Hey guys, how’s everything going? I’m alright. I’m so glad hackclub postponed the end of stardance, I have still another month to 1. finish this project 2. do other projects I had on my mind for such a long time. Before doing this devlog, I had to use claude to debug my work, because I had some errors I didn’t understand (I was using a class created for a test in the normal “code”), so bad :( and also other small issues.

Lately I worked on one of the most significat features for me, which is 2FA. As my network teacher says "zero trust, because the world is a place full of bastards".
2FA is one of the techniques I use to follow this approach.

Basically, now you can press “Enable” in your preferences, scan the QR code with any authenticator app (f.e google), or just type the secret by hand, because half the people can’t frame a QR code at the first time, lol.
You also have to confirm with a code. At login, if 2FA is on, there’s a second step for the six digits. You also get ten recovery codes that you can copy or download, shown only once. Turning it off asks for your password, so a stolen open session can’t remove this precaution.

You’re probably wondering: are the secrets encrypted? Yes, they are. I mostly use AES-GCM, because it’s pretty simple, but also secure, so it’s the better compromise. The TOTP secret and the mailbox passwords are stored encrypted with AES-GCM. The key lives in an env variable, not in the db, so a database dump alone isn’t enough to generate codes or read someone’s email.

I also turned the crm in a PWA. You can install it on your phone or desktop, it has its own icon and window, and when I deploy a new verion, it tells you to reload, instead of silently serving you the old one from cache (it also checks every 6 hours, maybe I’m gonna change it to 10, idk, for the tab you leave open for days)

Like in every other devlog, I made some tests and updated the docs. The report engine now has tests against a real Postgres started in docker, and the repo finally has a real README (it’s not finished, just with some basic information, claude, thanks for the suggestion of making it).

Oh, I nearly forgot. I also worked on emails.

Now I’m currently working on the Italian electronic invoice, which is called FatturaPA. The crm
builds the XML from an invoice, and the first test I wrote checks it against the official government XSD: if it doesn’t pass, it isn’t saved.

I think I’m gonna study a bit of english / american law, to allow people out of Italy to use this app as well.
I hope you like my product, see you soon