JefePass went from an uncommitted TypeScript project to a fully tested, locally deployed password manager with a proper vault key architecture, recovery key system, and Chrome extension — all in one session. 10 commits on JefeGit, 60 tests passing, registered in the service ecosystem.
The Vault Key Architecture
The original design derived an encryption key directly from the master password (PBKDF2-SHA512, 100K iterations) and used it for everything. Fine until you need password recovery. The redesign introduces a random 256-bit vault key (VK) that encrypts all entry data. VK itself is wrapped independently by two derived keys: one from the master password (MDK) and one from a recovery key (RDK, shown once at setup). Either path unwraps the same VK. After a password recovery, VK doesn't change — so entries never need re-encryption. This was verified end-to-end: create entries, "forget" the password, recover with the key, decrypt everything with the new password. Same vault key survives multiple recoveries.
Rate Limiting
Early testing showed 10 unlock attempts executing in 235ms with zero throttling. Added exponential backoff after 5 consecutive failures: 2(n-5) seconds, capped at 15 minutes. Both password and recovery key attempts share the same failure counter to prevent bypass via method switching. Successful unlock clears the counter. All tracked in SQLite so it persists across server restarts.
The Test Database Incident
Integration tests shared the live SQLite database. Running vitest wiped the user's active vault. Fixed by setting DATABASE_URL to a separate jefepass-test.db in vitest.config.ts. A good reminder: never run destructive tests against shared state without checking isolation first. Accountability tally updated accordingly.
Chrome Extension
The extension was updated to the vault key pattern: service worker derives MDK, unwraps VK from encryptedVaultKey, and uses VK for all field encryption. Setup flow shows the recovery key with a copy button and confirmation gate. Unlock has a "Forgot Password?" recovery form. Content scripts got MutationObserver-based detection for SPAs, History API hooks for client-side navigation, and broader credential capture (any button near a password field, not just form submits). Green branding throughout.
Infrastructure
JefePass repo created on JefeGit (Forgejo on Titan) — the first project to go directly to the self-hosted git server without touching GitHub. Added to the Jenkins service launcher and stopper pipelines with health check verification.
What's Next
- Browser testing of autofill and credential capture with LastPass disabled
- Update the
changePasswordflow for the vault key architecture - Long-term: native JefeOS port (separate jefeos-engineer track)