Skip to content

Develop - #5

Merged
r0073rr0r merged 11 commits into
mainfrom
develop
Feb 22, 2026
Merged

Develop#5
r0073rr0r merged 11 commits into
mainfrom
develop

Conversation

@r0073rr0r

@r0073rr0r r0073rr0r commented Feb 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Brief description of what this PR changes and why.

Type of change

  • Bug fix
  • New feature
  • Security fix
  • Refactor / tech debt
  • Documentation
  • Build / CI

Security impact

Does this PR touch any of the following? If yes, describe the impact:

  • Cryptographic primitives or parameters
  • Key derivation or key management
  • Authentication (PIN, biometric, decoy)
  • Panic wipe or self-destruct
  • Database schema or SQLCipher configuration
  • Data storage or serialization

Security impact description: (fill in if any box above is checked)

Testing

  • Tested on a real device
  • Existing tests pass (./gradlew test)
  • New tests added for changed logic

Device tested on: (model + Android version)

Checklist

  • No plaintext key material or note content in logs
  • No new dependencies added without discussion
  • PR targets main

Add keep.xml to preserve tx_auto_* string resources accessed via
getIdentifier() at runtime (invisible to static shrinker analysis).
Add locale_config.xml for Android 13+ per-app language support.
Product IDs use underscores (remove_ads_lifetime, pro_features_lifetime),
not dashes which are offer IDs. offerToken is optional for INAPP products
so treat null as empty string instead of aborting the purchase flow.
BiometricKeyStore now accepts configurable prefs name and keystore alias
so a separate decoy biometric store can coexist with the main one.
AppPreferences and UiState track decoy biometric enabled state.
MainActivity wires enrollment and unlock for the decoy key, deriving
the decoy master key from the decoy PIN via VaultKeyManager.

In UnlockScreen the fingerprint button uses long press for decoy unlock
and normal tap for the real vault. Settings shows a decoy biometric
section when the decoy vault is enabled.

Decoy settings are hidden by default and revealed by tapping the NULVEX
logo six times. Each tap fires one lightning bolt emoji in a random
direction; on the sixth tap all bolts explode outward and the section
becomes visible.
Register MIME types for .nulvex, .nulvxbk and .nulvxkeys files so the
app appears as a handler in file managers. Include file:// fallbacks for
legacy file managers and an autoVerify deep link for androidircx.com
media URLs. Also wire localeConfig for Android 13+ per-app language.
Add missing imports for VaultProfile and Compose offset to resolve
unresolved references that were breaking assembleDebug.
Align billing tests with updated product IDs and one-time purchase token
handling, and add coverage for single-note share imports, decoy biometric
state toggles, and manifest intent filters for encrypted files/deep links.
Allow creating labels without assigning them to a note by persisting custom
labels in app settings and surfacing them in the labels menu/filter list.
Also extend note-detail editing to update expiry alongside text and cover
both flows with updated instrumentation tests.
Extend note detail editing to support adding/removing labels and attaching
new images in the same save flow as text and expiry updates. Wire the new
save callback through MainScreen and MainActivity, and keep instrumentation
coverage stable by removing a flaky async assertion.
@r0073rr0r
r0073rr0r merged commit 778d7a1 into main Feb 22, 2026
3 checks passed
@r0073rr0r
r0073rr0r deleted the develop branch February 25, 2026 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant