Stay logged in (desktop keyring; remembered name and server in the browser)

littlefox commented

2026-10-17 17:29:51 +00:00

Owner

Protocol A has no login tokens, so staying logged in means keeping the password somewhere.

What:

Desktop: an opt-in "Remember me" that stores the password in the system keyring (Secret Service on Linux; Keychain/Credential Manager when we have those builds). Never in a plain file.
Browser: remember the name and server only, never the password (localStorage is readable by any script on the page).
Log out forgets the stored password.
With the keyring unavailable, say so and don't offer the option.

Done when:

The desktop smoke test logs in with "Remember me", restarts the app and lands logged in (with a test keyring under dbus-run-session).
An e2e spec checks that the browser pre-fills name and server and never writes the password to storage.
DESIGN.md documents where secrets live.

From docs/ROADMAP.md, 0.2 "Feels like an app".

Protocol A has no login tokens, so staying logged in means keeping the password somewhere. What: - Desktop: an opt-in "Remember me" that stores the password in the system keyring (Secret Service on Linux; Keychain/Credential Manager when we have those builds). Never in a plain file. - Browser: remember the name and server only, never the password (localStorage is readable by any script on the page). - Log out forgets the stored password. - With the keyring unavailable, say so and don't offer the option. Done when: - The desktop smoke test logs in with "Remember me", restarts the app and lands logged in (with a test keyring under dbus-run-session). - An e2e spec checks that the browser pre-fills name and server and never writes the password to storage. - DESIGN.md documents where secrets live. From docs/ROADMAP.md, 0.2 "Feels like an app".

littlefox added this to the 0.2: Feels like an app milestone

2026-10-17 17:29:51 +00:00

littlefox added the

labels

2026-10-17 17:29:51 +00:00

littlefox commented

2026-10-17 17:32:00 +00:00

Author

Owner

Decided (D-032): "Staying logged in is good, but only where secure. Do as you suggested". So: desktop stores the password only in the system keyring, opt-in; the browser remembers name and server but never the password; no keyring, no option.

littlefox referenced this issue

2026-10-17 17:32:42 +00:00

Record D-030..D-032; 0.2 issues in the roadmap #60

littlefox referenced this issue from a commit

2026-10-17 17:32:44 +00:00

Record D-030..D-032 and put the 0.2 issues in the roadmap

littlefox referenced this issue

2026-10-17 17:54:20 +00:00

Dependency audit (cargo-deny) and update PRs #68

littlefox referenced this issue from a pull request that will close it,

2026-10-17 23:01:07 +00:00

0.2: stay logged in, soak test, installable web app, keepalive #88

littlefox closed this issue

2026-10-18 00:35:15 +00:00

littlefox referenced this issue from a commit

2026-10-18 00:35:15 +00:00

Stay logged in: keyring on the desktop, name and server in the browser

littlefox commented

2026-10-18 00:55:58 +00:00

Author

Owner

Merged in #88 (CI run #154 green). Desktop: 'Håll mig inloggad' stores the password only in the system keyring (keyring 3.6, pure-Rust Secret Service, calls on their own thread), logs in by itself next start, removed on logout. Browser: 'Kom ihåg mig i den här webbläsaren' keeps server+name only. Desktop smoke test (gnome-keyring in its own D-Bus session): stored, auto-login after restart, removed on logout, no auto-login after. remember.spec.ts checks storage holds no password.

littlefox referenced this issue

2026-10-19 10:02:37 +00:00

Refreshing web client logs user out #147

Rows
Columns

Stay logged in (desktop keyring; remembered name and server in the browser) #53