add pinvault app

Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libsqlcipher-dev sqlcipher gcc python3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+
+RUN mkdir -p /data
+EXPOSE 8765
+
+CMD ["gunicorn", "-b", "0.0.0.0:8765", "--timeout", "120", "app:app"]

app.py

@@ -0,0 +1,435 @@
+from flask import Flask, render_template, request, jsonify
+import hashlib
+import os
+import random
+import secrets
+import shutil
+import string
+import threading
+from datetime import datetime, timedelta, timezone
+
+import pysqlcipher3.dbapi2 as sqlcipher
+
+app = Flask(__name__)
+app.secret_key = secrets.token_hex(32)
+
+DB_PATH = os.environ.get("PINVAULT_DB", "/data/pinvault.db")
+LOCAL_BACKUP_DIR = "/data/backups"
+NAS_BACKUP_DIR = "/mnt/aidata/pinvault"
+BACKUP_INTERVAL = 3600
+MAX_BACKUPS = 168
+RECOVERY_CODE_COUNT = 4
+RECOVERY_CODE_LENGTH = 64
+ALPHANUMERIC = string.ascii_letters + string.digits
+
+
+def dict_factory(cursor, row):
+    d = {}
+    for idx, col in enumerate(cursor.description):
+        d[col[0]] = row[idx]
+    return d
+
+
+def _derive_sqlcipher_key(bcrypt_hash: str) -> str:
+    return hashlib.sha256(bcrypt_hash.encode()).hexdigest()[:64]
+
+
+def get_conn():
+    conn = sqlcipher.connect(DB_PATH)
+    conn.row_factory = dict_factory
+    conn.execute(f'PRAGMA key = "{app.master_key}"')
+    conn.execute("PRAGMA journal_mode=WAL")
+    conn.execute("SELECT count(*) FROM sqlite_master")
+    return conn
+
+
+def hash_val(value):
+    return hashlib.sha256(value.encode()).hexdigest()
+
+
+def generate_recovery_code():
+    return "".join(secrets.choice(ALPHANUMERIC) for _ in range(RECOVERY_CODE_LENGTH))
+
+
+def now_utc():
+    return datetime.now(timezone.utc)
+
+
+def init_db():
+    with get_conn() as conn:
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS pins (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                label TEXT NOT NULL DEFAULT '',
+                pin_hash TEXT NOT NULL,
+                created_at TEXT NOT NULL,
+                lock_until TEXT NOT NULL,
+                bypassed_count INTEGER NOT NULL DEFAULT 0,
+                revealed INTEGER NOT NULL DEFAULT 0
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS recovery_codes (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                pin_id INTEGER NOT NULL,
+                code_hash TEXT NOT NULL,
+                used INTEGER NOT NULL DEFAULT 0,
+                FOREIGN KEY (pin_id) REFERENCES pins(id)
+            )
+        """)
+        try:
+            conn.execute("ALTER TABLE pins ADD COLUMN revealed INTEGER NOT NULL DEFAULT 0")
+            conn.commit()
+        except Exception:
+            pass
+
+
+def _backup_db(dest_path: str) -> bool:
+    try:
+        shutil.copy2(DB_PATH, dest_path)
+        return True
+    except Exception:
+        if os.path.exists(dest_path):
+            os.remove(dest_path)
+        return False
+
+
+def _cleanup_backups(directory: str):
+    try:
+        files = sorted(
+            [f for f in os.listdir(directory) if f.startswith("pinvault-backup-") and f.endswith(".db")],
+            reverse=True,
+        )
+        for old in files[MAX_BACKUPS:]:
+            os.remove(os.path.join(directory, old))
+    except Exception:
+        pass
+
+
+def _do_backup():
+    ts = now_utc().strftime("%Y%m%d-%H%M%S")
+    filename = f"pinvault-backup-{ts}.db"
+
+    os.makedirs(LOCAL_BACKUP_DIR, exist_ok=True)
+    os.makedirs(NAS_BACKUP_DIR, exist_ok=True)
+
+    local_path = os.path.join(LOCAL_BACKUP_DIR, filename)
+    nas_path = os.path.join(NAS_BACKUP_DIR, filename)
+
+    ok = _backup_db(local_path)
+    if ok:
+        shutil.copy2(local_path, nas_path)
+        _cleanup_backups(LOCAL_BACKUP_DIR)
+        _cleanup_backups(NAS_BACKUP_DIR)
+        return ok
+    return False
+
+
+def _backup_loop():
+    while True:
+        _do_backup()
+        timer = threading.Timer(BACKUP_INTERVAL, _backup_loop)
+        timer.daemon = True
+        timer.start()
+        break
+
+
