ISecureStorage
Namespace: BlazorNative.Device
DI-injectable façade over the encrypted-at-rest secret store (Keystore /
Keychain host-side), distinct from the plain unencrypted key/value storage on
BlazorNative.Core.IMobileBridge. Inject this rather than the low-level bridge; set, get and
delete secrets, each resolving with a BlazorNative.Core.SecureStorageStatus value (a failure
is DATA, never an exception). ISecureStorage.GetWithAuthAsync(String, String, CancellationToken) is the pairing: an
auth-bound write (requireAuth: true) can only be read back behind a fresh OS
biometric prompt. Register it with
ServiceCollectionExtensions.AddBlazorNativeDevice(IServiceCollection).
public interface ISecureStorage
Methods
SetAsync(String, String, Boolean, CancellationToken)
Stores value under key,
encrypted at rest. When requireAuth is true the item is
provisioned under the OS-key biometric binding so a later
ISecureStorage.GetWithAuthAsync(String, String, CancellationToken) can decrypt it (and a plain
ISecureStorage.GetAsync(String, CancellationToken) cannot). Returns the terminal
BlazorNative.Core.SecureStorageStatus — a failure is DATA. An oversize value
(> BlazorNative.Core.SecretResult.MaxValueBytes) returns
BlazorNative.Core.SecureStorageStatus.Error without crossing the wire.
ValueTask<SecureStorageStatus> SetAsync(string key, string value, bool requireAuth = false, CancellationToken ct = null)
Parameters
key String
value String
requireAuth Boolean
Returns
ValueTask<SecureStorageStatus>
GetAsync(String, CancellationToken)
Reads a PLAIN (non-auth-bound) secret WITHOUT a prompt. An auth-bound
item correctly fails BlazorNative.Core.SecureStorageStatus.AuthFailed here; an
absent key is BlazorNative.Core.SecureStorageStatus.NotFound. Only
BlazorNative.Core.SecureStorageStatus.Ok carries the value.
ValueTask<SecretResult> GetAsync(string key, CancellationToken ct = null)
Parameters
key String
Returns
GetWithAuthAsync(String, String, CancellationToken)
THE PAIRING: reads an auth-bound secret behind an OS biometric prompt
(reason is the prompt message), the OS decrypting the value
only after a fresh auth. A denied / failed / cancelled / locked-out gate returns
BlazorNative.Core.SecureStorageStatus.AuthFailed (no value) — the refusal is DATA.
ValueTask<SecretResult> GetWithAuthAsync(string key, string reason, CancellationToken ct = null)
Parameters
key String
reason String
Returns
DeleteAsync(String, CancellationToken)
Deletes a secret by key (idempotent — an absent key still statuses
BlazorNative.Core.SecureStorageStatus.Ok).
ValueTask<SecureStorageStatus> DeleteAsync(string key, CancellationToken ct = null)
Parameters
key String