react-native-nitro-storage 0.3.2 → 0.4.0

package/cpp/bindings/HybridStorage.cpp

@@ -14,6 +14,7 @@ namespace margelo::nitro::NitroStorage {
 
 namespace {
 constexpr auto kBatchMissingSentinel = "__nitro_storage_batch_missing__::v1";
+constexpr int kDefaultBiometricLevel = 2;
 } // namespace
 
 HybridStorage::HybridStorage()
@@ -74,7 +75,8 @@ void HybridStorage::set(const std::string& key, const std::string& value, double
             }
             break;
     }
-    
+
+    onKeySet(static_cast<int>(s), key);
     notifyListeners(static_cast<int>(s), key, value);
 }
 
@@ -143,7 +145,8 @@ void HybridStorage::remove(const std::string& key, double scope) {
             }
             break;
     }
-    
+
+    onKeyRemove(static_cast<int>(s), key);
     notifyListeners(static_cast<int>(s), key, std::nullopt);
 }
 
@@ -179,11 +182,56 @@ std::vector<std::string> HybridStorage::getAllKeys(double scope) {
             return keys;
         }
         case Scope::Disk:
-            ensureAdapter();
-            return nativeAdapter_->getAllKeysDisk();
-        case Scope::Secure:
-            ensureAdapter();
-            return nativeAdapter_->getAllKeysSecure();
+        case Scope::Secure: {
+            const int scopeValue = static_cast<int>(s);
+            ensureKeyIndexHydrated(scopeValue);
+            std::lock_guard<std::mutex> lock(keyIndexMutex_);
+            auto indexIt = keyIndex_.find(scopeValue);
+            if (indexIt == keyIndex_.end()) {
+                return {};
+            }
+            return toVector(indexIt->second);
+        }
+    }
+    return {};
+}
+
+std::vector<std::string> HybridStorage::getKeysByPrefix(const std::string& prefix, double scope) {
+    Scope s = toScope(scope);
+    if (prefix.empty()) {
+        return getAllKeys(scope);
+    }
+
+    switch (s) {
+        case Scope::Memory: {
+            std::lock_guard<std::mutex> lock(memoryMutex_);
+            std::vector<std::string> keys;
+            keys.reserve(memoryStore_.size());
+            for (const auto& [key, _] : memoryStore_) {
+                if (key.rfind(prefix, 0) == 0) {
+                    keys.push_back(key);
+                }
+            }
+            return keys;
+        }
+        case Scope::Disk:
+        case Scope::Secure: {
+            const int scopeValue = static_cast<int>(s);
+            ensureKeyIndexHydrated(scopeValue);
+            std::lock_guard<std::mutex> lock(keyIndexMutex_);
+            std::vector<std::string> keys;
+            auto indexIt = keyIndex_.find(scopeValue);
+            if (indexIt == keyIndex_.end()) {
+                return keys;
+            }
+            keys.reserve(indexIt->second.size());
+            for (const auto& key : indexIt->second) {
+                if (key.rfind(prefix, 0) == 0) {
+                    keys.push_back(key);
+                }
+            }
+            return keys;
+        }
     }
     return {};
 }
@@ -197,11 +245,16 @@ double HybridStorage::size(double scope) {
             return static_cast<double>(memoryStore_.size());
         }
         case Scope::Disk:
-            ensureAdapter();
-            return static_cast<double>(nativeAdapter_->sizeDisk());
-        case Scope::Secure:
-            ensureAdapter();
-            return static_cast<double>(nativeAdapter_->sizeSecure());
+        case Scope::Secure: {
+            const int scopeValue = static_cast<int>(s);
+            ensureKeyIndexHydrated(scopeValue);
+            std::lock_guard<std::mutex> lock(keyIndexMutex_);
+            auto indexIt = keyIndex_.find(scopeValue);
+            if (indexIt == keyIndex_.end()) {
+                return 0.0;
+            }
+            return static_cast<double>(indexIt->second.size());
+        }
     }
     return 0.0;
 }
@@ -261,7 +314,8 @@ void HybridStorage::clear(double scope) {
             }
             break;
     }
-    
+
+    onScopeClear(static_cast<int>(s));
     notifyListeners(static_cast<int>(s), "", std::nullopt);
 }
 
