r-zakarya
4258e9b559
Opening the vault threw java.lang.SecurityException: USE_BIOMETRIC is not in Delphi default permission list, and CanAuthenticate raises instead of answering false. So the fault showed up neither at compile time nor at startup, but on the first unlock - after the cache had already been written under an auth-protected key. The permission is the shallow half. The deep half is that SaveVault was called with a hard-coded True: we asked for a key guarded by a prompt that could not be shown, producing a file that was unreadable forever. It now receives BiometricAvailable, evaluated on the main thread before the worker starts. BiometricAvailable and AuthenticateThen also swallow what comes up from the Java layer and map it to boUnavailable. The caller has a path for every TBioOutcome and none for an exception. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
