From 23913c39fa268fbefc689a6679ff110c0b7cb44c Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Tue, 1 Jul 2025 18:21:34 +0530
Subject: [PATCH 01/11] Add Twitter conversion tracking script to layout

Inserted Twitter conversion tracking base code into the main layout to enable analytics and conversion tracking for Twitter ads.
---
 packages/frontend-web/app/layout.tsx | 13 +++++++++++++
 1 file changed, 13 insertions(+)
diff --git a/packages/frontend-web/app/layout.tsx b/packages/frontend-web/app/layout.tsx
index 939cd456..0fb7cc16 100644
--- a/packages/frontend-web/app/layout.tsx
+++ b/packages/frontend-web/app/layout.tsx
@@ -24,6 +24,19 @@ export default function RootLayout({
   return (
     <html lang="en" suppressHydrationWarning>
       <body className={inter.className}>
+        {/* Twitter conversion tracking base code */}
+        <script
+          dangerouslySetInnerHTML={{
+            __html: `
+              !function(e,t,n,s,u,a){e.twq||(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments);
+              },s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js',
+              a=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script');
+              twq('config','q2wa1');
+            `
+          }}
+        />
+        {/* End Twitter conversion tracking base code */}
+        
         <StackProvider app={stackServerApp}>
           <StackTheme>
             <ThemeProvider

From 70a7bda65ae3c9a26de5fe4edb353dd82c67c4d3 Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Tue, 1 Jul 2025 18:26:52 +0530
Subject: [PATCH 02/11] added linkedin tracking code

---
 packages/frontend-web/app/layout.tsx | 32 ++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/packages/frontend-web/app/layout.tsx b/packages/frontend-web/app/layout.tsx
index 0fb7cc16..7925105d 100644
--- a/packages/frontend-web/app/layout.tsx
+++ b/packages/frontend-web/app/layout.tsx
@@ -37,6 +37,38 @@ export default function RootLayout({
         />
         {/* End Twitter conversion tracking base code */}
         
+        {/* LinkedIn conversion tracking code */}
+        <script
+          type="text/javascript"
+          dangerouslySetInnerHTML={{
+            __html: `
+              _linkedin_partner_id = "7397812";
+              window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];
+              window._linkedin_data_partner_ids.push(_linkedin_partner_id);
+            `
+          }}
+        />
+        <script
+          type="text/javascript"
+          dangerouslySetInnerHTML={{
+            __html: `
+              (function(l) {
+                if (!l){window.lintrk = function(a,b){window.lintrk.q.push([a,b])};
+                window.lintrk.q=[]}
+                var s = document.getElementsByTagName("script")[0];
+                var b = document.createElement("script");
+                b.type = "text/javascript";b.async = true;
+                b.src = "https://snap.licdn.com/li.lms-analytics/insight.min.js";
+                s.parentNode.insertBefore(b, s);
+              })(window.lintrk);
+            `
+          }}
+        />
+        <noscript>
+          <img height="1" width="1" style={{display: 'none'}} alt="" src="https://px.ads.linkedin.com/collect/?pid=7397812&fmt=gif" />
+        </noscript>
+        {/* End LinkedIn conversion tracking code */}
+        
         <StackProvider app={stackServerApp}>
           <StackTheme>
             <ThemeProvider

From ede845405cf00ef1c5bcae6c81a27903d72f05c3 Mon Sep 17 00:00:00 2001
From: itsmeakhil <akhiledathadan007@gmail.com>
Date: Tue, 1 Jul 2025 18:38:09 +0530
Subject: [PATCH 03/11] Update layout.tsx

---
 packages/frontend-web/app/layout.tsx | 57 +++++++++-------------------
 1 file changed, 18 insertions(+), 39 deletions(-)

diff --git a/packages/frontend-web/app/layout.tsx b/packages/frontend-web/app/layout.tsx
index 7925105d..c6bcca37 100644
--- a/packages/frontend-web/app/layout.tsx
+++ b/packages/frontend-web/app/layout.tsx
@@ -23,52 +23,31 @@ export default function RootLayout({
 }>) {
   return (
     <html lang="en" suppressHydrationWarning>
-      <body className={inter.className}>
-        {/* Twitter conversion tracking base code */}
+      <head>
+        {/* Google Tag Manager */}
         <script
           dangerouslySetInnerHTML={{
-            __html: `
-              !function(e,t,n,s,u,a){e.twq||(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments);
-              },s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js',
-              a=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script');
-              twq('config','q2wa1');
-            `
+            __html: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+            new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+            j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+            'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+            })(window,document,'script','dataLayer','GTM-W589BL88');`
           }}
         />
-        {/* End Twitter conversion tracking base code */}
+        {/* End Google Tag Manager */}
+      </head>
+      <body className={inter.className}>
         
