Release v3.3.1

This reverts commit 5dba1db93d.

Fixes #1544

.crowdin/config.example.yml

@@ -0,0 +1,10 @@
+project_id: "372633"
+api_token: "<api-token-here>"
+base_path: "../app/src/main"
+base_url: "https://api.crowdin.com"
+preserve_hierarchy: true
+
+files:
+- source: "res/values/strings.xml"
+  dest: "strings.xml"
+  translation: "res/values-%android_code%/%original_file_name%"

.github/FUNDING.yml

@@ -1 +1,4 @@
-custom: ['https://www.buymeacoffee.com/beemdevelopment']
+buy_me_a_coffee: beemdevelopment
+custom:
+  - "https://www.blockchain.com/btc/address/bc1q26kyxqjkc6tu477pzy0whagwhs4ypv93qls22n"
+  - "https://nanocrawler.cc/explorer/account/nano_1aegisc559b1x4p3839egnu579jkd4htpidy14eo9e31gzqmwuafypnj4q94"

.github/ISSUE_TEMPLATE/bug.md

@@ -1,34 +0,0 @@
----
-name: "Bug report"
-about: "Create a report to help us fix a bug"
-labels: bug
----
-
-<!-- Please read the [bug reports section of the contribution
-guidelines](/CONTRIBUTING.md#bug-reports) before submitting an issue. -->
-
-###### Info
-
-* __Version__: 
-* __Source__: (Google Play/GitHub/F-Droid/?)
-* __Vault encrypted:__ Yes (with biometric unlock)/Yes/No
-* __Device:__
-* __Android version and ROM:__
-
-###### Steps to reproduce
-
-A detailed list of reproduction steps.
-
-###### What do you expect to happen?
-
-...
-
-###### What happens instead?
-
-...
-
-###### Log
-
-```
-If applicable, paste the debug log here.
-```

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,89 @@
+name: Bug Report
+description: Create a report to help us fix a bug
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please read the [bug reports section of the contribution guidelines](https://github.com/beemdevelopment/Aegis/blob/master/CONTRIBUTING.md#bug-reports) before submitting an issue.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Which version of Aegis are you using?
+      placeholder: "Example: v2.1"
+    validations:
+      required: true
+  - type: dropdown
+    id: source
+    attributes:
+      label: Source
+      description: Where did you get Aegis from?
+      options:
+        - Google Play
+        - F-Droid
+        - GitHub
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: encryption
+    attributes:
+      label: Vault encryption
+      description: Do you have encryption enabled for your Aegis vault?
+      options:
+        - "Yes (with biometric unlock)"
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+  - type: input
+    id: device
+    attributes:
+      label: Device
+      description: Which device are you using Aegis on?
+      placeholder: "Example: Pixel 5"
+    validations:
+      required: true
+  - type: input
+    id: android_version
+    attributes:
+      label: Android version
+      description: Which Android version is running on your device?
+      placeholder: "Example: Android 13"
+    validations:
+      required: true
+  - type: input
+    id: rom
+    attributes:
+      label: ROM
+      description: Are you using a custom ROM? If so, which one and which version? If you're using the stock OS that came with your device, you can leave this field empty.
+      placeholder: "Example: GrapheneOS"
+    validations:
+      required: false
+  - type: textarea
+    id: reproduction_steps
+    attributes:
+      label: Steps to reproduce
+      description: A detailed list of reproduction steps.
+    validations:
+      required: true
+  - type: textarea
+    id: expectations
+    attributes:
+      label: What do you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: reality
+    attributes:
+      label: What happens instead?
+    validations:
+      required: true
+  - type: textarea
+    id: log
+    attributes:
+      label: Log
+      description: If applicable, paste the debug log that you captured using ADB here.
+    validations:
+      required: false

.github/workflows/build-app-workflow.yaml

@@ -0,0 +1,63 @@
+name: build
+on: [pull_request, push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v4
+      - name: Validate Gradle wrapper
+        uses: gradle/wrapper-validation-action@699bb18358f12c5b78b37bb0111d3a0e2276e0e2
+      - uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: 'gradle'
+      - name: Build the app
+        run: ./gradlew build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: apk
+          path: app/build/outputs/apk/debug/app-debug.apk
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: 'gradle'
+      - name: Enable KVM group perms
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - name: Tests
+        uses: reactivecircus/android-emulator-runner@6b0df4b0efb23bb0ec63d881db79aefbc976e4b2
+        with:
+          api-level: 31
+          arch: x86_64
+          profile: pixel_3a
+          heap-size: 512M
+          ram-size: 4096M
+          emulator-options: -memory 4096 -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
+          disable-animations: true
+          disk-size: 8G
+          script: |
+            mkdir -p artifacts/report
+            adb logcat -c
+            adb logcat -G 16M && adb logcat -g
+            ./gradlew connectedCheck || touch tests_failing
+            adb logcat -d > artifacts/logcat.txt
+            cp -r app/build/reports/androidTests/connected/* artifacts/report/
+            if adb shell '[ -e /sdcard/Pictures/screenshots ]'; then adb pull /sdcard/Pictures/screenshots artifacts/; fi
+            test ! -f tests_failing
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: instrumented-test-report
+          path: |
+            artifacts/*
+          if-no-files-found: ignore

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,41 @@
+name: codeql
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: '25 16 * * 2'
+jobs:
+  analyze:
+    name: analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Exclude paths
+      # The importers are excluded from analysis, because some of the apps Aegis
+      # can import from don't have such great crypto, which will cause false
+      # positive security alerts.
+      run: |
+        find app/src/main/java/com/beemdevelopment/aegis/importers ! \( -name AegisImporter.java -o -name "DatabaseImporter*" \) -type f -exec rm -f {} +
+        sed -i '/Importer.class/d' app/src/main/java/com/beemdevelopment/aegis/importers/DatabaseImporter.java
+    - uses: actions/setup-java@v4
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+        cache: 'gradle'
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: java
+    - name: Build
+      run: ./gradlew assembleDebug
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/crowdin.yml

@@ -0,0 +1,31 @@
+name: crowdin
+on:
+  push:
+    branches:
+      - master
+# run sequentially (per branch)
+concurrency: "crowdin-upload-${{ github.ref }}"
+jobs:
+  upload-sources:
+    runs-on: ubuntu-latest
+    if: github.repository == 'beemdevelopment/Aegis'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install crowdin-cli
+        run: |
+          wget https://github.com/crowdin/crowdin-cli/releases/download/3.7.2/crowdin-cli.zip
+          echo "ee9f838b819ccedc33c9b2537055e5ba7d7934561b24df1e1a6274cbd6e27f2d  crowdin-cli.zip" | sha256sum -c
+          unzip crowdin-cli.zip -d crowdin-cli
+      - name: Upload to Crowdin
+        env:
+          CROWDIN_TOKEN: "${{ secrets.CROWDIN_TOKEN }}"
+        run: |
+          java -jar ./crowdin-cli/3.7.2/crowdin-cli.jar upload sources \
+            --no-progress \
+            --token "$CROWDIN_TOKEN" \
+            --project-id 372633 \
+            --base-path app/src/main \
+            --source res/values/strings.xml \
+            --translation "res/values-%android_code%/%original_file_name%" \
+            --dest strings.xml \
+            --branch master

.gitignore

@@ -40,3 +40,4 @@ captures/
 # Keystore files
 *.jks
 crowdin.properties
+.crowdin/config.yml

.travis.yml

@@ -1,24 +0,0 @@
-language: shell
-os: linux
-dist: bionic
-env:
-  global:
-    - ANDROID_HOME=${HOME}/android
-    - ANDROID_SDK_ROOT=${ANDROID_HOME}
-    - TOOLS=${ANDROID_HOME}/cmdline-tools
-    - PATH=${ANDROID_HOME}/emulator:${TOOLS}/tools/bin:${ANDROID_HOME}/platform-tools:${PATH}
-before_install:
-  - mkdir -p ${ANDROID_HOME}/licenses
-  - echo "8933bad161af4178b1185d1a37fbf41ea5269c55" > ${ANDROID_HOME}/licenses/android-sdk-license
-  - echo "d56f5187479451eabf01fb78af6dfcb131a6481e" >> ${ANDROID_HOME}/licenses/android-sdk-license
-  - echo "24333f8a63b6825ea9c5514f83c2829b004d1fee" >> ${ANDROID_HOME}/licenses/android-sdk-license
-install:
-  - mkdir -p ${TOOLS}
-  - travis_retry wget https://dl.google.com/android/repository/commandlinetools-linux-6514223_latest.zip -O ${TOOLS}/tools.zip
-  - unzip ${TOOLS}/tools.zip -d ${TOOLS}
-  - yes | travis_retry sdkmanager "platform-tools" > /dev/null
-  - yes | travis_retry sdkmanager "tools" > /dev/null
-  - yes | travis_retry sdkmanager "build-tools;30.0.1" > /dev/null
-  - yes | travis_retry sdkmanager "platforms;android-30" > /dev/null
-script:
-  - ./gradlew assemble check

CONTRIBUTING.md

@@ -4,11 +4,14 @@ Looking to contribute to Aegis? That's great! There are a couple of ways to help
 out. This document contains some general guidelines for each type of
 contribution.
 
+Please review [the FAQ](FAQ.md) before reporting a bug, asking a question or
+requesting a feature.
+
 ## Translations
 
 We use [Crowdin](https://crowdin.com/project/aegis-authenticator) to crowdsource
 translations of Aegis for lots of different languages. __Pull requests that
-add/update a translation are not longer accepted.__ Crowdin is our single source
+add/update a translation are no longer accepted.__ Crowdin is our single source
 of truth for translations, to keep things easy to maintain.
 
 The top 30 languages are available for translation. It's possible that yours is
@@ -27,10 +30,9 @@ requests.
 ## Bug reports
 
 We use GitHub's issue tracker to track bugs. To make bug reports easier to
-follow up on for us, they must follow [the
-template](.github/ISSUE_TEMPLATE/bug.md). If a bug report does not follow the
-template and does not contain enough information, it will be closed. Duplicate
-bug reports receive the same treatment.
+follow up on for us, please fill out the form as accurately as possible. If a
+bug report does not contain enough information, it will be closed. Duplicate bug
+reports receive the same treatment.
 
 Please consider trying to find the root cause yourself first and include your
 analysis of the issue in your report. Perhaps even send us a patch that fixes
@@ -96,7 +98,7 @@ __On your PC__:
 
     ```
     adb logcat -c
-    adb logcat -f debug.log
+    adb logcat > debug.log
     ```
 
     The logcat command captures the full system log by default, which may expose
@@ -106,8 +108,9 @@ __On your PC__:
     one below:
 
     ```sh
-    adb logcat --pid=$(adb shell pidof -s com.beemdevelopment.aegis) -f debug.log
+    adb logcat --pid=$(adb shell pidof -s com.beemdevelopment.aegis) > debug.log
     ```
+
     _If you are using a debug APK, replace ``com.beemdevelopment.aegis`` with
    ``com.beemdevelopment.aegis.debug``._
 

FAQ.md

@@ -0,0 +1,101 @@
+# FAQ
+
+## General
+
+### How can I contribute?
+
+There are lots of ways! Please refer to our [contributing
+guide](https://github.com/beemdevelopment/Aegis/blob/master/CONTRIBUTING.md).
+
+### Why is the latest version not on F-Droid yet?
+
+We don't release new versions of Aegis on F-Droid ourselves. Once we've released
+a new version on GitHub, F-Droid will usually kick off their automatic build
+process a day later and publish the app to their repository a couple of days
+afterwards. It can sometimes take up to a week for a new version to appear on
+F-Droid.
+
+### Can you port Aegis to iOS/Windows/MacOS/Browser Extension?
+
+We don't have plans to port Aegis to other platforms.
+
+### Can you add support for Autofill?
+
+On Android, only one app can be active in the Autofill slot at a time, and since
+this is typically occupied by the password manager, we don't see much value in
+adding support for this feature in Aegis.
+
+### What is the difference between exporting and backing up?
+
+Exporting is done manually and backups are done automatically. The format of the
+vault file is exactly the same for both.
+
+## Security
+
+### I can no longer use biometrics to unlock the app. What should I do?
+
+If you could previously unlock Aegis with biometrics, but suddenly can't do so
+anymore, this is probably caused by a change made to the security settings of
+your device. The app will tell you when this happened in most cases. To resolve
+this, unlock the app with your password, disable biometric unlock in the
+settings of Aegis and re-enable it.
+
+### Why does Aegis keep prompting me for my password, even though I have enabled biometric authentication?
+
+You're probably encountering the password reminder. Try entering your password
+to unlock the vault once. After that, Aegis will prompt for biometrics by
+default again until it's time for another password reminder.
+
+Since forgetting your password will result in loss of access to the contents of
+the vault, __we do NOT recommend disabling the password reminder__.
+
+### Aegis uses SHA1 for most/all of my tokens. Isn't that insecure?
+
+The hash algorithm is imposed by the service you're setting up 2FA for (e.g.
+Google, Facebook, GitHub, etc). There is nothing we can do about that. If we
+were to change this on Aegis' end, the tokens would stop working. Furthermore,
+when using SHA1 in an HMAC calculation, the currently known issues in SHA1 are
+not of concern.
+
+### Why doesn't Aegis support biometric unlock for my device, even though it works with other apps?
+
+The reason for this is pretty technical. In short, since you're not entering
+your password when using biometric unlock, Aegis needs some other way to decrypt
+the vault. For this purpose, we generate and use a key in the Android Keystore,
+telling it to only allow us to use that key if the user authenticates using
+their biometrics first. Some devices have buggy implementations of this feature,
+resulting in the error displayed to you by Aegis in an error dialog.
+
+If biometrics works with other apps, but not with Aegis, that means those other
+apps probably perform a weaker form of biometric authentication.
+
+## Backups
+
+### How can I back up my Aegis vault to the cloud automatically?
+
+Aegis can only automatically back up to the cloud if the app of your cloud
+provider is installed on your device and fully participates in the Android
+Storage Access Framework. Aegis doesn't have access to the internet and we don't
+have plans to change this, so adding support for specific cloud providers in the
+app is not possible.
+
+Cloud providers currently known to be supported:
+- Nextcloud
+
+Another common setup is to configure Aegis to back up to a folder on local
+storage of your device and then have a separate app (like
+[Syncthing](https://syncthing.net/)) sync that folder anywhere you want.
+
+## Importing
+
+### When importing from Authenticator Plus, an error is shown claiming that Accounts.txt is missing
+
+Make sure you supply an Authenticator Plus export file obtained through
+__Settings -> Backup & Restore -> Export as Text and HTML__. The ``.db`` format
+is not supported.
+
+If it still doesn't work, please report the issue to us. As a temporary
+workaround, you can try extracting the ZIP archive on a computer, recreating it
+without a password and then importing that into Aegis. Another option is
+extracting the ZIP archive on a computer and importing the resulting
+Accounts.txt file into Aegis with the "Plain text" import option.

README.md

@@ -1,14 +1,20 @@
 <img align="left" width="80" height="80" src="metadata/en-US/images/icon.png"
 alt="App icon">
 
-# Aegis Authenticator [![CI](https://api.travis-ci.org/beemdevelopment/Aegis.svg?branch=master)](https://travis-ci.org/github/beemdevelopment/aegis) [![Crowdin](https://badges.crowdin.net/aegis-authenticator/localized.svg)](https://crowdin.com/project/aegis-authenticator) [![Donate](https://img.shields.io/badge/donate-buy%20us%20a%20beer-%23FF813F)](https://www.buymeacoffee.com/beemdevelopment) [![Matrix](https://img.shields.io/badge/chat-Matrix-blue)](https://matrix.to/#/#aegis:matrix.org)
+# Aegis Authenticator
 
-__Aegis Authenticator__ is a free, secure and open source 2FA app for Android.
+<br>
+
+[![Build](https://github.com/beemdevelopment/Aegis/actions/workflows/build-app-workflow.yaml/badge.svg)](https://github.com/beemdevelopment/Aegis/actions/workflows/build-app-workflow.yaml?query=branch%3Amaster) [![Crowdin](https://badges.crowdin.net/aegis-authenticator/localized.svg)](https://crowdin.com/project/aegis-authenticator) [![Donate](https://img.shields.io/badge/donate-buy%20us%20a%20beer-%23FF813F)](https://www.buymeacoffee.com/beemdevelopment) [![Matrix](https://img.shields.io/matrix/aegis:matrix.org?color=blue)](https://matrix.to/#/#aegis:matrix.org)
+
+**Aegis Authenticator** is a free, secure and open source 2FA app for Android.
 It aims to provide a secure authenticator for your online services, while also
 including some features missing in existing authenticator apps, like proper
 encryption and backups. Aegis supports HOTP and TOTP, making it compatible with
 thousands of services.
 
+For a list of frequently asked questions, please check out [the FAQ](FAQ.md).
+
 The security design of the app and the vault format is described in detail in
 [this document](docs/vault.md).
 
@@ -28,10 +34,10 @@ The security design of the app and the vault format is described in detail in
 - Lots of ways to add new entries
   - Scan a QR code or an image of one
   - Enter details manually
-  - Import from other authenticator apps: Authenticator Plus, Authy, andOTP,
-    FreeOTP, FreeOTP+, Google Authenticator, Microsoft Authenticator, Plain
-    text, Steam, TOTP Authenticator and WinAuth (root access is required for
-    some of these)
+  - Import from other authenticator apps: 2FAS Authenticator, Authenticator
+    Plus, Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator, Microsoft
+    Authenticator, Plain text, Steam, TOTP Authenticator and WinAuth (root
+    access is required for some of these)
 - Organization
   - Alphabetic/custom sorting
   - Custom or automatically generated icons
@@ -47,19 +53,20 @@ The security design of the app and the vault format is described in detail in
 [<img width=200 alt="Screenshot 1"
 src="metadata/en-US/images/phoneScreenshots/screenshot1.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot1.png?raw=true)
 [<img width=200 alt="Screenshot 2"
-src="metadata/en-US/images/phoneScreenshots/screenshot2.png?raw=true">](/metadata/en-US/images/phoneScreenshots/screenshot2.png?raw=true)
+src="metadata/en-US/images/phoneScreenshots/screenshot2.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot2.png?raw=true)
 [<img width=200 alt="Screenshot 3"
-src="metadata/en-US/images/phoneScreenshots/screenshot3.png?raw=true">](/metadata/en-US/images/phoneScreenshots/screenshot3.png?raw=true)
-
+src="metadata/en-US/images/phoneScreenshots/screenshot3.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot3.png?raw=true)
 [<img width=200 alt="Screenshot 4"
 src="metadata/en-US/images/phoneScreenshots/screenshot4.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot4.png?raw=true)
+
 [<img width=200 alt="Screenshot 5"
 src="metadata/en-US/images/phoneScreenshots/screenshot5.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot5.png?raw=true)
 [<img width=200 alt="Screenshot 6"
 src="metadata/en-US/images/phoneScreenshots/screenshot6.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot6.png?raw=true)
-
 [<img width=200 alt="Screenshot 7"
 src="metadata/en-US/images/phoneScreenshots/screenshot7.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot7.png?raw=true)
+[<img width=200 alt="Screenshot 8"
+src="metadata/en-US/images/phoneScreenshots/screenshot8.png?raw=true">](metadata/en-US/images/phoneScreenshots/screenshot8.png?raw=true)
 
 ## Downloads
 
@@ -71,7 +78,7 @@ src="https://play.google.com/intl/en_us/badges/images/generic/en-play-badge.png"
 [<img height="80" alt="Get it on F-Droid"
 src="https://fdroid.gitlab.io/artwork/badge/get-it-on.png"
 />](https://f-droid.org/app/com.beemdevelopment.aegis)
-      
+
 ### Verification
 
