Authenticate with secure storage service (#402)

* Split secure key into use case

Allows us to push authentication for key access as late as possible.

* Do not reload if biometric locked

* Linter fixes

* Fix key upgrade scenario

* Fix boolean value message parsing

* Handle systems which don't support biometrics

* Do not fail key retrieval on secret upgrade

* Ensure old key is removed regardless of upgrade success

* Log errors

common/src/abstractions/biometric.main.ts

@@ -2,5 +2,5 @@ export abstract class BiometricMain {
     isError: boolean;
     init: () => Promise<void>;
     supportsBiometric: () => Promise<boolean>;
-    requestCreate: () => Promise<boolean>;
+    authenticateBiometric: () => Promise<boolean>;
 }

common/src/abstractions/crypto.service.ts

@@ -5,6 +5,7 @@ import { SymmetricCryptoKey } from '../models/domain/symmetricCryptoKey';
 import { ProfileOrganizationResponse } from '../models/response/profileOrganizationResponse';
 
 import { KdfType } from '../enums/kdfType';
+import { KeySuffixOptions } from './storage.service';
 
 export abstract class CryptoService {
     setKey: (key: SymmetricCryptoKey) => Promise<any>;
@@ -12,7 +13,7 @@ export abstract class CryptoService {
     setEncKey: (encKey: string) => Promise<{}>;
     setEncPrivateKey: (encPrivateKey: string) => Promise<{}>;
     setOrgKeys: (orgs: ProfileOrganizationResponse[]) => Promise<{}>;
-    getKey: () => Promise<SymmetricCryptoKey>;
+    getKey: (keySuffix?: KeySuffixOptions) => Promise<SymmetricCryptoKey>;
     getKeyHash: () => Promise<string>;
     getEncKey: (key?: SymmetricCryptoKey) => Promise<SymmetricCryptoKey>;
     getPublicKey: () => Promise<ArrayBuffer>;
@@ -21,8 +22,10 @@ export abstract class CryptoService {
     getOrgKeys: () => Promise<Map<string, SymmetricCryptoKey>>;
     getOrgKey: (orgId: string) => Promise<SymmetricCryptoKey>;
     hasKey: () => Promise<boolean>;
+    hasKeyInMemory: () => boolean;
+    hasKeyStored: (keySuffix?: KeySuffixOptions) => Promise<boolean>;
     hasEncKey: () => Promise<boolean>;
-    clearKey: () => Promise<any>;
+    clearKey: (clearSecretStorage?: boolean) => Promise<any>;
     clearKeyHash: () => Promise<any>;
     clearEncKey: (memoryOnly?: boolean) => Promise<any>;
     clearKeyPair: (memoryOnly?: boolean) => Promise<any>;

common/src/abstractions/storage.service.ts

@@ -1,5 +1,12 @@
 export abstract class StorageService {
-    get: <T>(key: string) => Promise<T>;
-    save: (key: string, obj: any) => Promise<any>;
-    remove: (key: string) => Promise<any>;
+    get: <T>(key: string, options?: StorageServiceOptions) => Promise<T>;
+    has: (key: string, options?: StorageServiceOptions) => Promise<boolean>;
+    save: (key: string, obj: any, options?: StorageServiceOptions) => Promise<any>;
+    remove: (key: string, options?: StorageServiceOptions) => Promise<any>;
 }
+
+export interface StorageServiceOptions {
+    keySuffix: KeySuffixOptions;
+}
+
+export type KeySuffixOptions = 'auto' | 'biometric';

common/src/abstractions/vaultTimeout.service.ts

@@ -2,6 +2,8 @@ import { EncString } from '../models/domain/encString';
 
 export abstract class VaultTimeoutService {
     biometricLocked: boolean;
+    manuallyOrTimerLocked: boolean;
+    everBeenUnlocked: boolean;
     pinProtectedKey: EncString;
     isLocked: () => Promise<boolean>;
     checkVaultTimeout: () => Promise<void>;