CFMS Client is the cross-platform client for the Confidential File Management System (CFMS). It securely connects to CFMS servers, provides controlled access to confidential documents, and manages file transfers. The application targets a native desktop experience and also supports Android.
Important
This client is intended only for deployed CFMS servers that you are authorized to access. It is not a general-purpose cloud-drive or file-server client.
- Secure connection and sign-in — WSS connections, trusted CA certificates, recent-server history, password or OpenSSH public-key sign-in, two-factor authentication, password changes, and password-recovery guidance.
- File workspace — directory browsing, search and sorting, favorites, breadcrumbs, item details, recycle bin, drag-and-drop uploads, and context-menu actions.
- Reliable transfers — upload-conflict handling, chunked transfers, a persistent download queue, pause/resume, retries, and batch controls.
- Access and administration — document access grants and rules, user and group management, audit entry points, and service status, subject to server-side permissions.
- Privacy and security controls — encrypted local preferences, app lock (PIN, biometrics, or passkeys when supported by the platform), screen protection, emergency lockdown state, and in-app update checks.
- Accessible, responsive UI — English and Simplified Chinese, Fluent 2 styling with locally bundled Noto Sans and Noto Serif, keyboard shortcuts, virtualized lists, and progressive loading for large directories.
- Node.js 24 (the version used by CI; local environments should meet the dependency runtime requirements at minimum)
- pnpm 11
- Rust stable, including
rustup - Platform-specific Tauri system dependencies. Android development also requires Android Studio, the Android SDK, and the NDK.
On Windows, you will normally also need the Visual Studio Desktop development with C++ workload and the WebView2 Runtime. See BUILD.md for Linux dependencies and the complete signing/release setup.
git clone --recurse-submodules https://github.com/cfms-dev/cfms_client_tauri.git
Set-Location cfms_client_tauri
pnpm install --frozen-lockfileThe CA certificate store is a Git submodule. If you already cloned the repository without submodules, initialize it with:
git submodule update --init --recursive# Start the desktop app in development mode (Tauri starts the frontend dev service)
pnpm tauri dev
# Run the frontend type check
pnpm check
# Run frontend unit tests
pnpm test
# Build frontend static assets
pnpm build
# Build an installer/package for the current platform
pnpm tauri buildUse pnpm for all JavaScript package-management and script commands. Do not use npm; keeping pnpm and the lockfile in sync is required for reproducible local and CI builds.
# Android: generate the native project once the Android toolchain is configured
pnpm tauri android init
# Start a development build on a connected device or emulator
pnpm tauri android dev
# Produce APK and AAB artifacts
pnpm tauri android buildiOS project generation and builds require macOS:
pnpm tauri ios init
pnpm tauri ios dev
pnpm tauri ios build- Launch the client, then read and accept the security disclaimer.
- Enter the CFMS server address provided by your administrator. When the port is omitted, the client uses
443. The address is validated and TLS is checked against the CA store bundled with the application. - Sign in with an authorized account. Complete two-factor verification if the server requires it.
- Use the Files workspace to browse, search, upload, and download documents; use Tasks to inspect and control transfers.
- Configure connection, language, privacy, app lock, download storage, updates, and two-factor settings in Settings as needed.
Server addresses, account permissions, document scope, and administrative features are controlled by the CFMS server. Contact the server administrator if you have lost your account password.
This client requires protocol 28, matching the server's advertised wire version; older protocol versions are rejected. Password sign-in uses method-based credentials. Login MFA exchanges an AUTH token through exchange_token with target purpose 2; required password changes use a restricted POST_AUTH token and require signing in again afterward.
The sign-in screen also accepts OpenSSH private-key files for Ed25519, RSA and NIST ECDSA, including passphrase-protected keys. The native client signs server challenges locally and supports public-key login and login MFA. The private key is never uploaded. Encrypted local preferences and transfer records use an account-scoped key in the operating system's secure storage; existing data requires its original password once for migration. Device-local keys do not replace the server's password-wrapped key or synchronize between devices.
Use Elevate privileges beside the top-bar lockdown control to request a token with purpose 6. The account's escalation policy determines whether a password, authenticator/recovery code, or no additional proof is required. The centered timer reads expiration from the issued JWT payload. Elevated tokens stay in native memory, are used for authenticated commands while valid, and expire independently of the ordinary session. Token refresh never extends elevation. Privilege elevation currently provides password and TOTP verification interfaces; elevation policies requiring public keys or extension authentication methods display an explicit unsupported-method message.
Hovering over the inactive elevation button highlights it in the caution color. While elevated, the button uses the lockdown control's danger treatment; click it again to discard the elevated token locally and return to the ordinary session immediately.
Settings → Authentication exposes credential inventory, public-key registration, label changes and deletion, and atomic revision-checked policy editing for login, MFA and elevation. Writes require elevation. The same editor is available for an account in user management to administrators with manage_user_authentication. Registering a public key does not authorize it for a purpose; policy alternatives select explicit credential IDs. The server checks whether changes preserve usable login and elevation paths.
Remote account operations select immutable user_id UUIDs, including avatars, password resets, group and permission changes, status, blocks, 2FA administration, keyring listing and direct access grants. User discovery supports explicit username or UUID selectors through get_user_info. Username remains the credential selector for password login and self-service password changes.
Update checks and CA certificate list refreshes read public repositories through the GitHub REST API. Anonymous requests normally share a limit of 60 requests per hour per originating IP address; requests authenticated with a personal access token normally use the account's 5,000-request-per-hour limit. These are GitHub's primary limits, not a guarantee that every request will succeed. See GitHub's rate-limit documentation.
To configure a token, open Settings → GitHub API. A fine-grained personal access token with minimal permissions is recommended. Public repository reading does not require write access. The token is saved in this device's secure credential storage and used only for the GitHub API requests above, including update checks before CFMS sign-in. It is not sent to your CFMS server or to update and certificate download URLs. Remove it on the same page when you no longer want authenticated requests. If it stops working, public requests continue anonymously and the client asks you to update or remove it.
CFMS is intended for confidential information. Authorized files are decrypted locally on the client device, so endpoint security is essential:
- Connect only from trusted, hardened devices and environments. Avoid using the application in public places or where others can view your screen.
- Do not disable TLS certificate validation unless you fully understand the risk and are performing controlled troubleshooting.
- Enable app lock and a system screen lock, install client updates promptly, and follow your organization's rules for handling and distributing confidential data.
- Never commit private keys, signing certificates, credentials, or build artifacts containing sensitive files.
- Keep a configured GitHub token private. It belongs to the GitHub account that created it and remains available to this device until you remove it or reset local application data.
- App lock is a privacy barrier for the UI, not a native authorization boundary: existing transfers and service state remain active while the UI is locked.
- The native client minimizes and zeroizes application-owned password, token, DEK, and serialized request buffers. WebView/JavaScript, operating-system, networking-library, register, and historical allocation copies cannot be reliably erased.
- Release builds disable frontend source maps and verbose WebView/stdout logging; Linux release builds also disable ordinary same-user process dumps. None of these controls claims to resist an administrator, root, kernel compromise, jailbroken device, or physical forensics.
The complete disclaimer is shown when the application is first used.
src/ SvelteKit pages, components, stores, and Tauri API wrappers
src-tauri/ Tauri entry point, IPC commands, platform config, and bundle resources
crates/
core/ Shared types, constants, and errors
crypto/ Key derivation, data encryption, and key wrapping
transport/ TLS, WebSocket streams, and proxy connections
transfer/ Chunked upload, download, verification, and decryption
service/ Connection, RPC, preferences, tasks, and download-queue services
static/ Icons, fonts, and frontend static assets
scripts/ Font embedding, version synchronization, and release-note tools
.github/workflows/ CI, packaging, and release automation
The frontend does not perform sensitive file I/O or network operations directly. Those operations cross the Tauri IPC boundary and are handled by the Rust service layer.
# Show, set, or increment the unified application version
pnpm app:version:show
pnpm app:version set 0.32.3
pnpm app:version bump patch
pnpm app:version:check
# Maintain the in-app changelog and export release notes
pnpm app:changelog -- --version 0.32.3 --write
pnpm app:release-notes
# Embed font assets into the application resources
pnpm assets:fontsThe version utility synchronizes package.json, the Cargo workspace, the Tauri configuration, and generated mobile version metadata where present. For the release process, platform signing secrets, and artifact details, see BUILD.md.
Issues and pull requests are welcome. Before submitting a change, run at least:
pnpm check
pnpm test
pnpm app:version:checkKeep changes focused, add appropriate tests, and do not commit build output, private certificates, keys, or real confidential documents.
This project is licensed under the Apache License 2.0.