toga-ai 1.0.584 → 1.0.585

package/knowledge/1.0/apps/tools/INDEX.md

@@ -6,7 +6,7 @@
 | [ClickUp Sprint Dashboard (tools /clickup/react)](features/clickup-sprint-dashboard.md) | A native **ClickUp sprint dashboard** in the 1.0 `tools` app at route `/clickup/react`, built for a wall-mounted **TV display** ("TOGa IQ" internal sprint metri | tools/_/app/clickup/sprint.php, tools/v2/sprints/tile/index.php, tools/v2/sprints/current/index.php, tools/v2/sprints/status-breakdown/index.php, tools/v2/sprints/worktype-breakdown/index.php, tools/v2/sprints/points-by-dev/index.php, tools/v2/sprints/burndown/index.php, tools/assets/clickup/sprint-dashboard.html, tools/mvc/clickup/react/get.php, tools/mvc/login/get.php, tools/_/app/nav.php |
 | [CloudFront Client Setup](features/cloudfront-client-setup.md) | An SSO-gated admin tool at **`/devops/cloudfront-clients`** in the Tools 1.0 app that onboards a client onto **CloudFront + Route 53 across multiple AWS account | tools/_/app/devops/cloudfront.php, tools/mvc/devops/cloudfront-clients/get.php, tools/mvc/devops/cloudfront-clients/post.php, tools/assets/js/cloudfront-clients.js, tools/assets/css/cloudfront-clients.css, tools/_/app/nav.php, tools/_/app/frameworkindex.php, tools/config.production.ini |
 | [Design Demo Admin](features/design-demo-admin.md) | A self-serve admin UI at **`/design`** in the SSO-protected **Tools** app that lets the design team publish self-contained "Claude Design" HTML exports as **ver | tools/_/app/design/github.php, tools/mvc/design/get.php, tools/mvc/design/post.php, tools/assets/css/design.css, tools/assets/js/design.js, tools/_/app/frameworkindex.php, tools/_/app/nav.php, tools/composer.json |
-| [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php |
+| [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php, tools/mvc/developers/password/post.php |
 | [/errors Curation Console (Tools → shared Core Logs DB)](features/errors-curation-console.md) | Internal-only triage/curation screen for the 2.0 Issue/Event error-reporting pipeline, built as a 1.0 Tools MVC page reading the **shared Core Logs DB** through | tools/mvc/errors/get.php, tools/mvc/errors/post.php, tools/mvc/errors/issue/get.php, tools/assets/css/style.css, tools/_/app/nav.php, tools/config.production.ini |
 | [Legacy Email Notifier (tools /email-migration/notify)](features/legacy-email-notifier.md) | An SSO-gated admin tool at **`/email-migration/notify`** (nav group **Email Migration** > **Legacy Notifier**, personas `['TOGa Technology','Development Team']` | tools/mvc/email-migration/notify/get.php, tools/mvc/email-migration/notify/post.php, tools/_/app/nav.php |
 | [Tools MVC — Routing, CSRF & App_Database Access Patterns](features/mvc-data-access-patterns.md) | The load-bearing 1.0 (`App_`) framework conventions a developer needs when adding a page to the Tools app — URL routing, CSRF, and DB access through `App_Databa | tools/_/app/nav.php, tools/mvc/get.php, library/app/error.php, library/app/database.php |

package/knowledge/1.0/apps/tools/features/developer-tools.md

@@ -6,14 +6,16 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-08-14
 owners: [jcardinal]
 files:
   - tools/mvc/developers/uuid/get.php
   - tools/mvc/developers/password/get.php
+  - tools/mvc/developers/password/post.php
 related:
   - ../architecture.md
   - ./persona-gated-navigation.md
+  - ./mvc-data-access-patterns.md
 ---
 
 ## Summary
@@ -28,10 +30,28 @@ personas **Development Team** / **TOGa Technology**. They are the reference exam
 - Server generates an RFC 4122 **v4** UUID via `random_bytes(16)` with version/variant bits set.
 - UI is click-to-copy, then instant **client-side** regenerate using `crypto.getRandomValues`.
 
-### Generate Password (`mvc/developers/password/get.php`)
-- Reproduces the standalone `test/team/generate_password.php` script.
-- `App_String::generateSupportCode(8)` produces the password; `App_String::passwordHash()`
-  produces the bcrypt hash. The page shows **both** the password and the hash, each copyable.
+### Generate Password (`mvc/developers/password/get.php` + `post.php`)
+- **Random support-code card (default, on page load):** reproduces the standalone
+  `test/team/generate_password.php` script. `App_String::generateSupportCode(8)` produces the
+  password; `App_String::passwordHash()` produces the bcrypt hash. The page shows **both** the
+  password and the hash, each copyable. Unchanged.
+- **Hash-your-own-password card:** the user types a password and gets its bcrypt hash without a
+  full page reload. bcrypt cannot run client-side, so the UI `fetch`es a sibling
+  `post.php` — the framework routes any non-GET for `/developers/password` to
+  `mvc/developers/password/post.php` (folder == route 1:1). `post.php` exposes one JSON action
+  `hash`, guarded with the standard tools pair `App_Auth::requireAuth()` then
+  `App_Page::validateCrossSiteRequestForgery()`. That CSRF check is **Origin/Referer-based, not
+  a token**, so a same-origin `fetch` passes with no embedded token (see
+  [mvc-data-access-patterns](./mvc-data-access-patterns.md)).
+- **Security discipline:** the clear-text password is **never logged or persisted**. A
+  `MAX_PASSWORD_BYTES = 4096` guard bounds input, and the endpoint returns a `truncated` flag
+  because bcrypt only consumes the first 72 bytes — the UI shows a note when that is exceeded.
+
+## Gotcha — bcrypt's 72-byte limit
+`password_hash`/`App_String::passwordHash()` silently ignores everything past the first **72
+bytes** of the input. The hash-your-own card surfaces this to the user (`truncated` flag + UI
+note) rather than letting a longer password appear to "work" while extra characters are dead.
 
 ## Change history
+- 2026-08-14 — Added a "hash your own password" card to the Generate Password tool: a new sibling `mvc/developers/password/post.php` exposes one JSON `hash` action (requireAuth + Origin/Referer CSRF), so the UI bcrypt-hashes user-typed input via `fetch` without a page reload; clear-text is never logged/persisted, `MAX_PASSWORD_BYTES=4096` guard, and a `truncated` flag surfaces bcrypt's 72-byte limit. Also fixed missing inter-card spacing by adding a `tool--password` wrapper modifier + `.tool--password .card { margin-bottom }` (mirroring `.tool--errors`; note style.scss is dead — edit style.css directly). (jcardinal)
 - 2026-06-25 — Built the first two Developers tools: RFC 4122 v4 UUID generator and a password+bcrypt-hash generator (ported from test/team/generate_password.php), both gated to Development Team / TOGa Technology personas (jcardinal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.584",
+  "version": "1.0.585",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",