hugo/IronStorage
1
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity

Document safe simulator biometric workflow

Browse Source
This commit is contained in:
Chili Palmer
2026-08-12 20:07:09 +02:00
parent 26f178bdf5
commit 00a22e9968
1 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
AGENTS.md
View File

@@ -46,12 +46,34 @@ cargo test --workspace
For Apple project changes, also run `xcodegen generate` from `apple/` and build For Apple project changes, also run `xcodegen generate` from `apple/` and build
the affected simulator targets. the affected simulator targets.
### Updating the Simulator app
Treat the booted simulator and its app container as persistent test state. To
update IronStorage, build for that simulator and install the new `.app` over
the existing installation with `xcrun simctl install <device-udid> <app-path>`.
Keep the same device UDID and bundle identifier.
Do not uninstall IronStorage, erase or recreate the simulator, reset its
keychain, install app-data packages, or delete its app container during an app
update. Those are destructive reset operations, not update steps, and can
remove preferences, repositories, credentials, and biometric enrollment state.
### Simulator biometric validation ### Simulator biometric validation
Before testing biometric unlock, enable Biometric Unlock once in the iPhone For initial setup only, select **Features > Face ID > Enrolled** before enabling
app so its protected passphrase is enrolled. In Simulator, use **Features > Biometric Unlock in the iPhone app. The user must then enable Biometric Unlock
Face ID > Enrolled**, trigger an IronStorage unlock, then choose **Matching and enter the GPG passphrase once so the protected passphrase is enrolled.
Face**. Verify the app changes from locked to unlocked. Use **Non-matching
Face** to test rejection, and clear **Enrolled** to test unavailable or changed For normal validation, do not toggle **Enrolled** again. Tap the entry's
biometric enrollment. **Unlock** control first so an authentication request is active, then select
Always tap the entry's **Unlock** control before **Features > Face ID > Matching Face**; a simulated match does nothing without an active authentication request. **Features > Face ID > Matching Face** and verify the app changes from locked to
unlocked. A matching face presented before **Unlock** does nothing. Use
**Non-matching Face** to test rejection without changing enrollment.
Apple's `biometryCurrentSet` access control invalidates a protected Keychain
item when Face ID is re-enrolled. Clearing or toggling **Enrolled** is therefore
a destructive negative test, not part of the normal unlock sequence. Only do it
when the issue explicitly requires changed-enrollment coverage and the user is
available to enter the GPG passphrase again. When deliberately returning to a
manual baseline, disable Biometric Unlock in IronStorage while the protected
record is still valid, then clear **Enrolled**.