 APK releases on Google Play and GitHub are signed using the same key. They can
@@ -103,16 +110,37 @@ Certificate fingerprints:
    SHA256: C6:DB:80:A8:E1:4E:52:30:C1:DE:84:15:EF:82:0D:13:DC:90:1D:8F:E3:3C:F3:AC:B5:7B:68:62:D8:58:A8:23
 ```
 
-### Community
+### Icon packs
 
-- [aegis-icons](https://github.com/krisu5/aegis-icons)
+Aegis supports icon packs to make it easier to assign icons to the entries in
+your vault. There are no official icon packs, but the community maintains a
+number of third-party icon packs you may want to check out. To learn how to
+create your own Aegis-compatible icon pack, see [the
+documentation](docs/iconpacks.md).
 
-  While we're still [working on better icon
-  support](https://github.com/beemdevelopment/Aegis/issues/509) in Aegis, krisu5
-  has started a third-party repository for icons that you may want to check out.
+- [aegis-icons](https://github.com/aegis-icons/aegis-icons)
 
-  [<img width=500 alt="Aegis-icons preview"
-  src="https://raw.githubusercontent.com/krisu5/aegis-icons/master/showcase.png">](https://github.com/krisu5/aegis-icons)
+  Unofficial monochrome-styled 2FA icons.
+
+  [<img width=500 alt="aegis-icons preview"
+  src="https://raw.githubusercontent.com/aegis-icons/aegis-icons/master/showcase.png">](https://github.com/aegis-icons/aegis-icons)
+
+- [delta-aegis-icons](https://github.com/Delta-Icons/aegis-icons)
+
+  Delta version of the unofficial monochrome-styled 2FA icon pack aegis-icons.
+
+- [aegis-simple-icons](https://github.com/alexbakker/aegis-simple-icons) *
+
+  This project periodically generates an icon pack for Aegis based on [Simple
+  Icons](https://simpleicons.org/).
+
+- [aegis-simple-icons-outlined](https://github.com/michaelschattgen/aegis-simple-icons-outlined) *
+
+  This is a variant on the aegis-simple-icons pack where the icons contain no solid background and just the outlines are being used.
+ 
+\* The icons are automatically generated, so
+  not all of them are as high quality as the ones you'll find in
+  [aegis-icons](https://github.com/aegis-icons/aegis-icons).
 
 ## Contributing
 
@@ -127,3 +155,8 @@ Swing by our Matrix room to interact with other contributors:
 
 This project is licensed under the GNU General Public License v3.0. See the
 [LICENSE](LICENSE) file for details.
+
+A couple of libraries vendored in Aegis' repository are licensed under a
+different license:
+- [TextDrawable](app/src/main/java/com/amulyakhare/textdrawable)
+- [TrustedIntents](app/src/main/java/info/guardianproject/trustedintents)

app/build.gradle

@@ -1,5 +1,7 @@
 apply plugin: 'com.android.application'
 apply plugin: 'com.google.protobuf'
+apply plugin: 'dagger.hilt.android.plugin'
+apply plugin: 'com.mikepenz.aboutlibraries.plugin'
 
 def getCmdOutput = { cmd ->
     def stdout = new ByteArrayOutputStream()
@@ -13,68 +15,88 @@ def getCmdOutput = { cmd ->
 def getGitHash = { -> return getCmdOutput(["git", "rev-parse", "--short", "HEAD"]) }
 def getGitBranch = { -> return getCmdOutput(["git", "rev-parse", "--abbrev-ref", "HEAD"]) }
 
-def fileProviderAuthority = "com.beemdevelopment.aegis.fileprovider"
+def packageName = "com.beemdevelopment.aegis"
+def fileProviderAuthority = "${packageName}.fileprovider"
+def fileProviderAuthorityDebug = "${packageName}.debug.fileprovider"
 
 android {
-    compileSdkVersion 30
+    compileSdk 35
+
+    namespace packageName
 
     defaultConfig {
-        applicationId "com.beemdevelopment.aegis"
+        applicationId "${packageName}"
         minSdkVersion 21
-        targetSdkVersion 30
-        versionCode 41
-        versionName "1.4-beta1"
+        targetSdkVersion 35
+        versionCode 74
+        versionName "3.3.1"
         multiDexEnabled true
         buildConfigField "String", "GIT_HASH", "\"${getGitHash()}\""
         buildConfigField "String", "GIT_BRANCH", "\"${getGitBranch()}\""
-        buildConfigField("String", "FILE_PROVIDER_AUTHORITY", "\"${fileProviderAuthority}\"")
-        manifestPlaceholders = [fileProviderAuthority: "${fileProviderAuthority}"]
+        buildConfigField "java.util.concurrent.atomic.AtomicBoolean", "TEST", "new java.util.concurrent.atomic.AtomicBoolean(false)"
+
+        javaCompileOptions {
+            annotationProcessorOptions {
+                arguments = ["room.schemaLocation": "$projectDir/schemas"]
+            }
+        }
 
         testInstrumentationRunner "com.beemdevelopment.aegis.AegisTestRunner"
         testInstrumentationRunnerArguments clearPackageData: 'true'
     }
 
-    lintOptions {
-        abortOnError true
-        disable "MissingTranslation"
-    }
-
     testOptions {
         execution 'ANDROIDX_TEST_ORCHESTRATOR'
 
-        unitTests.all {
-            useJUnitPlatform()
+        unitTests {
+            all {
+                maxHeapSize "3g"
 
-            ignoreFailures false
-            testLogging {
-                events "passed", "skipped", "failed", "standardOut", "standardError"
+                ignoreFailures false
+                testLogging {
+                    events "passed", "skipped", "failed", "standardOut", "standardError"
+
+                    showExceptions true
+                    exceptionFormat "full"
+                    showCauses true
+                    showStackTraces true
+                }
             }
+
+            includeAndroidResources true
         }
     }
 
     buildTypes {
         debug {
             applicationIdSuffix ".debug"
-            manifestPlaceholders = [title: "AegisDev", iconName: "ic_launcher_debug"]
+            manifestPlaceholders = [
+                title: "AegisDev",
+                iconName: "ic_launcher_debug",
+                fileProviderAuthority: "${fileProviderAuthorityDebug}"
+            ]
+            buildConfigField("String", "FILE_PROVIDER_AUTHORITY", "\"${fileProviderAuthorityDebug}\"")
             resValue "bool", "pref_secure_screen_default", "false"
-            postprocessing {
-                removeUnusedCode true
-                removeUnusedResources true
-                obfuscate false
-                optimizeCode false
-                proguardFiles getDefaultProguardFile('proguard-defaults.txt'), 'proguard-rules.pro'
-            }
         }
         release {
-            manifestPlaceholders = [title: "Aegis", iconName: "ic_launcher"]
+            manifestPlaceholders = [
+                title: "Aegis",
+                iconName: "ic_launcher",
+                fileProviderAuthority: "${fileProviderAuthority}"
+            ]
+            buildConfigField("String", "FILE_PROVIDER_AUTHORITY", "\"${fileProviderAuthority}\"")
             resValue "bool", "pref_secure_screen_default", "true"
-            postprocessing {
-                removeUnusedCode true
-                removeUnusedResources true
-                obfuscate false
-                optimizeCode true
-                proguardFiles getDefaultProguardFile('proguard-defaults.txt'), 'proguard-rules.pro'
-            }
+
+            minifyEnabled true
+            shrinkResources true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+
+    packagingOptions {
+        // R8 doesn't remove these resources, so exclude them manually. This reduces APK size by 4MB.
+        resources {
+            excludes += ['/org/bouncycastle/pqc/**/*.properties']
         }
     }
 
@@ -83,11 +105,18 @@ android {
         sourceCompatibility 1.8
         coreLibraryDesugaringEnabled true
     }
+    lint {
+        abortOnError true
+        checkDependencies true
+    }
+    buildFeatures {
+        buildConfig true
+    }
 }
 
 protobuf {
     protoc {
-        artifact = 'com.google.protobuf:protoc:3.8.0'
+        artifact = 'com.google.protobuf:protoc:3.25.1'
     }
     generateProtoTasks {
         all().each { task ->
@@ -100,32 +129,49 @@ protobuf {
     }
 }
 
-dependencies {
-    def cameraxVersion = '1.0.0-beta11'
-    def glideVersion = '4.11.0'
-    def guavaVersion = '30.0'
-    def junitVersion = '5.7.0'
-    def libsuVersion = '2.5.1'
+aboutLibraries {
+    // Tasks for aboutLibraries are not run automatically to keep the build reproducible
+    // To update manually: ./gradlew app:exportLibraryDefinitions -PaboutLibraries.exportPath=src/main/res/raw
+    prettyPrint = true
+    configPath = "app/config"
+    fetchRemoteFunding = false
+    registerAndroidTasks = false
+    exclusionPatterns = [~"javax.annotation.*"]
+    duplicationMode = com.mikepenz.aboutlibraries.plugin.DuplicateMode.MERGE
+}
 
-    annotationProcessor 'androidx.annotation:annotation:1.1.0'
+dependencies {
+    def cameraxVersion = '1.4.0'
+    def glideVersion = '4.16.0'
+    def guavaVersion = '33.3.1'
+    def hiltVersion = '2.52'
+    def junitVersion = '4.13.2'
+    def libsuVersion = '6.0.0'
+    def roomVersion = "2.6.1"
+
+    annotationProcessor 'androidx.annotation:annotation:1.9.1'
+    annotationProcessor "androidx.room:room-compiler:$roomVersion"
+    annotationProcessor "com.google.dagger:hilt-compiler:$hiltVersion"
     annotationProcessor "com.github.bumptech.glide:compiler:${glideVersion}"
 
     implementation fileTree(dir: 'libs', include: ['*.jar'])
-    implementation 'androidx.appcompat:appcompat:1.2.0'
-    implementation "androidx.biometric:biometric:1.0.1"
+    implementation 'androidx.activity:activity:1.9.3'
+    implementation 'androidx.appcompat:appcompat:1.7.0'
+    implementation "androidx.biometric:biometric:1.1.0"
     implementation "androidx.camera:camera-camera2:$cameraxVersion"
     implementation "androidx.camera:camera-lifecycle:$cameraxVersion"
-    implementation "androidx.camera:camera-view:1.0.0-alpha18"
-    implementation 'androidx.cardview:cardview:1.0.0'
-    implementation 'androidx.constraintlayout:constraintlayout:2.0.2'
+    implementation "androidx.camera:camera-view:$cameraxVersion"
+    implementation 'androidx.core:core:1.15.0'
+    implementation 'androidx.constraintlayout:constraintlayout:2.2.0'
     implementation 'androidx.documentfile:documentfile:1.0.1'
-    implementation "androidx.lifecycle:lifecycle-process:2.2.0"
-    implementation 'androidx.preference:preference:1.1.1'
-    implementation 'androidx.recyclerview:recyclerview:1.1.0'
-    implementation "androidx.viewpager2:viewpager2:1.0.0"
-    implementation 'com.amulyakhare:com.amulyakhare.textdrawable:1.0.1'
-    implementation 'com.getbase:floatingactionbutton:1.10.1'
-    implementation 'com.github.avito-tech:krop:0.44'
+    implementation 'androidx.lifecycle:lifecycle-process:2.8.7'
+    implementation "androidx.preference:preference:1.2.1"
+    implementation 'androidx.recyclerview:recyclerview:1.3.2'
+    implementation "androidx.room:room-runtime:$roomVersion"
+    implementation 'androidx.viewpager2:viewpager2:1.1.0'
+    implementation 'com.caverock:androidsvg-aar:1.4'
+    implementation "com.google.dagger:hilt-android:$hiltVersion"
+    implementation 'com.github.avito-tech:krop:0.52'
     implementation "com.github.bumptech.glide:annotations:${glideVersion}"
     implementation "com.github.bumptech.glide:glide:${glideVersion}"
     implementation("com.github.bumptech.glide:recyclerview-integration:${glideVersion}") {
@@ -134,31 +180,35 @@ dependencies {
     implementation "com.github.topjohnwu.libsu:core:${libsuVersion}"
     implementation "com.github.topjohnwu.libsu:io:${libsuVersion}"
     implementation "com.google.guava:guava:${guavaVersion}-android"
-    implementation 'com.google.android.material:material:1.0.0'
-    implementation 'com.google.protobuf:protobuf-javalite:3.13.0'
-    implementation 'com.google.zxing:core:3.4.1'
-    implementation "com.mikepenz:iconics-core:3.2.5"
-    implementation 'com.mikepenz:material-design-iconic-typeface:2.2.0.5@aar'
-    implementation 'com.nulab-inc:zxcvbn:1.3.0'
-    implementation 'de.hdodenhof:circleimageview:3.1.0'
-    implementation 'de.psdev.licensesdialog:licensesdialog:2.1.0'
-    implementation 'net.lingala.zip4j:zip4j:2.6.4'
-    implementation 'info.guardianproject.trustedintents:trustedintents:0.2'
-    implementation 'org.bouncycastle:bcprov-jdk15on:1.65'
+    implementation 'com.google.android.material:material:1.12.0'
+    implementation 'com.google.protobuf:protobuf-javalite:4.28.3'
+    implementation 'com.google.zxing:core:3.5.3'
+    implementation('com.mikepenz:aboutlibraries:11.2.3') {
+        exclude group: 'com.mikepenz', module: 'aboutlibraries-core'
+    }
+    implementation 'com.mikepenz:aboutlibraries-core-android:11.2.3'
+    implementation 'com.nulab-inc:zxcvbn:1.9.0'
+    implementation 'net.lingala.zip4j:zip4j:2.11.5'
+    implementation 'org.bouncycastle:bcprov-jdk18on:1.79'
+    implementation 'org.simpleflatmapper:sfm-csv:8.2.3'
 
-    androidTestImplementation 'androidx.test:core:1.3.0'
-    androidTestImplementation 'androidx.test:runner:1.3.0'
-    androidTestImplementation 'androidx.test:rules:1.3.0'
-    androidTestImplementation 'androidx.test.ext:junit:1.1.2'
-    androidTestImplementation 'androidx.test.espresso:espresso-core:3.3.0'
-    androidTestImplementation 'androidx.test.espresso:espresso-contrib:3.3.0'
-    androidTestImplementation 'androidx.test.espresso:espresso-intents:3.3.0'
-    androidTestImplementation 'junit:junit:4.13.1'
-    androidTestUtil 'androidx.test:orchestrator:1.3.0'
+    androidTestAnnotationProcessor "com.google.dagger:hilt-android-compiler:$hiltVersion"
+    androidTestImplementation "com.google.dagger:hilt-android-testing:$hiltVersion"
+    androidTestImplementation 'androidx.test:core:1.6.1'
+    androidTestImplementation 'androidx.test:runner:1.6.2'
+    androidTestImplementation 'androidx.test:rules:1.6.1'
+    androidTestImplementation 'androidx.test.ext:junit:1.2.1'
+    androidTestImplementation 'androidx.test.espresso:espresso-core:3.6.1'
+    androidTestImplementation 'androidx.test.espresso:espresso-contrib:3.6.1'
+    androidTestImplementation 'androidx.test.espresso:espresso-intents:3.6.1'
+    androidTestImplementation "junit:junit:${junitVersion}"
+    androidTestUtil 'androidx.test:orchestrator:1.5.1'
 
+    testImplementation 'androidx.test:core:1.6.1'
     testImplementation "com.google.guava:guava:${guavaVersion}-jre"
-    testImplementation "org.junit.jupiter:junit-jupiter-api:${junitVersion}"
-    testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:${junitVersion}"
+    testImplementation "junit:junit:${junitVersion}"
+    testImplementation 'org.json:json:20240303'
+    testImplementation 'org.robolectric:robolectric:4.14'
 
-    coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:1.0.10'
+    coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:2.1.3'
 }

app/config/libraries/krop.json

@@ -0,0 +1,6 @@
+{
+    "uniqueId": "com.github.avito-tech:krop",
+    "licenses": [
+        "MIT"
+    ]
+}

app/config/libraries/libsu.json

@@ -0,0 +1,6 @@
+{
+    "uniqueId": "com.github.topjohnwu.libsu:.*::regex",
+    "licenses": [
+        "Apache-2.0"
+    ]
+}

app/config/libraries/textdrawable.json

@@ -0,0 +1,15 @@
+{
+    "uniqueId": "com.amulyakhare:com.amulyakhare.textdrawable",
+    "funding": [
+        
+    ],
+    "developers": [
+        
+    ],
+    "artifactVersion": "1.0.1",
+    "description": "This light-weight library provides images with letter/text like the Gmail app. It extends the Drawable class thus can be used with existing/custom/network ImageView classes. Also included is a fluent interface for creating drawables and a customizable ColorGenerator.",
+    "name": "textdrawable",
+    "licenses": [
+        "MIT"
+    ]
+}

app/config/libraries/trustedintents.json

@@ -0,0 +1,23 @@
+{
+    "uniqueId": "info.guardianproject.trustedintents:trustedintents",
+    "funding": [
+        
+    ],
+    "developers": [
+        {
+            "name": "Guardian Project"
+        }
+    ],
+    "artifactVersion": "0.2",
+    "description": "TrustedIntents is a library for flexible trusted interactions between Android apps.  It is modeled after Android's `signature` protection level for permissions.  The key difference is that the framework allows the trusted signature to be set, rather than requiring to match the current app's signature.",
+    "scm": {
+        "connection": "scm:https://github.com/guardianproject/TrustedIntents.git",
+        "url": "scm:https://github.com/guardianproject/TrustedIntents",
+        "developerConnection": "scm:git@github.com:guardianproject/TrustedIntents.git"
+    },
+    "name": "TrustedIntents",
+    "website": "https://guardianproject.info/code/trustedintents",
+    "licenses": [
+        "3ca920d1875f7ad7ab04a2a331958577"
+    ]
+}

app/config/licenses/3ca920d1875f7ad7ab04a2a331958577.json

@@ -0,0 +1,5 @@
+{
+    "hash": "3ca920d1875f7ad7ab04a2a331958577",
+    "url": "https://github.com/guardianproject/TrustedIntents/blob/master/LICENSE.txt",
+    "name": "LGPLv2.1"
+}

app/lint.xml

@@ -1,6 +1,15 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <lint>
+    <issue id="MissingTranslation" severity="ignore" />
+    <issue id="MissingQuantity" severity="ignore" />
     <issue id="InvalidPackage">
         <ignore regexp="X509LDAPCertStoreSpi" />
     </issue>
+    <issue id="NotificationPermission">
+        <ignore regexp="com.bumptech.glide.request.target.NotificationTarget" />
+    </issue>
+    <issue id="UnusedResources" severity="error">
+        <ignore path="res/raw/aboutlibraries.json" />
+        <ignore regexp="res/mipmap.*/ic_launcher_debug.*.png" />
+    </issue>
 </lint>

app/proguard-rules.pro

@@ -1,24 +1,10 @@
-# Add project specific ProGuard rules here.
-# By default, the flags in this file are appended to flags specified
-# in /home/alex/Android/Sdk/tools/proguard/proguard-android.txt
-# You can edit the include path and order by changing the proguardFiles
-# directive in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# Add any project specific keep options here:
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
+-keepattributes LineNumberTable,SourceFile
+-renamesourcefileattribute SourceFile
+-dontobfuscate
 
 -keepclasseswithmembers public class androidx.recyclerview.widget.RecyclerView { *; }
-
+-keep class com.beemdevelopment.aegis.ui.fragments.preferences.*
 -keep class com.beemdevelopment.aegis.importers.** { *; }
-
 -keep class * extends com.google.protobuf.GeneratedMessageLite { *; }
--keep class !org.bouncycastle.jce.provider.X509LDAPCertStoreSpi { *; }
+
+-dontwarn javax.naming.**

app/schemas/com.beemdevelopment.aegis.database.AppDatabase/1.json

@@ -0,0 +1,52 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 1,
+    "identityHash": "392278bdb797d013cb2ada67a3b1cc60",
+    "entities": [
+      {
+        "tableName": "audit_logs",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `event_type` TEXT NOT NULL, `reference` TEXT, `timestamp` INTEGER NOT NULL)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "_eventType",
+            "columnName": "event_type",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "_reference",
+            "columnName": "reference",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "_timestamp",
+            "columnName": "timestamp",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '392278bdb797d013cb2ada67a3b1cc60')"
+    ]
+  }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/AegisTest.java

@@ -2,43 +2,125 @@ package com.beemdevelopment.aegis;
 
 import android.view.View;
 
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.recyclerview.widget.RecyclerView;
 import androidx.test.espresso.UiController;
 import androidx.test.espresso.ViewAction;
+import androidx.test.espresso.matcher.BoundedMatcher;
 import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.rule.GrantPermissionRule;
 
 import com.beemdevelopment.aegis.crypto.CryptoUtils;
 import com.beemdevelopment.aegis.crypto.SCryptParameters;
 import com.beemdevelopment.aegis.otp.OtpInfo;
-import com.beemdevelopment.aegis.vault.Vault;
+import com.beemdevelopment.aegis.ui.views.EntryHolder;
 import com.beemdevelopment.aegis.vault.VaultEntry;
 import com.beemdevelopment.aegis.vault.VaultFileCredentials;
 import com.beemdevelopment.aegis.vault.VaultManager;
-import com.beemdevelopment.aegis.vault.VaultManagerException;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+import com.beemdevelopment.aegis.vault.VaultRepositoryException;
 import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
 import com.beemdevelopment.aegis.vault.slots.SlotException;
+import com.beemdevelopment.aegis.vectors.VaultEntries;
 
+import org.hamcrest.Description;
 import org.hamcrest.Matcher;
+import org.junit.Before;
+import org.junit.Rule;
 
 import java.lang.reflect.InvocationTargetException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.InvalidKeyException;
 import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.List;
 
 import javax.crypto.NoSuchPaddingException;
 import javax.crypto.SecretKey;
+import javax.inject.Inject;
+
+import dagger.hilt.android.testing.HiltAndroidRule;
 
 public abstract class AegisTest {
     public static final String VAULT_PASSWORD = "test";
+    public static final String VAULT_PASSWORD_CHANGED = "test2";
+    public static final String VAULT_BACKUP_PASSWORD = "something";
+    public static final String VAULT_BACKUP_PASSWORD_CHANGED = "something2";
 
-    protected AegisApplication getApp() {
-        return (AegisApplication) InstrumentationRegistry.getInstrumentation().getTargetContext().getApplicationContext();
+    @Rule
+    public HiltAndroidRule hiltRule = new HiltAndroidRule(this);
+
+    @Rule
+    public final GrantPermissionRule permRule = getGrantPermissionRule();
+
+    @Inject
+    protected VaultManager _vaultManager;
+
+    @Inject
+    protected Preferences _prefs;
+
+    @Before
+    public void init() {
+        hiltRule.inject();
     }
 
-    protected VaultManager getVault() {
-        return getApp().getVaultManager();
+    private static GrantPermissionRule getGrantPermissionRule() {
+        List<String> perms = new ArrayList<>();
+        // NOTE: Disabled for now. See issue: #1047
+        /*if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            perms.add(Manifest.permission.POST_NOTIFICATIONS);
+        }*/
+        return GrantPermissionRule.grant(perms.toArray(new String[0]));
     }
 
-    protected VaultManager initVault() {
+    protected AegisApplicationBase getApp() {
+        return (AegisApplicationBase) InstrumentationRegistry.getInstrumentation().getTargetContext().getApplicationContext();
+    }
+
+    protected VaultRepository initEncryptedVault() {
+        VaultFileCredentials creds = generateCredentials();
+        return initVault(creds, VaultEntries.get());
+    }
+
+    protected VaultRepository initEmptyEncryptedVault() {
+        VaultFileCredentials creds = generateCredentials();
+        return initVault(creds, null);
+    }
+
+    protected VaultRepository initPlainVault() {
+        return initVault(null, VaultEntries.get());
+    }
+
+    protected VaultRepository initEmptyPlainVault() {
+        return initVault(null, null);
+    }
+
+    private VaultRepository initVault(@Nullable VaultFileCredentials creds, @Nullable List<VaultEntry> entries) {
+        VaultRepository vault;
+        try {
+            vault = _vaultManager.initNew(creds);
+        } catch (VaultRepositoryException e) {
+            throw new RuntimeException(e);
+        }
+
+        if (entries != null) {
+            for (VaultEntry entry : entries) {
+                _vaultManager.getVault().addEntry(entry);
+            }
+        }
+
+        try {
+            _vaultManager.save();
+        } catch (VaultRepositoryException e) {
+            throw new RuntimeException(e);
+        }
+
+        _prefs.setIntroDone(true);
+        return vault;
+    }
+
+    protected VaultFileCredentials generateCredentials() {
         PasswordSlot slot = new PasswordSlot();
         byte[] salt = CryptoUtils.generateSalt();
         SCryptParameters scryptParams = new SCryptParameters(
@@ -59,21 +141,17 @@ public abstract class AegisTest {
                 | SlotException e) {
             throw new RuntimeException(e);
         }
+
         creds.getSlots().add(slot);
-
-        VaultManager vault = getApp().initVaultManager(new Vault(), creds);
-        try {
-            vault.save(false);
-        } catch (VaultManagerException e) {
-            throw new RuntimeException(e);
-        }
-
-        getApp().getPreferences().setIntroDone(true);
-        return vault;
+        return creds;
     }
 
     protected static <T extends OtpInfo> VaultEntry generateEntry(Class<T> type, String name, String issuer) {
-        byte[] secret = CryptoUtils.generateRandomBytes(20);
+        return generateEntry(type, name, issuer, 20);
+    }
+
+    protected static <T extends OtpInfo> VaultEntry generateEntry(Class<T> type, String name, String issuer, int secretLength) {
+        byte[] secret = CryptoUtils.generateRandomBytes(secretLength);
 
         OtpInfo info;
         try {
@@ -105,4 +183,21 @@ public abstract class AegisTest {
             }
         };
     }
+
+    @NonNull
+    protected static Matcher<RecyclerView.ViewHolder> withOtpType(Class<? extends OtpInfo> otpClass) {
+        return new BoundedMatcher<RecyclerView.ViewHolder, EntryHolder>(EntryHolder.class) {
+            @Override
+            public boolean matchesSafely(EntryHolder holder) {
+                return holder != null
+                        && holder.getEntry() != null
+                        && holder.getEntry().getInfo().getClass().equals(otpClass);
+            }
+
+            @Override
+            public void describeTo(Description description) {
+                description.appendText(String.format("with otp type '%s'", otpClass.getSimpleName()));
+            }
+        };
+    }
 }

app/src/androidTest/java/com/beemdevelopment/aegis/AegisTestApplication.java

@@ -0,0 +1,7 @@
+package com.beemdevelopment.aegis;
+
+import dagger.hilt.android.testing.CustomTestApplication;
+
+@CustomTestApplication(AegisApplicationBase.class)
+public interface AegisTestApplication {
+}

app/src/androidTest/java/com/beemdevelopment/aegis/AegisTestRunner.java

@@ -1,15 +1,26 @@
 package com.beemdevelopment.aegis;
 
 import android.app.Application;
+import android.app.Instrumentation;
 import android.content.Context;
-import android.preference.PreferenceManager;
 
+import androidx.preference.PreferenceManager;
 import androidx.test.core.app.ApplicationProvider;
 import androidx.test.runner.AndroidJUnitRunner;
 
 import com.beemdevelopment.aegis.util.IOUtils;
 
 public class AegisTestRunner extends AndroidJUnitRunner {
+    static {
+        BuildConfig.TEST.set(true);
+    }
+
+    @Override
+    public Application newApplication(ClassLoader cl, String name, Context context)
+            throws ClassNotFoundException, IllegalAccessException, InstantiationException {
+        return Instrumentation.newApplication(AegisTestApplication_Application.class, context);
+    }
+
     @Override
     public void callApplicationOnCreate(Application app) {
         Context context = app.getApplicationContext();

app/src/androidTest/java/com/beemdevelopment/aegis/BackupExportTest.java

@@ -0,0 +1,400 @@
+package com.beemdevelopment.aegis;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.action.ViewActions.closeSoftKeyboard;
+import static androidx.test.espresso.action.ViewActions.pressBack;
+import static androidx.test.espresso.action.ViewActions.typeText;
+import static androidx.test.espresso.intent.Intents.intending;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.isInternal;
+import static androidx.test.espresso.matcher.ViewMatchers.hasDescendant;
+import static androidx.test.espresso.matcher.ViewMatchers.isRoot;
+import static androidx.test.espresso.matcher.ViewMatchers.withId;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+import android.app.Activity;
+import android.app.Instrumentation;
+import android.content.Intent;
+import android.net.Uri;
+
+import androidx.annotation.Nullable;
+import androidx.test.espresso.contrib.RecyclerViewActions;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.espresso.matcher.RootMatchers;
+import androidx.test.ext.junit.rules.ActivityScenarioRule;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.SmallTest;
+
+import com.beemdevelopment.aegis.crypto.CryptoUtils;
+import com.beemdevelopment.aegis.crypto.MasterKey;
+import com.beemdevelopment.aegis.encoding.Hex;
+import com.beemdevelopment.aegis.importers.DatabaseImporter;
+import com.beemdevelopment.aegis.importers.DatabaseImporterException;
+import com.beemdevelopment.aegis.importers.GoogleAuthUriImporter;
+import com.beemdevelopment.aegis.otp.OtpInfoException;
+import com.beemdevelopment.aegis.rules.ScreenshotTestRule;
+import com.beemdevelopment.aegis.ui.PreferencesActivity;
+import com.beemdevelopment.aegis.util.IOUtils;
+import com.beemdevelopment.aegis.vault.VaultBackupManager;
+import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.beemdevelopment.aegis.vault.VaultFile;
+import com.beemdevelopment.aegis.vault.VaultFileCredentials;
+import com.beemdevelopment.aegis.vault.VaultFileException;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+import com.beemdevelopment.aegis.vault.VaultRepositoryException;
+import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
+import com.beemdevelopment.aegis.vault.slots.SlotException;
+import com.beemdevelopment.aegis.vault.slots.SlotIntegrityException;
+import com.beemdevelopment.aegis.vault.slots.SlotList;
+import com.beemdevelopment.aegis.vectors.VaultEntries;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.rules.TestRule;
+import org.junit.runner.RunWith;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Collection;
+import java.util.List;
+
+import javax.crypto.Cipher;
+import javax.crypto.SecretKey;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
+
+@RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
+@SmallTest
+public class BackupExportTest extends AegisTest {
+    private final ActivityScenarioRule<PreferencesActivity> _activityRule = new ActivityScenarioRule<>(PreferencesActivity.class);
+
+    @Rule
+    public final TestRule testRule = RuleChain.outerRule(_activityRule).around(new ScreenshotTestRule());
+
+    @Before
+    public void setUp() {
+        Intents.init();
+    }
+
+    @After
+    public void tearDown() {
+        Intents.release();
+    }
+
+    @Test
+    public void testPlainVaultExportPlainJson() {
+        initPlainVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        File file = doExport();
+
+        readVault(file, null);
+    }
+
+    @Test
+    public void testPlainVaultExportPlainTxt() {
+        initPlainVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(R.id.dropdown_export_format)).perform(click());
+        onView(withText(R.string.export_format_google_auth_uri)).inRoot(RootMatchers.isPlatformPopup()).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        File file = doExport();
+
+        readTxtExport(file);
+    }
+
+    @Test
+    public void testPlainVaultExportEncryptedJson() {
+        initPlainVault();
+
+        openExportDialog();
+        File file = doExport();
+
+        onView(withId(R.id.text_password)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
+        onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
+        onView(withId(android.R.id.button1)).perform(click());
+
+        readVault(file, VAULT_PASSWORD);
+    }
+
+    @Test
+    public void testEncryptedVaultExportPlainJson() {
+        initEncryptedVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        File file = doExport();
+
+        readVault(file, null);
+    }
+
+    @Test
+    public void testEncryptedVaultExportPlainTxt() {
+        initEncryptedVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(R.id.dropdown_export_format)).perform(click());
+        onView(withText(R.string.export_format_google_auth_uri)).inRoot(RootMatchers.isPlatformPopup()).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        File file = doExport();
+
+        readTxtExport(file);
+    }
+
+    @Test
+    public void testEncryptedVaultExportEncryptedJson() {
+        initEncryptedVault();
+
+        openExportDialog();
+        File file = doExport();
+
+        readVault(file, VAULT_PASSWORD);
+    }
+
+    @Test
+    public void testPlainVaultExportHtml() {
+        initPlainVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(R.id.dropdown_export_format)).perform(click());
+        onView(withText(R.string.export_format_html)).inRoot(RootMatchers.isPlatformPopup()).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        doExport();
+    }
+
+    @Test
+    public void testEncryptedVaultExportHtml() {
+        initEncryptedVault();
+
+        openExportDialog();
+        onView(withId(R.id.checkbox_export_encrypt)).perform(click());
+        onView(withId(R.id.dropdown_export_format)).perform(click());
+        onView(withText(R.string.export_format_html)).inRoot(RootMatchers.isPlatformPopup()).perform(click());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(withId(R.id.checkbox_accept)).perform(click());
+        doExport();
+    }
+
+    @Test
+    public void testSeparateExportPassword() {
+        initEncryptedVault();
+        setSeparateBackupExportPassword();
+
+        openExportDialog();
+        File file = doExport();
+
+        readVault(file, VAULT_BACKUP_PASSWORD);
+    }
+
+    @Test
+    public void testChangeBackupPassword() throws SlotIntegrityException {
+        initEncryptedVault();
+        setSeparateBackupExportPassword();
+
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_section_security_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_backup_password_change_title)), click()));
+        onView(withId(R.id.text_password)).perform(typeText(VAULT_BACKUP_PASSWORD_CHANGED), closeSoftKeyboard());
+        onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_BACKUP_PASSWORD_CHANGED), closeSoftKeyboard());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(isRoot()).perform(pressBack());
+
+        VaultFileCredentials creds = _vaultManager.getVault().getCredentials();
+        assertEquals(creds.getSlots().findRegularPasswordSlots().size(), 1);
+        assertEquals(creds.getSlots().findBackupPasswordSlots().size(), 1);
+
+        for (PasswordSlot slot : creds.getSlots().findBackupPasswordSlots()) {
+            verifyPasswordSlotChange(creds, slot, VAULT_BACKUP_PASSWORD, VAULT_BACKUP_PASSWORD_CHANGED);
+        }
+
+        for (PasswordSlot slot : creds.getSlots().findRegularPasswordSlots()) {
+            decryptPasswordSlot(slot, VAULT_PASSWORD);
+        }
+
+        openExportDialog();
+        File file = doExport();
+        readVault(file, VAULT_BACKUP_PASSWORD_CHANGED);
+    }
+
+    @Test
