react-native-nitro-storage 0.4.1 → 0.4.3

package/ios/IOSStorageAdapterCpp.mm

@@ -2,8 +2,6 @@
 #import <Foundation/Foundation.h>
 #import <Security/Security.h>
 #import <LocalAuthentication/LocalAuthentication.h>
-#include <algorithm>
-#include <unordered_set>
 
 namespace NitroStorage {
 
@@ -16,13 +14,22 @@ static NSUserDefaults* NitroDiskDefaults() {
     return defaults ?: [NSUserDefaults standardUserDefaults];
 }
 
+// Prevents the Keychain from showing auth UI. On iOS 14+ kSecUseAuthenticationUIFail is
+// deprecated; the correct replacement is an LAContext with interactionNotAllowed = YES.
+static void disableKeychainInteraction(NSMutableDictionary* query) {
+    LAContext* ctx = [[LAContext alloc] init];
+    ctx.interactionNotAllowed = YES;
+    query[(__bridge id)kSecUseAuthenticationContext] = ctx;
+}
+
 static CFStringRef accessControlAttr(int level) {
     switch (level) {
         case 1: return kSecAttrAccessibleAfterFirstUnlock;
         case 2: return kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly;
         case 3: return kSecAttrAccessibleWhenUnlockedThisDeviceOnly;
         case 4: return kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly;
-        default: return kSecAttrAccessibleWhenUnlocked;
+        case 0: return kSecAttrAccessibleWhenUnlocked;
+        default: return kSecAttrAccessibleAfterFirstUnlock;
     }
 }
 
@@ -36,7 +43,10 @@ void IOSStorageAdapterCpp::setDisk(const std::string& key, const std::string& va
     NSString* nsValue = [NSString stringWithUTF8String:value.c_str()];
     NSUserDefaults* defaults = NitroDiskDefaults();
     [defaults setObject:nsValue forKey:nsKey];
-    [[NSUserDefaults standardUserDefaults] removeObjectForKey:nsKey];
+    NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
+    if ([standard objectForKey:nsKey] != nil) {
+        [standard removeObjectForKey:nsKey];
+    }
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getDisk(const std::string& key) {
@@ -61,16 +71,22 @@ std::optional<std::string> IOSStorageAdapterCpp::getDisk(const std::string& key)
 void IOSStorageAdapterCpp::deleteDisk(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
     [NitroDiskDefaults() removeObjectForKey:nsKey];
-    [[NSUserDefaults standardUserDefaults] removeObjectForKey:nsKey];
+    NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
+    if ([standard objectForKey:nsKey] != nil) {
+        [standard removeObjectForKey:nsKey];
+    }
 }
 
 bool IOSStorageAdapterCpp::hasDisk(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    return [NitroDiskDefaults() objectForKey:nsKey] != nil;
+    if ([NitroDiskDefaults() objectForKey:nsKey] != nil) return true;
+    // Check legacy standardUserDefaults for un-migrated keys
+    return [[NSUserDefaults standardUserDefaults] stringForKey:nsKey] != nil;
 }
 
 std::vector<std::string> IOSStorageAdapterCpp::getAllKeysDisk() {
-    NSDictionary<NSString*, id>* entries = [NitroDiskDefaults() dictionaryRepresentation];
+    NSUserDefaults* defaults = NitroDiskDefaults();
+    NSDictionary<NSString*, id>* entries = [defaults persistentDomainForName:kDiskSuiteName] ?: @{};
     std::vector<std::string> keys;
     keys.reserve(entries.count);
     for (NSString* key in entries) {
@@ -92,7 +108,8 @@ std::vector<std::string> IOSStorageAdapterCpp::getKeysByPrefixDisk(const std::st
 }
 
 size_t IOSStorageAdapterCpp::sizeDisk() {
-    return [NitroDiskDefaults() dictionaryRepresentation].count;
+    NSDictionary<NSString*, id>* entries = [NitroDiskDefaults() persistentDomainForName:kDiskSuiteName] ?: @{};
+    return entries.count;
 }
 
