frankhart2018 / primistore Goto Github PK
View Code? Open in Web Editor NEWLocally hosted password management tool
License: MIT License
Locally hosted password management tool
License: MIT License
Second of many issues for #40 project.
Backfill the existing passwords with a default policy id. The config for this policy would look like:
{
"name": "default",
"updateWindowMin": 20,
"updateWindowMax": 30,
}
Currently the rotation rules are hardcoded and the colors thus displayed are due to those hardcoded thresholds. Add an option to save this in the database and allow users to modify this.
Currently backup is done using a bash script, which is not optimal as it requires user to login to their Pi server. Instead provide a single button in the UI (update Device Info -> Device Admin and add it there) to generate and download backup for mongo and charset directory.
Currently if the charset file is missing, the delete endpoint: DELETE /password/:pass_uid
fails with 500 when the deletion of charset fails (possible because it does not exist). This is not really required, if it cannot delete it should just move one and delete the database entry and return 200 (already exists).
Display the following stats about the along with the decrypted password in decrypt page:
This helps when creating a new password, I usually prefer to keep password stats same for the same account.
Modify the UI to provide a better feel for the user
When travelling the Pi might not be with you, so it is best to have a script to generate a snapshot of the mongo data and the charset's directory and another script that can be used to load from the snapshot.
Auto adjust the final range slider on selecting percentages for remaining sliders.
Also, prevent user from setting a total percentage greater than 100
A script to fetch IP which can be used to spin up the docker containers will be very helpful to automate the whole process of spinning up containers on the PI.
Learn repos should have a LEARN.md file to teach student how to build your project step by step. You can explain how to build your project with text, code snippets, images, or even short (5 minute) long video lessons. As the maintainer of a Learn repo, the LEARN.md file requires you to think critically about how to explain the building of your project and how to also make it engaging. We don't expect you to be an expert teacher, but we would like you to reflect on how difficult it was to get to your level of knowledge, and then provide friendly guidance to help other students to learn.
Reference: https://github.com/Recode-Hive/Stackoverflow-Analysis/blob/main/Learn.md
create a wiki page describing in detail steps to create, store and use the passwords securely
The current font family makes it very hard to distinguish between lowercase L (l) and uppercase I (I). Which leads to confusion while using the passwords.
Explain the image processing algorithm used to convert images into 1s and 0s. Otherwise, you will forget it too.
When the app is deployed to a single server, multiple profiles will allow users to separate their passwords from other people sharing the server access.
Fourth of many issues for #40 project.
Now that everything is set up, it's time to wire it all up.
GET /policy/:policyId
, that returns:{
"updateWindowMin": 20,
"updateWindowMax": 30,
}
Password manager does have API logs along with the status code returned, but for further helping in debugging, it would make sense to add the time when the log was generated (in the local time zone of course).
The page should be frontend only and provides capability just to generate passwords, not encode or store them in any way. There should be three range bars for setting the percent of alphabets, special characters, and numbers. There should be a text box (that accepts only numbers) to get the number of digits in the password and then a button (duh) to generate the password.
This is not ideal as time is of utmost importance for calculating the age of keys and charset. Fix this on startup in raspberry PI, maybe add this to the script that runs on container spin up.
Currently the safe password generator component does not allow user to select either of upper or lowercase alphabets. It is not necessary that every site allows for uppercase alphabets, enforcing everyone to use both types of alphabets is not right.
The errors propagated from the backend are not displayed in the frontend, so if anything goes wrong (especially while running OpenSSL commands), there's no way for the user to find out what went wrong, which is not a nice experience (especially for someone running things inside docker containers, it will be painful to search for error logs).
Adding version information would let the user find out what features they have or don't have based on the milestones here in Github (and probably a Changelog document later). It should be clearly visible to the user. This needs to be done ASAP, as currently there is a single version (0.1) but after 0.2 is released, it would be difficult to find out what enhancements/bug fixes are in the installed version.
Add logging to node API when running, it will help in debugging issues.
add prompts to notify user to install docker and docker-compose if they are not installed already, in the provisioning script for pi
Right now to upgrade version, the user has to manually pull the latest docker images and re-build the containers using these new images. This should be automated.
The README should contain the following:
The home page (MainMenu component) with all the links is not really required, the default home can be ListPasswords component. And all the links are already in navbar, there's no need for duplicating all the links in home page.
👋 Hi @frankhart2018,
I am Prince,web developer Girlscript Summer of Code. I'll be collaborating with you on preparing your repo for GSSoC'24 Program
Why are these changes required?
After Analysing last year's contributions and feedback it would be great for students to have a couple of standard readme files on the repo to understand what the project is all about and some issues detailing what they can contribute. This will help you to see increased engagement in your repository as well.
As mentioned students get a chance to learn step by step, how to build this project as well as invite mentors to collaborate and add features to this repo. I will generate issues, which will provide guidance on how to prepare your repo for Girlscript summer of code 2024 on 10th May.
This issue will serve as a tracking issue to track all issues related to GSSoC'24. I recommend creating a new branch for every issue and opening a pull request to track changes so we can effectively collaborate with each other and merge changes when you and I feel like those changes are ready to be merged on your primary branch.
If you have any questions or concerns, please feel free to leave a comment on this issue or any of the other issues that are generated.
I look forward to working with you
In GSSoC'24, GitHub Topics will help the discoverability of your project.
I see that you already have great topics on your repository!
I would recommend adding the name of the company like the software you use to build like "vs-code, ghdesktop" to improve your discoverability.
