About:Pharmacopedia.ext - Revision history

MDElliottMD: 0.9.8.7 close-out: star hold-to-expand model, editor enhancements module, vote removal (boss-claude)

2026-05-28T02:45:58Z

0.9.8.7 close-out: star hold-to-expand model, editor enhancements module, vote removal (boss-claude)

MDElliottMD: 0.9.8.7 Security section: correct live TLS config (HIGH:!aNULL, TLS1.0/1.1 allowed), fix LocalSettings.php owner (root:www-data), AbuseFilter 2/2 enabled, OATHAuth 5 recovery codes, HSTS preload pending

2026-05-27T11:07:05Z

0.9.8.7 Security section: correct live TLS config (HIGH:!aNULL, TLS1.0/1.1 allowed), fix LocalSettings.php owner (root:www-data), AbuseFilter 2/2 enabled, OATHAuth 5 recovery codes, HSTS preload pending

← Older revision		Revision as of 11:07, 27 May 2026
Line 68:		Line 68:
	TLS terminates at Apache 2 (mod_ssl) on the same host as the application. No CDN, no reverse proxy, no load balancer is in front. Certificate is a Let's Encrypt ECDSA leaf, renewed by <code>certbot.timer</code> (fires twice daily, renews when within 30 days of expiry). Private key on disk is mode 600 root:root in <code>/etc/letsencrypt/archive/pharmacopedia.wiki/</code>.		TLS terminates at Apache 2 (mod_ssl) on the same host as the application. No CDN, no reverse proxy, no load balancer is in front. Certificate is a Let's Encrypt ECDSA leaf, renewed by <code>certbot.timer</code> (fires twice daily, renews when within 30 days of expiry). Private key on disk is mode 600 root:root in <code>/etc/letsencrypt/archive/pharmacopedia.wiki/</code>.

	Apache TLS config (from <code>/etc/letsencrypt/options-ssl-apache.conf</code>~~, loaded by every Pharmacopedia vhost~~):		Apache TLS config (live from <code>/etc/letsencrypt/options-ssl-apache.conf</code> + <code>/etc/apache2/mods-enabled/ssl.conf</code>):

	SSLProtocol all ~~-SSLv2~~ -SSLv3 ~~-TLSv1 -TLSv1.1~~		SSLProtocol all -SSLv3
	SSLCipherSuite ~~ECDHE-ECDSA-AES128-GCM-SHA256~~:~~ECDHE-RSA-AES128-GCM-SHA256:~~		SSLCipherSuite HIGH:!aNULL
	~~ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:~~
	~~ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:~~
	~~DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384~~
	~~SSLHonorCipherOrder off~~
	SSLSessionTickets off		SSLSessionTickets off

	Effective ~~enabled~~: TLS 1.~~2 + TLS~~ 1.3 ~~only~~. ~~TLS 1~~.0 / 1.1 ~~refused~~. <code>SSLSessionTickets off</code> preserves forward secrecy across server restarts.		Effective TLS range: TLS 1.0 through 1.3 (SSLv3 explicitly refused). The cipher suite shorthand <code>HIGH:!aNULL</code> covers all ECDHE + DHE forward-secrecy ciphers but does not exclude TLSv1.0 or TLSv1.1 at the protocol layer. Hardening to an explicit modern list and <code>SSLProtocol -TLSv1 -TLSv1.1</code> is queued; see ''Honest limitations'' below. <code>SSLSessionTickets off</code> preserves forward secrecy across server restarts.

	HSTS:		HSTS:
Line 84:		Line 80:
	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload		Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

	Two years, subdomains included, preload-ready.		Two years, subdomains included, preload-ready. The <code>preload</code> directive is present in the header; submission to the Chromium HSTS preload list is pending.

	=== HTTP security headers ===		=== HTTP security headers ===
Line 150:		Line 146:
	The high-trust paths and their modes (no values published):		The high-trust paths and their modes (no values published):

	/var/www/mediawiki/LocalSettings.php 640 ~~www-data~~:www-data		/var/www/mediawiki/LocalSettings.php 640 root:www-data
	contains: $wgSecretKey, $wgUpgradeKey, $wgDBpassword,		contains: $wgSecretKey, $wgUpgradeKey, $wgDBpassword,
	$wgTurnstileSecretKey, $wgSMTP['password'],		$wgTurnstileSecretKey, $wgSMTP['password'],
Line 181:		Line 177:
	MediaWiki passwords are stored as PBKDF2 hashes (MW core default). Verified across every <code>user_password</code> row: HMAC-SHA-512 inner hash, 30,000 iterations, 64-byte derived key, 16-byte random salt per user. The <code>$wgPasswordConfig</code> default is unmodified; bcrypt is available in MW core but not enabled.		MediaWiki passwords are stored as PBKDF2 hashes (MW core default). Verified across every <code>user_password</code> row: HMAC-SHA-512 inner hash, 30,000 iterations, 64-byte derived key, 16-byte random salt per user. The <code>$wgPasswordConfig</code> default is unmodified; bcrypt is available in MW core but not enabled.

	Two-factor authentication via the OATHAuth extension. Default module is TOTP per RFC 6238: HMAC-SHA-1 inner, 6 digits, 30-second time-step, 80-bit shared secret. ~~Ten~~ recovery codes per user, each a random ~~10-character~~ string, hashed at rest, consumed on use. WebAuthn / FIDO2 (passkey) is available in the same extension and is the operator's first-choice path.		Two-factor authentication via the OATHAuth extension. Default module is TOTP per RFC 6238: HMAC-SHA-1 inner, 6 digits, 30-second time-step, 80-bit shared secret. Five recovery codes per user, each a random string, hashed at rest, consumed on use. WebAuthn / FIDO2 (passkey) is available in the same extension and is the operator's first-choice path.

	==== AdminCrypto ====		==== AdminCrypto ====
Line 234:		Line 230:

	* Cloudflare Turnstile gates account creation, repeated failed logins, URL-bearing edits, and email-sending. Editors are not challenged on normal edits (a deliberate friction trade-off).		* Cloudflare Turnstile gates account creation, repeated failed logins, URL-bearing edits, and email-sending. Editors are not challenged on normal edits (a deliberate friction trade-off).
	* The AbuseFilter extension is ~~installed and configured; the~~ active-rule set is small ~~today and~~ the lane will grow as live-fire patterns emerge.		* The AbuseFilter extension is loaded with 2 rules, both enabled as of 0.9.8.7. Rule 1: spam-keyword block (block + disallow). Rule 2: new-account edit throttle (throttle). The active rule set is small; the lane will grow as live-fire patterns emerge.
	* Every file or image upload is scanned by ClamAV before the file moves into the persistent store. The scanner is run via <code>clamdscan</code> (persistent daemon, fast) with a fallback to <code>clamscan</code>. The gate is fail-closed: exit 0 = clean (proceed), exit 1 = infected (reject + unlink), any other exit = error (reject + unlink). A scanner crash never becomes a pass.		* Every file or image upload is scanned by ClamAV before the file moves into the persistent store. The scanner is run via <code>clamdscan</code> (persistent daemon, fast) with a fallback to <code>clamscan</code>. The gate is fail-closed: exit 0 = clean (proceed), exit 1 = infected (reject + unlink), any other exit = error (reject + unlink). A scanner crash never becomes a pass.
	* fail2ban (see ''SSH + host'' above) bans abusive IPs at the network layer.		* fail2ban (see ''SSH + host'' above) bans abusive IPs at the network layer.
Line 247:		Line 243:
	* '''No CDN, no DDoS layer.''' One VM, three open ports, UFW + fail2ban. Hostile traffic can take the site down; it cannot exfiltrate.		* '''No CDN, no DDoS layer.''' One VM, three open ports, UFW + fail2ban. Hostile traffic can take the site down; it cannot exfiltrate.
	* '''Some application-layer key rotation is "never" by design.''' The voter-hash secret and the AdminCrypto Mode B master key cannot rotate without breaking either anonymity or existing wrappings respectively. Loss of either key has the obvious one-time consequence; trading that off against the alternative (re-encrypt every historical record) was the deliberate choice.		* '''Some application-layer key rotation is "never" by design.''' The voter-hash secret and the AdminCrypto Mode B master key cannot rotate without breaking either anonymity or existing wrappings respectively. Loss of either key has the obvious one-time consequence; trading that off against the alternative (re-encrypt every historical record) was the deliberate choice.
	* '''~~Two enabled AbuseFilter rules~~.''' The ~~pipeline~~ is ~~in place;~~ the ~~rule set is small~~. ~~Honest signal: this~~ is ~~plumbing for future use, not active filtering today~~.		* '''TLS allows TLSv1.0 and TLSv1.1.''' The live Apache literal is <code>SSLProtocol all -SSLv3</code>, which does not exclude older TLS protocol versions at the protocol layer. Hardening to an explicit modern cipher list with <code>SSLProtocol -TLSv1 -TLSv1.1</code> is queued.
	* '''Perspective-invite tokens are half-migrated to hashed storage.''' 0.9.8.7 added the <code>pvi_token_hash</code> column, backfilled it, and switched the lookup to hash-first; the cleartext <code>pvi_token</code> column is still present so the dual-write fallback works during the deploy edge. 0.9.8.8 drops the cleartext column and the fallback branch, at which point a database-read attacker can no longer extract usable invite tokens. Severity in the interim: an attacker with DB read can still submit a perspective under a planted invite identity; not access to medical data.		* '''Perspective-invite tokens are half-migrated to hashed storage.''' 0.9.8.7 added the <code>pvi_token_hash</code> column, backfilled it, and switched the lookup to hash-first; the cleartext <code>pvi_token</code> column is still present so the dual-write fallback works during the deploy edge. 0.9.8.8 drops the cleartext column and the fallback branch, at which point a database-read attacker can no longer extract usable invite tokens. Severity in the interim: an attacker with DB read can still submit a perspective under a planted invite identity; not access to medical data.

