Implement the TOTP tab and Watch sharing selection #52

New Issue

hugo · 2026-08-09T20:00:44Z

hugo commented

2026-08-09 20:00:44 +00:00

Goal

Implement the TOTP tab, large-code detail view, and per-entry Apple Watch sharing choice.

Scope

List all storage-identified TOTP entries in the third tab without decrypting codes until requested.
Selecting a row opens a native detail view with the current code in large, readable digits, issuer/account labels, countdown/progress, copy action, and error/locked states.
Update displayed codes from storage-owned OTP results; timer ticks must not extend the authentication lease.
Add a "Share with Apple Watch" switch/checkbox to TOTP details and persist that selection through storage-owned application preference/domain APIs, not in the pass repository format or Swift defaults.
Refresh the watch snapshot after a share selection or TOTP entry changes, and clearly present unavailable/pending Watch connectivity.
Keep HOTP out of the Watch sharing surface unless a later explicit requirement adds safe counter synchronization.

Acceptance criteria

TOTP entries can be listed, authenticated, viewed in large digits, copied, and selected/deselected for Watch sharing.
Countdown updates do not renew authentication and codes disappear on lock.
Share selection survives restart without changing upstream-compatible password-store entry contents.
Swift never parses otpauth:// data or calculates an OTP.

## Goal Implement the TOTP tab, large-code detail view, and per-entry Apple Watch sharing choice. ## Scope - List all storage-identified TOTP entries in the third tab without decrypting codes until requested. - Selecting a row opens a native detail view with the current code in large, readable digits, issuer/account labels, countdown/progress, copy action, and error/locked states. - Update displayed codes from storage-owned OTP results; timer ticks must not extend the authentication lease. - Add a "Share with Apple Watch" switch/checkbox to TOTP details and persist that selection through storage-owned application preference/domain APIs, not in the pass repository format or Swift defaults. - Refresh the watch snapshot after a share selection or TOTP entry changes, and clearly present unavailable/pending Watch connectivity. - Keep HOTP out of the Watch sharing surface unless a later explicit requirement adds safe counter synchronization. ## Acceptance criteria - TOTP entries can be listed, authenticated, viewed in large digits, copied, and selected/deselected for Watch sharing. - Countdown updates do not renew authentication and codes disappear on lock. - Share selection survives restart without changing upstream-compatible password-store entry contents. - Swift never parses `otpauth://` data or calculates an OTP.

hugo added this to the 04 - iPhone and Apple Watch apps milestone 2026-08-09 20:00:44 +00:00

hugo added the enhancement label 2026-08-09 20:00:44 +00:00

hugo added the critical label 2026-08-11 18:03:19 +00:00

hugo added the untested label 2026-08-11 18:54:58 +00:00

hugo commented

2026-08-11 18:55:24 +00:00

Implemented in b01cc8b and pushed to main.

Implementation:

Added a Rust-owned mobile TOTP catalog and detail service. It decrypts and parses pass-compatible otpauth entries in storage, excludes HOTP, derives codes only for requested details/copies, returns issuer/account/countdown metadata, and redacts codes from Debug output.
Added lease-safe mobile authentication APIs: timer refreshes read codes without renewing the inactivity lease; deliberate row/copy/switch actions touch it; lock/error paths remove the displayed and retained Swift code and clear an IronStorage-owned clipboard value.
Persisted per-entry Apple Watch sharing in validated, secret-free application config without modifying pass contents. Config writes reload the current document first so stale tab/home/biometric state cannot overwrite the selection.
Added the generated UniFFI bridge and a native UIKit TOTP tab: inset-grouped list, large monospaced detail code, determinate progress/countdown, tap/copy feedback, native Watch switch, disclosure/list states, Dynamic Type sizing, VoiceOver labels, and unavailable/pending Watch status.
Followed Apple HIG patterns for tab navigation, list disclosure, progress indicators, and switches.

