From dd5d0f68726fe56ee4d199867d414aea81905cc4 Mon Sep 17 00:00:00 2001 From: cirakg Date: Mon, 19 Oct 2026 15:27:37 +0200 Subject: feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations Records are one ByteArray each: a readable TLV header plus an encrypt-then-MAC box whose aad binds the entry ID and the header. The device key seals unlocked entries and pending items; a random master key, wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted before the check, with delays on the trusted clock and an uptime fallback. Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes on invalid input. Co-Authored-By: Claude Opus 5.5 --- source/storage/VaultError.mc | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 source/storage/VaultError.mc (limited to 'source/storage/VaultError.mc') diff --git a/source/storage/VaultError.mc b/source/storage/VaultError.mc new file mode 100644 index 0000000..7320ce4 --- /dev/null +++ b/source/storage/VaultError.mc @@ -0,0 +1,35 @@ +// Author: cirakg & claude ai +// Summary: The one exception type the storage layer throws, with a code the UI turns into a message. + +import Toybox.Lang; + +class VaultError extends Lang.Exception { + + // The session is locked and the operation needs the master key. + static const LOCKED = 1; + // A record or the PIN wrap failed to decode or verify. + static const DAMAGED = 2; + // Application.Storage refused a write (store full). + static const FULL = 3; + // The entry cap is reached, or one record would be too big. + static const LIMIT = 4; + // No entry with that ID. + static const NOT_FOUND = 5; + // The data was written by a newer app version; nothing may be changed. + static const NEWER_SCHEMA = 6; + // The entry failed validation (see Entry.validate()). + static const INVALID = 7; + // A wrong-PIN delay is running; try again later. + static const LOCKED_OUT = 8; + // The operation needs a PIN and none is set, or a PIN is already set. + static const NO_PIN = 9; + static const PIN_EXISTS = 10; + + var code as Number; + + function initialize(errorCode as Number, message as String) { + Exception.initialize(); + code = errorCode; + mMessage = message; + } +} -- cgit v1.2.3