+def _get_backup_list():
+    result = []
+    for d in [LOCAL_BACKUP_DIR, NAS_BACKUP_DIR]:
+        location = "local" if d == LOCAL_BACKUP_DIR else "nas"
+        try:
+            for f in sorted(os.listdir(d)):
+                if f.startswith("pinvault-backup-") and f.endswith(".db"):
+                    path = os.path.join(d, f)
+                    size = os.path.getsize(path)
+                    mtime = datetime.fromtimestamp(os.path.getmtime(path), tz=timezone.utc)
+                    result.append({
+                        "filename": f,
+                        "location": location,
+                        "size": size,
+                        "created": mtime.isoformat(),
+                    })
+        except Exception:
+            pass
+    return sorted(result, key=lambda x: x["created"], reverse=True)
+
+
+@app.route("/")
+def index():
+    return render_template("index.html")
+
+
+@app.route("/api/status", methods=["GET"])
+def api_status():
+    return jsonify({"locked": not getattr(app, "master_key", None)})
+
+
+@app.route("/api/backups", methods=["GET"])
+def api_list_backups():
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    return jsonify(_get_backup_list())
+
+
+@app.route("/api/backups", methods=["POST"])
+def api_trigger_backup():
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    ok = _do_backup()
+    return jsonify({"ok": ok, "backups": _get_backup_list()})
+
+
+@app.route("/api/backups/<filename>/restore", methods=["POST"])
+def api_restore_backup(filename):
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    import re
+    if not re.match(r'^pinvault-backup-\d{8}-\d{6}\.db$', filename):
+        return jsonify({"error": "Invalid backup filename."}), 400
+
+    src = None
+    for d in [LOCAL_BACKUP_DIR, NAS_BACKUP_DIR]:
+        candidate = os.path.join(d, filename)
+        if os.path.exists(candidate):
+            src = candidate
+            break
+
+    if not src:
+        return jsonify({"error": "Backup file not found."}), 404
+
+    try:
+        test_conn = sqlcipher.connect(src)
+        test_conn.execute(f'PRAGMA key = "{app.master_key}"')
+        test_conn.execute("SELECT count(*) FROM sqlite_master")
+        test_conn.close()
+    except Exception as e:
+        return jsonify({"error": f"Backup verification failed: {e}"}), 500
+
+    shutil.copy2(src, DB_PATH)
+    return jsonify({"ok": True, "restored": filename})
+
+
+@app.route("/api/pins", methods=["GET"])
+def api_list_pins():
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    with get_conn() as conn:
+        rows = conn.execute(
+            """
+            SELECT p.id, p.label, p.created_at, p.lock_until, p.bypassed_count, p.revealed,
+                   (SELECT COUNT(*) FROM recovery_codes rc WHERE rc.pin_id = p.id AND rc.used = 0) AS remaining_codes
+            FROM pins p ORDER BY p.id
+            """
+        ).fetchall()
+    now = now_utc()
+    result = []
+    for row in rows:
+        lock_until = datetime.fromisoformat(row["lock_until"])
+        locked = now < lock_until
+        days_left = max(0, (lock_until - now).days) if locked else 0
+        result.append({
+            "id": row["id"],
+            "label": row["label"],
+            "created_at": row["created_at"],
+            "lock_until": row["lock_until"],
+            "locked": locked,
+            "days_remaining": days_left,
+            "revealed": bool(row["revealed"]),
+            "bypassed_count": row["bypassed_count"],
+            "remaining_codes": row["remaining_codes"],
+        })
+    return jsonify(result)
+
+
+@app.route("/api/pins", methods=["POST"])
+def api_add_pin():
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    data = request.get_json()
+    label = data.get("label", "").strip()
+    lock_days = data.get("lock_days", 30)
+    if lock_days < 0:
+        return jsonify({"error": "lock_days must be >= 0"}), 400
+
+    pin = f"{random.randint(0, 9999):04d}"
+    pin_hash = hash_val(pin)
+    now = now_utc()
+    lock_until = (now + timedelta(days=lock_days)).isoformat()
+
+    codes = [generate_recovery_code() for _ in range(RECOVERY_CODE_COUNT)]
+
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO pins (label, pin_hash, created_at, lock_until) VALUES (?, ?, ?, ?)",
+            (label, pin_hash, now.isoformat(), lock_until),
+        )
+        pin_id = cur.lastrowid
+        for code in codes:
+            conn.execute(
+                "INSERT INTO recovery_codes (pin_id, code_hash) VALUES (?, ?)",
+                (pin_id, hash_val(code)),
+            )
+        conn.commit()
+
+    return jsonify({
+        "id": pin_id,
+        "label": label,
+        "pin": pin,
+        "lock_until": lock_until,
+        "recovery_codes": codes,
+    }), 201
+
+
+@app.route("/api/pins/<int:pin_id>/access", methods=["POST"])
+def api_access_pin(pin_id):
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    data = request.get_json() or {}
+    bypass_code = data.get("bypass_code", "").strip() if data.get("bypass_code") else None
+
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM pins WHERE id = ?", (pin_id,)).fetchone()
+        if not row:
+            return jsonify({"error": "PIN entry not found"}), 404
+
+        lock_until = datetime.fromisoformat(row["lock_until"])
+        now = now_utc()
+
+        if bypass_code:
+            code_hash = hash_val(bypass_code)
+            code_row = conn.execute(
+                "SELECT * FROM recovery_codes WHERE pin_id = ? AND code_hash = ? AND used = 0",
+                (pin_id, code_hash),
+            ).fetchone()
+            if not code_row:
+                return jsonify({"error": "Invalid or already-used recovery code"}), 403
+            conn.execute(
+                "UPDATE recovery_codes SET used = 1 WHERE id = ?",
+                (code_row["id"],),
+            )
+            conn.execute(
+                "UPDATE pins SET lock_until = ?, bypassed_count = bypassed_count + 1, revealed = 1 WHERE id = ?",
+                (now.isoformat(), pin_id),
+            )
+            conn.commit()
+            pin = recover_pin(row["pin_hash"])
+            return jsonify({"pin": pin})
+
+        if now >= lock_until:
+            conn.execute("UPDATE pins SET revealed = 1 WHERE id = ?", (pin_id,))
+            conn.commit()
+            pin = recover_pin(row["pin_hash"])
+            return jsonify({"pin": pin})
+
+        return jsonify({"error": "PIN is locked. Use a recovery code to bypass."}), 423
+
+    return jsonify({"error": "Unexpected error"}), 500
+
+
+@app.route("/api/pins/<int:pin_id>", methods=["DELETE"])
+def api_delete_pin(pin_id):
+    if not getattr(app, "master_key", None):
+        return jsonify({"error": "Vault not configured."}), 401
+    with get_conn() as conn:
+        row = conn.execute("SELECT revealed FROM pins WHERE id = ?", (pin_id,)).fetchone()
+        if not row:
+            return jsonify({"error": "PIN entry not found"}), 404
+        if not row["revealed"]:
+            return jsonify({"error": "Cannot delete unrevealed PIN. Access it first."}), 409
+        conn.execute("DELETE FROM recovery_codes WHERE pin_id = ?", (pin_id,))
+        cur = conn.execute("DELETE FROM pins WHERE id = ?", (pin_id,))
+        conn.commit()
+    return jsonify({"ok": True})
+
+
+def recover_pin(pin_hash):
+    for i in range(10000):
+        candidate = f"{i:04d}"
+        if hash_val(candidate) == pin_hash:
+            return candidate
+    return None
+
+
+def _verify_db():
+    try:
+        conn = sqlcipher.connect(DB_PATH)
+        conn.execute(f'PRAGMA key = "{app.master_key}"')
+        conn.execute("SELECT count(*) FROM sqlite_master")
+        conn.close()
+        return True
+    except Exception:
+        return False
+
+
+def _latest_backup():
+    candidates = []
+    for d in [LOCAL_BACKUP_DIR, NAS_BACKUP_DIR]:
+        try:
+            for f in os.listdir(d):
+                if f.startswith("pinvault-backup-") and f.endswith(".db"):
+                    path = os.path.join(d, f)
+                    candidates.append((os.path.getmtime(path), path))
+        except Exception:
+            pass
+    if not candidates:
+        return None
+    candidates.sort(reverse=True)
+    return candidates[0][1]
+
+
+def _auto_restore():
+    if _verify_db():
+        return True
+
+    print("DB is corrupted or unreadable. Attempting auto-restore...", flush=True)
+    backup = _latest_backup()
+    if not backup:
+        print("No backups found. Cannot auto-restore.", file=sys.stderr, flush=True)
+        return False
+
+    try:
+        test = sqlcipher.connect(backup)
+        test.execute(f'PRAGMA key = "{app.master_key}"')
+        test.execute("SELECT count(*) FROM sqlite_master")
+        test.close()
+    except Exception:
+        print(f"Backup {backup} also unreadable. Cannot auto-restore.", file=sys.stderr, flush=True)
+        return False
+
+    shutil.copy2(backup, DB_PATH)
+    print(f"Restored DB from backup: {backup}", flush=True)
+    return True
+
+
+def bootstrap():
+    import sys
+    bcrypt_hash = os.environ.get("PINVAULT_MASTER_HASH", "").strip()
+    os.environ.pop("PINVAULT_MASTER_HASH", None)
+
+    if not bcrypt_hash:
+        print("ERROR: PINVAULT_MASTER_HASH environment variable is required.", file=sys.stderr)
+        print("Generate one with: python3 -c \"import bcrypt; print(bcrypt.hashpw(b'YOUR_PASSWORD', bcrypt.gensalt()).decode())\"", file=sys.stderr)
+        sys.exit(1)
+
+    if not bcrypt_hash.startswith("$2"):
+        print("ERROR: PINVAULT_MASTER_HASH must be a bcrypt hash (starts with $2b$ or $2a$)", file=sys.stderr)
+        sys.exit(1)
+
+    app.master_key = _derive_sqlcipher_key(bcrypt_hash)
+
+    if os.path.exists(DB_PATH):
+        if not _auto_restore():
+            print("FATAL: Cannot open database and no valid backup found.", file=sys.stderr, flush=True)
+            sys.exit(1)
+
+    init_db()
+    _do_backup()
+    t = threading.Thread(target=_backup_loop, daemon=True)
+    t.start()
+
+
+bootstrap()
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=8765)

docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  pinvault:
+    build: .
+    ports:
+      - "8765:8765"
+    volumes:
+      - pinvault-data:/data
+      - /mnt/aidata:/mnt/aidata
+    environment:
+      - PINVAULT_MASTER_HASH=${PINVAULT_MASTER_HASH}
+    restart: unless-stopped
+
+volumes:
+  pinvault-data:

requirements.txt

@@ -0,0 +1,3 @@
+flask==3.1.*
+gunicorn==23.0.*
+pysqlcipher3==1.2.*

static/app.js

@@ -0,0 +1,284 @@
+const api = (path, opts = {}) =>
+  fetch(path, {
+    headers: { "Content-Type": "application/json" },
+    ...opts,
+  }).then(r => {
+    if (r.status === 204 || !r.body) return { ok: true };
+    return r.json().then(d => {
+      if (!r.ok) throw new Error(d.error || "Request failed");
+      return d;
+    });
+  });
+
+const pinTimers = {};
+
+function fmtCountdown(ms) {
+  if (ms <= 0) return "00:00:00:00";
+  const d = Math.floor(ms / 86400000);
+  const totalSec = Math.floor((ms % 86400000) / 1000);
+  const h = Math.floor(totalSec / 3600);
+  const m = Math.floor((totalSec % 3600) / 60);
+  const s = totalSec % 60;
+  const dd = String(d).padStart(2, "0");
+  const hh = String(h).padStart(2, "0");
+  const mm = String(m).padStart(2, "0");
+  const ss = String(s).padStart(2, "0");
+  return `${dd}:${hh}:${mm}:${ss}`;
+}
+
+async function loadPins() {
+  const el = document.getElementById("pins-list");
+  try {
+    const pins = await api("/api/pins");
+    if (!pins.length) {
+      el.innerHTML = '<p class="empty-state">No PINs stored yet.</p>';
+      return;
+    }
+    el.innerHTML = `
+      <table class="pin-table">
+        <thead>
+          <tr>
+            <th>ID</th>
+            <th>Label</th>
+            <th>Status</th>
+            <th>Countdown</th>
+            <th>Codes</th>
+            <th></th>
+          </tr>
+        </thead>
+        <tbody>
+          ${pins.map(p => `
+            <tr>
+              <td>#${p.id}</td>
+              <td>${esc(p.label) || "<span class='muted'>(none)</span>"}</td>
+              <td>${p.locked
+                ? `<span class="badge badge-locked">LOCKED</span>`
+                : `<span class="badge badge-unlocked">UNLOCKED</span>`}</td>
+              <td class="countdown" id="cd-${p.id}" data-until="${p.lock_until}">${fmtCountdown(new Date(p.lock_until) - Date.now())}</td>
+              <td>${p.remaining_codes}/${4}</td>
+              <td>
+                <button class="btn btn-sm" onclick="accessPin(${p.id})">Access</button>
+                <button class="btn btn-sm" onclick="deletePin(${p.id}, '${esc(p.label)}')"
+                  ${p.revealed ? '' : 'disabled title="Must be revealed first"'}
+                  style="${p.revealed ? 'color:var(--danger)' : 'color:var(--muted);opacity:0.4'}">
+                  Del
+                </button>
+              </td>
+            </tr>
+          `).join("")}
+        </tbody>
+      </table>`;
+
+    pins.forEach(p => {
+      if (pinTimers[p.id]) clearInterval(pinTimers[p.id]);
+      pinTimers[p.id] = setInterval(() => {
+        const cell = document.getElementById(`cd-${p.id}`);
+        if (!cell) {
+          clearInterval(pinTimers[p.id]);
+          return;
+        }
+        const remaining = new Date(p.lock_until) - Date.now();
+        cell.textContent = fmtCountdown(remaining);
+      }, 1000);
+    });
+  } catch (e) {
+    el.innerHTML = `<p class="error-msg">${esc(e.message)}</p>`;
+  }
+}
+
+document.getElementById("add-form").addEventListener("submit", async (e) => {
+  e.preventDefault();
+  const label = document.getElementById("label").value;
+  const lockDays = parseInt(document.getElementById("lock-days").value) || 30;
+
+  try {
+    const result = await api("/api/pins", {
+      method: "POST",
+      body: JSON.stringify({ label, lock_days: lockDays }),
+    });
+
+    const content = document.getElementById("new-pin-content");
+    const pinId = "pin-" + result.id;
+    content.innerHTML = `
+      <p class="muted text-center" style="margin-bottom:0.3rem">Your PIN</p>
+      <div class="pin-display masked" id="${pinId}">••••</div>
+      <div class="text-center" style="margin-bottom:1rem">
+        <button class="btn btn-sm" id="${pinId}-btn" onclick="togglePin('${pinId}', '${result.pin}', '${pinId}-btn')">&#x1f441; Reveal PIN</button>
+      </div>
+      <div class="warning-box">
+        Save your recovery codes now. They will <strong>not</strong> be shown again.
+      </div>
+      <div class="recovery-list">
+        ${result.recovery_codes.map((c, i) => `
+          <div class="recovery-item">
+            <strong>[${i + 1}]</strong>
+            <code id="rc-${i}">${c}</code>
+            <button class="copy-btn" onclick="copyText('rc-${i}')" title="Copy">&#x1f4cb;</button>
+          </div>
+        `).join("")}
+      </div>
+      <p class="muted text-center" style="margin-top:0.75rem;font-size:0.8rem">
+        Access locked until: ${new Date(result.lock_until).toLocaleDateString()}
+      </p>
+      <div class="text-center" style="margin-top:1rem">
+        <button class="btn btn-primary" onclick="doPrint()">&#x1f5b8; Print Sheet</button>
+      </div>`;
+
+    schedulePrint(result);
+    document.getElementById("new-pin-result").classList.remove("hidden");
+    document.getElementById("label").value = "";
+    loadPins();
+  } catch (err) {
+    alert(err.message);
+  }
+});
+
+function accessPin(id) {
+  const title = document.getElementById("modal-title");
+  const body = document.getElementById("modal-body");
+  title.textContent = `Access PIN #${id}`;
+  body.innerHTML = `
+    <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
+      Enter a recovery code to bypass the lock:
+    </p>
+    <form id="access-form">
+      <div class="form-group">
+        <textarea id="bypass-input" placeholder="Paste 64-character recovery code here..." rows="2" required></textarea>
+      </div>
+      <div id="access-error" class="error-msg" style="margin-bottom:0.5rem"></div>
+      <button type="submit" class="btn btn-primary" style="width:100%">Unlock PIN</button>
+    </form>`;
+  document.getElementById("modal-overlay").classList.remove("hidden");
+
+  document.getElementById("access-form").addEventListener("submit", async (e) => {
+    e.preventDefault();
+    const code = document.getElementById("bypass-input").value.trim();
+    const errEl = document.getElementById("access-error");
+    errEl.textContent = "";
+
+    try {
+      const result = await api(`/api/pins/${id}/access`, {
+        method: "POST",
+        body: JSON.stringify({ bypass_code: code }),
+      });
+      body.innerHTML = `
+        <div class="text-center">
+          <p class="muted" style="margin-bottom:0.3rem">Your PIN</p>
+          <div class="pin-display">${result.pin}</div>
+          <button class="btn btn-sm" onclick="copyTextDirect('${result.pin}')" style="margin-top:0.5rem">
+            Copy PIN &#x1f4cb;
+          </button>
+        </div>`;
+      loadPins();
+    } catch (err) {
+      errEl.textContent = err.message;
+    }
+  });
+}
+
+async function deletePin(id, label) {
+  const lbl = label || `#${id}`;
+  if (!confirm(`Delete PIN for "${lbl}"?`)) return;
+  try {
+    await api(`/api/pins/${id}`, { method: "DELETE" });
+    loadPins();
+  } catch (e) {
+    alert(e.message);
+  }
+}
+
+function closeModal() {
+  document.getElementById("modal-overlay").classList.add("hidden");
+}
+
+document.getElementById("modal-overlay").addEventListener("click", (e) => {
+  if (e.target.id === "modal-overlay") closeModal();
+});
+
+function copyText(elId) {
+  const text = document.getElementById(elId).textContent;
+  navigator.clipboard.writeText(text);
+}
+
+function togglePin(elId, pin, btnId) {
+  const el = document.getElementById(elId);
+  const btn = document.getElementById(btnId);
+  if (el.classList.contains("masked")) {
+    el.textContent = pin;
+    el.classList.remove("masked");
+    btn.innerHTML = "&#x1f441; Hide PIN";
+  } else {
+    el.textContent = "\u2022\u2022\u2022\u2022";
+    el.classList.add("masked");
+    btn.innerHTML = "&#x1f441; Reveal PIN";
+  }
+}
+
+function copyTextDirect(text) {
+  navigator.clipboard.writeText(text);
+}
+
+let _printData = null;
+
+function schedulePrint(result) {
+  _printData = result;
+}
+
+function doPrint() {
+  if (!_printData) return;
+  const r = _printData;
+  const w = window.open("", "_blank", "width=600,height=600");
+  const dateStr = new Date(r.lock_until).toLocaleDateString("en-US", {year:"numeric",month:"long",day:"numeric"});
+  const labelStr = r.label || "(no label)";
+  const codeRows = r.recovery_codes.map((c, i) =>
+    `<div class="code-row"><div class="code-num">${i+1}</div><div class="code-text">${c}</div></div>`
+  ).join("\n");
+  w.document.write(`<!DOCTYPE html>
+<html><head><title>PinVault - PIN #${r.id}</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+body{font-family:'Courier New',monospace;padding:0.5in}
+.print-card{border:3px solid #000;border-radius:8px;padding:0.4in;max-width:5in}
+.header{text-align:center;margin-bottom:0.3in}
+.header h1{font-size:1.2rem;letter-spacing:0.1em;margin-bottom:0.1in}
+.header .subtitle{font-size:0.65rem;color:#555}
+.pin-section{text-align:center;margin:0.25in 0;padding:0.15in 0;border-top:1px dashed #999;border-bottom:1px dashed #999}
+.pin-section .label{font-size:0.6rem;text-transform:uppercase;letter-spacing:0.15em;color:#333;margin-bottom:0.1in}
+.pin-section .pin{font-size:2.5rem;font-weight:bold;letter-spacing:0.35rem}
+.info{font-size:0.55rem;color:#666;text-align:center;margin:0.15in 0}
+.codes-section{margin-top:0.2in}
+.codes-section h2{font-size:0.7rem;text-transform:uppercase;letter-spacing:0.1em;margin-bottom:0.15in;text-align:center}
+.code-row{display:flex;align-items:stretch;margin-bottom:0.12in;page-break-inside:avoid}
+.code-num{font-size:0.7rem;font-weight:bold;width:0.6in;text-align:center;border-right:2px solid #000;padding:0.1in 0.05in;display:flex;align-items:center}
+.code-text{flex:1;padding:0.1in 0.15in;font-size:0.72rem;word-break:break-all;line-height:1.4}
+.footer{text-align:center;margin-top:0.25in;font-size:0.5rem;color:#999;border-top:1px dashed #ccc;padding-top:0.1in}
+@page{size:letter;margin:0.5in}
+@media print{body{padding:0}.print-card{border:2px solid #000}}
+</style></head><body>
+<div class="print-card">
+  <div class="header">
+    <h1>PINVAULT</h1>
+    <div class="subtitle">PIN #${r.id} &middot; ${labelStr}</div>
+  </div>
+  <div class="pin-section">
+    <div class="label">Access PIN</div>
+    <div class="pin">${r.pin}</div>
+  </div>
+  <div class="info">Locked until: ${dateStr}</div>
+  <div class="codes-section">
+    <h2>Recovery Codes</h2>
+${codeRows}
+  </div>
+  <div class="footer">One-time use. Store securely.</div>
+</div></body></html>`);
+  w.document.close();
+  setTimeout(() => { w.print(); }, 400);
+}
+
+function esc(s) {
+  const d = document.createElement("div");
+  d.textContent = s;
+  return d.innerHTML;
+}
+
+loadPins();

static/style.css

@@ -0,0 +1,282 @@
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+:root {
+--bg: #0f1117;
+--surface: #1a1d27;
+--surface2: #242734;
+--border: #2e3245;
+--text: #e4e5eb;
+--muted: #8b8fa3;
+--accent: #6c5ce7;
+--accent-hover: #7e70f0;
+--danger: #e74c3c;
+--danger-hover: #c0392b;
+--success: #2ecc71;
+--warning: #f39c12;
+--radius: 10px;
+}
+
+body {
+font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+background: var(--bg);
+color: var(--text);
+line-height: 1.6;
+min-height: 100vh;
+}
+
+.container {
+max-width: 720px;
+margin: 0 auto;
+padding: 2rem 1rem;
+}
+
+header {
+text-align: center;
+margin-bottom: 2rem;
+}
+
+header h1 {
+font-size: 2rem;
+font-weight: 700;
+letter-spacing: -0.5px;
+}
+
+.subtitle {
+color: var(--muted);
+font-size: 0.9rem;
+}
+
+.card {
+background: var(--surface);
+border: 1px solid var(--border);
+border-radius: var(--radius);
+margin-bottom: 1.5rem;
+overflow: hidden;
+}
+
+.card-header {
+display: flex;
+justify-content: space-between;
+align-items: center;
+padding: 1rem 1.25rem;
+border-bottom: 1px solid var(--border);
+}
+
+.card-header h2 {
+font-size: 1rem;
+font-weight: 600;
+}
+
+.card-body {
+padding: 1.25rem;
+}
+
+.form-group {
+margin-bottom: 1rem;
+}
+
+.form-group label {
+display: block;
+font-size: 0.8rem;
+font-weight: 500;
+color: var(--muted);
+margin-bottom: 0.4rem;
+}
+
+.form-group input, .form-group textarea {
+width: 100%;
+padding: 0.6rem 0.8rem;
+background: var(--surface2);
+border: 1px solid var(--border);
+border-radius: 6px;
+color: var(--text);
+font-size: 0.9rem;
+outline: none;
+transition: border-color 0.2s;
+}
+
+.form-group input:focus, .form-group textarea:focus {
+border-color: var(--accent);
+}
+
+.form-group textarea {
+resize: vertical;
+min-height: 60px;
+font-family: inherit;
+}
+
+.btn {
+display: inline-flex;
+align-items: center;
+gap: 0.4rem;
+padding: 0.6rem 1.2rem;
+border: none;
+border-radius: 6px;
+font-size: 0.85rem;
+font-weight: 500;
+cursor: pointer;
+transition: background 0.2s, opacity 0.2s;
+}
+
+.btn:hover { opacity: 0.85; }
+.btn:active { opacity: 0.7; }
+
+.btn-primary { background: var(--accent); color: #fff; }
+.btn-danger { background: var(--danger); color: #fff; }
+.btn-success { background: var(--success); color: #fff; }
+.btn-sm { padding: 0.3rem 0.6rem; font-size: 0.8rem; background: var(--surface2); color: var(--muted); }
+
+.btn-close {
+background: none;
+border: none;
+color: var(--muted);
+font-size: 1.2rem;
+cursor: pointer;
+padding: 0.2rem;
+}
+
+.pin-table {
+width: 100%;
+border-collapse: collapse;
+font-size: 0.85rem;
+}
+
+.pin-table th, .pin-table td {
+text-align: left;
+padding: 0.7rem 0.6rem;
+border-bottom: 1px solid var(--border);
+}
+
+.pin-table th {
+font-size: 0.75rem;
+text-transform: uppercase;
+color: var(--muted);
+font-weight: 500;
+}
+
+.pin-table tr:last-child td { border-bottom: none; }
+
+.badge {
+display: inline-block;
+padding: 0.15rem 0.5rem;
