Present secure authentication, unlock, and automatic relock behavior using the shared storage authentication lease.
Scope
Ask for authentication when the first action needs decrypted content, not merely while browsing encrypted entry names.
Obtain, renew, use, and revoke the storage-owned authentication lease without retaining a second GUI-owned passphrase copy.
Use the shared configurable inactivity timeout, defaulting to 120 seconds, exactly as the CLI/TUI configuration defines it.
Count deliberate entry interaction as activity; rendering, animation, background ticks, Git progress, and window events must not keep the lease alive.
On expiry or manual lock, immediately hide decrypted fields, clear UI edit buffers and clipboard presentation state as applicable, and return to a locked view.
Handle failed/cancelled authentication and an expiry during a pending operation without exposing partial plaintext.
Acceptance criteria
Browsing the tree does not prompt; the first decrypting action does.
The default two-minute timeout and a configured timeout are both covered by deterministic clock-driven tests.
Passive window activity cannot indefinitely extend a lease.
Lock/expiry removes decrypted presentation state and requires authentication again.
Authentication secrets and lease policy remain owned by crates/storage.
## Goal
Present secure authentication, unlock, and automatic relock behavior using the shared storage authentication lease.
## Scope
- Ask for authentication when the first action needs decrypted content, not merely while browsing encrypted entry names.
- Obtain, renew, use, and revoke the storage-owned authentication lease without retaining a second GUI-owned passphrase copy.
- Use the shared configurable inactivity timeout, defaulting to 120 seconds, exactly as the CLI/TUI configuration defines it.
- Count deliberate entry interaction as activity; rendering, animation, background ticks, Git progress, and window events must not keep the lease alive.
- On expiry or manual lock, immediately hide decrypted fields, clear UI edit buffers and clipboard presentation state as applicable, and return to a locked view.
- Handle failed/cancelled authentication and an expiry during a pending operation without exposing partial plaintext.
## Acceptance criteria
- Browsing the tree does not prompt; the first decrypting action does.
- The default two-minute timeout and a configured timeout are both covered by deterministic clock-driven tests.
- Passive window activity cannot indefinitely extend a lease.
- Lock/expiry removes decrypted presentation state and requires authentication again.
- Authentication secrets and lease policy remain owned by `crates/storage`.
hugo
added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-09 19:30:04 +00:00
Implemented in b9034c5. The Iced desktop app now loads the shared storage configuration and GPG identity, authenticates only for protected-content access, retains only the storage-owned lease handle, renews it exclusively from deliberate input, observes expiry from passive timer ticks, rejects stale authentication completions, and clears decrypted/editor/clipboard presentation state on expiry, cancellation, failure, or manual lock. Deterministic desktop tests cover the default 120-second and configured timeouts plus passive versus deliberate activity. Verification passed: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; native macOS Iced launch smoke test. The commit also makes pre-existing workspace gates deterministic on macOS (canonical temporary paths, a safe FIFO fixture, and injected keychain-unavailable test state).
Implemented in b9034c5. The Iced desktop app now loads the shared storage configuration and GPG identity, authenticates only for protected-content access, retains only the storage-owned lease handle, renews it exclusively from deliberate input, observes expiry from passive timer ticks, rejects stale authentication completions, and clears decrypted/editor/clipboard presentation state on expiry, cancellation, failure, or manual lock. Deterministic desktop tests cover the default 120-second and configured timeouts plus passive versus deliberate activity. Verification passed: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; native macOS Iced launch smoke test. The commit also makes pre-existing workspace gates deterministic on macOS (canonical temporary paths, a safe FIFO fixture, and injected keychain-unavailable test state).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Present secure authentication, unlock, and automatic relock behavior using the shared storage authentication lease.
Scope
Acceptance criteria
crates/storage.Implemented in
b9034c5. The Iced desktop app now loads the shared storage configuration and GPG identity, authenticates only for protected-content access, retains only the storage-owned lease handle, renews it exclusively from deliberate input, observes expiry from passive timer ticks, rejects stale authentication completions, and clears decrypted/editor/clipboard presentation state on expiry, cancellation, failure, or manual lock. Deterministic desktop tests cover the default 120-second and configured timeouts plus passive versus deliberate activity. Verification passed: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; native macOS Iced launch smoke test. The commit also makes pre-existing workspace gates deterministic on macOS (canonical temporary paths, a safe FIFO fixture, and injected keychain-unavailable test state).