Implement Rust-owned Android Keystore secure storage (#93)

crates/storage/Cargo.toml

@@ -92,6 +92,7 @@ zbus-secret-service-keyring-store = { workspace = true, optional = true }
 arboard = { workspace = true, optional = true }
 
 [dev-dependencies]
+aes-gcm = "0.11.1"
 hex = "0.4"
 keepass = { workspace = true, features = ["save_kdbx4"] }
 nix = { version = "0.31", features = ["fs"] }

crates/storage/src/mobile_authentication.rs

@@ -107,11 +107,14 @@ impl MobileAuthenticationError {
                 "IronStorage Locked",
                 "The authentication lease expired.",
             ),
-            AuthenticationError::SecretStore(SecretStoreError::Missing) => {
-                Self::passphrase_required("Enter the GPG key passphrase to continue.")
-            }
+            AuthenticationError::SecretStore(
+                SecretStoreError::Missing
+                | SecretStoreError::DeviceKeyMissing
+                | SecretStoreError::Invalidated,
+            ) => Self::passphrase_required("Enter the GPG key passphrase to continue."),
             AuthenticationError::SecretStore(
                 SecretStoreError::Denied
+                | SecretStoreError::Lockout
                 | SecretStoreError::UnsupportedProtection
                 | SecretStoreError::Unavailable,
             ) => Self::new(

crates/storage/src/mobile_private_storage.rs

@@ -275,6 +275,14 @@ impl PrivateStorage {
         Ok(storage)
     }
 
+    pub fn android_secret_backend(
+        &self,
+        keystore: std::sync::Arc<dyn crate::secret_store::android::AndroidKeystore>,
+    ) -> Result<crate::secret_store::android::AndroidSecretBackend, PrivateStorageError> {
+        let directory = private_directory(&self.data, "secrets")?;
+        crate::secret_store::android::AndroidSecretBackend::open(directory, keystore)
+            .map_err(secret_error)
+    }
     pub fn root(&self) -> &Path {
         &self.root
     }
@@ -476,8 +484,12 @@ fn secret_error(error: SecretStoreError) -> PrivateStorageError {
         SecretStoreError::Locked | SecretStoreError::Denied | SecretStoreError::Cancelled => {
             PrivateStorageError::SecureStorageLocked
         }
-        SecretStoreError::Missing => PrivateStorageError::RestoredWithoutKeystore,
-        SecretStoreError::Corrupted => PrivateStorageError::InvalidSecureBinding,
+        SecretStoreError::Missing | SecretStoreError::DeviceKeyMissing => {
+            PrivateStorageError::RestoredWithoutKeystore
+        }
+        SecretStoreError::Corrupted | SecretStoreError::Invalidated => {
+            PrivateStorageError::InvalidSecureBinding
+        }
         _ => PrivateStorageError::SecureStorageUnavailable,
     }
 }

crates/storage/src/secret_store.rs

@@ -16,6 +16,7 @@ use crate::{
     repository::SecretBytes,
 };
 
+pub mod android;
 mod platform;
 
 pub(crate) use platform::NativeSecretBackend;
@@ -283,6 +284,9 @@ impl SecretCachePolicy {
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum SecretStoreError {
+    DeviceKeyMissing,
+    Invalidated,
+    Lockout,
     InvalidReference,
     InvalidCachePolicy,
     AlreadyExists,
@@ -298,6 +302,11 @@ pub enum SecretStoreError {
 impl fmt::Display for SecretStoreError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         let message = match self {
+            Self::DeviceKeyMissing => {
+                "the device key is missing; recover the protected secret manually"
+            }
+            Self::Invalidated => "the protected key was invalidated; recover the secret manually",
+            Self::Lockout => "biometric authentication is locked out",
             Self::InvalidReference => "the secret reference is invalid",
             Self::InvalidCachePolicy => "the secret cache policy is invalid",
             Self::AlreadyExists => "the referenced secret already exists",