Skip to content

Raise KeyRevokedException when re-enrolment removes or invalidates the key - #16

Open
shai-almog wants to merge 3 commits into
masterfrom
key-revoked-on-reenroll
Open

shai-almog wants to merge 3 commits into
masterfrom
key-revoked-on-reenroll

Conversation

@shai-almog

Copy link
Copy Markdown
Contributor

getPassword raised a generic RuntimeException instead of KeyRevokedException after the user removed every biometric or re-enrolled, so apps could not tell a re-enrolment from an error.

  • Android: Android deletes a biometric-bound key when every biometric is removed. A stored password whose key is missing is now reported as revoked, and that check runs before the availability check, so it also fires while nothing is enrolled.
  • iOS: an item bound to kSecAccessControlTouchIDCurrentSet answers errSecItemNotFound to a data read after the Face ID / Touch ID set changes, while an attributes-only query (no prompt) still finds it. That now raises KeyRevokedException and deletes the unreadable item. iOS previously never raised it.

Same fix as the built-in Biometrics API in codenameone/CodenameOne#6221.

🤖 Generated with Claude Code

shai-almog and others added 3 commits November 12, 2026 14:00
…e key

Android: a key deleted after all biometrics were removed was reported as
'No key found'. iOS: an item invalidated by a Face ID/Touch ID change was
reported as a generic error; iOS never raised KeyRevokedException.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant