3.8 KiB
Android entry editor
Passwords offers New folder and New entry in configured stores, including an empty store. An unlocked entry offers Edit entry. The native form presents Rust field IDs, kinds, names, sensitivity, capabilities and generation options. Values are hidden until explicitly revealed. Named/repeated fields, multiline notes and OTP URIs can be added; accessible Up/Down and Remove controls obey Rust capabilities. Opaque non-UTF8 fields remain intact and cannot be edited. Generation requires confirmation before replacing the password.
Rust owns validation, lossless entry serialization, recipients, generation, revision checks, atomic encryption/write and Git commits. Kotlin collects input and presents typed results. Failed validation and stale saves keep the draft; an explicit discard is required before Back, another tab or manual Lock can abandon dirty changes. Background/expiry clears plaintext presentation at once.
The Rust authentication owner retains a ciphertext-only checkpoint in memory, including stable IDs, exact bytes and the original conflict base. Collected inputs are encrypted with monotonic versions; late completion cannot replace newer input. Unlock restores that draft without silently adopting a newer repository revision. The checkpoint is neither a repository format nor a disk draft. Save and confirmed discard remove it; process recreation removes all checkpoints and starts locked. SavedStateHandle contains only an editor-open boolean for the Rust-provided discarded-draft explanation, never fields or native editor handles.
The existing protected Compose surface disables autofill/content capture, personalized IME learning and extraction. Activity/dialog secure flags protect screenshots; window focus loss and memory pressure clear protected presentation. Editor records redact their string representations. Long fields use a lazy scrolling form with IME padding, focus traversal and multiline input; keyboard activation and 200% text are exercised by instrumentation.
Regression coverage uses public encrypted fixtures for folder/entry creation, dynamic repeated fields, PINs, multiline Unicode, OTP, add/remove/reorder, generation, atomic save, invalid input, stale conflict, explicit discard, background and two-second authentication expiry. A Rust fixture preserves an opaque non-UTF8 value through checkpoint recovery and a neighboring field edit. Compose tests cover typed callbacks, masking, keyboard save, confirmation, configured-empty creation and process-restart saved-state boundaries.
Validation uses ARM64 emulators on API 26 (4 KB), API 37 (4 KB) and API 37 (strict 16 KB), with app/core/bridge instrumentation and five cold starts on each. Debug/release builds, both ARM native ABIs, packaging, lint, architecture, dependency/license and SBOM gates accompany all four Rust workspace checks. ARMv7 is built and packaged; no live ARMv7 image was available. Physical devices and x86_64 are outside this milestone's support scope.
Computer use in Android Studio's embedded emulator exercises a freshly created public fixture store: folder/entry creation, confirmed generation, dynamic PIN fields, save and reopening, dirty tab cancellation, background/expiry recovery and confirmed discard. The fixture uses a known public passphrase, with no user secret required. Editor entry clears viewer presentation without starting a competing storage refresh; completed mutations wait for directory refresh before accepting another operation. The core regression keeps the native process's single immutable private root throughout viewer and editor checks.
The additive shared contract regenerates hardened Swift bindings. The iPhone and dependent watch simulator targets build after XcodeGen generation; the iPhone update preserves its app container, and computer use verifies locked folder navigation with existing data and biometric enrollment retained.