web

README

IronHand Web UI

This directory contains the React/Vite frontend for IronHand.

The UI talks to the IronHand REST API under /api/v1 and is intended to be served by the Go server in production.

User flow

• Register with a passphrase; save the generated secret key (shown once, cannot be retrieved later).
• Login with passphrase + secret key.
• Optionally enable "remember secret key on this device" (uses sessionStorage, cleared when the tab closes).
• MFA setup:
  • Configure TOTP 2FA from the dashboard by scanning the QR code (or entering the secret manually); provide the one-time code on future logins.
  • Disable TOTP 2FA when no longer needed (requires a valid TOTP code).
  • Register one or more WebAuthn/passkeys for phishing-resistant second-factor login.
  • Manage passkeys: list registered passkeys, rename them, or delete individual credentials.
  • Configure passkey policy (optional or required) from auth settings.
  • Generate one-time recovery codes for account access when MFA devices are unavailable.
• Step-up authentication: sensitive operations (e.g., vault export) require re-authentication via TOTP or passkey (5-minute window).
• Create and manage vaults; vault IDs are generated by the server.
• Store items of various types: logins, notes, cards, certificates, or custom entries.
• Vault sharing: invite other users to a vault with a specific role (reader, writer, or owner) via time-limited invite links.
• Vault export/import: export all vault items as an encrypted backup; import from a backup file.
• Cross-vault search: search items by name, type, or content across all accessible vaults.
• Initialize any vault as a Certificate Authority (CA) to issue, revoke, and renew X.509 certificates.
• Download PEM-encoded certificates, private keys, CA certificates, and CRLs directly from the UI.
• View vault audit logs (who accessed or modified items, and when).

Prerequisites

• Node.js 20+ (or current LTS)
• npm 10+

Install dependencies

npm install

Run the Web UI in development

From this directory:

npm run dev

This starts Vite on http://localhost:8080.

Run backend + frontend together (recommended for local development)

1. Start the Go backend from the repository root:

go run ./cmd/ironhand server

1. In another terminal, start the Web UI dev server:

cd web
npm run dev

1. Open:

• Web UI: http://localhost:8080
• API docs: https://localhost:8443/api/v1/docs

Note: the Go server uses TLS by default (https://localhost:8443), often with a self-signed certificate in local dev.

Build for production

npm run build

Output is written to web/dist.

Preview production build locally

npm run preview

Lint

npm run lint

Documentation

Index

• func Handler(nonceFunc NonceFunc) (http.Handler, error)
• type NonceFunc

Functions

func Handler

func Handler(nonceFunc NonceFunc) (http.Handler, error)

Handler returns an http.Handler that serves the embedded SPA assets.

When nonceFunc is provided, HTML responses have a <meta name="csp-nonce" content="..."> tag injected before </head> so that client-side code can read the per-request nonce and apply it to dynamically created <style> elements.

Types

type NonceFunc

type NonceFunc func(r *http.Request) string

NonceFunc returns the per-request CSP nonce from the request context. When nil, no nonce meta tag is injected into the HTML.