Let users fill IronStorage credentials into other Android apps and browsers with explicit authorization and storage-owned identity matching.
Scope
Implement an AndroidX CredentialProviderService for Android 14+ password credentials and an Android AutofillService for API 26+ and compatible clients, sharing one Rust-backed candidate/retrieval contract.
Add the storage-owned application/site identity, matching, search, permission, selection, and credential-field APIs needed by both services. Kotlin may translate OS request structures into typed facts but must not decide which entry/fields represent a credential.
Return only non-secret candidate metadata before selection/authentication. Decrypt and return username/password only after explicit system/user selection and a valid shared or newly established authentication lease.
Support inline suggestions where available, manual search, cancellation, provider enablement/settings intents, client package/web-origin validation, and process isolation/recreation.
Treat browser-supplied origins as privileged input only when validated using Android Credential Manager's trusted-caller/origin mechanisms; otherwise match the verified calling application identity.
Implement save/update offers only through an explicit storage-owned create/edit flow with destination and overwrite confirmation; never silently capture another app's fields.
Keep datasets/entries minimal, short-lived, non-cacheable, and absent from logs/recents/notifications. Apply service timeouts and cancellation.
Cover malicious AssistStructure, spoofed package/origin, ambiguous fields, locked store, stale repository, concurrent edits, and unsupported clients.
Provide onboarding/status links for selecting IronStorage as the preferred password/autofill provider, including current Chrome Android guidance.
Acceptance criteria
Enabled users can fill a matching username/password in representative native apps and current Chrome without opening broad repository access.
Android 14+ Credential Manager and API 26+ Autofill use the same Rust matching/results and security policy.
No candidate response exposes a password before selection/authentication.
Spoofed/untrusted origin, stale identity, cancellation, timeout, and relock fail closed.
Save/update never occurs without explicit user confirmation and a storage transaction.
Service and Compose code contain no entry parser, credential heuristic, permission policy, or secret persistence.
Depends on the platform-neutral contract, Keystore/biometric authentication, structured viewer/editor, and lifecycle security. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Let users fill IronStorage credentials into other Android apps and browsers with explicit authorization and storage-owned identity matching.
## Scope
- Implement an AndroidX `CredentialProviderService` for Android 14+ password credentials and an Android `AutofillService` for API 26+ and compatible clients, sharing one Rust-backed candidate/retrieval contract.
- Add the storage-owned application/site identity, matching, search, permission, selection, and credential-field APIs needed by both services. Kotlin may translate OS request structures into typed facts but must not decide which entry/fields represent a credential.
- Return only non-secret candidate metadata before selection/authentication. Decrypt and return username/password only after explicit system/user selection and a valid shared or newly established authentication lease.
- Support inline suggestions where available, manual search, cancellation, provider enablement/settings intents, client package/web-origin validation, and process isolation/recreation.
- Treat browser-supplied origins as privileged input only when validated using Android Credential Manager's trusted-caller/origin mechanisms; otherwise match the verified calling application identity.
- Implement save/update offers only through an explicit storage-owned create/edit flow with destination and overwrite confirmation; never silently capture another app's fields.
- Keep datasets/entries minimal, short-lived, non-cacheable, and absent from logs/recents/notifications. Apply service timeouts and cancellation.
- Cover malicious AssistStructure, spoofed package/origin, ambiguous fields, locked store, stale repository, concurrent edits, and unsupported clients.
- Provide onboarding/status links for selecting IronStorage as the preferred password/autofill provider, including current Chrome Android guidance.
## Acceptance criteria
- Enabled users can fill a matching username/password in representative native apps and current Chrome without opening broad repository access.
- Android 14+ Credential Manager and API 26+ Autofill use the same Rust matching/results and security policy.
- No candidate response exposes a password before selection/authentication.
- Spoofed/untrusted origin, stale identity, cancellation, timeout, and relock fail closed.
- Save/update never occurs without explicit user confirmation and a storage transaction.
- Service and Compose code contain no entry parser, credential heuristic, permission policy, or secret persistence.
Depends on the platform-neutral contract, Keystore/biometric authentication, structured viewer/editor, and lifecycle security. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00
Added AndroidX Credential Provider for API 34+ and framework Autofill for API 26+, including inline suggestions, manual search, cancellation, enablement/status links, and explicit save/update offers.
Both use one Rust storage contract for installed signing identities, trusted HTTPS browser origins, matching, typed form/entry fields, selection, consent, authentication, request expiry, and recoverable entry/Git transactions. Candidate responses expose paths only; final retrieval consumes the request and the activity relocks after handoff.
