Skip to content

Harden password verification and improve media and QR flows#23

Merged
BackGwa merged 19 commits intomainfrom
develop
Jan 13, 2026
Merged

Harden password verification and improve media and QR flows#23
BackGwa merged 19 commits intomainfrom
develop

Conversation

@BackGwa
Copy link
Owner

@BackGwa BackGwa commented Jan 13, 2026

Description

Upgrades password-protected sessions to use nonce-based HMAC proofs (no password hash transmitted), improves peer/QR module loading, and adds reliable stream-end cleanup. Also includes landing-page UX/accessibility tweaks and documentation/config updates.

Type of Change

  • Bug fix (bugs/)
  • New feature (features/)
  • Refactoring (refactor/)
  • Hotfix (hotfix/)
  • Chore (chore/)

Changes Made

  • Introduced nonce-based HMAC password proof flow and updated verification handling.
  • Added stream-ended handling and video cleanup; improved device enumeration cache behavior.
  • Lazy-loaded PeerJS/QR components and refined join flow; updated docs and env examples.

Checklist

  • Code follows the project's coding style
  • Self-review completed
  • Documentation updated (if necessary)

- Deleted PageTransition.tsx and related SCSS.
- Centralized password validation errors in PasswordInput component.
- Simplified MediaService and PeerService by removing redundant methods.
- Streamlined usePasswordProtection and usePasswordVerification hooks.
- Consolidated type definitions for Media and Peer connections.
- Clear video stream on unmount to prevent memory leaks.
- Use type imports for PeerJS to optimize build size.
- Cache camera devices in mediaService for reduced latency.
- Optimize QR scan by caching canvas context per video element.
- Removed `useEffect` from `usePasswordVerification` in favor of `useCallback` for better performance.
- Switched from direct state mutation to `useRef` for persistent variables like `tempPeerForVerification`.
- Simplified password message handling with `handlePasswordMessage`.
- Removed unnecessary `hostPeerId` parameter and validation logic for cleaner implementation.
- Updated README with new badge placement for improved visibility.
- Removed redundant connection validation steps in diagrams.
- Added spacing adjustments to README for better readability.
Streamline join flow, error messaging, and client cleanup
- Convert to dynamic importing for QRCodeSVG component
  in `QRSharePanel` for improved loading time.
- Switch `usePeerConnection` to async initialization with
  error handling enhancements for peer setup.
- Refactor `peerService` to use dynamic imports for PeerJS, optimizing
  initial load with a cached promise.
- Modify `qrScanner` to dynamically import `jsqr`, adding scan lock to
  manage concurrent QR scan requests more effectively.
Improve Peer initialization with config constants
Split heavy peer/QR dependencies with dynamic imports
- Implement HMAC-based password verification for added security.
- Introduce nonce generation for request-response integrity.
- Provide legacy support for non-HMAC clients.
- Optimize password hashing and add error handling.
- Implement HMAC-based password proof for improved security.
- Remove legacy support for non-HMAC password handling.
- Update sequence diagrams in ARCHITECTURE.md for clarity.
- Add error handling for missing nonce in proof creation.
- Simplify related code in hooks and type definitions.
Enforce nonce-based HMAC password verification
- Added `onStreamEnded` callback to `useMediaStream` to handle video track end events.
- Updated `useMediaStream` and `HostPage` to manage navigation on stream end.
- Refactored stream end logic for improved clarity and maintenance.
Handle stream end events to stop sharing automatically
Add a main landmark on the landing page and set empty alt text on decorative images for clearer screen reader behavior.
@BackGwa BackGwa added bug Something isn't working documentation Improvements or additions to documentation enhancement New feature or request labels Jan 13, 2026
@BackGwa BackGwa merged commit 589e625 into main Jan 13, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working documentation Improvements or additions to documentation enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant