web app access - via remote vault

We originally had this idea of a web app randomly accessing files in vault but with the decryption happening in the browser.

This doesn't currently work as the page cache decrypts pages before they are available at a higher level.

is it practical to put an adaptor between the main api and the page cache. The adaptor would allow network calls to happen between
the api and the cache with the default adapter being a no op with calls going directly to the page cache.

This would allow the web code and the local code to be identically except for the adaptor.

The adaptor would need to tell the cache not to decrypt the pages and the adaptor on the web side would decrypt the pages as they arrive.
The web side might then want its own page cache.

Or do we just treat the file as a byte stream and its the read/writes which are done across the network with all code shared.

So the page cache would run in the browser and just use a generic web server to pull back chunks of the lock box as required.

• this does feel better and means we don't need a specialised web server.

Start by mapping the existing API and page-cache entry points, then trace where pages are decrypted and how local file reads and writes flow through them. Compare the adaptor, browser-side cache, and byte-stream alternatives; the work is done when one approach is specified clearly enough to share the web and local code without exposing decrypted pages prematurely.