Add optional local data encryption with data.bin vault#5
Merged
henricook merged 7 commits intoJul 5, 2026
Merged
Conversation
Contributor
Author
|
On load with plaintext json, prompts to encrypt local json (into a data.bin). Prompts for password on encrypt. On loading an encrypted vault, prompts for password. (Password prompt) And passwords on visible upon entering correct password! data.bin (as opposed to data.json) is stored at: |
Owner
|
Thanks @spotco ! Do you mind if I push a couple of minor amendments and then prompt you to take a look? Broadly though, looking good |
Contributor
Author
|
yep, go ahead 👍 |
- Raise vault KDF to 600k PBKDF2-SHA256 iterations (OWASP guidance) - Reject out-of-range iteration counts on load (unlock DoS guard) - Distinguish wrong-password from corrupted-vault errors via typed error kinds instead of string matching - Cache the derived key per session and restrict write-verification to migrate / password-change, so routine saves skip PBKDF2 - Share PBKDF2/AES-GCM primitives between the vault and 2FAS services - Fix off-by-one length guard that blocked decrypting empty payloads - Cancel pending debounced save during migrate / password change - Reopen the vault prompt on a failed unlock instead of clearing the unrelated 2FAS backup credential - Expand test coverage for unlock, error-kind, AAD-tamper and empty-plaintext paths
…lt-encryption # Conflicts: # lib/presentation/pages/dashboard_page.dart
- Remember when the user picks "Not Now" on the encryption migration prompt so it is not shown again on every launch - Store the choice in SharedPreferences and honour it on load - The manual "Encrypt Local Data" action remains available afterwards
- Make vault saves atomic: swap via .bak rename instead of delete-then-rename, roll back on failure, and recover from leftover .tmp/.bak files at load time so an interrupted save can no longer lose the vault - Stop trimming passwords; surrounding whitespace is preserved - Surface unknown load errors (e.g. corrupt data.json) as a plain error state instead of an unwinnable password prompt - Only re-show the password dialog while a password is still required - Render friendly load-error copy instead of raw exception text and hide the password action when the failure is not password-related - Guard the debounced save against running concurrently with vault operations and cancel it before imports - Remove dead loadData/readPlaintextJsonObject and unused mock code - Document the data.bin vault in CLAUDE.md - Add tests: key-based save round-trip, .tmp/.bak crash recovery, unknown-error prompt behaviour, whitespace-preserving passwords
- Validate the full envelope (including ciphertext presence and length) before adopting a leftover .tmp, so a header-valid but broken temp file cannot shadow a recoverable .bak - Delete leftover .tmp/.bak swap artifacts once the vault unlocks successfully; a crashed password change could otherwise leave a copy encrypted under the old password on disk indefinitely - Tests for both behaviours
Owner
|
Thanks @spotco ! |
henricook
added a commit
that referenced
this pull request
Jul 5, 2026
…vault Reconciles the import merge/append feature with the now-merged local vault (PR #5). Import persistence goes through the vault-aware _persistCurrentData() instead of a direct plaintext saveData, so importing while an encrypted vault is active re-encrypts into data.bin rather than writing decrypted secrets to data.json. The merge is committed to state then persisted, rolling back the in-memory merge if the persist fails. Adds a test asserting imports take the encrypted path when the vault is active.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds optional encryption for local LibreOTP data by migrating plaintext
data.jsonstorage into an encrypteddata.binvault.This includes:
data.binoverdata.jsonwhen both exist