MDElliottMD: 0.9.8.7 close-out: Security & encryption refresh -- M3 perspective-invite hashing subsection added, backups section names 14-day active + up-to-180-day recovery-layer, honest limitations updated, OAuth 2.0 subsection notes iOS-autofill autocomplete attrs

2026-05-24T01:21:09Z

0.9.8.7 close-out: Security & encryption refresh -- M3 perspective-invite hashing subsection added, backups section names 14-day active + up-to-180-day recovery-layer, honest limitations updated, OAuth 2.0 subsection notes iOS-autofill autocomplete attrs

← Older revision		Revision as of 01:21, 24 May 2026
Line 1:		Line 1:
	'''Version:''' 0.9.8.6 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5		'''Version:''' 0.9.8.7 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5
	'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later		'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later
	'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>		'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>
Line 200:		Line 200:
	==== OAuth 2.0 (iOS app) ====		==== OAuth 2.0 (iOS app) ====

	The iOS app authenticates against the wiki via the MWOAuth extension. RSA-4096 signing keypair generated 2026-05-22 with <code>openssl genrsa</code>; JWT signing algorithm RS256. Access tokens live 1 hour; refresh tokens 1 month (MWOAuth defaults). PKCE with S256 challenge is REQUIRED for public clients (<code>$wgOAuth2RequireCodeChallengeForPublicClients = true</code>); the iOS bundle never holds a client secret. Tokens are stored at rest in the wiki's session cache keyed by hashed token (the tokens themselves are opaque to the cache row). The browser-to-app handoff goes via a small HTML+JS bridge at <code>https://pharmacopedia.wiki/app/oauth-callback</code> that forwards the authorization code + state to the <code>pharmacopedia://oauth</code> custom URL scheme.		The iOS app authenticates against the wiki via the MWOAuth extension. RSA-4096 signing keypair generated 2026-05-22 with <code>openssl genrsa</code>; JWT signing algorithm RS256. Access tokens live 1 hour; refresh tokens 1 month (MWOAuth defaults). PKCE with S256 challenge is REQUIRED for public clients (<code>$wgOAuth2RequireCodeChallengeForPublicClients = true</code>); the iOS bundle never holds a client secret. Tokens are stored at rest in the wiki's session cache keyed by hashed token (the tokens themselves are opaque to the cache row). The browser-to-app handoff goes via a small HTML+JS bridge at <code>https://pharmacopedia.wiki/app/oauth-callback</code> that forwards the authorization code + state to the <code>pharmacopedia://oauth</code> custom URL scheme. Special:UserLogin and Special:CreateAccount also carry <code>autocomplete</code> field attributes (<code>username</code>, <code>current-password</code> / <code>new-password</code>, <code>email</code>) injected by the <code>AuthChangeFormFields</code> hook so iOS Safari + system password managers offer the right credentials on the right field.

	==== Voter anonymity ====		==== Voter anonymity ====

	Every vote stores a HMAC-SHA-256 of the voter's user id, salted with <code>$wgPharmacopediaVoteHashSecret</code> (256 bits, never rotated by policy). The hash is a 64-character hex string in <code>pcp_votes</code> in place of the user id, so an administrator reading the votes table cannot map a vote back to an identity without the secret. The secret lives only in LocalSettings.		Every vote stores a HMAC-SHA-256 of the voter's user id, salted with <code>$wgPharmacopediaVoteHashSecret</code> (256 bits, never rotated by policy). The hash is a 64-character hex string in <code>pcp_votes</code> in place of the user id, so an administrator reading the votes table cannot map a vote back to an identity without the secret. The secret lives only in LocalSettings.

			==== Perspective-invite tokens ====

			The perspective subsystem's invite tokens are 24-byte URL-safe random strings handed to invitees in <code>Special:Perspective/<token></code> links. As of 0.9.8.7, every new invite stores BOTH the cleartext token in <code>pcp_perspective_invite.pvi_token</code> AND a SHA-256 hash of the same token in a new <code>pvi_token_hash</code> column (<code>BINARY(32)</code>, <code>UNIQUE</code>). Lookup at <code>PerspectiveStore::resolveToken</code> hashes the inbound URL token and searches by hash first; a cleartext-column fallback covers any row not yet backfilled at deploy edge. Hashing reuses the canonical <code>AdminCrypto::hashInviteToken</code> helper (raw 32-byte SHA-256), the same shape as the existing <code>pcp_administer_invites.inv_token_hash</code> pattern.

			Honest current status: this is half-shipped on purpose. The cleartext <code>pvi_token</code> column is still present so the lookup-fallback works during the dual-write cycle; 0.9.8.8 drops the cleartext column and the fallback branch, at which point a database-read attacker can no longer extract usable perspective-invite tokens.

	=== Backups ===		=== Backups ===
Line 213:		Line 219:
	--passphrase-file /root/.backup-passphrase		--passphrase-file /root/.backup-passphrase

	GPG packet inspection on a current bundle confirms cipher 9 (AES256), S2K mode 3 (iterated and salted), S2K count 65,011,712 iterations, MDC method 2 (modification-detection code present). Local retention is 7 days; off-host (Dropbox via rclone) is 60 ~~days~~. The passphrase file is 64 bytes random, mode 600 root:root, never transmitted off-host.		GPG packet inspection on a current bundle confirms cipher 9 (AES256), S2K mode 3 (iterated and salted), S2K count 65,011,712 iterations, MDC method 2 (modification-detection code present). Local retention is 7 days; off-host (Dropbox via rclone) is 14 days as of 2026-05-23 (was 60). The passphrase file is 64 bytes random, mode 600 root:root, never transmitted off-host.

