Montara PassOverview
The parts of Montara Pass and how they talk to each other.
Components
browser ── / ──►┐
/vault, … │ static files of the web app (apps/app)
├─ server (apps/server) ──► PostgreSQL 18
browser ── /api/v1/… ──►│ the API
extension ─ /api/v1/… ──►┘One process answers on one origin. Every endpoint starts with /api; any
other path is a file of the web app, or index.html for a route that exists
only in the browser. In development the Vite dev server plays the first role
and proxies /api to the Go server.
- The API authenticates users and stores what clients send. It validates sizes and shapes, enforces who may touch which item, and never decrypts. In production the same process also serves the web app's static files.
- The web app is the full client: it creates the vault, manages folders, items, sharing and the trash.
- The extension reads the same vault and fills logins into pages. It
imports the web app's
lib/cryptomodule directly, so both produce and read exactly the same ciphertext. - The marketing site and these docs are separate static-ish sites and do not talk to the API.
Two passwords
| Sign-in password | Master password | |
|---|---|---|
| Proves | who you are, to the server | nothing to the server |
| Sent to the server | yes, over TLS | never |
| Can be reset | yes, by email | no |
| Protects | the account | the vault's keys |
Signing in gives access to the ciphertext. Only the master password turns it into something readable.
Server layout
apps/server follows the gofi structure:
| Path | Role |
|---|---|
cmd/api | The HTTP server: flags, database, Authula, the routes under /api and the static web app |
cmd/migrate | The migration CLI |
internal/handlers | One handler per resource; reads the request, calls a repository |
internal/repositories | SQL, one repository per table group |
internal/dtos | Request bodies with their validation rules, and the response envelope |
internal/middlewares | Authorization, CORS, rate limit, error rendering |
internal/models | Row types |
migrations | SQL files, embedded in the binary |
The web app is served from ./public, relative to the working directory. When
that folder is missing, as under go run, the server serves the API only.
Web app layout
Everything lives under apps/app/src.
| Path | Role |
|---|---|
src/routes | File-based routes for TanStack Router; (auth) and (app) are groups that add no URL segment |
lib/api | One axios client that refreshes the access token on a 401, then services, queries (TanStack Query), models and dtos (zod) |
lib/crypto | Key derivation, AES-GCM, RSA-OAEP and the vault operations built on them |
lib/stores/vault.ts | The unlocked keys, in memory only |
components/{ui,block,layout} | Primitives, feature blocks and page chrome |
config/env.ts | The VITE_* variables, validated once |
The extension imports lib/crypto, the API models and the item schema from
here through its @/ alias, which points at apps/app/src.