-        {/* LinkedIn conversion tracking code */}
-        <script
-          type="text/javascript"
-          dangerouslySetInnerHTML={{
-            __html: `
-              _linkedin_partner_id = "7397812";
-              window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];
-              window._linkedin_data_partner_ids.push(_linkedin_partner_id);
-            `
-          }}
-        />
-        <script
-          type="text/javascript"
-          dangerouslySetInnerHTML={{
-            __html: `
-              (function(l) {
-                if (!l){window.lintrk = function(a,b){window.lintrk.q.push([a,b])};
-                window.lintrk.q=[]}
-                var s = document.getElementsByTagName("script")[0];
-                var b = document.createElement("script");
-                b.type = "text/javascript";b.async = true;
-                b.src = "https://snap.licdn.com/li.lms-analytics/insight.min.js";
-                s.parentNode.insertBefore(b, s);
-              })(window.lintrk);
-            `
-          }}
-        />
+        {/* Google Tag Manager (noscript) */}
         <noscript>
-          <img height="1" width="1" style={{display: 'none'}} alt="" src="https://px.ads.linkedin.com/collect/?pid=7397812&fmt=gif" />
+          <iframe 
+            src="https://www.googletagmanager.com/ns.html?id=GTM-W589BL88"
+            height="0" 
+            width="0" 
+            style={{display: 'none', visibility: 'hidden'}}
+          />
         </noscript>
-        {/* End LinkedIn conversion tracking code */}
-        
+        {/* End Google Tag Manager (noscript) */}
         <StackProvider app={stackServerApp}>
           <StackTheme>
             <ThemeProvider

From f1219ff1ddcde39bf61464d873f816dacc3bc28f Mon Sep 17 00:00:00 2001
From: itsmeakhil <akhiledathadan007@gmail.com>
Date: Tue, 1 Jul 2025 19:52:16 +0530
Subject: [PATCH 04/11] Update jwt_utils.py

---
 packages/backend-server/app/utils/jwt_utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/backend-server/app/utils/jwt_utils.py b/packages/backend-server/app/utils/jwt_utils.py
index b2d4a434..299eeea4 100644
--- a/packages/backend-server/app/utils/jwt_utils.py
+++ b/packages/backend-server/app/utils/jwt_utils.py
@@ -16,7 +16,7 @@ def create_jwt_token(
     if expires_delta:
         expire = datetime.utcnow() + expires_delta
     else:
-        expire = datetime.utcnow() + timedelta(days=2)
+        expire = datetime.utcnow() + timedelta(days=30)
     to_encode.update({"exp": expire})
     encoded_jwt = jwt.encode(to_encode, jwt_secret, algorithm=jwt_algorithm)
     return encoded_jwt

From 00a1be1aac735f34eee19bcbb4b157f612ad8db3 Mon Sep 17 00:00:00 2001
From: itsmeakhil <akhiledathadan007@gmail.com>
Date: Tue, 1 Jul 2025 19:52:23 +0530
Subject: [PATCH 05/11] Create .dockerignore

---
 packages/backend-server/.dockerignore | 97 +++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 packages/backend-server/.dockerignore

diff --git a/packages/backend-server/.dockerignore b/packages/backend-server/.dockerignore
new file mode 100644
index 00000000..43da448e
--- /dev/null
+++ b/packages/backend-server/.dockerignore
@@ -0,0 +1,97 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Git
+.git/
+.gitignore
+
+# Documentation
+README.md
+*.md
+docs/
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+.nox/
+coverage.xml
+*.cover
+.hypothesis/
+
+# Logs
+*.log
+logs/
+
+# Temporary files
+*.tmp
+*.temp
+.cache/
+
+# Docker
+Dockerfile*
+docker-compose*
+.dockerignore
+
+# Development files
+.env.local
+.env.development
+.env.test
+.env.production
+
+# Build artifacts
+*.slim
+slim.report.json
+
+# Node modules (if any)
+node_modules/
+
+# Backup files
+*.bak
+*.backup 
\ No newline at end of file

From f2dc66754361a94c48b757b65a4c3f5e0fb89ddd Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Thu, 10 Jul 2025 16:52:36 +0530
Subject: [PATCH 06/11] Add config loader and secure env handling to extension