			The 14-day window describes ACTIVE off-host storage: after 14 days the encrypted bundle is removed from the active view of the off-host provider by the nightly rotation. The current off-host provider (Dropbox Pro) additionally retains deleted files in a deletion-recovery layer for up to 180 days, during which the encrypted bundle may remain recoverable by the account operator; after that window the bundle is permanently and irrecoverably deleted. The bundle is GPG-AES256 encrypted at all times; the off-host provider cannot read it under any circumstance. This active-vs-recovery distinction is queued for removal once a B-side backend migration (Hetzner Storage Box BX11, SFTP, POSIX unlink, no recovery layer) ships; tracked in ''Honest limitations'' below.

	The backup tar covers <code>/var/www/mediawiki/images</code>, <code>LocalSettings.php</code>, the Pharmacopedia extension, and local skin assets. The full <code>mediawiki</code> schema is dumped separately to a sibling SQL file (also encrypted). Deliberately excluded by path: the AdminCrypto master key, the OAuth2 RSA private key, the backup passphrase itself, the Gmail SMTP credential, and the Let's Encrypt private key. ''A leak of any single backup bundle does not yield Mode B decryption power, JWT signing power, or further off-host backup decryption — those keys live elsewhere on the host and are not in the bundle.''		The backup tar covers <code>/var/www/mediawiki/images</code>, <code>LocalSettings.php</code>, the Pharmacopedia extension, and local skin assets. The full <code>mediawiki</code> schema is dumped separately to a sibling SQL file (also encrypted). Deliberately excluded by path: the AdminCrypto master key, the OAuth2 RSA private key, the backup passphrase itself, the Gmail SMTP credential, and the Let's Encrypt private key. ''A leak of any single backup bundle does not yield Mode B decryption power, JWT signing power, or further off-host backup decryption — those keys live elsewhere on the host and are not in the bundle.''
Line 236:		Line 244:

	* '''Single point of failure.''' Host-root compromise yields AdminCrypto Mode B decryption, OAuth2 JWT signing, backup decryption (via the passphrase file), and outbound email impersonation. Defense-in-depth lives in per-key file separation + filesystem perms + open_basedir, but a root-on-host attacker who clears each gate gets everything.		* '''Single point of failure.''' Host-root compromise yields AdminCrypto Mode B decryption, OAuth2 JWT signing, backup decryption (via the passphrase file), and outbound email impersonation. Defense-in-depth lives in per-key file separation + filesystem perms + open_basedir, but a root-on-host attacker who clears each gate gets everything.
	* '''Backup-lag on deletion.''' When a user requests deletion, the live row is purged; encrypted ~~backups containing~~ the ~~deleted data roll~~ off ~~naturally over their retention window~~ (up to 60 days ~~off-host)~~. Disclosed in About:Privacy.		* '''Backup-lag on deletion.''' When a user requests deletion, the live row is purged immediately; the encrypted bundle is removed from active off-host storage after 14 days; the off-host provider's deletion-recovery layer may keep the (still-encrypted) bundle recoverable by the account operator for up to 180 days after that, until it is permanently deleted. Disclosed in About:Privacy on the wiki and (with identical wording) in Oyami's PRIVACY.md. Queued: a backend migration to Hetzner Storage Box (POSIX unlink, no recovery layer) collapses the window to a clean 14 days.
	* '''No CDN, no DDoS layer.''' One VM, three open ports, UFW + fail2ban. Hostile traffic can take the site down; it cannot exfiltrate.		* '''No CDN, no DDoS layer.''' One VM, three open ports, UFW + fail2ban. Hostile traffic can take the site down; it cannot exfiltrate.
	* '''Some application-layer key rotation is "never" by design.''' The voter-hash secret and the AdminCrypto Mode B master key cannot rotate without breaking either anonymity or existing wrappings respectively. Loss of either key has the obvious one-time consequence; trading that off against the alternative (re-encrypt every historical record) was the deliberate choice.		* '''Some application-layer key rotation is "never" by design.''' The voter-hash secret and the AdminCrypto Mode B master key cannot rotate without breaking either anonymity or existing wrappings respectively. Loss of either key has the obvious one-time consequence; trading that off against the alternative (re-encrypt every historical record) was the deliberate choice.
	* '''Two enabled AbuseFilter rules.''' The pipeline is in place; the rule set is small. Honest signal: this is plumbing for future use, not active filtering today.		* '''Two enabled AbuseFilter rules.''' The pipeline is in place; the rule set is small. Honest signal: this is plumbing for future use, not active filtering today.
	* '''~~The perspective~~-invite ~~token is~~ cleartext ~~at rest in~~ <code>~~pcp_perspective_invite.~~pvi_token</code>~~.''' Hash-on-store migration~~ is ~~queued (interface~~-~~claude + parser~~-~~claude lane)~~. Severity: an attacker with DB read can submit a perspective under a planted invite identity; not access to medical data.		* '''Perspective-invite tokens are half-migrated to hashed storage.''' 0.9.8.7 added the <code>pvi_token_hash</code> column, backfilled it, and switched the lookup to hash-first; the cleartext <code>pvi_token</code> column is still present so the dual-write fallback works during the deploy edge. 0.9.8.8 drops the cleartext column and the fallback branch, at which point a database-read attacker can no longer extract usable invite tokens. Severity in the interim: an attacker with DB read can still submit a perspective under a planted invite identity; not access to medical data.