+    public void testChangePasswordHavingBackupPassword() throws SlotIntegrityException {
+        initEncryptedVault();
+        setSeparateBackupExportPassword();
+
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_section_security_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_set_password_title)), click()));
+        onView(withId(R.id.text_password)).perform(typeText(VAULT_PASSWORD_CHANGED), closeSoftKeyboard());
+        onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_PASSWORD_CHANGED), closeSoftKeyboard());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(isRoot()).perform(pressBack());
+
+        VaultFileCredentials creds = _vaultManager.getVault().getCredentials();
+        assertEquals(creds.getSlots().findRegularPasswordSlots().size(), 1);
+        assertEquals(creds.getSlots().findBackupPasswordSlots().size(), 1);
+
+        for (PasswordSlot slot : creds.getSlots().findRegularPasswordSlots()) {
+            verifyPasswordSlotChange(creds, slot, VAULT_PASSWORD, VAULT_PASSWORD_CHANGED);
+        }
+
+        for (PasswordSlot slot : creds.getSlots().findBackupPasswordSlots()) {
+            decryptPasswordSlot(slot, VAULT_BACKUP_PASSWORD);
+        }
+
+        openExportDialog();
+        File file = doExport();
+        readVault(file, VAULT_BACKUP_PASSWORD);
+    }
+
+    private void setSeparateBackupExportPassword() {
+        VaultFileCredentials creds = _vaultManager.getVault().getCredentials();
+        assertEquals(creds.getSlots().findRegularPasswordSlots().size(), 1);
+        assertEquals(creds.getSlots().findBackupPasswordSlots().size(), 0);
+
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_section_security_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_backup_password_title)), click()));
+        onView(withId(R.id.text_password)).perform(typeText(VAULT_BACKUP_PASSWORD), closeSoftKeyboard());
+        onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_BACKUP_PASSWORD), closeSoftKeyboard());
+        onView(withId(android.R.id.button1)).perform(click());
+        onView(isRoot()).perform(pressBack());
+
+        creds = _vaultManager.getVault().getCredentials();
+        assertEquals(creds.getSlots().findRegularPasswordSlots().size(), 1);
+        assertEquals(creds.getSlots().findBackupPasswordSlots().size(), 1);
+        for (PasswordSlot slot : creds.getSlots().findBackupPasswordSlots()) {
+            verifyPasswordSlotChange(creds, slot, VAULT_PASSWORD, VAULT_BACKUP_PASSWORD);
+        }
+    }
+
+    private void verifyPasswordSlotChange(VaultFileCredentials creds, PasswordSlot slot, String oldPassword, String newPassword) {
+        assertThrows(SlotIntegrityException.class, () -> decryptPasswordSlot(slot, oldPassword));
+        MasterKey masterKey;
+        try {
+            masterKey = decryptPasswordSlot(slot, newPassword);
+        } catch (SlotIntegrityException e) {
+            throw new RuntimeException("Unable to decrypt password slot", e);
+        }
+
+        assertArrayEquals(creds.getKey().getBytes(), masterKey.getBytes());
+    }
+
+    private File doExport() {
+        File file = getExportFileUri();
+        Intent resultData = new Intent();
+        resultData.setData(Uri.fromFile(file));
+
+        Instrumentation.ActivityResult result = new Instrumentation.ActivityResult(Activity.RESULT_OK, resultData);
+        intending(not(isInternal())).respondWith(result);
+
+        onView(withId(android.R.id.button1)).perform(click());
+        return file;
+    }
+
+    private void openExportDialog() {
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_section_import_export_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_export_title)), click()));
+    }
+
+    private MasterKey decryptPasswordSlot(PasswordSlot slot, String password) throws SlotIntegrityException {
+        SecretKey derivedKey = slot.deriveKey(password.toCharArray());
+        try {
+            Cipher cipher = slot.createDecryptCipher(derivedKey);
+            return slot.getKey(cipher);
+        } catch (SlotException e) {
+            throw new RuntimeException("Unable to decrypt password slot", e);
+        }
+    }
+
+    private File getExportFileUri() {
+        String dirName = Hex.encode(CryptoUtils.generateRandomBytes(8));
+        File dir = new File(getInstrumentation().getTargetContext().getExternalCacheDir(), String.format("export-%s", dirName));
+        if (!dir.mkdirs()) {
+            throw new RuntimeException(String.format("Unable to create export directory: %s", dir));
+        }
+
+        VaultBackupManager.FileInfo fileInfo = new VaultBackupManager.FileInfo(VaultRepository.FILENAME_PREFIX_EXPORT);
+        return new File(dir, fileInfo.toString());
+    }
+
+    private VaultRepository readVault(File file, @Nullable String password) {
+        VaultRepository repo;
+        try (InputStream inStream = new FileInputStream(file)) {
+            byte[] bytes = IOUtils.readAll(inStream);
+            VaultFile vaultFile = VaultFile.fromBytes(bytes);
+
+            VaultFileCredentials creds = null;
+            if (password != null) {
+                SlotList slots = vaultFile.getHeader().getSlots();
+                for (PasswordSlot slot : slots.findAll(PasswordSlot.class)) {
+                    SecretKey derivedKey = slot.deriveKey(password.toCharArray());
+                    Cipher cipher = slot.createDecryptCipher(derivedKey);
+                    MasterKey masterKey = slot.getKey(cipher);
+                    creds = new VaultFileCredentials(masterKey, slots);
+                    break;
+                }
+            }
+
+            repo = VaultRepository.fromFile(getInstrumentation().getContext(), vaultFile, creds);
+        } catch (SlotException | SlotIntegrityException | VaultRepositoryException | VaultFileException | IOException e) {
+            throw new RuntimeException("Unable to read back vault file", e);
+        }
+
+        checkReadEntries(repo.getEntries());
+        return repo;
+    }
+
+    private void readTxtExport(File file) {
+        GoogleAuthUriImporter importer = new GoogleAuthUriImporter(getInstrumentation().getContext());
+
+        Collection<VaultEntry> entries;
+        try (InputStream inStream = new FileInputStream(file)) {
+            DatabaseImporter.State state = importer.read(inStream);
+            DatabaseImporter.Result result = state.convert();
+            entries = result.getEntries().getValues();
+        } catch (DatabaseImporterException | IOException e) {
+            throw new RuntimeException("Unable to read txt export file", e);
+        }
+
+        checkReadEntries(entries);
+    }
+
+    private void checkReadEntries(Collection<VaultEntry> entries) {
+        List<VaultEntry> vectors = VaultEntries.get();
+        assertEquals(vectors.size(), entries.size());
+
+        int i = 0;
+        for (VaultEntry entry : entries) {
+            VaultEntry vector = vectors.get(i);
+            String message = String.format("Entries are not equivalent: (%s) (%s)", vector.toJson().toString(), entry.toJson().toString());
+            assertTrue(message, vector.equivalates(entry));
+            try {
+                assertEquals(message, vector.getInfo().getOtp(), entry.getInfo().getOtp());
+            } catch (OtpInfoException e) {
+                throw new RuntimeException("Unable to generate OTP", e);
+            }
+            i++;
+        }
+    }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/DeepLinkTest.java

@@ -1,5 +1,10 @@
 package com.beemdevelopment.aegis;
 
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.matcher.ViewMatchers.withId;
+import static junit.framework.TestCase.assertTrue;
+
 import android.content.Intent;
 import android.net.Uri;
 
@@ -16,38 +21,36 @@ import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import static androidx.test.espresso.Espresso.onView;
-import static androidx.test.espresso.action.ViewActions.click;
-import static androidx.test.espresso.matcher.ViewMatchers.withId;
-import static junit.framework.TestCase.assertTrue;
+import dagger.hilt.android.testing.HiltAndroidTest;
 
 @RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
 @LargeTest
-public class IntentTest extends AegisTest {
+public class DeepLinkTest extends AegisTest {
     @Before
     public void before() {
-        initVault();
+        initEmptyEncryptedVault();
     }
 
     @Test
-    public void doDeepLinkIntent() {
+    public void testDeepLinkIntent() {
         VaultEntry entry = generateEntry(TotpInfo.class, "Bob", "Google");
         GoogleAuthInfo info = new GoogleAuthInfo(entry.getInfo(), entry.getName(), entry.getIssuer());
         launch(info.getUri());
 
         onView(withId(R.id.action_save)).perform(click());
 
-        VaultEntry createdEntry = (VaultEntry) getVault().getEntries().toArray()[0];
+        VaultEntry createdEntry = (VaultEntry) _vaultManager.getVault().getEntries().toArray()[0];
         assertTrue(createdEntry.equivalates(entry));
     }
 
     @Test
-    public void doDeepLinkIntent_Empty() {
+    public void testDeepLinkIntent_Empty() {
         launch(null);
     }
 
     @Test
-    public void doDeepLinkIntent_Bad() {
+    public void testDeepLinkIntent_Bad() {
         launch(Uri.parse("otpauth://bad"));
         onView(withId(android.R.id.button1)).perform(click());
     }

app/src/androidTest/java/com/beemdevelopment/aegis/EmptySecretTest.java

@@ -0,0 +1,54 @@
+package com.beemdevelopment.aegis;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.matcher.ViewMatchers.hasDescendant;
+import static androidx.test.espresso.matcher.ViewMatchers.withId;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.espresso.contrib.RecyclerViewActions;
+import androidx.test.ext.junit.rules.ActivityScenarioRule;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.SmallTest;
+
+import com.beemdevelopment.aegis.otp.OtpInfoException;
+import com.beemdevelopment.aegis.otp.TotpInfo;
+import com.beemdevelopment.aegis.rules.ScreenshotTestRule;
+import com.beemdevelopment.aegis.ui.MainActivity;
+import com.beemdevelopment.aegis.vault.VaultEntry;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.rules.TestRule;
+import org.junit.runner.RunWith;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
+
+@RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
+@SmallTest
+public class EmptySecretTest extends AegisTest {
+    private ActivityScenario<MainActivity> _scenario;
+
+    @Before
+    public void before() throws OtpInfoException {
+        initEmptyPlainVault();
+        _vaultManager.getVault().addEntry(new VaultEntry(new TotpInfo(new byte[0])));
+
+        _scenario = ActivityScenario.launch(MainActivity.class);
+    }
+
+    @After
+    public void after() {
+        _scenario.close();
+    }
+
+    @Test
+    public void testVaultEntryEmptySecret() {
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.error_all_caps)), click()));
+    }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/IntroTest.java

@@ -1,41 +1,88 @@
 package com.beemdevelopment.aegis;
 
-import androidx.test.espresso.ViewInteraction;
-import androidx.test.ext.junit.rules.ActivityScenarioRule;
-import androidx.test.ext.junit.runners.AndroidJUnit4;
-import androidx.test.filters.LargeTest;
-
-import com.beemdevelopment.aegis.ui.IntroActivity;
-import com.beemdevelopment.aegis.vault.VaultManager;
-import com.beemdevelopment.aegis.vault.slots.BiometricSlot;
-import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
-import com.beemdevelopment.aegis.vault.slots.SlotList;
-
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
 import static androidx.test.espresso.Espresso.onView;
 import static androidx.test.espresso.action.ViewActions.click;
 import static androidx.test.espresso.action.ViewActions.closeSoftKeyboard;
 import static androidx.test.espresso.action.ViewActions.replaceText;
 import static androidx.test.espresso.action.ViewActions.typeText;
 import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.intent.Intents.intending;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.isInternal;
 import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
 import static androidx.test.espresso.matcher.ViewMatchers.withId;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 import static junit.framework.TestCase.assertFalse;
 import static junit.framework.TestCase.assertNull;
 import static junit.framework.TestCase.assertTrue;
 import static org.hamcrest.Matchers.not;
 
+import android.app.Activity;
+import android.app.Instrumentation;
+import android.content.Intent;
+import android.net.Uri;
+
+import androidx.test.espresso.IdlingRegistry;
+import androidx.test.espresso.IdlingResource;
+import androidx.test.espresso.ViewInteraction;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.ext.junit.rules.ActivityScenarioRule;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.LargeTest;
+import androidx.viewpager2.widget.ViewPager2;
+
+import com.beemdevelopment.aegis.rules.ScreenshotTestRule;
+import com.beemdevelopment.aegis.ui.IntroActivity;
+import com.beemdevelopment.aegis.util.IOUtils;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+import com.beemdevelopment.aegis.vault.slots.BiometricSlot;
+import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
+import com.beemdevelopment.aegis.vault.slots.SlotList;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.rules.TestRule;
+import org.junit.runner.RunWith;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
+
 @RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
 @LargeTest
 public class IntroTest extends AegisTest {
+    private final ActivityScenarioRule<IntroActivity> _activityRule = new ActivityScenarioRule<>(IntroActivity.class);
+
+    private ViewPager2IdlingResource _viewPager2IdlingResource;
+
     @Rule
-    public final ActivityScenarioRule<IntroActivity> activityRule = new ActivityScenarioRule<>(IntroActivity.class);
+    public final TestRule testRule = RuleChain.outerRule(_activityRule).around(new ScreenshotTestRule());
+
+    @Before
+    public void setUp() {
+        Intents.init();
+
+        _activityRule.getScenario().onActivity(activity -> {
+            _viewPager2IdlingResource = new ViewPager2IdlingResource(activity.findViewById(R.id.pager), "viewPagerIdlingResource");
+            IdlingRegistry.getInstance().register(_viewPager2IdlingResource);
+        });
+    }
+
+    @After
+    public void tearDown() {
+        Intents.release();
+        IdlingRegistry.getInstance().unregister(_viewPager2IdlingResource);
+    }
 
     @Test
-    public void doIntro_None() {
+    public void testIntro_None() {
+        assertFalse(_prefs.isIntroDone());
         ViewInteraction next = onView(withId(R.id.btnNext));
         ViewInteraction prev = onView(withId(R.id.btnPrevious));
 
@@ -48,15 +95,16 @@ public class IntroTest extends AegisTest {
         next.perform(click());
         prev.check(matches(not(isDisplayed())));
         next.perform(click());
-        next.perform(click());
 
-        VaultManager vault = getVault();
+        VaultRepository vault = _vaultManager.getVault();
         assertFalse(vault.isEncryptionEnabled());
-        assertNull(getVault().getCredentials());
+        assertNull(vault.getCredentials());
+        assertTrue(_prefs.isIntroDone());
     }
 
     @Test
-    public void doIntro_Password() {
+    public void testIntro_Password() {
+        assertFalse(_prefs.isIntroDone());
         ViewInteraction next = onView(withId(R.id.btnNext));
         ViewInteraction prev = onView(withId(R.id.btnPrevious));
 
@@ -79,10 +127,102 @@ public class IntroTest extends AegisTest {
         next.perform(click());
         next.perform(click());
 
-        VaultManager vault = getVault();
-        SlotList slots = getVault().getCredentials().getSlots();
+        VaultRepository vault = _vaultManager.getVault();
+        SlotList slots = vault.getCredentials().getSlots();
         assertTrue(vault.isEncryptionEnabled());
         assertTrue(slots.has(PasswordSlot.class));
         assertFalse(slots.has(BiometricSlot.class));
+        assertTrue(_prefs.isIntroDone());
+    }
+
+    @Test
+    public void testIntro_Import_Plain() {
+        assertFalse(_prefs.isIntroDone());
+        Uri uri = getResourceUri("aegis_plain.json");
+        Intent resultData = new Intent();
+        resultData.setData(uri);
+
+        Instrumentation.ActivityResult result = new Instrumentation.ActivityResult(Activity.RESULT_OK, resultData);
+        intending(not(isInternal())).respondWith(result);
+
+        ViewInteraction next = onView(withId(R.id.btnNext));
+        onView(withId(R.id.btnImport)).perform(click());
+        next.perform(click());
+
+        VaultRepository vault = _vaultManager.getVault();
+        assertFalse(vault.isEncryptionEnabled());
+        assertNull(vault.getCredentials());
+        assertTrue(_prefs.isIntroDone());
+    }
+
+    @Test
+    public void testIntro_Import_Encrypted() {
+        assertFalse(_prefs.isIntroDone());
+        Uri uri = getResourceUri("aegis_encrypted.json");
+        Intent resultData = new Intent();
+        resultData.setData(uri);
+
+        Instrumentation.ActivityResult result = new Instrumentation.ActivityResult(Activity.RESULT_OK, resultData);
+        intending(not(isInternal())).respondWith(result);
+
+        ViewInteraction next = onView(withId(R.id.btnNext));
+        onView(withId(R.id.btnImport)).perform(click());
+        onView(withId(R.id.text_input)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
+        onView(withId(android.R.id.button1)).perform(click());
+        next.perform(click());
+
+        VaultRepository vault = _vaultManager.getVault();
+        SlotList slots = vault.getCredentials().getSlots();
+        assertTrue(vault.isEncryptionEnabled());
+        assertTrue(slots.has(PasswordSlot.class));
+        assertFalse(slots.has(BiometricSlot.class));
+        assertTrue(_prefs.isIntroDone());
+    }
+
+    private Uri getResourceUri(String resourceName) {
+        File targetFile = new File(getInstrumentation().getTargetContext().getExternalCacheDir(), resourceName);
+        try (InputStream inStream = getClass().getResourceAsStream(resourceName);
+             FileOutputStream outStream = new FileOutputStream(targetFile)) {
+            IOUtils.copy(inStream, outStream);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+
+        return Uri.fromFile(targetFile);
+    }
+
+    // Source: https://stackoverflow.com/a/32763454/12972657
+    private static class ViewPager2IdlingResource implements IdlingResource {
+        private final String _resName;
+        private boolean _isIdle = true;
+        private IdlingResource.ResourceCallback _resourceCallback = null;
+
+        public ViewPager2IdlingResource(ViewPager2 viewPager, String resName) {
+            viewPager.registerOnPageChangeCallback(new ViewPager2.OnPageChangeCallback() {
+                @Override
+                public void onPageScrollStateChanged(int state) {
+                    _isIdle = (state == ViewPager2.SCROLL_STATE_IDLE || state == ViewPager2.SCROLL_STATE_DRAGGING);
+                    if (_isIdle && _resourceCallback != null) {
+                        _resourceCallback.onTransitionToIdle();
+                    }
+                }
+            });
+            _resName = resName;
+        }
+
+        @Override
+        public String getName() {
+            return _resName;
+        }
+
+        @Override
+        public boolean isIdleNow() {
+            return _isIdle;
+        }
+
+        @Override
+        public void registerIdleTransitionCallback(IdlingResource.ResourceCallback resourceCallback) {
+            _resourceCallback = resourceCallback;
+        }
     }
 }

app/src/androidTest/java/com/beemdevelopment/aegis/OverallTest.java

@@ -1,32 +1,5 @@
 package com.beemdevelopment.aegis;
 
-import androidx.annotation.IdRes;
-import androidx.test.core.app.ApplicationProvider;
-import androidx.test.espresso.AmbiguousViewMatcherException;
-import androidx.test.espresso.ViewInteraction;
-import androidx.test.espresso.contrib.RecyclerViewActions;
-import androidx.test.ext.junit.rules.ActivityScenarioRule;
-import androidx.test.ext.junit.runners.AndroidJUnit4;
-import androidx.test.filters.LargeTest;
-
-import com.beemdevelopment.aegis.encoding.Base32;
-import com.beemdevelopment.aegis.otp.HotpInfo;
-import com.beemdevelopment.aegis.otp.SteamInfo;
-import com.beemdevelopment.aegis.otp.TotpInfo;
-import com.beemdevelopment.aegis.ui.MainActivity;
-import com.beemdevelopment.aegis.vault.VaultEntry;
-import com.beemdevelopment.aegis.vault.VaultManager;
-import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
-
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import static androidx.test.espresso.Espresso.onData;
 import static androidx.test.espresso.Espresso.onView;
 import static androidx.test.espresso.Espresso.openContextualActionModeOverflowMenu;
 import static androidx.test.espresso.action.ViewActions.clearText;
@@ -34,44 +7,91 @@ import static androidx.test.espresso.action.ViewActions.click;
 import static androidx.test.espresso.action.ViewActions.closeSoftKeyboard;
 import static androidx.test.espresso.action.ViewActions.longClick;
 import static androidx.test.espresso.action.ViewActions.pressBack;
+import static androidx.test.espresso.action.ViewActions.scrollTo;
 import static androidx.test.espresso.action.ViewActions.typeText;
 import static androidx.test.espresso.matcher.ViewMatchers.hasDescendant;
+import static androidx.test.espresso.matcher.ViewMatchers.isDescendantOfA;
 import static androidx.test.espresso.matcher.ViewMatchers.isRoot;
+import static androidx.test.espresso.matcher.ViewMatchers.withClassName;
 import static androidx.test.espresso.matcher.ViewMatchers.withId;
 import static androidx.test.espresso.matcher.ViewMatchers.withText;
 import static junit.framework.TestCase.assertFalse;
 import static junit.framework.TestCase.assertNull;
 import static junit.framework.TestCase.assertTrue;
-import static org.hamcrest.Matchers.anything;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.containsString;
+
+import androidx.annotation.IdRes;
+import androidx.recyclerview.widget.RecyclerView;
+import androidx.test.espresso.ViewInteraction;
+import androidx.test.espresso.contrib.RecyclerViewActions;
+import androidx.test.espresso.matcher.RootMatchers;
+import androidx.test.ext.junit.rules.ActivityScenarioRule;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.LargeTest;
+
+import com.beemdevelopment.aegis.encoding.Base32;
+import com.beemdevelopment.aegis.encoding.Hex;
+import com.beemdevelopment.aegis.otp.HotpInfo;
+import com.beemdevelopment.aegis.otp.MotpInfo;
+import com.beemdevelopment.aegis.otp.SteamInfo;
+import com.beemdevelopment.aegis.otp.TotpInfo;
+import com.beemdevelopment.aegis.otp.YandexInfo;
+import com.beemdevelopment.aegis.rules.ScreenshotTestRule;
+import com.beemdevelopment.aegis.ui.MainActivity;
+import com.beemdevelopment.aegis.ui.views.EntryAdapter;
+import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
+
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.rules.TestRule;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
 
 @RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
 @LargeTest
 public class OverallTest extends AegisTest {
     private static final String _groupName = "Test";
 
+    private final ActivityScenarioRule<MainActivity> _activityRule = new ActivityScenarioRule<>(MainActivity.class);
+
     @Rule
-    public final ActivityScenarioRule<MainActivity> activityRule = new ActivityScenarioRule<>(MainActivity.class);
+    public final TestRule testRule = RuleChain.outerRule(_activityRule).around(new ScreenshotTestRule());
 
     @Test
-    public void doOverallTest() {
+    public void testOverall() {
         ViewInteraction next = onView(withId(R.id.btnNext));
         next.perform(click());
         onView(withId(R.id.rb_password)).perform(click());
         next.perform(click());
-        onView(withId(R.id.text_password)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
+        onView(withId(R.id.text_password)).perform(click()).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
         onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
         next.perform(click());
         onView(withId(R.id.btnNext)).perform(click());
 
-        VaultManager vault = getVault();
+        VaultRepository vault = _vaultManager.getVault();
         assertTrue(vault.isEncryptionEnabled());
         assertTrue(vault.getCredentials().getSlots().has(PasswordSlot.class));
+        assertTrue(_prefs.isIntroDone());
 
         List<VaultEntry> entries = Arrays.asList(
                 generateEntry(TotpInfo.class, "Frank", "Google"),
                 generateEntry(HotpInfo.class, "John", "GitHub"),
                 generateEntry(TotpInfo.class, "Alice", "Office 365"),
-                generateEntry(SteamInfo.class, "Gaben", "Steam")
+                generateEntry(SteamInfo.class, "Gaben", "Steam"),
+                generateEntry(YandexInfo.class, "Ivan", "Yandex", 16),
+                generateEntry(MotpInfo.class, "Jimmy McGill", "PfSense", 16)
         );
         for (VaultEntry entry : entries) {
             addEntry(entry);
@@ -79,23 +99,31 @@ public class OverallTest extends AegisTest {
 
         List<VaultEntry> realEntries = new ArrayList<>(vault.getEntries());
         for (int i = 0; i < realEntries.size(); i++) {
-            assertTrue(realEntries.get(i).equivalates(entries.get(i)));
+            String message = String.format("%s != %s", realEntries.get(i).toJson().toString(), entries.get(i).toJson().toString());
+            assertTrue(message, realEntries.get(i).equivalates(entries.get(i)));
         }
 
         for (int i = 0; i < 10; i++) {
-            onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(1, clickChildViewWithId(R.id.buttonRefresh)));
+            onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnHolderItem(withOtpType(HotpInfo.class), clickChildViewWithId(R.id.buttonRefresh)));
         }
 
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(0, longClick()));
+        AtomicBoolean isErrorCardShown = new AtomicBoolean(false);
+        _activityRule.getScenario().onActivity(activity -> {
+            isErrorCardShown.set(((EntryAdapter)((RecyclerView) activity.findViewById(R.id.rvKeyProfiles)).getAdapter()).isErrorCardShown());
+        });
+
+        int entryPosOffset = isErrorCardShown.get() ? 1 : 0;
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 0, longClick()));
         onView(withId(R.id.action_copy)).perform(click());
 
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(1, longClick()));
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 1, longClick()));
         onView(withId(R.id.action_edit)).perform(click());
         onView(withId(R.id.text_name)).perform(clearText(), typeText("Bob"), closeSoftKeyboard());
-        onView(withId(R.id.spinner_group)).perform(click());
-        onData(anything()).atPosition(1).perform(click());
+        onView(withId(R.id.text_group)).perform(click());
+        onView(withId(R.id.addGroup)).inRoot(RootMatchers.isDialog()).perform(click());
         onView(withId(R.id.text_input)).perform(typeText(_groupName), closeSoftKeyboard());
         onView(withId(android.R.id.button1)).perform(click());
+        onView(withText(R.string.save)).perform(click());
         onView(isRoot()).perform(pressBack());
         onView(withId(android.R.id.button1)).perform(click());
 
@@ -105,35 +133,36 @@ public class OverallTest extends AegisTest {
         changeSort(R.string.sort_alphabetically_reverse);
         changeSort(R.string.sort_custom);
 
-        changeFilter(_groupName);
-        changeFilter(R.string.filter_ungrouped);
-        changeFilter(R.string.all);
+        changeGroupFilter(_groupName);
+        changeGroupFilter(null);
 
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(1, longClick()));
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(2, click()));
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(3, click()));
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 2, longClick()));
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 3, click()));
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 4, click()));
         onView(withId(R.id.action_share_qr)).perform(click());
         onView(withId(R.id.btnNext)).perform(click()).perform(click()).perform(click());
 
-        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(2, longClick()));
-        onView(withId(R.id.action_delete)).perform(click());
+        onView(withId(R.id.rvKeyProfiles)).perform(RecyclerViewActions.actionOnItemAtPosition(entryPosOffset + 0, longClick()));
+        onView(allOf(isDescendantOfA(withClassName(containsString("ActionBarContextView"))), withClassName(containsString("OverflowMenuButton")))).perform(click());
+        onView(withText(R.string.action_delete)).perform(click());
         onView(withId(android.R.id.button1)).perform(click());
 
         openContextualActionModeOverflowMenu();
         onView(withText(R.string.lock)).perform(click());
         onView(withId(R.id.text_password)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
         onView(withId(R.id.button_decrypt)).perform(click());
-        vault = getVault();
+        vault = _vaultManager.getVault();
 
         openContextualActionModeOverflowMenu();
         onView(withText(R.string.action_settings)).perform(click());
-        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_encryption_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_section_security_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItemAtPosition(1, click()));
         onView(withId(android.R.id.button1)).perform(click());
 
         assertFalse(vault.isEncryptionEnabled());
         assertNull(vault.getCredentials());
 
-        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItem(hasDescendant(withText(R.string.pref_encryption_title)), click()));
+        onView(withId(androidx.preference.R.id.recycler_view)).perform(RecyclerViewActions.actionOnItemAtPosition(1, click()));
         onView(withId(R.id.text_password)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
         onView(withId(R.id.text_password_confirm)).perform(typeText(VAULT_PASSWORD), closeSoftKeyboard());
         onView(withId(android.R.id.button1)).perform(click());
@@ -147,44 +176,61 @@ public class OverallTest extends AegisTest {
         onView(withText(resId)).perform(click());
     }
 
-    private void changeFilter(String text) {
-        openContextualActionModeOverflowMenu();
-        onView(withText(R.string.filter)).perform(click());
-        onView(withText(text)).perform(click());
-    }
-
-    private void changeFilter(@IdRes int resId) {
-        changeFilter(ApplicationProvider.getApplicationContext().getString(resId));
+    private void changeGroupFilter(String text) {
+        if (text == null) {
+            onView(allOf(withText(R.string.no_group), isDescendantOfA(withId(R.id.groupChipGroup)))).perform(click());
+        } else {
+            onView(allOf(withText(text), isDescendantOfA(withId(R.id.groupChipGroup)))).perform(click());
+        }
     }
 
     private void addEntry(VaultEntry entry) {
-        onView(withId(R.id.fab_expand_menu_button)).perform(click());
+        onView(withId(R.id.fab)).perform(click());
         onView(withId(R.id.fab_enter)).perform(click());
 
+        onView(withId(R.id.accordian_header)).perform(scrollTo(), click());
         onView(withId(R.id.text_name)).perform(typeText(entry.getName()), closeSoftKeyboard());
         onView(withId(R.id.text_issuer)).perform(typeText(entry.getIssuer()), closeSoftKeyboard());
 
         if (entry.getInfo().getClass() != TotpInfo.class) {
-            int i = entry.getInfo() instanceof HotpInfo ? 1 : 2;
-            try {
-                onView(withId(R.id.spinner_type)).perform(click());
-                onData(anything()).atPosition(i).perform(click());
-            } catch (AmbiguousViewMatcherException e) {
-                // for some reason, clicking twice is sometimes necessary, otherwise the test fails on the next line
-                onView(withId(R.id.spinner_type)).perform(click());
-                onData(anything()).atPosition(i).perform(click());
-            }
+            String otpType;
             if (entry.getInfo() instanceof HotpInfo) {
-                onView(withId(R.id.text_counter)).perform(typeText("0"), closeSoftKeyboard());
-            }
-            if (entry.getInfo() instanceof SteamInfo) {
-                onView(withId(R.id.text_digits)).perform(clearText(), typeText("5"), closeSoftKeyboard());
+                otpType = "HOTP";
+            } else if (entry.getInfo() instanceof SteamInfo) {
+                otpType = "Steam";
+            } else if (entry.getInfo() instanceof YandexInfo) {
+                otpType = "Yandex";
+            } else if (entry.getInfo() instanceof MotpInfo) {
+                otpType = "MOTP";
+            } else if (entry.getInfo() instanceof TotpInfo) {
+                otpType = "TOTP";
+            } else {
+                throw new RuntimeException(String.format("Unexpected entry type: %s", entry.getInfo().getClass().getSimpleName()));
             }
+
+            onView(withId(R.id.dropdown_type)).perform(scrollTo(), click());
+            onView(withText(otpType)).inRoot(RootMatchers.isPlatformPopup()).perform(click());
+        }
+
+        String secret;
+        if (Objects.equals(entry.getInfo().getTypeId(), MotpInfo.ID)) {
+            secret = Hex.encode(entry.getInfo().getSecret());
+        } else {
+            secret = Base32.encode(entry.getInfo().getSecret());
         }
 
-        String secret = Base32.encode(entry.getInfo().getSecret());
         onView(withId(R.id.text_secret)).perform(typeText(secret), closeSoftKeyboard());
 
+        if (entry.getInfo() instanceof YandexInfo) {
+            String pin = "123456";
+            ((YandexInfo) entry.getInfo()).setPin(pin);
+            onView(withId(R.id.text_pin)).perform(typeText(pin), closeSoftKeyboard());
+        } else if (entry.getInfo() instanceof MotpInfo) {
+            String pin = "1234";
+            ((MotpInfo) entry.getInfo()).setPin(pin);
+            onView(withId(R.id.text_pin)).perform(typeText(pin), closeSoftKeyboard());
+        }
+
         onView(withId(R.id.action_save)).perform(click());
     }
 }

app/src/androidTest/java/com/beemdevelopment/aegis/PanicTriggerTest.java

@@ -0,0 +1,58 @@
+package com.beemdevelopment.aegis;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+import android.content.Intent;
+
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ActivityTestRule;
+