 void IOSStorageAdapterCpp::setDiskBatch(
@@ -100,11 +117,18 @@ void IOSStorageAdapterCpp::setDiskBatch(
     const std::vector<std::string>& values
 ) {
     NSUserDefaults* defaults = NitroDiskDefaults();
+    NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
+    NSMutableArray* legacyKeysToRemove = [NSMutableArray array];
     for (size_t i = 0; i < keys.size() && i < values.size(); ++i) {
         NSString* nsKey = [NSString stringWithUTF8String:keys[i].c_str()];
         NSString* nsValue = [NSString stringWithUTF8String:values[i].c_str()];
         [defaults setObject:nsValue forKey:nsKey];
-        [[NSUserDefaults standardUserDefaults] removeObjectForKey:nsKey];
+        if ([standard objectForKey:nsKey] != nil) {
+            [legacyKeysToRemove addObject:nsKey];
+        }
+    }
+    for (NSString* key in legacyKeysToRemove) {
+        [standard removeObjectForKey:key];
     }
 }
 
@@ -127,7 +151,7 @@ void IOSStorageAdapterCpp::deleteDiskBatch(const std::vector<std::string>& keys)
 
 void IOSStorageAdapterCpp::clearDisk() {
     NSUserDefaults* defaults = NitroDiskDefaults();
-    NSDictionary<NSString*, id>* entries = [defaults dictionaryRepresentation];
+    NSDictionary<NSString*, id>* entries = [defaults persistentDomainForName:kDiskSuiteName] ?: @{};
     for (NSString* key in entries) {
         [defaults removeObjectForKey:key];
     }
@@ -162,15 +186,31 @@ static NSMutableDictionary* allAccountsQuery(NSString* service, NSString* access
 
 static std::vector<std::string> keychainAccountsForService(NSString* service, NSString* accessGroup) {
     NSMutableDictionary* query = allAccountsQuery(service, accessGroup);
+    disableKeychainInteraction(query);
     CFTypeRef result = NULL;
     std::vector<std::string> keys;
-    if (SecItemCopyMatching((__bridge CFDictionaryRef)query, &result) == errSecSuccess && result) {
-        NSArray* items = (__bridge_transfer NSArray*)result;
-        keys.reserve(items.count);
-        for (NSDictionary* item in items) {
-            NSString* account = item[(__bridge id)kSecAttrAccount];
-            if (account) {
-                keys.push_back(std::string([account UTF8String]));
+    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
+    if (status == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
+    if (status == errSecSuccess && result) {
+        id items = (__bridge_transfer id)result;
+        NSArray* itemArray = nil;
+        if ([items isKindOfClass:[NSArray class]]) {
+            itemArray = (NSArray*)items;
+        } else if ([items isKindOfClass:[NSDictionary class]]) {
+            itemArray = @[(NSDictionary*)items];
+        }
+        if (itemArray) {
+            keys.reserve(itemArray.count);
+            for (NSDictionary* item in itemArray) {
+                NSString* account = item[(__bridge id)kSecAttrAccount];
+                if (account) {
+                    keys.push_back(std::string([account UTF8String]));
+                }
             }
         }
     }
@@ -180,7 +220,14 @@ static std::vector<std::string> keychainAccountsForService(NSString* service, NS
 void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string& value) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
     NSData* data = [[NSString stringWithUTF8String:value.c_str()] dataUsingEncoding:NSUTF8StringEncoding];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    int accessControlLevel;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+        accessControlLevel = accessControlLevel_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
 
     NSDictionary* updateAttributes = @{
@@ -196,9 +243,15 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
 
     if (status == errSecItemNotFound) {
         query[(__bridge id)kSecValueData] = data;
-        query[(__bridge id)kSecAttrAccessible] = (__bridge id)accessControlAttr(accessControlLevel_);
+        query[(__bridge id)kSecAttrAccessible] = (__bridge id)accessControlAttr(accessControlLevel);
         const OSStatus addStatus = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
         if (addStatus != errSecSuccess) {
+            if (addStatus == errSecInteractionNotAllowed) {
+                throw std::runtime_error(
+                    "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+                    "The item is not accessible until the device is unlocked."
+                );
+            }
             throw std::runtime_error(
                 "NitroStorage: Secure set failed with status " + std::to_string(addStatus)
             );
@@ -207,6 +260,12 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
         return;
     }
 