Verification completed:

Local compatibility fixture test covers TOTP catalog metadata, RFC 6238 code generation, HOTP exclusion, redacted output, Watch select state, and boundary rollover. No live server is used.
Config regression proves selection survives reload and a stale concurrent app preference write without creating/modifying a vault.
cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
xcodegen generate
Xcode Analyze succeeded.
iPhone 17 Pro simulator Debug build succeeded with Swift warnings as errors; final app installed and launched.
Signed optimized Release-iphoneos build succeeded and validated.

Deferred under the untested label because no user unlock is available:

Authenticated simulator visual/interaction pass with real entries: list and long issuer/account text, large code layout at accessibility Dynamic Type sizes, countdown rollover, copy flash/clipboard cleanup, Watch select/deselect/restart, lock/expiry disappearance, error states, VoiceOver, and unavailable/pending Watch presentation. The simulator launch itself was verified, but existing authentication/app-token state blocked the protected TOTP screens.
Signed Release install and smoke test on the paired physical iPhone. CoreDevice currently reports it unavailable.
End-to-end Watch connectivity/snapshot delivery once the later Watch transport issue is implemented.

The automated and build gates are green; reopening for the deferred device/UI checks is tracked by untested.

Implemented in b01cc8b and pushed to main. Implementation: - Added a Rust-owned mobile TOTP catalog and detail service. It decrypts and parses pass-compatible otpauth entries in storage, excludes HOTP, derives codes only for requested details/copies, returns issuer/account/countdown metadata, and redacts codes from Debug output. - Added lease-safe mobile authentication APIs: timer refreshes read codes without renewing the inactivity lease; deliberate row/copy/switch actions touch it; lock/error paths remove the displayed and retained Swift code and clear an IronStorage-owned clipboard value. - Persisted per-entry Apple Watch sharing in validated, secret-free application config without modifying pass contents. Config writes reload the current document first so stale tab/home/biometric state cannot overwrite the selection. - Added the generated UniFFI bridge and a native UIKit TOTP tab: inset-grouped list, large monospaced detail code, determinate progress/countdown, tap/copy feedback, native Watch switch, disclosure/list states, Dynamic Type sizing, VoiceOver labels, and unavailable/pending Watch status. - Followed Apple HIG patterns for tab navigation, list disclosure, progress indicators, and switches. Verification completed: - Local compatibility fixture test covers TOTP catalog metadata, RFC 6238 code generation, HOTP exclusion, redacted output, Watch select state, and boundary rollover. No live server is used. - Config regression proves selection survives reload and a stale concurrent app preference write without creating/modifying a vault. - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace - xcodegen generate - Xcode Analyze succeeded. - iPhone 17 Pro simulator Debug build succeeded with Swift warnings as errors; final app installed and launched. - Signed optimized Release-iphoneos build succeeded and validated. Deferred under the untested label because no user unlock is available: - Authenticated simulator visual/interaction pass with real entries: list and long issuer/account text, large code layout at accessibility Dynamic Type sizes, countdown rollover, copy flash/clipboard cleanup, Watch select/deselect/restart, lock/expiry disappearance, error states, VoiceOver, and unavailable/pending Watch presentation. The simulator launch itself was verified, but existing authentication/app-token state blocked the protected TOTP screens. - Signed Release install and smoke test on the paired physical iPhone. CoreDevice currently reports it unavailable. - End-to-end Watch connectivity/snapshot delivery once the later Watch transport issue is implemented. The automated and build gates are green; reopening for the deferred device/UI checks is tracked by untested.

hugo closed this issue

2026-08-11 18:55:37 +00:00

hugo commented

2026-08-12 17:32:47 +00:00

Non-destructive validation completed on 2026-08-12. In the iPhone simulator, the TOTP detail displayed the current-code presentation and countdown, and the Watch selection toggle was changed and restored to its original state. TOTP parsing, cache, selection, and lock behavior passed in the current isolated Rust workspace tests. No OTP value is included in this report. Removing the untested label.

hugo removed the untested label 2026-08-12 17:32:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#52