Introduces config.js to load environment variables from a .env file, updates crypto-utils.js to use the AES key from configuration, and updates background.js to initialize configuration on startup. Adds SETUP.md with environment setup instructions, updates README.md for new setup steps, and modifies manifest.json to include config.js and .env as web-accessible resources. Ensures sensitive keys are not hardcoded and improves extension security and setup clarity.
---
 packages/Extenstions/.gitignore      |  27 ++++++
 packages/Extenstions/README.md       |  22 +++--
 packages/Extenstions/SETUP.md        |  86 ++++++++++++++++++
 packages/Extenstions/background.js   |  15 +++-
 packages/Extenstions/config.js       | 125 +++++++++++++++++++++++++++
 packages/Extenstions/crypto-utils.js |  13 ++-
 packages/Extenstions/manifest.json   |   4 +-
 7 files changed, 281 insertions(+), 11 deletions(-)
 create mode 100644 packages/Extenstions/.gitignore
 create mode 100644 packages/Extenstions/SETUP.md
 create mode 100644 packages/Extenstions/config.js

diff --git a/packages/Extenstions/.gitignore b/packages/Extenstions/.gitignore
new file mode 100644
index 00000000..c03fbbf4
--- /dev/null
+++ b/packages/Extenstions/.gitignore
@@ -0,0 +1,27 @@
+# Environment files
+.env
+.env.local
+.env.development
+.env.test
+.env.production
+
+# Node modules (if any build tools are added)
+node_modules/
+
+# Build outputs
+dist/
+build/
+
+# Temporary files
+*.tmp
+*.temp
+
+# IDE files
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS generated files
+.DS_Store
+Thumbs.db 
\ No newline at end of file
diff --git a/packages/Extenstions/README.md b/packages/Extenstions/README.md
index 1ed71d5b..35d5503f 100644
--- a/packages/Extenstions/README.md
+++ b/packages/Extenstions/README.md
@@ -11,14 +11,26 @@ This Chrome extension allows users to autofill card and email details from their
 
 ## Setup
 
+### Environment Configuration
+
+⚠️ **IMPORTANT**: Before setting up the extension, you must configure the environment variables for security.
+
+**See [SETUP.md](./SETUP.md) for detailed environment configuration instructions.**
+
+Quick setup:
+1. Create a `.env` file in this directory
+2. Add: `INDEXED_DB_AES_KEY="your_key_here"`
+3. Get the key from your team or the frontend-web `.env.local` file
+
 ### Development Setup
 
 1. Clone this repository
-2. Open Chrome and navigate to `chrome://extensions/`
-3. Enable "Developer mode" in the top-right corner
-4. Click "Load unpacked" and select the `packages/Extenstions` directory
-5. Note the Extension ID assigned by Chrome (you'll need it for the next step)
-6. Update the `EXTENSION_ID` constant in `packages/frontend-web/app/extension-login/page.tsx` with your extension ID
+2. **Configure environment variables** (see SETUP.md)
+3. Open Chrome and navigate to `chrome://extensions/`
+4. Enable "Developer mode" in the top-right corner
+5. Click "Load unpacked" and select the `packages/Extenstions` directory
+6. Note the Extension ID assigned by Chrome (you'll need it for the next step)
+7. Update the `EXTENSION_ID` constant in `packages/frontend-web/app/extension-login/page.tsx` with your extension ID
 