Added bounded process-local requests, encrypted save staging, current-caller/repository rechecks, secure-window/recents/IME protections, explicit destination/overwrite confirmation, preservation of unrelated fields, and refusal of ambiguous forms, concurrent editors, expired/relocked requests and stale identities. Confirmed identical saves succeed without rewriting ciphertext.
Added an independent synthetic client APK, native Rust facade regressions, Compose/intent security tests, dependency inventory, artifact gates and docs/android/credentials.md. Arbitrary client signer verification requires QUERY_ALL_PACKAGES; it queries only the OS-supplied package and never enumerates apps. The documentation records the Play declaration/review requirement.
Android verification and release lint passed; both ARM native packages, strict 16-KB alignment, release debug symbols/build IDs, backup/manifest and dependency/license/SBOM audits passed.
API 26 ARM64 provider instrumentation: 1 test passed. Strict 16-KB API 37 ARM64 native regressions: 4 tests passed. API 37 ARM64 app instrumentation: 48 tests passed. Retained system-save/caller/intent checks: 3 tests passed. CI helper self-checks: 9 passed.
Computer use verified actual native Autofill and Credential Manager fills, and Chrome filling both exact synthetic fields. Per the user's explicit instruction, used the emulator's installed Chrome 145.0.7632.218; no Chrome update was installed.
Actual Credential Manager and framework Autofill save dialogs created separate explicitly selected destinations. Production Rust readback verified both exact submitted fields. Missing overwrite confirmation was rejected; confirmed identical update succeeded; cancellation and interrupted/expired requests failed closed.
Reviewed the completed code against this issue's scope and acceptance criteria. No Apple app changes. Runtime evidence is ARM64 emulator-only; ARMv7 packaging is audited, without claiming ARMv7, x86_64 or physical-device runtime coverage.
Implemented in 0c8366d34ffc68db9ca2aab6b27f985dd6ca49a7 on main.
- Added AndroidX Credential Provider for API 34+ and framework Autofill for API 26+, including inline suggestions, manual search, cancellation, enablement/status links, and explicit save/update offers.
- Both use one Rust storage contract for installed signing identities, trusted HTTPS browser origins, matching, typed form/entry fields, selection, consent, authentication, request expiry, and recoverable entry/Git transactions. Candidate responses expose paths only; final retrieval consumes the request and the activity relocks after handoff.
- Added bounded process-local requests, encrypted save staging, current-caller/repository rechecks, secure-window/recents/IME protections, explicit destination/overwrite confirmation, preservation of unrelated fields, and refusal of ambiguous forms, concurrent editors, expired/relocked requests and stale identities. Confirmed identical saves succeed without rewriting ciphertext.
- Added an independent synthetic client APK, native Rust facade regressions, Compose/intent security tests, dependency inventory, artifact gates and docs/android/credentials.md. Arbitrary client signer verification requires QUERY_ALL_PACKAGES; it queries only the OS-supplied package and never enumerates apps. The documentation records the Play declaration/review requirement.
Validation:
- Required cargo fmt check, warning-denying workspace check, clippy, and workspace tests passed.
- Android verification and release lint passed; both ARM native packages, strict 16-KB alignment, release debug symbols/build IDs, backup/manifest and dependency/license/SBOM audits passed.
- API 26 ARM64 provider instrumentation: 1 test passed. Strict 16-KB API 37 ARM64 native regressions: 4 tests passed. API 37 ARM64 app instrumentation: 48 tests passed. Retained system-save/caller/intent checks: 3 tests passed. CI helper self-checks: 9 passed.
- Computer use verified actual native Autofill and Credential Manager fills, and Chrome filling both exact synthetic fields. Per the user's explicit instruction, used the emulator's installed Chrome 145.0.7632.218; no Chrome update was installed.
- Actual Credential Manager and framework Autofill save dialogs created separate explicitly selected destinations. Production Rust readback verified both exact submitted fields. Missing overwrite confirmation was rejected; confirmed identical update succeeded; cancellation and interrupted/expired requests failed closed.
- Reviewed the completed code against this issue's scope and acceptance criteria. No Apple app changes. Runtime evidence is ARM64 emulator-only; ARMv7 packaging is audited, without claiming ARMv7, x86_64 or physical-device runtime coverage.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Let users fill IronStorage credentials into other Android apps and browsers with explicit authorization and storage-owned identity matching.
Scope
CredentialProviderServicefor Android 14+ password credentials and an AndroidAutofillServicefor API 26+ and compatible clients, sharing one Rust-backed candidate/retrieval contract.Acceptance criteria
Depends on the platform-neutral contract, Keystore/biometric authentication, structured viewer/editor, and lifecycle security. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Implemented in
0c8366d34fon main.Validation: