Enum UnlockPolicy

java.lang.Object
java.lang.Enum<UnlockPolicy>
com.codename1.security.vault.UnlockPolicy
All Implemented Interfaces:
Comparable<UnlockPolicy>
public enum UnlockPolicy extends Enum<UnlockPolicy>

How a vault may be reopened, chosen by the application and explained to the user.

This is the trade an application actually has to make, so it is a choice of three named behaviours rather than a set of cryptographic parameters. What changes between them is which wraps of the data key are allowed to exist on this device -- and the rule that makes the strongest one mean anything is that choosing it removes the weaker wraps rather than leaving them beside it. A vault that requires a passkey and also keeps an unattended device wrap is a vault that does not require a passkey.

  • Enum Constant Details

    • SESSION_ONLY

      public static final UnlockPolicy SESSION_ONLY

      The password is required every time the application starts, or in a browser every time the page loads.

      Nothing that can reopen the vault is written to the device: the data key exists only in memory between unlock and lock. The strongest of the three against a stolen device or a copied browser profile, and the one users abandon, which is why it is not the default for anything.

    • REMEMBER_DEVICE

      public static final UnlockPolicy REMEMBER_DEVICE

      The user chose to be remembered on this device.

      The data key is additionally wrapped under a device key -- the OS key store on a native port, a non-extractable CryptoKey in the browser -- so the vault reopens without a prompt. That is unattended access by design: anyone who can run the application on this device, or who copies a full browser profile including its IndexedDB, reopens the vault without knowing the password.

      An application offering this must say so in those words. "Remember me" reads as a convenience and is a change in who can read the data.

    • REQUIRE_USER_VERIFICATION

      public static final UnlockPolicy REQUIRE_USER_VERIFICATION

      The device key exists but reaching it requires the user to verify themselves -- a biometric, a device passcode, a passkey with user verification.

      Choosing this deletes any REMEMBER_DEVICE wrap that already existed, and refuses to create one while it is in force. Without that, the unattended wrap sits beside the gated one and the prompt is decoration.

      Not every platform can provide it. Vault.capabilities() reports whether this device can, and Vault.enroll(char[], VaultOptions) fails with VaultError.POLICY_NOT_MET rather than quietly enrolling under a weaker policy.

  • Method Details

    • values

      public static UnlockPolicy[] values()
      Returns an array containing the constants of this enum type, in the order they are declared.
      Returns:
      an array containing the constants of this enum type, in the order they are declared

    • valueOf

      public static UnlockPolicy valueOf(String name)
      Returns the enum constant of this type with the specified name. The string must match exactly an identifier used to declare an enum constant in this type. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum type has no constant with the specified name
      NullPointerException - if the argument is null