+    if (status == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
     throw std::runtime_error(
         "NitroStorage: Secure set failed with status " + std::to_string(status)
     );
@@ -214,39 +273,81 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
 
 std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
     query[(__bridge id)kSecReturnData] = @YES;
     query[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitOne;
+    disableKeychainInteraction(query);
 
     CFTypeRef result = NULL;
-    if (SecItemCopyMatching((__bridge CFDictionaryRef)query, &result) == errSecSuccess && result) {
+    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
+    if (status == errSecSuccess && result) {
         NSData* data = (__bridge_transfer NSData*)result;
         NSString* str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
         if (str) return std::string([str UTF8String]);
     }
+    if (status == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
     return std::nullopt;
 }
 
 void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+
     NSMutableDictionary* secureQuery = baseKeychainQuery(nsKey, kKeychainService, group);
-    SecItemDelete((__bridge CFDictionaryRef)secureQuery);
+    OSStatus secureStatus = SecItemDelete((__bridge CFDictionaryRef)secureQuery);
+    if (secureStatus == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
+
     NSMutableDictionary* biometricQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
-    SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
+    OSStatus biometricStatus = SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
+    if (biometricStatus == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
+
+    // errSecItemNotFound means the item was already gone — that's fine (idempotent).
+    // Only update the cache if the delete actually ran (success or item-not-found).
     markSecureKeyRemoved(key);
     markBiometricKeyRemoved(key);
 }
 
 bool IOSStorageAdapterCpp::hasSecure(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* secureQuery = baseKeychainQuery(nsKey, kKeychainService, group);
+    disableKeychainInteraction(secureQuery);
     if (SecItemCopyMatching((__bridge CFDictionaryRef)secureQuery, NULL) == errSecSuccess) {
         return true;
     }
     NSMutableDictionary* biometricQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
+    disableKeychainInteraction(biometricQuery);
     return SecItemCopyMatching((__bridge CFDictionaryRef)biometricQuery, NULL) == errSecSuccess;
 }
 
@@ -310,7 +411,12 @@ void IOSStorageAdapterCpp::deleteSecureBatch(const std::vector<std::string>& key
 }
 
 void IOSStorageAdapterCpp::clearSecure() {
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* secureQuery = [@{
         (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
         (__bridge id)kSecAttrService: kKeychainService
@@ -318,7 +424,14 @@ void IOSStorageAdapterCpp::clearSecure() {
     if (group && group.length > 0) {
         secureQuery[(__bridge id)kSecAttrAccessGroup] = group;
     }
-    SecItemDelete((__bridge CFDictionaryRef)secureQuery);
+    OSStatus secStatus = SecItemDelete((__bridge CFDictionaryRef)secureQuery);
+    if (secStatus != errSecSuccess && secStatus != errSecItemNotFound) {
+        if (secStatus == errSecInteractionNotAllowed) {
+            throw std::runtime_error("NitroStorage: Cannot clear secure storage: keychain is locked (errSecInteractionNotAllowed)");
+        }
+        throw std::runtime_error(
+            std::string("NitroStorage: clearSecure failed with status ") + std::to_string(secStatus));
+    }
 
     NSMutableDictionary* biometricQuery = [@{
         (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
@@ -327,13 +440,21 @@ void IOSStorageAdapterCpp::clearSecure() {
     if (group && group.length > 0) {
         biometricQuery[(__bridge id)kSecAttrAccessGroup] = group;
     }
-    SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
-    clearSecureKeyCache();
+    OSStatus bioStatus = SecItemDelete((__bridge CFDictionaryRef)biometricQuery);
+    if (bioStatus != errSecSuccess && bioStatus != errSecItemNotFound) {
+        if (bioStatus == errSecInteractionNotAllowed) {
+            throw std::runtime_error("NitroStorage: Cannot clear biometric storage: keychain is locked (errSecInteractionNotAllowed)");
+        }
+        throw std::runtime_error(
+            std::string("NitroStorage: clearSecureBiometric failed with status ") + std::to_string(bioStatus));
+    }
+    clearSecureKeyCache();  // Only clears cache AFTER confirmed deletion
 }
 