If you are happy with the topics you have, feel free to close this issue. 👍
archi@ubuntu:~/primistore/pi$ ifconfig | grep inet
Command 'ifconfig' not found, but can be installed with:
sudo apt install net-tools
ifconfig is not installed by default in pi, which leads to following error :-
python3 get_current_ip.py
Traceback (most recent call last):
File "/home/archi/primistore/pi/get_current_ip.py", line 18, in <module>
get_ip()
File "/home/archi/primistore/pi/get_current_ip.py", line 14, in get_ip
raise RuntimeError(f"Cannot determine a single IP, found: {ips}")
RuntimeError: Cannot determine a single IP, found: []
We recommend that every repo has a code of conduct. If you don’t feel comfortable creating your own Code of Conduct from scratch we highly recommend using one of the templates provided by GitHub. If you do use a template, please read through the template and ensure that you can and will abide by the Code of Conduct.
Please follow these instructions on how to add a Code of Conduct.
Sample: https://github.com/Recode-Hive/Stackoverflow-Analysis/blob/main/CODE_OF_CONDUCT.md
When decrypted password shows up in DecryptPassword component, user has to manually copy the password. It should automatically be copied into clipboard and the user should be notified (maybe an alert that the password is copied).
Do not display the device info tab in for non-Pi users, as it is specific to deployment on a Pi.
Self explanatory
The temperature can be fetched using the following command in pi:
vcgencmd measure_temp
First of many issues for #40 project.
POST /policy
:{
"name": "string",
"updateWindowMin": "num",
"updateWindowMax": "num",
}
updateWindowMin
: Number of days before the safe update windowupdateWindowMax
: Number of days till upper limit of safe update window, after this the rotation will be overdueA simple script that can be executed on bootup to use the IP script to fetch the IP and use spin up docker containers in raspberry PI.
As the maintainer of a Collaborate repo, keeping Issues up-to-date will help the student community understand what they can do to contribute. Issues should vary by the easy (update documentation) to the difficult (add a new feature). The more involved you are, the more opportunities there are to collaborate.
Recommendations:
Add issues of varying difficulty to the repo often. you must add the tag GSSoC'24, Level 1, Level2, Level 3 good first issue etc.
How we cacluclate the Scores on Leaderboard: Every PR one point
Level 1: 10 points
Level 2: 25 points
Level 3: 45 points
Try to add some documentation issues as well it would be easy for beginner contributor to explore opensource through your repo.
Generate issues even if you plan on solving them, so the repository appears as active.
Contribute/commit often to the repo so it does not go stale.
Reference https://github.com/Recode-Hive/Stackoverflow-Analysis/issues
Migrate all command execution in password-manager
to command-executor-lib.
Display the currently used memory (primary memory) in device info (just for pi)
When an encrypted image is downloaded from the encrypt password page, it takes some time to generate the image and make it available for download, which is not optimal. Investigate if this can be sped up, or if there is no possibility of speed up and a please wait option so the user knows something is going on and the app is not actually stuck.
The encrypted password is converted to data URL in frontend/src/components/EncryptPassword/EncryptPassword.js
. This slows down the experience when download image button is clicked. This process of converting the string to data URI can be done asynchronously after the encrypted password is fetched and stored in local storage. When download is clicked, it can be loaded from local storage, thus instantly downloading after the button is pressed.
It will always generate safe passwords. Source: Trust me bro.
Third of many issues for #40 project.
Add a new page to edit password, give an option for each password to go to this page.
On clicking edit, after selecting a policy in number 4, stay in the same page.
When hosted on a raspberry pi (or any other device on the network), there is a slight delay during uploading the PMS file, the user has no idea if anything is working or not, and can accidentally send multiple upload requests, which might lead to unforeseen results. Display an upload progress bar on the frontend.
For both downloading (#35) and restoring (#36) backups, commands need to be run on the host, this can be achieved using the existing runCommandInPipe
function, but currently it is designed to run only a single command (i.e. the device info command - /usr/bin/landscape-sysinfo
). To make it more generic a standard messaging protocol needs to be established while sending command to the pipe, and another protocol needs to be set for sending output and caching.
Delete a password (i.e. the AES key + iv and the charset entry from DB and the file containing the charset).
In case someone messes up and rotates AES key or charset before they saved their decrypted current password, they will never be able to access (or decrypt) their password. Add this button to the new Device Admin tab, this will ask the user if they want to restore to that point using the snapshot tarball they upload and in that case will restore mongo and charsets to that point.
Currently the list of special characters is hardcoded into the function, which might generate a password that a website does not allow for. Give the option to remove or add from the special characters list.
Dump the output from the service that runs commands from the pipe into a file, so that it's easier to debug if there are any issues.
Issue templates are very helpful for a collaboration repo. When users identify a bug or want to add a new feature, you can provide templates so you can collect all the pertinent information you need to fix a bug or add a new feature.
We recommend creating a “Report Bug” and “Feature Request” issue template.
you can refer this: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
Some suggested prompts/questions you can add to a “Report Bug” template are:
Briefly describe the bug
What is the expected behavior?
Please provide step by step instructions on how to reproduce the bug
Some suggested prompts/questions you can add to a “Feature Request” issue template are:
Briefly describe your feature request
What problem is this feature trying to solve?
How do we know when the feature is complete?
Reference: https://github.com/Recode-Hive/Stackoverflow-Analysis/issues/new/choose
Click on Get Started button and copy the template to yours.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.