Wallet password protection

[dkackman]

fix #206

[dkackman]

Code review

Found 2 issues:

1. Biometric unlock breaks after the first successful use — skipKeychainRef.current.add(fingerprint) is called every time the OS keychain returns a stored password (as a "pending validation" marker), but is never cleared when the backend accepts that password. It is only cleared in handleSubmit — the manual-entry path. In practice: the first biometric-authenticated operation succeeds, the flag stays set, and every subsequent operation in the same session skips the keychain and falls back to the password dialog. Biometric effectively works only once per session.

sage/src/contexts/PasswordContext.tsx

Lines 127 to 133 in 815e594

	const stored = await keychainGet(keychainKey(fingerprint));
	if (stored !== null) {
	// Mark as pending validation — if backend rejects, next call skips keychain
	skipKeychainRef.current.add(fingerprint);
	return stored;
	}
	// Fall through to password dialog if keychain retrieval fails

2. Delete confirmation dialog stays open when the password prompt is cancelled — setIsDeleteOpen(false) is only called at the bottom of deleteSelf, after the backend call. The early return on password === undefined (user cancels the password dialog) exits before that line, leaving the delete dialog stuck open. The Details dialog handles this correctly by calling setIsDetailsOpen(false) before the early return.

sage/src/components/WalletCard.tsx

Lines 81 to 92 in 815e594

	const deleteSelf = async () => {
	const password = await requestPassword(info.has_password);
	if (password === undefined) return;
	await commands
	.deleteKey({ fingerprint: info.fingerprint })
	.then(async () => {
	await clearKeychainEntry(info.fingerprint);
	setKeys(keys.filter((key) => key.fingerprint !== info.fingerprint));
	})
	.catch(addError);
	setIsDeleteOpen(false);
	};

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[dkackman]

Code review

Found 1 issue:

1. Concurrent requestPassword calls corrupt pendingRef — first caller's promise hangs indefinitely — pendingRef is a single useRef<PasswordRequest | null>. If two operations simultaneously reach the password dialog path (Case 4), the second write to pendingRef.current silently overwrites the first. handleSubmit only resolves the second caller. The first caller's Promise is permanently unresolved — that operation hangs with no error, no timeout, and no way to recover. A realistic trigger: a WalletConnect request arrives while the user is also initiating a UI signing operation.

sage/src/contexts/PasswordContext.tsx

Lines 158 to 165 in c88b3f9

	// Case 4: Has password → show dialog (fallback or no biometric)
	if (hasPassword) {
	return new Promise<string | null | undefined>((resolve) => {
	pendingRef.current = { resolve, fingerprint };
	setOpen(true);
	});
	}

The fix is to either (a) queue pending requests instead of replacing them, or (b) reject the in-flight request when a new one arrives (so at least the caller fails fast rather than hanging).

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}