@@ -303,6 +357,9 @@ void HybridStorage::setBatch(const std::vector<std::string>& keys, const std::ve
     }
 
     const auto scopeValue = static_cast<int>(s);
+    for (const auto& key : keys) {
+        onKeySet(scopeValue, key);
+    }
     const auto listeners = copyListenersForScope(scopeValue);
     for (size_t i = 0; i < keys.size(); ++i) {
         notifyListeners(listeners, keys[i], values[i]);
@@ -399,6 +456,9 @@ void HybridStorage::removeBatch(const std::vector<std::string>& keys, double sco
     }
 
     const auto scopeValue = static_cast<int>(s);
+    for (const auto& key : keys) {
+        onKeyRemove(scopeValue, key);
+    }
     const auto listeners = copyListenersForScope(scopeValue);
     for (const auto& key : keys) {
         notifyListeners(listeners, key, std::nullopt);
@@ -410,14 +470,7 @@ void HybridStorage::removeByPrefix(const std::string& prefix, double scope) {
         return;
     }
 
-    const auto keys = getAllKeys(scope);
-    std::vector<std::string> prefixedKeys;
-    prefixedKeys.reserve(keys.size());
-    for (const auto& key : keys) {
-        if (key.rfind(prefix, 0) == 0) {
-            prefixedKeys.push_back(key);
-        }
-    }
+    const auto prefixedKeys = getKeysByPrefix(prefix, scope);
 
     if (prefixedKeys.empty()) {
         return;
@@ -446,9 +499,18 @@ void HybridStorage::setKeychainAccessGroup(const std::string& group) {
 // --- Biometric ---
 
 void HybridStorage::setSecureBiometric(const std::string& key, const std::string& value) {
+    setSecureBiometricWithLevel(key, value, kDefaultBiometricLevel);
+}
+
+void HybridStorage::setSecureBiometricWithLevel(const std::string& key, const std::string& value, double level) {
     ensureAdapter();
     try {
-        nativeAdapter_->setSecureBiometric(key, value);
+        nativeAdapter_->setSecureBiometricWithLevel(
+            key,
+            value,
+            static_cast<int>(level)
+        );
+        onKeySet(static_cast<int>(Scope::Secure), key);
         notifyListeners(static_cast<int>(Scope::Secure), key, value);
     } catch (const std::exception& e) {
         throw std::runtime_error(std::string("NitroStorage: Biometric set failed: ") + e.what());
@@ -468,6 +530,7 @@ void HybridStorage::deleteSecureBiometric(const std::string& key) {
     ensureAdapter();
     try {
         nativeAdapter_->deleteSecureBiometric(key);
+        onKeyRemove(static_cast<int>(Scope::Secure), key);
         notifyListeners(static_cast<int>(Scope::Secure), key, std::nullopt);
     } catch (const std::exception& e) {
         throw std::runtime_error(std::string("NitroStorage: Biometric delete failed: ") + e.what());
@@ -483,6 +546,7 @@ void HybridStorage::clearSecureBiometric() {
     ensureAdapter();
     try {
         nativeAdapter_->clearSecureBiometric();
+        onScopeClear(static_cast<int>(Scope::Secure));
         notifyListeners(static_cast<int>(Scope::Secure), "", std::nullopt);
     } catch (const std::exception& e) {
         throw std::runtime_error(std::string("NitroStorage: Biometric clear failed: ") + e.what());
@@ -527,6 +591,87 @@ void HybridStorage::notifyListeners(
     notifyListeners(listeners, key, value);
 }
 
