security: encrypt NaCl keypair at rest with AES-GCM and harden PoW captcha signature with HMAC-SHA256

js/services/auth.js

@@ -8,6 +8,7 @@
 
 import { directus } from './directus.js'
 import { setPersist, getPersist } from './directus/client.js'
+import { cryptoService } from './crypto.js'
 import { i18n } from '../i18n.js'
 
 const AUTH_DOMAIN = 'dgray.io'
@@ -114,6 +115,7 @@ class AuthService {
 
         try {
             await directus.login(email, uuid)
+            await cryptoService.unlock(uuid)
             this.currentUser = await directus.getCurrentUser()
             this.notifyListeners()
             this.storeUuid(uuid)
@@ -142,6 +144,7 @@ class AuthService {
         this.clearStoredUuid()
         localStorage.removeItem('dgray_remember')
         setPersist(false)
+        cryptoService.lock()
         this.resetPreferencesToDefaults()
         this.notifyListeners()
     }
@@ -289,6 +292,8 @@ class AuthService {
     async tryRestoreSession() {
         if (directus.isAuthenticated()) {
             try {
+                const uuid = this.getStoredUuid()
+                if (uuid) await cryptoService.unlock(uuid)
                 this.currentUser = await directus.getCurrentUser()
                 this.syncPreferencesToLocal()
                 this.notifyListeners()