Implement credential management system - #12
Merged
Conversation
…g and master password integration
MathCunha16
added
enhancement
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughO PR corrige rotas backend, adiciona o fluxo de segurança do vault, implementa o workspace frontend de credenciais com CRUD, tags e modais, integra bloqueio automático e substitui o logo por uma versão dinâmica vinculada ao estado do vault. ChangesSegurança, credenciais e identidade visual
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant ProjectDetailView
participant useSecurity
participant securityApi
participant SecurityController
participant credentialsApi
ProjectDetailView->>useSecurity: consulta setup e status do vault
useSecurity->>securityApi: executa setup, unlock ou lock
securityApi->>SecurityController: chama /api/v1/security
SecurityController-->>useSecurity: retorna status da sessão
ProjectDetailView->>credentialsApi: lista ou altera credenciais
credentialsApi-->>ProjectDetailView: retorna dados do workspace
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
frontend/src/features/credentials/components/CredentialForm.tsx (1)
419-428: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winMapeie
decryptedPayloadpelos nomes reais do backend. O payload usausername/password,apiKeyerawText; os fallbacks parauser/pass/secret,token/key,content/texteObject.values(payload)[0]são especulativos e podem preencher o formulário com o campo errado. Remova esses sinônimos e convertarawTextpararawTextContentexplicitamente.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/src/features/credentials/components/CredentialForm.tsx` around lines 419 - 428, Atualize o mapeamento de decryptedPayload para usar somente os campos reais do backend: username, password, apiKey e rawText. Remova os fallbacks especulativos e atribua explicitamente payload.rawText a rawTextContent, mantendo valores vazios quando esses campos não existirem.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/components/ProjectDetailView.tsx`:
- Around line 259-266: Evite exibir o UnlockVaultCard durante o carregamento de
useMasterPasswordSetupStatusQuery e useVaultStatusQuery: capture os estados
isLoading/isPending dessas queries e só derive isVaultLocked e a decisão entre
setup, lock e unlock quando ambas tiverem concluído. Preserve o comportamento
atual após o carregamento, tratando explicitamente o estado pendente para não
considerá-lo bloqueado.
In `@frontend/src/features/credentials/components/CredentialDetailModal.tsx`:
- Around line 40-76: Update the isOpen effect in CredentialDetailModal to move
focus into the modal when it opens, preferably focusing the first focusable
element and falling back to modalRef.current. Ensure the modal container
supports programmatic focus with tabIndex={-1}, while preserving the existing
Escape handling and focus-trap behavior.
- Around line 80-83: Atualize copyToClipboard para tratar a Promise de
navigator.clipboard.writeText com async/await e try/catch, exibindo o toast de
sucesso apenas após a cópia ser concluída e tratando falhas de forma consistente
com handleCopy em ProjectDetailView.
In `@frontend/src/features/credentials/components/CredentialForm.tsx`:
- Around line 233-240: Update the visibility toggle buttons in CredentialForm,
including the password and API key buttons, to remain reachable through normal
keyboard Tab navigation by removing tabIndex={-1}. Add dynamic aria-label values
that clearly announce whether each control will show or hide its corresponding
secret, while preserving the existing toggle behavior and icons.
In `@frontend/src/features/security/components/MasterPasswordSetupCard.tsx`:
- Around line 77-95: Padronize a acessibilidade dos controles de senha: em
frontend/src/features/security/components/MasterPasswordSetupCard.tsx:77-95,
associe o label ao input de nova senha, adicione nome acessível ao botão de
visibilidade e remova tabIndex={-1}; aplique os mesmos ajustes ao campo de
confirmação em
frontend/src/features/security/components/MasterPasswordSetupCard.tsx:135-153;
em frontend/src/features/security/components/UnlockVaultCard.tsx:41-60, associe
o label ao input e torne o botão de visibilidade nomeado e navegável por
teclado.
In `@frontend/src/features/security/hooks/useSecurity.ts`:
- Around line 59-63: Update the onSuccess handler in useSecurity so vault
blocking cancels in-flight credential requests and explicitly removes cached
credential queries for each project and credential. Replace the broad
["projects"] invalidation with query-cache removal targeting ["projects",
projectId, "credentials"] and ["projects", projectId, "credentials",
credentialId], while preserving vaultStatus invalidation.
In `@frontend/src/hooks/useInactivityAutoLock.ts`:
- Around line 11-28: Stabilize the auto-lock timer in useInactivityAutoLock by
avoiding dependencies that change identity on every render: use the mutation’s
mutateAsync operation directly and store onLockTriggered in a ref or otherwise
make it stable. Ensure the effect resets the timeout only when the enabled state
or required mutation operation changes, so polling and inline callbacks cannot
postpone the 15-minute lock indefinitely.
In `@frontend/src/routes/projects`.$projectId.module.css:
- Line 1128: Atualize a regra CSS que contém word-break: break-word para usar
overflow-wrap: break-word e, se necessário para preservar o comportamento
existente, defina também word-break: normal.
- Around line 1176-1186: Remove the duplicated .btnDecrypt:hover rule, keeping a
single hover definition. Search ProjectDetailView and other consumers for
.btnDecrypt usage; if the class is unused, remove its base rule and remaining
related styles as well.
