@entropy-softworks/ui 2026.7.31

package/src/services/hibp.ts

@@ -0,0 +1,120 @@
+/**
+ * Have-I-Been-Pwned password lookup using `k`-anonymity.
+ *
+ * Sends only the first five hex characters of the SHA-1 hash to the HIBP
+ * API. The full hash and plaintext never leave the device. Designed to be
+ * called from a debounced password-input change handler — see `debounce`
+ * below.
+ */
+
+import { Platform } from "react-native";
+import * as Crypto from "expo-crypto";
+import { fetchWithTimeout } from "../utils/fetch";
+import { getCachedPolicy, type HibpPolicy } from "./hibp-cache";
+
+export interface PwnedPasswordResult {
+  /** `true` = breached, `false` = safe, `null` = check failed (unknown). */
+  isPwned: boolean | null;
+  count: number;
+  error?: string;
+}
+
+export async function checkPasswordPwned(password: string): Promise<PwnedPasswordResult> {
+  try {
+    const hash = await Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA1, password, {
+      encoding: Crypto.CryptoEncoding.HEX,
+    });
+    const hashUpperCase = hash.toUpperCase();
+    const prefix = hashUpperCase.substring(0, 5);
+    const suffix = hashUpperCase.substring(5);
+
+    const response = await fetchWithTimeout(
+      `https://api.pwnedpasswords.com/range/${prefix}`,
+      {
+        method: "GET",
+        headers: {
+          // User-Agent is a forbidden header in browsers and cannot be set
+          // via fetch — the browser sends its own. On native, expo handles it.
+          ...(Platform.OS !== "web" ? { "User-Agent": "Entropy Softworks Client" } : {}),
+          "Add-Padding": "true",
+        },
+      },
+      10_000
+    );
+
+    if (!response.ok) {
+      throw new Error(`HIBP API returned status ${response.status}`);
+    }
+
+    const text = await response.text();
+    const hashes = text.split("\r\n").filter((line) => line.length > 0);
+
+    for (const hashLine of hashes) {
+      const [hashSuffix, count] = hashLine.split(":");
+      if (hashSuffix === suffix && count) {
+        return { isPwned: true, count: parseInt(count, 10) };
+      }
+    }
+
+    return { isPwned: false, count: 0 };
+  } catch {
+    return {
+      isPwned: null,
+      count: 0,
+      error: "Unable to verify password security. Please try again later.",
+    };
+  }
+}
+
+export interface PwnedMessage {
+  title: string;
+  message: string;
+  severity: "error" | "warning" | "info";
+}
+
+/**
+ * Build a user-friendly message for a HIBP result. The policy comes from
+ * the shared cache populated by the consumer (see `hibp-cache.ts`). If no
+ * policy is cached, falls back to a non-enforcing default.
+ */
+export function getPwnedMessage(result: PwnedPasswordResult): PwnedMessage {
+  if (result.error) {
+    return {
+      title: "Unable to Verify",
+      message: result.error,
+      severity: "info",
+    };
+  }
+
+  if (result.isPwned === false) {
+    return {
+      title: "Password Is Safe",
+      message: "This password has not been found in any known data breaches.",
+      severity: "info",
+    };
+  }
+
+  const policy: HibpPolicy = getCachedPolicy() ?? {
+    enabled: true,
+    enforce: false,
+    block_threshold: 0,
+  };
+
+  if (policy.enforce && result.count > policy.block_threshold) {
+    return {
+      title: "Password Compromised!",
+      message: `This password has appeared in ${result.count.toLocaleString()} known data breaches. Please choose a different password.`,
+      severity: "error",
+    };
+  }
+
+  return {
+    title: "Password Found in Breach",
+    message: `This password has appeared ${result.count.toLocaleString()} time${result.count > 1 ? "s" : ""} in data breaches. Consider choosing a different password.`,
+    severity: "warning",
+  };
+}
+
+// `debounce` moved to `utils/debounce`; re-exported here for back-compat
+// with existing `@entropy-softworks/ui/services/hibp` consumers.
+export { debounce } from "../utils/debounce";