+import com.beemdevelopment.aegis.ui.PanicResponderActivity;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
+
+@RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
+@SmallTest
+public class PanicTriggerTest extends AegisTest {
+    @Before
+    public void before() {
+        initEncryptedVault();
+    }
+
+    @Test
+    public void testPanicTriggerDisabled() {
+        assertFalse(_prefs.isPanicTriggerEnabled());
+        assertTrue(_vaultManager.isVaultLoaded());
+        launchPanic();
+        assertTrue(_vaultManager.isVaultLoaded());
+        _vaultManager.getVault();
+        assertTrue(VaultRepository.fileExists(getApp()));
+    }
+
+    @Test
+    public void testPanicTriggerEnabled() {
+        _prefs.setIsPanicTriggerEnabled(true);
+        assertTrue(_prefs.isPanicTriggerEnabled());
+        assertTrue(_vaultManager.isVaultLoaded());
+        launchPanic();
+        assertFalse(_vaultManager.isVaultLoaded());
+        assertThrows(IllegalStateException.class, () -> _vaultManager.getVault());
+        assertFalse(VaultRepository.fileExists(getApp()));
+    }
+
+    private void launchPanic() {
+        Intent intent = new Intent(PanicResponderActivity.PANIC_TRIGGER_ACTION);
+        // we need to use the deprecated ActivityTestRule class because of https://github.com/android/android-test/issues/143
+        ActivityTestRule<PanicResponderActivity> rule = new ActivityTestRule<>(PanicResponderActivity.class);
+        rule.launchActivity(intent);
+    }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/rules/ScreenshotTestRule.java

@@ -0,0 +1,36 @@
+package com.beemdevelopment.aegis.rules;
+
+import android.graphics.Bitmap;
+
+import androidx.test.runner.screenshot.BasicScreenCaptureProcessor;
+import androidx.test.runner.screenshot.ScreenCapture;
+import androidx.test.runner.screenshot.ScreenCaptureProcessor;
+import androidx.test.runner.screenshot.Screenshot;
+
+import org.junit.rules.TestWatcher;
+import org.junit.runner.Description;
+
+import java.io.IOException;
+import java.util.HashSet;
+
+public class ScreenshotTestRule extends TestWatcher {
+    @Override
+    protected void failed(Throwable e, Description description) {
+        super.failed(e, description);
+
+        String filename = description.getTestClass().getSimpleName() + "-" + description.getMethodName();
+
+        ScreenCapture capture = Screenshot.capture();
+        capture.setName(filename);
+        capture.setFormat(Bitmap.CompressFormat.PNG);
+
+        HashSet<ScreenCaptureProcessor> processors = new HashSet<>();
+        processors.add(new BasicScreenCaptureProcessor());
+
+        try {
+            capture.process(processors);
+        } catch (IOException e2) {
+            e.printStackTrace();
+        }
+    }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/vault/VaultRepositoryTest.java

@@ -0,0 +1,43 @@
+package com.beemdevelopment.aegis.vault;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.SmallTest;
+
+import com.beemdevelopment.aegis.AegisTest;
+import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import dagger.hilt.android.testing.HiltAndroidTest;
+
+@RunWith(AndroidJUnit4.class)
+@HiltAndroidTest
+@SmallTest
+public class VaultRepositoryTest extends AegisTest {
+    @Before
+    public void before() {
+        initEncryptedVault();
+    }
+
+    @Test
+    public void testToggleEncryption() throws VaultRepositoryException {
+        VaultRepository vault = _vaultManager.getVault();
+        _vaultManager.disableEncryption();
+        assertFalse(vault.isEncryptionEnabled());
+        assertNull(vault.getCredentials());
+
+        VaultFileCredentials creds = generateCredentials();
+        _vaultManager.enableEncryption(creds);
+        assertTrue(vault.isEncryptionEnabled());
+        assertNotNull(vault.getCredentials());
+        assertEquals(vault.getCredentials().getSlots().findAll(PasswordSlot.class).size(), 1);
+    }
+}

app/src/androidTest/java/com/beemdevelopment/aegis/vectors/VaultEntries.java

@@ -0,0 +1 @@
+../../../../../../test/java/com/beemdevelopment/aegis/vectors/VaultEntries.java

app/src/androidTest/resources/com/beemdevelopment/aegis/aegis_encrypted.json

@@ -0,0 +1 @@
+../../../../../test/resources/com/beemdevelopment/aegis/importers/aegis_encrypted.json

app/src/androidTest/resources/com/beemdevelopment/aegis/aegis_plain.json

@@ -0,0 +1 @@
+../../../../../test/resources/com/beemdevelopment/aegis/importers/aegis_plain.json

app/src/main/AndroidManifest.xml

@@ -1,11 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    package="com.beemdevelopment.aegis">
+    xmlns:tools="http://schemas.android.com/tools">
 
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.USE_BIOMETRIC" />
 
+    <!-- NOTE: Disabled for now. See issue: #1047
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    -->
+
     <uses-feature
         android:name="android.hardware.camera"
         android:required="false" />
@@ -15,23 +18,28 @@
 
     <application
         android:name=".AegisApplication"
-        android:allowBackup="false"
+        android:allowBackup="true"
+        android:fullBackupOnly="true"
+        android:fullBackupContent="@xml/backup_rules_old"
+        android:dataExtractionRules="@xml/backup_rules"
+        android:backupAgent=".AegisBackupAgent"
+        android:enableOnBackInvokedCallback="true"
         android:icon="@mipmap/${iconName}"
         android:label="Aegis"
         android:supportsRtl="true"
-        android:theme="@style/AppTheme.NoActionBar"
-        tools:ignore="GoogleAppIndexingWarning"
-        tools:replace="android:theme">
+        android:theme="@style/Theme.Aegis.Launch"
+        tools:targetApi="tiramisu">
         <activity android:name=".ui.TransferEntriesActivity"
             android:label="@string/title_activity_transfer" />
         <activity
             android:name=".ui.AboutActivity"
             android:label="@string/title_activity_about" />
         <activity
-            android:name=".ui.SelectEntriesActivity"
-            android:label="@string/title_activity_select_entries" />
+            android:name=".ui.ImportEntriesActivity"
+            android:label="@string/title_activity_import_entries" />
         <activity
             android:name=".ui.MainActivity"
+            android:exported="true"
             android:label="${title}">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
@@ -46,6 +54,13 @@
 
                 <data android:scheme="otpauth" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
         </activity>
         <activity
             android:name=".ui.ScannerActivity"
@@ -57,22 +72,22 @@
             android:label="@string/title_activity_edit_entry" />
         <activity
             android:name=".ui.IntroActivity"
-            android:theme="@style/AppTheme.NoActionBar"
             android:screenOrientation="portrait" />
         <activity
-            android:name=".ui.AuthActivity"
-            android:theme="@style/AppTheme.NoActionBar" />
+            android:name=".ui.AuthActivity" />
         <activity
             android:name=".ui.PreferencesActivity"
             android:label="@string/title_activity_preferences" />
-        <activity
-            android:name=".ui.SlotManagerActivity"
-            android:label="@string/title_activity_manage_slots" />
         <activity
             android:name=".ui.GroupManagerActivity"
             android:label="@string/title_activity_manage_groups" />
+        <activity android:name=".ui.AssignIconsActivity"
+            android:label="@string/title_activity_assign_icons"/>
+        <activity android:name=".ui.LicensesActivity"
+            android:label="@string/title_activity_licenses"/>
         <activity
             android:name=".ui.PanicResponderActivity"
+            android:exported="true"
             android:launchMode="singleInstance"
             android:noHistory="true"
             android:theme="@android:style/Theme.NoDisplay">
@@ -83,7 +98,41 @@
         </activity>
         <activity android:name=".ui.ExitActivity" />
 
+        <!-- NOTE: Disabled for now. See issue: #1047
         <service android:name=".services.NotificationService" />
+        -->
+
+        <service
+            android:name=".services.LaunchAppTileService"
+            android:label="@string/tile_open_vault"
+            android:icon="@drawable/ic_aegis_quicksettings"
+            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.service.quicksettings.action.QS_TILE" />
+            </intent-filter>
+            <meta-data android:name="android.service.quicksettings.ACTIVE_TILE"
+                android:value="true" />
+        </service>
+
+        <service
+            android:name=".services.LaunchScannerTileService"
+            android:label="@string/tile_open_scanner"
+            android:icon="@drawable/ic_aegis_quicksettings"
+            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.service.quicksettings.action.QS_TILE" />
+            </intent-filter>
+            <meta-data android:name="android.service.quicksettings.ACTIVE_TILE"
+                android:value="true" />
+        </service>
+
+        <receiver android:name=".receivers.VaultLockReceiver" android:exported="false">
+            <intent-filter>
+                <action android:name="${applicationId}.LOCK_VAULT" />
+            </intent-filter>
+        </receiver>
 
         <provider
             android:name="androidx.core.content.FileProvider"
@@ -95,6 +144,21 @@
                 android:resource="@xml/file_paths">
             </meta-data>
         </provider>
+
+        <meta-data android:name="android.webkit.WebView.MetricsOptOut" android:value="true" />
     </application>
 
+    <queries>
+        <package android:name="me.jmh.authenticatorpro" />
+        <package android:name="com.authy.authy" />
+        <package android:name="org.fedorahosted.freeotp" />
+        <package android:name="org.liberty.android.freeotpplus" />
+        <package android:name="com.google.android.apps.authenticator2" />
+        <package android:name="com.azure.authenticator" />
+        <package android:name="com.valvesoftware.android.steam.community" />
+        <package android:name="com.authenticator.authservice2" />
+        <package android:name="com.duosecurity.duomobile" />
+        <package android:name="com.blizzard.messenger" />
+    </queries>
+
 </manifest>

app/src/main/assets/LICENSE

@@ -0,0 +1 @@
+../../../../LICENSE

app/src/main/assets/changelog.html

@@ -31,6 +31,292 @@
     </head>
     <body>
         <div></div>
+        <h3>Version 3.3.1</h3>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Codes were not shown in case the tiles view mode was combined with hidden account names</li>
+        </ul>
+        <h3>Version 3.3</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Significant improvements to group filtering
+                <ul>
+                    <li>Groups can now be filtered on straight from the main view instead of through a dialog</li>
+                    <li>Ability to assign multiple entries to a group in one go</li>
+                    <li>Support for reordering groups</li>
+                </ul>
+            </li>
+            <li>Codes now change color when they're about to expire</li>
+            <li>Option to show the next code ahead of time</li>
+            <li>Support for backing up to a single file (This enables support for more cloud providers, such as Google Drive)</li>
+            <li>Various minor improvements to make QR code exports easier to scan</li>
+            <li>Support for importing from Ente Auth</li>
+            <li>Support for importing FreeOTP 2 backups</li>
+            <li>Updated translations</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>QR codes exported for Google Authenticator could not be scanned on iOS</li>
+            <li>The code would be copied after a single tap in case "Tap to reveal" and "Copy tokens to the clipboard" were enabled simultaneously</li>
+            <li>Various other minor UI, stability and performance improvements</li>
+        </ul>
+        <h3>Version 3.2</h3>
+        <h4>New</h4>
+        <ul>
+            <li>The ability to add a single entry to multiple groups</li>
+            <li>Option to keep an infinite number of backups</li>
+            <li>Option to customize which fields to search for in entries</li>
+            <li>Allow hiding entry names in the tiled view mode</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>With "Tap to reveal" enabled, the size of the shown dots would not be consistent with the size of the code digits, on some devices</li>
+            <li>After importing a backup, the UI would in some cases incorrectly claim that biometric unlock is enabled</li>
+            <li>The export dialog was not fully visible on some devices</li>
+            <li>Various other minor UI, stability and performance improvements</li>
+        </ul>
+        <h3>Version 3.1.1</h3>
+        <h4>Fixes</h4>
+        <p>
+            A recent Android Pixel update introduced a bug causing Aegis to sometimes show a black screen after unlocking the vault.
+            We have reported this issue to the Google Issue Tracker (<a href="https://issuetracker.google.com/issues/352963108">link</a>) and
+            are awaiting a response from Google. In the meantime, we have implemented a workaround that eliminates this bug.
+        </p>
+        <ul>
+            <li>Group filter now gets applied properly upon unlocking the vault</li>
+            <li>Advanced entry settings now gets shown correctly</li>
+            <li>Keyboard when searching for entries now gets hidden when the user starts scrolling through the list</li>
+        </ul>
+        <h3>Version 3.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>A new audit log has been added to check all important events that occurred in your vault</li>
+            <li>Added the ability to rename groups</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Group selection will now be remembered again upon launch</li>
+            <li>Various UI improvements</li>
+            <li>Stability fixes</li>
+        </ul>
+        <h3>Version 3.0.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Support for importing from the new Battle.net app</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Visual glitches when AMOLED theme was used on old Android versions</li>
+            <li>Minor UI improvements</li>
+        </ul>
+        <h3>Version 3.0</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Material 3 (and Material You)</li>
+            <li>Automatic assignment of icons to entries</li>
+            <li>Ability to select all entries in one go</li>
+            <li>Support for importing 2FAS schema v4 backups</li>
+            <li>Sort entries based on the last time they were used</li>
+            <li>Some clarifications related to importing and backup permission errors</li>
+            <li>Preparations for the ability to assign a single entry to multiple groups</li>
+            <li>Performance improvements when scrolling through an entry list with lots of icons</li>
+            <li>A new look for the third-party licenses list</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Directly importing from Authy using root would fail</li>
+            <li>Minor glitches related to animation duration scale settings</li>
+            <li>Various stability improvements</li>
+        </ul>
+        <h3>Version 2.2.2</h3>
+        <h4>New</h4>
+        <ul>
+            <li>An optional name field for icon packs to bypass filename character restrictions</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>The Authenticator Pro importer only supported the legacy backup format</li>
+            <li>A crash could occur in the tile service</li>
+        </ul>
+        <h3>Version 2.2.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Ability to automatically skip potential duplicates when importing entries</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Biometrics button on the unlock screen was unresponsive</li>
+        </ul>
+        <h3>Version 2.2</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Authenticator Pro encrypted import support</li>
+            <li>Ability to change account name position</li>
+            <li>A new dialog explaining how our password reminder works</li>
+            <li>Ability to change copy behavior</li>
+            <li>Ability to only show account names when necessary</li>
+            <li>New view mode: Tiles/Grid</li>
+            <li>Added translation: Dutch (Frysian)</li>
+            <li>Updated translations</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Deleting an entry while a search filter is active now shows the correct state</li>
+            <li>Aegis now fully respects system animation settings</li>
+        </ul>
+        <h3>Version 2.1.3</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Option to disable the backup reminder</li>
+            <li>Improved group selection dropdown during vault export</li>
+            <li>New translation: Hebrew</li>
+            <li>Updated translations</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>A crash could occur because a Toast was incorrectly created</li>
+        </ul>
+        <h3>Version 2.1.2</h3>
+        <h4>Fixes</h4>
+        <ul>
+            <li>A crash could occur when changing an entry in such a way that it is filtered out from the entry list</li>
+        </ul>
+        <h3>Version 2.1.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>An option to export the vault as an HTML file</li>
+            <li>Support for importing from Battle.net Authenticator (root required)</li>
+            <li>An option to hide entry icons</li>
+            <li>An option to only include certain groups in an export</li>
+            <li>Copying a token now takes a second tap if tap to reveal is enabled</li>
+            <li>The ability to copy the URI when transferring entries through QR codes</li>
+            <li>Updated translations</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>The lock notification would remain after locking the vault in certain cases. For now, we've disabled the notification entirely.</li>
+            <li>Making changes to an entry while having one or more favorited entries in the vault could result in buggy ordering</li>
+            <li>Tapping to the reveal a token could increase the height of the entry in certain view modes on recent Android versions</li>
+            <li>The backup reminder was unclear about when the last successful backup took place</li>
+            <li>Users could accidentally select MD5 as the hash algorithm for non-mOTP entry types, causing crashes at seemingly random intervals. Any users who have gotten themselves into this situation will see these bad entries get reset to SHA1.</li>
+            <li>Importing from certain apps would cause a crash if an empty password was entered</li>
+            <li>The andOTP importer could hang indefinitely if the user accidentally selected a non-andOTP file.</li>
+            <li>Various other stability improvements</li>
+        </ul>
+        <h3>Version 2.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Support for mOTP</li>
+            <li>Support for Yandex OTP (Experimental)</li>
+            <li>An Adaptive Icon for Material You</li>
+            <li>Ability to favorite certain entries and pin them to the top of the entry list</li>
+            <li>Ability to filter by entries that are not in a group</li>
+            <li>Ability to set a separate password that is used for encrypting backups and exports</li>
+            <li>Support for predictive back gesture</li>
+            <li>Improved overview of backup status in preferences</li>
+            <li>Additional options for code digit grouping</li>
+            <li>Support for importing from Duo</li>
+            <li>Support for importing from Bitwarden</li>
+            <li>Support for importing multiple QR code images in one go</li>
+            <li>Support for scanning Google Authenticator export QR codes from image files</li>
+            <li>Display some extra information in the dialog displayed when deleting an entry</li>
+            <li>An option to export through Google Authenticator export QR code images</li>
+            <li>An option to import an existing vault file from the first page in the intro</li>
+            <li>An option to minimize the app after copying a token</li>
+            <li>A count of the total number of entries is displayed at the bottom of the entry list</li>
+            <li>A backup reminder is shown if changes were made to the vault, but no backup or export has been created yet since then</li>
+            <li>A warning is shown after a plaintext export has been made</li>
+            <li>An option to focus search immediately after the app starts</li>
+            <li>Allow customization of the frequency of the password reminder</li>
+            <li>Allow sharing text to Aegis in the format of a Google Authenticator URI to add as a new entry</li>
+            <li>Always allow D2D (device-to-device) Android backups regardless of backup settings</li>
+            <li>Mark clipboard data as sensitive when copying tokens so that Android will mask them in the UI</li>
+            <li>Updated translations for almost all languages</li>
+            <li>New languages: Asturian, Catalan, Galician</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Various reliability improvements for the QR code scanner</li>
+            <li>The floating action button was glitchy when making small entry list scroll movements</li>
+            <li>The vault unlocked notification was never shown and was still using the old app icon</li>
+            <li>The automatically generated entry icon was broken if the entry name/issuer is a multi-codepoint character (certain emoji's, for example)</li>
+            <li>The PIN keyboard was not disabled after enabling encryption</li>
+            <li>The password prompt message was unclear when importing from a file</li>
+            <li>The entry list was not sorted correctly if a change to an entry caused its location to change</li>
+            <li>Quickly double-tapping on the copy button would cause a crash</li>
+            <li>Importing an entry with an empty secret would cause a crash loop</li>
+            <li>On certain devices, it was not possible to import icon packs because the .ZIP files would be grayed out</li>
+            <li>An unclear error message was shown when trying to import from Steam and Google Authenticator</li>
+            <li>Various other minor UI and stability improvements</li>
+        </ul>
+        <h3>Version 2.0.3</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Support for importing 2FAS Authenticator's new backup format</li>
+        </ul>
+        <h3>Version 2.0.2</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Add a note field to entries</li>
+            <li>An option to pause code updating of highlighted entries</li>
+            <li>New translation: Lithuanian</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Minor UI and stability improvements</li>
+            <li>The Microsoft Authenticator importer did not accept spaces and dashes in secrets</li>
+        </ul>
+        <h3>Version 2.0.1</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Support for sorting on most used tokens</li>
+            <li>Some minor UX and stability improvements</li>
+            <li>New translation: Vietnamese</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>QR code information was decoded incorrectly in some cases if the app was set to a certain language (Turkish, for example)</li>
+        </ul>
+        <h3>Version 2.0</h3>
+        <h4>New</h4>
+        <ul>
+            <li>Support for icon packs</li>
+            <li>Support for participation in Android's backup system (Google Drive, Seedvault)</li>
+            <li>UI refresh (switched to the Material Components theme)</li>
+            <li>Bottom sheet with chips to filter on groups</li>
+            <li>Support for importing from 2FAS Authenticator</li>
+            <li>Search in account names by default (and remove the setting)</li>
+            <li>Replaced the FAB with a bottom sheet dialog</li>
+            <li>Reorganization of settings into separate categories</li>
+            <li>Ability to 'share' images of QR codes to scan in Aegis</li>
+            <li>Option to save the current group filter</li>
+            <li>New translations for Bulgarian, Danish, Latvian, Swedish and Ukranian</li>
+        </ul>
+        <h4>Fixes</h4>
+        <ul>
+            <li>The QR code scanner had trouble detecting QR codes on some devices due to low resolution image capture</li>
+            <li>The app would vanish from the recent apps list after locking</li>
+            <li>When importing from Nextcloud, Aegis would report that the file could not be found.</li>
+            <li>The biometrics prompt would not appear on some devices</li>
+            <li>The app would lock when selecting a file/icon on certain devices and configurations</li>
+            <li>There were multiple layout issues on small screen devices</li>
+            <li>Various other usability, performance and stability improvements</li>
+        </ul>
+        <h3>Version 1.4.2</h3>
+        <h4>Fixes</h4>
+        <ul>
+            <li>The app would crash if DocumentsUI is not present on the device</li>
+            <li>The app would close when selecting an icon if auto lock on minimize was enabled</li>
+            <li>Importing from Authy was flaky for entries that have an icon</li>
+            <li>The dark theme was not properly applied to the QR code scanner view</li>
+            <li>The app would crash on plain text export on some devices</li>
+            <li>Importing from Authenticator Plus stopped working</li>
+        </ul>
+        <h3>Version 1.4.1</h3>
+        <h4>Fixes</h4>
+        <ul>
+            <li>Scanning QR codes stopped working on certain devices (primarily OnePlus)</li>
+        </ul>
         <h3>Version 1.4</h3>
         <h4>New</h4>
         <ul>
@@ -58,6 +344,8 @@
             <li>The app would crash if an entry was added to the vault twice due to an IO error</li>
             <li>The app would crash if the device was rotated while a progress dialog was shown</li>
             <li>The PIN keyboard would show even if a new non-digit password was set</li>
+            <li>The password reminder popup would be occluded by the autofill popup</li>
+            <li>Importing from other apps on Android 11 was broken due to some permission issues</li>
         </ul>
         <h3>Version 1.3</h3>
         <h4>New</h4>

app/src/main/assets/license.html

@@ -0,0 +1,14 @@
+<html>
+    <head>
+        <style type="text/css">
+            body {
+                background-color: %2$s;
+                color: %3$s;
+                font-size: 0.8em;
+            }
+        </style>
+    </head>
+    <body>
+        <pre>%1$s</pre>
+    </body>
+</html>

app/src/main/java/com/amulyakhare/textdrawable/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Amulya Khare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

app/src/main/java/com/amulyakhare/textdrawable/TextDrawable.java

@@ -0,0 +1,316 @@
+package com.amulyakhare.textdrawable;
+
+import android.graphics.*;
+import android.graphics.drawable.ShapeDrawable;
+import android.graphics.drawable.shapes.OvalShape;
+import android.graphics.drawable.shapes.RectShape;
+import android.graphics.drawable.shapes.RoundRectShape;
+
+/**
+ * @author amulya
+ * @datetime 14 Oct 2014, 3:53 PM
+ */
+public class TextDrawable extends ShapeDrawable {
+
+    private final Paint textPaint;
+    private final Paint borderPaint;
+    private static final float SHADE_FACTOR = 0.9f;
+    private final String text;
+    private final int color;
+    private final RectShape shape;
+    private final int height;
+    private final int width;
+    private final int fontSize;
+    private final float radius;
+    private final int borderThickness;
+
+    private TextDrawable(Builder builder) {
+        super(builder.shape);
+
+        // shape properties
+        shape = builder.shape;
+        height = builder.height;
+        width = builder.width;
+        radius = builder.radius;
+
+        // text and color
+        text = builder.toUpperCase ? builder.text.toUpperCase() : builder.text;
+        color = builder.color;
+
+        // text paint settings
+        fontSize = builder.fontSize;
+        textPaint = new Paint();
+        textPaint.setColor(builder.textColor);
+        textPaint.setAntiAlias(true);
+        textPaint.setFakeBoldText(builder.isBold);
+        textPaint.setStyle(Paint.Style.FILL);
+        textPaint.setTypeface(builder.font);
+        textPaint.setTextAlign(Paint.Align.CENTER);
+        textPaint.setStrokeWidth(builder.borderThickness);
+
+        // border paint settings
+        borderThickness = builder.borderThickness;
+        borderPaint = new Paint();
+        borderPaint.setColor(getDarkerShade(color));
+        borderPaint.setStyle(Paint.Style.STROKE);
+        borderPaint.setStrokeWidth(borderThickness);
+
+        // drawable paint color
+        Paint paint = getPaint();
+        paint.setColor(color);
+
+    }
+
+    private int getDarkerShade(int color) {
+        return Color.rgb((int)(SHADE_FACTOR * Color.red(color)),
+                (int)(SHADE_FACTOR * Color.green(color)),
+                (int)(SHADE_FACTOR * Color.blue(color)));
+    }
+
+    @Override
+    public void draw(Canvas canvas) {
+        super.draw(canvas);
+        Rect r = getBounds();
+
+
+        // draw border
+        if (borderThickness > 0) {
+            drawBorder(canvas);
+        }
+
+        int count = canvas.save();
+        canvas.translate(r.left, r.top);
+
+        // draw text
+        int width = this.width < 0 ? r.width() : this.width;
+        int height = this.height < 0 ? r.height() : this.height;
+        int fontSize = this.fontSize < 0 ? (Math.min(width, height) / 2) : this.fontSize;
+        textPaint.setTextSize(fontSize);
+        canvas.drawText(text, width / 2, height / 2 - ((textPaint.descent() + textPaint.ascent()) / 2), textPaint);
+
+        canvas.restoreToCount(count);
+
+    }
+
+    private void drawBorder(Canvas canvas) {
+        RectF rect = new RectF(getBounds());
+        rect.inset(borderThickness/2, borderThickness/2);
+
+        if (shape instanceof OvalShape) {
+            canvas.drawOval(rect, borderPaint);
+        }
+        else if (shape instanceof RoundRectShape) {
+            canvas.drawRoundRect(rect, radius, radius, borderPaint);
+        }
+        else {
+            canvas.drawRect(rect, borderPaint);
+        }
+    }
+
+    @Override
+    public void setAlpha(int alpha) {
+        textPaint.setAlpha(alpha);
+    }
+
+    @Override
+    public void setColorFilter(ColorFilter cf) {
+        textPaint.setColorFilter(cf);
+    }
+
+    @Override
+    public int getOpacity() {
+        return PixelFormat.TRANSLUCENT;
+    }
+
+    @Override
+    public int getIntrinsicWidth() {
+        return width;
+    }
+
+    @Override
+    public int getIntrinsicHeight() {
+        return height;
+    }
+
+    public static IShapeBuilder builder() {
+        return new Builder();
+    }
+
+    public static class Builder implements IConfigBuilder, IShapeBuilder, IBuilder {
+
+        private String text;
+
+        private int color;
+
+        private int borderThickness;
+
+        private int width;
+
+        private int height;
+
+        private Typeface font;
+
+        private RectShape shape;
+
+        public int textColor;
+
+        private int fontSize;
+
+        private boolean isBold;
+
+        private boolean toUpperCase;
+
+        public float radius;
+
+        private Builder() {
+            text = "";
+            color = Color.GRAY;
+            textColor = Color.WHITE;
+            borderThickness = 0;
+            width = -1;
+            height = -1;
+            shape = new RectShape();
+            font = Typeface.create("sans-serif-light", Typeface.NORMAL);
+            fontSize = -1;
+            isBold = false;
+            toUpperCase = false;
+        }
+
+        public IConfigBuilder width(int width) {
+            this.width = width;
+            return this;
+        }
+
+        public IConfigBuilder height(int height) {
+            this.height = height;
+            return this;
+        }
+
+        public IConfigBuilder textColor(int color) {
+            this.textColor = color;
+            return this;
+        }
+
+        public IConfigBuilder withBorder(int thickness) {
+            this.borderThickness = thickness;
+            return this;
+        }
+
+        public IConfigBuilder useFont(Typeface font) {
+            this.font = font;
+            return this;
+        }
+
+        public IConfigBuilder fontSize(int size) {
+            this.fontSize = size;
+            return this;
+        }
+
+        public IConfigBuilder bold() {
+            this.isBold = true;
+            return this;
+        }
+
+        public IConfigBuilder toUpperCase() {
+            this.toUpperCase = true;
+            return this;
+        }
+
+        @Override
+        public IConfigBuilder beginConfig() {
+            return this;
+        }
+
+        @Override
+        public IShapeBuilder endConfig() {
+            return this;
+        }
+
+        @Override
+        public IBuilder rect() {
+            this.shape = new RectShape();
+            return this;
+        }
+
+        @Override
+        public IBuilder round() {
+            this.shape = new OvalShape();
+            return this;
+        }
+
+        @Override
+        public IBuilder roundRect(int radius) {
+            this.radius = radius;
+            float[] radii = {radius, radius, radius, radius, radius, radius, radius, radius};
+            this.shape = new RoundRectShape(radii, null, null);
+            return this;
+        }
+
+        @Override
+        public TextDrawable buildRect(String text, int color) {
+            rect();
+            return build(text, color);
+        }
+
+        @Override
+        public TextDrawable buildRoundRect(String text, int color, int radius) {
+            roundRect(radius);
+            return build(text, color);
+        }
+
+        @Override
+        public TextDrawable buildRound(String text, int color) {
+            round();
+            return build(text, color);
+        }
+
+        @Override
+        public TextDrawable build(String text, int color) {
+            this.color = color;
+            this.text = text;
+            return new TextDrawable(this);