	=== Security researchers welcome ===		=== Security researchers welcome ===

MDElliottMD: Drop wikitext H1 so the orientation block becomes the lead section and == sections collapse independently on mobile (per Mark, 2026-05-23)

2026-05-23T18:51:58Z

Drop wikitext H1 so the orientation block becomes the lead section and == sections collapse independently on mobile (per Mark, 2026-05-23)

← Older revision		Revision as of 18:51, 23 May 2026
Line 1:		Line 1:
	~~= Pharmacopedia extension specification =~~

	'''Version:''' 0.9.8.6 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5		'''Version:''' 0.9.8.6 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5
	'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later		'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later

MDElliottMD: Add Security & encryption section (verbatim config + crypto detail per server-claude inventory; disclosure block per Mark)

2026-05-23T06:52:44Z

Add Security & encryption section (verbatim config + crypto detail per server-claude inventory; disclosure block per Mark)

Show changes

MDElliottMD: Version bump to 0.9.8.6

2026-05-23T06:26:20Z

Version bump to 0.9.8.6

← Older revision		Revision as of 06:26, 23 May 2026
Line 1:		Line 1:
	= Pharmacopedia extension specification =		= Pharmacopedia extension specification =

	'''Version:''' 0.9.8.5 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5		'''Version:''' 0.9.8.6 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5
	'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later		'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later
	'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>		'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>

MDElliottMD: 0.9.8.6 body amendments: parser tags (CommonUses + problem/effectMedicines), live typeahead, near-control autosave dot, Custom content namespaces section (all 6), Wiki-content pages we maintain

2026-05-23T06:23:40Z

0.9.8.6 body amendments: parser tags (CommonUses + problem/effectMedicines), live typeahead, near-control autosave dot, Custom content namespaces section (all 6), Wiki-content pages we maintain

@@ Line 81: / Line 81: @@
 <code>DiptychChrome</code> supplies the shared topbar and footer for both. The modules are <code>ext.pharmacopedia.frontpage</code> and <code>ext.pharmacopedia.categoryindex</code>; each carries its own palette tokens so the splash renders correctly with no skin stylesheet loaded.
 == Parser tags ==
@@ Line 116: / Line 118: @@
 |-
 | <code>&lt;categoryindex/&gt;</code> || The two-origin diptych Category index || <code>CategoryIndexTag</code>
 |}
@@ Line 537: / Line 545: @@
 == Autosave infrastructure ==
 Every block on <code>Special:MyProfile</code> is wrapped in <code>&lt;div data-pcp-save-block="block-name"&gt;</code>. The blocksave.js library:
@@ Line 824: / Line 836: @@
 * <code>UserGetRights</code> + <code>UserEffectiveGroups</code>: verified-provider role wiring
 * Various special-page registrations via <code>SpecialPage_initList</code>
 == Configuration globals ==

MDElliottMD: Version bump to 0.9.8.5

2026-05-23T03:18:07Z

Version bump to 0.9.8.5

← Older revision		Revision as of 03:18, 23 May 2026
Line 1:		Line 1:
	= Pharmacopedia extension specification =		= Pharmacopedia extension specification =

	'''Version:''' 0.9.8.0 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5		'''Version:''' 0.9.8.5 · '''Requires:''' MediaWiki >= 1.46.0 · PHP >= 8.5
	'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later		'''Author:''' MDElliottMD · '''License:''' GPL-2.0-or-later
	'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>		'''Source:''' <code>/var/www/mediawiki/extensions/Pharmacopedia/</code>

MDElliottMD: Document HYD-PCP, the thirteenth assessment (the wellbeing check-in shipped in v0.9.8.0)

2026-05-22T08:16:06Z

Document HYD-PCP, the thirteenth assessment (the wellbeing check-in shipped in v0.9.8.0)

MDElliottMD: Crypto note: the Mode A KDF scheme v2 (Argon2id MODERATE) is live, not future

2026-05-22T08:02:46Z

Crypto note: the Mode A KDF scheme v2 (Argon2id MODERATE) is live, not future

← Older revision		Revision as of 08:02, 22 May 2026
Line 484:		Line 484:
	* '''Passphrase''' (opt-in, zero-knowledge): the secret key is wrapped with an Argon2id-derived key from a passphrase only the owner knows. Not even the site can read the results. '''The passphrase cannot be recovered or reset'''; losing it makes every collected result permanently unreadable.		* '''Passphrase''' (opt-in, zero-knowledge): the secret key is wrapped with an Argon2id-derived key from a passphrase only the owner knows. Not even the site can read the results. '''The passphrase cannot be recovered or reset'''; losing it makes every collected result permanently unreadable.

