Present authentication and automatic relocking #29

New Issue

hugo · 2026-08-09T19:30:04Z

hugo commented

2026-08-09 19:30:04 +00:00

Goal

Present secure authentication, unlock, and automatic relock behavior using the shared storage authentication lease.

Scope

Ask for authentication when the first action needs decrypted content, not merely while browsing encrypted entry names.
Obtain, renew, use, and revoke the storage-owned authentication lease without retaining a second GUI-owned passphrase copy.
Use the shared configurable inactivity timeout, defaulting to 120 seconds, exactly as the CLI/TUI configuration defines it.
Count deliberate entry interaction as activity; rendering, animation, background ticks, Git progress, and window events must not keep the lease alive.
On expiry or manual lock, immediately hide decrypted fields, clear UI edit buffers and clipboard presentation state as applicable, and return to a locked view.
Handle failed/cancelled authentication and an expiry during a pending operation without exposing partial plaintext.

Acceptance criteria

Browsing the tree does not prompt; the first decrypting action does.
The default two-minute timeout and a configured timeout are both covered by deterministic clock-driven tests.
Passive window activity cannot indefinitely extend a lease.
Lock/expiry removes decrypted presentation state and requires authentication again.
Authentication secrets and lease policy remain owned by crates/storage.

## Goal Present secure authentication, unlock, and automatic relock behavior using the shared storage authentication lease. ## Scope - Ask for authentication when the first action needs decrypted content, not merely while browsing encrypted entry names. - Obtain, renew, use, and revoke the storage-owned authentication lease without retaining a second GUI-owned passphrase copy. - Use the shared configurable inactivity timeout, defaulting to 120 seconds, exactly as the CLI/TUI configuration defines it. - Count deliberate entry interaction as activity; rendering, animation, background ticks, Git progress, and window events must not keep the lease alive. - On expiry or manual lock, immediately hide decrypted fields, clear UI edit buffers and clipboard presentation state as applicable, and return to a locked view. - Handle failed/cancelled authentication and an expiry during a pending operation without exposing partial plaintext. ## Acceptance criteria - Browsing the tree does not prompt; the first decrypting action does. - The default two-minute timeout and a configured timeout are both covered by deterministic clock-driven tests. - Passive window activity cannot indefinitely extend a lease. - Lock/expiry removes decrypted presentation state and requires authentication again. - Authentication secrets and lease policy remain owned by `crates/storage`.

hugo added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-09 19:30:04 +00:00

hugo added the enhancement label 2026-08-09 19:30:04 +00:00

hugo commented

2026-08-10 13:21:57 +00:00

Implemented in b9034c5. The Iced desktop app now loads the shared storage configuration and GPG identity, authenticates only for protected-content access, retains only the storage-owned lease handle, renews it exclusively from deliberate input, observes expiry from passive timer ticks, rejects stale authentication completions, and clears decrypted/editor/clipboard presentation state on expiry, cancellation, failure, or manual lock. Deterministic desktop tests cover the default 120-second and configured timeouts plus passive versus deliberate activity. Verification passed: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; native macOS Iced launch smoke test. The commit also makes pre-existing workspace gates deterministic on macOS (canonical temporary paths, a safe FIFO fixture, and injected keychain-unavailable test state).

Implemented in b9034c5. The Iced desktop app now loads the shared storage configuration and GPG identity, authenticates only for protected-content access, retains only the storage-owned lease handle, renews it exclusively from deliberate input, observes expiry from passive timer ticks, rejects stale authentication completions, and clears decrypted/editor/clipboard presentation state on expiry, cancellation, failure, or manual lock. Deterministic desktop tests cover the default 120-second and configured timeouts plus passive versus deliberate activity. Verification passed: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; native macOS Iced launch smoke test. The commit also makes pre-existing workspace gates deterministic on macOS (canonical temporary paths, a safe FIFO fixture, and injected keychain-unavailable test state).

hugo closed this issue

2026-08-10 13:22:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#29