Fail closed when encrypted prefs are unavailable

codex · codex · commit 5f9f19e69462 · 2026-03-09T22:08:20.000+02:00
diff --git a/app/src/main/java/com/thinkoff/clawwatch/SecurePrefs.kt b/app/src/main/java/com/thinkoff/clawwatch/SecurePrefs.kt
@@ -53,8 +53,8 @@ object SecurePrefs {
                     EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
                 )
             } catch (e: Exception) {
-                Log.w(TAG, "EncryptedSharedPreferences unavailable, falling back to plaintext", e)
-                appContext.getSharedPreferences(LEGACY_PREFS_NAME, Context.MODE_PRIVATE)
+                Log.e(TAG, "EncryptedSharedPreferences unavailable; refusing plaintext secret storage", e)
+                throw IllegalStateException("Encrypted storage unavailable on this device", e)
             }
 
             migrateLegacyIfPresent(appContext, secure)

Original file line number	Diff line number	Diff line change
`@@ -53,8 +53,8 @@ object SecurePrefs {`
`53`	`53`	`EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM`
`54`	`54`	`)`
`55`	`55`	`} catch (e: Exception) {`
`56`		`- Log.w(TAG, "EncryptedSharedPreferences unavailable, falling back to plaintext", e)`
`57`		`- appContext.getSharedPreferences(LEGACY_PREFS_NAME, Context.MODE_PRIVATE)`
	`56`	`+ Log.e(TAG, "EncryptedSharedPreferences unavailable; refusing plaintext secret storage", e)`
	`57`	`+ throw IllegalStateException("Encrypted storage unavailable on this device", e)`
`58`	`58`	`}`
`59`	`59`
`60`	`60`	`migrateLegacyIfPresent(appContext, secure)`