Integrate Android BiometricPrompt with the shared authentication lease #98

New Issue

hugo · 2026-08-17T19:12:20Z

hugo commented

2026-08-17 19:12:20 +00:00

Goal

Reestablish the Rust-owned authentication lease through Android biometrics without duplicating authentication policy in Kotlin.

Scope

Use AndroidX Biometric BiometricPrompt with the Keystore cipher operation supplied by the secure-secret adapter.
When no enrolled protected passphrase is usable, collect the GPG passphrase in a secure Compose dialog and pass it directly to storage for key validation; do not persist it unless storage completes explicit enrollment.
Let crates/storage own authentication generation, inactivity timeout, activity touches, manual lock, cancellation, and which operations require decryption.
Map strong biometric/device capability, no enrollment, cancellation, negative action, temporary/permanent lockout, key invalidation, process death, and app backgrounding to typed outcomes.
Enabling biometric unlock must perform capability checks, prove the passphrase, create the authentication-bound Keystore record, and only then commit the setting. Disabling deletes it.
Never allow device credential fallback when it would violate the current-biometric-set policy; if a different policy is desired it requires an explicit storage-level decision.
Ensure ordinary folder browsing and cached non-secret TOTP paths do not prompt.

Acceptance criteria

First protected access requests manual passphrase or a valid enrolled biometric operation and establishes one shared lease across screens.
Valid biometric unlock works without the passphrase entering ordinary Kotlin persistence.
Enrollment change, lock-screen removal, invalid key, cancellation, and lockout fail closed and offer manual passphrase recovery.
Timeout/manual lock immediately invalidate native handles and mask every protected screen.
Unit tests use fake clocks/auth results; device tests cover success, cancellation, invalidation, background, and recovery.

Depends on the Keystore adapter, platform-neutral contract, and Compose shell issues. Part of #87.

## Goal Reestablish the Rust-owned authentication lease through Android biometrics without duplicating authentication policy in Kotlin. ## Scope - Use AndroidX Biometric `BiometricPrompt` with the Keystore cipher operation supplied by the secure-secret adapter. - When no enrolled protected passphrase is usable, collect the GPG passphrase in a secure Compose dialog and pass it directly to storage for key validation; do not persist it unless storage completes explicit enrollment. - Let `crates/storage` own authentication generation, inactivity timeout, activity touches, manual lock, cancellation, and which operations require decryption. - Map strong biometric/device capability, no enrollment, cancellation, negative action, temporary/permanent lockout, key invalidation, process death, and app backgrounding to typed outcomes. - Enabling biometric unlock must perform capability checks, prove the passphrase, create the authentication-bound Keystore record, and only then commit the setting. Disabling deletes it. - Never allow device credential fallback when it would violate the current-biometric-set policy; if a different policy is desired it requires an explicit storage-level decision. - Ensure ordinary folder browsing and cached non-secret TOTP paths do not prompt. ## Acceptance criteria - First protected access requests manual passphrase or a valid enrolled biometric operation and establishes one shared lease across screens. - Valid biometric unlock works without the passphrase entering ordinary Kotlin persistence. - Enrollment change, lock-screen removal, invalid key, cancellation, and lockout fail closed and offer manual passphrase recovery. - Timeout/manual lock immediately invalidate native handles and mask every protected screen. - Unit tests use fake clocks/auth results; device tests cover success, cancellation, invalidation, background, and recovery. Depends on the Keystore adapter, platform-neutral contract, and Compose shell issues. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:20 +00:00

hugo added the enhancement label 2026-08-17 19:12:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#98