Complete the TUI coverage and security audit #28

New Issue

hugo · 2026-08-09T19:11:18Z

hugo commented

2026-08-09 19:11:18 +00:00

Objective

Complete the TUI feature-coverage, security and terminal-behavior audit for milestone acceptance.

Scope

Maintain a matrix mapping every base pass and pass-otp operation to a TUI element, default hotkey where required, and : command.
Exercise complete keyboard-only workflows from shared configuration through authentication, view/edit, mutation, Git synchronization, OTP and relock.
Test supported terminal sizes, color capability fallbacks, Unicode widths, paste, resize, suspension, panic restoration and slow storage operations.
Audit apps/tui for repository access, domain parsing, external processes, secret leakage, lingering plaintext and duplicated storage decisions.
Document the Mutt-inspired interaction model and concise default key reference.

Acceptance criteria

The coverage matrix has no missing base-pass or pass-otp action.
The default two-minute and configured inactivity relock flows pass with a controlled clock.
Required Rust checks and all TUI state/snapshot/integration tests pass.
apps/tui is presentation and interaction only; all password-store objects and behavior come from crates/storage.

Prerequisites

All other milestone-02 issues.

## Objective Complete the TUI feature-coverage, security and terminal-behavior audit for milestone acceptance. ## Scope - Maintain a matrix mapping every base pass and pass-otp operation to a TUI element, default hotkey where required, and `:` command. - Exercise complete keyboard-only workflows from shared configuration through authentication, view/edit, mutation, Git synchronization, OTP and relock. - Test supported terminal sizes, color capability fallbacks, Unicode widths, paste, resize, suspension, panic restoration and slow storage operations. - Audit `apps/tui` for repository access, domain parsing, external processes, secret leakage, lingering plaintext and duplicated storage decisions. - Document the Mutt-inspired interaction model and concise default key reference. ## Acceptance criteria - The coverage matrix has no missing base-pass or pass-otp action. - The default two-minute and configured inactivity relock flows pass with a controlled clock. - Required Rust checks and all TUI state/snapshot/integration tests pass. - `apps/tui` is presentation and interaction only; all password-store objects and behavior come from `crates/storage`. ## Prerequisites All other milestone-02 issues.

hugo added this to the 02 - Mutt-style terminal UI milestone 2026-08-09 19:11:18 +00:00

hugo added the enhancement label 2026-08-09 19:11:18 +00:00

hugo commented

2026-08-10 11:40:36 +00:00

Implemented and pushed in commit c263265.

Completed the TUI coverage and security audit:

Added an executable pass/pass-otp coverage matrix tied to the central action and command registries.
Implemented the missing show and generate clipboard/QR presentation paths using storage-owned typed requests and presentation objects.
Preserved generation presentation choices in the form and added authenticated show presentation dispatch.
Added bracketed-paste and focus-loss handling, including presentation cancellation and forced relock.
Added full monochrome color fallback and verified readable layout behavior across supported terminal sizes.
Proved slow storage work stays off the input thread.
Added a production-source architecture/security audit preventing repository access, domain parsing, process launch, unsafe Rust, and duplicated QR/OTP decisions in apps/tui.
Documented the Mutt-inspired model, default key reference, full operation matrix, terminal behavior, and audit evidence in apps/tui/COMMANDS.md, linked from README.md.

Review against the issue found no missing base pass or pass-otp operation. The TUI remains an interaction/presentation layer over crates/storage.

Required gates passed from the repository root:

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

The TUI suite contains 82 passing tests; the complete workspace suite and doc tests pass.

Implemented and pushed in commit c263265. Completed the TUI coverage and security audit: - Added an executable pass/pass-otp coverage matrix tied to the central action and command registries. - Implemented the missing show and generate clipboard/QR presentation paths using storage-owned typed requests and presentation objects. - Preserved generation presentation choices in the form and added authenticated show presentation dispatch. - Added bracketed-paste and focus-loss handling, including presentation cancellation and forced relock. - Added full monochrome color fallback and verified readable layout behavior across supported terminal sizes. - Proved slow storage work stays off the input thread. - Added a production-source architecture/security audit preventing repository access, domain parsing, process launch, unsafe Rust, and duplicated QR/OTP decisions in apps/tui. - Documented the Mutt-inspired model, default key reference, full operation matrix, terminal behavior, and audit evidence in apps/tui/COMMANDS.md, linked from README.md. Review against the issue found no missing base pass or pass-otp operation. The TUI remains an interaction/presentation layer over crates/storage. Required gates passed from the repository root: - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace The TUI suite contains 82 passing tests; the complete workspace suite and doc tests pass.

hugo closed this issue

2026-08-10 11:40:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#28