package/src/services/index.ts

@@ -0,0 +1,52 @@
+export { default as AuthService } from "./auth.service";
+export type {
+  User,
+  AuthResponse,
+  LoginRequest,
+  RegisterRequest,
+  ErrorResponse,
+  MfaSetupResponse,
+  ServerConfig,
+} from "./auth.service";
+
+export { isPasskeySupported, registerPasskey, authenticateWithPasskey } from "./passkey";
+
+export {
+  configureApi,
+  getBaseUrl,
+  getDefaultBaseUrl,
+  getStoragePrefix,
+  setBaseUrl,
+  resetBaseUrl,
+  loadServerUrlOverride,
+  getSessionToken,
+  storeSessionToken,
+  clearSessionToken,
+  getAuthMode,
+  getTenant,
+  setTenant,
+  type ApiConfig,
+} from "./api-config";
+
+export {
+  checkPasswordPwned,
+  getPwnedMessage,
+  type PwnedPasswordResult,
+  type PwnedMessage,
+} from "./hibp";
+
+export {
+  getCachedPolicy as getCachedHibpPolicy,
+  fetchHibpPolicy,
+  getHibpPolicy,
+  type HibpPolicy,
+} from "./hibp-cache";
+
+export {
+  buildFaviconUrl,
+  customIconId,
+  customIconRef,
+  isCustomIconRef,
+  resolveIcon,
+  type ResolvedIcon,
+} from "./favicon";

package/src/services/passkey.ts

@@ -0,0 +1,213 @@
+// WebAuthn passkey client (auth-only — no PRF / key-wrapping). Shared across
+// Entropy Softworks Expo apps. Drives the OS authenticator (Face ID / Touch ID
+// / device passkey) and talks to the server's /auth/passkey/* ceremony
+// endpoints.
+//
+// Native (Expo dev build / store build) uses `react-native-passkey`, which
+// consumes/produces the WebAuthn JSON shapes directly (base64url strings). Web
+// uses the DOM `navigator.credentials` API, which needs ArrayBuffers, so the
+// base64url fields are rewritten in and serialized back out.
+//
+// NOTE: passkeys require a native build (not Expo Go) and an associated-domain
+// / asset-link binding the app to the server's WEBAUTHN_RP_ID. `react-native-
+// passkey` is a lazy import so apps/platforms that never call these functions
+// don't need it linked.
+
+import { Platform } from "react-native";
+import { getBaseUrl, getSessionToken, storeSessionToken } from "./api-config";
+import type { AuthResponse } from "./auth.service";
+
+// ── base64url ⇄ ArrayBuffer (web path only) ────────────────────────────────
+
+function b64urlToBuffer(value: string): ArrayBuffer {
+  const pad = "=".repeat((4 - (value.length % 4)) % 4);
+  const base64 = (value + pad).replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(base64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) {
+    bytes[i] = bin.charCodeAt(i);
+  }
+  return bytes.buffer;
+}
+
+function bufferToB64url(buf: ArrayBuffer): string {
+  const bytes = new Uint8Array(buf);
+  let bin = "";
+  for (const b of bytes) {
+    bin += String.fromCharCode(b);
+  }
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// ── transport ───────────────────────────────────────────────────────────────
+
+async function post(path: string, body: unknown): Promise<Response> {
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  const token = await getSessionToken();
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return fetch(`${getBaseUrl()}${path}`, {
+    method: "POST",
+    headers,
+    credentials: "include",
+    body: JSON.stringify(body),
+  });
+}
+
+async function postJson<T>(path: string, body: unknown): Promise<T> {
+  const res = await post(path, body);
+  if (!res.ok) {
+    let message = `request failed (${res.status})`;
+    try {
+      const data = await res.json();
+      message = data?.error?.message ?? message;
+    } catch {
+      // non-JSON error body; keep the status message
+    }
+    throw new Error(message);
+  }
+  return (await res.json()) as T;
+}
+
+interface BeginResponse {
+  ceremonyId: string;
+  publickeyOptions: Record<string, unknown>;
+}
+
+// react-native-passkey is a native module; import lazily so the web bundle and
+// type-checking don't hard-depend on it being linked.
+async function nativePasskey() {
+  const mod = await import("react-native-passkey");
+  return mod.Passkey;
+}
+
+/** Whether this platform can do WebAuthn at all. */
+export async function isPasskeySupported(): Promise<boolean> {
+  if (Platform.OS === "web") {
+    return (
+      typeof globalThis !== "undefined" &&
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      !!(globalThis as any).PublicKeyCredential
+    );
+  }
+  try {
+    const Passkey = await nativePasskey();
+    return Boolean((Passkey as { isSupported?: () => boolean }).isSupported?.());
+  } catch {
+    return false;
+  }
+}
+
+/** The inner `publicKey` object webauthn-rs wraps its options in. */
+function inner(options: Record<string, unknown>): Record<string, unknown> {
+  const pk = options.publicKey;
+  return (pk && typeof pk === "object" ? pk : options) as Record<string, unknown>;
+}
+
+async function createCredential(options: Record<string, unknown>): Promise<unknown> {
+  if (Platform.OS === "web") {
+    const pk = { ...inner(options) };
+    pk.challenge = b64urlToBuffer(pk.challenge as string);
+    const user = pk.user as Record<string, unknown> | undefined;
+    if (user && typeof user.id === "string") {
+      pk.user = { ...user, id: b64urlToBuffer(user.id) };
+    }
+    if (Array.isArray(pk.excludeCredentials)) {
+      pk.excludeCredentials = (pk.excludeCredentials as Record<string, unknown>[]).map((c) => ({
+        ...c,
+        id: typeof c.id === "string" ? b64urlToBuffer(c.id) : c.id,
+      }));
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const cred = (await navigator.credentials.create({ publicKey: pk as any })) as any;
+    return serializeWebCredential(cred);
+  }
+  const Passkey = await nativePasskey();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return (Passkey as any).create(inner(options));
+}
+
+async function getCredential(options: Record<string, unknown>): Promise<unknown> {
+  if (Platform.OS === "web") {
+    const pk = { ...inner(options) };
+    pk.challenge = b64urlToBuffer(pk.challenge as string);
+    if (Array.isArray(pk.allowCredentials)) {
+      pk.allowCredentials = (pk.allowCredentials as Record<string, unknown>[]).map((c) => ({
+        ...c,
+        id: typeof c.id === "string" ? b64urlToBuffer(c.id) : c.id,
+      }));
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const cred = (await navigator.credentials.get({ publicKey: pk as any })) as any;
+    return serializeWebCredential(cred);
+  }
+  const Passkey = await nativePasskey();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return (Passkey as any).get(inner(options));
+}
+
+// Convert a DOM PublicKeyCredential into the base64url JSON the server expects.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function serializeWebCredential(cred: any): unknown {
+  const r = cred.response;
+  const out: Record<string, unknown> = {
+    id: cred.id,
+    rawId: bufferToB64url(cred.rawId),
+    type: cred.type,
+    response: {} as Record<string, unknown>,
+  };
+  const resp = out.response as Record<string, unknown>;
+  if (r.attestationObject) {
+    resp.attestationObject = bufferToB64url(r.attestationObject);
+  }
+  if (r.clientDataJSON) {
+    resp.clientDataJSON = bufferToB64url(r.clientDataJSON);
+  }
+  if (r.authenticatorData) {
+    resp.authenticatorData = bufferToB64url(r.authenticatorData);
+  }
+  if (r.signature) {
+    resp.signature = bufferToB64url(r.signature);
+  }
+  if (r.userHandle) {
+    resp.userHandle = bufferToB64url(r.userHandle);
+  }
+  return out;
+}
+
+function clientExtensionResults(cred: unknown): Record<string, unknown> | undefined {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const c = cred as any;
+  if (typeof c?.getClientExtensionResults === "function") {
+    return c.getClientExtensionResults();
+  }
+  return c?.clientExtensionResults;
+}
+
+/** Register a new passkey for the signed-in user. Triggers the OS biometric. */
+export async function registerPasskey(label: string): Promise<{ label: string }> {
+  const begin = await postJson<BeginResponse>("/auth/passkey/register/begin", { label });
+  const credential = await createCredential(begin.publickeyOptions);
+  return postJson<{ label: string }>("/auth/passkey/register/finish", {
+    ceremonyId: begin.ceremonyId,
+    label,
+    credential,
+    clientExtensionResults: clientExtensionResults(credential),
+  });
+}
+
+/** Sign in with a passkey. Returns the authenticated session. */
+export async function authenticateWithPasskey(email?: string): Promise<AuthResponse> {
+  const begin = await postJson<BeginResponse>("/auth/passkey/authenticate/begin", { email });
+  const credential = await getCredential(begin.publickeyOptions);
+  const auth = await postJson<AuthResponse>("/auth/passkey/authenticate/finish", {
+    ceremonyId: begin.ceremonyId,
+    credential,
+    clientExtensionResults: clientExtensionResults(credential),
+  });
+  if (auth.session_token) {
+    await storeSessionToken(auth.session_token);
+  }
+  return auth;
+}

