Feat/keepass integration

[rederyk]

Ciao! I am an Italian user. I've used AI to help me with the English translation and to refine some of the QML logic, but I have tested everything extensively on my own system to make sure it's solid and fits the iNiR aesthetic.

---

Summary

Improved the KeePass integration with a focus on security, automation, and visual consistency.

Key Improvements:

• Security: Migrated the vault password cache from plain files to the system keyring via secret-tool (Secret Service API).
• Background Timer: Implemented a real background countdown timer that automatically locks the database and clears the cache when it expires.
• Enhanced Generator: Completely overhauled the password generation logic:
  • Standard passwords now guarantee at least one character of each selected type (upper, lower, number, symbol).
  • Word-based generator now mixes full-word casing (ALL CAPS vs lowercase) and interleaves symbols/numbers between words for better entropy and security.
• Live UI: Added a live countdown badge in the title bar with a progress bar. The timer turns red when close to locking (< 30s).
• Quick Extension: The timer badge is clickable to instantly reset/extend the unlock duration.
• Aesthetic Alignment: Refactored the UI to match the 'Pill' style used in iNiR settings, including proper high-contrast text inversion for readability.
• Documentation: Added a new guide in docs/KEEPASS.md.

Testing

• inir restart && inir logs — checked, no critical errors.
• Tested the specific feature path that changed — verified unlocking, background timer, live badge, manual reset, and the new generation rules.
• Both panel families checked — KeePass is currently used only in the ii panel family, but the underlying service is shared.

I hope this helps other KeePass users in the community!

[snowarch]

hey this is cool and i appreciate the effort, but it needs some work before it can go in. a few things:

• the hardcoded vault path ($HOME/Nextcloud/secrets/end4dot-keepass.kdbx) needs to be configurable, probably a config key
• the italian wordlist (_KP_WORDS_IT) should be english or pulled from the translation system
• squash the 12 commits into something clean
• GlobalStates.keepassOpen adds surface area to a singleton with 129+ consumers, worth thinking about whether this needs its own state management
• the keepassxc-cli dependency should be optional, not required — feature should gracefully degrade if it's not installed

no rush, take your time cleaning it up and ping when it's ready for another look

[rederyk]

Hi @snowarch, I've addressed all the points from your review:

• Configurable vault path: moved to a keepass.vaultDir config key, no hardcoded paths.
• Wordlist: removed the Italian hardcoded list, now pulled from the translation system via Translation.tr("keepass_wordlist").
• Commits: squashed and cleaned up — now 4 logical commits.
• GlobalStates: removed keepassOpen from GlobalStates, state is managed locally in the panel.
• Graceful degrade: if keepassxc-cli is not installed, the panel shows an install banner instead of failing; keepassxc is listed in optdepends in the PKGBUILD.

Ready for another look whenever you have time, thanks!

[snowarch]

hey, thanks for addressing the previous points. i went through the updated diff more carefully and there are still some things that need fixing before this can go in.

first — the PR scope. this should only touch keepass-related files, but right now it also modifies SidebarRight.qml (rewrites the visibility pattern to mask-based input), adds a formatTime() function to DateTime.qml, and then changes 6 other files (CalendarEventRow, EventCard, TimeButton, CalendarWidget, AnimeService, YtMusic) to use it. those are unrelated changes that affect stable code across both panel families. if you want to propose those separately thats fine, but they cant ride along in a feature PR — especially right now during a release cycle where i need clean diffs.

second — the panel doesnt follow the design system correctly. a few concrete things:

• Appearance.colors.colNegative does not exist. the error color token is colError.
• Appearance.colors.colLayer1Border does not exist. borders use colOutlineVariant or colLayer0Border.
• Appearance.font.pixelSize.tiny does not exist. smallest is the token you want.

these arent edge cases, they produce runtime warnings (Unable to assign [undefined] to QColor) every time the panel opens. i need contributors to verify their work against the actual Appearance.qml schema — the properties are all there, its just a matter of reading the file.

third — look at how ClipboardPanel.qml is structured. it uses GlassBackground for the surface (which handles all the glass/blur/transparency logic per style automatically), it has proper entry/exit animations using Appearance.animation tokens, and it handles the backdrop click-to-close pattern correctly. the keepass panel uses a bare Rectangle with hardcoded width (640px) and manual color branching in every single property (angelEverywhere/inirEverywhere/auroraEverywhere ternaries repeated 50+ times). GlassBackground exists precisely to avoid that pattern.

