Refactor secrets rotation classes

app/src/main/AndroidManifest.xml

@@ -51,7 +51,7 @@
             android:screenOrientation="locked"
             android:theme="@style/AppTheme" />
         <activity
-            android:name=".activity.security.ReEncryptionActivity"
+            android:name=".activity.security.SecretsUpdateActivity"
             android:exported="false"
             android:screenOrientation="locked"
             android:theme="@style/AppTheme.NoActionBar" />
@@ -117,7 +117,7 @@
             android:stopWithTask="false"
             android:foregroundServiceType="dataSync" />
         <service
-            android:name=".service.security.crypto.update.SecretsUpdateAndroidService"
+            android:name=".service.security.rotation.SecretsUpdateAndroidService"
             android:exported="false"
             android:stopWithTask="false"
             android:foregroundServiceType="dataSync" />

app/src/main/java/app/notesr/activity/FsaResolver.java

@@ -7,9 +7,9 @@
 
 import java.util.Set;
 
-import app.notesr.activity.security.ReEncryptionActivity;
+import app.notesr.activity.security.SecretsUpdateActivity;
 import app.notesr.service.AndroidServiceRegistry;
-import app.notesr.service.security.crypto.update.SecretsUpdateAndroidService;
+import app.notesr.service.security.rotation.SecretsUpdateAndroidService;
 import lombok.RequiredArgsConstructor;
 
 /**
@@ -30,7 +30,7 @@ public final class FsaResolver {
 //            new FsaEntry(AppMigrationAndroidService.class, MigrationActivity.class),
 //            new FsaEntry(ExportAndroidService.class, ExportActivity.class),
 //            new FsaEntry(ImportAndroidService.class, ImportActivity.class),
-            new FsaEntry(SecretsUpdateAndroidService.class, ReEncryptionActivity.class)
+            new FsaEntry(SecretsUpdateAndroidService.class, SecretsUpdateActivity.class)
     );
 
     private final AndroidServiceRegistry servicesRegistry;

app/src/main/java/app/notesr/activity/note/list/NotesListActivity.java

@@ -105,7 +105,7 @@ public boolean onCreateOptionsMenu(Menu menu) {
 
         menuActions.put(R.id.lockAppButton, lockAction::lock);
         menuActions.put(R.id.changePasswordMenuItem, this::startChangePasswordActivity);
-        menuActions.put(R.id.generateNewKeyMenuItem, generateNewKeyAction::startActivity);
+        menuActions.put(R.id.rotateKey, generateNewKeyAction::startActivity);
         menuActions.put(R.id.exportMenuItem,
                 () -> startActivity(new Intent(this, ExportActivity.class)));
         menuActions.put(R.id.importMenuItem,

app/src/main/java/app/notesr/activity/security/AuthActivity.java

@@ -20,6 +20,7 @@
 import app.notesr.activity.ActivityBase;
 import app.notesr.core.util.SecureStringBuilder;
 import app.notesr.service.security.AppSecurityService;
+import app.notesr.service.security.rotation.SecretsRotationService;
 import lombok.AllArgsConstructor;
 import lombok.Getter;
 
@@ -57,7 +58,11 @@ protected void onCreate(Bundle savedInstanceState) {
 
         String mode = getIntent().getStringExtra(EXTRA_MODE);
         var appSecurityService = new AppSecurityService(getApplicationContext());
-        authHandler = new AuthHandler(this, appSecurityService, passwordBuilder);
+        var secretsRotationService = new SecretsRotationService(getApplicationContext(),
+                appSecurityService);
+
+        authHandler = new AuthHandler(this, appSecurityService, secretsRotationService,
+                passwordBuilder);
 
         try {
             currentMode = Mode.valueOf(mode);

app/src/main/java/app/notesr/activity/security/AuthHandler.java

@@ -34,6 +34,7 @@
 import app.notesr.service.security.AppSecurityException;
 import app.notesr.service.security.AppSecurityService;
 import app.notesr.service.security.AuthenticationFailedException;
+import app.notesr.service.security.rotation.SecretsRotationService;
 import lombok.RequiredArgsConstructor;
 
