security: encrypt credentials, caches, and harden lock screen

app/src/main/java/sh/sar/basedbank/ui/home/HomeActivity.kt

@@ -56,6 +56,7 @@ class HomeActivity : AppCompatActivity() {
     private val autolockHandler = Handler(Looper.getMainLooper())
     private var warningDialog: AlertDialog? = null
     private var countdownTimer: CountDownTimer? = null
+    private var pauseTime = 0L
 
     private val warningRunnable = Runnable { showAutolockWarning() }
 
@@ -194,11 +195,24 @@ class HomeActivity : AppCompatActivity() {
 
     override fun onResume() {
         super.onResume()
+        // If we were away long enough to have hit the autolock timeout (e.g. while
+        // QrScannerActivity was in the foreground), lock immediately.
+        if (pauseTime > 0L) {
+            val elapsed = System.currentTimeMillis() - pauseTime
+            val timeout = getSharedPreferences("prefs", MODE_PRIVATE).getLong("autolock_timeout", 60_000L)
+            val securitySet = getSharedPreferences("prefs", MODE_PRIVATE).getString("security_method", null) != null
+            if (timeout > 0L && elapsed >= timeout && securitySet) {
+                startActivity(Intent(this, sh.sar.basedbank.LockActivity::class.java))
+                finish()
+                return
+            }
+        }
         resetAutolockTimer()
     }
 
     override fun onPause() {
         super.onPause()
+        pauseTime = System.currentTimeMillis()
         autolockHandler.removeCallbacks(autolockRunnable)
         autolockHandler.removeCallbacks(warningRunnable)
         countdownTimer?.cancel(); countdownTimer = null
@@ -300,8 +314,7 @@ class HomeActivity : AppCompatActivity() {
             val mibJob = mibCreds?.let {
                 async(Dispatchers.IO) {
                     try {
-                        val prefs = getSharedPreferences("mib_prefs", MODE_PRIVATE)
-                        val flow = MibLoginFlow(prefs)
+                        val flow = MibLoginFlow(CredentialStore(this@HomeActivity))
                         val accounts = flow.login(it.username, it.passwordHash, it.otpSeed)
                         val app = application as BasedBankApp
                         app.accounts = accounts
@@ -411,8 +424,7 @@ class HomeActivity : AppCompatActivity() {
 
     private fun refreshContacts(session: MibSession?, profiles: List<MibProfile>) {
         if (session == null || profiles.isEmpty()) return
-        val prefs = getSharedPreferences("mib_prefs", MODE_PRIVATE)
-        val flow = MibLoginFlow(prefs)
+        val flow = MibLoginFlow(CredentialStore(this))
         val contactsClient = MibContactsClient()
         lifecycleScope.launch {
             try {
@@ -465,8 +477,7 @@ class HomeActivity : AppCompatActivity() {
                 val fresh = withContext(Dispatchers.IO) {
                     val sess = app.mibSession ?: return@withContext null
                     val profile = app.mibProfiles.firstOrNull { it.profileId == src.profileId } ?: return@withContext null
-                    val prefs = getSharedPreferences("mib_prefs", MODE_PRIVATE)
-                    try { MibLoginFlow(prefs).fetchAllProfiles(sess, listOf(profile), src.loginTag) }
+                    try { MibLoginFlow(CredentialStore(this@HomeActivity)).fetchAllProfiles(sess, listOf(profile), src.loginTag) }
                     catch (_: Exception) { null }
                 } ?: return@launch
                 // Replace accounts from this profile only, keep everything else
@@ -480,8 +491,7 @@ class HomeActivity : AppCompatActivity() {
 
     private fun refreshFinancing(session: MibSession?, profiles: List<MibProfile>) {
         if (session == null || profiles.isEmpty()) return
-        val prefs = getSharedPreferences("mib_prefs", MODE_PRIVATE)
-        val flow = MibLoginFlow(prefs)
+        val flow = MibLoginFlow(CredentialStore(this))
         val client = MibFinancingClient()
         lifecycleScope.launch {
             try {