[Vault] Unlock UI: PIN + biometric, user-pickable #121

New issue

Closed

opened 2026-06-29 20:39:19 +00:00 by Mark · 0 comments

Mark commented

2026-06-29 20:39:19 +00:00

Owner

Parent: #26

Decision (2026-06-28)

Vault unlocks via PIN or biometric, user-pickable. The unlock screen surfaces both options; whichever the user selects as primary opens the vault. If the other is registered, it acts as a fallback.

Scope

Unlock UI in or adjacent to Vault.tsx: PIN entry (4–6 digits) or Capacitor Biometrics prompt.
Per-device preference (which factor is primary) stored in app settings.
Existing vault-crypto.ts is reused for the key derivation; no crypto changes needed.
Lockout: 5 failed PIN attempts -> 30s cooldown; biometric falls back automatically.

Out of scope (already addressed elsewhere)

Emergency exit / panic gesture: closed at #77.
Re-encrypt / reset PIN: separate issue if needed.

Verification

Can enroll biometric and unlock with it.
Can enroll PIN and unlock with it.
After biometric fail, PIN works.
After 5 PIN fails, 30s lockout actually triggers.
Volatile in-memory key per session (already in vault-crypto).

## Parent: #26 ## Decision (2026-06-28) Vault unlocks via **PIN or biometric, user-pickable**. The unlock screen surfaces both options; whichever the user selects as primary opens the vault. If the other is registered, it acts as a fallback. ## Scope - Unlock UI in or adjacent to `Vault.tsx`: PIN entry (4–6 digits) or Capacitor Biometrics prompt. - Per-device preference (which factor is primary) stored in app settings. - Existing `vault-crypto.ts` is reused for the key derivation; no crypto changes needed. - Lockout: 5 failed PIN attempts -> 30s cooldown; biometric falls back automatically. ## Out of scope (already addressed elsewhere) - Emergency exit / panic gesture: closed at #77. - Re-encrypt / reset PIN: separate issue if needed. ## Verification - Can enroll biometric and unlock with it. - Can enroll PIN and unlock with it. - After biometric fail, PIN works. - After 5 PIN fails, 30s lockout actually triggers. - Volatile in-memory key per session (already in vault-crypto).