+std::vector<std::string> HybridStorage::toVector(const std::unordered_set<std::string>& keys) {
+    std::vector<std::string> values;
+    values.reserve(keys.size());
+    for (const auto& key : keys) {
+        values.push_back(key);
+    }
+    return values;
+}
+
+void HybridStorage::ensureKeyIndexHydrated(int scope) {
+    if (scope != static_cast<int>(Scope::Disk) && scope != static_cast<int>(Scope::Secure)) {
+        return;
+    }
+
+    {
+        std::lock_guard<std::mutex> lock(keyIndexMutex_);
+        auto hydratedIt = keyIndexHydrated_.find(scope);
+        if (hydratedIt != keyIndexHydrated_.end() && hydratedIt->second) {
+            return;
+        }
+    }
+
+    ensureAdapter();
+    std::vector<std::string> keys;
+    try {
+        if (scope == static_cast<int>(Scope::Disk)) {
+            keys = nativeAdapter_->getAllKeysDisk();
+        } else {
+            keys = nativeAdapter_->getAllKeysSecure();
+        }
+    } catch (const std::exception& e) {
+        throw std::runtime_error(std::string("NitroStorage: Key index hydration failed: ") + e.what());
+    } catch (...) {
+        throw std::runtime_error("NitroStorage: Key index hydration failed");
+    }
+
+    std::lock_guard<std::mutex> lock(keyIndexMutex_);
+    auto& index = keyIndex_[scope];
+    index.clear();
+    for (const auto& key : keys) {
+        index.insert(key);
+    }
+    keyIndexHydrated_[scope] = true;
+}
+
+void HybridStorage::onKeySet(int scope, const std::string& key) {
+    if (scope != static_cast<int>(Scope::Disk) && scope != static_cast<int>(Scope::Secure)) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(keyIndexMutex_);
+    auto hydratedIt = keyIndexHydrated_.find(scope);
+    if (hydratedIt != keyIndexHydrated_.end() && hydratedIt->second) {
+        keyIndex_[scope].insert(key);
+    }
+}
+
+void HybridStorage::onKeyRemove(int scope, const std::string& key) {
+    if (scope != static_cast<int>(Scope::Disk) && scope != static_cast<int>(Scope::Secure)) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(keyIndexMutex_);
+    auto hydratedIt = keyIndexHydrated_.find(scope);
+    if (hydratedIt != keyIndexHydrated_.end() && hydratedIt->second) {
+        keyIndex_[scope].erase(key);
+    }
+}
+
+void HybridStorage::onScopeClear(int scope) {
+    if (scope != static_cast<int>(Scope::Disk) && scope != static_cast<int>(Scope::Secure)) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(keyIndexMutex_);
+    auto hydratedIt = keyIndexHydrated_.find(scope);
+    if (hydratedIt != keyIndexHydrated_.end() && hydratedIt->second) {
+        keyIndex_[scope].clear();
+    }
+}
+
 void HybridStorage::ensureAdapter() const {
     if (!nativeAdapter_) {
         throw std::runtime_error("NitroStorage: Native adapter not initialized");

package/cpp/bindings/HybridStorage.hpp

@@ -8,6 +8,7 @@
 #include <functional>
 #include <memory>
 #include <vector>
+#include <unordered_set>
 
 namespace margelo::nitro::NitroStorage {
 
@@ -31,6 +32,7 @@ public:
     void clear(double scope) override;
     bool has(const std::string& key, double scope) override;
     std::vector<std::string> getAllKeys(double scope) override;
+    std::vector<std::string> getKeysByPrefix(const std::string& prefix, double scope) override;
     double size(double scope) override;
     void setBatch(const std::vector<std::string>& keys, const std::vector<std::string>& values, double scope) override;
     std::vector<std::string> getBatch(const std::vector<std::string>& keys, double scope) override;
@@ -44,6 +46,7 @@ public:
     void setSecureWritesAsync(bool enabled) override;
     void setKeychainAccessGroup(const std::string& group) override;
     void setSecureBiometric(const std::string& key, const std::string& value) override;
+    void setSecureBiometricWithLevel(const std::string& key, const std::string& value, double level) override;
     std::optional<std::string> getSecureBiometric(const std::string& key) override;
     void deleteSecureBiometric(const std::string& key) override;
     bool hasSecureBiometric(const std::string& key) override;
@@ -65,10 +68,13 @@ private:
     std::mutex memoryMutex_;
     
     std::shared_ptr<::NitroStorage::NativeStorageAdapter> nativeAdapter_;
-    
+
     HybridStorageMap<int, std::vector<Listener>> listeners_;
     std::mutex listenersMutex_;
     size_t nextListenerId_ = 0;
+    HybridStorageMap<int, std::unordered_set<std::string>> keyIndex_;
+    HybridStorageMap<int, bool> keyIndexHydrated_;
+    std::mutex keyIndexMutex_;
 
     std::vector<Listener> copyListenersForScope(int scope);
     void notifyListeners(
@@ -77,6 +83,11 @@ private:
         const std::optional<std::string>& value
     );
     void notifyListeners(int scope, const std::string& key, const std::optional<std::string>& value);
+    std::vector<std::string> toVector(const std::unordered_set<std::string>& keys);
+    void ensureKeyIndexHydrated(int scope);
+    void onKeySet(int scope, const std::string& key);
+    void onKeyRemove(int scope, const std::string& key);
+    void onScopeClear(int scope);
     void ensureAdapter() const;
     Scope toScope(double scopeValue);
 };