+        }
+    }
+
+    public interface IConfigBuilder {
+        public IConfigBuilder width(int width);
+
+        public IConfigBuilder height(int height);
+
+        public IConfigBuilder textColor(int color);
+
+        public IConfigBuilder withBorder(int thickness);
+
+        public IConfigBuilder useFont(Typeface font);
+
+        public IConfigBuilder fontSize(int size);
+
+        public IConfigBuilder bold();
+
+        public IConfigBuilder toUpperCase();
+
+        public IShapeBuilder endConfig();
+    }
+
+    public static interface IBuilder {
+
+        public TextDrawable build(String text, int color);
+    }
+
+    public static interface IShapeBuilder {
+
+        public IConfigBuilder beginConfig();
+
+        public IBuilder rect();
+
+        public IBuilder round();
+
+        public IBuilder roundRect(int radius);
+
+        public TextDrawable buildRect(String text, int color);
+
+        public TextDrawable buildRoundRect(String text, int color, int radius);
+
+        public TextDrawable buildRound(String text, int color);
+    }
+}

app/src/main/java/com/amulyakhare/textdrawable/util/ColorGenerator.java

@@ -0,0 +1,69 @@
+package com.amulyakhare.textdrawable.util;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Random;
+
+/**
+ * @author amulya
+ * @datetime 14 Oct 2014, 5:20 PM
+ */
+public class ColorGenerator {
+
+    public static ColorGenerator DEFAULT;
+
+    public static ColorGenerator MATERIAL;
+
+    static {
+        DEFAULT = create(Arrays.asList(
+                0xfff16364,
+                0xfff58559,
+                0xfff9a43e,
+                0xffe4c62e,
+                0xff67bf74,
+                0xff59a2be,
+                0xff2093cd,
+                0xffad62a7,
+                0xff805781
+        ));
+        MATERIAL = create(Arrays.asList(
+                0xffe57373,
+                0xfff06292,
+                0xffba68c8,
+                0xff9575cd,
+                0xff7986cb,
+                0xff64b5f6,
+                0xff4fc3f7,
+                0xff4dd0e1,
+                0xff4db6ac,
+                0xff81c784,
+                0xffaed581,
+                0xffff8a65,
+                0xffd4e157,
+                0xffffd54f,
+                0xffffb74d,
+                0xffa1887f,
+                0xff90a4ae
+        ));
+    }
+
+    private final List<Integer> mColors;
+    private final Random mRandom;
+
+    public static ColorGenerator create(List<Integer> colorList) {
+        return new ColorGenerator(colorList);
+    }
+
+    private ColorGenerator(List<Integer> colorList) {
+        mColors = colorList;
+        mRandom = new Random(System.currentTimeMillis());
+    }
+
+    public int getRandomColor() {
+        return mColors.get(mRandom.nextInt(mColors.size()));
+    }
+
+    public int getColor(Object key) {
+        return mColors.get(Math.abs(key.hashCode()) % mColors.size());
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/AccountNamePosition.java

@@ -0,0 +1,17 @@
+package com.beemdevelopment.aegis;
+
+public enum AccountNamePosition {
+    HIDDEN,
+    END,
+    BELOW;
+
+    private static AccountNamePosition[] _values;
+
+    static {
+        _values = values();
+    }
+
+    public static AccountNamePosition fromInteger(int x) {
+        return _values[x];
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/AegisApplication.java

@@ -1,214 +1,8 @@
 package com.beemdevelopment.aegis;
 
-import android.app.Application;
-import android.app.NotificationChannel;
-import android.app.NotificationManager;
-import android.content.BroadcastReceiver;
-import android.content.Context;
-import android.content.Intent;
-import android.content.IntentFilter;
-import android.content.pm.ShortcutInfo;
-import android.content.pm.ShortcutManager;
-import android.graphics.drawable.Icon;
-import android.os.Build;
+import dagger.hilt.android.HiltAndroidApp;
 
-import androidx.annotation.NonNull;
-import androidx.annotation.RequiresApi;
-import androidx.lifecycle.Lifecycle;
-import androidx.lifecycle.LifecycleEventObserver;
-import androidx.lifecycle.LifecycleOwner;
-import androidx.lifecycle.ProcessLifecycleOwner;
+@HiltAndroidApp
+public class AegisApplication extends AegisApplicationBase {
 
-import com.beemdevelopment.aegis.services.NotificationService;
-import com.beemdevelopment.aegis.ui.MainActivity;
-import com.beemdevelopment.aegis.util.IOUtils;
-import com.beemdevelopment.aegis.vault.Vault;
-import com.beemdevelopment.aegis.vault.VaultFile;
-import com.beemdevelopment.aegis.vault.VaultFileCredentials;
-import com.beemdevelopment.aegis.vault.VaultManager;
-import com.beemdevelopment.aegis.vault.VaultManagerException;
-import com.mikepenz.iconics.Iconics;
-import com.mikepenz.material_design_iconic_typeface_library.MaterialDesignIconic;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-public class AegisApplication extends Application {
-    private VaultFile _vaultFile;
-    private VaultManager _manager;
-    private Preferences _prefs;
-    private List<LockListener> _lockListeners;
-
-    private static final String CODE_LOCK_STATUS_ID = "lock_status_channel";
-    private static final String CODE_LOCK_VAULT_ACTION = "lock_vault";
-
-    @Override
-    public void onCreate() {
-        super.onCreate();
-        _prefs = new Preferences(this);
-        _lockListeners = new ArrayList<>();
-
-        Iconics.init(this);
-        Iconics.registerFont(new MaterialDesignIconic());
-
-        // listen for SCREEN_OFF events
-        ScreenOffReceiver receiver = new ScreenOffReceiver();
-        IntentFilter intentFilter = new IntentFilter();
-        intentFilter.addAction(Intent.ACTION_SCREEN_OFF);
-        intentFilter.addAction(CODE_LOCK_VAULT_ACTION);
-        registerReceiver(receiver, intentFilter);
-
-        // lock the app if the user moves the application to the background
-        ProcessLifecycleOwner.get().getLifecycle().addObserver(new AppLifecycleObserver());
-
-        // clear the cache directory on startup, to make sure no temporary vault export files remain
-        IOUtils.clearDirectory(getCacheDir(), false);
-
-        if (android.os.Build.VERSION.SDK_INT >= Build.VERSION_CODES.N_MR1) {
-            initAppShortcuts();
-        }
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            initNotificationChannels();
-        }
-    }
-
-    public boolean isVaultLocked() {
-        return _manager == null;
-    }
-
-    /**
-     * Loads the vault file from disk at the default location, stores an internal
-     * reference to it for future use and returns it. This must only be called before
-     * initVaultManager() or after lock().
-     */
-    public VaultFile loadVaultFile() throws VaultManagerException {
-        if (!isVaultLocked()) {
-            throw new AssertionError("loadVaultFile() may only be called before initVaultManager() or after lock()");
-        }
-
-        if (_vaultFile == null) {
-            _vaultFile = VaultManager.readFile(this);
-        }
-
-        return _vaultFile;
-    }
-
-    /**
-     * Initializes the vault manager by decrypting the given vaultFile with the given
-     * creds. This removes the internal reference to the raw vault file.
-     */
-    public VaultManager initVaultManager(VaultFile vaultFile, VaultFileCredentials creds) throws VaultManagerException {
-        _vaultFile = null;
-        _manager = VaultManager.init(this, vaultFile, creds);
-        return _manager;
-    }
-
-    /**
-     * Initializes the vault manager with the given vault and creds. This removes the
-     * internal reference to the raw vault file.
-     */
-    public VaultManager initVaultManager(Vault vault, VaultFileCredentials creds) {
-        _vaultFile = null;
-        _manager = new VaultManager(this, vault, creds);
-        return _manager;
-    }
-
-    public VaultManager getVaultManager() {
-        return _manager;
-    }
-
-    public Preferences getPreferences() {
-        return _prefs;
-    }
-
-    public boolean isAutoLockEnabled(int autoLockType) {
-        return _prefs.isAutoLockTypeEnabled(autoLockType) && !isVaultLocked() && _manager.isEncryptionEnabled();
-    }
-
-    public void registerLockListener(LockListener listener) {
-        _lockListeners.add(listener);
-    }
-
-    public void unregisterLockListener(LockListener listener) {
-        _lockListeners.remove(listener);
-    }
-
-    /**
-     * Locks the vault and the app.
-     * @param userInitiated whether or not the user initiated the lock in MainActivity.
-     */
-    public void lock(boolean userInitiated) {
-        _manager.destroy();
-        _manager = null;
-
-        for (LockListener listener : _lockListeners) {
-            listener.onLocked(userInitiated);
-        }
-
-        stopService(new Intent(AegisApplication.this, NotificationService.class));
-    }
-
-    @RequiresApi(api = Build.VERSION_CODES.N_MR1)
-    private void initAppShortcuts() {
-        ShortcutManager shortcutManager = getSystemService(ShortcutManager.class);
-        if (shortcutManager == null) {
-            return;
-        }
-
-        Intent intent = new Intent(this, MainActivity.class);
-        intent.putExtra("action", "scan");
-        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
-        intent.setAction(Intent.ACTION_MAIN);
-
-        ShortcutInfo shortcut = new ShortcutInfo.Builder(this, "shortcut_new")
-                .setShortLabel(getString(R.string.new_entry))
-                .setLongLabel(getString(R.string.add_new_entry))
-                .setIcon(Icon.createWithResource(this, R.drawable.ic_qr_code))
-                .setIntent(intent)
-                .build();
-
-        shortcutManager.setDynamicShortcuts(Collections.singletonList(shortcut));
-    }
-
-    private void initNotificationChannels() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            CharSequence name = getString(R.string.channel_name_lock_status);
-            String description = getString(R.string.channel_description_lock_status);
-            int importance = NotificationManager.IMPORTANCE_LOW;
-
-            NotificationChannel channel = new NotificationChannel(CODE_LOCK_STATUS_ID, name, importance);
-            channel.setDescription(description);
-
-            NotificationManager notificationManager = getSystemService(NotificationManager.class);
-            notificationManager.createNotificationChannel(channel);
-        }
-    }
-
-    private class AppLifecycleObserver implements LifecycleEventObserver {
-        @Override
-        public void onStateChanged(@NonNull LifecycleOwner source, @NonNull Lifecycle.Event event) {
-            if (event == Lifecycle.Event.ON_STOP && isAutoLockEnabled(Preferences.AUTO_LOCK_ON_MINIMIZE)) {
-                lock(false);
-            }
-        }
-    }
-
-    private class ScreenOffReceiver extends BroadcastReceiver {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (isAutoLockEnabled(Preferences.AUTO_LOCK_ON_DEVICE_LOCK)) {
-                lock(false);
-            }
-        }
-    }
-
-    public interface LockListener {
-        /**
-         * When called, the app/vault has been locked and the listener should perform its cleanup operations.
-         * @param userInitiated whether or not the user initiated the lock in MainActivity.
-         */
-        void onLocked(boolean userInitiated);
-    }
 }

app/src/main/java/com/beemdevelopment/aegis/AegisApplicationBase.java

@@ -0,0 +1,130 @@
+package com.beemdevelopment.aegis;
+
+import android.app.Application;
+import android.app.NotificationChannel;
+import android.app.NotificationManager;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.content.pm.ShortcutInfo;
+import android.content.pm.ShortcutManager;
+import android.graphics.drawable.Icon;
+import android.os.Build;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.RequiresApi;
+import androidx.core.content.ContextCompat;
+import androidx.lifecycle.Lifecycle;
+import androidx.lifecycle.LifecycleEventObserver;
+import androidx.lifecycle.LifecycleOwner;
+import androidx.lifecycle.ProcessLifecycleOwner;
+import androidx.room.Room;
+
+import com.beemdevelopment.aegis.database.AppDatabase;
+import com.beemdevelopment.aegis.database.AuditLogEntry;
+import com.beemdevelopment.aegis.database.AuditLogRepository;
+import com.beemdevelopment.aegis.receivers.VaultLockReceiver;
+import com.beemdevelopment.aegis.ui.MainActivity;
+import com.beemdevelopment.aegis.util.IOUtils;
+import com.beemdevelopment.aegis.vault.VaultManager;
+import com.topjohnwu.superuser.Shell;
+
+import org.checkerframework.checker.units.qual.A;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+
+import dagger.hilt.InstallIn;
+import dagger.hilt.android.EarlyEntryPoint;
+import dagger.hilt.android.EarlyEntryPoints;
+import dagger.hilt.components.SingletonComponent;
+
+public abstract class AegisApplicationBase extends Application {
+    private static final String CODE_LOCK_STATUS_ID = "lock_status_channel";
+
+    private VaultManager _vaultManager;
+
+    static {
+        // Enable verbose libsu logging in debug builds
+        Shell.enableVerboseLogging = BuildConfig.DEBUG;
+    }
+
+    @Override
+    public void onCreate() {
+        super.onCreate();
+        _vaultManager = EarlyEntryPoints.get(this, EntryPoint.class).getVaultManager();
+
+        VaultLockReceiver lockReceiver = new VaultLockReceiver();
+        IntentFilter intentFilter = new IntentFilter(Intent.ACTION_SCREEN_OFF);
+        ContextCompat.registerReceiver(this, lockReceiver, intentFilter, ContextCompat.RECEIVER_NOT_EXPORTED);
+
+        // lock the app if the user moves the application to the background
+        ProcessLifecycleOwner.get().getLifecycle().addObserver(new AppLifecycleObserver());
+
+        // clear the cache directory on startup, to make sure no temporary vault export files remain
+        IOUtils.clearDirectory(getCacheDir(), false);
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N_MR1) {
+            initAppShortcuts();
+        }
+
+        // NOTE: Disabled for now. See issue: #1047
+        /*if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            initNotificationChannels();
+        }*/
+    }
+
+    @RequiresApi(api = Build.VERSION_CODES.N_MR1)
+    private void initAppShortcuts() {
+        ShortcutManager shortcutManager = getSystemService(ShortcutManager.class);
+        if (shortcutManager == null) {
+            return;
+        }
+
+        Intent intent = new Intent(this, MainActivity.class);
+        intent.putExtra("action", "scan");
+        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        intent.setAction(Intent.ACTION_MAIN);
+
+        ShortcutInfo shortcut = new ShortcutInfo.Builder(this, "shortcut_new")
+                .setShortLabel(getString(R.string.new_entry))
+                .setLongLabel(getString(R.string.add_new_entry))
+                .setIcon(Icon.createWithResource(this, R.drawable.ic_qr_code))
+                .setIntent(intent)
+                .build();
+
+        shortcutManager.setDynamicShortcuts(Collections.singletonList(shortcut));
+    }
+
+    private void initNotificationChannels() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            CharSequence name = getString(R.string.channel_name_lock_status);
+            String description = getString(R.string.channel_description_lock_status);
+            int importance = NotificationManager.IMPORTANCE_LOW;
+
+            NotificationChannel channel = new NotificationChannel(CODE_LOCK_STATUS_ID, name, importance);
+            channel.setDescription(description);
+
+            NotificationManager notificationManager = getSystemService(NotificationManager.class);
+            notificationManager.createNotificationChannel(channel);
+        }
+    }
+
+    private class AppLifecycleObserver implements LifecycleEventObserver {
+        @Override
+        public void onStateChanged(@NonNull LifecycleOwner source, @NonNull Lifecycle.Event event) {
+            if (event == Lifecycle.Event.ON_STOP
+                    && _vaultManager.isAutoLockEnabled(Preferences.AUTO_LOCK_ON_MINIMIZE)
+                    && !_vaultManager.isAutoLockBlocked()) {
+                _vaultManager.lock(false);
+            }
+        }
+    }
+
+    @EarlyEntryPoint
+    @InstallIn(SingletonComponent.class)
+    interface EntryPoint {
+        VaultManager getVaultManager();
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/AegisBackupAgent.java

@@ -0,0 +1,147 @@
+package com.beemdevelopment.aegis;
+
+import android.app.backup.BackupAgent;
+import android.app.backup.BackupDataInput;
+import android.app.backup.BackupDataOutput;
+import android.app.backup.FullBackupDataOutput;
+import android.os.Build;
+import android.os.ParcelFileDescriptor;
+import android.util.Log;
+
+import com.beemdevelopment.aegis.database.AppDatabase;
+import com.beemdevelopment.aegis.database.AuditLogRepository;
+import com.beemdevelopment.aegis.util.IOUtils;
+import com.beemdevelopment.aegis.vault.VaultFile;
+import com.beemdevelopment.aegis.vault.VaultRepository;
+import com.beemdevelopment.aegis.vault.VaultRepositoryException;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+public class AegisBackupAgent extends BackupAgent {
+    private static final String TAG = AegisBackupAgent.class.getSimpleName();
+
+    private Preferences _prefs;
+
+    private AuditLogRepository _auditLogRepository;
+
+    @Override
+    public void onCreate() {
+        super.onCreate();
+
+        // Cannot use injection with Dagger Hilt here, because the app is launched in a restricted mode on restore
+        _prefs = new Preferences(this);
+        AppDatabase appDatabase = AegisModule.provideAppDatabase(this);
+        _auditLogRepository = AegisModule.provideAuditLogRepository(appDatabase);
+    }
+
+    @Override
+    public synchronized void onFullBackup(FullBackupDataOutput data) throws IOException {
+        Log.i(TAG, String.format("onFullBackup() called: flags=%d, quota=%d",
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.P ? data.getTransportFlags() : -1,
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.O ? data.getQuota() : -1));
+
+        boolean isD2D = Build.VERSION.SDK_INT >= Build.VERSION_CODES.P
+                && (data.getTransportFlags() & FLAG_DEVICE_TO_DEVICE_TRANSFER) == FLAG_DEVICE_TO_DEVICE_TRANSFER;
+
+        if (isD2D) {
+            Log.i(TAG, "onFullBackup(): allowing D2D transfer");
+        } else if (!_prefs.isAndroidBackupsEnabled()) {
+            Log.i(TAG, "onFullBackup() skipped: Android backups disabled in preferences");
+            return;
+        }
+
+        // We perform a catch of any Exception here to make sure we also
+        // report any runtime exceptions, in addition to the expected IOExceptions.
+        try {
+            fullBackup(data);
+            _auditLogRepository.addAndroidBackupCreatedEvent();
+            _prefs.setAndroidBackupResult(new Preferences.BackupResult(null));
+        } catch (Exception e) {
+            Log.e(TAG, String.format("onFullBackup() failed: %s", e));
+            _prefs.setAndroidBackupResult(new Preferences.BackupResult(e));
+            throw e;
+        }
+
+        Log.i(TAG, "onFullBackup() finished");
+    }
+
+    private void fullBackup(FullBackupDataOutput data) throws IOException {
+        // First copy the vault to the files/backup directory
+        createBackupDir();
+        File vaultBackupFile = getVaultBackupFile();
+        try (OutputStream outputStream = new FileOutputStream(vaultBackupFile)) {
+            VaultFile vaultFile = VaultRepository.readVaultFile(this);
+            byte[] bytes = vaultFile.exportable().toBytes();
+            outputStream.write(bytes);
+        } catch (VaultRepositoryException | IOException e) {
+            deleteBackupDir();
+            throw new IOException(e);
+        }
+
+        // Then call the original implementation so that fullBackupContent specified in AndroidManifest is read
+        try {
+            super.onFullBackup(data);
+        } finally {
+            deleteBackupDir();
+        }
+    }
+
+    @Override
+    public synchronized void onRestoreFile(ParcelFileDescriptor data, long size, File destination, int type, long mode, long mtime) throws IOException {
+        Log.i(TAG, String.format("onRestoreFile() called: dest=%s", destination));
+        super.onRestoreFile(data, size, destination, type, mode, mtime);
+
+        File vaultBackupFile = getVaultBackupFile();
+        if (destination.getCanonicalFile().equals(vaultBackupFile.getCanonicalFile())) {
+            try (InputStream inStream = new FileInputStream(vaultBackupFile)) {
+                VaultRepository.writeToFile(this, inStream);
+            } catch (IOException e) {
+                Log.e(TAG, String.format("onRestoreFile() failed: dest=%s, error=%s", destination, e));
+                throw e;
+            } finally {
+                deleteBackupDir();
+            }
+        }
+
+        Log.i(TAG, String.format("onRestoreFile() finished: dest=%s", destination));
+    }
+
+    @Override
+    public synchronized void onQuotaExceeded(long backupDataBytes, long quotaBytes) {
+        super.onQuotaExceeded(backupDataBytes, quotaBytes);
+        Log.e(TAG, String.format("onQuotaExceeded() called: backupDataBytes=%d, quotaBytes=%d", backupDataBytes, quotaBytes));
+    }
+
+    @Override
+    public void onBackup(ParcelFileDescriptor oldState, BackupDataOutput data, ParcelFileDescriptor newState) throws IOException {
+
+    }
+
+    @Override
+    public void onRestore(BackupDataInput data, int appVersionCode, ParcelFileDescriptor newState) throws IOException {
+
+    }
+
+    private void createBackupDir() throws IOException {
+        File dir = getVaultBackupFile().getParentFile();
+        if (dir == null || (!dir.exists() && !dir.mkdir())) {
+            throw new IOException(String.format("Unable to create backup directory: %s", dir));
+        }
+    }
+
+    private void deleteBackupDir() {
+        File dir = getVaultBackupFile().getParentFile();
+        if (dir != null) {
+            IOUtils.clearDirectory(dir, true);
+        }
+    }
+
+    private File getVaultBackupFile() {
+        return new File(new File(getFilesDir(), "backup"), VaultRepository.FILENAME);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/AegisModule.java

@@ -0,0 +1,55 @@
+package com.beemdevelopment.aegis;
+
+import android.content.Context;
+
+import androidx.room.Room;
+
+import com.beemdevelopment.aegis.database.AppDatabase;
+import com.beemdevelopment.aegis.database.AuditLogDao;
+import com.beemdevelopment.aegis.database.AuditLogRepository;
+import com.beemdevelopment.aegis.icons.IconPackManager;
+import com.beemdevelopment.aegis.vault.VaultManager;
+
+import javax.inject.Singleton;
+
+import dagger.Module;
+import dagger.Provides;
+import dagger.hilt.InstallIn;
+import dagger.hilt.android.qualifiers.ApplicationContext;
+import dagger.hilt.components.SingletonComponent;
+
+@Module
+@InstallIn(SingletonComponent.class)
+public class AegisModule {
+    @Provides
+    @Singleton
+    public static IconPackManager provideIconPackManager(@ApplicationContext Context context) {
+        return new IconPackManager(context);
+    }
+
+    @Provides
+    @Singleton
+    public static AuditLogRepository provideAuditLogRepository(AppDatabase appDatabase) {
+        AuditLogDao auditLogDao = appDatabase.auditLogDao();
+        return new AuditLogRepository(auditLogDao);
+    }
+
+    @Provides
+    @Singleton
+    public static VaultManager provideVaultManager(@ApplicationContext Context context, AuditLogRepository auditLogRepository) {
+        return new VaultManager(context, auditLogRepository);
+    }
+
+    @Provides
+    public static Preferences providePreferences(@ApplicationContext Context context) {
+        return new Preferences(context);
+    }
+
+    @Provides
+    @Singleton
+    public static AppDatabase provideAppDatabase(@ApplicationContext Context context) {
+        return Room.databaseBuilder(context.getApplicationContext(),
+                        AppDatabase.class, "aegis-db")
+                .build();
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/BackupsVersioningStrategy.java

@@ -0,0 +1,7 @@
+package com.beemdevelopment.aegis;
+
+public enum BackupsVersioningStrategy {
+    UNDEFINED,
+    MULTIPLE_BACKUPS,
+    SINGLE_BACKUP
+}

app/src/main/java/com/beemdevelopment/aegis/CopyBehavior.java

@@ -0,0 +1,17 @@
+package com.beemdevelopment.aegis;
+
+public enum CopyBehavior {
+    NEVER,
+    SINGLETAP,
+    DOUBLETAP;
+
+    private static CopyBehavior[] _values;
+
+    static {
+        _values = values();
+    }
+
+    public static CopyBehavior fromInteger(int x) {
+        return _values[x];
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/EventType.java

@@ -0,0 +1,42 @@
+package com.beemdevelopment.aegis;
+
+public enum EventType {
+
+    VAULT_UNLOCKED,
+    VAULT_BACKUP_CREATED,
+    VAULT_ANDROID_BACKUP_CREATED,
+    VAULT_EXPORTED,
+    ENTRY_SHARED,
+    VAULT_UNLOCK_FAILED_PASSWORD,
+    VAULT_UNLOCK_FAILED_BIOMETRICS;
+    private static EventType[] _values;
+
+    static {
+        _values = values();
+    }
+
+    public static EventType fromInteger(int x) {
+        return _values[x];
+    }
+
+    public static int getEventTitleRes(EventType eventType) {
+        switch (eventType) {
+            case VAULT_UNLOCKED:
+                return R.string.event_title_vault_unlocked;
+            case VAULT_BACKUP_CREATED:
+                return R.string.event_title_backup_created;
+            case VAULT_ANDROID_BACKUP_CREATED:
+                return R.string.event_title_android_backup_created;
+            case VAULT_EXPORTED:
+                return R.string.event_title_vault_exported;
+            case ENTRY_SHARED:
+                return R.string.event_title_entry_shared;
+            case VAULT_UNLOCK_FAILED_PASSWORD:
+                return R.string.event_title_vault_unlock_failed_password;
+            case VAULT_UNLOCK_FAILED_BIOMETRICS:
+                return R.string.event_title_vault_unlock_failed_biometrics;
+            default:
+                return R.string.event_unknown;
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/GroupPlaceholderType.java

@@ -0,0 +1,20 @@
+package com.beemdevelopment.aegis;
+
+public enum GroupPlaceholderType {
+    ALL,
+    NEW_GROUP,
+    NO_GROUP;
+
+    public int getStringRes() {
+        switch (this) {
+            case ALL:
+                return R.string.all;
+            case NEW_GROUP:
+                return R.string.new_group;
+            case NO_GROUP:
+                return R.string.no_group;
+            default:
+                throw new IllegalArgumentException("Unexpected placeholder type: " + this);
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/PassReminderFreq.java

@@ -0,0 +1,56 @@
+package com.beemdevelopment.aegis;
+
+import androidx.annotation.StringRes;
+
+import java.util.concurrent.TimeUnit;
+
+public enum PassReminderFreq {
+    NEVER,
+    WEEKLY,
+    BIWEEKLY,
+    MONTHLY,
+    QUARTERLY;
+
+    public long getDurationMillis() {
+        long weeks;
+        switch (this) {
+            case WEEKLY:
+                weeks = 1;
+                break;
+            case BIWEEKLY:
+                weeks = 2;
+                break;
+            case MONTHLY:
+                weeks = 4;
+                break;
+            case QUARTERLY:
+                weeks = 13;
+                break;
+            default:
+                weeks = 0;
+                break;
+        }
+
+        return TimeUnit.MILLISECONDS.convert(weeks * 7L, TimeUnit.DAYS);
+    }
+
+    @StringRes
+    public int getStringRes() {
+        switch (this) {
+            case WEEKLY:
+                return R.string.password_reminder_freq_weekly;
+            case BIWEEKLY:
+                return R.string.password_reminder_freq_biweekly;
+            case MONTHLY:
+                return R.string.password_reminder_freq_monthly;
+            case QUARTERLY:
+                return R.string.password_reminder_freq_quarterly;
+            default:
+                return R.string.password_reminder_freq_never;
+        }
+    }
+
+    public static PassReminderFreq fromInteger(int i) {
+        return PassReminderFreq.values()[i];
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/Preferences.java

@@ -5,11 +5,30 @@ import android.content.SharedPreferences;
 import android.content.res.Resources;
 import android.net.Uri;
 import android.os.Build;
-import android.preference.PreferenceManager;
 
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.core.provider.DocumentsContractCompat;
+import androidx.preference.PreferenceManager;
+
+import com.beemdevelopment.aegis.util.JsonUtils;
+import com.beemdevelopment.aegis.util.TimeUtils;
+import com.beemdevelopment.aegis.vault.VaultBackupPermissionException;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
 import java.util.Locale;
-import java.util.concurrent.TimeUnit;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
 
 public class Preferences {
     public static final int AUTO_LOCK_OFF = 1 << 0;
@@ -17,12 +36,26 @@ public class Preferences {
     public static final int AUTO_LOCK_ON_MINIMIZE = 1 << 2;
     public static final int AUTO_LOCK_ON_DEVICE_LOCK = 1 << 3;
 
+    public static final int SEARCH_IN_ISSUER = 1 << 0;
+    public static final int SEARCH_IN_NAME = 1 << 1;
+    public static final int SEARCH_IN_NOTE = 1 << 2;
+    public static final int SEARCH_IN_GROUPS = 1 << 3;
+
+    public static final int BACKUPS_VERSIONS_INFINITE = -1;
+
     public static final int[] AUTO_LOCK_SETTINGS = {
             AUTO_LOCK_ON_BACK_BUTTON,
             AUTO_LOCK_ON_MINIMIZE,
             AUTO_LOCK_ON_DEVICE_LOCK
     };
 
+    public static final int[] SEARCH_BEHAVIOR_SETTINGS = {
+            SEARCH_IN_ISSUER,
+            SEARCH_IN_NAME,
+            SEARCH_IN_NOTE,
+            SEARCH_IN_GROUPS
+    };
+
     private SharedPreferences _prefs;
 
     public Preferences(Context context) {
@@ -31,57 +64,113 @@ public class Preferences {
         if (getPasswordReminderTimestamp().getTime() == 0) {
             resetPasswordReminderTimestamp();
         }
+
+        migratePreferences();
+    }
+
+    public void migratePreferences() {
+        // Change copy on tap to copy behavior to new preference and delete the old key
+        String prefCopyOnTapKey = "pref_copy_on_tap";
+        if (_prefs.contains(prefCopyOnTapKey)) {
+
+            boolean isCopyOnTapEnabled = _prefs.getBoolean(prefCopyOnTapKey, false);
+            if (isCopyOnTapEnabled) {
+                setCopyBehavior(CopyBehavior.SINGLETAP);
+            }
+
+            _prefs.edit().remove(prefCopyOnTapKey).apply();
+        }
     }
 
     public boolean isTapToRevealEnabled() {
         return _prefs.getBoolean("pref_tap_to_reveal", false);
     }
 
-    public boolean isSearchAccountNameEnabled() {
-        return _prefs.getBoolean("pref_search_names", false);
-    }
-
     public boolean isEntryHighlightEnabled() {
         return _prefs.getBoolean("pref_highlight_entry", false);
     }
 
+    public boolean isPauseFocusedEnabled() {
+        boolean dependenciesEnabled = isTapToRevealEnabled() || isEntryHighlightEnabled();
+        if (!dependenciesEnabled) return false;
+        return _prefs.getBoolean("pref_pause_entry", false);
+    }
+
     public boolean isPanicTriggerEnabled() {
         return _prefs.getBoolean("pref_panic_trigger", false);
     }
 
+    public void setIsPanicTriggerEnabled(boolean enabled) {
+        _prefs.edit().putBoolean("pref_panic_trigger", enabled).apply();
+    }
+
     public boolean isSecureScreenEnabled() {
         // screen security should be enabled by default, but not for debug builds
         return _prefs.getBoolean("pref_secure_screen", !BuildConfig.DEBUG);
     }
 
-    public boolean isPasswordReminderEnabled() {
-        return _prefs.getBoolean("pref_password_reminder", true);
+    public PassReminderFreq getPasswordReminderFrequency() {
+        final String key = "pref_password_reminder_freq";
+        if (_prefs.contains(key) || _prefs.getBoolean("pref_password_reminder", true)) {
+            int i = _prefs.getInt(key, PassReminderFreq.BIWEEKLY.ordinal());
+            return PassReminderFreq.fromInteger(i);
+        }
+
+        return PassReminderFreq.NEVER;
+    }
+
+    public void setPasswordReminderFrequency(PassReminderFreq freq) {
+        _prefs.edit().putInt("pref_password_reminder_freq", freq.ordinal()).apply();
     }
 
     public boolean isPasswordReminderNeeded() {
-        long diff = new Date().getTime() - getPasswordReminderTimestamp().getTime();
-        long days = TimeUnit.DAYS.convert(diff, TimeUnit.MILLISECONDS);
-        return isPasswordReminderEnabled() && days >= 30;
+        return isPasswordReminderNeeded(new Date().getTime());
+    }
+
+    boolean isPasswordReminderNeeded(long currTime) {
+        PassReminderFreq freq = getPasswordReminderFrequency();
+        if (freq == PassReminderFreq.NEVER) {
+            return false;
+        }
+
+        long duration = currTime - getPasswordReminderTimestamp().getTime();
+        return duration >= freq.getDurationMillis();
     }
 
     public Date getPasswordReminderTimestamp() {
         return new Date(_prefs.getLong("pref_password_reminder_counter", 0));
     }
 
+    void setPasswordReminderTimestamp(long timestamp) {
+        _prefs.edit().putLong("pref_password_reminder_counter", timestamp).apply();
+    }
+
     public void resetPasswordReminderTimestamp() {
-        _prefs.edit().putLong("pref_password_reminder_counter", new Date().getTime()).apply();
+        setPasswordReminderTimestamp(new Date().getTime());
     }
 
-    public boolean isAccountNameVisible() {
-        return _prefs.getBoolean("pref_account_name", true);
+    public boolean onlyShowNecessaryAccountNames() { return _prefs.getBoolean("pref_shared_issuer_account_name", false); }
+
+    public boolean isIconVisible() {
+        return _prefs.getBoolean("pref_show_icons", true);
     }
 
-    public int getCodeGroupSize() {
-        if (_prefs.getBoolean("pref_code_group_size", false)) {
-            return 2;
-        } else {
-            return 3;
-        }
+    public boolean getShowNextCode() {
+        return _prefs.getBoolean("pref_show_next_code", false);
+    }
+
+    public boolean getShowExpirationState() {
+        return _prefs.getBoolean("pref_expiration_state", true);
+    }
+
+    public CodeGrouping getCodeGroupSize() {
+        String value = _prefs.getString("pref_code_group_size_string", "GROUPING_THREES");
+
+        return CodeGrouping.valueOf(value);
+    }
+
+    public void setCodeGroupSize(CodeGrouping codeGroupSize) {
