No description
7a641dec00
Introduces a wrapped-DEK recovery model so a forgotten password doesn't lose all encrypted data. The encryption key becomes a random DEK (not derived from the password); the DEK is wrapped under both a password-derived KEK and a recovery-phrase-derived KEK, and both wrapped forms are stored on the server. Crypto (crypto/keys.ts): - DEK generation (random AES-256-GCM), KEK derivation (PBKDF2 password/recovery), wrapDek/unwrapDek/rewrapDek. - setupEncryption(password, recoveryPhrase?) — generates a DEK, wraps under both KEKs, returns wrapped forms + recovery proof. - unlockWithPassword(password, wrappedDek) — derives password KEK, unwraps DEK. - unlockWithRecovery(phrase, wrappedDek) — derives recovery KEK, unwraps DEK. Backend: - User model: wrapped_dek, wrapped_dek_iv, recovery_wrapped_dek, recovery_wrapped_dek_iv fields. - RegisterRequest accepts wrapped-DEK fields; stored verbatim. - AuthResponse returns wrapped_dek + wrapped_dek_iv (for login unwrapping). - New GET /api/auth/recovery-info?email= — returns recovery-wrapped DEK. - RecoverPasswordRequest gains new_wrapped_dek + new_wrapped_dek_iv. - change-password also accepts + stores re-wrapped DEK. Frontend: - Auth store: login unwraps DEK from response; new recover() action fetches recovery-wrapped DEK, unwraps with phrase, re-wraps under new password. - RecoveryPage (new): email + recovery phrase + new password flow. - LoginPage: 'Forgot password? Recover' link. App.tsx: /recover route. Verified: backend 21 tests, 0 warnings; frontend build clean, 20 tests. |
||
|---|---|---|
| .forgejo/workflows | ||
| backend | ||
| docs | ||
| scripts | ||
| web/normogen-web | ||
| .cursorrules | ||
| .gitignore | ||
| .gooserules | ||
| README.md | ||
Normogen
Normogen (Mapudungun for "Balanced Life") is an open-source health data platform for private, secure health data management.
📚 Documentation
All project documentation has been organized into the docs/ directory:
- Documentation Index - Start here for complete documentation
- Product Overview - Project introduction and features
- Quick Start - Get started quickly
- API Documentation - Backend API reference
🚀 Quick Start
# Clone repository
git clone <forgejo-url> normogen
cd normogen/backend
# Setup configuration
cp .env.example .env
# Edit .env with your values
# Run with Docker Compose
docker compose up -d
# Check status (default port is 6500 via NORMOGEN_PORT; Solaria maps it to host 6800)
curl http://localhost:6500/health
📊 Current Status
- Backend: ✅ Phase 2.x feature-complete (Rust + Axum + MongoDB), including drug interactions (Phase 2.8). Security-hardened: token-version validation, hashed refresh-token persistence, fail-fast config, real-IP audit logging. Deployed on Solaria.
- Frontend: 🚧 Early (React + TypeScript) — Login/Register pages + API/store layer exist; router not yet wired.
- Tests: 18 unit + 13 integration (auth + medication), CI-gated with MongoDB.
- Deployment: Docker on Solaria (image built manually — CI can't run DinD on Forgejo).
- See docs/product/STATUS.md for the full breakdown.
🗂️ Documentation Structure
docs/
├── product/ # Product definition, features, roadmap
├── implementation/ # Phase plans, specs, progress reports
├── testing/ # Test scripts and results
├── deployment/ # Deployment guides and scripts
├── development/ # Git workflow, CI/CD, development tools
└── archive/ # Historical documentation
📖 Full Documentation
See the Documentation Index for complete project documentation.
Last Updated: 2026-06-27