Account Handling

public/js/modals.js

@@ -126,8 +126,8 @@ export function openAuthModal(initialTab = 'signin') {
         }
       });
 
-      b.querySelector('#github-btn').addEventListener('click', () => loginWithOAuth('github'));
-      b.querySelector('#google-btn').addEventListener('click', () => loginWithOAuth('google'));
+      b.querySelector('#github-btn').addEventListener('click', () => { loginWithOAuth('github'); closeModal(); });
+      b.querySelector('#google-btn').addEventListener('click', () => { loginWithOAuth('google'); closeModal(); });
       b.querySelector('#forgot-pw').addEventListener('click', () => openForgotPasswordModal());
 
       // Enter key

public/oauth-callback.html

@@ -58,21 +58,9 @@
       }
 
       msgEl.textContent = 'Sign-in complete! Closing…';
-      // Give localStorage a moment to propagate, then close.
+      // Give localStorage a moment to propagate, then try to close the popup.
       setTimeout(() => {
-        // If we're in a popup, close it.
-        if (window.opener !== null || window.history.length <= 1) {
-          window.close();
-        }
-        // If close() didn't work (e.g. tab opened directly), redirect home.
-        setTimeout(() => {
-          const p = new URLSearchParams({
-            oauth: '1',
-            t: tokens.access_token,
-            r: tokens.refresh_token || '',
-          });
-          location.replace('/?' + p.toString());
-        }, 800);
+        try { window.close(); } catch (_) { /* ignore */ }
       }, 300);
     } else {
       msgEl.textContent = 'No token received. You can close this window.';

server/cryptoUtils.js

@@ -0,0 +1,61 @@
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16; // 128 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+
+// Derive key from environment variable
+function getKey() {
+  const keyEnv = process.env.DATA_ENCRYPTION_KEY;
+  if (!keyEnv) throw new Error('DATA_ENCRYPTION_KEY environment variable not set');
+  // Use SHA-256 to derive a 32-byte key from the env var
+  return crypto.createHash('sha256').update(keyEnv).digest();
+}
+
+export function encryptJson(data) {
+  const key = getKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipher(ALGORITHM, key);
+  cipher.setAAD(Buffer.from('')); // Optional AAD
+
+  let encrypted = cipher.update(JSON.stringify(data), 'utf8', 'hex');
+  encrypted += cipher.final('hex');
+
+  const authTag = cipher.getAuthTag();
+  return {
+    iv: iv.toString('hex'),
+    encrypted,
+    authTag: authTag.toString('hex'),
+  };
+}
+
+export function decryptJson(encryptedData) {
+  const key = getKey();
+  const { iv, encrypted, authTag } = encryptedData;
+  const decipher = crypto.createDecipher(ALGORITHM, key);
+  decipher.setAuthTag(Buffer.from(authTag, 'hex'));
+  decipher.setAAD(Buffer.from('')); // Match AAD
+
+  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return JSON.parse(decrypted);
+}
+
+export async function saveEncryptedJson(filePath, data) {
+  const encrypted = encryptJson(data);
+  await fs.writeFile(filePath, JSON.stringify(encrypted));
+}
+
+export async function loadEncryptedJson(filePath) {
+  try {
+    const content = await fs.readFile(filePath, 'utf8');
+    const encrypted = JSON.parse(content);
+    return decryptJson(encrypted);
+  } catch (err) {
+    if (err.code === 'ENOENT') return null; // File not found
+    throw err;
+  }
+}

server/sessionStore.js

@@ -2,6 +2,8 @@
 // Device sessions live in memory only (restart clears them).
 import { createClient } from '@supabase/supabase-js';
 import crypto from 'crypto';
+import { saveEncryptedJson, loadEncryptedJson } from './cryptoUtils.js';
+import path from 'path';
 
 let _SUPABASE_URL, _SUPABASE_ANON_KEY;
 export function initStoreConfig(url, key) { _SUPABASE_URL = url; _SUPABASE_ANON_KEY = key; }
@@ -14,11 +16,45 @@ const userCache   = new Map(); // userId -> { sessions: Map, online: Set }
 const tempStore   = new Map(); // tempId -> TempData
 const devSessions = new Map(); // token  -> DeviceSession
 
