umputun / stash / 20609592819

84%

master: 84%

push

github

feat(store): add zero-knowledge client-side encryption

add optional client-side encryption where server never sees plaintext.
encryption/decryption happens entirely in Go client library using
AES-256-GCM with Argon2id key derivation. server stores opaque $ZK$ blobs.

- add ZKCrypto with Encrypt/Decrypt methods (app/store/zkcrypto.go)
- add ZKEncrypted field to KeyInfo, detect $ZK$ prefix in db.go
- add WithZKKey(passphrase) client option (lib/stash)
- web UI shows green shield icon, hides edit for ZK keys
- add e2e tests for ZK display and behavior
- document ZK encryption in README and CLAUDE.md

178 of 215 new or added lines in 5 files covered. (82.79%)

3289 of 3936 relevant lines covered (83.56%)

96.65 hits per line