agentic-dev-library / thumbcode / 21114944112

23%

push

github

feat(credentials): implement secure credential storage service (#42)

Implements secure credential management as specified in Issue #9.

## Features:
- **Hardware-backed storage**: Uses Expo SecureStore with WHEN_UNLOCKED_THIS_DEVICE_ONLY
- **Biometric authentication**: Optional biometric unlock via expo-local-authentication
- **API validation**: Validates credentials against GitHub, Anthropic, and OpenAI APIs
- **Secure masking**: Shows masked credential values for display

## CredentialService API:
- `store(type, data, options)`: Store credential with optional validation
- `retrieve(type, options)`: Retrieve credential with optional biometric auth
- `validateCredential(type, secret)`: Validate against respective API
- `delete(type)`: Securely delete credential
- `exists(type)`: Check if credential exists
- `revalidateAll()`: Re-validate all stored credentials
- `isBiometricAvailable()`: Check device biometric support
- `authenticateWithBiometrics()`: Perform biometric authentication

## Security:
- Secrets stored in SecureStore (hardware-backed)
- Metadata tracked in Zustand CredentialStore (no secrets)
- Automatic masking of displayed credentials
- Support for biometric-gated access

## Tests:
- 22 unit tests covering all functionality
- Mocks for SecureStore and LocalAuthentication

Closes #9

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

100 of 330 branches covered (30.3%)

Branch coverage included in aggregate %.

98 of 133 new or added lines in 1 file covered. (73.68%)

273 of 578 relevant lines covered (47.23%)

1.24 hits per line