package/src/types/external.d.ts

@@ -0,0 +1,24 @@
+declare module "react-native-qrcode-svg" {
+  import type { ComponentType } from "react";
+
+  export interface QRCodeProps {
+    value: string;
+    size?: number;
+    color?: string;
+    backgroundColor?: string;
+    quietZone?: number;
+    enableLinearGradient?: boolean;
+    linearGradient?: string[];
+    logo?: { uri: string } | number;
+    logoSize?: number;
+    logoBackgroundColor?: string;
+    logoMargin?: number;
+    logoBorderRadius?: number;
+    ecl?: "L" | "M" | "Q" | "H";
+    getRef?: (ref: unknown) => void;
+    onError?: (error: unknown) => void;
+  }
+
+  const QRCode: ComponentType<QRCodeProps>;
+  export default QRCode;
+}

package/src/utils/__tests__/clipboard.test.ts

@@ -0,0 +1,59 @@
+import * as Clipboard from "expo-clipboard";
+import { clearClipboardNow, copyToClipboard } from "../clipboard";
+
+jest.mock("expo-clipboard", () => {
+  let value = "";
+  return {
+    setStringAsync: jest.fn(async (v) => {
+      value = v;
+      return true;
+    }),
+    getStringAsync: async () => value,
+    __get: () => value,
+  };
+});
+
+const setStringAsync = Clipboard.setStringAsync as jest.MockedFunction<
+  typeof Clipboard.setStringAsync
+>;
+
+describe("copyToClipboard", () => {
+  beforeEach(() => {
+    setStringAsync.mockClear();
+    jest.useFakeTimers();
+  });
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it("writes the value and schedules a 30s auto-clear", async () => {
+    const ok = await copyToClipboard("secret");
+    expect(ok).toBe(true);
+    expect(setStringAsync).toHaveBeenLastCalledWith("secret");
+    jest.advanceTimersByTime(30_000);
+    expect(setStringAsync).toHaveBeenLastCalledWith("");
+  });
+
+  it("re-scheduling cancels the prior auto-clear", async () => {
+    await copyToClipboard("first");
+    jest.advanceTimersByTime(15_000);
+    await copyToClipboard("second");
+    jest.advanceTimersByTime(15_000);
+    // Still inside the second copy's window — auto-clear hasn't fired.
+    expect(setStringAsync).toHaveBeenLastCalledWith("second");
+  });
+
+  it("clearClipboardNow wipes immediately and cancels pending timers", async () => {
+    await copyToClipboard("x");
+    await clearClipboardNow();
+    expect(setStringAsync).toHaveBeenLastCalledWith("");
+    setStringAsync.mockClear();
+    jest.advanceTimersByTime(60_000);
+    expect(setStringAsync).not.toHaveBeenCalled();
+  });
+
+  it("returns false when the platform refuses the write", async () => {
+    setStringAsync.mockResolvedValueOnce(false);
+    expect(await copyToClipboard("nope")).toBe(false);
+  });
+});