+        _prefs.edit().putString("pref_code_group_size_string", codeGroupSize.name()).apply();
     }
 
     public boolean isIntroDone() {
@@ -97,6 +186,20 @@ public class Preferences {
         return _prefs.getInt("pref_auto_lock_mask", def);
     }
 
+    public int getSearchBehaviorMask() {
+        final int def = SEARCH_IN_ISSUER | SEARCH_IN_NAME;
+
+        return _prefs.getInt("pref_search_behavior_mask", def);
+    }
+
+    public boolean isSearchBehaviorTypeEnabled(int searchBehaviorType) {
+        return (getSearchBehaviorMask() & searchBehaviorType) == searchBehaviorType;
+    }
+
+    public void setSearchBehaviorMask(int searchBehavior) {
+        _prefs.edit().putInt("pref_search_behavior_mask", searchBehavior).apply();
+    }
+
     public boolean isAutoLockEnabled() {
         return getAutoLockMask() != AUTO_LOCK_OFF;
     }
@@ -137,6 +240,10 @@ public class Preferences {
         _prefs.edit().putInt("pref_current_theme", theme.ordinal()).apply();
     }
 
+    public boolean isDynamicColorsEnabled() {
+        return _prefs.getBoolean("pref_dynamic_colors", false);
+    }
+
     public ViewMode getCurrentViewMode() {
         return ViewMode.fromInteger(_prefs.getInt("pref_current_view_mode", 0));
     }
@@ -145,12 +252,117 @@ public class Preferences {
         _prefs.edit().putInt("pref_current_view_mode", viewMode.ordinal()).apply();
     }
 
+    public AccountNamePosition getAccountNamePosition() {
+        return AccountNamePosition.fromInteger(_prefs.getInt("pref_account_name_position", AccountNamePosition.END.ordinal()));
+    }
+
+    public void setAccountNamePosition(AccountNamePosition accountNamePosition) {
+        _prefs.edit().putInt("pref_account_name_position", accountNamePosition.ordinal()).apply();
+    }
+
+    public Integer getUsageCount(UUID uuid) {
+        Integer usageCount = getUsageCounts().get(uuid);
+
+        return usageCount != null ? usageCount : 0;
+    }
+
+    public void resetUsageCount(UUID uuid) {
+        Map<UUID, Integer> usageCounts = getUsageCounts();
+        usageCounts.put(uuid, 0);
+
+        setUsageCount(usageCounts);
+    }
+
+    public long getLastUsedTimestamp(UUID uuid) {
+        Map<UUID, Long> timestamps = getLastUsedTimestamps();
+        if (timestamps != null && timestamps.size() > 0){
+            Long timestamp = timestamps.get(uuid);
+            return timestamp != null ? timestamp : 0;
+        }
+
+        return 0;
+    }
+
+    public void clearUsageCount() {
+        _prefs.edit().remove("pref_usage_count").apply();
+    }
+
+    public Map<UUID, Long> getLastUsedTimestamps() {
+        Map<UUID, Long> lastUsedTimestamps = new HashMap<>();
+        String lastUsedTimestamp = _prefs.getString("pref_last_used_timestamps", "");
+        try {
+            JSONArray arr = new JSONArray(lastUsedTimestamp);
+            for (int i = 0; i < arr.length(); i++) {
+                JSONObject json = arr.getJSONObject(i);
+                lastUsedTimestamps.put(UUID.fromString(json.getString("uuid")), json.getLong("timestamp"));
+            }
+        } catch (JSONException ignored) {
+        }
+
+        return lastUsedTimestamps;
+    }
+
+    public void setLastUsedTimestamps(Map<UUID, Long> lastUsedTimestamps) {
+        JSONArray lastUsedTimestampJson = new JSONArray();
+        for (Map.Entry<UUID, Long> entry : lastUsedTimestamps.entrySet()) {
+            JSONObject entryJson = new JSONObject();
+            try {
+                entryJson.put("uuid", entry.getKey());
+                entryJson.put("timestamp", entry.getValue());
+                lastUsedTimestampJson.put(entryJson);
+            } catch (JSONException e) {
+                e.printStackTrace();
+            }
+        }
+
+        _prefs.edit().putString("pref_last_used_timestamps", lastUsedTimestampJson.toString()).apply();
+    }
+
+    public Map<UUID, Integer> getUsageCounts() {
+        Map<UUID, Integer> usageCounts = new HashMap<>();
+        String usageCount = _prefs.getString("pref_usage_count", "");
+        try {
+            JSONArray arr = new JSONArray(usageCount);
+            for (int i = 0; i < arr.length(); i++) {
+                JSONObject json = arr.getJSONObject(i);
+                usageCounts.put(UUID.fromString(json.getString("uuid")), json.getInt("count"));
+            }
+        } catch (JSONException ignored) {
+        }
+
+        return usageCounts;
+    }
+
+    public void setUsageCount(Map<UUID, Integer> usageCounts) {
+        JSONArray usageCountJson = new JSONArray();
+        for (Map.Entry<UUID, Integer> entry : usageCounts.entrySet()) {
+            JSONObject entryJson = new JSONObject();
+            try {
+                entryJson.put("uuid", entry.getKey());
+                entryJson.put("count", entry.getValue());
+                usageCountJson.put(entryJson);
+            } catch (JSONException e) {
+                e.printStackTrace();
+            }
+        }
+
+        _prefs.edit().putString("pref_usage_count", usageCountJson.toString()).apply();
+    }
+
     public int getTimeout() {
         return _prefs.getInt("pref_timeout", -1);
     }
 
+    public String getLanguage() {
+        return _prefs.getString("pref_lang", "system");
+    }
+
+    public void setLanguage(String lang) {
+        _prefs.edit().putString("pref_lang", lang).apply();
+    }
+
     public Locale getLocale() {
-        String lang = _prefs.getString("pref_lang", "system");
+        String lang = getLanguage();
 
         if (lang.equals("system")) {
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
@@ -168,12 +380,30 @@ public class Preferences {
         return new Locale(parts[0], parts[1]);
     }
 
+    public boolean isAndroidBackupsEnabled() {
+        return _prefs.getBoolean("pref_android_backups", false);
+    }
+
+    public void setIsAndroidBackupsEnabled(boolean enabled) {
+        _prefs.edit().putBoolean("pref_android_backups", enabled).apply();
+        setAndroidBackupResult(null);
+    }
+
     public boolean isBackupsEnabled() {
         return _prefs.getBoolean("pref_backups", false);
     }
 
     public void setIsBackupsEnabled(boolean enabled) {
         _prefs.edit().putBoolean("pref_backups", enabled).apply();
+        setBuiltInBackupResult(null);
+    }
+
+    public boolean isBackupReminderEnabled() {
+        return _prefs.getBoolean("pref_backup_reminder", true);
+    }
+
+    public void setIsBackupReminderEnabled(boolean enabled) {
+        _prefs.edit().putBoolean("pref_backup_reminder", enabled).apply();
     }
 
     public Uri getBackupsLocation() {
@@ -185,6 +415,44 @@ public class Preferences {
         return null;
     }
 
+    public boolean getFocusSearchEnabled() {
+        return _prefs.getBoolean("pref_focus_search", false);
+    }
+
+    public void setFocusSearch(boolean enabled) {
+        _prefs.edit().putBoolean("pref_focus_search", enabled).apply();
+    }
+
+    public void setLatestExportTimeNow() {
+        _prefs.edit().putLong("pref_export_latest", new Date().getTime()).apply();
+        setIsBackupReminderNeeded(false);
+    }
+
+    public Date getLatestBackupOrExportTime() {
+        List<Date> dates = new ArrayList<>();
+
+        long l = _prefs.getLong("pref_export_latest", 0);
+        if (l > 0) {
+            dates.add(new Date(l));
+        }
+
+        BackupResult builtinRes = getBuiltInBackupResult();
+        if (builtinRes != null) {
+            dates.add(builtinRes.getTime());
+        }
+
+        BackupResult androidRes = getAndroidBackupResult();
+        if (androidRes != null) {
+            dates.add(androidRes.getTime());
+        }
+
+        if (dates.size() == 0) {
+            return null;
+        }
+
+        return Collections.max(dates, Date::compareTo);
+    }
+
     public void setBackupsLocation(Uri location) {
         _prefs.edit().putString("pref_backups_location", location == null ? null : location.toString()).apply();
     }
@@ -197,12 +465,91 @@ public class Preferences {
         _prefs.edit().putInt("pref_backups_versions", versions).apply();
     }
 
-    public void setBackupsError(Exception e) {
-        _prefs.edit().putString("pref_backups_error", e == null ? null : e.toString()).apply();
+    public void setAndroidBackupResult(@Nullable BackupResult res) {
+        setBackupResult(false, res);
     }
 
-    public String getBackupsError() {
-        return _prefs.getString("pref_backups_error", null);
+    public void setBuiltInBackupResult(@Nullable BackupResult res) {
+        setBackupResult(true, res);
+    }
+
+    @Nullable
+    public BackupResult getAndroidBackupResult() {
+        return getBackupResult(false);
+    }
+
+    @Nullable
+    public BackupResult getBuiltInBackupResult() {
+        return getBackupResult(true);
+    }
+
+    @Nullable
+    public Preferences.BackupResult getErroredBackupResult() {
+        Preferences.BackupResult res = getBuiltInBackupResult();
+        if (res != null && !res.isSuccessful()) {
+            return res;
+        }
+        res = getAndroidBackupResult();
+        if (res != null && !res.isSuccessful()) {
+            return res;
+        }
+        return null;
+    }
+
+    private void setBackupResult(boolean isBuiltInBackup, @Nullable BackupResult res) {
+        String json = null;
+        if (res != null) {
+            res.setIsBuiltIn(isBuiltInBackup);
+            json = res.toJson();
+        }
+        _prefs.edit().putString(getBackupResultKey(isBuiltInBackup), json).apply();
+    }
+
+    @Nullable
+    private BackupResult getBackupResult(boolean isBuiltInBackup) {
+        String json = _prefs.getString(getBackupResultKey(isBuiltInBackup), null);
+        if (json == null) {
+            return null;
+        }
+
+        try {
+            BackupResult res = BackupResult.fromJson(json);
+            res.setIsBuiltIn(isBuiltInBackup);
+            return res;
+        } catch (JSONException e) {
+            return null;
+        }
+    }
+
+    private static String getBackupResultKey(boolean isBuiltInBackup) {
+        return isBuiltInBackup ? "pref_backups_result_builtin": "pref_backups_result_android";
+    }
+
+    public void setIsBackupReminderNeeded(boolean needed) {
+        if (isBackupsReminderNeeded() != needed) {
+            _prefs.edit().putBoolean("pref_backups_reminder_needed", needed).apply();
+        }
+    }
+
+    public boolean isBackupsReminderNeeded() {
+        return _prefs.getBoolean("pref_backups_reminder_needed", false);
+    }
+
+    public void setIsPlaintextBackupWarningNeeded(boolean needed) {
+        _prefs.edit().putBoolean("pref_plaintext_backup_warning_needed", needed).apply();
+    }
+
+    public boolean isPlaintextBackupWarningNeeded() {
+        return !isPlaintextBackupWarningDisabled()
+                && _prefs.getBoolean("pref_plaintext_backup_warning_needed", false);
+    }
+
+    public void setIsPlaintextBackupWarningDisabled(boolean disabled) {
+        _prefs.edit().putBoolean("pref_plaintext_backup_warning_disabled", disabled).apply();
+    }
+
+    public boolean isPlaintextBackupWarningDisabled() {
+        return _prefs.getBoolean("pref_plaintext_backup_warning_disabled", false);
     }
 
     public boolean isPinKeyboardEnabled() {
@@ -217,7 +564,136 @@ public class Preferences {
         _prefs.edit().putBoolean("pref_warn_time_sync", enabled).apply();
     }
 
-    public boolean isCopyOnTapEnabled() {
-        return _prefs.getBoolean("pref_copy_on_tap", false);
+    public CopyBehavior getCopyBehavior() {
+        return CopyBehavior.fromInteger(_prefs.getInt("pref_current_copy_behavior", 0));
+    }
+
+    public void setCopyBehavior(CopyBehavior copyBehavior) {
+        _prefs.edit().putInt("pref_current_copy_behavior", copyBehavior.ordinal()).apply();
+    }
+
+    public boolean isMinimizeOnCopyEnabled() {
+        return _prefs.getBoolean("pref_minimize_on_copy", false);
+    }
+
+    public void setGroupFilter(Set<UUID> groupFilter) {
+        JSONArray json = new JSONArray(groupFilter);
+        _prefs.edit().putString("pref_group_filter_uuids", json.toString()).apply();
+    }
+
+    public Set<UUID> getGroupFilter() {
+        String raw = _prefs.getString("pref_group_filter_uuids", null);
+        if (raw == null || raw.isEmpty()) {
+            return Collections.emptySet();
+        }
+
+        try {
+            JSONArray json = new JSONArray(raw);
+            Set<UUID> filter = new HashSet<>();
+            for (int i = 0; i < json.length(); i++) {
+                filter.add(json.isNull(i) ? null : UUID.fromString(json.getString(i)));
+            }
+            return filter;
+        } catch (JSONException e) {
+            return Collections.emptySet();
+        }
+    }
+
+    @NonNull
+    public BackupsVersioningStrategy getBackupVersioningStrategy() {
+        Uri uri = getBackupsLocation();
+        if (uri == null) {
+            return BackupsVersioningStrategy.UNDEFINED;
+        }
+        if (DocumentsContractCompat.isTreeUri(uri)) {
+            return BackupsVersioningStrategy.MULTIPLE_BACKUPS;
+        } else {
+            return BackupsVersioningStrategy.SINGLE_BACKUP;
+        }
+    }
+
+    public static class BackupResult {
+        private final Date _time;
+        private boolean _isBuiltIn;
+        private final String _error;
+        private final boolean _isPermissionError;
+
+        public BackupResult(@Nullable Exception e) {
+            this(new Date(), e == null ? null : e.toString(), e instanceof VaultBackupPermissionException);
+        }
+
+        private BackupResult(Date time, @Nullable String error, boolean isPermissionError) {
+            _time = time;
+            _error = error;
+            _isPermissionError = isPermissionError;
+        }
+
+        @Nullable
+        public String getError() {
+            return _error;
+        }
+
+        public boolean isSuccessful() {
+            return _error == null;
+        }
+
+        public Date getTime() {
+            return _time;
+        }
+
+        public String getElapsedSince(Context context) {
+            return TimeUtils.getElapsedSince(context, _time);
+        }
+
+        public boolean isBuiltIn() {
+            return _isBuiltIn;
+        }
+
+        private void setIsBuiltIn(boolean isBuiltIn) {
+            _isBuiltIn = isBuiltIn;
+        }
+
+        public boolean isPermissionError() {
+            return _isPermissionError;
+        }
+
+        public String toJson() {
+            JSONObject obj = new JSONObject();
+
+            try {
+                obj.put("time", _time.getTime());
+                obj.put("error", _error == null ? JSONObject.NULL : _error);
+                obj.put("isPermissionError", _isPermissionError);
+            } catch (JSONException e) {
+                throw new RuntimeException(e);
+            }
+
+            return obj.toString();
+        }
+
+        public static BackupResult fromJson(String json) throws JSONException {
+            JSONObject obj = new JSONObject(json);
+            long time = obj.getLong("time");
+            String error = JsonUtils.optString(obj, "error");
+            boolean isPermissionError = obj.optBoolean("isPermissionError");
+            return new BackupResult(new Date(time), error, isPermissionError);
+        }
+    }
+
+    public enum CodeGrouping {
+        HALVES(-1),
+        NO_GROUPING(-2),
+        GROUPING_TWOS(2),
+        GROUPING_THREES(3),
+        GROUPING_FOURS(4);
+
+        private final int _value;
+        CodeGrouping(int value) {
+            _value = value;
+        }
+
+        public int getValue() {
+            return _value;
+        }
     }
 }

app/src/main/java/com/beemdevelopment/aegis/SortCategory.java

@@ -1,5 +1,7 @@
 package com.beemdevelopment.aegis;
 
+import com.beemdevelopment.aegis.helpers.comparators.LastUsedComparator;
+import com.beemdevelopment.aegis.helpers.comparators.UsageCountComparator;
 import com.beemdevelopment.aegis.vault.VaultEntry;
 import com.beemdevelopment.aegis.helpers.comparators.AccountNameComparator;
 import com.beemdevelopment.aegis.helpers.comparators.IssuerNameComparator;
@@ -12,7 +14,9 @@ public enum SortCategory {
     ACCOUNT,
     ACCOUNT_REVERSED,
     ISSUER,
-    ISSUER_REVERSED;
+    ISSUER_REVERSED,
+    USAGE_COUNT,
+    LAST_USED;
 
     private static SortCategory[] _values;
 
@@ -29,17 +33,22 @@ public enum SortCategory {
 
         switch (this) {
             case ACCOUNT:
-                comparator = new AccountNameComparator();
+                comparator = new AccountNameComparator().thenComparing(new IssuerNameComparator());
                 break;
             case ACCOUNT_REVERSED:
-                comparator = Collections.reverseOrder(new AccountNameComparator());
+                comparator = Collections.reverseOrder(new AccountNameComparator().thenComparing(new IssuerNameComparator()));
                 break;
             case ISSUER:
-                comparator = new IssuerNameComparator();
+                comparator = new IssuerNameComparator().thenComparing(new AccountNameComparator());
                 break;
             case ISSUER_REVERSED:
-                comparator = Collections.reverseOrder(new IssuerNameComparator());
+                comparator = Collections.reverseOrder(new IssuerNameComparator().thenComparing(new AccountNameComparator()));
                 break;
+            case USAGE_COUNT:
+                comparator = Collections.reverseOrder(new UsageCountComparator());
+                break;
+            case LAST_USED:
+                comparator = Collections.reverseOrder(new LastUsedComparator());
         }
 
         return comparator;
@@ -57,6 +66,10 @@ public enum SortCategory {
                 return R.id.menu_sort_alphabetically;
             case ISSUER_REVERSED:
                 return R.id.menu_sort_alphabetically_reverse;
+            case USAGE_COUNT:
+                return R.id.menu_sort_usage_count;
+            case LAST_USED:
+                return R.id.menu_sort_last_used;
             default:
                 return R.id.menu_sort_custom;
         }

app/src/main/java/com/beemdevelopment/aegis/ThemeMap.java

@@ -10,14 +10,8 @@ public class ThemeMap {
     }
 
     public static final Map<Theme, Integer> DEFAULT = ImmutableMap.of(
-            Theme.LIGHT, R.style.AppTheme,
-            Theme.DARK, R.style.AppTheme_Dark,
-            Theme.AMOLED, R.style.AppTheme_TrueBlack
-    );
-
-    public static final Map<Theme, Integer> NO_ACTION_BAR = ImmutableMap.of(
-            Theme.LIGHT, R.style.AppTheme_Light_NoActionBar,
-            Theme.DARK, R.style.AppTheme_Dark_NoActionBar,
-            Theme.AMOLED, R.style.AppTheme_TrueBlack_NoActionBar
+            Theme.LIGHT, R.style.Theme_Aegis_Light,
+            Theme.DARK, R.style.Theme_Aegis_Dark,
+            Theme.AMOLED, R.style.Theme_Aegis_Amoled
     );
 }

app/src/main/java/com/beemdevelopment/aegis/ViewMode.java

@@ -5,7 +5,8 @@ import androidx.annotation.LayoutRes;
 public enum ViewMode {
     NORMAL,
     COMPACT,
-    SMALL;
+    SMALL,
+    TILES;
 
     private static ViewMode[] _values;
 
@@ -26,19 +27,39 @@ public enum ViewMode {
                 return R.layout.card_entry_compact;
             case SMALL:
                 return R.layout.card_entry_small;
+            case TILES:
+                return R.layout.card_entry_tile;
             default:
                 return R.layout.card_entry;
         }
     }
 
     /**
-     * Retrieves the height (in dp) that the divider between entries should have in this view mode.
+     * Retrieves the offset (in dp) that should exist between entries in this view mode.
      */
-    public float getDividerHeight() {
+    public float getItemOffset() {
         if (this == ViewMode.COMPACT) {
-            return 0;
+            return 1;
+        } else if (this == ViewMode.TILES) {
+            return 4;
         }
 
-        return 20;
+        return 8;
+    }
+
+    public int getSpanCount() {
+        if (this == ViewMode.TILES) {
+            return 2;
+        }
+
+        return 1;
+    }
+
+    public String getFormattedAccountName(String accountName) {
+        if (this == ViewMode.TILES) {
+            return accountName;
+        }
+
+        return String.format("(%s)", accountName);
     }
 }

app/src/main/java/com/beemdevelopment/aegis/crypto/CryptoUtils.java

@@ -2,7 +2,7 @@ package com.beemdevelopment.aegis.crypto;
 
 import android.os.Build;
 
-import org.bouncycastle.crypto.generators.SCrypt;
+import com.beemdevelopment.aegis.crypto.bc.SCrypt;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;

app/src/main/java/com/beemdevelopment/aegis/crypto/bc/SCrypt.java

@@ -0,0 +1,255 @@
+/*
+Copyright (c) 2000-2021 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software
+and associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+ */
+
+package com.beemdevelopment.aegis.crypto.bc;
+
+import org.bouncycastle.crypto.PBEParametersGenerator;
+import org.bouncycastle.crypto.digests.SHA256Digest;
+import org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator;
+import org.bouncycastle.crypto.params.KeyParameter;
+import org.bouncycastle.util.Arrays;
+import org.bouncycastle.util.Integers;
+import org.bouncycastle.util.Pack;
+
+/**
+ * Implementation of the scrypt a password-based key derivation function.
+ * <p>
+ * Scrypt was created by Colin Percival and is specified in <a
+ * href="https://tools.ietf.org/html/rfc7914">RFC 7914 - The scrypt Password-Based Key Derivation Function</a>
+ */
+public class SCrypt
+{
+    private SCrypt()
+    {
+        // not used.
+    }
+
+    /**
+     * Generate a key using the scrypt key derivation function.
+     *
+     * @param P     the bytes of the pass phrase.
+     * @param S     the salt to use for this invocation.
+     * @param N     CPU/Memory cost parameter. Must be larger than 1, a power of 2 and less than
+     *              <code>2^(128 * r / 8)</code>.
+     * @param r     the block size, must be &gt;= 1.
+     * @param p     Parallelization parameter. Must be a positive integer less than or equal to
+     *              <code>Integer.MAX_VALUE / (128 * r * 8)</code>.
+     * @param dkLen the length of the key to generate.
+     * @return the generated key.
+     */
+    public static byte[] generate(byte[] P, byte[] S, int N, int r, int p, int dkLen)
+    {
+        if (P == null)
+        {
+            throw new IllegalArgumentException("Passphrase P must be provided.");
+        }
+        if (S == null)
+        {
+            throw new IllegalArgumentException("Salt S must be provided.");
+        }
+        if (N <= 1 || !isPowerOf2(N))
+        {
+            throw new IllegalArgumentException("Cost parameter N must be > 1 and a power of 2");
+        }
+        // Only value of r that cost (as an int) could be exceeded for is 1
+        if (r == 1 && N >= 65536)
+        {
+            throw new IllegalArgumentException("Cost parameter N must be > 1 and < 65536.");
+        }
+        if (r < 1)
+        {
+            throw new IllegalArgumentException("Block size r must be >= 1.");
+        }
+        int maxParallel = Integer.MAX_VALUE / (128 * r * 8);
+        if (p < 1 || p > maxParallel)
+        {
+            throw new IllegalArgumentException("Parallelisation parameter p must be >= 1 and <= " + maxParallel
+                    + " (based on block size r of " + r + ")");
+        }
+        if (dkLen < 1)
+        {
+            throw new IllegalArgumentException("Generated key length dkLen must be >= 1.");
+        }
+        return MFcrypt(P, S, N, r, p, dkLen);
+    }
+
+    private static byte[] MFcrypt(byte[] P, byte[] S, int N, int r, int p, int dkLen)
+    {
+        int MFLenBytes = r * 128;
+        byte[] bytes = SingleIterationPBKDF2(P, S, p * MFLenBytes);
+
+        int[] B = null;
+
+        try
+        {
+            int BLen = bytes.length >>> 2;
+            B = new int[BLen];
+
+            Pack.littleEndianToInt(bytes, 0, B);
+
+            /*
+             * Chunk memory allocations; We choose 'd' so that there will be 2**d chunks, each not
+             * larger than 32KiB, except that the minimum chunk size is 2 * r * 32.
+             */
+            int d = 0, total = N * r;
+            while ((N - d) > 2 && total > (1 << 10))
+            {
+                ++d;
+                total >>>= 1;
+            }
+
+            int MFLenWords = MFLenBytes >>> 2;
+            for (int BOff = 0; BOff < BLen; BOff += MFLenWords)
+            {
+                // TODO These can be done in parallel threads
+                SMix(B, BOff, N, d, r);
+            }
+
+            Pack.intToLittleEndian(B, bytes, 0);
+
+            return SingleIterationPBKDF2(P, bytes, dkLen);
+        }
+        finally
+        {
+            Clear(bytes);
+            Clear(B);
+        }
+    }
+
+    private static byte[] SingleIterationPBKDF2(byte[] P, byte[] S, int dkLen)
+    {
+        PBEParametersGenerator pGen = new PKCS5S2ParametersGenerator(new SHA256Digest());
+        pGen.init(P, S, 1);
+        KeyParameter key = (KeyParameter)pGen.generateDerivedMacParameters(dkLen * 8);
+        return key.getKey();
+    }
+
+    private static void SMix(int[] B, int BOff, int N, int d, int r)
+    {
+        int powN = Integers.numberOfTrailingZeros(N);
+        int blocksPerChunk = N >>> d;
+        int chunkCount = 1 << d, chunkMask = blocksPerChunk - 1, chunkPow = powN - d;
+
+        int BCount = r * 32;
+
+        int[] blockX1 = new int[16];
+        int[] blockX2 = new int[16];
+        int[] blockY = new int[BCount];
+
+        int[] X = new int[BCount];
+        int[][] VV = new int[chunkCount][];
+
+        try
+        {
+            System.arraycopy(B, BOff, X, 0, BCount);
+
+            for (int c = 0; c < chunkCount; ++c)
+            {
+                int[] V = new int[blocksPerChunk * BCount];
+                VV[c] = V;
+
+                int off = 0;
+                for (int i = 0; i < blocksPerChunk; i += 2)
+                {
+                    System.arraycopy(X, 0, V, off, BCount);
+                    off += BCount;
+                    BlockMix(X, blockX1, blockX2, blockY, r);
+                    System.arraycopy(blockY, 0, V, off, BCount);
+                    off += BCount;
+                    BlockMix(blockY, blockX1, blockX2, X, r);
+                }
+            }
+
+            int mask = N - 1;
+            for (int i = 0; i < N; ++i)
+            {
+                int j = X[BCount - 16] & mask;
+                int[] V = VV[j >>> chunkPow];
+                int VOff = (j & chunkMask) * BCount;
+                System.arraycopy(V, VOff, blockY, 0, BCount);
+                Xor(blockY, X, 0, blockY);
+                BlockMix(blockY, blockX1, blockX2, X, r);
+            }
+
+            System.arraycopy(X, 0, B, BOff, BCount);
+        }
+        finally
+        {
+            ClearAll(VV);
+            ClearAll(new int[][]{X, blockX1, blockX2, blockY});
+        }
+    }
+
+    private static void BlockMix(int[] B, int[] X1, int[] X2, int[] Y, int r)
+    {
+        System.arraycopy(B, B.length - 16, X1, 0, 16);
+
+        int BOff = 0, YOff = 0, halfLen = B.length >>> 1;
+
+        for (int i = 2 * r; i > 0; --i)
+        {
+            Xor(X1, B, BOff, X2);
+
+            Salsa20Engine.salsaCore(8, X2, X1);
+            System.arraycopy(X1, 0, Y, YOff, 16);
+
+            YOff = halfLen + BOff - YOff;
+            BOff += 16;
+        }
+    }
+
+    private static void Xor(int[] a, int[] b, int bOff, int[] output)
+    {
+        for (int i = output.length - 1; i >= 0; --i)
+        {
+            output[i] = a[i] ^ b[bOff + i];
+        }
+    }
+
+    private static void Clear(byte[] array)
+    {
+        if (array != null)
+        {
+            Arrays.fill(array, (byte)0);
+        }
+    }
+
+    private static void Clear(int[] array)
+    {
+        if (array != null)
+        {
+            Arrays.fill(array, 0);
+        }
+    }
+
+    private static void ClearAll(int[][] arrays)
+    {
+        for (int i = 0; i < arrays.length; ++i)
+        {
+            Clear(arrays[i]);
+        }
+    }
+
+    // note: we know X is non-zero
+    private static boolean isPowerOf2(int x)
+    {
+        return ((x & (x - 1)) == 0);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/crypto/bc/Salsa20Engine.java

@@ -0,0 +1,118 @@
+/*
+Copyright (c) 2000-2021 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software
+and associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+ */
+
+package com.beemdevelopment.aegis.crypto.bc;
+
+/**
+ * Implementation of Daniel J. Bernstein's Salsa20 stream cipher, Snuffle 2005
+ */
+public class Salsa20Engine {
+    private Salsa20Engine()
+    {
+
+    }
+
+    public static void salsaCore(int rounds, int[] input, int[] x)
+    {
+        if (input.length != 16)
+        {
+            throw new IllegalArgumentException();
+        }
+        if (x.length != 16)
+        {
+            throw new IllegalArgumentException();
+        }
+        if (rounds % 2 != 0)
+        {
+            throw new IllegalArgumentException("Number of rounds must be even");
+        }
+
+        int x00 = input[ 0];
+        int x01 = input[ 1];
+        int x02 = input[ 2];
+        int x03 = input[ 3];
+        int x04 = input[ 4];
+        int x05 = input[ 5];
+        int x06 = input[ 6];
+        int x07 = input[ 7];
+        int x08 = input[ 8];
+        int x09 = input[ 9];
+        int x10 = input[10];
+        int x11 = input[11];
+        int x12 = input[12];
+        int x13 = input[13];
+        int x14 = input[14];
+        int x15 = input[15];
+
+        for (int i = rounds; i > 0; i -= 2)
+        {
+            x04 ^= Integer.rotateLeft(x00 + x12, 7);
+            x08 ^= Integer.rotateLeft(x04 + x00, 9);
+            x12 ^= Integer.rotateLeft(x08 + x04, 13);
+            x00 ^= Integer.rotateLeft(x12 + x08, 18);
+            x09 ^= Integer.rotateLeft(x05 + x01, 7);
+            x13 ^= Integer.rotateLeft(x09 + x05, 9);
+            x01 ^= Integer.rotateLeft(x13 + x09, 13);
+            x05 ^= Integer.rotateLeft(x01 + x13, 18);
+            x14 ^= Integer.rotateLeft(x10 + x06, 7);
+            x02 ^= Integer.rotateLeft(x14 + x10, 9);
+            x06 ^= Integer.rotateLeft(x02 + x14, 13);
+            x10 ^= Integer.rotateLeft(x06 + x02, 18);
+            x03 ^= Integer.rotateLeft(x15 + x11, 7);
+            x07 ^= Integer.rotateLeft(x03 + x15, 9);
+            x11 ^= Integer.rotateLeft(x07 + x03, 13);
+            x15 ^= Integer.rotateLeft(x11 + x07, 18);
+
+            x01 ^= Integer.rotateLeft(x00 + x03, 7);
+            x02 ^= Integer.rotateLeft(x01 + x00, 9);
+            x03 ^= Integer.rotateLeft(x02 + x01, 13);
+            x00 ^= Integer.rotateLeft(x03 + x02, 18);
+            x06 ^= Integer.rotateLeft(x05 + x04, 7);
+            x07 ^= Integer.rotateLeft(x06 + x05, 9);
+            x04 ^= Integer.rotateLeft(x07 + x06, 13);
+            x05 ^= Integer.rotateLeft(x04 + x07, 18);
+            x11 ^= Integer.rotateLeft(x10 + x09, 7);
+            x08 ^= Integer.rotateLeft(x11 + x10, 9);
+            x09 ^= Integer.rotateLeft(x08 + x11, 13);
+            x10 ^= Integer.rotateLeft(x09 + x08, 18);
+            x12 ^= Integer.rotateLeft(x15 + x14, 7);
+            x13 ^= Integer.rotateLeft(x12 + x15, 9);
+            x14 ^= Integer.rotateLeft(x13 + x12, 13);
+            x15 ^= Integer.rotateLeft(x14 + x13, 18);
+        }
+
+        x[ 0] = x00 + input[ 0];
+        x[ 1] = x01 + input[ 1];
+        x[ 2] = x02 + input[ 2];
+        x[ 3] = x03 + input[ 3];
+        x[ 4] = x04 + input[ 4];
+        x[ 5] = x05 + input[ 5];
+        x[ 6] = x06 + input[ 6];
+        x[ 7] = x07 + input[ 7];
+        x[ 8] = x08 + input[ 8];
+        x[ 9] = x09 + input[ 9];
+        x[10] = x10 + input[10];
+        x[11] = x11 + input[11];
+        x[12] = x12 + input[12];
+        x[13] = x13 + input[13];
+        x[14] = x14 + input[14];
+        x[15] = x15 + input[15];
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/crypto/otp/HOTP.java

@@ -14,18 +14,7 @@ public class HOTP {
 
     public static OTP generateOTP(byte[] secret, String algo, int digits, long counter)
             throws NoSuchAlgorithmException, InvalidKeyException {
-        SecretKeySpec key = new SecretKeySpec(secret, "RAW");
-
-        // encode counter in big endian
-        byte[] counterBytes = ByteBuffer.allocate(8)
-                .order(ByteOrder.BIG_ENDIAN)
-                .putLong(counter)
-                .array();
-
-        // calculate the hash of the counter
-        Mac mac = Mac.getInstance(algo);
-        mac.init(key);
-        byte[] hash = mac.doFinal(counterBytes);
+        byte[] hash = getHash(secret, algo, counter);
 
         // truncate hash to get the HTOP value
         // http://tools.ietf.org/html/rfc4226#section-5.4
@@ -37,4 +26,20 @@ public class HOTP {
 
         return new OTP(otp, digits);
     }
+
+    public static byte[] getHash(byte[] secret, String algo, long counter)
+            throws NoSuchAlgorithmException, InvalidKeyException {
+        SecretKeySpec key = new SecretKeySpec(secret, "RAW");
+
+        // encode counter in big endian
+        byte[] counterBytes = ByteBuffer.allocate(8)
+                .order(ByteOrder.BIG_ENDIAN)
+                .putLong(counter)
+                .array();
+
+        // calculate the hash of the counter
+        Mac mac = Mac.getInstance(algo);
+        mac.init(key);
+        return mac.doFinal(counterBytes);
+    }
 }

app/src/main/java/com/beemdevelopment/aegis/crypto/otp/MOTP.java

@@ -0,0 +1,54 @@
+package com.beemdevelopment.aegis.crypto.otp;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.VisibleForTesting;
+
+import com.beemdevelopment.aegis.encoding.Hex;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class MOTP {
+    private final String _code;
+    private final int _digits;
+
+    private MOTP(String code, int digits) {
+        _code = code;
+        _digits = digits;
+    }
+
+    @NonNull
+    public static MOTP generateOTP(byte[] secret, String algo, int digits, int period, String pin)
+            throws NoSuchAlgorithmException {
+
+        return generateOTP(secret, algo, digits, period, pin, System.currentTimeMillis() / 1000);
+    }
+
+    @NonNull
+    public static MOTP generateOTP(byte[] secret, String algo, int digits, int period, String pin, long time)
+            throws NoSuchAlgorithmException {
+
+        long timeBasedCounter = time / period;
+        String secretAsString = Hex.encode(secret);
+        String toDigest =  timeBasedCounter + secretAsString + pin;
+        String code = getDigest(algo, toDigest.getBytes(StandardCharsets.UTF_8));