package/cpp/core/NativeStorageAdapter.hpp

@@ -15,6 +15,7 @@ public:
     virtual void deleteDisk(const std::string& key) = 0;
     virtual bool hasDisk(const std::string& key) = 0;
     virtual std::vector<std::string> getAllKeysDisk() = 0;
+    virtual std::vector<std::string> getKeysByPrefixDisk(const std::string& prefix) = 0;
     virtual size_t sizeDisk() = 0;
     virtual void setDiskBatch(const std::vector<std::string>& keys, const std::vector<std::string>& values) = 0;
     virtual std::vector<std::optional<std::string>> getDiskBatch(const std::vector<std::string>& keys) = 0;
@@ -25,6 +26,7 @@ public:
     virtual void deleteSecure(const std::string& key) = 0;
     virtual bool hasSecure(const std::string& key) = 0;
     virtual std::vector<std::string> getAllKeysSecure() = 0;
+    virtual std::vector<std::string> getKeysByPrefixSecure(const std::string& prefix) = 0;
     virtual size_t sizeSecure() = 0;
     virtual void setSecureBatch(const std::vector<std::string>& keys, const std::vector<std::string>& values) = 0;
     virtual std::vector<std::optional<std::string>> getSecureBatch(const std::vector<std::string>& keys) = 0;
@@ -38,6 +40,7 @@ public:
     virtual void setKeychainAccessGroup(const std::string& group) = 0;
 
     virtual void setSecureBiometric(const std::string& key, const std::string& value) = 0;
+    virtual void setSecureBiometricWithLevel(const std::string& key, const std::string& value, int level) = 0;
     virtual std::optional<std::string> getSecureBiometric(const std::string& key) = 0;
     virtual void deleteSecureBiometric(const std::string& key) = 0;
     virtual bool hasSecureBiometric(const std::string& key) = 0;

package/ios/IOSStorageAdapterCpp.hpp

@@ -1,6 +1,8 @@
 #pragma once
 
 #include "../core/NativeStorageAdapter.hpp"
+#include <mutex>
+#include <unordered_set>
 
 namespace NitroStorage {
 
@@ -14,6 +16,7 @@ public:
     void deleteDisk(const std::string& key) override;
     bool hasDisk(const std::string& key) override;
     std::vector<std::string> getAllKeysDisk() override;
+    std::vector<std::string> getKeysByPrefixDisk(const std::string& prefix) override;
     size_t sizeDisk() override;
     void setDiskBatch(const std::vector<std::string>& keys, const std::vector<std::string>& values) override;
     std::vector<std::optional<std::string>> getDiskBatch(const std::vector<std::string>& keys) override;
@@ -24,6 +27,7 @@ public:
     void deleteSecure(const std::string& key) override;
     bool hasSecure(const std::string& key) override;
     std::vector<std::string> getAllKeysSecure() override;
+    std::vector<std::string> getKeysByPrefixSecure(const std::string& prefix) override;
     size_t sizeSecure() override;
     void setSecureBatch(const std::vector<std::string>& keys, const std::vector<std::string>& values) override;
     std::vector<std::optional<std::string>> getSecureBatch(const std::vector<std::string>& keys) override;
@@ -37,6 +41,7 @@ public:
     void setKeychainAccessGroup(const std::string& group) override;
 
     void setSecureBiometric(const std::string& key, const std::string& value) override;
+    void setSecureBiometricWithLevel(const std::string& key, const std::string& value, int level) override;
     std::optional<std::string> getSecureBiometric(const std::string& key) override;
     void deleteSecureBiometric(const std::string& key) override;
     bool hasSecureBiometric(const std::string& key) override;
@@ -45,6 +50,17 @@ public:
 private:
     int accessControlLevel_ = 0;
     std::string keychainAccessGroup_;
+    mutable std::mutex secureKeysMutex_;
+    std::unordered_set<std::string> secureKeysCache_;
+    std::unordered_set<std::string> biometricKeysCache_;
+    bool secureKeyCacheHydrated_ = false;
+
+    void ensureSecureKeyCacheHydrated();
+    void markSecureKeySet(const std::string& key);
+    void markSecureKeyRemoved(const std::string& key);
+    void markBiometricKeySet(const std::string& key);
+    void markBiometricKeyRemoved(const std::string& key);
+    void clearSecureKeyCache();
 };
 