	AES-256-GCM is used for key wrapping in both modes. <code>AdminCrypto</code> (<code>includes/Assessments/AdminCrypto.php</code>) is the helper: <code>setupOwnerKey</code>, <code>verifyPassphrase</code>, <code>unlockSecretKey</code>, <code>encryptForOwner</code> / <code>decryptForOwner</code>, <code>encryptForRespondent</code> / <code>decryptForRespondent</code>, <code>mintInviteToken</code> / <code>hashInviteToken</code>. Invite tokens are 256-bit; only their SHA-256 hash is stored, so a stolen database yields no usable tokens. The respondent's own copy of each result is sealed to a key derived from the raw invite token, so the link doubles as the respondent's read credential. A scheme-version column on the key and result rows lets the cipher or KDF ~~change in a future~~ v2.		AES-256-GCM is used for key wrapping in both modes. <code>AdminCrypto</code> (<code>includes/Assessments/AdminCrypto.php</code>) is the helper: <code>setupOwnerKey</code>, <code>verifyPassphrase</code>, <code>unlockSecretKey</code>, <code>encryptForOwner</code> / <code>decryptForOwner</code>, <code>encryptForRespondent</code> / <code>decryptForRespondent</code>, <code>mintInviteToken</code> / <code>hashInviteToken</code>. Invite tokens are 256-bit; only their SHA-256 hash is stored, so a stolen database yields no usable tokens. The respondent's own copy of each result is sealed to a key derived from the raw invite token, so the link doubles as the respondent's read credential. A scheme-version column on the key and result rows lets the cipher or KDF be revised over time; the Mode A passphrase KDF currently runs at scheme v2 (Argon2id at MODERATE limits), and an owner created under an earlier scheme is transparently re-wrapped on their next unlock.

	=== De-identified research pool ===		=== De-identified research pool ===

← Older revision		Revision as of 02:45, 28 May 2026
Line 6:		Line 6:

	* Structured medicine pages via the <code><nowiki>{{MedTemplate}}</nowiki></code> template		* Structured medicine pages via the <code><nowiki>{{MedTemplate}}</nowiki></code> template
	* Per-user rating on effects, problems, titration strategies, anecdotes, and drug-drug interactions (continuous 0–100 sliders, ±100 valence; no 0–5 likert anywhere)		* Per-user rating on effects, problems, titration strategies, anecdotes, and drug-drug interactions (continuous 0–100 sliders, ±100 valence; no 0–5 likert anywhere); ratings use a hold-to-expand star widget (300 ms press, spring animation, drag-commit with pixel-travel + value-delta guards); voters can remove their own committed rating
	* Binary AND choice/multi voting on arbitrary content (<code>type="single"</code> / <code>type="multi"</code> with 2-5 options, results-visibility policy per element)		* Binary AND choice/multi voting on arbitrary content (<code>type="single"</code> / <code>type="multi"</code> with 2-5 options, results-visibility policy per element)
	* Two-perspective data capture (personal vs. provider) wherever clinically meaningful		* Two-perspective data capture (personal vs. provider) wherever clinically meaningful
Line 39:		Line 39:
	* '''Backend (PHP):''' <code>includes/</code>, one class per parser tag, store, special page, or API module. Auto-loaded under <code>MediaWiki\Extension\Pharmacopedia\</code>. Assessment classes under <code>includes/Assessments/</code>. API modules under <code>includes/Api/</code>.		* '''Backend (PHP):''' <code>includes/</code>, one class per parser tag, store, special page, or API module. Auto-loaded under <code>MediaWiki\Extension\Pharmacopedia\</code>. Assessment classes under <code>includes/Assessments/</code>. API modules under <code>includes/Api/</code>.
	* '''Frontend (JS / CSS):''' multiple ResourceModules per surface area:		* '''Frontend (JS / CSS):''' multiple ResourceModules per surface area:
	** <code>ext.pharmacopedia</code>: main IIFE (chip-picker, dx autocomplete, BFI-10 compute, vote logic for both binary and choice/multi)		** <code>ext.pharmacopedia</code>: main IIFE (chip-picker, dx autocomplete, BFI-10 compute, vote logic for both binary and choice/multi, hold-to-expand star rating model with spring animation and drag-commit, vote removal)
	** <code>ext.pharmacopedia.styles</code>: base extension stylesheet (self-hosted Geist / Newsreader / Source Serif fonts, core component styling)		** <code>ext.pharmacopedia.styles</code>: base extension stylesheet (self-hosted Geist / Newsreader / Source Serif fonts, core component styling)
	** <code>ext.pharmacopedia.blocksave</code>: debounced autosave per block (race-safe)		** <code>ext.pharmacopedia.blocksave</code>: debounced autosave per block (race-safe)
Line 49:		Line 49:
	** <code>ext.pharmacopedia.perspective</code>: observer-perspective form enhancement (slider readout, progress, consent/delete confirm)		** <code>ext.pharmacopedia.perspective</code>: observer-perspective form enhancement (slider readout, progress, consent/delete confirm)
	** <code>ext.pharmacopedia.administer</code>: the administer-to-others surfaces (take-flow slider readout + "Not sure" toggling, owner-hub styling)		** <code>ext.pharmacopedia.administer</code>: the administer-to-others surfaces (take-flow slider readout + "Not sure" toggling, owner-hub styling)
			** <code>ext.pharmacopedia.editor</code>: editor enhancements loaded on <code>action=edit/submit</code>; smart paste converts bare PMID or DOI from the clipboard into a formatted <code><ref></code> tag (PubMed eutils / CrossRef); house-rules linter flags banned terms and em-dashes on submit with a dismissable warning; quick-ref stub (Ctrl+Alt+R) inserts a journal-article <code><ref></code> skeleton
	** <code>ext.pharmacopedia.observation</code>: quick-add observation textarea + live preview		** <code>ext.pharmacopedia.observation</code>: quick-add observation textarea + live preview
	** <code>ext.pharmacopedia.refupgrade</code>: bulk linker for free-text → structured refs		** <code>ext.pharmacopedia.refupgrade</code>: bulk linker for free-text → structured refs