+
+        return new MOTP(code, digits);
+    }
+
+    @VisibleForTesting
+    @NonNull
+    protected static String getDigest(String algo, byte[] toDigest) throws NoSuchAlgorithmException {
+        MessageDigest md = MessageDigest.getInstance(algo);
+        byte[] digest = md.digest(toDigest);
+
+        return Hex.encode(digest);
+    }
+
+    @NonNull
+    @Override
+    public String toString() {
+        return _code.substring(0, _digits);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/crypto/otp/OTP.java

@@ -5,8 +5,8 @@ import androidx.annotation.NonNull;
 public class OTP {
     private static final String STEAM_ALPHABET = "23456789BCDFGHJKMNPQRTVWXY";
 
-    private int _code;
-    private int _digits;
+    private final int _code;
+    private final int _digits;
 
     public OTP(int code, int digits) {
         _code = code;

app/src/main/java/com/beemdevelopment/aegis/crypto/otp/YAOTP.java

@@ -0,0 +1,71 @@
+package com.beemdevelopment.aegis.crypto.otp;
+
+import androidx.annotation.NonNull;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+
+public class YAOTP {
+    private static final int EN_ALPHABET_LENGTH = 26;
+    private final long _code;
+    private final int _digits;
+
+    private YAOTP(long code, int digits) {
+        _code = code;
+        _digits = digits;
+    }
+
+    public static YAOTP generateOTP(byte[] secret, String pin, int digits, String otpAlgo, long period)
+            throws NoSuchAlgorithmException, InvalidKeyException, IOException {
+        long seconds = System.currentTimeMillis() / 1000;
+        return generateOTP(secret, pin, digits, otpAlgo, period, seconds);
+    }
+
+    public static YAOTP generateOTP(byte[] secret, String pin, int digits, String otpAlgo, long period, long seconds)
+            throws NoSuchAlgorithmException, InvalidKeyException, IOException {
+        byte[] pinWithHash;
+        byte[] pinBytes = pin.getBytes(StandardCharsets.UTF_8);
+        try (ByteArrayOutputStream stream = new ByteArrayOutputStream(pinBytes.length + secret.length)) {
+            stream.write(pinBytes);
+            stream.write(secret);
+            pinWithHash = stream.toByteArray();
+        }
+
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
+        byte[] keyHash = md.digest(pinWithHash);
+        if (keyHash[0] == 0) {
+            keyHash = Arrays.copyOfRange(keyHash, 1, keyHash.length);
+        }
+
+        long counter = (long) Math.floor((double) seconds / period);
+        byte[] periodHash = HOTP.getHash(keyHash, otpAlgo, counter);
+        int offset = periodHash[periodHash.length - 1] & 0xf;
+        periodHash[offset] &= 0x7f;
+        long otp = ByteBuffer.wrap(periodHash)
+                .order(ByteOrder.BIG_ENDIAN)
+                .getLong(offset);
+
+        return new YAOTP(otp, digits);
+    }
+
+    @NonNull
+    @Override
+    public String toString() {
+        long code = _code % (long) Math.pow(EN_ALPHABET_LENGTH, _digits);
+        char[] chars = new char[_digits];
+
+        for (int i = _digits - 1; i >= 0; i--) {
+            chars[i] = (char) ('a' + (code % EN_ALPHABET_LENGTH));
+            code /= EN_ALPHABET_LENGTH;
+        }
+
+        return new String(chars);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/crypto/pins/GuardianProjectFDroidRSA4096.java

@@ -1,14 +0,0 @@
-package com.beemdevelopment.aegis.crypto.pins;
-
-import info.guardianproject.trustedintents.ApkSignaturePin;
-
-public final class GuardianProjectFDroidRSA4096 extends ApkSignaturePin {
-
-    public GuardianProjectFDroidRSA4096() {
-        fingerprints = new String[]{
-                "927f7e38b6acbecd84e02dace33efa9a7a2f0979750f28f585688ee38b3a4e28",
-        };
-        certificates = new byte[][]{
-                {48, -126, 3, 95, 48, -126, 2, 71, -96, 3, 2, 1, 2, 2, 4, 28, -30, 107, -102, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 11, 5, 0, 48, 96, 49, 11, 48, 9, 6, 3, 85, 4, 6, 19, 2, 85, 75, 49, 12, 48, 10, 6, 3, 85, 4, 8, 19, 3, 79, 82, 71, 49, 12, 48, 10, 6, 3, 85, 4, 7, 19, 3, 79, 82, 71, 49, 19, 48, 17, 6, 3, 85, 4, 10, 19, 10, 102, 100, 114, 111, 105, 100, 46, 111, 114, 103, 49, 15, 48, 13, 6, 3, 85, 4, 11, 19, 6, 70, 68, 114, 111, 105, 100, 49, 15, 48, 13, 6, 3, 85, 4, 3, 19, 6, 70, 68, 114, 111, 105, 100, 48, 30, 23, 13, 49, 55, 49, 50, 48, 55, 49, 55, 51, 48, 52, 50, 90, 23, 13, 52, 53, 48, 52, 50, 52, 49, 55, 51, 48, 52, 50, 90, 48, 96, 49, 11, 48, 9, 6, 3, 85, 4, 6, 19, 2, 85, 75, 49, 12, 48, 10, 6, 3, 85, 4, 8, 19, 3, 79, 82, 71, 49, 12, 48, 10, 6, 3, 85, 4, 7, 19, 3, 79, 82, 71, 49, 19, 48, 17, 6, 3, 85, 4, 10, 19, 10, 102, 100, 114, 111, 105, 100, 46, 111, 114, 103, 49, 15, 48, 13, 6, 3, 85, 4, 11, 19, 6, 70, 68, 114, 111, 105, 100, 49, 15, 48, 13, 6, 3, 85, 4, 3, 19, 6, 70, 68, 114, 111, 105, 100, 48, -126, 1, 34, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 1, 5, 0, 3, -126, 1, 15, 0, 48, -126, 1, 10, 2, -126, 1, 1, 0, -107, -115, -106, 1, -26, 72, -105, -99, 62, 3, -55, 34, 99, -112, -68, -20, -115, 31, 34, 118, -50, 12, -32, -59, 74, -58, -37, -87, 21, 105, 36, -82, 13, -51, 66, 4, 55, -111, 13, -46, -7, -69, -15, 36, 118, -7, 101, -86, 123, -83, -103, 110, 116, -54, 112, 46, 12, 96, -76, -48, -70, -33, -81, 52, 59, 73, 107, -126, -72, -25, 32, 93, 29, -20, 5, -41, -27, 123, -9, 104, -31, -59, -1, -83, -93, 99, 85, -116, -62, -55, 18, -63, 6, -51, -110, 33, 9, 7, -49, 102, -20, -122, -124, -68, 93, -102, 31, 48, 86, 96, -99, 105, -52, 95, 12, 57, 99, 12, -24, 70, 40, -99, -20, -21, -85, -70, -105, 95, 117, -31, 126, -126, -39, 46, -62, 59, -23, -74, 108, -12, -56, -40, -96, 79, -37, -82, 1, 99, -104, 48, -60, 92, 14, 109, 127, -22, 31, 115, -27, 108, 9, 92, 118, -45, 103, 117, 57, -50, -82, 114, -113, 68, -82, 87, 96, 111, 72, 65, -63, 12, 31, -34, -31, -55, -101, 101, 101, 59, 73, -119, -122, 82, 28, 47, -108, -85, 59, 46, 89, -93, -1, 9, -11, -51, 63, -44, 109, -76, -103, -26, -49, -80, 6, 52, -27, 73, -104, 40, 2, -101, -124, 60, -52, -105, -70, -24, -62, 88, 38, 53, -99, -92, 31, 119, 26, 79, 60, -124, 25, -115, -89, -115, -109, 0, 6, 122, -78, 116, 82, 3, 39, -67, 45, -43, 17, -39, 2, 3, 1, 0, 1, -93, 33, 48, 31, 48, 29, 6, 3, 85, 29, 14, 4, 22, 4, 20, 63, 109, -42, -109, 25, 22, 7, -37, -22, -41, -38, 58, -56, 2, -68, -38, -22, 65, -28, -60, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 11, 5, 0, 3, -126, 1, 1, 0, 94, 17, 31, 36, 85, -11, 85, 44, 19, -80, -20, -92, -118, 93, 40, 45, 96, 31, -3, -37, -110, -96, 102, 81, 61, -74, -125, -117, -112, 58, -47, 17, 78, -18, 111, -116, 26, -91, 73, 100, 84, -99, 21, 87, 73, -106, 108, -51, -125, -21, 119, -88, -78, 2, 82, -109, -64, -9, -86, -112, -115, 66, -86, 46, 71, 107, -65, 96, -102, 47, 35, -45, -126, 33, 34, 121, -25, -85, -121, -56, -42, 22, -1, -95, -86, 81, 100, -70, 113, 104, -73, 22, -19, 79, -19, 52, 62, 42, 76, -112, 94, -34, 42, -57, -75, -90, -58, 118, 127, -106, -39, 108, -56, -79, 103, -33, 22, 3, 47, 103, -76, -81, 53, -22, -44, -26, -102, 63, -99, 39, 38, -108, 75, 33, 10, 25, -110, -125, -115, 114, -69, 73, -112, 36, 74, 77, -82, -44, 29, -123, -8, -117, 71, -105, 15, -109, 51, 22, 4, 80, 1, 43, 118, 121, -113, -70, 83, -56, 82, -110, 4, -63, 16, -57, 126, -70, 81, 73, 61, 2, -61, 24, -14, -10, 4, -21, 90, 24, 66, 41, -57, -60, -113, -18, -54, -1, 103, -75, 32, -64, 67, 103, 109, -79, -12, -113, -27, 114, 89, 116, 115, -13, -123, -70, 61, -41, -46, -118, 29, -105, -97, -75, 39, -51, 60, 88, 125, 55, -46, -95, 52, 57, 52, -115, 80, 44, 109, 119, -116, -62, -77, -74, -88, 41, 57, -65, -71, -115, -67, 23, 66, -21, 56, 51, -91, 109},};
-    }
-}

app/src/main/java/com/beemdevelopment/aegis/database/AppDatabase.java

@@ -0,0 +1,15 @@
+package com.beemdevelopment.aegis.database;
+
+import android.content.Context;
+
+import androidx.room.Database;
+import androidx.room.Room;
+import androidx.room.RoomDatabase;
+
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+
+@Database(entities = {AuditLogEntry.class}, version = 1)
+public abstract class AppDatabase extends RoomDatabase {
+    public abstract AuditLogDao auditLogDao();
+}

app/src/main/java/com/beemdevelopment/aegis/database/AuditLogDao.java

@@ -0,0 +1,17 @@
+package com.beemdevelopment.aegis.database;
+
+import androidx.lifecycle.LiveData;
+import androidx.room.Dao;
+import androidx.room.Insert;
+import androidx.room.Query;
+
+import java.util.List;
+
+@Dao
+public interface AuditLogDao {
+    @Insert
+    void insert(AuditLogEntry log);
+
+    @Query("SELECT * FROM audit_logs WHERE timestamp >= strftime('%s', 'now', '-30 days') ORDER BY timestamp DESC")
+    LiveData<List<AuditLogEntry>> getAll();
+}

app/src/main/java/com/beemdevelopment/aegis/database/AuditLogEntry.java

@@ -0,0 +1,61 @@
+package com.beemdevelopment.aegis.database;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.room.ColumnInfo;
+import androidx.room.Entity;
+import androidx.room.Ignore;
+import androidx.room.PrimaryKey;
+
+import com.beemdevelopment.aegis.EventType;
+
+@Entity(tableName = "audit_logs")
+public class AuditLogEntry {
+    @PrimaryKey(autoGenerate = true)
+    protected long id;
+
+    @NonNull
+    @ColumnInfo(name = "event_type")
+    private final EventType _eventType;
+
+    @ColumnInfo(name = "reference")
+    private final String _reference;
+
+    @ColumnInfo(name = "timestamp")
+    private final long _timestamp;
+
+    @Ignore
+    public AuditLogEntry(@NonNull EventType eventType) {
+        this(eventType, null);
+    }
+
+    @Ignore
+    public AuditLogEntry(@NonNull EventType eventType, @Nullable String reference) {
+        _eventType = eventType;
+        _reference = reference;
+        _timestamp = System.currentTimeMillis();
+    }
+
+    AuditLogEntry(long id, @NonNull EventType eventType, @Nullable String reference, long timestamp) {
+        this.id = id;
+        _eventType = eventType;
+        _reference = reference;
+        _timestamp = timestamp;
+    }
+
+    public long getId() {
+        return id;
+    }
+
+    public EventType getEventType() {
+        return _eventType;
+    }
+
+    public String getReference() {
+        return _reference;
+    }
+
+    public long getTimestamp() {
+        return _timestamp;
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/database/AuditLogRepository.java

@@ -0,0 +1,66 @@
+package com.beemdevelopment.aegis.database;
+
+import androidx.lifecycle.LiveData;
+
+import com.beemdevelopment.aegis.EventType;
+
+import java.util.List;
+import java.util.concurrent.Executor;
+import java.util.concurrent.Executors;
+
+public class AuditLogRepository {
+    private final AuditLogDao _auditLogDao;
+    private final Executor _executor;
+
+    public AuditLogRepository(AuditLogDao auditLogDao) {
+        _auditLogDao = auditLogDao;
+        _executor = Executors.newSingleThreadExecutor();
+    }
+
+    public LiveData<List<AuditLogEntry>> getAllAuditLogEntries() {
+        return _auditLogDao.getAll();
+    }
+
+    public void addVaultUnlockedEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_UNLOCKED);
+        insert(auditLogEntry);
+    }
+
+    public void addBackupCreatedEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_BACKUP_CREATED);
+        insert(auditLogEntry);
+    }
+
+    public void addAndroidBackupCreatedEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_ANDROID_BACKUP_CREATED);
+        insert(auditLogEntry);
+    }
+
+    public void addVaultExportedEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_EXPORTED);
+        insert(auditLogEntry);
+    }
+
+    public void addEntrySharedEvent(String reference) {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.ENTRY_SHARED, reference);
+        insert(auditLogEntry);
+    }
+
+    public void addVaultUnlockFailedPasswordEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_UNLOCK_FAILED_PASSWORD);
+        insert(auditLogEntry);
+
+    }
+
+    public void addVaultUnlockFailedBiometricsEvent() {
+        AuditLogEntry auditLogEntry = new AuditLogEntry(EventType.VAULT_UNLOCK_FAILED_BIOMETRICS);
+        insert(auditLogEntry);
+    }
+
+    public void insert(AuditLogEntry auditLogEntry) {
+        _executor.execute(() -> {
+            _auditLogDao.insert(auditLogEntry);
+        });
+    }
+
+}

app/src/main/java/com/beemdevelopment/aegis/encoding/Base32.java

@@ -2,6 +2,9 @@ package com.beemdevelopment.aegis.encoding;
 
 import com.google.common.io.BaseEncoding;
 
+import java.nio.charset.StandardCharsets;
+import java.util.Locale;
+
 public class Base32 {
     private Base32() {
 
@@ -9,7 +12,7 @@ public class Base32 {
 
     public static byte[] decode(String s) throws EncodingException {
         try {
-            return BaseEncoding.base32().decode(s.toUpperCase());
+            return BaseEncoding.base32().decode(s.toUpperCase(Locale.ROOT));
         } catch (IllegalArgumentException e) {
             throw new EncodingException(e);
         }
@@ -18,4 +21,9 @@ public class Base32 {
     public static String encode(byte[] data) {
         return BaseEncoding.base32().omitPadding().encode(data);
     }
+
+    public static String encode(String s) {
+        byte[] bytes = s.getBytes(StandardCharsets.UTF_8);
+        return encode(bytes);
+    }
 }

app/src/main/java/com/beemdevelopment/aegis/encoding/EncodingException.java

@@ -6,4 +6,8 @@ public class EncodingException extends IOException {
     public EncodingException(Throwable cause) {
         super(cause);
     }
+
+    public EncodingException(String message) {
+        super(message);
+    }
 }

app/src/main/java/com/beemdevelopment/aegis/encoding/Hex.java

@@ -2,6 +2,8 @@ package com.beemdevelopment.aegis.encoding;
 
 import com.google.common.io.BaseEncoding;
 
+import java.util.Locale;
+
 public class Hex {
     private Hex() {
 
@@ -9,7 +11,7 @@ public class Hex {
 
     public static byte[] decode(String s) throws EncodingException {
         try {
-            return BaseEncoding.base16().decode(s.toUpperCase());
+            return BaseEncoding.base16().decode(s.toUpperCase(Locale.ROOT));
         } catch (IllegalArgumentException e) {
             throw new EncodingException(e);
         }

app/src/main/java/com/beemdevelopment/aegis/helpers/AnimationsHelper.java

@@ -0,0 +1,54 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.content.Context;
+import android.provider.Settings;
+import android.view.animation.Animation;
+import android.view.animation.AnimationUtils;
+import android.view.animation.LayoutAnimationController;
+
+public class AnimationsHelper {
+    private AnimationsHelper() {
+
+    }
+
+    public static Animation loadScaledAnimation(Context context, int animationResId) {
+        return loadScaledAnimation(context, animationResId, Scale.ANIMATOR);
+    }
+
+    public static Animation loadScaledAnimation(Context context, int animationResId, Scale scale) {
+        Animation animation = AnimationUtils.loadAnimation(context, animationResId);
+        long newDuration = (long) (animation.getDuration() * scale.getValue(context));
+        animation.setDuration(newDuration);
+        return animation;
+    }
+
+    public static LayoutAnimationController loadScaledLayoutAnimation(Context context, int animationResId) {
+        return loadScaledLayoutAnimation(context, animationResId, Scale.ANIMATOR);
+    }
+
+    public static LayoutAnimationController loadScaledLayoutAnimation(Context context, int animationResId, Scale scale) {
+        LayoutAnimationController controller = AnimationUtils.loadLayoutAnimation(context, animationResId);
+        Animation animation = controller.getAnimation();
+        animation.setDuration((long) (animation.getDuration() * scale.getValue(context)));
+        return controller;
+    }
+
+    public enum Scale {
+        ANIMATOR(Settings.Global.ANIMATOR_DURATION_SCALE),
+        TRANSITION(Settings.Global.TRANSITION_ANIMATION_SCALE);
+
+        private final String _setting;
+
+        Scale(String setting) {
+            _setting = setting;
+        }
+
+        public float getValue(Context context) {
+            return Settings.Global.getFloat(context.getContentResolver(), _setting, 1.0f);
+        }
+
+        public boolean isZero(Context context) {
+            return getValue(context) == 0;
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/BiometricsHelper.java

@@ -2,8 +2,8 @@ package com.beemdevelopment.aegis.helpers;
 
 import android.content.Context;
 
-import androidx.biometric.BiometricConstants;
 import androidx.biometric.BiometricManager;
+import androidx.biometric.BiometricPrompt;
 
 public class BiometricsHelper {
     private BiometricsHelper() {
@@ -12,16 +12,16 @@ public class BiometricsHelper {
 
     public static BiometricManager getManager(Context context) {
         BiometricManager manager = BiometricManager.from(context);
-        if (manager.canAuthenticate() == BiometricManager.BIOMETRIC_SUCCESS) {
+        if (manager.canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG) == BiometricManager.BIOMETRIC_SUCCESS) {
             return manager;
         }
         return null;
     }
 
     public static boolean isCanceled(int errorCode) {
-        return errorCode == BiometricConstants.ERROR_CANCELED
-                || errorCode == BiometricConstants.ERROR_USER_CANCELED
-                || errorCode == BiometricConstants.ERROR_NEGATIVE_BUTTON;
+        return errorCode == BiometricPrompt.ERROR_CANCELED
+                || errorCode == BiometricPrompt.ERROR_USER_CANCELED
+                || errorCode == BiometricPrompt.ERROR_NEGATIVE_BUTTON;
     }
 
     public static boolean isAvailable(Context context) {

app/src/main/java/com/beemdevelopment/aegis/helpers/CenterVerticalSpan.java

@@ -0,0 +1,30 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.graphics.Rect;
+import android.text.TextPaint;
+import android.text.style.MetricAffectingSpan;
+
+import androidx.annotation.NonNull;
+
+public class CenterVerticalSpan extends MetricAffectingSpan {
+    Rect _substringBounds;
+
+    public CenterVerticalSpan(Rect substringBounds) {
+        _substringBounds = substringBounds;
+    }
+
+    @Override
+    public void updateMeasureState(@NonNull TextPaint textPaint) {
+        applyBaselineShift(textPaint);
+    }
+
+    @Override
+    public void updateDrawState(@NonNull TextPaint textPaint) {
+        applyBaselineShift(textPaint);
+    }
+
+    private void applyBaselineShift(TextPaint textPaint) {
+        float topDifference = textPaint.getFontMetrics().top - _substringBounds.top;
+        textPaint.baselineShift -= (topDifference / 2f);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/DropdownHelper.java

@@ -0,0 +1,27 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.content.Context;
+import android.widget.ArrayAdapter;
+import android.widget.AutoCompleteTextView;
+
+import androidx.annotation.ArrayRes;
+
+import com.beemdevelopment.aegis.R;
+
+import java.util.List;
+
+public class DropdownHelper {
+    private DropdownHelper() {
+
+    }
+
+    public static void fillDropdown(Context context, AutoCompleteTextView dropdown, @ArrayRes int textArrayResId) {
+        ArrayAdapter<CharSequence> adapter = ArrayAdapter.createFromResource(context, textArrayResId, R.layout.dropdown_list_item);
+        dropdown.setAdapter(adapter);
+    }
+
+    public static <T> void fillDropdown(Context context, AutoCompleteTextView dropdown, List<T> items) {
+        ArrayAdapter<T> adapter = new ArrayAdapter<>(context, R.layout.dropdown_list_item, items);
+        dropdown.setAdapter(adapter);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/FabScrollHelper.java

@@ -6,7 +6,6 @@ import android.view.View;
 import android.view.animation.AccelerateInterpolator;
 import android.view.animation.DecelerateInterpolator;
 import androidx.coordinatorlayout.widget.CoordinatorLayout;
-import com.getbase.floatingactionbutton.FloatingActionsMenu;
 
 public class FabScrollHelper {
     private View _fabMenu;
@@ -17,9 +16,9 @@ public class FabScrollHelper {
     }
 
     public void onScroll(int dx, int dy) {
-        if (dy > 0 && _fabMenu.getVisibility() == View.VISIBLE && !_isAnimating) {
+        if (dy > 2 && _fabMenu.getVisibility() == View.VISIBLE && !_isAnimating) {
             setVisible(false);
-        } else if (dy < 0 && _fabMenu.getVisibility() != View.VISIBLE && !_isAnimating) {
+        } else if (dy < -2 && _fabMenu.getVisibility() != View.VISIBLE && !_isAnimating) {
             setVisible(true);
         }
     }

app/src/main/java/com/beemdevelopment/aegis/helpers/MetricsHelper.java

@@ -0,0 +1,14 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.content.Context;
+import android.util.DisplayMetrics;
+
+public class MetricsHelper {
+    private MetricsHelper() {
+
+    }
+
+    public static int convertDpToPixels(Context context, float dp) {
+        return (int) (dp * (context.getResources().getDisplayMetrics().densityDpi / DisplayMetrics.DENSITY_DEFAULT));
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/PasswordStrengthHelper.java

@@ -1,14 +1,60 @@
 package com.beemdevelopment.aegis.helpers;
 
 import android.content.Context;
+import android.content.res.ColorStateList;
+import android.graphics.Color;
+import android.widget.EditText;
+import android.widget.ProgressBar;
+import android.widget.TextView;
 
 import com.beemdevelopment.aegis.R;
+import com.google.android.material.textfield.TextInputLayout;
+import com.google.common.base.Strings;
+import com.nulabinc.zxcvbn.Strength;
+import com.nulabinc.zxcvbn.Zxcvbn;
 
 public class PasswordStrengthHelper {
-    // Material design color palette
-    private static String[] COLORS = {"#FF5252", "#FF5252", "#FFC107", "#8BC34A", "#4CAF50"};
+    // Limit the password length to prevent zxcvbn4j from exploding
+    private static final int MAX_PASSWORD_LENGTH = 64;
 
-    public static String getString(int score, Context context) {
+    // Material design color palette
+    private final static String[] COLORS = {"#FF5252", "#FF5252", "#FFC107", "#8BC34A", "#4CAF50"};
+
+    private final Zxcvbn _zxcvbn = new Zxcvbn();
+    private final EditText _textPassword;
+    private final ProgressBar _barPasswordStrength;
+    private final TextView _textPasswordStrength;
+    private final TextInputLayout _textPasswordWrapper;
+
+    public PasswordStrengthHelper(
+            EditText textPassword,
+            ProgressBar barPasswordStrength,
+            TextView textPasswordStrength,
+            TextInputLayout textPasswordWrapper
+    ) {
+        _textPassword = textPassword;
+        _barPasswordStrength = barPasswordStrength;
+        _textPasswordStrength = textPasswordStrength;
+        _textPasswordWrapper = textPasswordWrapper;
+    }
+
+    public void measure(Context context) {
+        if (_textPassword.getText().length() > MAX_PASSWORD_LENGTH) {
+            _barPasswordStrength.setProgress(0);
+            _textPasswordStrength.setText(R.string.password_strength_unknown);
+        } else {
+            Strength strength = _zxcvbn.measure(_textPassword.getText());
+            _barPasswordStrength.setProgress(strength.getScore());
+            _barPasswordStrength.setProgressTintList(ColorStateList.valueOf(Color.parseColor(getColor(strength.getScore()))));
+            _textPasswordStrength.setText((_textPassword.getText().length() != 0) ? getString(strength.getScore(), context) : "");
+            String warning = strength.getFeedback().getWarning();
+            _textPasswordWrapper.setError(warning);
+            _textPasswordWrapper.setErrorEnabled(!Strings.isNullOrEmpty(warning));
+            strength.wipe();
+        }
+    }
+
+    private static String getString(int score, Context context) {
         if (score < 0 || score > 4) {
             throw new IllegalArgumentException("Not a valid zxcvbn score");
         }
@@ -17,7 +63,7 @@ public class PasswordStrengthHelper {
         return strings[score];
     }
 
-    public static String getColor(int score) {
+    private static String getColor(int score) {
         if (score < 0 || score > 4) {
             throw new IllegalArgumentException("Not a valid zxcvbn score");
         }

app/src/main/java/com/beemdevelopment/aegis/helpers/QrCodeAnalyzer.java

@@ -1,28 +1,23 @@
 package com.beemdevelopment.aegis.helpers;
 
+import static android.graphics.ImageFormat.YUV_420_888;
+
 import android.util.Log;
+import android.util.Size;
 
 import androidx.annotation.NonNull;
 import androidx.camera.core.ImageAnalysis;
 import androidx.camera.core.ImageProxy;
 
-import com.google.zxing.BinaryBitmap;
-import com.google.zxing.ChecksumException;
-import com.google.zxing.FormatException;
 import com.google.zxing.NotFoundException;
 import com.google.zxing.PlanarYUVLuminanceSource;
 import com.google.zxing.Result;
-import com.google.zxing.common.HybridBinarizer;
-import com.google.zxing.qrcode.QRCodeReader;
 
 import java.nio.ByteBuffer;
 
-import static android.graphics.ImageFormat.YUV_420_888;
-import static android.graphics.ImageFormat.YUV_422_888;
-import static android.graphics.ImageFormat.YUV_444_888;
-
 public class QrCodeAnalyzer implements ImageAnalysis.Analyzer {
     private static final String TAG = QrCodeAnalyzer.class.getSimpleName();
+    public static final Size RESOLUTION = new Size(1200, 1600);
 
     private final QrCodeAnalyzer.Listener _listener;
 
@@ -33,29 +28,35 @@ public class QrCodeAnalyzer implements ImageAnalysis.Analyzer {
     @Override
     public void analyze(@NonNull ImageProxy image) {
         int format = image.getFormat();
-        if (format != YUV_420_888 && format != YUV_422_888 && format != YUV_444_888) {
-            Log.e(TAG, String.format("Expected YUV format, got %d instead", format));
+        if (format != YUV_420_888) {
+            Log.e(TAG, String.format("Unexpected YUV image format: %d", format));
             image.close();
             return;
         }
 
-        ByteBuffer buf = image.getPlanes()[0].getBuffer();
+        ImageProxy.PlaneProxy plane = image.getPlanes()[0];
+        ByteBuffer buf = plane.getBuffer();
         byte[] data = new byte[buf.remaining()];
         buf.get(data);
         buf.rewind();
 
         PlanarYUVLuminanceSource source = new PlanarYUVLuminanceSource(
-                data, image.getWidth(), image.getHeight(), 0, 0, image.getWidth(), image.getHeight(), false
+                data,
+                plane.getRowStride(),
+                image.getHeight(),
+                0,
+                0,
+                image.getWidth(),
+                image.getHeight(),
+                false
         );
 
-        QRCodeReader reader = new QRCodeReader();
-        BinaryBitmap bitmap = new BinaryBitmap(new HybridBinarizer(source));
         try {
-            Result result = reader.decode(bitmap);
+            Result result = QrCodeHelper.decodeFromSource(source);
             if (_listener != null) {
                 _listener.onQrCodeDetected(result);
             }
-        } catch (ChecksumException | FormatException | NotFoundException ignored) {
+        } catch (NotFoundException ignored) {
 
         } finally {
             image.close();

app/src/main/java/com/beemdevelopment/aegis/helpers/QrCodeHelper.java

@@ -0,0 +1,96 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.graphics.Bitmap;
+import android.graphics.BitmapFactory;
+import android.graphics.Color;
+
+import androidx.annotation.ColorInt;
+
+import com.google.zxing.BarcodeFormat;
+import com.google.zxing.BinaryBitmap;
+import com.google.zxing.DecodeHintType;
+import com.google.zxing.LuminanceSource;
+import com.google.zxing.MultiFormatReader;
+import com.google.zxing.NotFoundException;
+import com.google.zxing.RGBLuminanceSource;
+import com.google.zxing.Result;
+import com.google.zxing.WriterException;
+import com.google.zxing.common.BitMatrix;
+import com.google.zxing.common.HybridBinarizer;
+import com.google.zxing.qrcode.QRCodeWriter;
+
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+public class QrCodeHelper {
+    private QrCodeHelper() {
+
+    }
+
+    public static Result decodeFromSource(LuminanceSource source) throws NotFoundException {
+        Map<DecodeHintType, Object> hints = new HashMap<>();
+        hints.put(DecodeHintType.POSSIBLE_FORMATS, Collections.singletonList(BarcodeFormat.QR_CODE));
+        hints.put(DecodeHintType.ALSO_INVERTED, true);
+
+        BinaryBitmap bitmap = new BinaryBitmap(new HybridBinarizer(source));
+        MultiFormatReader reader = new MultiFormatReader();
+        return reader.decode(bitmap, hints);
+    }
+
+    public static Result decodeFromStream(InputStream inStream) throws DecodeError {
+        BitmapFactory.Options bmOptions = new BitmapFactory.Options();
+        Bitmap bitmap = BitmapFactory.decodeStream(inStream, null, bmOptions);
+        if (bitmap == null) {
+            throw new DecodeError("Unable to decode stream to bitmap");
+        }
+
+        // If ZXing is not able to decode the image on the first try, we try a couple of
+        // more times with smaller versions of the same image.
+        for (int i = 0; i <= 2; i++) {
+            if (i != 0) {
+                bitmap = BitmapHelper.resize(bitmap, bitmap.getWidth() / (i * 2), bitmap.getHeight() / (i * 2));
+            }
+
+            try {
+                int[] pixels = new int[bitmap.getWidth() * bitmap.getHeight()];
+                bitmap.getPixels(pixels, 0, bitmap.getWidth(), 0, 0, bitmap.getWidth(), bitmap.getHeight());
+
+                LuminanceSource source = new RGBLuminanceSource(bitmap.getWidth(), bitmap.getHeight(), pixels);
+                return decodeFromSource(source);
+            } catch (NotFoundException ignored) {
+
+            }
+        }
+
+        throw new DecodeError(NotFoundException.getNotFoundInstance());
+    }
+
+    public static Bitmap encodeToBitmap(String data, int width, int height, @ColorInt int backgroundColor) throws WriterException {
+        QRCodeWriter writer = new QRCodeWriter();
+        BitMatrix bitMatrix = writer.encode(data, BarcodeFormat.QR_CODE, width, height);
+
+        int[] pixels = new int[width * height];
+        for (int y = 0; y < height; y++) {
+            int offset = y * width;
+            for (int x = 0; x < width; x++) {
+                pixels[offset + x] = bitMatrix.get(x, y) ? Color.BLACK : backgroundColor;
+            }
+        }
+
+        Bitmap bitmap = Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888);
+        bitmap.setPixels(pixels, 0, width, 0, 0, width, height);
+        return bitmap;
+    }
+
+    public static class DecodeError extends Exception {
+        public DecodeError(String message) {
+            super(message);
+        }
+
+        public DecodeError(Throwable cause) {
+            super(cause);
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/SafHelper.java

@@ -0,0 +1,47 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.content.Context;
+import android.database.Cursor;
+import android.net.Uri;
+import android.provider.OpenableColumns;
+import android.webkit.MimeTypeMap;
+
+import androidx.documentfile.provider.DocumentFile;
+
+public class SafHelper {
+    private SafHelper() {
+
+    }
+
+    public static String getFileName(Context context, Uri uri) {
+        if (uri.getScheme() != null && uri.getScheme().equals("content")) {
+            try (Cursor cursor = context.getContentResolver().query(uri, new String[]{OpenableColumns.DISPLAY_NAME}, null, null, null)) {
+                if (cursor != null && cursor.moveToFirst()) {
+                    int i = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME);
+                    if (i != -1) {
+                        return cursor.getString(i);
+                    }
+                }
+            }
+        }
+
+        return uri.getLastPathSegment();
+    }
+
+    public static String getMimeType(Context context, Uri uri) {
+        DocumentFile file = DocumentFile.fromSingleUri(context, uri);
+        if (file != null) {
+            String fileType = file.getType();
+            if (fileType != null) {
+                return fileType;
+            }
+
+            String ext = MimeTypeMap.getFileExtensionFromUrl(uri.toString());
+            if (ext != null) {
+                return MimeTypeMap.getSingleton().getMimeTypeFromExtension(ext);
+            }
+        }
+
+        return null;
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/SimpleAnimationEndListener.java

@@ -0,0 +1,32 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.view.animation.Animation;
+
+public class SimpleAnimationEndListener implements Animation.AnimationListener {
+    private final Listener _listener;
+
+    public SimpleAnimationEndListener(Listener listener) {
+        _listener = listener;
+    }
+
+    @Override
+    public void onAnimationStart(Animation animation) {
+
+    }
+
+    @Override
+    public void onAnimationEnd(Animation animation) {
+        if (_listener != null) {
+            _listener.onAnimationEnd(animation);
+        }
+    }
+
+    @Override
+    public void onAnimationRepeat(Animation animation) {
+
+    }
+
+    public interface Listener {
+        void onAnimationEnd(Animation animation);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/SimpleItemTouchHelperCallback.java

@@ -1,20 +1,24 @@
 package com.beemdevelopment.aegis.helpers;
 
+import static androidx.recyclerview.widget.RecyclerView.NO_POSITION;
+
+import androidx.annotation.NonNull;
 import androidx.recyclerview.widget.ItemTouchHelper;
 import androidx.recyclerview.widget.RecyclerView;
 
-import com.beemdevelopment.aegis.vault.VaultEntry;
 import com.beemdevelopment.aegis.ui.views.EntryAdapter;
+import com.beemdevelopment.aegis.vault.VaultEntry;
 
 public class SimpleItemTouchHelperCallback extends ItemTouchHelper.Callback {
 
     private VaultEntry _selectedEntry;
 
-    private final ItemTouchHelperAdapter _adapter;
+    private final EntryAdapter _adapter;
     private boolean _positionChanged = false;
     private boolean _isLongPressDragEnabled = true;
+    private int _dragFlags = ItemTouchHelper.UP | ItemTouchHelper.DOWN;
 
-    public SimpleItemTouchHelperCallback(ItemTouchHelperAdapter adapter) {
+    public SimpleItemTouchHelperCallback(EntryAdapter adapter) {
         _adapter = adapter;
     }
 
@@ -28,7 +32,14 @@ public class SimpleItemTouchHelperCallback extends ItemTouchHelper.Callback {
     }
 
     public void setSelectedEntry(VaultEntry entry) {
-        _selectedEntry = entry;
+        if (entry == null) {
+            _selectedEntry = null;
+            return;
+        }
+
+        if (!entry.isFavorite()) {
+            _selectedEntry = entry;
+        }
     }
 
     @Override
@@ -36,32 +47,55 @@ public class SimpleItemTouchHelperCallback extends ItemTouchHelper.Callback {
         return false;
     }
 
-    @Override
