Security Stance

Mini Diarium — Security Stance

The opinionated, repo-specific security/privacy/encryption stance for Mini Diarium. Use this skill alongside (not instead of) /security-review. This document is passive context that loads whenever security-adjacent work appears; /security-review is a one-shot review command.

The authoritative sources are PHILOSOPHY.md and SECURITY.md. This skill distills the operational details: invariants, file:line anchors, footguns, and what-breaks-if-you-change-this. When this document and an authoritative source disagree, the source wins — file an update to this skill.

1. When to load this skill

Load when work touches any of:

• Crypto: crates/mini-diarium-crypto/src/crypto/cipher.rs, crates/mini-diarium-crypto/src/crypto/password.rs
• Auth: crates/mini-diarium-core/src/auth/mod.rs (composed slot ops + AuthMethodInfo), crates/mini-diarium-crypto/src/auth/{password,keypair,auto_key}.rs (the pure wrapping methods), src-tauri/src/commands/auth/
• IPC contract: src/lib/tauri/, src/lib/errors.ts, any new #[tauri::command]
• Auto-lock paths: src/App.tsx idle timer, src-tauri/src/screen_lock.rs, src/lib/focus-lock.ts, src-tauri/src/window_focus.rs, src/lib/dialog.ts
• DB schema / migrations: crates/mini-diarium-core/src/db/schema/mod.rs (SCHEMA_VERSION), crates/mini-diarium-core/src/db/schema/compat.rs (forward-compatibility guard), crates/mini-diarium-core/src/db/schema/migrations/
• Backups & rotation: crates/mini-diarium-core/src/backup.rs
• Journal config: crates/mini-diarium-core/src/config.rs (JournalConfig, auto_key, require_all_auth)
• Import / export: src-tauri/src/commands/import.rs, commands/export.rs, import/*.rs, export/*.rs
• Plugin sandbox: crates/mini-diarium-core/src/plugin/rhai_loader/ (runtime.rs = engine + limits, metadata.rs, mod.rs = loader), plugin/registry.rs, plugin/builtins.rs
• Search interface (preserved stub): src-tauri/src/commands/search.rs, src/state/search.ts, src/components/search/
• Debug dump: src-tauri/src/commands/debug.rs
• File-read commands & allowlists: src-tauri/src/commands/files.rs
• Tauri capabilities: src-tauri/capabilities/*.json
• CSP: src-tauri/tauri.conf.json (security.csp, dangerousDisableAssetCspModification)
• Network isolation: src-tauri/src/lib.rs (init script, on_navigation, on_new_window, Windows COM handler, macOS WKContentRuleList handler); src/lib/network-isolation-script.ts (TS copy — must stay in sync with Rust)
• E2E env-var isolation: src-tauri/src/lib.rs (MINI_DIARIUM_E2E*)
• Sanitization of imported HTML/Markdown: src/lib/markdown.ts (DOMPurify)
• Anything involving passwords, keys, nonces, zeroization, or persistence of entry content

Examples

• Adding a new Tauri command that touches entries / files / auth / plugins → load
• Pure CSS-only change, i18n string addition, README typo → do not load
• Reviewing/proposing new features → load to apply the six principles + five non-negotiables

2. The five non-negotiables (absolute invariants)

From PHILOSOPHY.md:165-169. These are not preferences — they are red lines.

If an agent proposes a change that visibly conflicts with any non-negotiable: STOP. Surface the conflict to the user. Do not implement, even partially.

3. Threat model at a glance

Compact form of SECURITY.md:30-43. This is the "what can I honestly promise?" cheat sheet.

4. Crypto invariants (concrete numbers, not principles)

Rule for any change to a row in this table:

1. Schema migration with SCHEMA_VERSION bump in db/schema/mod.rs.
2. Explicit ### Security section in the next CHANGELOG entry, plus user-facing notes.
3. SECURITY.md update if the threat model shifts.
4. Stop and confirm with the user before silently "upgrading" parameters.

