tanmay-sharma-01/digivault

Purpose and Entry Points

Digital Vault is a same-origin Flask/vanilla-JS secure-notes application. backend/app.py starts the HTTP server, exposes the /api/* surface, and serves frontend/index.html at /. The frontend can alternatively be opened directly and target the backend API.

Client/API Boundary

frontend/index.html is the single-page client: it manages registration/login state, holds the returned session token, sends it as X-Session-Token, and drives note CRUD, search, export, logout, and inactivity UI. backend/app.py is the API orchestration boundary: request validation, authentication gating, response/status handling, and calls into security and persistence modules.

Identity and Login Protection

Registration and login flow through backend/app.py and backend/auth.py. Auth enforces alphanumeric usernames and password complexity, hashes/checks passwords with bcrypt, and calculates password-strength feedback. User records track failed attempts and locked_until; three failed logins lock an account for five minutes. Successful login creates a session rather than exposing credentials.

Session Lifecycle

backend/sessions.py owns UUID token creation, lookup, refresh, removal, and the two-minute inactivity rule. Protected API routes in backend/app.py validate X-Session-Token before accessing notes. The client pings the session endpoint periodically and resets to login on expiry; server-side validation remains authoritative.

Note Isolation and Encryption

Authenticated note operations are orchestrated in backend/app.py. A validated session resolves one username, and all note reads, writes, deletes, searches, and exports operate only within that user’s record. backend/encryption.py loads or creates a Fernet key and encrypts note content before persistence; normal note reads decrypt content for the authenticated response. Titles and note metadata remain available for title-based search.

Persistence and Runtime State

backend/storage.py provides JSON-file persistence for users and sessions. Runtime data resides under data/: users (password hashes, lock state, encrypted notes), active sessions, and the Fernet key are created on demand and excluded from source control. This is local filesystem storage rather than a database, with no indicated multi-process coordination or transactional boundary.

Runtime and External Dependencies

The application runs on Python/Flask with backend/requirements.txt; Flask-CORS enables browser access, bcrypt supplies password hashing, and cryptography supplies Fernet encryption. There are no remote services or database dependencies. The security boundary assumes local protection of data/secret.key; compromise of that key permits decryption of stored note bodies.