biometric_storage 6.0.0-dev.2 changelog

6.0.0-dev.2 #

Six pre-existing bugs, all found while reviewing 6.0.0-dev.1 and none introduced by it.

android: an authentication requested while the activity cannot host a dialog no longer hangs forever. androidx.biometric refuses to start after onSaveInstanceState — logging Unable to start authentication — and returns without invoking any callback, so the pending Flutter result never completed. The state is checked up front and reported as AuthException(AuthExceptionCode.unknown) instead. Reachable whenever the app is backgrounded, independently of the configuration-change bug below.
android: the plugin kept using a destroyed Activity after a configuration change. onReattachedToActivityForConfigChanges and onDetachedFromActivityForConfigChanges were both empty, so after a rotation every authenticated read or write handed BiometricPrompt a dead FragmentActivity. ActivityAware documents that the old reference must be cleared and the new binding adopted; now both happen.
android: a storage-not-initialized error delivered its message as the PlatformException.code — the field callers match on. The code is now NotInitialized.
iOS/macOS: init replied twice when an argument was missing or mistyped, so the caller saw the error and then a success. The success reply now only happens on the success path.
Breaking: iOS/macOS canAuthenticate() reports an unrecognised LAError as CanAuthenticateResponse.statusUnknown rather than unsupported, matching Android. unsupported means "the plugin does not support this platform", so a recoverable biometryLockout was telling callers to give up entirely. Callers that treat statusUnknown as usable will now attempt authentication where they previously did not.
Breaking: iOS/macOS, a repeat getStorage() for a name that is already open no longer rebuilds the store. It used to replace it outright, which threw away the cached LAContext — so any darwinTouchIDAuthenticationForceReuseContextDuration in progress — and quietly adopted whatever options the second call passed. The first call now wins, as on Android. If you relied on re-initializing to change options, give each set of options its own store name, or restart — there is no API to close a store, so none can be reopened differently within a run. Passing different options to a repeat call was never reported back to Dart, and now definitively does nothing.
Breaking: forceInit now does what it documents on Windows, web, iOS and macOS. It was implemented on Android only; the others accepted the flag and dropped it. It throws BiometricStorageException on every platform — the PlatformException(code: 'AlreadyInitialized') that the method-channel platforms raise is translated, so one catch clause covers all of them. Linux still ignores the flag: its init keeps no per-store state at all, so implementing it there is a separate change.
Breaking: windows read() and delete() throw BiometricStorageException when the credential store fails, instead of returning null and false. Those values still mean "no value stored" and "there was nothing to delete" — previously they doubled as the answer for a failing store, so a failure read as data loss.
iOS/macOS: canAuthenticate() names biometryLockout explicitly rather than letting it fall through the unmapped-code path, and the nil-error branch reports statusUnknown too rather than unsupported.

6.0.0-dev.1 #

Breaking: requires Dart 3.10 / Flutter 3.44 or newer.

Support package:win32 6.x, and drop 5.x and older. Every 5.x release of this plugin pinned win32 >=2.0.0 <6.0.0, which made it unresolvable alongside package_info_plus >=10.1.0 and anything else on win32 6. The Windows implementation is compiled on every dart.library.io platform, so win32 6 removing TEXT() also broke iOS and macOS builds — the test suite now imports the public barrel so flutter test compiles the win32 bindings on any host.
windows: writing an empty value no longer throws.
windows: fix a use-after-free in read(). CredentialBlob.asTypedList() is a view onto memory owned by the credential, and it was decoded after CredFree had released it. The bytes are now copied out first. Present since 1.1.0, where a9e3944 moved the CredFree call in between the two.
windows: the bindings now have runtime coverage, not just compile coverage — test/biometric_storage_win32_test.dart exercises write/read/delete against the real credential store, and runs on the Windows CI job.
iOS/macOS: Swift Package Manager support. Adding this plugin to an app that has migrated to SwiftPM no longer regenerates a Podfile. CocoaPods keeps working; both a Package.swift and a podspec are shipped.
iOS/macOS: the Swift sources moved to darwin/ and are shared through sharedDarwinSource, replacing the symlink from ios/Classes. The macOS plugin class is now BiometricStoragePlugin (was BiometricStorageMacOSPlugin) and the Objective-C shim on iOS is gone. Neither is referenced from Dart, so this is only visible in a hand-written registrant.
android: AGP 8.13, Kotlin 2.2, compileSdk 36, androidx.biometric 1.4.0-alpha05, core-ktx 1.18.0, fragment-ktx 1.9.0, slf4j 2.0.18 and kotlin-logging 8. The plugin no longer applies the Kotlin Gradle Plugin itself — AGP 9 warns about that and future Flutter releases reject it.
android: canAuthenticate() no longer throws on a status code the plugin does not know about — Android 16 added BIOMETRIC_ERROR_NOT_ENABLED_FOR_APPS (21) and every call blew up. Unmapped codes are reported as CanAuthenticateResponse.statusUnknown and logged. https://github.com/authpass/biometric_storage/issues/148
android: the plugin no longer calls jvmToolchain, which failed to resolve in some consumer builds. https://github.com/authpass/biometric_storage/issues/107
Document the Android FlutterFragmentActivity and Theme.AppCompat requirements as what they actually are: both only apply to storage that shows an authentication prompt, and the theme only where androidx.biometric falls back to its own dialog, which is below API 28 rather than below API 29.
web: the package is now WebAssembly-ready. lib/src/biometric_storage.dart imported dart:io unconditionally for Platform, which marked the whole package wasm-incompatible; the host OS now comes through a conditional import, with dart:io still doing the work everywhere it exists. No behaviour change on any platform. https://github.com/authpass/biometric_storage/issues/145
iOS/macOS: the prompt strings (IosPromptInfo.saveTitle / accessTitle) now travel on the LAContext as localizedReason instead of through kSecUseOperationPrompt, deprecated since iOS 14 / macOS 11. Same prompts, no deprecation warnings on build.

5.2.0-dev.1 #

iOS/macOS: StorageFileInitOptions.darwinKeychainAccessGroup to store items in a shared keychain access group (kSecAttrAccessGroup), so an app extension can read them. Note that the access group is part of an item's identity — existing items are not migrated automatically.

5.1.1-dev.2 #

Improve canAuthenticate to include InitOptions to decide for which authenticaiton type to check.

5.1.0 #

Fix typo in Flutter to iOS reuse duration parameter name @jefmathiot #125

5.1.0-rc.5 #

upgrade dependency to web 1.0

5.1.0-rc.4 #

enable building on jdk 17 and up https://github.com/authpass/biometric_storage/issues/117 thanks @connyduck

5.1.0-rc.3 #

Split Split authenticationValidityDurationSeconds between android and iOS
- darwinTouchIDAuthenticationForceReuseContextDuration: Basically the equivalent to androidAuthenticationValidityDuration
- darwinTouchIDAuthenticationAllowableReuseDuration
android: return correct code if no biometric is enrolled #115 @ThomasLamprecht
web: migrate from dart:html to package:web (for wasm support).

5.0.1 #

Add option for iOS/MacOS to allow non-biometric authentication (darwinBiometricOnly) #101
- Improve [canAuthenticate] to differentiate between no available biometry and no available user code.
Bump dart sdk requirement to 3.2.

5.0.0+4 #

Add topics to pubspec.yaml

5.0.0+3 #

Android: Upgrade AGP, fix building with AGP 8
Android: Depend on slf4j-api.

5.0.0+1 #

MacOS: fix building on MacOS

5.0.0 #

Allow overriding of promptInfo during read/write thanks @luckyrat
Android: (POTENTIALLY BREAKING): Completely removed deprecated old file backend based on androidx.security. This was deprecated since version 3.0.0 and users should have been migrated on every read or write. (this is only internally, does not change anything of the API).
Update dependencies.

4.1.3 #

iOS/MacOS: Reuse LAContext to make touchIDAuthenticationAllowableReuseDuration work. thanks @radvansky-tomas

4.1.2 #

Android: Move File I/O and encryption to background thread. (Previously used UI Thread) https://github.com/authpass/biometric_storage/pull/64

4.1.1 #

Fix building on all platforms, add github actions to test building.

4.1.0 #

Android: Remove Moshi dependency altogether. #53

4.0.1 #

Update to Moshi 1.13 for Kotlin 1.6.0 compatibility. #53

4.0.0 #

Fixed compile errors with Flutter >= 2.8.0 (Compatible with Flutter 2.5). #47 fix #42

3.0.1 #

Android: Validate options on int When authenticationValidityDurationSeconds == -1, then androidBiometricOnly must be true
Android: if authenticationValidityDurationSeconds is > 0 only show authentication prompt when necessary. (It will simply try to use the key, and show the auth prompt only when a UserNotAuthenticatedException is thrown).
Android: When biometric key is invalidated (e.g. because biometric security is changed on the device), we simply delete the old key and data! (KeyPermanentlyInvalidatedException)

3.0.0 #

Stable Release 🥳
**Please check below for breaking changes in the -rc releases.

3.0.0-rc.12 #

Android: Fix a few bugs with authenticationValidityDurationSeconds == -1
iOS/MacOS: Don't set timeout for authenticationValidityDurationSeconds == -1
iOS/MacOS: Don't raise an error on delete if item was not found.
Android: Fix user cancel code. (Previously an unknown exception was thrown instead of userCanceled)
Android: Ignore androidBiometricOnly prior to Android R (30).
Introduce AuthExceptionCode.canceled

3.0.0-rc.7 #

Breaking Change: authenticationValidityDurationSeconds is now -1 by default, which was not supported before hand. If you need backward compatibility, make sure to override this value to the previous value of 10.
Breaking Change: No more support for Android v1 Plugin registration.
Breaking Change: No longer using androidx.security, but instead handle encryption directly. Temporarily there is a fallback to read old content. This requires either reencrypting everything, or old data will no longer be readable.
1. This should fix a lot of errors.
2. This now finally also allows using authenticationValidityDurationSeconds = -1.
3. BIOMETRIC_WEAK is no longer used, only BIOMETRIC_STRONG.
Don't ask for authentication for delete.

3.0.0-rc.5 #

Breaking Change: due to the introduction of iOS prompt info there is now a wrapper object PromptInfo which contains AndroidPromptInfo and IosPromptInfo.
Android: Add support for local (non-biometric) storage (#28, thanks @killalad)
Android: Update all gradle dependencies, removed gradle-wrapper from plugin folder.
iOS: Add support for customizing prompt strings.
MacOS: Add support for customizing prompt strings.

2.0.3 #

Android
- compatibility with kotlin 1.5.20
- Remove jcenter() references.
- androidx.core:core:1.3.2 to 1.6.0
- moshi from 1.11.0 to 1.12.0 (this is the kotlin 1.5.20 compatibility problem)

2.0.2 #

Android upgrade dependencies:
- androidx.security:security-crypto from 1.1.0-alpha02 to 1.1.0-alpha03
- androidx.biometric:biometric from 1.1.0-beta01 to 1.2.0-alpha03
- Update README to clarify minSdkVersion and kotlin version

2.0.1 #

Handle android BIOMETRIC_STATUS_UNKNOWN response on older devices (Android 9/API 28(?))

2.0.0 #

Null safety stable release.

2.0.0-nullsafety.1 #

Null safety migration.

1.1.0+1 #

upgrade android moshi dependency.

1.1.0 #

Upgrade to latest Android dependencies (gradle plugin, androidx.*, gradle plugin)
- androidx.security:security-crypto 1.0.0-rc02 to 1.1.0-alpha02
- androidx.biometric:biometric 1.0.1 to 1.1.0-beta01

1.0.1+5 #

Workaround to not load win32 when compiling for web.

1.0.1+4 #

Fix windows plugin config.

1.0.1+1 #

Support for web support: Warning: Unencrypted - stores into local storage on web!
Updated README to add details about windows.

1.0.0 #

Windows: Initial support for windows. only unauthenticated storage in Credential Manager.

0.4.1 #

Linux: Improve snap compatibility by detecting AppArmor error to prompt users to connect to password-manager-service.

0.4.0 #

Linux: Initial support for Linux - only unauthenticated storage in Keyring.

0.3.4+6 #

Android: androidx.security 1.0.0-rc02 needs another proguard rule. https://github.com/google/tink/issues/361

0.3.4+5 #

Android: Upgrade to androidx.security 1.0.0-rc02 which should fix protobuf incompatibilities #6 https://developer.android.com/jetpack/androidx/releases/security#security-crypto-1.0.0-rc02

0.3.4+4 #

Android: fix PromptInfo deserialization with minification.
Android: add proguard setting to fix protobuf exceptions.

0.3.4+2 #

Android: updated dependencies to androidx.security, biometric, gradle tools.

0.3.4+1 #

Android: on error send stack trace to flutter. also fixed a couple of warnings.

0.3.4 #

Android: allow customization of the PromptInfo (labels, buttons, etc). @patrickhammond

0.3.3 #

ios: added swift 5 dependency to podspec to fix compile errors https://github.com/authpass/biometric_storage/issues/3

0.3.2 #

android: fingerprint failures don't cancel the dialog, so don't trigger error callback. #2 (fixes crash)

0.3.1 #

Use android v2 plugin API.

0.3.0-beta.2 #

Use new plugin format for Mac OS format. Not compatible with flutter 1.9.x

0.2.2+2 #

Use legacy plugin platforms structure to be compatible with flutter stable.

0.2.2+1 #

fixed home page link, updated example README.

0.2.2 #

Android: Use codegen instead of reflection for json serialization. (Fixes bug that options aren't assed in correctly due to minification)

0.2.1 #

Android: Fix for having multiple files with different configurations.
Correctly handle UserCanceled events.
Define correct default values on dart side (10 seconds validity timeout).

0.2.0 #

MacOS Support

0.1.0 #

iOS Support
Support for non-authenticated storage (ie. secure/encrypted storage, without extra biometric authenticatiton prompts)
delete()'ing files.

0.0.1 Initial release #

Android Support.

biometric_storage 6.0.0-dev.2 biometric_storage: ^6.0.0-dev.2 copied to clipboard

Metadata