5. Auth architecture

A random 256-bit master key is generated at journal creation (db/schema/create.rs). It encrypts every entry field with AES-256-GCM. The master key itself is never stored in plaintext — it is wrapped per registered auth slot in the auth_slots table (schema v3+). See SECURITY.md:47-69.

Three wrap methods exist:

Hard rules:

• change_password is O(1): re-wraps the master key only. Never re-encrypt entries on password change — that conversation always ends in a production bug. See SECURITY.md:61.
• remove_auth_method refuses to delete the last slot. That guard lives at src-tauri/src/commands/auth/auth_methods.rs:197+. Never remove or weaken it. Removing the only auth method = unrecoverable journal.
• require_all_auth (per journal) forces unlock_diary_all_methods. Single-method unlock paths must keep the guard. The guard lives in commands/auth/auth_core.rs:80-90 and again at :136-146 (one per single-method unlock path). When adding a new single-method unlock path, add the guard there too.
• Passwordless (AutoKeyMethod) is accepted per docs/decisions/2026-04-passwordless-journal.md. Trade-off: OS-account compromise = journal compromise. The UI surfaces this via an explicit acknowledgement checkbox in PasswordCreation.tsx. The auto_key hex must stay in config.json — moving it into the DB creates a decryption circularity (you would need the key to decrypt the key).
• Master-key returns travel as SecretBytes (crates/mini-diarium-crypto/src/auth/mod.rs:21-53) so they zeroize on drop even if the caller forgets.
• Both success and error paths zeroize. Wrong-password code paths must also call .zeroize() on derived wrapping keys. See crypto/password.rs:60 (success) and :103 (error).

6. Auto-lock: all three paths must fire

Auto-lock is a triple-path mechanism. A change to one path is implicitly a change to all three — the agent must verify the other two still work.

Path A — Frontend idle timer (src/App.tsx:20-55)

• Tracks user activity events: mousemove, keydown, click, touchstart, scroll (App.tsx:22).
• After autoLockTimeout seconds of inactivity, calls lockJournal() (App.tsx:42).
• Cleanup in onCleanup removes listeners and clears the timer (App.tsx:48-54).
• Controlled by autoLockEnabled + autoLockTimeout preferences.

Path B — Backend OS events (src-tauri/src/screen_lock.rs)

• Windows: WM_WTSSESSION_CHANGE (lock/logoff) + WM_POWERBROADCAST (suspend) via Win32 subclass (screen_lock.rs:1-100).
• macOS: screen-sleep + com.apple.screenIsLocked notifications.
• Both call commands::auth::auto_lock_diary_if_unlocked(...) (screen_lock.rs:79, :208) and emit 'journal-locked'.
• Fires even when the app is in the background.

Path C — Frontend focus-loss lock (src/lib/focus-lock.ts + src-tauri/src/window_focus.rs, wired in App.tsx)

• Not DOM visibilitychange — the original design, disproven by manual testing (TODO-0068): WebView2 does not reliably update document.visibilityState on window minimize (confirmed with the CDP debugger fully detached, ruling out an automation-tooling confound).
• Detection lives in Rust (window_focus.rs): on_window_event on WindowEvent::Focused, emitting "window-unfocused" (false) / "window-focused" (true). A single push-based event pair covers minimize, Alt+Tab/Cmd+Tab away, clicking another app's window, and (on macOS) Cmd+H "Hide" — all of these resign/regain the window's key/active status at the OS level: WM_KILLFOCUS/WM_NCACTIVATE (Windows), windowDidResignKey (macOS — its own doc comment in tao explicitly calls out the Cmd+Tab case), GTK focus-out-event (Linux, forwarded as a genuine WindowEvent unlike minimize/iconify, which GTK only tracks internally). No polling needed — this superseded an earlier is_minimized()-polling design once source inspection confirmed Focused is reliably forwarded on all three platforms.
• Debounced, not immediate (FOCUS_LOSS_DEBOUNCE_MS, focus-lock.ts, default 3000ms, parametrized as an options.debounceMs field so it's overridable in tests and easy to retune): user feedback after shipping the immediate-lock version reported that a misclick outside the window locked the journal instantly, which was too aggressive. window-unfocused now starts a setTimeout instead of locking; window-focused clears it. isDialogOpen() and isUnlocked() are (re-)checked when the timer actually fires, not at the initial event, since either can change during the debounce window.
• Design iteration history: (1) frontend-only visibilitychange/blur — disproven, WebView2 doesn't fire it reliably on minimize; (2) Rust is_minimized() polling + a macOS-specific NSApplication.isHidden poll for Cmd+H — replaced because it missed alt-tab/click-away entirely, which the user confirmed was undesired (intent is "lock on any focus loss"); (3) WindowEvent::Focused(false)-only, immediate lock — replaced after the user reported it was too aggressive (locks on a misclick); (4) current: Focused(false)/Focused(true) pair + debounce.
• Native dialogs (export/import/key-file save) also resign the main window's focus the same way real focus-loss does. src/lib/dialog.ts wraps open/save/confirm from @tauri-apps/plugin-dialog with a shared open-dialog counter (isDialogOpen()); focus-lock.ts checks it when the debounce fires. Every dialog call site must import from dialog.ts, never the plugin directly — src/CLAUDE.md gotcha #10 — or it reopens the false-positive gap. A dialog that closes within the debounce window also self-cancels via the window-focused event when focus returns to the main window.
• Reschedule, not abandon, when the debounce fires while isDialogOpen() is true (Task 3.5 of docs/archive/project-support-overlay-plan.md, 2026-08-21): the debounce check used to return outright when isDialogOpen() was true at fire time, which meant a dialog left open longer than the debounce window disabled the lock for the rest of that open period, however long. It now reschedules itself (scheduleCheck) and re-checks every debounceMs until isDialogOpen() returns false, at which point it locks if the window is still unfocused and the journal is still unlocked — the lock is delayed, not skipped. dialog.ts's openUrlSuppressingFocusLoss() (added by the same task, used only by ProjectSupportOverlay's external-link buttons) is a second, time-bounded producer of isDialogOpen() === true: it increments the same counter for a fixed EXTERNAL_HANDOFF_SUPPRESS_MS (3500ms, kept in dialog.ts and hand-synced to stay strictly greater than FOCUS_LOSS_DEBOUNCE_MS to avoid a circular import) rather than for a dialog's actual open/close lifetime, since openUrl() resolves immediately and there is no promise to await for the browser handoff itself.
• Known gap: the dialog guard only covers the app's own dialogs. It does not cover the native menu bar, OS notifications, or other focus-stealers outside the app's own dialog call sites. Closing that fully would need a "does the newly-focused window belong to our own process" check, which is unreliable on Linux/Wayland — the same class of problem that broke the visibilitychange design. Not attempted; flagged as a known limitation instead.
• Frontend (focus-lock.ts) listens for "window-unfocused"/"window-focused" via @tauri-apps/api/event's listen() and calls lockJournal() when the debounce timer fires, autoLockOnFocusLoss is enabled (preferences.ts, default false), the journal is still unlocked, and isDialogOpen() is false.
• Guarded multiple ways: the wiring createEffect only registers both listeners while enabled() && isUnlocked() (cleaning up both unlisten fns and any pending debounce timer — including handling the case where disposal races the pending listen() promise — when either goes false); window-focused cancels a pending debounce as the primary "don't lock" path; isDialogOpen()/isUnlocked() are re-checked at fire time as defense-in-depth.
• The Rust handler runs for the app's lifetime regardless of the preference — it only emits events; the frontend decides whether to act on them. Keeps Rust free of preference/lock-state/timing awareness, consistent with preferences.ts being frontend/localStorage-only.

