Abin ToppoandClaude Fable 5
1d7646d938
- Add src/core/ (config, errors, events, http, observability, storage, query) - Add src/Spreadsheet/ engine with native POI backend and Excel bridge - Add Envelope C spreadsheet flow and tender bidding envelope modules - Consolidate components into src/components/, remove legacy Component/ and Hooks/ - Add registration state/validation, auth session guard, profile edit modules - Add unit tests across axios, redux, bidding, registration, encryption, core - Add CI workflow, docs (architecture, audit, DSC API spec), keystore example - Remove tracked keystore binary; ignore scripts.zip Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
851 B
Mobile bid encryption contract
The mobile client uses the server-issued envelope key K for all bid
submissions. For text values, encrypt with AES-128/ECB/PKCS5 using the first
16 bytes of SHA-256(K) and send Base64 ciphertext. For the Envelope-C BOQ,
encrypt the raw workbook bytes with AES-128/ECB/PKCS5 using the first 16 bytes
of SHA-1(K) and upload the raw ciphertext bytes as the multipart file.
The same K must be sent as randomKeyGenerated and RSA-wrapped with every
officer/contractor public key in saveEnvelopesOfficersDetailsResDTO.
Envelope-C requestDto includes deviceType: "Mobile", fieldValue,
fieldValueInWord, hashValue (SHA-256 of the unencrypted workbook bytes),
fileName, and the wrapped officer keys. The workbook editor preserves the
source workbook structure and only applies permitted cell edits.