 // --- Configuration ---
 
 void IOSStorageAdapterCpp::setSecureAccessControl(int level) {
+    std::lock_guard<std::mutex> lock(accessGroupMutex_);
     accessControlLevel_ = level;
 }
 
@@ -342,8 +463,12 @@ void IOSStorageAdapterCpp::setSecureWritesAsync(bool /*enabled*/) {
 }
 
 void IOSStorageAdapterCpp::setKeychainAccessGroup(const std::string& group) {
+    std::lock_guard<std::mutex> lock1(accessGroupMutex_);
+    std::lock_guard<std::mutex> lock2(secureKeysMutex_);
     keychainAccessGroup_ = group;
-    clearSecureKeyCache();
+    secureKeysCache_.clear();
+    biometricKeysCache_.clear();
+    secureKeyCacheHydrated_ = false;
 }
 
 // --- Biometric (separate Keychain service with biometric ACL) ---
@@ -353,14 +478,41 @@ void IOSStorageAdapterCpp::setSecureBiometric(const std::string& key, const std:
 }
 
 void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, const std::string& value, int level) {
+    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSData* data = [[NSString stringWithUTF8String:value.c_str()] dataUsingEncoding:NSUTF8StringEncoding];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+
     if (level == 0) {
+        // Delete any existing biometric keychain entry for this key
+        NSMutableDictionary* deleteQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
+        SecItemDelete((__bridge CFDictionaryRef)deleteQuery);
+        markBiometricKeyRemoved(key);
+
         setSecure(key, value);
         return;
     }
 
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSData* data = [[NSString stringWithUTF8String:value.c_str()] dataUsingEncoding:NSUTF8StringEncoding];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    // Capture backup before delete — must not prompt for auth
+    std::optional<std::string> backup = std::nullopt;
+    {
+        NSMutableDictionary* backupQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
+        backupQuery[(__bridge id)kSecReturnData] = @YES;
+        backupQuery[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitOne;
+        disableKeychainInteraction(backupQuery);
+        CFTypeRef backupResult = NULL;
+        if (SecItemCopyMatching((__bridge CFDictionaryRef)backupQuery, &backupResult) == errSecSuccess && backupResult) {
+            NSData* bData = (__bridge_transfer NSData*)backupResult;
+            NSString* str = [[NSString alloc] initWithData:bData encoding:NSUTF8StringEncoding];
+            if (str) backup = std::string([str UTF8String]);
+        } else if (backupResult) {
+            CFRelease(backupResult);
+        }
+    }
 
     // Delete existing item first (access control can't be updated in place)
     NSMutableDictionary* deleteQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
@@ -380,6 +532,7 @@ void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, c
 
     if (error || !access) {
         if (access) CFRelease(access);
+        if (error) CFRelease(error);
         throw std::runtime_error("NitroStorage: Failed to create biometric access control");
     }
 
@@ -387,16 +540,40 @@ void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, c
     attrs[(__bridge id)kSecValueData] = data;
     attrs[(__bridge id)kSecAttrAccessControl] = (__bridge_transfer id)access;
 