 ### Frontend Setup
 
diff --git a/packages/Extenstions/SETUP.md b/packages/Extenstions/SETUP.md
new file mode 100644
index 00000000..2602ddd5
--- /dev/null
+++ b/packages/Extenstions/SETUP.md
@@ -0,0 +1,86 @@
+# Zecrypt Browser Extension Setup
+
+## Environment Configuration
+
+⚠️ **SECURITY NOTICE**: This extension requires proper environment configuration to work securely. Never commit sensitive keys to version control.
+
+### Development Setup
+
+1. **Create Environment File**
+   
+   Create a `.env` file in the `packages/Extenstions/` directory:
+   
+   ```bash
+   cd packages/Extenstions/
+   cp .env.example .env  # If example exists, or create manually
+   ```
+
+2. **Configure Environment Variables**
+   
+   Add the following to your `.env` file:
+   
+   ```
+   INDEXED_DB_AES_KEY="HxmfPmPwqQZ3gHKwfHXi6TmPwVDppr0oDKyPwCdopDI="
+   ```
+   
+   **Note**: The key should match the `NEXT_PUBLIC_INDEXED_DB_AES_KEY` from the frontend-web `.env.local` file.
+
+3. **Verify Setup**
+   
+   - The `.env` file should NOT be committed to git (it's already in `.gitignore`)
+   - Check that the extension loads without console errors
+   - Verify that crypto operations work correctly
+
+### Production Deployment
+
+For production environments, consider:
+
+1. **Build-time Injection**: Use a build script to inject environment variables
+2. **Secure Key Management**: Use proper secrets management systems
+3. **Key Rotation**: Implement regular key rotation procedures
+
+### File Structure
+
+```
+packages/Extenstions/
+├── .env                 # Your environment file (NOT committed)
+├── .gitignore          # Ensures .env is ignored
+├── config.js           # Configuration loader
+├── crypto-utils.js     # Crypto utilities (uses config)
+├── background.js       # Background script (initializes config)
+└── ... other files
+```
+
+### Troubleshooting
+
+**Error: "Extension configuration not loaded"**
+- Ensure `.env` file exists in the extensions directory
+- Check that `INDEXED_DB_AES_KEY` is properly set in `.env`
+- Verify the key format (should be base64 encoded)
+
+**Error: "Configuration key not found"**
+- Check that the key in `.env` matches exactly: `INDEXED_DB_AES_KEY`
+- Ensure there are no extra spaces or characters
+- Verify the file is saved properly
+
+**Error: "Invalid encryption key format"**
+- The key should be a valid base64 string
+- Check that the key length is correct (32 bytes when decoded)
+- Ensure the key matches the one used in the web application
+
+### Security Best Practices
+
+1. **Never hardcode keys** in source code
+2. **Use different keys** for different environments (dev/staging/prod)
+3. **Rotate keys regularly** and update all environments
+4. **Restrict access** to environment files and key management systems
+5. **Monitor usage** and implement key usage auditing
+
+### Getting the Key
+
+The `INDEXED_DB_AES_KEY` should be obtained from:
+1. Your development team's secure key management system
+2. The frontend-web application's environment configuration
+3. Your organization's secrets management platform
+
+Contact your development team if you don't have access to the required keys. 
\ No newline at end of file
diff --git a/packages/Extenstions/background.js b/packages/Extenstions/background.js
index c356b088..e53a03c9 100644
--- a/packages/Extenstions/background.js
+++ b/packages/Extenstions/background.js
@@ -1,9 +1,22 @@
 // Base API URL
 const API_BASE_URL = 'https://preview.api.zecrypt.io/api/v1/web';
 
-// Import crypto utilities
+// Import configuration and crypto utilities
+importScripts('config.js');
 importScripts('crypto-utils.js');
 
+// Initialize configuration when extension starts
+(async function initializeExtension() {
+  try {
+    console.log('Initializing Zecrypt extension configuration...');
+    await ExtensionConfig.initConfig();
+    console.log('Extension configuration loaded successfully');
+  } catch (error) {
+    console.error('Failed to load extension configuration:', error);
+    console.error('Please ensure you have created a .env file in the extensions directory with the required keys');
+  }
+})();
+
 // Helper function to check if URL is accessible for script injection
 function isValidUrl(url) {
   // Exclude chrome:// URLs, chrome-extension:// URLs, and other restricted schemes
diff --git a/packages/Extenstions/config.js b/packages/Extenstions/config.js
new file mode 100644
index 00000000..b4fa945c
--- /dev/null
+++ b/packages/Extenstions/config.js
@@ -0,0 +1,125 @@
+/**
+ * Configuration loader for browser extension
+ * Handles environment variables in browser context
+ * 
+ * SECURITY NOTE: 
+ * - Create a .env file in this directory with: INDEXED_DB_AES_KEY="your_key_here"
+ * - The .env file is ignored by git and should never be committed
+ * - In production, use build-time injection or secure configuration management
+ */
+
+// This will hold our configuration
+let CONFIG = null;
+
+/**
+ * Load configuration from environment file
+ * Note: This is a simplified approach for browser extensions
+ * In a real production setup, you'd want to use build-time injection
+ */
+async function loadConfigFromEnv() {
+  try {
+    // Try to fetch the .env file (this will only work in development)
+    const response = await fetch(chrome.runtime.getURL('.env'));
+    if (response.ok) {
+      const envText = await response.text();
+      const config = {};
+      
+      // Parse simple KEY="value" format
+      const lines = envText.split('\n');
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed && !trimmed.startsWith('#')) {
+          const [key, ...valueParts] = trimmed.split('=');
+          if (key && valueParts.length > 0) {
+            // Remove quotes from value
+            let value = valueParts.join('=').trim();
+            if ((value.startsWith('"') && value.endsWith('"')) || 
+                (value.startsWith("'") && value.endsWith("'"))) {
+              value = value.slice(1, -1);
+            }
+            config[key] = value;
+          }
+        }
+      }
+      
+      return config;
+    }
+  } catch (error) {
+    console.warn('Could not load .env file:', error.message);
+  }
+  
+  return null;
+}
+
+/**
+ * Initialize configuration
+ * This should be called when the extension starts
+ */
+async function initConfig() {
+  // Try to load from .env file first
+  CONFIG = await loadConfigFromEnv();
+  
+  // If no config loaded, check for injected config (build-time injection)
+  if (!CONFIG && typeof window !== 'undefined' && window.INJECTED_CONFIG) {
+    CONFIG = window.INJECTED_CONFIG;
+  }
+  
+  // If still no config, throw an error
+  if (!CONFIG || !CONFIG.INDEXED_DB_AES_KEY) {
+    throw new Error(
+      'Configuration not found! Please create a .env file in the extensions directory with:\n' +
+      'INDEXED_DB_AES_KEY="your_key_here"\n\n' +
+      'See README.md for setup instructions.'
+    );
+  }
+  
+  return CONFIG;
+}
+
+/**
+ * Get a configuration value
+ */
+function getConfig(key) {
+  if (!CONFIG) {
+    throw new Error('Configuration not initialized. Call initConfig() first.');
+  }
+  
+  const value = CONFIG[key];
+  if (!value) {
+    throw new Error(`Configuration key '${key}' not found.`);
+  }
+  
+  return value;
+}
+
+/**
+ * Get the AES encryption key for localStorage encryption
+ */
+function getIndexedDbAesKey() {
+  return getConfig('INDEXED_DB_AES_KEY');
+}
+
+/**
+ * Check if configuration is loaded
+ */
+function isConfigLoaded() {
+  return CONFIG !== null;
+}
+
+// Export for browser extension context
+const ExtensionConfig = {
+  initConfig,
+  getConfig,
+  getIndexedDbAesKey,
+  isConfigLoaded
+};
+
+// Make available globally
+if (typeof globalThis !== 'undefined') {
+  globalThis.ExtensionConfig = ExtensionConfig;
+}
+
+// Also support module exports for potential build tools
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = ExtensionConfig;
+} 
\ No newline at end of file
diff --git a/packages/Extenstions/crypto-utils.js b/packages/Extenstions/crypto-utils.js
index fc8545b5..d8673446 100644
--- a/packages/Extenstions/crypto-utils.js
+++ b/packages/Extenstions/crypto-utils.js
@@ -2,11 +2,11 @@
  * Crypto utilities for the browser extension
  * Simplified version of the frontend-web crypto functions
  * Works in both service worker and regular browser contexts
+ * 
+ * SECURITY NOTE: The AES key is now loaded from configuration instead of being hardcoded
+ * Make sure config.js is loaded and initialized before using these functions
  */
 
-// Environment variable equivalent - this should be the same as NEXT_PUBLIC_INDEXED_DB_AES_KEY
-const INDEXED_DB_AES_KEY = "HxmfPmPwqQZ3gHKwfHXi6TmPwVDppr0oDKyPwCdopDI=";
-
 // Get the appropriate global context (self for service workers, window for regular contexts)
 const globalContext = (function() {
   if (typeof self !== 'undefined') {
@@ -23,6 +23,13 @@ const globalContext = (function() {
  */
 function getStorageEncryptionKey() {
   try {
+    // Get the key from configuration instead of hardcoded value
+    if (!globalContext.ExtensionConfig || !globalContext.ExtensionConfig.isConfigLoaded()) {
+      throw new Error("Extension configuration not loaded. Please ensure config.js is loaded and initConfig() is called.");
+    }
+    
+    const INDEXED_DB_AES_KEY = globalContext.ExtensionConfig.getIndexedDbAesKey();
+    
     const binaryString = atob(INDEXED_DB_AES_KEY);
     const bytes = new Uint8Array(binaryString.length);
     for (let i = 0; i < binaryString.length; i++) {
diff --git a/packages/Extenstions/manifest.json b/packages/Extenstions/manifest.json
index f6cc5269..af5ea0de 100644
--- a/packages/Extenstions/manifest.json
+++ b/packages/Extenstions/manifest.json
@@ -26,12 +26,12 @@
   "content_scripts": [
     {
       "matches": ["<all_urls>"],
-      "js": ["crypto-utils.js", "content.js"]
+      "js": ["config.js", "crypto-utils.js", "content.js"]
     }
   ],
   "web_accessible_resources": [
     {
-      "resources": ["crypto-utils.js"],
+      "resources": ["config.js", "crypto-utils.js", ".env"],
       "matches": ["<all_urls>"]
     }
   ],

From 369a9e30172ca22388e31130aecf2a268701ba17 Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Thu, 10 Jul 2025 17:14:25 +0530
Subject: [PATCH 07/11] Simplify authentication success message

Updated the alert description after successful authentication to a shorter message instructing the user to close the tab, removing extra details about extension usage.
---
 packages/frontend-web/app/[locale]/extension-login/page.tsx | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/frontend-web/app/[locale]/extension-login/page.tsx b/packages/frontend-web/app/[locale]/extension-login/page.tsx
index 0a2d7d01..17773b69 100644
--- a/packages/frontend-web/app/[locale]/extension-login/page.tsx
+++ b/packages/frontend-web/app/[locale]/extension-login/page.tsx
@@ -401,8 +401,7 @@ export default function ExtensionLogin() {
             <Alert className="border-green-200 bg-green-50">
               <AlertTitle className="text-green-800">✓ Authentication successful</AlertTitle>
               <AlertDescription className="text-green-700">
-                Your Zecrypt account is now connected to the browser extension.
-                You can close this tab and start using the extension to autofill your cards and emails.
+                You may now close this tab.
               </AlertDescription>
             </Alert>
           )}

From 0282ab7a4eaa7478a50d9875c36c30b061ca6f25 Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Thu, 10 Jul 2025 17:38:20 +0530
Subject: [PATCH 08/11] Remove debug logs and update extension config for
 production

Eliminated console.log debug statements from background.js and popup.js for cleaner production code. Updated manifest.json to version 1.1, changed externally_connectable domain to zecrypt.io, and set production URLs in popup.js.
---
 packages/Extenstions/background.js | 39 +++---------------------------
 packages/Extenstions/manifest.json |  4 +--
 packages/Extenstions/popup.js      |  8 +++---
 3 files changed, 9 insertions(+), 42 deletions(-)

diff --git a/packages/Extenstions/background.js b/packages/Extenstions/background.js
index e53a03c9..47b4b192 100644
--- a/packages/Extenstions/background.js
+++ b/packages/Extenstions/background.js
@@ -8,9 +8,7 @@ importScripts('crypto-utils.js');
 // Initialize configuration when extension starts
 (async function initializeExtension() {
   try {
-    console.log('Initializing Zecrypt extension configuration...');
     await ExtensionConfig.initConfig();
-    console.log('Extension configuration loaded successfully');
   } catch (error) {
     console.error('Failed to load extension configuration:', error);
     console.error('Please ensure you have created a .env file in the extensions directory with the required keys');
@@ -69,7 +67,6 @@ async function storeProjectAesKey(projectAesKey) {
     chrome.storage.local.set({ 
       zecryptProjectAesKey: encryptedKey
     });
-    console.log('Project AES key stored securely');
   } catch (error) {
     console.error('Error storing project AES key:', error);
   }
@@ -82,7 +79,6 @@ async function getDecryptedProjectAesKey() {
       if (result.zecryptProjectAesKey) {
         try {
           const decryptedKey = await CryptoUtils.decryptFromLocalStorage(result.zecryptProjectAesKey);
-          console.log('Project AES key retrieved and decrypted');
           resolve(decryptedKey);
         } catch (error) {
           console.error('Error decrypting project AES key:', error);
@@ -120,7 +116,6 @@ async function processCardData(cardRaw) {
         const decryptedData = await CryptoUtils.decryptDataField(cardRaw.data, projectAesKey);
         const parsedData = JSON.parse(decryptedData);
         
-        console.log('Card data decrypted successfully');
         return {
           ...cardRaw,
           cardNumber: parsedData.number || 'undefined',
@@ -187,8 +182,6 @@ async function processEmailData(emailRaw) {
         const decryptedData = await CryptoUtils.decryptDataField(emailRaw.data, projectAesKey);
         const parsedData = JSON.parse(decryptedData);
         
-        console.log('Email data decrypted successfully');
-        console.log("[Zecrypt Debug] Decrypted Email Password:", parsedData.password);
         return {
           ...emailRaw,
           email: parsedData.email_address || 'undefined',
@@ -205,7 +198,6 @@ async function processEmailData(emailRaw) {
       // Data might not be encrypted (legacy format)
       try {
         const parsedData = JSON.parse(emailRaw.data);
-        console.log("[Zecrypt Debug] Decrypted Email Password (legacy):", parsedData.password);
         return {
           ...emailRaw,
           email: parsedData.email_address || 'undefined',
@@ -281,7 +273,6 @@ function getCards() {
     apiRequest(ENDPOINTS.cards)
       .then(async function(response) {
         const cards = response.data || [];
-        console.log(`Processing ${cards.length} cards for decryption`);
         const processedCards = await Promise.all(cards.map(processCardData));
         
         resolve({
@@ -304,7 +295,6 @@ function getEmails() {
     apiRequest(ENDPOINTS.emails)
       .then(async function(response) {
         const emails = response.data || [];
-        console.log(`Processing ${emails.length} emails for decryption`);
         const processedEmails = await Promise.all(emails.map(processEmailData));
         