Frontend listener (src/state/auth.ts:240-263)

• setupAuthEventListeners() listens for 'journal-locking' (pre-lock cleanup) and 'journal-locked' (post-lock state reset).
• Wired in App.tsx on mount.

Checklist for any change here:

• If you touched App.tsx, did backend OS lock (Path B) and the focus-loss lock (Path C) still result in a clean UI lock?
• If you touched screen_lock.rs, did the idle-timer path (Path A) and the focus-loss lock (Path C) still call lockJournal cleanly?
• If you touched focus-lock.ts, did the idle-timer path (Path A) and backend OS lock (Path B) still fire independently?
• Did the 'journal-locked' event still propagate?
• Were the platform-specific Win32 / macOS code paths preserved?
• If you added a new native dialog call site, does it import open/save/confirm from src/lib/dialog.ts (not @tauri-apps/plugin-dialog directly)? A direct import reopens the false-positive-lock gap Path C's dialog guard exists to close.

7. The IPC / error sanitization boundary

• Every Tauri invoke() failure that reaches user-visible UI must go through mapTauriError(err, t) from src/lib/errors.ts:13-51.
• What it strips: filesystem paths, OS error codes (os error N), rusqlite/sqlite/argon2 internals.
• What it passes through verbatim: already-user-friendly strings ("file is too large", wrong-password messages — see the regex matches at errors.ts:17-32).
• Call sites that may omit the translator argument t: module-level state (e.g., src/state/auth.ts) where no i18n context is available — mapTauriError falls back to defaultT (English) per the JSDoc at errors.ts:7-12. Those errors go to an error signal, not raw display.

Red flag patterns to grep for during review:

catch { setError(err.toString()) }
catch { setError(err.message) }
catch (err) { setError(String(err)) }

Any of these without mapTauriError is a bug. Fix at the call site.

Useful grep:

invoke\(|from '@tauri-apps/api'

For each match, confirm the surrounding catch block routes through mapTauriError. See src/CLAUDE.md "Error Handling" for the canonical pattern.

8. Data-at-rest rules

Reconciliation: auto_key in config.json vs. "no plaintext on disk"

The non-negotiable from PHILOSOPHY.md:166 is about diary content, not wrapping keys. auto_key is a 32-byte random AES wrapping key; the entries it wraps remain AES-256-GCM ciphertext on disk. The ADR (docs/decisions/2026-04-passwordless-journal.md:38-40) makes this explicit. Do not "fix" this by moving plaintext entries somewhere else, or by removing auto_key. The trade-off is documented and acknowledged in the UI.

WAL-mode caveat: SQLite is in default journal mode (DELETE), not WAL. fs::copy is therefore safe (backup.rs:22-28). A backup taken mid-write could theoretically capture a partial transaction; documented in SECURITY.md:87-88. Switching to WAL requires switching backups to the SQLite Online Backup API at the same time.

9. Search: in-memory scan (no plaintext on disk)

FTS was removed in v0.2.0 (schema v4) because the plaintext entries_fts table defeated encryption at rest. Search was reintroduced as an in-memory scan: each query decrypts entries (same decrypt path as export/stats), matches case- and accent-folded terms, builds HTML-escaped <mark> snippets, and discards everything. Nothing searchable is written to disk. Do not delete any of these:

Constraints for any future implementation (non-negotiable):

1. No plaintext on disk. Encrypted index, or in-memory rebuilt at unlock, or SQLCipher-style encrypted FTS. Do not reintroduce a plaintext FTS5 table.
2. Schema migration required. Bump SCHEMA_VERSION in db/schema/mod.rs, add a migration step, and decide min_reader_version (db/schema/compat.rs).
3. All reindex hooks wired. Every // Search index hook: site must call into the new module.
4. UI placement is undecided. Wire SearchBar/SearchResults into Sidebar.tsx or a new component; do not assume the old layout. See src-tauri/CLAUDE.md "Implementing Search" for the design constraints.