package/src/utils/__tests__/cn.test.ts

@@ -0,0 +1,24 @@
+import { cn } from "../cn";
+
+describe("cn", () => {
+  it("joins truthy class names", () => {
+    expect(cn("a", "b")).toBe("a b");
+  });
+
+  it("drops falsy values", () => {
+    expect(cn("a", false, undefined, null, "", "b")).toBe("a b");
+  });
+
+  it("resolves tailwind conflicts in favour of the last class", () => {
+    expect(cn("px-2", "px-4")).toBe("px-4");
+    expect(cn("text-red-500", "text-blue-500")).toBe("text-blue-500");
+  });
+
+  it("preserves non-conflicting tailwind classes", () => {
+    expect(cn("flex", "items-center", "p-4")).toBe("flex items-center p-4");
+  });
+
+  it("flattens nested arrays and objects", () => {
+    expect(cn(["a", "b"], { c: true, d: false })).toBe("a b c");
+  });
+});

package/src/utils/__tests__/debounce.test.ts

@@ -0,0 +1,42 @@
+import { debounce } from "../debounce";
+
+describe("debounce", () => {
+  beforeEach(() => {
+    jest.useFakeTimers();
+  });
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it("collapses rapid calls into a single trailing invocation", () => {
+    const fn = jest.fn();
+    const debounced = debounce(fn, 100);
+    debounced("a");
+    debounced("b");
+    debounced("c");
+    expect(fn).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(100);
+    expect(fn).toHaveBeenCalledTimes(1);
+    expect(fn).toHaveBeenCalledWith("c");
+  });
+
+  it("cancels a pending invocation when cancel() runs first", () => {
+    const fn = jest.fn();
+    const debounced = debounce(fn, 100);
+    debounced("a");
+    debounced.cancel();
+    jest.advanceTimersByTime(200);
+    expect(fn).not.toHaveBeenCalled();
+  });
+
+  it("re-arms after a successful invocation", () => {
+    const fn = jest.fn();
+    const debounced = debounce(fn, 50);
+    debounced("a");
+    jest.advanceTimersByTime(50);
+    debounced("b");
+    jest.advanceTimersByTime(50);
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(fn.mock.calls.map((c) => c[0])).toEqual(["a", "b"]);
+  });
+});

package/src/utils/__tests__/error.test.ts

@@ -0,0 +1,18 @@
+import { getErrorMessage } from "../error";
+
+describe("getErrorMessage", () => {
+  it("extracts the message off an Error instance", () => {
+    expect(getErrorMessage(new Error("boom"))).toBe("boom");
+  });
+
+  it("falls back to the provided fallback for non-Error values", () => {
+    expect(getErrorMessage("nope", "default")).toBe("default");
+    expect(getErrorMessage(undefined, "default")).toBe("default");
+    expect(getErrorMessage({ thing: 1 }, "default")).toBe("default");
+    expect(getErrorMessage(123, "default")).toBe("default");
+  });
+
+  it("uses the default fallback when none is supplied", () => {
+    expect(getErrorMessage(123)).toBe("An unexpected error occurred");
+  });
+});

package/src/utils/__tests__/http-error.test.ts

@@ -0,0 +1,33 @@
+import { extractErrorMessage } from "../http-error";
+
+function jsonResponse(body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status: 400,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("extractErrorMessage", () => {
+  it("returns the top-level message when no details are supplied", async () => {
+    const r = jsonResponse({ error: { message: "Bad request" } });
+    expect(await extractErrorMessage(r, "fb")).toBe("Bad request");
+  });
+
+  it("joins details with commas", async () => {
+    const r = jsonResponse({ error: { message: "ignored", details: ["a", "b", "c"] } });
+    expect(await extractErrorMessage(r, "fb")).toBe("a, b, c");
+  });
+
+  it("caps the number of details rendered and marks the truncation", async () => {
+    const details = Array.from({ length: 20 }, (_, i) => `e${i}`);
+    const r = jsonResponse({ error: { message: "ignored", details } });
+    const out = await extractErrorMessage(r, "fb");
+    expect(out.endsWith(", …")).toBe(true);
+    expect(out.split(", ").length).toBe(6); // 5 entries + the ellipsis marker
+  });
+
+  it("returns fallback for unparseable bodies", async () => {
+    const r = new Response("not json", { status: 500 });
+    expect(await extractErrorMessage(r, "fallback")).toBe("fallback");
+  });
+});

