Savestate: Fix sync settings overwrite bug and persist crypto key in sessionStorage

dev-dist/sw.js

@@ -81,7 +81,7 @@ define(['./workbox-7e5eb42b'], (function (workbox) { 'use strict';
     "revision": "3ca0b8505b4bec776b69afdba2768812"
   }, {
     "url": "index.html",
-    "revision": "0.3e92u8tignc"
+    "revision": "0.ch9b1jd5754"
   }], {});
   workbox.cleanupOutdatedCaches();
   workbox.registerRoute(new workbox.NavigationRoute(workbox.createHandlerBoundToURL("index.html"), {

dynamischer Name.txt

@@ -2,9 +2,17 @@ farbverlauf
 
 nur bilder absenden können
 
+Database Password: #8BA2V*d4xtPzzv
+
 Enter
 
-wissensammeln --> persönliche news
+meine Themen (Entdecken Sektion)
+
+Account system
+
+wissensammeln --> persönliche News
+
+open router: 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
 
 groq: 
 

src/app.js

@@ -189,6 +189,7 @@ window.copyToClipboard = async (text, btnElement) => {
 const initApp = async () => {
   // Wait for auth to initialize
   await authService.initialize();
+  await syncManager.initialize();
 
   // Scale up UI on web (HuggingFace) to match Capacitor native scale
   const isNative = window.Capacitor && window.Capacitor.isNativePlatform && window.Capacitor.isNativePlatform();

src/services/auth-service.js

@@ -32,8 +32,8 @@ class AuthService {
       // If the crypto key is null, the UI should prompt the user to "Unlock" their data
       // by entering their password again, OR we can try to store the derived key in sessionStorage
       // (not localStorage!) so it survives page reloads but dies when the tab closes.
-      const storedKey = sessionStorage.getItem('schoolmind_temp_key_marker');
-      if (!storedKey) {
+      const restored = await cryptoService.restoreKey();
+      if (!restored) {
         // App will need to ask for password to unlock
         console.warn('Session active, but crypto key missing. Needs unlock.');
       }

src/services/crypto-service.js

@@ -29,10 +29,15 @@ class CryptoService {
       },
       keyMaterial,
       { name: 'AES-GCM', length: 256 },
-      false,
+      true, // make extractable to store in sessionStorage
       ['encrypt', 'decrypt']
     );
     
+    // Store in sessionStorage (survives reload, dies on tab close)
+    const rawKey = await crypto.subtle.exportKey('raw', this.key);
+    const base64Key = btoa(String.fromCharCode(...new Uint8Array(rawKey)));
+    sessionStorage.setItem('schoolmind_session_key', base64Key);
+    
     return true;
   }
 
@@ -93,8 +98,32 @@ class CryptoService {
     }
   }
   
+  async restoreKey() {
+    const base64Key = sessionStorage.getItem('schoolmind_session_key');
+    if (!base64Key) return false;
+    try {
+      const binaryString = atob(base64Key);
+      const bytes = new Uint8Array(binaryString.length);
+      for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+      }
+      this.key = await crypto.subtle.importKey(
+        'raw',
+        bytes,
+        { name: 'AES-GCM', length: 256 },
+        true,
+        ['encrypt', 'decrypt']
+      );
+      return true;
+    } catch (e) {
+      console.error('Failed to restore crypto key:', e);
+      return false;
+    }
+  }
+
   clearKey() {
     this.key = null;
+    sessionStorage.removeItem('schoolmind_session_key');
   }
 
   // --- Utility functions ---

src/services/sync-service.js

@@ -19,6 +19,13 @@ class SyncManager {
     });
   }
 
+  async initialize() {
+    // Called once on app startup to trigger initial sync if already logged in
+    if (authService.user && authService.isCryptoUnlocked()) {
+      this.sync();
+    }
+  }
+
   async sync() {
     if (!authService.user || !authService.isCryptoUnlocked() || this.isSyncing) return;
     this.isSyncing = true;
@@ -51,10 +58,6 @@ class SyncManager {
       
     if (error) throw error;
 
-    // We merge remote into local if remote updated_at > local, but sqlite doesn't have updated_at for settings.
-    // For now, we prefer local over remote if local has a valid API key, otherwise pull remote.
-    // Easiest sync strategy: Push all local to remote if local exists, else pull from remote.
-    
     const remoteSettingsMap = {};
     if (remoteSettings) {
       for (const row of remoteSettings) {
@@ -62,6 +65,23 @@ class SyncManager {
       }
     }
 
+    // Check if local settings is effectively empty (only defaults, no api keys)
+    const hasLocalApiKey = localSettings.some(r => r.key.includes('api_key') && r.value && r.value.trim().length > 0);
+    const hasRemoteApiKey = Object.keys(remoteSettingsMap).some(k => k.includes('api_key') && remoteSettingsMap[k] && remoteSettingsMap[k].trim().length > 0);
+
+    // If local has no API keys, but remote has some, we assume this is a NEW login on a new device.
+    // In this case, we DO NOT push our local defaults to remote. We just pull from remote.
+    if (!hasLocalApiKey && hasRemoteApiKey) {
+      for (const key of Object.keys(remoteSettingsMap)) {
+        if (remoteSettingsMap[key]) {
+          db.setSetting(key, remoteSettingsMap[key]);
+        }
+      }
+      return; // Skip pushing to remote
+    }
+
+    // Otherwise, push local to remote
+
     for (const row of localSettings) {
       const encryptedValue = await cryptoService.encrypt(row.value);
       await supabase.from('settings').upsert({

vite.config.js

@@ -30,7 +30,7 @@ export default defineConfig({
     VitePWA({
       registerType: 'autoUpdate',
       devOptions: {
-        enabled: true
+        enabled: false
       },
       workbox: {
         skipWaiting: true,