Memories

Memories / Documentation

On this page

Memories Web

Open Memories Web in a browser and connect to an existing hosted Center. This is a Center client, not a browser-local encrypted vault. Center operators can read hosted content. Native clients remain the place for device-only secrets, end-to-end pairing, and conflict resolution.

Connect

With account authentication enabled, choose Log in or Register. Email registration sends a one-time verification code, valid for 15 minutes. Enter it and choose a password of 12-256 UTF-8 bytes to create your private hosted vault, then log in. Username registration is available when selected by the operator. Registration may be closed independently of login. SMTP failure never bypasses verification. Password reset and email/username changes are not yet supported.

For administrator-provisioned members or older Centers, choose Use token:

  1. Obtain your Center's HTTPS origin and a member or scoped grant token from its administrator. An admin token does not authorize content access.
  2. Enter the origin and token in Web. For hosted SaaS, use https://memories.ivjn.us; the public Web page selects this address by default. You can also enter your own Center (for example https://center.example.com). Do not put tokens or passwords into URLs. Existing member tokens continue to work and are not automatically converted into password accounts.
  3. The granted vault and scope appear after connection. Read, write and delete controls follow the grant; the server independently enforces every operation.

You can browse memories, knowledge cards and files; search their titles/tags; create and edit memory/card text; edit card tags and privacy; upload files up to 12 MiB; download files; and delete items when your grant permits it. Additional card fields are displayed read-only, with sensitive fields hidden. Updating text preserves existing structured and protected metadata on the server. Credentials, E2E secret material and conflicted revisions are not editable in this client. Files are downloaded as attachments and never executed or previewed in the page.

Deploy with a Center

New Center builds include the same frontend at /app/. No additional web server is needed. Use the existing HTTPS reverse proxy in front of the Center for remote access; plain HTTP is supported only on loopback for local development.

Same-origin use (https://center.example.com/app/ connecting to https://center.example.com) requires no CORS configuration. To use the public website as the frontend, allow that specific origin when starting the Center:

memories-center --data /path/to/center --web-origin https://memories.ivjn.us

Keep the existing protected environment configuration for signing, admin tokens, grants and the hosted password. --web-origin is repeatable or comma-separated; MEMORIES_CENTER_WEB_ORIGINS is its equivalent environment setting. HTTPS origins are required except for explicit localhost/loopback development origins. No wildcard, credentialed URL, path, query or fragment is accepted.

CORS is limited to hosted session, account authentication, memories and RPC endpoints. It does not allow browser access to admin, enrollment or grant-management endpoints and does not relax bearer authorization. An existing Center must be upgraded to serve /app/ or use this origin setting. A reverse proxy that already implements an equivalent exact-origin policy can serve the existing content API instead.

Session behavior

Account login creates a one-hour bearer grant. Disconnect attempts to revoke that session, including when the page locks or exits. If the browser cannot send the logout request, the grant remains valid until its server-enforced expiry. Closing registration or changing its mode does not terminate existing accounts.

The bearer and returned content are held only in page memory, not localStorage, sessionStorage, IndexedDB or a service-worker cache. Only the language preference is saved. Reloading, navigating away, switching the page into the background, or five minutes without interaction clears the connection and visible content. Unsaved changes are discarded on automatic lock. JavaScript garbage collection does not guarantee physical erasure of memory, browser extensions or debugging tools can inspect it, and downloaded files remain on your device.

The client binds each token to the selected origin and rejects redirects. It cancels pending requests on disconnect and discards late responses. A request that reached the server can still finish after cancellation: check the result before retrying an interrupted write.

中文使用说明

打开网页版，填写自己的 Center HTTPS 地址，以及 管理员提供的成员或授权令牌。托管 SaaS 地址为 https://memories.ivjn.us，官网网页版 会默认选择该地址，也可以手动连接自己的 Center。启用账号服务后可选择登录或注册：邮箱 模式先验证邮箱再设置密码，用户名模式直接创建账号。管理员可关闭注册，已有账号仍可登录。 已有成员可选择“使用令牌”；管理员令牌不能用于内容登录。

连接后可浏览、按标题和标签搜索记忆/卡片/文件，编辑记忆与卡片正文、标签和私人标记， 上传最大 12 MiB 的文件并下载，在权限允许时删除内容。卡片附加字段目前只读，敏感字段 保持隐藏；编辑正文不会覆盖服务器已有的结构化资料。凭据、设备端到端秘密和版本冲突 请继续使用原生客户端处理。

新版 Center 自带 /app/ 页面，同源连接不需要跨域设置。从官网连接自己的 Center 时， 请为服务增加 --web-origin https://memories.ivjn.us，并沿用原来的受保护服务环境配置。 这只开放指定内容接口的浏览器来源，不改变每次请求的令牌与权限校验。

令牌与内容仅放在页面内存中。刷新、切到后台或空闲 5 分钟会锁定并清除页面资料， 自动锁定会丢弃未保存编辑。数据保存在 Center，服务器运营者可以读取；本版本不提供 浏览器本地加密保险库。网络中断时先刷新核对写入结果，避免重复提交。