head element:
<head>
<script> src="../storage-free-pass.api/API.js"</script>
</head>
In the <body> element, add a single script. It should define the function const userData = () => {/*...*/}; and return the structure of the user accounts. For example:
"use strict";
const userData = () => {
const defaultPasswordLength = 16;
const testCharacterRepertoire = "1234567890ABCDDEFG";
const strongCharacterRepertoire = "!#$%&()+-0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^abcdefghijkmnopqrstuvwxyz|~/";
return {
metadata: { title: `User Data Sample ${String.fromCodePoint(0x1f9e1)}`, version: "1.0.0", },
accounts: [
{
identity: {
seed: "Test",
selection: { characterRepertoire: testCharacterRepertoire, start: 0, length: 8, shift: 0 }
},
display: { name: "Test" }
},
{
identity: {
seed: "Real account 2020/02/14",
selection: { characterRepertoire: strongCharacterRepertoire, start: 0, length: 24, shift: 0 }
},
display: { group: "$", name: "Real Account", user: { name: "user", url: "./redirect-demo/accounts.html" } }
},
], // accounts
default: {
identity: {
seed: "ERROR! define seed!",
selection: { characterRepertoire: strongCharacterRepertoire, start: 0, length: defaultPasswordLength, shift: 0 }
},
display: { name: "Incomplete account", url: "https://www.undefined.account", user: { name: "unknown user", url: String.empty } }
},
};
};
Title string representing the user's account set. It is displayed as the browser's page/tab title and the title of the account selector.
Optional string representing version of the user's account set, if defined, shown in the title of the account selector.
Array of account objects. Each object in the array has the same structure as default,
which is used to populate undefined members of each account structure, so, all members of each account are formally optional.
For explanation of account object members, see default below.
However, three members are practically essential in all cases:
This field is critically important and should be unique. Combined with master password, it is used for generation of cryptographic hash.
If an account password has to be changed, some part of seed should be modified, otherwise new password will be the same as old one,
or made different only due to the changes in selection, which would be not safe enough.
It's a good idea to include date or date/time of the new password creation in the seed string.
This name is used for UI navigation using the list box on left.
Besides, it is shown on top of the account table, which also can be used as an anchor, if display.url is defined.
This name is used as a logon name for authentication.
All members of default are mandatory and should not be assigned to undefined. They represent account
data used to fill in all undefined members of each account:
Set of parameters which uniquely determine the content of the password string, depending on master password:
Seed string used for cryptographic hash generation. The hash is generated from a master password and
seed.
Parameters of selection of password string based on generated cryptographic hash:
Character repertoire string used to represent part of generated cryptographic hash array in textual
form.
A password string will be composed from the characters taken from character repertoire and also
those
found in inserts.
Starting index in the cryptographic hash array. This is an integer value which doesn't have to be less than the size of the array.
Length of the password string, not counting inserts.
Integer representing shift in the character repertoire. This index doesn't have to be less then the length of the character repertoire.
Inserts member is used to work around the problem with the sites with some special password rules. For example, some rules require the presense of at least one character of each of several character sets. To meed such criteria, some fixed character sequences can be inserted into the automatically generated password string in different positions. This is an object with the structure shown below, or and array of such objects:
String value of the text to be inserted in the password string.
Optional position of the text to be inserted in the password string. If this value exceeds the length of
current password string, the value is appended. If this value is negative, the
position is counted from the end of the current password string. If it is not defined, it is equivalent to position 0.
Set of parameters which do not affect the content of the password string. The only member which affects login
is
user.name. All the members are used for the presentation of account data in UI:
Display name of the account, used in the navigation list box and in the header of the account table.
Optional string representing a group of accounts shown in the account selector. Note that grouping can re-order accounts, as accounts with the same group name are grouped together. The accounts for which the group is not defined are placed on top of the list.
URL of the site where authentication is required. Ideally, it should be a logon page or a page where logon is clearly visible. If URL is defined, the header of the account table becomes an anchor used to navigate to the authentication page.
User name used for authentication. It can be viewed or obtained via the system clipboard.
User-provided URL used to place additional informal data related to the account. If URL is defined "User" part of the "User Name" lable becomes a anchor.
Optionally, the user can provide a custom cryptosystem:
<head>
<script>script data-crypto="../storage-free-pass.api/crypto.js" src="../storage-free-pass.api/API.js"</script>
</head>
The file “crypto.js” can be any file used to replace the file “storage-free-pass.api/crypto.js”. If should implement the same functionality and define the function const passwordGenerator = (() => {/* ... */}.
The file is found by the attribute script attribute data-crypto. If this attribute is not defined, the default file “storage-free-pass.api/crypto.js” is used.