 } // namespace NitroStorage

package/ios/IOSStorageAdapterCpp.mm

@@ -79,6 +79,18 @@ std::vector<std::string> IOSStorageAdapterCpp::getAllKeysDisk() {
     return keys;
 }
 
+std::vector<std::string> IOSStorageAdapterCpp::getKeysByPrefixDisk(const std::string& prefix) {
+    const auto keys = getAllKeysDisk();
+    std::vector<std::string> filtered;
+    filtered.reserve(keys.size());
+    for (const auto& key : keys) {
+        if (key.rfind(prefix, 0) == 0) {
+            filtered.push_back(key);
+        }
+    }
+    return filtered;
+}
+
 size_t IOSStorageAdapterCpp::sizeDisk() {
     return [NitroDiskDefaults() dictionaryRepresentation].count;
 }
@@ -177,11 +189,27 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
 
     OSStatus status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)updateAttributes);
 
+    if (status == errSecSuccess) {
+        markSecureKeySet(key);
+        return;
+    }
+
     if (status == errSecItemNotFound) {
         query[(__bridge id)kSecValueData] = data;
         query[(__bridge id)kSecAttrAccessible] = (__bridge id)accessControlAttr(accessControlLevel_);
-        SecItemAdd((__bridge CFDictionaryRef)query, NULL);
+        const OSStatus addStatus = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
+        if (addStatus != errSecSuccess) {
+            throw std::runtime_error(
+                "NitroStorage: Secure set failed with status " + std::to_string(addStatus)
+            );
+        }
+        markSecureKeySet(key);
+        return;
     }
+
+    throw std::runtime_error(
+        "NitroStorage: Secure set failed with status " + std::to_string(status)
+    );
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& key) {
@@ -207,6 +235,8 @@ void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
     SecItemDelete((__bridge CFDictionaryRef)secureQuery);
     NSMutableDictionary* biometricQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
+    markSecureKeyRemoved(key);
+    markBiometricKeyRemoved(key);
 }
 
 bool IOSStorageAdapterCpp::hasSecure(const std::string& key) {
@@ -221,20 +251,36 @@ bool IOSStorageAdapterCpp::hasSecure(const std::string& key) {
 }
 
 std::vector<std::string> IOSStorageAdapterCpp::getAllKeysSecure() {
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
-    std::vector<std::string> keys = keychainAccountsForService(kKeychainService, group);
-    std::unordered_set<std::string> seen(keys.begin(), keys.end());
-    const std::vector<std::string> biometricKeys = keychainAccountsForService(kBiometricKeychainService, group);
-    for (const auto& key : biometricKeys) {
-        if (seen.insert(key).second) {
-            keys.push_back(key);
-        }
+    ensureSecureKeyCacheHydrated();
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    std::unordered_set<std::string> combined = secureKeysCache_;
+    combined.insert(biometricKeysCache_.begin(), biometricKeysCache_.end());
+    std::vector<std::string> keys;
+    keys.reserve(combined.size());
+    for (const auto& key : combined) {
+        keys.push_back(key);
     }
     return keys;
 }
 
+std::vector<std::string> IOSStorageAdapterCpp::getKeysByPrefixSecure(const std::string& prefix) {
+    const auto keys = getAllKeysSecure();
+    std::vector<std::string> filtered;
+    filtered.reserve(keys.size());
+    for (const auto& key : keys) {
+        if (key.rfind(prefix, 0) == 0) {
+            filtered.push_back(key);
+        }
+    }
+    return filtered;
+}
+
 size_t IOSStorageAdapterCpp::sizeSecure() {
-    return getAllKeysSecure().size();
+    ensureSecureKeyCacheHydrated();
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    std::unordered_set<std::string> combined = secureKeysCache_;
+    combined.insert(biometricKeysCache_.begin(), biometricKeysCache_.end());
+    return combined.size();
 }
 
 void IOSStorageAdapterCpp::setSecureBatch(
@@ -282,6 +328,7 @@ void IOSStorageAdapterCpp::clearSecure() {
         biometricQuery[(__bridge id)kSecAttrAccessGroup] = group;
     }
     SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
+    clearSecureKeyCache();
 }
 
