kv-wasm: forget the Secret Key on logout and on any failed unlock or login

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-18 07:00:50 +09:00
parent 2e2c8cd26f
commit 1e073e1f09
4 changed files with 58 additions and 10 deletions
@@ -113,8 +113,10 @@ two replicas overwriting each other.
   the platform defaults to the OS from the user agent because the server has no `web` platform yet.
 4. **Every unlock needs the master password and Secret Key.** There is no Local Unlock Key on the
   web: nothing secret is ever written to IndexedDB, so a reload, `lock()` or closing the tab
-   leaves the vault locked. (The Secret Key that setup codes carry is kept in wasm memory while
-   unlocked and dropped on `lock()`, unlike kv-ffi, which keeps a sealed copy on disk.) Lock on idle and on `visibilitychange`/`pagehide` as the UI sees fit;
+   leaves the vault locked. The Secret Key that setup codes carry is kept in wasm memory only, set
+   after an unlock/login proved it and dropped on `lock()`, `logout()` and any failed unlock or
+   login; no getter exposes it (unlike kv-ffi, which keeps a sealed copy on disk). See
+   kestrove-spec docs/10 §5 "Web vault". Lock on idle and on `visibilitychange`/`pagehide` as the UI sees fit;
   `close()` drops the worker and every key in it.
 5. **Secrets in JS.** Master password, Secret Key and decrypted `ItemDto`s are JS strings the
   core cannot wipe. Do not keep them in long-lived state, logs or URLs. The core zeroizes its own