Implement Android Credential Manager and Autofill password-provider integration #109

New Issue

hugo · 2026-08-17T19:15:15Z

hugo commented

2026-08-17 19:15:15 +00:00

Goal

Let users fill IronStorage credentials into other Android apps and browsers with explicit authorization and storage-owned identity matching.

Scope

Implement an AndroidX CredentialProviderService for Android 14+ password credentials and an Android AutofillService for API 26+ and compatible clients, sharing one Rust-backed candidate/retrieval contract.
Add the storage-owned application/site identity, matching, search, permission, selection, and credential-field APIs needed by both services. Kotlin may translate OS request structures into typed facts but must not decide which entry/fields represent a credential.
Return only non-secret candidate metadata before selection/authentication. Decrypt and return username/password only after explicit system/user selection and a valid shared or newly established authentication lease.
Support inline suggestions where available, manual search, cancellation, provider enablement/settings intents, client package/web-origin validation, and process isolation/recreation.
Treat browser-supplied origins as privileged input only when validated using Android Credential Manager's trusted-caller/origin mechanisms; otherwise match the verified calling application identity.
Implement save/update offers only through an explicit storage-owned create/edit flow with destination and overwrite confirmation; never silently capture another app's fields.
Keep datasets/entries minimal, short-lived, non-cacheable, and absent from logs/recents/notifications. Apply service timeouts and cancellation.
Cover malicious AssistStructure, spoofed package/origin, ambiguous fields, locked store, stale repository, concurrent edits, and unsupported clients.
Provide onboarding/status links for selecting IronStorage as the preferred password/autofill provider, including current Chrome Android guidance.

Acceptance criteria

Enabled users can fill a matching username/password in representative native apps and current Chrome without opening broad repository access.
Android 14+ Credential Manager and API 26+ Autofill use the same Rust matching/results and security policy.
No candidate response exposes a password before selection/authentication.
Spoofed/untrusted origin, stale identity, cancellation, timeout, and relock fail closed.
Save/update never occurs without explicit user confirmation and a storage transaction.
Service and Compose code contain no entry parser, credential heuristic, permission policy, or secret persistence.

Depends on the platform-neutral contract, Keystore/biometric authentication, structured viewer/editor, and lifecycle security. Part of #87.

## Goal Let users fill IronStorage credentials into other Android apps and browsers with explicit authorization and storage-owned identity matching. ## Scope - Implement an AndroidX `CredentialProviderService` for Android 14+ password credentials and an Android `AutofillService` for API 26+ and compatible clients, sharing one Rust-backed candidate/retrieval contract. - Add the storage-owned application/site identity, matching, search, permission, selection, and credential-field APIs needed by both services. Kotlin may translate OS request structures into typed facts but must not decide which entry/fields represent a credential. - Return only non-secret candidate metadata before selection/authentication. Decrypt and return username/password only after explicit system/user selection and a valid shared or newly established authentication lease. - Support inline suggestions where available, manual search, cancellation, provider enablement/settings intents, client package/web-origin validation, and process isolation/recreation. - Treat browser-supplied origins as privileged input only when validated using Android Credential Manager's trusted-caller/origin mechanisms; otherwise match the verified calling application identity. - Implement save/update offers only through an explicit storage-owned create/edit flow with destination and overwrite confirmation; never silently capture another app's fields. - Keep datasets/entries minimal, short-lived, non-cacheable, and absent from logs/recents/notifications. Apply service timeouts and cancellation. - Cover malicious AssistStructure, spoofed package/origin, ambiguous fields, locked store, stale repository, concurrent edits, and unsupported clients. - Provide onboarding/status links for selecting IronStorage as the preferred password/autofill provider, including current Chrome Android guidance. ## Acceptance criteria - Enabled users can fill a matching username/password in representative native apps and current Chrome without opening broad repository access. - Android 14+ Credential Manager and API 26+ Autofill use the same Rust matching/results and security policy. - No candidate response exposes a password before selection/authentication. - Spoofed/untrusted origin, stale identity, cancellation, timeout, and relock fail closed. - Save/update never occurs without explicit user confirmation and a storage transaction. - Service and Compose code contain no entry parser, credential heuristic, permission policy, or secret persistence. Depends on the platform-neutral contract, Keystore/biometric authentication, structured viewer/editor, and lifecycle security. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00

hugo added the enhancement label 2026-08-17 19:15:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#109