-setInterval(() => {
+const TEMP_STORE_FILE = '/data/temp_sessions.json';
+
+async function loadTempStore() {
+  const data = await loadEncryptedJson(TEMP_STORE_FILE);
+  if (data) {
+    for (const [id, d] of Object.entries(data)) {
+      tempStore.set(id, {
+        sessions: new Map(Object.entries(d.sessions || {})),
+        msgCount: d.msgCount || 0,
+        created: d.created || Date.now(),
+        lastActive: d.lastActive || Date.now(),
+      });
+    }
+  }
+}
+
+async function saveTempStore() {
+  const data = {};
+  for (const [id, d] of tempStore) {
+    data[id] = {
+      sessions: Object.fromEntries(d.sessions),
+      msgCount: d.msgCount,
+      created: d.created,
+      lastActive: d.lastActive,
+    };
+  }
+  await saveEncryptedJson(TEMP_STORE_FILE, data);
+}
+
+// Load temp store on init
+loadTempStore().catch(err => console.error('Failed to load temp store:', err));
+
+setInterval(async () => {
   const now = Date.now();
   for (const [id, d] of tempStore)
     if (now - d.created > TEMP_TTL_MS || now - d.lastActive > TEMP_INACTIVITY)
       tempStore.delete(id);
+  // Save after cleanup
+  await saveTempStore().catch(err => console.error('Failed to save temp store:', err));
 }, 30 * 60 * 1000);
 
 function userClient(accessToken) {
@@ -42,15 +78,19 @@ export const sessionStore = {
   createTempSession(t) {
     const d = this.initTemp(t);
     const s = { id: crypto.randomUUID(), name: 'New Chat', created: Date.now(), history: [] };
-    d.sessions.set(s.id, s); d.lastActive = Date.now(); return s;
+    d.sessions.set(s.id, s); d.lastActive = Date.now();
+    saveTempStore().catch(err => console.error('Failed to save temp store:', err));
+    return s;
   },
   updateTempSession(t, id, patch) {
     const d = tempStore.get(t); if (!d) return null;
     const s = d.sessions.get(id); if (!s) return null;
-    Object.assign(s, patch); d.lastActive = Date.now(); return s;
+    Object.assign(s, patch); d.lastActive = Date.now();
+    saveTempStore().catch(err => console.error('Failed to save temp store:', err));
+    return s;
   },
-  deleteTempSession(t, id) { tempStore.get(t)?.sessions.delete(id); },
-  deleteTempAll(t)         { tempStore.get(t)?.sessions.clear(); },
+  deleteTempSession(t, id) { tempStore.get(t)?.sessions.delete(id); saveTempStore().catch(err => console.error('Failed to save temp store:', err)); },
+  deleteTempAll(t)         { tempStore.get(t)?.sessions.clear(); saveTempStore().catch(err => console.error('Failed to save temp store:', err)); },
 
   /**
    * Copy temp sessions into the user's account on login.

server/wsHandler.js

@@ -56,7 +56,9 @@ const handlers = {
     client.deviceToken = deviceSessionStore.create(user.id, client.ip, client.userAgent);
     sessionStore.markOnline(user.id, ws);
 
-    const tId = clientTempId || client.tempId;
+    // If the client provided a persistent tempId, use and save it on the ws client
+    if (clientTempId) client.tempId = clientTempId;
+    const tId = client.tempId;
     await sessionStore.transferTempToUser(tId, user.id, accessToken);
 
     const [sessions, settings, profile] = await Promise.all([
@@ -79,7 +81,9 @@ const handlers = {
   },
 
   'auth:guest': (ws, msg, client) => {
+    // Honor a client-supplied persistent tempId and persist it on the ws client
     const t = msg.tempId || client.tempId;
+    client.tempId = t;
     sessionStore.initTemp(t);
     safeSend(ws, { type: 'auth:guestOk', tempId: t, sessions: sessionStore.getTempSessions(t).map(ser) });
   },