 @RequiredArgsConstructor
@@ -43,6 +44,7 @@ public final class AuthHandler {
 
     private final AuthActivity activity;
     private final AppSecurityService appSecurityService;
+    private final SecretsRotationService secretsRotationService;
     private final SecureStringBuilder passwordBuilder;
 
     private int attempts = MAX_ATTEMPTS;
@@ -119,21 +121,20 @@ public void recoverKey() {
     public void changePassword() {
         char[] password = proceedPasswordSetting();
 
-        if (password != null) {
-            try {
-                Context context = activity.getApplicationContext();
-                CryptoSecrets secrets = appSecurityService.getActualSecrets();
+        if (password == null) {
+            // New password entered, but not confirmed (repeated by user)
+            return;
+        }
 
-                secrets.setPassword(password);
-                appSecurityService.setSecrets(secrets);
-                secrets.destroy();
+        try {
+            secretsRotationService.updatePassword(password);
 
-                showToastMessage(R.string.updated);
-                activity.startActivity(new Intent(context, NotesListActivity.class));
-                activity.finish();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
+            showToastMessage(R.string.updated);
+            activity.startActivity(new Intent(activity.getApplicationContext(),
+                    NotesListActivity.class));
+            activity.finish();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
         }
     }
 

app/src/main/java/app/notesr/activity/security/KeySetupCompletionHandler.java

@@ -25,7 +25,7 @@
 import app.notesr.core.security.dto.CryptoSecrets;
 import app.notesr.service.security.AppSecurityService;
 import app.notesr.service.migration.DataVersionManager;
-import app.notesr.service.security.crypto.update.SecretsUpdateAndroidService;
+import app.notesr.service.security.rotation.SecretsUpdateAndroidService;
 import lombok.RequiredArgsConstructor;
 
 @RequiredArgsConstructor
@@ -73,7 +73,7 @@ private void proceedFirstRun() {
 
     private void proceedRegeneration() {
         new DialogFactory(activity)
-                .getThemedAlertDialogBuilder(R.layout.dialog_re_encryption_warning)
+                .getThemedAlertDialogBuilder(R.layout.dialog_secrets_rotation_warning)
                 .setTitle(R.string.warning)
                 .setPositiveButton(R.string.yes,
                         (dialog, which) -> onRegenerationConfirmed())
@@ -94,10 +94,10 @@ private void onRegenerationConfirmed() {
             throw new RuntimeException(e);
         }
 
-        Intent reEncryptionIntent = new Intent(activity.getApplicationContext(),
-                ReEncryptionActivity.class);
+        Intent secretsUpdateIntent = new Intent(activity.getApplicationContext(),
+                SecretsUpdateActivity.class);
 
-        activity.startActivity(reEncryptionIntent);
+        activity.startActivity(secretsUpdateIntent);
         activity.finish();
     }
 

app/src/main/java/app/notesr/activity/security/ReEncryptionActivity.java → app/src/main/java/app/notesr/activity/security/SecretsUpdateActivity.java

@@ -20,34 +20,34 @@
 import app.notesr.activity.DialogFactory;
 import app.notesr.activity.note.list.NotesListActivity;
 import app.notesr.service.AndroidServiceRegistry;
-import app.notesr.service.security.crypto.update.SecretsUpdateAndroidService;
-import app.notesr.service.security.crypto.update.SecretsUpdateAndroidServiceStarter;
+import app.notesr.service.security.rotation.SecretsUpdateAndroidService;
+import app.notesr.service.security.rotation.SecretsUpdateAndroidServiceStarter;
 
-public final class ReEncryptionActivity extends ActivityBase {
+public final class SecretsUpdateActivity extends ActivityBase {
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        setContentView(R.layout.activity_re_encryption);
+        setContentView(R.layout.activity_secrets_update);
         applyInsets(findViewById(R.id.main));
         disableBackButton(this);
 
-        ReEncryptionBroadcastReceiver broadcastReceiver =
-                new ReEncryptionBroadcastReceiver(this::onReEncryptionComplete,
-                        this::onReEncryptionFailed);
+        SecretsUpdateBroadcastReceiver broadcastReceiver =
+                new SecretsUpdateBroadcastReceiver(this::onSecretsUpdateComplete,
+                        this::onSecretsUpdateFailed);
 
         LocalBroadcastManager.getInstance(this).registerReceiver(broadcastReceiver,
                 new IntentFilter(SecretsUpdateAndroidService.BROADCAST_ACTION));
 