fourth — the translations. the PR adds keys to 16 locale files but the values are just english placeholders for everything except the wordlists. thats fine to ship as-is (the translation team can fill them in later), but just flagging it.

fifth — the service singleton (KeePass.qml) contains the IpcHandler, but since QML singletons are lazy-loaded, the IPC target only exists if the panel is loaded. if someone removes iiKeepass from their enabledPanels the whole thing goes dead silently. other services that need IPC (like Audio, Cliphist) are referenced by always-loaded components which forces their instantiation. worth thinking about how to ensure the handler is always available.

the backend script and the service logic are solid — the architecture of script + service + panel is right, the secret-tool caching is good, the timer system makes sense. its really the panel UI that needs a rewrite following the existing patterns, and the unrelated changes need to be dropped from this branch.

no rush, take your time.

[snowarch]

Thanks @rederyk — solid feature and clearly tested. Two blockers before it can land:

1. It currently conflicts with main and needs a rebase.
2. The history has commits co-authored by an AI assistant — iNiR keeps AI attribution out of git, so please squash/re-author so the commits are yours only.

Once it's rebased and cleaned up I'll review the keyring + timer logic properly.

[rederyk]

Rebased onto latest main and cleaned up the history as requested 🙏

Blockers addressed

• Rebase: rebased onto current main. Conflicts resolved in defaults/config.json, scripts/lib/ipc-registry.sh (regenerated with generate-ipc-registry.py, --check passes) and the 14 conflicting translation files (only the keepass_* strings re-applied on top of the new main). PR is now MERGEABLE / clean.
• AI attribution: removed the Co-Authored-By trailers — the history is now 3 commits authored by me only.

Two small functional fixes I folded in while rebasing

• Password generator (word mode): when both numbers and symbols were enabled, the per-gap separator picked one or the other at random, so a generated passphrase could miss a whole type (and the short 2-word preset has a single gap, making both impossible). It now guarantees every selected type appears at least once, matching the standard generator's behaviour. Verified across length presets.
• Entry list UX: navigating the results with ↑/↓ now auto-selects the highlighted entry, so a single Enter copies (no more double-press) and Alt reveals the entry you're looking at.

Ready for the keyring + timer review whenever you have time — happy to adjust anything there.

[rederyk]

Pushed a round of keyring + timer hardening (the area you flagged), all squashed into the existing commits — still 3 clean commits authored by me.

Keyring

• Cache items are now scoped per vault (a path attribute), so vaults with different master passwords can't feed each other a stale password — verified live across two vaults (switching vaults forces a fresh unlock, no cross-vault reuse).
• The cache is wiped on shell start: there's no auto-unlock from the keyring, so a lingering master password was pure risk. Now it never outlives the session that created it.
• No-keyring fallback: if no Secret Service is reachable, the password is kept in memory for the session instead of silently failing copy/reveal (probed once at startup).
• Optional KP_DEBUG=1 trace logs every keyring decision (cache hit/miss, store, clear, stdin fallback) so you can audit that nothing silently falls back — off by default, zero overhead, documented in docs/KEEPASS.md.

Timer / TTL

• keepass.cacheTtl is now persisted (config + Settings → Services → KeePass), so the "stay unlocked" duration survives restarts. The unlock-panel slider updates its label live while dragging and commits the value on the actual unlock.

Also folded in earlier: the word generator now guarantees every selected character type, and the entry list auto-selects on ↑/↓ so a single Enter copies.

Tested live (Niri + gnome-keyring): unlock → copy/reveal all hit the keyring cache, lock clears the scoped item, startup wipes stale items. Happy to adjust anything.

[rederyk]

One more fix folded into the feat commit: add could report "Failed to add entry" even though the entry was saved.

cmd_add ended its success branch with [[ -z "$(read_cache)" ]] && write_cache …. When the cache already exists (the normal case — DB unlocked), the test is false, so that && list (the function's last statement) returned exit 1, making a successful add look like a failure — which also flipped the UI back to the locked state. Replaced it with an explicit if … fi + return 0. Verified the entry is added and the panel stays unlocked.