         resolve({
@@ -324,7 +314,6 @@ function getEmails() {
 // Enhanced external message listener to handle project AES key
 chrome.runtime.onMessageExternal.addListener(
   (message, sender, sendResponse) => {
-    console.log('External message received:', message);
     if (message.type === 'LOGIN' && message.token) {
       // Store the token and workspace/project IDs securely in chrome.storage.local
       chrome.storage.local.set({ 
@@ -336,12 +325,9 @@ chrome.runtime.onMessageExternal.addListener(
           console.error('Error storing tokens:', chrome.runtime.lastError);
           sendResponse({ success: false, error: chrome.runtime.lastError.message });
         } else {
-          console.log('Token and workspace data stored successfully');
-          
           // Store project AES key securely if provided
           if (message.projectAesKey) {
             await storeProjectAesKey(message.projectAesKey);
-            console.log('Project AES key stored successfully');
           }
           
           sendResponse({ success: true });
@@ -385,7 +371,6 @@ function checkLocalStorageAuth() {
             }
           }, (results) => {
             if (chrome.runtime.lastError) {
-              console.log('Script execution failed:', chrome.runtime.lastError.message);
               resolve({ success: false, error: chrome.runtime.lastError.message });
               return;
             }
@@ -402,12 +387,9 @@ function checkLocalStorageAuth() {
                   console.error('Error storing auth data:', chrome.runtime.lastError);
                   resolve({ success: false, error: chrome.runtime.lastError.message });
                 } else {
-                  console.log('Auth data retrieved from localStorage and stored');
-                  
                   // Store project AES key securely if provided
                   if (authData.projectAesKey) {
                     await storeProjectAesKey(authData.projectAesKey);
-                    console.log('Project AES key from localStorage stored successfully');
                   }
                   
                   resolve({ success: true, authData });
@@ -417,7 +399,6 @@ function checkLocalStorageAuth() {
               resolve({ success: false, error: 'No auth data found' });
             }
           });        } else {
-          console.log('No valid tab found for localStorage check. Current tab:', tabs[0]?.url || 'No tab');
           resolve({ success: false, error: 'No accessible tab found' });
         }
       });
@@ -445,7 +426,6 @@ function startAuthCheck() {
     
     // Stop checking after max attempts
     if (authCheckAttempts > MAX_AUTH_CHECK_ATTEMPTS) {
-      console.log('Auth check timeout after', MAX_AUTH_CHECK_ATTEMPTS, 'attempts');
       stopAuthCheck();
       return;
     }
@@ -455,18 +435,15 @@ function startAuthCheck() {
       if (result.success) {
         clearInterval(authCheckInterval);
         authCheckInterval = null;
-        console.log('Authentication successful via localStorage polling');
         
         // Notify popup if it's open
         try {
           chrome.runtime.sendMessage({ type: 'AUTH_SUCCESS' });
         } catch (e) {
           // Popup might not be open, that's ok
-          console.log('Could not notify popup:', e.message);
         }
       } else if (result.error && result.error.includes('Cannot access')) {
         // If we get access errors, reduce polling frequency
-        console.log('Access error during auth check, slowing down polling');
       }
     } catch (error) {
       console.error('Error during auth check:', error);
@@ -504,10 +481,8 @@ function checkAuth() {
 
 // Listen for messages from popup or content scripts
 chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
-  console.log('Internal message received:', message);
     if (message.type === 'CHECK_AUTH') {
     checkAuth().then(result => {
-      console.log('Auth check result:', result);
       
       // If not authenticated, try checking localStorage as fallback
       if (!result.isAuthenticated) {
@@ -522,8 +497,6 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
             // Only start periodic checking if we don't have access errors
             if (!localResult.error || !localResult.error.includes('Cannot access')) {
               startAuthCheck();
-            } else {
-              console.log('Skipping periodic auth check due to access restrictions');
             }
           }
         });
@@ -554,10 +527,9 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
   }
   // Handle logout request
   if (message.type === 'LOGOUT') {
-    chrome.storage.local.remove(['zecryptToken', 'zecryptWorkspaceId', 'zecryptProjectId', 'zecryptProjectAesKey'], () => {
-      console.log('Tokens and project key removed');
-      sendResponse({ success: true });
-    });
+          chrome.storage.local.remove(['zecryptToken', 'zecryptWorkspaceId', 'zecryptProjectId', 'zecryptProjectAesKey'], () => {
+        sendResponse({ success: true });
+      });
     return true;
   }
 