-    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)attrs, NULL);
-    if (status != errSecSuccess) {
-        throw std::runtime_error("NitroStorage: Biometric set failed with status " + std::to_string(status));
+    OSStatus addStatus = SecItemAdd((__bridge CFDictionaryRef)attrs, NULL);
+    if (addStatus != errSecSuccess) {
+        if (backup.has_value()) {
+            try {
+                setSecure(key, *backup);
+            } catch (const std::exception& restoreEx) {
+                throw std::runtime_error(
+                    std::string("NitroStorage: Biometric set failed with status ") +
+                    std::to_string(addStatus) +
+                    " and previous value restoration also failed: " + restoreEx.what());
+            }
+        }
+        if (addStatus == errSecInteractionNotAllowed) {
+            throw std::runtime_error(
+                "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+                "The item is not accessible until the device is unlocked."
+            );
+        }
+        throw std::runtime_error(
+            std::string("NitroStorage: Biometric set failed with status ") +
+            std::to_string(addStatus) +
+            (backup.has_value() ? " (previous value restored to non-biometric keychain)" : " (no previous value)"));
     }
     markBiometricKeySet(key);
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     query[(__bridge id)kSecReturnData] = @YES;
     query[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitOne;
@@ -408,6 +585,12 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::s
         NSString* str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
         if (str) return std::string([str UTF8String]);
     }
+    if (status == errSecInteractionNotAllowed) {
+        throw std::runtime_error(
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
     if (status == errSecUserCanceled || status == errSecAuthFailed) {
         throw std::runtime_error("NitroStorage: Biometric authentication failed");
     }
@@ -416,7 +599,12 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::s
 
 void IOSStorageAdapterCpp::deleteSecureBiometric(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     SecItemDelete((__bridge CFDictionaryRef)query);
     markBiometricKeyRemoved(key);
@@ -424,13 +612,24 @@ void IOSStorageAdapterCpp::deleteSecureBiometric(const std::string& key) {
 
 bool IOSStorageAdapterCpp::hasSecureBiometric(const std::string& key) {
     NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
+    disableKeychainInteraction(query);
     return SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL) == errSecSuccess;
 }
 
 void IOSStorageAdapterCpp::clearSecureBiometric() {
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     NSMutableDictionary* query = [@{
         (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
         (__bridge id)kSecAttrService: kBiometricKeychainService
@@ -438,24 +637,40 @@ void IOSStorageAdapterCpp::clearSecureBiometric() {
     if (group && group.length > 0) {
         query[(__bridge id)kSecAttrAccessGroup] = group;
     }
-    SecItemDelete((__bridge CFDictionaryRef)query);
-    std::lock_guard<std::mutex> lock(secureKeysMutex_);
-    biometricKeysCache_.clear();
+    OSStatus status = SecItemDelete((__bridge CFDictionaryRef)query);
+    if (status != errSecSuccess && status != errSecItemNotFound) {
+        if (status == errSecInteractionNotAllowed) {
+            throw std::runtime_error("NitroStorage: Cannot clear biometric storage: keychain is locked (errSecInteractionNotAllowed)");
+        }
+        throw std::runtime_error(
+            std::string("NitroStorage: clearSecureBiometric failed with status ") + std::to_string(status));
+    }
+    {
+        std::lock_guard<std::mutex> lock(secureKeysMutex_);
+        biometricKeysCache_.clear();
+    }
 }
 
 void IOSStorageAdapterCpp::ensureSecureKeyCacheHydrated() {
     {
         std::lock_guard<std::mutex> lock(secureKeysMutex_);
-        if (secureKeyCacheHydrated_) {
-            return;
-        }
+        if (secureKeyCacheHydrated_) return;
+    }
+
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
     }
+    NSString* nsGroup = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
 
-    NSString* group = keychainAccessGroup_.empty() ? nil : [NSString stringWithUTF8String:keychainAccessGroup_.c_str()];
-    const std::vector<std::string> secureKeys = keychainAccountsForService(kKeychainService, group);
-    const std::vector<std::string> biometricKeys = keychainAccountsForService(kBiometricKeychainService, group);
+    // These can throw errSecInteractionNotAllowed — let the exception propagate
+    // so the cache is NOT marked hydrated (will be retried on next access)
+    const std::vector<std::string> secureKeys = keychainAccountsForService(kKeychainService, nsGroup);
+    const std::vector<std::string> biometricKeys = keychainAccountsForService(kBiometricKeychainService, nsGroup);
 
     std::lock_guard<std::mutex> lock(secureKeysMutex_);
+    if (secureKeyCacheHydrated_) return;
     secureKeysCache_.clear();
     biometricKeysCache_.clear();
     secureKeysCache_.insert(secureKeys.begin(), secureKeys.end());