Skip to content

ELECTRON_MIGRATION.md

Latest commit

 

History

History
127 lines (97 loc) · 4.26 KB

ELECTRON_MIGRATION.md

File metadata and controls

127 lines (97 loc) · 4.26 KB
Raw

Electron Migration - Alby to Local Key Import

Overview

When we moved from Alby browser extension to local key import for Electron, multiple systems needed updates. This document tracks all the changes required and their current status.

Key Architecture Changes

Before (Alby-only)

  • Authentication: Browser extension (Alby) via NIP-07
  • Key Storage: Managed by browser extension
  • User Tracking: Based on Alby public key
  • API Headers: Only sent Alby pubkey

After (Electron + Alby)

  • Authentication: Dual support (Alby in browser, local import in Electron)
  • Key Storage: Encrypted local storage with AES-256
  • User Tracking: Works with both Alby and Electron keys
  • API Headers: Sends pubkey from either source

Components That Required Updates

✅ COMPLETED

  1. Key Management (/components/nostr/electron-key-manager.tsx)

    • Created new component for key import/management
    • Added encryption with KeyEncryption class
    • Proper nsec/hex format handling

  2. Encryption (/lib/crypto-utils.ts)

    • Implemented AES-256-GCM encryption
    • Device-specific encryption keys
    • Session storage for decrypted keys

  3. Nostr Service (/lib/nostr-electron.ts)

    • Created Electron-specific Nostr service
    • Handles encrypted key loading
    • Signs events locally
    • Migration from old unencrypted format

  4. API Client (/lib/api-client.ts)

    • Updated to check Electron keys first
    • Falls back to Alby if no Electron key
    • Sends proper pubkey header for user tracking

  5. Main Page (/app/page.tsx)

    • Added hasNostrAccess variable (Alby OR Electron)
    • Updated all isConnected checks
    • Fixed download form enablement
    • Updated messaging for Electron

  6. Content List (/components/content/content-list.tsx)

    • Added Electron key detection
    • Updated empty states with proper messaging
    • Added "Back" button for key import navigation
    • Fixed Nostr posting to use local signing

  7. Gallery Page (/app/gallery/page.tsx)

    • Uses updated ContentList with proper auth detection

  8. Unified Auth Section (/components/auth/unified-auth-section.tsx)

    • Shows ElectronKeyManager in Electron
    • Shows Alby connection in browser

  9. Nostr Context (/context/nostr-context.tsx)

    • Added Electron detection and key checking
    • Dual support for both auth methods
    • Proper npub formatting for both

  10. Connection Status (/components/nostr/connection-status.tsx)

    • Different messaging for Electron ("Nostr Key Active")
    • Hide disconnect button in Electron (keys managed differently)

  11. API Routes (/app/api/nostr/post/route.ts)

    • Accepts pre-signed events from Electron
    • Publishes without needing server-side key

⚠️ AREAS THAT MAY NEED REVIEW

  1. Other API Routes

    • Check all routes properly handle Electron pubkey headers
    • Ensure consistent user ID handling

  2. Error Messages

    • Review all error messages mentioning "Alby"
    • Update to be platform-appropriate

  3. Documentation

    • Update user guides for Electron key import
    • Document security model

Testing Checklist

  • Key import works in Electron
  • Encrypted storage verified
  • Download form enables with imported key
  • Gallery shows content with imported key
  • API requests include proper pubkey header
  • Content associated with user's pubkey
  • Nostr posting works with imported key
  • Full end-to-end test in production build
  • Cross-platform testing (Windows, macOS, Linux)

Security Considerations

  1. Key Storage

    • Keys encrypted with AES-256-GCM
    • Device-specific encryption (not portable)
    • Session storage for temporary decrypted access

  2. Privacy

    • Keys never sent to server
    • All signing happens locally
    • Clear messaging about security

Lessons Learned

  1. Always do comprehensive impact analysis when changing authentication systems
  2. User tracking systems need to be authentication-agnostic
  3. Dual support requires careful context checking throughout the app
  4. Clear messaging is critical when security models differ between platforms

Future Improvements

  1. Consider unified key management interface
  2. Add key backup/export functionality
  3. Implement key rotation support
  4. Add multi-key support for advanced users