@@ -568,12 +540,9 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
       zecryptWorkspaceId: message.workspaceId,
       zecryptProjectId: message.projectId
     }, async () => {
-      console.log('Token and workspace data stored successfully from popup');
-      
       // Store project AES key securely if provided
       if (message.projectAesKey) {
         await storeProjectAesKey(message.projectAesKey);
-        console.log('Project AES key stored successfully from popup');
       }
       
       sendResponse({ success: true });
@@ -643,5 +612,5 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 
 // Initialize when the extension is installed or updated
 chrome.runtime.onInstalled.addListener(() => {
-  console.log('Zecrypt extension installed');
+  // Extension installed
 });
\ No newline at end of file
diff --git a/packages/Extenstions/manifest.json b/packages/Extenstions/manifest.json
index af5ea0de..2f249746 100644
--- a/packages/Extenstions/manifest.json
+++ b/packages/Extenstions/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Zecrypt",
-  "version": "1.0",
+  "version": "1.1",
   "description": "Secure autofill for passwords, cards, and personal data from your Zecrypt vault",
   "permissions": [
     "storage",
@@ -36,7 +36,7 @@
     }
   ],
   "externally_connectable": {
-    "matches": ["*://*.zecrypt.com/*", "*://localhost:*/*"]
+    "matches": ["*://*.zecrypt.io/*"]
   },
   "icons": {
     "16": "icons/favicon-1.png",
diff --git a/packages/Extenstions/popup.js b/packages/Extenstions/popup.js
index 8ea5e72a..ac77462c 100644
--- a/packages/Extenstions/popup.js
+++ b/packages/Extenstions/popup.js
@@ -19,7 +19,6 @@ document.addEventListener('DOMContentLoaded', () => {
         projectId: event.data.projectId
       }, (response) => {
         if (response && response.success) {
-          console.log('Authentication successful via postMessage');
           // Refresh the popup UI
           showAuthenticatedUI();
           fetchData();
@@ -31,7 +30,6 @@ document.addEventListener('DOMContentLoaded', () => {
   // Listen for auth success from background script
   chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     if (message.type === 'AUTH_SUCCESS') {
-      console.log('Authentication successful via background polling');
       // Refresh the popup UI
       checkAuthAndUpdateUI();
     }
@@ -59,11 +57,11 @@ document.addEventListener('DOMContentLoaded', () => {
         showUnauthenticatedUI();
       }
     }
-  });// Configuration for development vs production
-  const isDevelopment = true; // Set to false for production
+  });  // Configuration for development vs production
+  const isDevelopment = false; // Set to false for production
   const BASE_URL = isDevelopment 
     ? 'http://localhost:3000' 
-    : 'https://app.zecrypt.com';
+    : 'https://app.zecrypt.io';
     // Login button click handler
   loginBtn.addEventListener('click', () => {
     // Start auth checking in background

From 21d0a398b2b997596f2dd1ec1ebb06cd845b1aee Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Thu, 10 Jul 2025 17:44:00 +0530
Subject: [PATCH 09/11] Update .gitignore

---
 .gitignore | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 547186ef..aceec8e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -189,4 +189,10 @@ pnpm-lock.yaml
 packages/*/node_modules
 packages/*/dist
 packages/*/build
-packages/*/.next
\ No newline at end of file
+packages/*/.next
+
+# Cursor
+cursor.rules
+
+.cursor/
+.cursorrules
\ No newline at end of file

From ef0e0676017f420f970ccaff20a6a9102e844fba Mon Sep 17 00:00:00 2001
From: ananducv <ananducv666@gmail.com>
Date: Thu, 10 Jul 2025 17:57:43 +0530
Subject: [PATCH 10/11] Update .gitignore

---
 .gitignore | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index aceec8e7..1e844bdb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -195,4 +195,7 @@ packages/*/.next
 cursor.rules
 
 .cursor/
-.cursorrules
\ No newline at end of file
+.cursorrules
+.cursorignore
+
+

From b5edb9a4b1b0a4dc59a1ba0b1f006584f5d811d7 Mon Sep 17 00:00:00 2001
From: itsmeakhil <akhiledathadan007@gmail.com>
Date: Tue, 15 Jul 2025 11:21:26 +0530
Subject: [PATCH 11/11] Update utils.py

---
 packages/backend-server/app/utils/utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/backend-server/app/utils/utils.py b/packages/backend-server/app/utils/utils.py
index 03bced9e..916058d0 100644
--- a/packages/backend-server/app/utils/utils.py
+++ b/packages/backend-server/app/utils/utils.py
@@ -41,7 +41,7 @@ def create_uuid():
 def get_origins(env):
     data = {
         "production": ["https://app.zecrypt.io"],
-        "dev": ["http://localhost:3000", "https://preview.app.zecrypt.io"],
+        "dev": ["http://localhost:3000", "https://preview.app.zecrypt.io", "chrome-extension://*"],
     }
     return data.get(env, ["*"])
 