-        startReEncryptionService();
+        startSecretsUpdateService();
     }
 
     @Override
     protected boolean requiresSession() {
         return false;
     }
 
-    private void startReEncryptionService() {
+    private void startSecretsUpdateService() {
         AndroidServiceRegistry serviceRegistry = AndroidServiceRegistry
                 .getInstance(getApplicationContext());
 
@@ -60,14 +60,14 @@ private void startReEncryptionService() {
         }
     }
 
-    private void onReEncryptionComplete() {
+    private void onSecretsUpdateComplete() {
         startActivity(new Intent(getApplicationContext(), NotesListActivity.class));
         finish();
     }
 
-    private void onReEncryptionFailed() {
+    private void onSecretsUpdateFailed() {
         DialogFactory dialogFactory = new DialogFactory(this);
-        dialogFactory.getThemedAlertDialogBuilder(R.layout.dialog_re_encryption_failed)
+        dialogFactory.getThemedAlertDialogBuilder(R.layout.dialog_secrets_update_failed)
                 .setTitle(R.string.error)
                 .setCancelable(false)
                 .setPositiveButton(R.string.ok, (dialog, which) -> {

app/src/main/java/app/notesr/activity/security/ReEncryptionBroadcastReceiver.java → app/src/main/java/app/notesr/activity/security/SecretsUpdateBroadcastReceiver.java

@@ -9,13 +9,13 @@
 import android.content.Context;
 import android.content.Intent;
 
-import app.notesr.service.security.crypto.update.SecretsUpdateAndroidService;
+import app.notesr.service.security.rotation.SecretsUpdateAndroidService;
 import lombok.RequiredArgsConstructor;
 
 @RequiredArgsConstructor
-public final class ReEncryptionBroadcastReceiver extends BroadcastReceiver {
-    private final Runnable onReEncryptionComplete;
-    private final Runnable onReEncryptionFailed;
+public final class SecretsUpdateBroadcastReceiver extends BroadcastReceiver {
+    private final Runnable onSecretsUpdateComplete;
+    private final Runnable onSecretsUpdateFailed;
 
     @Override
     public void onReceive(Context context, Intent intent) {
@@ -27,9 +27,9 @@ public void onReceive(Context context, Intent intent) {
                     false);
 
             if (isCompleted) {
-                onReEncryptionComplete.run();
+                onSecretsUpdateComplete.run();
             } else if (isFailed) {
-                onReEncryptionFailed.run();
+                onSecretsUpdateFailed.run();
             }
         }
     }

app/src/main/res/layout/activity_re_encryption.xml → app/src/main/res/layout/activity_secrets_update.xml

@@ -6,10 +6,10 @@
     android:layout_width="match_parent"
     android:layout_height="match_parent"
     android:background="@color/activity_background"
-    tools:context=".activity.security.ReEncryptionActivity">
+    tools:context=".activity.security.SecretsUpdateActivity">
 
     <TextView
-        android:id="@+id/reEncryptionNameLabel"
+        android:id="@+id/secretsUpdateTitleLabel"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
         android:layout_marginTop="224dp"
@@ -20,24 +20,24 @@
         app:layout_constraintTop_toTopOf="parent" />
 
     <ProgressBar
-        android:id="@+id/reEncryptionProgressBar"
+        android:id="@+id/secretsUpdateProgressBar"
         style="?android:attr/progressBarStyle"
         android:layout_width="150dp"
         android:layout_height="150dp"
         android:layout_marginTop="16dp"
         app:layout_constraintEnd_toEndOf="parent"
         app:layout_constraintHorizontal_bias="0.498"
         app:layout_constraintStart_toStartOf="parent"
-        app:layout_constraintTop_toBottomOf="@+id/reEncryptionNameLabel" />
+        app:layout_constraintTop_toBottomOf="@+id/secretsUpdateTitleLabel" />
 
