r-zakarya
4258e9b559
Opening the vault threw java.lang.SecurityException: USE_BIOMETRIC is not in Delphi default permission list, and CanAuthenticate raises instead of answering false. So the fault showed up neither at compile time nor at startup, but on the first unlock - after the cache had already been written under an auth-protected key. The permission is the shallow half. The deep half is that SaveVault was called with a hard-coded True: we asked for a key guarded by a prompt that could not be shown, producing a file that was unreadable forever. It now receives BiometricAvailable, evaluated on the main thread before the worker starts. BiometricAvailable and AuthenticateThen also swallow what comes up from the Java layer and map it to boUnavailable. The caller has a path for every TBioOutcome and none for an exception. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
85 lines
4.0 KiB
XML
85 lines
4.0 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- BEGIN_INCLUDE(manifest) -->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
xmlns:tools="http://schemas.android.com/tools"
|
|
package="%package%"
|
|
android:versionCode="%versionCode%"
|
|
android:versionName="%versionName%"
|
|
android:installLocation="%installLocation%">
|
|
<uses-sdk android:minSdkVersion="%minSdkVersion%" android:targetSdkVersion="%targetSdkVersion%" />
|
|
<%uses-permission%>
|
|
<!-- Absente de la liste par defaut de Delphi, et sans elle BiometricPrompt
|
|
leve java.lang.SecurityException a la premiere invite - pas au
|
|
demarrage, donc le defaut ne se voit qu'en essayant d'ouvrir le coffre.
|
|
USE_FINGERPRINT couvre les versions anterieures a Android 9, ou
|
|
BiometricPrompt n'existe pas encore. -->
|
|
<uses-permission android:name="android.permission.USE_BIOMETRIC" />
|
|
<uses-permission android:name="android.permission.USE_FINGERPRINT" />
|
|
<uses-feature android:glEsVersion="0x00020000" android:required="true"/>
|
|
<queries>
|
|
<%queries-child-elements%>
|
|
</queries>
|
|
<!-- usesCleartextTraffic : TEST UNIQUEMENT. Android bloque le trafic en
|
|
clair depuis la version 9, y compris vers 127.0.0.1 ; sans cet
|
|
attribut l'essai local via "adb reverse" echoue avec une erreur
|
|
reseau opaque. A RETIRER avant diffusion : l'endpoint de production
|
|
est en HTTPS, et le jeton Bearer circule dans un en-tete a chaque
|
|
appel. -->
|
|
<!-- allowBackup=false : le repertoire prive contient vault.bin, c'est-a-dire
|
|
le coffre entier. Il est chiffre par une cle qui ne quitte pas la puce,
|
|
donc ce qui sortirait serait inexploitable - mais il sortirait, et une
|
|
sauvegarde cloud n'a rien a faire dans le chemin d'un gestionnaire de
|
|
mots de passe. fullBackupContent et dataExtractionRules ne sont pas
|
|
necessaires une fois la sauvegarde refusee en bloc. -->
|
|
<application
|
|
android:allowBackup="false"
|
|
android:usesCleartextTraffic="true"
|
|
android:persistent="%persistent%"
|
|
android:restoreAnyVersion="%restoreAnyVersion%"
|
|
android:label="%label%"
|
|
android:debuggable="%debuggable%"
|
|
android:largeHeap="%largeHeap%"
|
|
android:icon="%icon%"
|
|
android:theme="%theme%"
|
|
android:hardwareAccelerated="%hardwareAccelerated%"
|
|
android:resizeableActivity="true"
|
|
android:requestLegacyExternalStorage="true">
|
|
<%provider%>
|
|
<%application-meta-data%>
|
|
<%uses-libraries%>
|
|
<!-- Trigger Google Play services to install the backported photo picker module. -->
|
|
<service
|
|
android:name="com.google.android.gms.metadata.ModuleDependencies"
|
|
android:enabled="false"
|
|
android:exported="false"
|
|
tools:ignore="MissingClass">
|
|
<intent-filter>
|
|
<action android:name="com.google.android.gms.metadata.MODULE_DEPENDENCIES" />
|
|
</intent-filter>
|
|
|
|
<meta-data android:name="photopicker_activity:0:required" android:value="" />
|
|
</service>
|
|
<%services%>
|
|
<!-- Our activity is a subclass of the built-in NativeActivity framework class.
|
|
This will take care of integrating with our NDK code. -->
|
|
<activity
|
|
android:name="com.embarcadero.firemonkey.FMXNativeActivity"
|
|
android:exported="true"
|
|
android:label="%activityLabel%"
|
|
android:configChanges="orientation|keyboard|keyboardHidden|screenSize|screenLayout|uiMode"
|
|
android:launchMode="singleTask">
|
|
<!-- Tell NativeActivity the name of our .so -->
|
|
<meta-data android:name="android.app.lib_name" android:value="%libNameValue%" />
|
|
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.MAIN" />
|
|
|
|
<category android:name="android.intent.category.LAUNCHER" />
|
|
</intent-filter>
|
|
</activity>
|
|
<%activity%>
|
|
<%receivers%>
|
|
</application>
|
|
</manifest>
|
|
<!-- END_INCLUDE(manifest) -->
|