Security: Move JWT secret to Electron safeStorage, restrict IPC maintenance, & sandbox renderer

[khaira777]

Feature / Security Hardening Request

Extracted from fork codewithsharma/FloCafe (branch: develop):

Overview

Security improvements to protect auth secrets on disk, restrict privileged desktop operations, and sandbox the Electron renderer process.

Proposed Changes

1. JWT Secret Storage Migration:
   • Move from plain SQLite settings into Electron safeStorage (OS Keychain / DPAPI / Secret Service).
   • Reference: main/services/jwt-secret.ts and migration version 74 (p0_2_jwt_secret_storage_marker).
2. IPC Maintenance Authorization:
   • Gate restart and installation IPC handlers (restart-and-install) behind Owner/Manager JWT validation to prevent unauthenticated renderer calls.
   • Reference: main/security/restart-and-install.ts.
3. Electron Sandbox & Navigation Guards:
   • Enable renderer process sandbox and enforce strict navigation guards to block arbitrary external navigation or window spawning.
   • Reference: main/security/browser-window-security.ts.
4. LAN Network Binding:
   • Bind HTTP server to localhost by default instead of 0.0.0.0 unless explicitly configured in settings via network_mode.
   • Reference: main/services/network-mode.ts and migration 73.

[khaira777]

Verdict: VALID ENHANCEMENT (fork-derived; several claims accurate, some already addressed, migration/file references are fork-only)

Findings:

• JWT secret is stored plaintext in the settings table (main/routes/auth.ts getJWTSecret() reads/inserts key jwt_secret; JWT_SECRET env wins). Moving it to Electron safeStorage is valid hardening and there is precedent: Google Drive tokens and the master PIN already use safeStorage (main/services/google-drive.ts).
• IPC sender identity is already enforced for backup/restore/db-init via the trusted-sender wrapper (main/ipc.ts:50-59, added in fix: remove privileged bridge from KDS window and enforce IPC sender identity #315). However restart-and-install (main/index.ts:656-662) is a plain ipcMain.handle with only an updateDownloaded check — no sender validation, no role check. Real, small gap (exploitable only by a LAN page, and only after an update download).
• Renderer sandbox is disabled: sandbox: false with contextIsolation: true (main/index.ts:226-228). Enabling it is non-trivial (preload uses require, restricted under sandbox) and should be its own effort.
• LAN binding: servers bind 0.0.0.0 (main/server.ts:331, main/kds-server.ts:638, main/server-app.ts:333) — by design for KDS/Server App LAN access via mDNS flo.local. A "localhost by default + network_mode setting" would need a design that keeps companion devices working; don't treat as a one-line change.

Inaccurate/outdated:

• Referenced files don't exist on main: main/services/jwt-secret.ts, main/security/restart-and-install.ts, main/security/browser-window-security.ts, main/services/network-mode.ts, and migrations 73/74 (current schema is v68). These are fork-only artifacts.

Suggested scope: (1) safeStorage for jwt_secret with env override + migration path; (2) route restart-and-install/check-for-updates through the trusted-sender wrapper; (3) separate decision on renderer sandbox; (4) defer network_mode default until the KDS/Server App LAN design is settled.