From 01439ed29a68edcfea8b2223ced3291e2224ee0e Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Tue, 24 Feb 2026 13:56:47 -0500
Subject: [PATCH] revert vault session to localStorage (per-origin, shared
 across tabs)

sessionStorage was per-tab which forced re-entering the password on
every new tab to the same site. localStorage is scoped per-origin
which is the right granularity. The lock button clears the session
from localStorage when the user wants to end their session.
---
 public/src/vault.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/public/src/vault.js b/public/src/vault.js
index c08e1d2..5437d2f 100644
--- a/public/src/vault.js
+++ b/public/src/vault.js
@@ -156,7 +156,7 @@ const UncloseVault = {
   /**
    * Create session for auto-unlock persistence
    * Stores the password encrypted with a random session key
-   * Session is per-tab (sessionStorage): survives navigation, cleared on tab close
+   * Session persists per-origin in localStorage until explicitly locked
    */
   createSession(password) {
     if (!this.isAvailable()) return;
@@ -168,14 +168,14 @@ const UncloseVault = {
       // Encrypt password with session key
       const encryptedPassword = CryptoJS.AES.encrypt(password, sessionKey).toString();
 
-      // Store session data in sessionStorage (per-tab, survives navigation)
+      // Store session data in localStorage (per-origin, persists until locked)
       const sessionData = {
         key: sessionKey,
         data: encryptedPassword,
         created: Date.now()
       };
 
-      sessionStorage.setItem(this.SESSION_KEY, JSON.stringify(sessionData));
+      localStorage.setItem(this.SESSION_KEY, JSON.stringify(sessionData));
     } catch (e) {
       console.error('Failed to create session:', e);
     }
@@ -184,14 +184,14 @@ const UncloseVault = {
   /**
    * Try to restore session (auto-unlock)
    * Returns true if session was valid and vault unlocked
-   * Session is per-tab: each new tab requires password, navigation within a tab does not
+   * Session persists per-origin until explicitly locked
    */
   tryRestoreSession() {
     if (!this.isAvailable()) return false;
     if (this.isUnlocked()) return true; // Already unlocked
 
     try {
-      const sessionJson = sessionStorage.getItem(this.SESSION_KEY);
+      const sessionJson = localStorage.getItem(this.SESSION_KEY);
       if (!sessionJson) return false;
 
       const session = JSON.parse(sessionJson);
@@ -225,7 +225,7 @@ const UncloseVault = {
    * Clear session data
    */
   clearSession() {
-    sessionStorage.removeItem(this.SESSION_KEY);
+    localStorage.removeItem(this.SESSION_KEY);
   },
 
   /**
@@ -233,7 +233,7 @@ const UncloseVault = {
    */
   getSessionInfo() {
     try {
-      const sessionJson = sessionStorage.getItem(this.SESSION_KEY);
+      const sessionJson = localStorage.getItem(this.SESSION_KEY);
       if (!sessionJson) return null;
 
       const session = JSON.parse(sessionJson);