 // --- Configuration ---
@@ -296,11 +343,21 @@ void IOSStorageAdapterCpp::setSecureWritesAsync(bool /*enabled*/) {
 
 void IOSStorageAdapterCpp::setKeychainAccessGroup(const std::string& group) {
     keychainAccessGroup_ = group;
+    clearSecureKeyCache();
 }
 
 // --- Biometric (separate Keychain service with biometric ACL) ---
 
 void IOSStorageAdapterCpp::setSecureBiometric(const std::string& key, const std::string& value) {
+    setSecureBiometricWithLevel(key, value, 2);
+}
+
+void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, const std::string& value, int level) {
+    if (level == 0) {
+        setSecure(key, value);
+        return;
+    }
+
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
     NSData* data = [[NSString stringWithUTF8String:value.c_str()] dataUsingEncoding:NSUTF8StringEncoding];
     NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
@@ -310,10 +367,14 @@ void IOSStorageAdapterCpp::setSecureBiometric(const std::string& key, const std:
     SecItemDelete((__bridge CFDictionaryRef)deleteQuery);
 
     CFErrorRef error = NULL;
+    SecAccessControlCreateFlags flags = kSecAccessControlBiometryCurrentSet;
+    if (level == 1) {
+        flags = kSecAccessControlUserPresence;
+    }
     SecAccessControlRef access = SecAccessControlCreateWithFlags(
         kCFAllocatorDefault,
         kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
-        kSecAccessControlBiometryCurrentSet,
+        flags,
         &error
     );
 
@@ -330,6 +391,7 @@ void IOSStorageAdapterCpp::setSecureBiometric(const std::string& key, const std:
     if (status != errSecSuccess) {
         throw std::runtime_error("NitroStorage: Biometric set failed with status " + std::to_string(status));
     }
+    markBiometricKeySet(key);
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::string& key) {
@@ -357,6 +419,7 @@ void IOSStorageAdapterCpp::deleteSecureBiometric(const std::string& key) {
     NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     SecItemDelete((__bridge CFDictionaryRef)query);
+    markBiometricKeyRemoved(key);
 }
 
 bool IOSStorageAdapterCpp::hasSecureBiometric(const std::string& key) {
@@ -376,6 +439,67 @@ void IOSStorageAdapterCpp::clearSecureBiometric() {
         query[(__bridge id)kSecAttrAccessGroup] = group;
     }
     SecItemDelete((__bridge CFDictionaryRef)query);
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    biometricKeysCache_.clear();
+}
+
+void IOSStorageAdapterCpp::ensureSecureKeyCacheHydrated() {
+    {
+        std::lock_guard<std::mutex> lock(secureKeysMutex_);
+        if (secureKeyCacheHydrated_) {
+            return;
+        }
+    }
+
+    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    const std::vector<std::string> secureKeys = keychainAccountsForService(kKeychainService, group);
+    const std::vector<std::string> biometricKeys = keychainAccountsForService(kBiometricKeychainService, group);
+
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    secureKeysCache_.clear();
+    biometricKeysCache_.clear();
+    secureKeysCache_.insert(secureKeys.begin(), secureKeys.end());
+    biometricKeysCache_.insert(biometricKeys.begin(), biometricKeys.end());
+    secureKeyCacheHydrated_ = true;
+}
+
+void IOSStorageAdapterCpp::markSecureKeySet(const std::string& key) {
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    if (!secureKeyCacheHydrated_) {
+        return;
+    }
+    secureKeysCache_.insert(key);
+}
+
+void IOSStorageAdapterCpp::markSecureKeyRemoved(const std::string& key) {
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    if (!secureKeyCacheHydrated_) {
+        return;
+    }
+    secureKeysCache_.erase(key);
+}
+
+void IOSStorageAdapterCpp::markBiometricKeySet(const std::string& key) {
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    if (!secureKeyCacheHydrated_) {
+        return;
+    }
+    biometricKeysCache_.insert(key);
+}
+
+void IOSStorageAdapterCpp::markBiometricKeyRemoved(const std::string& key) {
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    if (!secureKeyCacheHydrated_) {
+        return;
+    }
+    biometricKeysCache_.erase(key);
+}
+
+void IOSStorageAdapterCpp::clearSecureKeyCache() {
+    std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    secureKeysCache_.clear();
+    biometricKeysCache_.clear();
+    secureKeyCacheHydrated_ = false;
 }
 
 } // namespace NitroStorage