Knowledge Vault

LawForge

4 min read

LawForge

Legal document generator with compliance-focused security, attorney-client privilege protections, audit logging, and 26 legal templates.

Zone: staging/ Version: 1.0.0

Overview

LawForge generates legal documents from 26 compliance-ready templates across six categories: Administrative/Client Intake (5), Litigation (8), Estate Planning (3), Real Estate (3), Corporate (4), and Correspondence (3). A Template Wizard handles dynamic field prompts with tab/enter navigation. An Edit Wizard resumes incomplete templates with progress tracking. Folder Profiles persist per-folder auto-fill for firm name, attorney, and client.

All data stays client-side — no cloud sync. Offline support via Service Worker.

Tech Stack

ComponentTechnology
LanguageVanilla JS (ES6+)
PersistenceIndexedDB (LawForgeDB v5, 5 object stores)
TestingVitest 2.1.9
CI/CDGitHub Actions (security.yml)
Zonestaging/

No external runtime dependencies. The security module is IIFE-wrapped and fully self-contained.

Architecture

FilePurpose
lawforge_v1.htmlSingle-page application entry point
app.jsDocument management, UI, Template Wizard (2375 lines)
law-templates.js26 template definitions with field metadata
security.jsInput sanitization, sensitive field detection, session management (458 lines)
db.jsIndexedDB wrapper and CRUD operations
crypto.jsField encryption — IIFE (LawForgeCrypto)
service-worker.jsOffline support

See also: indexeddb-migration-protocol for IndexedDB versioning and migration strategy.

IndexedDB Stores

Five object stores in LawForgeDB v5:

  • documents — content, template type, metadata
  • folders — folder hierarchy
  • versions — document snapshots (default 50 per document)
  • settings — user preferences and vault salt
  • audit_log — event records (capped at 5000 entries)

Security

The security module (security.js) handles:

  • Session management: 15-minute inactivity warning, 30-minute hard lock
  • Input sanitization: Blocks script injection, event handlers, HTML, data URIs, null bytes (recursive scrubbing)
  • Sensitive field detection: Auto-masking of SSN, TIN, bank accounts, credit cards, passwords
  • Data leak prevention: Print/copy/drag-drop warnings and interception, clipboard copy notification logging
  • Confidentiality banners: Document-level attorney-client privilege notices

Encryption Foundation (Phase 3.4)

Field encryption on the document content field:

  • Algorithm: PBKDF2-SHA256 (310,000 iterations) + AES-256-GCM
  • Implementation: Web Crypto API (SubtleCrypto) — no external dependencies
  • Key held in memory only; never persisted to disk
  • Salt stored as base64 in IndexedDB settings store under key vault_salt
  • DB_SECURE in db.js wraps saveDocument/getDocument — title, type, and dates remain plaintext for sidebar search
  • Migration-safe: existing docs without _enc: true flag are returned as-is
  • DOM vault overlay built with DOM methods (no innerHTML) to satisfy security hook
  • SubtleCrypto requires HTTPS or localhost — vault gracefully disabled otherwise with console warning

See also: 3-scanner-security-architecture for the CI security scanning setup (TruffleHog + Trivy + Semgrep).

Audit & Compliance

Comprehensive audit log (max 5000 entries) covering:

  • DOC_CREATE, DOC_SAVE, DOC_DELETE, DOC_EXPORT
  • TEMPLATE_GENERATE, SENSITIVE_FIELD detection
  • SESSION_LOCKED, CLIPBOARD_COPY, PRINT_ATTEMPT

Audit Log Viewer modal provides search, filter by event type, export, and prune functions. Timestamp and user context on all events.

Export Formats

Six export formats: Markdown, TXT, HTML, PDF, JSON, DOCX.

Current Status

Phase: Staging (Phase 3.4 complete as of 2026-03-13)

Completed

  • 26-template system across 6 legal categories
  • Security module: session management, input sanitization, sensitive field detection
  • Audit logging with viewer modal
  • Offline support via Service Worker
  • Phase 2 compliance: security.yml (TruffleHog + Trivy + Semgrep), SECURITY.md, PR template, CODEOWNERS
  • Phase 3.4: Encryption foundation (PBKDF2 + AES-256-GCM via SubtleCrypto)

Known Gaps

  • Test coverage below 60% target (remediation planned Phase 4)
  • CI/CD lint+test pipeline pending (security.yml deployed; general CI next)
  • RBAC design deferred to Phase 6.2 (roles: admin/editor/viewer, document-level permissions, immutable audit log export)
  • Audit log capped at 5000 entries; no backup/restore mechanism
  • Session lock timeout (30 minutes) not configurable via UI

Lessons Learned

  • SubtleCrypto availability: Web Crypto API requires HTTPS or localhost. A graceful fallback (console warning, vault disabled) is required for environments that don’t meet this constraint.
  • Calibration mode for new staging repos: All new staging repos start security CI in calibration mode to establish baseline before switching to enforcing mode. Calibration period set through 2026-04-13.
  • DOM construction over innerHTML: Security hook flags innerHTML usage. Building vault overlays with DOM methods (createElement, appendChild) avoids the hook entirely.
  • Encryption migration safety: Storing an _enc: true flag on encrypted documents allows migration-safe reads — unencrypted legacy documents are returned as-is without errors.

Graph View

Backlinks