package/src/utils/__tests__/palette.test.ts

@@ -0,0 +1,22 @@
+import { darkPalette, getPalette, lightPalette } from "../palette";
+
+describe("palette", () => {
+  it("returns lightPalette for the light scheme", () => {
+    expect(getPalette("light")).toBe(lightPalette);
+  });
+
+  it("returns darkPalette for the dark scheme", () => {
+    expect(getPalette("dark")).toBe(darkPalette);
+  });
+
+  it("light and dark cover the same token surface", () => {
+    expect(Object.keys(lightPalette).sort()).toEqual(Object.keys(darkPalette).sort());
+  });
+
+  it("light vs dark have inverted background / foreground", () => {
+    expect(lightPalette.background).toBe("rgb(255, 255, 255)");
+    expect(lightPalette.foreground).toBe("rgb(0, 0, 0)");
+    expect(darkPalette.background).toBe("rgb(0, 0, 0)");
+    expect(darkPalette.foreground).toBe("rgb(255, 255, 255)");
+  });
+});

package/src/utils/__tests__/password.test.ts

@@ -0,0 +1,55 @@
+import { generatePassword } from "../password";
+
+const CRYPTO_OK = typeof globalThis.crypto?.getRandomValues === "function";
+const describeIfCrypto = CRYPTO_OK ? describe : describe.skip;
+
+describeIfCrypto("generatePassword", () => {
+  it("returns exactly the requested length", () => {
+    expect(generatePassword({ length: 16 }).length).toBe(16);
+    expect(generatePassword({ length: 32 }).length).toBe(32);
+    expect(generatePassword({ length: 64 }).length).toBe(64);
+  });
+
+  it("draws only from the enabled character class", () => {
+    const pw = generatePassword({
+      length: 64,
+      includeUppercase: false,
+      includeLowercase: false,
+      includeNumbers: true,
+      includeSymbols: false,
+    });
+    expect(/^\d+$/.test(pw)).toBe(true);
+  });
+
+  it("excludes similar glyphs when requested", () => {
+    const pw = generatePassword({
+      length: 256,
+      includeUppercase: true,
+      includeLowercase: true,
+      includeNumbers: true,
+      includeSymbols: false,
+      excludeSimilar: true,
+    });
+    for (const ch of ["i", "l", "1", "L", "o", "0", "O"]) {
+      expect(pw).not.toContain(ch);
+    }
+  });
+
+  it("throws when every class is disabled", () => {
+    expect(() =>
+      generatePassword({
+        length: 16,
+        includeUppercase: false,
+        includeLowercase: false,
+        includeNumbers: false,
+        includeSymbols: false,
+      })
+    ).toThrow();
+  });
+
+  it("draws different output across calls (non-deterministic)", () => {
+    const a = generatePassword({ length: 32 });
+    const b = generatePassword({ length: 32 });
+    expect(a).not.toBe(b);
+  });
+});

package/src/utils/__tests__/settings-storage.test.ts

@@ -0,0 +1,15 @@
+import { loadSetting, saveSetting } from "../settings-storage";
+
+describe("settings-storage (native path)", () => {
+  it("returns the fallback when nothing is stored", async () => {
+    expect(await loadSetting("vault_setting_unset_42", true)).toBe(true);
+    expect(await loadSetting("vault_setting_unset_43", false)).toBe(false);
+  });
+
+  it("round-trips a boolean via SecureStore", async () => {
+    await saveSetting("vault_setting_alpha", true);
+    expect(await loadSetting("vault_setting_alpha", false)).toBe(true);
+    await saveSetting("vault_setting_alpha", false);
+    expect(await loadSetting("vault_setting_alpha", true)).toBe(false);
+  });
+});