     <TextView
-        android:id="@+id/reEncryptionWarningLabel"
+        android:id="@+id/secretsUpdateWarningLabel"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
         android:layout_marginTop="16dp"
         android:text="@string/this_may_take_a_long_time"
         android:textSize="20sp"
         app:layout_constraintEnd_toEndOf="parent"
         app:layout_constraintStart_toStartOf="parent"
-        app:layout_constraintTop_toBottomOf="@+id/reEncryptionProgressBar" />
+        app:layout_constraintTop_toBottomOf="@+id/secretsUpdateProgressBar" />
 </androidx.constraintlayout.widget.ConstraintLayout>

app/src/main/res/layout/dialog_re_encryption_failed.xml → app/src/main/res/layout/dialog_secrets_update_failed.xml

@@ -7,7 +7,7 @@
     android:background="@color/dialog_background">
 
     <TextView
-        android:id="@+id/reEncryptionFailedErrorText"
+        android:id="@+id/secretsUpdateFailedErrorLabel"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
         android:textSize="15sp"

app/src/main/res/menu/menu_notes_list.xml

@@ -23,6 +23,6 @@
     <item android:id="@+id/changePasswordMenuItem"
         android:title="@string/change_access_code"/>
 
-    <item android:id="@+id/generateNewKeyMenuItem"
-        android:title="@string/regenerate_or_import_key"/>
+    <item android:id="@+id/rotateKey"
+        android:title="@string/change_private_key"/>
 </menu>

app/src/main/res/values/strings.xml

@@ -48,7 +48,7 @@
     <string name="change_access_code">Change access code</string>
     <string name="create_new_access_code">Create new access code</string>
     <string name="updated">Updated!</string>
-    <string name="regenerate_or_import_key">Regenerate or import key</string>
+    <string name="change_private_key">Change private key</string>
     <string name="key_regeneration_warning">This action will cause all of your data to be re-encrypted.\nAre you sure?</string>
     <string name="re_encrypting_data">Re-encrypting data…</string>
     <string name="warning">Warning</string>

core/src/main/java/app/notesr/core/security/dto/CryptoSecrets.java

@@ -7,10 +7,9 @@
 
 import java.util.Arrays;
 
-import app.notesr.core.util.CharUtils;
-import app.notesr.core.util.KeyUtils;
 import lombok.AllArgsConstructor;
 import lombok.Data;
+import lombok.EqualsAndHashCode;
 
 /**
  * Data transfer object containing cryptographic secrets.
@@ -20,6 +19,7 @@
  */
 @AllArgsConstructor
 @Data
+@EqualsAndHashCode
 public final class CryptoSecrets {
 
     public static final int MASTER_KEY_SIZE = 48;

service/src/main/java/app/notesr/service/security/AppSecurityService.java

@@ -17,6 +17,7 @@
 import app.notesr.core.security.crypto.CryptoManager;
 import app.notesr.core.security.crypto.CryptoManagerProvider;
 import app.notesr.core.security.dto.CryptoSecrets;
+import app.notesr.core.security.exception.SessionExpiredException;
 import app.notesr.core.util.CryptoSecretsValidator;
 import app.notesr.data.DatabaseProvider;
 import lombok.RequiredArgsConstructor;
@@ -79,6 +80,7 @@ public byte[] generateMasterKey() {
      * Retrieves the currently configured cryptographic secrets.
      *
      * @return the current {@link CryptoSecrets} if configured, or null if not yet initialized
+     * @throws SessionExpiredException if secrets are not configured or have expired.
      * @see #isAuthConfigured()
      */
     public CryptoSecrets getActualSecrets() {

service/src/main/java/app/notesr/service/security/crypto/update/DatabaseManager.java → service/src/main/java/app/notesr/service/security/rotation/DatabaseManager.java

@@ -3,13 +3,13 @@
  * SPDX-License-Identifier: MIT
  */
 
-package app.notesr.service.security.crypto.update;
+package app.notesr.service.security.rotation;
 
 import app.notesr.data.AppDatabase;
 
 /**
  * Interface for managing database instances and the global database provider state
- * during secrets updates.
+ * during secrets rotation.
  */
 public interface DatabaseManager {
     AppDatabase getDatabase(String name, byte[] key);

service/src/main/java/app/notesr/service/security/crypto/update/DatabaseManagerImpl.java → service/src/main/java/app/notesr/service/security/rotation/DatabaseManagerImpl.java

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: MIT
  */
 
-package app.notesr.service.security.crypto.update;
+package app.notesr.service.security.rotation;
 
 import android.content.Context;
 import android.util.Log;