---
Nitpick comments:
In `@frontend/src/features/credentials/components/CredentialForm.tsx`:
- Around line 419-428: Atualize o mapeamento de decryptedPayload para usar
somente os campos reais do backend: username, password, apiKey e rawText. Remova
os fallbacks especulativos e atribua explicitamente payload.rawText a
rawTextContent, mantendo valores vazios quando esses campos não existirem.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: b3f1bf44-e461-4327-8466-a2ddeac7e77b
⛔ Files ignored due to path filters (1)
frontend/src/assets/logo-devaulty.svgis excluded by!**/*.svg
📒 Files selected for processing (27)
backend/src/main/java/com/devaulty/backend/adapter/in/web/credential/CredentialController.javabackend/src/main/java/com/devaulty/backend/adapter/in/web/security/SecurityController.javabackend/src/test/java/com/devaulty/backend/adapter/in/web/credential/CredentialControllerIT.javabackend/src/test/java/com/devaulty/backend/adapter/in/web/security/SecurityControllerIT.javafrontend/src/components/HackerLogo.module.cssfrontend/src/components/HackerLogo.tsxfrontend/src/components/LogoDevaulty.tsxfrontend/src/components/ProjectDetailView.tsxfrontend/src/components/RootLayout.tsxfrontend/src/features/credentials/api/credentialsApi.tsfrontend/src/features/credentials/components/CredentialDetailModal.module.cssfrontend/src/features/credentials/components/CredentialDetailModal.tsxfrontend/src/features/credentials/components/CredentialForm.module.cssfrontend/src/features/credentials/components/CredentialForm.tsxfrontend/src/features/credentials/hooks/useCredentials.tsfrontend/src/features/security/api/securityApi.tsfrontend/src/features/security/components/MasterPasswordSetupCard.module.cssfrontend/src/features/security/components/MasterPasswordSetupCard.tsxfrontend/src/features/security/components/UnlockVaultCard.module.cssfrontend/src/features/security/components/UnlockVaultCard.tsxfrontend/src/features/security/components/VaultSecurityBanner.module.cssfrontend/src/features/security/components/VaultSecurityBanner.tsxfrontend/src/features/security/hooks/useSecurity.tsfrontend/src/features/tags/hooks/useTags.tsfrontend/src/hooks/useInactivityAutoLock.tsfrontend/src/routes/projects.$projectId.module.cssfrontend/src/types/api.ts
…nd modal accessibility across the vault interface.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/features/security/components/MasterPasswordSetupCard.tsx`:
- Line 19: Update hasNumberOrSpecial so symbol detection accepts any
non-alphanumeric character, including symbols such as ?, ~, and backtick,
instead of relying on the current allowlist; alternatively, reuse the backend
password-policy definition if that is the established source of truth.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: c4e909b2-a819-4216-8d07-9eb8dbde272d
📒 Files selected for processing (9)
frontend/src/components/ProjectDetailView.tsxfrontend/src/components/TagsManagerModal.tsxfrontend/src/features/credentials/components/CredentialDetailModal.tsxfrontend/src/features/credentials/components/CredentialForm.tsxfrontend/src/features/security/components/MasterPasswordSetupCard.tsxfrontend/src/features/security/components/UnlockVaultCard.tsxfrontend/src/features/security/hooks/useSecurity.tsfrontend/src/hooks/useInactivityAutoLock.tsfrontend/src/routes/projects.$projectId.module.css
🚧 Files skipped from review as they are similar to previous changes (6)
- frontend/src/features/security/components/UnlockVaultCard.tsx
- frontend/src/hooks/useInactivityAutoLock.ts
- frontend/src/features/security/hooks/useSecurity.ts
- frontend/src/features/credentials/components/CredentialDetailModal.tsx
- frontend/src/components/ProjectDetailView.tsx
- frontend/src/features/credentials/components/CredentialForm.tsx
…password regex validation
This was referenced Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feat: Secure Credentials Vault & Security Center
This PR implements the complete frontend support for the Credentials & Vault feature inside Devaulty, adhering to zero-knowledge cryptographic practices, secure RAM session management, and premium visual components.
🔒 Key Security Features
Strict Tab-Scoped Security:
Master Password Setup & Enforcement:
15-Minute Inactivity Auto-Lock:
mousemove,keydown,click, etc.) when inside the unlocked Credentials workspace.Zero-Knowledge Decrypted Payload Handling:
LOGINcredentials,API_KEYtokens, andRAW_TEXTkeys/private keys) are loaded on-demand and kept masked by default (••••••••).gcTime: 0configured in React Query to ensure decrypted credentials are instantly wiped from browser memory/cache once the modal closes.🎨 UI/UX Enhancements & Visual "Fru-frus"
CredentialDetailModal):01and00).72px) and tab label sizing so "CREDENTIALS" fits perfectly without text truncation.📁 Modified Files
src/features/security/components/MasterPasswordSetupCard.tsxsrc/features/security/components/UnlockVaultCard.tsxsrc/features/security/components/VaultSecurityBanner.tsxsrc/features/credentials/components/CredentialForm.tsxsrc/features/credentials/components/CredentialDetailModal.tsxsrc/components/HackerLogo.tsxsrc/components/HackerLogo.module.csssrc/components/LogoDevaulty.tsx(updated centered<>path viewBox)src/features/security/api/securityApi.tssrc/features/credentials/api/credentialsApi.tssrc/hooks/useInactivityAutoLock.tssrc/components/ProjectDetailView.tsxsrc/routes/projects.$projectId.module.csssrc/components/RootLayout.tsxSummary by CodeRabbit