← Older revision		Revision as of 08:16, 22 May 2026
Line 12:		Line 12:
	* Two-perspective data capture (personal vs. provider) wherever clinically meaningful		* Two-perspective data capture (personal vs. provider) wherever clinically meaningful
	* User profile with dimensional personality / autism assessments (CATI, CAT-Q, MBTI, Enneagram, PID-5-BF, OCEAN/BFI-10) and rich auto-generated reports		* User profile with dimensional personality / autism assessments (CATI, CAT-Q, MBTI, Enneagram, PID-5-BF, OCEAN/BFI-10) and rich auto-generated reports
	* Further self-report instruments (BPNS, NFCS, OCI-PCP, WHOQOL-BREF) on the same auto-scored, report-bearing pattern		* Further self-report instruments (BPNS, NFCS, OCI-PCP, WHOQOL-BREF) and the HYD-PCP wellbeing check-in, on the same auto-scored, report-bearing pattern
	* ADHD screening (ASRS and AMAAS-SR) plus a Formal testing log of standardized-test scores, every score field carrying its own visibility		* ADHD screening (ASRS and AMAAS-SR) plus a Formal testing log of standardized-test scores, every score field carrying its own visibility
	* Diagnosis autocomplete backed by ~41,500 ICD-10-CM, ICD-11, and DSM-5 codes		* Diagnosis autocomplete backed by ~41,500 ICD-10-CM, ICD-11, and DSM-5 codes
Line 215:		Line 215:
	* '''Enneagram''' (9 type sliders + 45-item screening test)		* '''Enneagram''' (9 type sliders + 45-item screening test)
	* '''MBTI''' (4 dichotomy sliders + 32-item OEJTS test)		* '''MBTI''' (4 dichotomy sliders + 32-item OEJTS test)
	* '''Self-report assessments''' (PID-5-BF, CATI, CAT-Q, BPNS, NFCS, OCI-PCP, WHOQOL-BREF, each a collapsible inline test)		* '''Self-report assessments''' (PID-5-BF, CATI, CAT-Q, BPNS, NFCS, OCI-PCP, WHOQOL-BREF, HYD-PCP, each a collapsible inline test)
	* '''ADHD screening''' (ASRS adult-ADHD screener and AMAAS-SR attention self-report, each a collapsible inline test)		* '''ADHD screening''' (ASRS adult-ADHD screener and AMAAS-SR attention self-report, each a collapsible inline test)
	* '''Formal testing''' (a log of standardized-test scores; raw score, percentile and pass/fail each carry their own privacy setting)		* '''Formal testing''' (a log of standardized-test scores; raw score, percentile and pass/fail each carry their own privacy setting)
Line 287:		Line 287:
	\|}		\|}

	~~Four~~ further self-report instruments are available on the same collapsible-inline-test, auto-scored, report-bearing pattern:		Five further self-report instruments are available on the same collapsible-inline-test, auto-scored, report-bearing pattern:

	{\| class="wikitable"		{\| class="wikitable"
Line 299:		Line 299:
	\|-		\|-
	\| '''WHOQOL-BREF-PCP''' \|\| 26 \|\| 4 domains (Physical, Psychological, Social, Environment) + 2 overall items, 5-point Likert \|\| quality of life		\| '''WHOQOL-BREF-PCP''' \|\| 26 \|\| 4 domains (Physical, Psychological, Social, Environment) + 2 overall items, 5-point Likert \|\| quality of life
			\|-
			\| '''HYD-PCP''' \|\| 8 \|\| 8 single-item domains, each one bipolar slider (−100 really poorly to +100 really well); no subscales, no cutoffs \|\| everyday wellbeing, re-taken and watched over time; a locally authored check-in, not validated
	\|}		\|}