+border-radius: 4px;
+font-size: 0.75rem;
+font-weight: 600;
+}
+
+.badge-locked { background: rgba(231,76,60,0.15); color: var(--danger); }
+.badge-unlocked { background: rgba(46,204,113,0.15); color: var(--success); }
+
+.pin-display {
+font-family: 'SF Mono', 'Fira Code', monospace;
+font-size: 2.5rem;
+letter-spacing: 0.5rem;
+text-align: center;
+padding: 1rem 0;
+font-weight: 700;
+user-select: all;
+}
+
+.pin-display.masked {
+color: var(--muted);
+cursor: default;
+}
+
+.countdown {
+font-family: 'SF Mono', 'Fira Code', monospace;
+font-size: 0.85rem;
+font-weight: 600;
+letter-spacing: 0.05em;
+white-space: nowrap;
+}
+
+.recovery-list {
+margin: 0.75rem 0;
+}
+
+.recovery-item {
+display: flex;
+align-items: center;
+gap: 0.5rem;
+padding: 0.4rem 0;
+font-size: 0.78rem;
+}
+
+.recovery-item code {
+flex: 1;
+background: var(--surface2);
+padding: 0.3rem 0.5rem;
+border-radius: 4px;
+font-family: 'SF Mono', 'Fira Code', monospace;
+font-size: 0.72rem;
+word-break: break-all;
+overflow: hidden;
+text-overflow: ellipsis;
+max-height: 1.5em;
+line-height: 1.5;
+}
+
+.copy-btn {
+background: none;
+border: none;
+color: var(--muted);
+cursor: pointer;
+font-size: 0.85rem;
+padding: 0.2rem;
+flex-shrink: 0;
+}
+
+.copy-btn:hover { color: var(--text); }
+
+.warning-box {
+background: rgba(243,156,18,0.1);
+border: 1px solid rgba(243,156,18,0.3);
+border-radius: 6px;
+padding: 0.75rem 1rem;
+font-size: 0.82rem;
+color: var(--warning);
+margin: 0.75rem 0;
+}
+
+.muted { color: var(--muted); }
+.text-center { text-align: center; }
+.hidden { display: none !important; }
+.error-msg { color: var(--danger); font-size: 0.85rem; }
+
+#modal-overlay {
+position: fixed;
+inset: 0;
+background: rgba(0,0,0,0.6);
+display: flex;
+align-items: center;
+justify-content: center;
+z-index: 100;
+}
+
+.modal {
+background: var(--surface);
+border: 1px solid var(--border);
+border-radius: var(--radius);
+width: 90%;
+max-width: 500px;
+max-height: 90vh;
+overflow-y: auto;
+}
+
+.modal-header {
+display: flex;
+justify-content: space-between;
+align-items: center;
+padding: 1rem 1.25rem;
+border-bottom: 1px solid var(--border);
+}
+
+.modal-header h2 { font-size: 1rem; }
+.modal-body { padding: 1.25rem; }
+
+.empty-state {
+text-align: center;
+padding: 2rem 1rem;
+color: var(--muted);
+font-size: 0.9rem;
+}

templates/index.html

@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>PinVault</title>
+<link rel="stylesheet" href="/static/style.css">
+</head>
+<body>
+<div class="container">
+<header>
+<h1>PinVault</h1>
+<p class="subtitle">Encrypted, time-locked PIN storage</p>
+</header>
+
+<main>
+<div class="card">
+<div class="card-header">
+<h2>New PIN</h2>
+</div>
+<div class="card-body">
+<form id="add-form">
+<div class="form-group">
+<label for="label">Label</label>
+<input type="text" id="label" placeholder="e.g. Banking app" required>
+</div>
+<div class="form-group">
+<label for="lock-days">Lock (days)</label>
+<input type="number" id="lock-days" value="30" min="0" max="365">
+</div>
+<button type="submit" class="btn btn-primary">Generate PIN</button>
+</form>
+</div>
+</div>
+
+<div id="new-pin-result" class="card hidden">
+<div class="card-header">
+<h2>New PIN Generated</h2>
+<button class="btn btn-sm btn-close" onclick="this.closest('.card').classList.add('hidden')">&times;</button>
+</div>
+<div class="card-body" id="new-pin-content"></div>
+</div>
+
+<div class="card">
+<div class="card-header">
+<h2>Stored PINs</h2>
+<button class="btn btn-sm" onclick="loadPins()">Refresh</button>
+</div>
+<div class="card-body">
+<div id="pins-list"><p class="muted">Loading...</p></div>
+</div>
+</div>
+</main>
+</div>
+
+<div id="modal-overlay" class="hidden">
+<div class="modal">
+<div class="modal-header">
+<h2 id="modal-title"></h2>
+<button class="btn btn-sm btn-close" onclick="closeModal()">&times;</button>
+</div>
+<div class="modal-body" id="modal-body"></div>
+</div>
+</div>
+
+<script src="/static/app.js"></script>
+</body>
+</html>