Implement authentication and inactivity-relock presentation #19

New Issue

hugo · 2026-08-09T19:10:38Z

hugo commented

2026-08-09 19:10:38 +00:00

Objective

Implement authentication, locked-state and inactivity-relock presentation using the storage authentication lease.

Scope

Require authentication before opening an entry and present secure-store, biometric/user-presence or passphrase prompts requested by storage.
Signal actual keyboard activity to the lease while ignoring repaint, OTP tick and background Git activity.
Close the shown entry after configured inactivity, drop viewer/editor plaintext state and return focus safely to the sidebar.
Provide a manual lock action and immediately lock on terminal suspend or lost terminal ownership.
Present remaining-time or relock warnings only when useful and never expose secret material in status text.

Acceptance criteria

Default and configured timeout behavior is proven with a controlled clock.
Reauthentication is required after expiry, manual lock and suspension.
Authentication denial, cancellation and unavailable secure storage leave the entry closed.
Dirty edit state follows an explicit tested discard/cancel policy on forced relock; plaintext does not remain reachable by the UI.

Prerequisites

TUI shell; storage authentication lease.

## Objective Implement authentication, locked-state and inactivity-relock presentation using the storage authentication lease. ## Scope - Require authentication before opening an entry and present secure-store, biometric/user-presence or passphrase prompts requested by storage. - Signal actual keyboard activity to the lease while ignoring repaint, OTP tick and background Git activity. - Close the shown entry after configured inactivity, drop viewer/editor plaintext state and return focus safely to the sidebar. - Provide a manual lock action and immediately lock on terminal suspend or lost terminal ownership. - Present remaining-time or relock warnings only when useful and never expose secret material in status text. ## Acceptance criteria - Default and configured timeout behavior is proven with a controlled clock. - Reauthentication is required after expiry, manual lock and suspension. - Authentication denial, cancellation and unavailable secure storage leave the entry closed. - Dirty edit state follows an explicit tested discard/cancel policy on forced relock; plaintext does not remain reachable by the UI. ## Prerequisites TUI shell; storage authentication lease.

hugo added this to the 02 - Mutt-style terminal UI milestone 2026-08-09 19:10:38 +00:00

hugo added the enhancement label 2026-08-09 19:10:38 +00:00

hugo commented

2026-08-10 06:22:48 +00:00

Implemented in commit 57a79b7 and pushed to main.

Implementation:

Enter requests asynchronous authentication through the storage-owned NativeAuthenticationSession before any viewer transition; stale, denied, cancelled, and unavailable results leave the entry closed.
Uses the configured AuthenticationTimeout and configured default OpenPGP key, presents secure-store/passphrase progress without secret data, and retains the generation-bound handle for storage-backed viewer work.
Only real keypresses call touch_user_activity. Timer ticks, repaint, tree refresh/filter work, and background completions do not extend the lease.
Timer polling expires leases and shows a concise warning only during the last 30 seconds.
Manual lock, Ctrl-Z, focus loss, and expiry revoke storage access immediately, close entry state, return focus to the sidebar, and invalidate pending work.
Forced editor relock has an explicit discard policy and clears all presentation references to entry state.

Verification:

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
30 focused TUI tests pass. Storage controlled-clock tests verify default/configured activity extension, exact expiry, manual revocation, cancellation, and zeroizing relock behavior.

Implemented in commit 57a79b7 and pushed to main. Implementation: - Enter requests asynchronous authentication through the storage-owned NativeAuthenticationSession before any viewer transition; stale, denied, cancelled, and unavailable results leave the entry closed. - Uses the configured AuthenticationTimeout and configured default OpenPGP key, presents secure-store/passphrase progress without secret data, and retains the generation-bound handle for storage-backed viewer work. - Only real keypresses call touch_user_activity. Timer ticks, repaint, tree refresh/filter work, and background completions do not extend the lease. - Timer polling expires leases and shows a concise warning only during the last 30 seconds. - Manual lock, Ctrl-Z, focus loss, and expiry revoke storage access immediately, close entry state, return focus to the sidebar, and invalidate pending work. - Forced editor relock has an explicit discard policy and clears all presentation references to entry state. Verification: - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace - 30 focused TUI tests pass. Storage controlled-clock tests verify default/configured activity extension, exact expiry, manual revocation, cancellation, and zeroizing relock behavior.

hugo closed this issue

2026-08-10 06:22:48 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#19