	All assessment items submit raw responses to <code>pcp_profile_fields</code> under namespace <code>{key}_raw</code> (e.g. <code>cati_raw</code>); the computed scores live under namespace <code>{key}</code> with keys like <code>subscale_SOC</code>, <code>total</code>, plus a <code>taken_at</code> timestamp. Re-scoring happens automatically on every save (autosave fires <code>scoreResponses()</code> on the full raw set, skipping "unsure" rows). Each completed assessment also auto-upserts a Life-story keyframe row (see [[#Life-story timeline\|Life-story timeline]]) so trajectories plot over time.		All assessment items submit raw responses to <code>pcp_profile_fields</code> under namespace <code>{key}_raw</code> (e.g. <code>cati_raw</code>); the computed scores live under namespace <code>{key}</code> with keys like <code>subscale_SOC</code>, <code>total</code>, plus a <code>taken_at</code> timestamp. Re-scoring happens automatically on every save (autosave fires <code>scoreResponses()</code> on the full raw set, skipping "unsure" rows). Each completed assessment also auto-upserts a Life-story keyframe row (see [[#Life-story timeline\|Life-story timeline]]) so trajectories plot over time.

	All ~~twelve~~ assessments (the six dimensional, these ~~four~~, and the two ADHD screeners below) are registered in <code>AssessmentRegistry</code> and so can also be administered to outside respondents (see [[#Administer assessments to others\|Administer assessments to others]]).		All thirteen assessments (the six dimensional, these five, and the two ADHD screeners below) are registered in <code>AssessmentRegistry</code> and so can also be administered to outside respondents (see [[#Administer assessments to others\|Administer assessments to others]]).

	=== ADHD screening ===		=== ADHD screening ===
Line 459:		Line 461:
	== Administer assessments to others ==		== Administer assessments to others ==

	A registered user (the '''owner''') can send any of the ~~twelve~~ registered assessment scales to people outside the wiki (the '''respondents'''), collect their results, and follow them over time. Respondents need no account; a one-time invite link is their only credential. The subsystem is built so that, by default, a respondent's results are readable only by the owner, and the owner can additionally choose a zero-knowledge mode in which not even a site administrator can read them.		A registered user (the '''owner''') can send any of the thirteen registered assessment scales to people outside the wiki (the '''respondents'''), collect their results, and follow them over time. Respondents need no account; a one-time invite link is their only credential. The subsystem is built so that, by default, a respondent's results are readable only by the owner, and the owner can additionally choose a zero-knowledge mode in which not even a site administrator can read them.

	=== Assessment registry ===		=== Assessment registry ===
Line 465:		Line 467:
	<code>AssessmentRegistry</code> (<code>includes/Assessments/AssessmentRegistry.php</code>) is the single source of truth: an assessment registered there once autopopulates the owner's scale-picker, the respondent take-flow, and the dashboards. Each entry names a scorer class and a '''response model''':		<code>AssessmentRegistry</code> (<code>includes/Assessments/AssessmentRegistry.php</code>) is the single source of truth: an assessment registered there once autopopulates the owner's scale-picker, the respondent take-flow, and the dashboards. Each entry names a scorer class and a '''response model''':
	* <code>radio</code>, discrete labelled radio buttons (CATI, CAT-Q, PID-5-BF, NFCS, BPNS, OCI-PCP, WHOQOL-BREF, ASRS)		* <code>radio</code>, discrete labelled radio buttons (CATI, CAT-Q, PID-5-BF, NFCS, BPNS, OCI-PCP, WHOQOL-BREF, ASRS)
	* <code>slider</code>, one continuous slider per item with uniform end anchors (OCEAN, Enneagram, AMAAS)		* <code>slider</code>, one continuous slider per item with uniform end anchors (OCEAN, Enneagram, AMAAS, HYD-PCP)
	* <code>bipolar</code>, one slider per item with the item's own two opposing phrases as the anchors (MBTI)		* <code>bipolar</code>, one slider per item with the item's own two opposing phrases as the anchors (MBTI)

Line 498:		Line 500:
	* <code>pcp_administer_research</code>, the de-identified research pool		* <code>pcp_administer_research</code>, the de-identified research pool

	The 12-instrument submission handler reuses the existing assessment scorers in <code>includes/Assessments/</code> rather than reimplementing scoring.		The 13-instrument submission handler reuses the existing assessment scorers in <code>includes/Assessments/</code> rather than reimplementing scoring.

	== Choice / multi voting ==		== Choice / multi voting ==
Line 855:		Line 857:
	\| \|-- DatePicker.php (range / possibility-mix date widget backend + injectBirthdayContextOnce)		\| \|-- DatePicker.php (range / possibility-mix date widget backend + injectBirthdayContextOnce)
	\| \|-- Assessments/		\| \|-- Assessments/
	\| \| \|-- AssessmentRegistry.php (single source of truth for the 12 instruments)		\| \| \|-- AssessmentRegistry.php (single source of truth for the 13 instruments)
	\| \| \|-- AdminCrypto.php (X25519 / Argon2id / AES-256-GCM helper)		\| \| \|-- AdminCrypto.php (X25519 / Argon2id / AES-256-GCM helper)
	\| \| \|-- Cati.php, CatiNorms.php		\| \| \|-- Cati.php, CatiNorms.php