	fix: Sign out + login flow + cache bust for i18n ... - auth.js: window.handleLogout at module top level (was inside renderUserMenu, not always called). Fixes settings dropdown 'Sign out' onclick='handleLogout()' doing nothing. - auth.js: add missing imports (loadVaults, loadTags from sidebar.js) and dynamic import for IndexUpdateManager (circular dep avoidance). Fixes 'loadVaults is not defined' error on login. - sw.js: CACHE_VERSION v4→v5 to bust stale Service Worker cache that was serving old viewer.js without data-i18n attributes, causing dashboard tabs to stay French despite English profile. To apply: rebuild container + unregister SW in DevTools + reload.	2026-06-21 11:37:51 -04:00
bruno	6d4a45797e	fix: Sign out button in settings dropdown not working ... The header dropdown 'Sign out' menu item used onclick='handleLogout()' but handleLogout was never defined as a global function. Added window.handleLogout in auth.js that delegates to AuthManager.logout(), same as the existing logout-btn handler.	2026-06-21 11:14:03 -04:00
bruno	dec46cd5ab	fix: re-sync language from server after login ... Root cause: initI18n() runs before auth on login page, so /api/auth/me fails (401) and locale falls back to browser language. After login, showWelcome() renders with stale locale without re-checking server preference. French users always got French UI. Fix: after successful login, fetch /api/auth/me and call setLocale() if server language differs from current. This ensures the dashboard renders in the user's saved language preference.	2026-06-21 11:06:27 -04:00
bruno	659c227e6a	i18n: complete audit — 55 new keys, all hardcoded strings converted to t() ... - Added 4 missing keys: button.cancel, toast.dir_renamed, toast.file_deleted, toast.file_renamed - Replaced 41 hardcoded showToast() strings with t() calls across 13 JS files - Replaced 10 hardcoded textContent/title/innerHTML strings with t() calls - Fixed theme labels: Sombre/Clair -> t('theme.dark')/t('theme.light') - Fixed vault selector: Tous les vaults -> t('help.all_vaults') - Both locale files: 983 -> 1032 keys, perfectly matched - Bidirectional EN<->FR switching verified in browser	2026-06-18 22:49:19 -04:00
bruno	7977cb89aa	fix: admin table i18n + emoji preservation in nav items ... - Admin panel: table headers, data values, date locale-aware - Settings/help nav: emojis added to locale values (🔍🔧🔄 etc.) - auth.js: getLocale import, t() for all user-facing strings - Added common.never + 6 admin column keys - 746 locale keys per language	2026-06-18 15:16:08 -04:00
bruno	1a27e95c1a	fix: admin panel template literal — ' + t() + ' → ${t()} ... The concatenation syntax was literal text inside backtick template, showing raw code on screen. Fixed both admin.title and admin.new_user.	2026-06-18 14:44:40 -04:00
bruno	0403be4516	feat: complete i18n coverage — all dynamic content translated ... All remaining French strings converted to t() calls: - ui.js: create/delete file/dir modals, rename/copy/bookmark toasts - palette.js: confirm dialogs, error toasts - search.js: result summary text with interpolation - config.js: about/diagnostics section labels - auth.js: admin panel title - viewer.js: forge popout labels - dashboard.js: shared widget buttons, date locale-aware 57 new locale keys for dynamic content (modals, toasts, admin, about) Total: 597 keys per language All 26 modules validated — 163 exports, 0 errors	2026-06-18 14:18:25 -04:00
bruno	f85482214e	feat: i18n system - French/English internationalization ... Core: i18n.js module with t(), setLocale(), initI18n() - Flat key→string JSON locale files (fr.json + en.json, 165 keys) - data-i18n / data-i18n-placeholder / data-i18n-attr DOM attributes - Live locale switch via setLocale() - no page reload - Language detection: localStorage > navigator.language > 'fr' - Fallback: missing key → French → raw key Wired into: - app.js: await initI18n() early in init() - config.js: profile save → await setLocale(), toasts + confirm via t() - auth.js: network error toast via t() - index.html: data-i18n on login form, profile section, search placeholder	2026-06-18 13:31:11 -04:00
bruno	227e157793	Fix: pattern regex v-flag, help mobile: TOC accordion not slide-over, search always in TOC	2026-06-03 11:13:37 -04:00
bruno	0db52c3c0e	fix: imports manquants — getFileIcon, showWelcome, showProgressBar, hideProgressBar	2026-05-29 09:13:41 -04:00
bruno	7edbd7a31a	fix: imports manquants — TabManager, showToast, closeHeaderMenu, closeMobileSidebar, ContextMenuManager, RightSidebarManager	2026-05-29 09:01:33 -04:00
bruno	c83068f473	fix: add safeCreateIcons import to auth.js + export closeHeaderMenu from ui.js	2026-05-28 19:20:23 -04:00
bruno	9971168025	fix: remaining const state.allVaults → allVaults in auth.js	2026-05-28 18:51:06 -04:00
bruno	2c6c74419c	fix: revert _state.allVaults → _allVaults (AdminPanel local property)	2026-05-28 18:40:00 -04:00
bruno	148b3851ae	fix: add missing state. prefix to all bare state variable references across all modules	2026-05-28 18:33:39 -04:00
bruno	6a55dfd5eb	fix: over-aggressive state.xxx replacements on local variables	2026-05-28 17:02:27 -04:00
bruno	a2ff9297ce	fix: strip line number prefixes from all JS files	2026-05-28 16:46:17 -04:00
bruno	643a73e0f5	fix: strip read_file line numbers accidentally injected into JS files	2026-05-28 16:40:14 -04:00
bruno	7866f93778	refactor: state.js → mutable object to fix 'assignment to constant' errors ... ES module imports are read-only live bindings — can't reassign imported let/const variables. Replace individual 'export let' with single 'export const state = {...}' mutable object. All modules updated: import { state } from './state.js' All state access changed to state.xxx pattern. Fixes cascade of 'Assignment to constant variable' errors.	2026-05-28 16:34:39 -04:00
bruno	4836d6f1d0	refactor: split app.js (8875 lines) into 12 ES modules ... frontend/js/ structure: state.js (55 lines) — Shared mutable state, constants utils.js (510 lines) — EXT_ICONS, getFileIcon, escapeHtml, safeCreateIcons auth.js (547 lines) — api(), AuthManager, initLoginForm, AdminPanel search.js (1106 lines)— SearchHistory, QueryParser, Autocomplete, performSearch sidebar.js (1091 lines)— Vault tree, sidebar filter, TagFilterService, loadTags viewer.js (1554 lines)— openFile, Outline, ScrollSpy, Frontmatter, Editor ui.js (2250 lines)— Theme, Toast, Sidebar, Dropdowns, Tabs, ContextMenu dashboard.js (461 lines) — Dashboard widgets (Recent, Stats, Bookmarks) config.js (999 lines) — Config panel, Hidden files, About, Sidebar tabs sync.js (436 lines) — SSE/IndexUpdateManager, PWA registration graph.js (401 lines) — GraphViewManager (force-directed canvas graph) legacy.js (550 lines) — Remaining bridge functions (goHome, showWelcome, initSearch) app.js (80 lines) — Thin orchestrator: imports all modules, calls init() index.html: switched from <script src="app.js"> to <script type="module" src="js/app.js"> Original app.js preserved for backward compatibility. All 14 modules pass node --check syntax validation.	2026-05-28 14:04:50 -04:00