-    public int getMovementFlags(RecyclerView recyclerView, RecyclerView.ViewHolder viewHolder) {
-        int dragFlags = ItemTouchHelper.UP | ItemTouchHelper.DOWN;
-        int swipeFlags = 0;
+    public void setDragFlags(int dragFlags) {
+        _dragFlags = dragFlags;
+    }
 
-        int position = viewHolder.getAdapterPosition();
-        EntryAdapter adapter = (EntryAdapter)recyclerView.getAdapter();
-        if (adapter.getEntryAt(position) != _selectedEntry || !isLongPressDragEnabled())
-        {
-            dragFlags = 0;
+    @Override
+    public int getMovementFlags(@NonNull RecyclerView recyclerView, @NonNull RecyclerView.ViewHolder viewHolder) {
+        // It's not clear when this can happen, but sometimes the ViewHolder
+        // that's passed to this function has a position of -1, leading
+        // to a crash down the line.
+        int position = viewHolder.getBindingAdapterPosition();
+        if (position == NO_POSITION) {
+            return 0;
         }
 
-        return makeMovementFlags(dragFlags, swipeFlags);
+        EntryAdapter adapter = (EntryAdapter) recyclerView.getAdapter();
+        if (adapter == null) {
+            return 0;
+        }
+
+        int swipeFlags = 0;
+        if (adapter.isPositionFooter(position)
+                || adapter.isPositionErrorCard(position)
+                || adapter.getEntryAtPosition(position) != _selectedEntry
+                || !isLongPressDragEnabled()) {
+            return makeMovementFlags(0, swipeFlags);
+        }
+
+        return makeMovementFlags(_dragFlags, swipeFlags);
     }
 
     @Override
     public boolean onMove(RecyclerView recyclerView, RecyclerView.ViewHolder viewHolder,
                           RecyclerView.ViewHolder target) {
-        _adapter.onItemMove(viewHolder.getAdapterPosition(), target.getAdapterPosition());
+        int targetIndex = _adapter.translateEntryPosToIndex(target.getBindingAdapterPosition());
+        if (targetIndex < _adapter.getShownFavoritesCount()) {
+            return false;
+        }
+
+        int firstPosition = viewHolder.getLayoutPosition();
+        int secondPosition = target.getBindingAdapterPosition();
+
+        _adapter.onItemMove(firstPosition, secondPosition);
         _positionChanged = true;
         return true;
     }
 
     @Override
     public void onSwiped(RecyclerView.ViewHolder viewHolder, int direction) {
-        _adapter.onItemDismiss(viewHolder.getAdapterPosition());
+        _adapter.onItemDismiss(viewHolder.getBindingAdapterPosition());
     }
 
     @Override
@@ -69,10 +103,9 @@ public class SimpleItemTouchHelperCallback extends ItemTouchHelper.Callback {
         super.clearView(recyclerView, viewHolder);
 
         if (_positionChanged) {
-            _adapter.onItemDrop(viewHolder.getAdapterPosition());
+            _adapter.onItemDrop(viewHolder.getBindingAdapterPosition());
             _positionChanged = false;
+            _adapter.refresh(false);
         }
     }
-
-
 }

app/src/main/java/com/beemdevelopment/aegis/helpers/SimpleTextWatcher.java

@@ -0,0 +1,33 @@
+package com.beemdevelopment.aegis.helpers;
+
+import android.text.Editable;
+import android.text.TextWatcher;
+
+public final class SimpleTextWatcher implements TextWatcher {
+    private final Listener _listener;
+
+    public SimpleTextWatcher(Listener listener) {
+        _listener = listener;
+    }
+
+    @Override
+    public void beforeTextChanged(CharSequence s, int start, int count, int after) {
+
+    }
+
+    @Override
+    public void onTextChanged(CharSequence s, int start, int before, int count) {
+
+    }
+
+    @Override
+    public void afterTextChanged(Editable s) {
+        if (_listener != null) {
+            _listener.afterTextChanged(s);
+        }
+    }
+
+    public interface Listener {
+        void afterTextChanged(Editable s);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/SpinnerHelper.java

@@ -1,31 +0,0 @@
-package com.beemdevelopment.aegis.helpers;
-
-import android.content.Context;
-import android.widget.ArrayAdapter;
-import android.widget.Spinner;
-
-import java.util.List;
-
-import androidx.annotation.ArrayRes;
-
-public class SpinnerHelper {
-    private SpinnerHelper() {
-
-    }
-
-    public static void fillSpinner(Context context, Spinner spinner, @ArrayRes int textArrayResId) {
-        ArrayAdapter<CharSequence> adapter = ArrayAdapter.createFromResource(context, textArrayResId, android.R.layout.simple_spinner_item);
-        initSpinner(spinner, adapter);
-    }
-
-    public static <T> void fillSpinner(Context context, Spinner spinner, List<T> items) {
-        ArrayAdapter adapter = new ArrayAdapter<>(context, android.R.layout.simple_spinner_item, items);
-        initSpinner(spinner, adapter);
-    }
-
-    private static void initSpinner(Spinner spinner, ArrayAdapter adapter) {
-        adapter.setDropDownViewResource(android.R.layout.simple_spinner_dropdown_item);
-        spinner.setAdapter(adapter);
-        spinner.invalidate();
-    }
-}

app/src/main/java/com/beemdevelopment/aegis/helpers/TextDrawableHelper.java

@@ -5,6 +5,7 @@ import android.view.View;
 import com.amulyakhare.textdrawable.TextDrawable;
 import com.amulyakhare.textdrawable.util.ColorGenerator;
 
+import java.text.BreakIterator;
 import java.util.Arrays;
 
 public class TextDrawableHelper {
@@ -48,6 +49,18 @@ public class TextDrawableHelper {
                 .width(view.getLayoutParams().width)
                 .height(view.getLayoutParams().height)
                 .endConfig()
-                .buildRect(text.substring(0, 1).toUpperCase(), color);
+                .buildRound(getFirstGrapheme(text).toUpperCase(), color);
+    }
+
+    private static String getFirstGrapheme(String text) {
+        BreakIterator iter = BreakIterator.getCharacterInstance();
+        iter.setText(text);
+
+        int start = iter.first(), end = iter.next();
+        if (end == BreakIterator.DONE) {
+            return "";
+        }
+
+        return text.substring(start, end);
     }
 }

app/src/main/java/com/beemdevelopment/aegis/helpers/ThemeHelper.java

@@ -1,23 +1,58 @@
 package com.beemdevelopment.aegis.helpers;
 
-import android.content.res.Resources;
-import android.graphics.Color;
-import android.util.TypedValue;
+import android.content.res.Configuration;
 
-import androidx.annotation.ColorInt;
+import androidx.appcompat.app.AppCompatActivity;
 
+import com.beemdevelopment.aegis.Preferences;
 import com.beemdevelopment.aegis.R;
+import com.beemdevelopment.aegis.Theme;
+import com.google.android.material.color.DynamicColors;
+import com.google.android.material.color.DynamicColorsOptions;
+
+import java.util.Map;
 
 public class ThemeHelper {
-    private ThemeHelper() {
+    private final AppCompatActivity _activity;
+    private final Preferences _prefs;
 
+    public ThemeHelper(AppCompatActivity activity, Preferences prefs) {
+        _activity = activity;
+        _prefs = prefs;
     }
 
-    public static int getThemeColor(int attributeId, Resources.Theme currentTheme) {
-        TypedValue typedValue = new TypedValue();
-        currentTheme.resolveAttribute(attributeId, typedValue, true);
-        @ColorInt int color = typedValue.data;
+    /**
+     * Sets the theme of the activity. The actual style that is set is picked from the
+     * given map, based on the theme configured by the user.
+     */
+    public void setTheme(Map<Theme, Integer> themeMap) {
+        int theme = themeMap.get(getConfiguredTheme());
+        _activity.setTheme(theme);
 
-        return color;
+        if (_prefs.isDynamicColorsEnabled()) {
+            DynamicColorsOptions.Builder optsBuilder = new DynamicColorsOptions.Builder();
+            if (getConfiguredTheme().equals(Theme.AMOLED)) {
+                optsBuilder.setThemeOverlay(R.style.ThemeOverlay_Aegis_Dynamic_Amoled);
+            } else if (getConfiguredTheme().equals(Theme.DARK)) {
+                optsBuilder.setThemeOverlay(R.style.ThemeOverlay_Aegis_Dynamic_Dark);
+            }
+
+            DynamicColors.applyToActivityIfAvailable(_activity, optsBuilder.build());
+        }
+    }
+
+    public Theme getConfiguredTheme() {
+        Theme theme = _prefs.getCurrentTheme();
+
+        if (theme == Theme.SYSTEM || theme == Theme.SYSTEM_AMOLED) {
+            int currentNightMode = _activity.getResources().getConfiguration().uiMode & Configuration.UI_MODE_NIGHT_MASK;
+            if (currentNightMode == Configuration.UI_MODE_NIGHT_YES) {
+                theme = theme == Theme.SYSTEM_AMOLED ? Theme.AMOLED : Theme.DARK;
+            } else {
+                theme = Theme.LIGHT;
+            }
+        }
+
+        return theme;
     }
 }

app/src/main/java/com/beemdevelopment/aegis/helpers/comparators/FavoriteComparator.java

@@ -0,0 +1,12 @@
+package com.beemdevelopment.aegis.helpers.comparators;
+
+import com.beemdevelopment.aegis.vault.VaultEntry;
+
+import java.util.Comparator;
+
+public class FavoriteComparator implements Comparator<VaultEntry> {
+    @Override
+    public int compare(VaultEntry a, VaultEntry b) {
+        return -1 * Boolean.compare(a.isFavorite(), b.isFavorite());
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/comparators/LastUsedComparator.java

@@ -0,0 +1,12 @@
+package com.beemdevelopment.aegis.helpers.comparators;
+
+import com.beemdevelopment.aegis.vault.VaultEntry;
+
+import java.util.Comparator;
+
+public class LastUsedComparator implements Comparator<VaultEntry> {
+    @Override
+    public int compare(VaultEntry a, VaultEntry b) {
+        return Long.compare(a.getLastUsedTimestamp(), b.getLastUsedTimestamp());
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/helpers/comparators/UsageCountComparator.java

@@ -0,0 +1,12 @@
+package com.beemdevelopment.aegis.helpers.comparators;
+
+import com.beemdevelopment.aegis.vault.VaultEntry;
+
+import java.util.Comparator;
+
+public class UsageCountComparator implements Comparator<VaultEntry> {
+    @Override
+    public int compare(VaultEntry a, VaultEntry b) {
+        return Integer.compare(a.getUsageCount(), b.getUsageCount());
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/icons/IconPack.java

@@ -0,0 +1,216 @@
+package com.beemdevelopment.aegis.icons;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import com.beemdevelopment.aegis.util.JsonUtils;
+import com.google.common.base.Objects;
+import com.google.common.io.Files;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.io.File;
+import java.io.Serializable;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.UUID;
+
+public class IconPack {
+    private UUID _uuid;
+    private String _name;
+    private int _version;
+    private List<Icon> _icons;
+
+    private File _dir;
+
+    private IconPack(UUID uuid, String name, int version, List<Icon> icons) {
+        _uuid = uuid;
+        _name = name;
+        _version = version;
+        _icons = icons;
+    }
+
+    public UUID getUUID() {
+        return _uuid;
+    }
+
+    public String getName() {
+        return _name;
+    }
+
+    public int getVersion() {
+        return _version;
+    }
+
+    public List<Icon> getIcons() {
+        return Collections.unmodifiableList(_icons);
+    }
+
+    /**
+     * Retrieves a list of icons suggested for the given issuer.
+     */
+    public List<Icon> getSuggestedIcons(String issuer) {
+        if (issuer == null || issuer.isEmpty()) {
+            return new ArrayList<>();
+        }
+
+        List<Icon> icons = new ArrayList<>();
+        for (Icon icon : _icons) {
+            MatchType matchType = icon.getMatchFor(issuer);
+            if (matchType != null) {
+                // Inverse matches (entry issuer contains icon name) are less likely
+                // to be good, so position them at the end of the list.
+                if (matchType.equals(MatchType.NORMAL)) {
+                    icons.add(0, icon);
+                } else if (matchType.equals(MatchType.INVERSE)) {
+                    icons.add(icon);
+                }
+            }
+        }
+
+        return icons;
+    }
+
+    @Nullable
+    public File getDirectory() {
+        return _dir;
+    }
+
+    void setDirectory(@NonNull File dir) {
+        _dir = dir;
+    }
+
+    /**
+     * Indicates whether some other object is "equal to" this one. The object does not
+     * necessarily have to be the same instance. Equality of UUID and version will make
+     * this method return true;
+     */
+    @Override
+    public boolean equals(Object o) {
+        if (!(o instanceof IconPack)) {
+            return false;
+        }
+
+        IconPack pack = (IconPack) o;
+        return super.equals(pack) || (getUUID().equals(pack.getUUID()) && getVersion() == pack.getVersion());
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hashCode(_uuid, _version);
+    }
+
+    public static IconPack fromJson(JSONObject obj) throws JSONException {
+        UUID uuid;
+        String uuidString = obj.getString("uuid");
+        try {
+            uuid = UUID.fromString(uuidString);
+        } catch (IllegalArgumentException e) {
+            throw new JSONException(String.format("Bad UUID format: %s", uuidString));
+        }
+        String name = obj.getString("name");
+        int version = obj.getInt("version");
+        JSONArray array = obj.getJSONArray("icons");
+
+        List<Icon> icons = new ArrayList<>();
+        for (int i = 0; i < array.length(); i++) {
+            Icon icon = Icon.fromJson(array.getJSONObject(i));
+            icons.add(icon);
+        }
+
+        return new IconPack(uuid, name, version, icons);
+    }
+
+    public static IconPack fromBytes(byte[] data) throws JSONException {
+        JSONObject obj = new JSONObject(new String(data, StandardCharsets.UTF_8));
+        return IconPack.fromJson(obj);
+    }
+
+    public static class Icon implements Serializable {
+        private final String _relFilename;
+        private final String _name;
+        private final String _category;
+        private final List<String> _issuers;
+
+        private File _file;
+
+        protected Icon(String filename, String name, String category, List<String> issuers) {
+            _relFilename = filename;
+            _name = name;
+            _category = category;
+            _issuers = issuers;
+        }
+
+        public String getRelativeFilename() {
+            return _relFilename;
+        }
+
+        @Nullable
+        public File getFile() {
+            return _file;
+        }
+
+        void setFile(@NonNull File file) {
+            _file = file;
+        }
+
+        public IconType getIconType() {
+            return IconType.fromFilename(_relFilename);
+        }
+
+        public String getName() {
+            if (_name != null) {
+                return _name;
+            }
+            return Files.getNameWithoutExtension(new File(_relFilename).getName());
+        }
+
+        public String getCategory() {
+            return _category;
+        }
+
+        private MatchType getMatchFor(String issuer) {
+            String lowerEntryIssuer = issuer.toLowerCase();
+
+            boolean inverseMatch = false;
+            for (String is : _issuers) {
+                String lowerIconIssuer = is.toLowerCase();
+                if (lowerIconIssuer.contains(lowerEntryIssuer)) {
+                    return MatchType.NORMAL;
+                }
+                if (lowerEntryIssuer.contains(lowerIconIssuer)) {
+                    inverseMatch = true;
+                }
+            }
+            if (inverseMatch) {
+                return MatchType.INVERSE;
+            }
+
+            return null;
+        }
+
+        public static Icon fromJson(JSONObject obj) throws JSONException {
+            String filename = obj.getString("filename");
+            String name = JsonUtils.optString(obj, "name");
+            String category = obj.isNull("category") ? null : obj.getString("category");
+            JSONArray array = obj.getJSONArray("issuer");
+
+            List<String> issuers = new ArrayList<>();
+            for (int i = 0; i < array.length(); i++) {
+                String issuer = array.getString(i);
+                issuers.add(issuer);
+            }
+
+            return new Icon(filename, name, category, issuers);
+        }
+    }
+
+    private enum MatchType {
+        NORMAL,
+        INVERSE
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/icons/IconPackException.java

@@ -0,0 +1,11 @@
+package com.beemdevelopment.aegis.icons;
+
+public class IconPackException extends Exception {
+    public IconPackException(Throwable cause) {
+        super(cause);
+    }
+
+    public IconPackException(String message) {
+        super(message);
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/icons/IconPackExistsException.java

@@ -0,0 +1,14 @@
+package com.beemdevelopment.aegis.icons;
+
+public class IconPackExistsException extends IconPackException {
+    private IconPack _pack;
+
+    public IconPackExistsException(IconPack pack) {
+        super(String.format("Icon pack %s (%d) already exists", pack.getName(), pack.getVersion()));
+        _pack = pack;
+    }
+
+    public IconPack getIconPack() {
+        return _pack;
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/icons/IconPackManager.java

@@ -0,0 +1,223 @@
+package com.beemdevelopment.aegis.icons;
+
+import android.content.Context;
+
+import androidx.annotation.Nullable;
+
+import com.beemdevelopment.aegis.util.IOUtils;
+
+import net.lingala.zip4j.ZipFile;
+import net.lingala.zip4j.io.inputstream.ZipInputStream;
+import net.lingala.zip4j.model.FileHeader;
+
+import org.json.JSONException;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+public class IconPackManager {
+    private static final String _packDefFilename = "pack.json";
+
+    private File _iconsBaseDir;
+    private List<IconPack> _iconPacks;
+
+    public IconPackManager(Context context) {
+        _iconPacks = new ArrayList<>();
+        _iconsBaseDir = new File(context.getFilesDir(), "icons");
+        rescanIconPacks();
+    }
+
+    private IconPack getIconPackByUUID(UUID uuid) {
+        List<IconPack> packs = _iconPacks.stream().filter(i -> i.getUUID().equals(uuid)).collect(Collectors.toList());
+        if (packs.size() == 0) {
+            return null;
+        }
+
+        return packs.get(0);
+    }
+
+    public boolean hasIconPack() {
+        return _iconPacks.size() > 0;
+    }
+
+    public List<IconPack> getIconPacks() {
+        return new ArrayList<>(_iconPacks);
+    }
+
+    public void removeIconPack(IconPack pack) throws IconPackException {
+        try {
+            File dir = getIconPackDir(pack);
+            deleteDir(dir);
+        } catch (IOException e) {
+            throw new IconPackException(e);
+        }
+
+        _iconPacks.remove(pack);
+    }
+
+    public IconPack importPack(File inFile) throws IconPackException {
+        try {
+            // read and parse the icon pack definition file of the icon pack
+            ZipFile zipFile = new ZipFile(inFile);
+            FileHeader packHeader = zipFile.getFileHeader(_packDefFilename);
+            if (packHeader == null) {
+                throw new IOException("Unable to find pack.json in the root of the ZIP file");
+            }
+            IconPack pack;
+            byte[] defBytes;
+            try (ZipInputStream inStream = zipFile.getInputStream(packHeader)) {
+                defBytes = IOUtils.readAll(inStream);
+                pack = IconPack.fromBytes(defBytes);
+            }
+
+            // create a new directory to store the icon pack, based on the UUID and version
+            File packDir = getIconPackDir(pack);
+            if (!packDir.getCanonicalPath().startsWith(_iconsBaseDir.getCanonicalPath() + File.separator)) {
+                throw new IOException("Attempted to write outside of the parent directory");
+            }
+            if (packDir.exists()) {
+                throw new IconPackExistsException(pack);
+            }
+            IconPack existingPack = getIconPackByUUID(pack.getUUID());
+            if (existingPack != null) {
+                throw new IconPackExistsException(existingPack);
+            }
+            if (!packDir.exists() && !packDir.mkdirs()) {
+                throw new IOException(String.format("Unable to create directories: %s", packDir.toString()));
+            }
+
+            // extract each of the defined icons to the icon pack directory
+            for (IconPack.Icon icon : pack.getIcons()) {
+                File destFile = new File(packDir, icon.getRelativeFilename());
+                FileHeader iconHeader = zipFile.getFileHeader(icon.getRelativeFilename());
+                if (iconHeader == null) {
+                    throw new IOException(String.format("Unable to find %s relative to the root of the ZIP file", icon.getRelativeFilename()));
+                }
+
+                // create new directories for this file if needed
+                File parent = destFile.getParentFile();
+                if (parent != null && !parent.exists() && !parent.mkdirs()) {
+                    throw new IOException(String.format("Unable to create directories: %s", packDir.toString()));
+                }
+
+                try (ZipInputStream inStream = zipFile.getInputStream(iconHeader);
+                     FileOutputStream outStream = new FileOutputStream(destFile)) {
+                    IOUtils.copy(inStream, outStream);
+                }
+
+                // after successful copy of the icon, store the new filename
+                icon.setFile(destFile);
+            }
+
+            // write the icon pack definition file to the newly created directory
+            try (FileOutputStream outStream = new FileOutputStream(new File(packDir, _packDefFilename))) {
+                outStream.write(defBytes);
+            }
+
+            // after successful extraction of the icon pack, store the new directory
+            pack.setDirectory(packDir);
+            _iconPacks.add(pack);
+            return pack;
+        } catch (IOException | JSONException e) {
+            throw new IconPackException(e);
+        }
+    }
+
+    private void rescanIconPacks() {
+        _iconPacks.clear();
+
+        File[] dirs = _iconsBaseDir.listFiles();
+        if (dirs == null) {
+            return;
+        }
+
+        for (File dir : dirs) {
+            if (!dir.isDirectory()) {
+                 continue;
+            }
+
+            UUID uuid;
+            try {
+                uuid = UUID.fromString(dir.getName());
+            } catch (IllegalArgumentException e) {
+                e.printStackTrace();
+                continue;
+            }
+
+            File versionDir = getLatestVersionDir(dir);
+            if (versionDir != null) {
+                IconPack pack;
+                try (FileInputStream inStream = new FileInputStream(new File(versionDir, _packDefFilename))) {
+                    byte[] bytes = IOUtils.readAll(inStream);
+                    pack = IconPack.fromBytes(bytes);
+                    pack.setDirectory(versionDir);
+                } catch (JSONException | IOException e) {
+                    e.printStackTrace();
+                    continue;
+                }
+
+                for (IconPack.Icon icon : pack.getIcons()) {
+                    icon.setFile(new File(versionDir, icon.getRelativeFilename()));
+                }
+
+                // do a sanity check on the UUID and version
+                if (pack.getUUID().equals(uuid) && pack.getVersion() == Integer.parseInt(versionDir.getName())) {
+                    _iconPacks.add(pack);
+                }
+            }
+        }
+    }
+
+    private File getIconPackDir(IconPack pack) {
+        return new File(_iconsBaseDir, pack.getUUID() + File.separator + pack.getVersion());
+    }
+
+    @Nullable
+    private static File getLatestVersionDir(File packDir) {
+        File[] dirs = packDir.listFiles();
+        if (dirs == null) {
+            return null;
+        }
+
+        int latestVersion = -1;
+        for (File versionDir : dirs) {
+            int version;
+            try {
+                version = Integer.parseInt(versionDir.getName());
+            } catch (NumberFormatException ignored) {
+                continue;
+            }
+
+            if (latestVersion == -1 || version > latestVersion) {
+                latestVersion = version;
+            }
+        }
+
+        if (latestVersion == -1) {
+            return null;
+        }
+
+        return new File(packDir, Integer.toString(latestVersion));
+    }
+
+    private static void deleteDir(File dir) throws IOException {
+        if (dir.isDirectory()) {
+            File[] children = dir.listFiles();
+            if (children != null) {
+                for (File child : children) {
+                    deleteDir(child);
+                }
+            }
+        }
+
+        if (!dir.delete()) {
+            throw new IOException(String.format("Unable to delete directory: %s", dir));
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/icons/IconType.java

@@ -0,0 +1,53 @@
+package com.beemdevelopment.aegis.icons;
+
+import com.google.common.io.Files;
+
+import java.util.Locale;
+
+public enum IconType {
+    INVALID,
+    SVG,
+    PNG,
+    JPEG;
+
+    public static IconType fromMimeType(String mimeType) {
+        switch (mimeType) {
+            case "image/svg+xml":
+                return SVG;
+            case "image/png":
+                return PNG;
+            case "image/jpeg":
+                return JPEG;
+            default:
+                return INVALID;
+        }
+    }
+
+    public static IconType fromFilename(String filename) {
+        switch (Files.getFileExtension(filename).toLowerCase(Locale.ROOT)) {
+            case "svg":
+                return SVG;
+            case "png":
+                return PNG;
+            case "jpg":
+                // intentional fallthrough
+            case "jpeg":
+                return JPEG;
+            default:
+                return INVALID;
+        }
+    }
+
+    public String toMimeType() {
+        switch (this) {
+            case SVG:
+                return "image/svg+xml";
+            case PNG:
+                return "image/png";
+            case JPEG:
+                return "image/jpeg";
+            default:
+                throw new RuntimeException(String.format("Can't convert icon type %s to MIME type", this));
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/importers/AegisImporter.java

@@ -1,14 +1,23 @@
 package com.beemdevelopment.aegis.importers;
 
 import android.content.Context;
+import android.content.DialogInterface;
 
-import com.beemdevelopment.aegis.encoding.EncodingException;
-import com.beemdevelopment.aegis.otp.OtpInfoException;
+import androidx.annotation.Nullable;
+import androidx.lifecycle.Lifecycle;
+
+import com.beemdevelopment.aegis.R;
+import com.beemdevelopment.aegis.helpers.ContextHelper;
+import com.beemdevelopment.aegis.ui.dialogs.Dialogs;
+import com.beemdevelopment.aegis.ui.tasks.PasswordSlotDecryptTask;
 import com.beemdevelopment.aegis.util.IOUtils;
 import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.beemdevelopment.aegis.vault.VaultEntryException;
 import com.beemdevelopment.aegis.vault.VaultFile;
 import com.beemdevelopment.aegis.vault.VaultFileCredentials;
 import com.beemdevelopment.aegis.vault.VaultFileException;
+import com.beemdevelopment.aegis.vault.VaultGroup;
+import com.beemdevelopment.aegis.vault.slots.PasswordSlot;
 import com.beemdevelopment.aegis.vault.slots.SlotList;
 import com.topjohnwu.superuser.io.SuFile;
 
@@ -18,6 +27,8 @@ import org.json.JSONObject;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.List;
+import java.util.UUID;
 
 public class AegisImporter extends DatabaseImporter {
 
@@ -56,23 +67,66 @@ public class AegisImporter extends DatabaseImporter {
             return _file.getHeader().getSlots();
         }
 
-        public State decrypt(VaultFileCredentials creds) throws VaultFileException {
-            JSONObject obj = _file.getContent(creds);
-            return new DecryptedState(obj);
+        public State decrypt(VaultFileCredentials creds) throws DatabaseImporterException {
+            JSONObject obj;
+            try {
+                obj = _file.getContent(creds);
+            } catch (VaultFileException e) {
+                throw new DatabaseImporterException(e);
+            }
+
+            return new DecryptedState(obj, creds);
+        }
+
+        public State decrypt(char[] password) throws DatabaseImporterException {
+            List<PasswordSlot> slots = getSlots().findAll(PasswordSlot.class);
+            PasswordSlotDecryptTask.Result result = PasswordSlotDecryptTask.decrypt(slots, password);
+            VaultFileCredentials creds = new VaultFileCredentials(result.getKey(), getSlots());
+            return decrypt(creds);
         }
 
         @Override
         public void decrypt(Context context, DecryptListener listener) {
+            Dialogs.showPasswordInputDialog(context, R.string.enter_password_aegis_title, 0, (Dialogs.TextInputListener) password -> {
+                List<PasswordSlot> slots = getSlots().findAll(PasswordSlot.class);
+                PasswordSlotDecryptTask.Params params = new PasswordSlotDecryptTask.Params(slots, password);
+                PasswordSlotDecryptTask task = new PasswordSlotDecryptTask(context, result -> {
+                    try {
+                        if (result == null) {
+                            throw new DatabaseImporterException("Password incorrect");
+                        }
 
+                        VaultFileCredentials creds = new VaultFileCredentials(result.getKey(), getSlots());
+                        State state = decrypt(creds);
+                        listener.onStateDecrypted(state);
+                    } catch (DatabaseImporterException e) {
+                        listener.onError(e);
+                    }
+                });
+
+                Lifecycle lifecycle = ContextHelper.getLifecycle(context);
+                task.execute(lifecycle, params);
+            }, (DialogInterface.OnCancelListener) dialog -> listener.onCanceled());
         }
     }
 
     public static class DecryptedState extends State {
         private JSONObject _obj;
+        private VaultFileCredentials _creds;
 
         private DecryptedState(JSONObject obj) {
+            this(obj, null);
+        }
+
+        private DecryptedState(JSONObject obj, VaultFileCredentials creds) {
             super(false);
             _obj = obj;
+            _creds = creds;
+        }
+
+        @Nullable
+        public VaultFileCredentials getCredentials() {
+            return _creds;
         }
 
         @Override
@@ -80,11 +134,31 @@ public class AegisImporter extends DatabaseImporter {
             Result result = new Result();
 
             try {
-                JSONArray array = _obj.getJSONArray("entries");
-                for (int i = 0; i < array.length(); i++) {
-                    JSONObject entryObj = array.getJSONObject(i);
+                if (_obj.has("groups")) {
+                    JSONArray groupArray = _obj.getJSONArray("groups");
+                    for (int i = 0; i < groupArray.length(); i++) {
+                        JSONObject groupObj = groupArray.getJSONObject(i);
+                        try {
+                            VaultGroup group = convertGroup(groupObj);
+                            if (!result.getGroups().has(group)) {
+                                result.addGroup(group);
+                            }
+                        } catch (DatabaseImporterEntryException e) {
+                            result.addError(e);
+                        }
+                    }
+                }
+
+                JSONArray entryArray = _obj.getJSONArray("entries");
+                for (int i = 0; i < entryArray.length(); i++) {
+                    JSONObject entryObj = entryArray.getJSONObject(i);
                     try {
                         VaultEntry entry = convertEntry(entryObj);
+                        for (UUID groupUuid : entry.getGroups()) {
+                            if (!result.getGroups().has(groupUuid)) {
+                                entry.getGroups().remove(groupUuid);
+                            }
+                        }
                         result.addEntry(entry);
                     } catch (DatabaseImporterEntryException e) {
                         result.addError(e);
@@ -100,7 +174,15 @@ public class AegisImporter extends DatabaseImporter {
         private static VaultEntry convertEntry(JSONObject obj) throws DatabaseImporterEntryException {
             try {
                 return VaultEntry.fromJson(obj);
-            } catch (JSONException | OtpInfoException | EncodingException e) {
+            } catch (VaultEntryException e) {
+                throw new DatabaseImporterEntryException(e, obj.toString());
+            }
+        }
+
+        private static VaultGroup convertGroup(JSONObject obj) throws DatabaseImporterEntryException {
+            try {
+                return VaultGroup.fromJson(obj);
+            } catch (VaultEntryException e) {
                 throw new DatabaseImporterEntryException(e, obj.toString());
             }
         }

app/src/main/java/com/beemdevelopment/aegis/importers/AndOtpImporter.java

@@ -17,10 +17,11 @@ import com.beemdevelopment.aegis.otp.OtpInfo;
 import com.beemdevelopment.aegis.otp.OtpInfoException;
 import com.beemdevelopment.aegis.otp.SteamInfo;
 import com.beemdevelopment.aegis.otp.TotpInfo;
-import com.beemdevelopment.aegis.ui.Dialogs;
-import com.beemdevelopment.aegis.ui.tasks.ProgressDialogTask;
+import com.beemdevelopment.aegis.ui.dialogs.Dialogs;
+import com.beemdevelopment.aegis.ui.tasks.PBKDFTask;
 import com.beemdevelopment.aegis.util.IOUtils;
 import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.google.android.material.dialog.MaterialAlertDialogBuilder;
 import com.topjohnwu.superuser.io.SuFile;
 
 import org.json.JSONArray;
@@ -35,17 +36,14 @@ import java.security.InvalidAlgorithmParameterException;
 import java.security.InvalidKeyException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.KeySpec;
 import java.util.Arrays;
+import java.util.Locale;
 
 import javax.crypto.BadPaddingException;
 import javax.crypto.Cipher;
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.NoSuchPaddingException;
 import javax.crypto.SecretKey;
-import javax.crypto.SecretKeyFactory;
-import javax.crypto.spec.PBEKeySpec;
 import javax.crypto.spec.SecretKeySpec;
 
 public class AndOtpImporter extends DatabaseImporter {
@@ -95,7 +93,7 @@ public class AndOtpImporter extends DatabaseImporter {
             _data = data;
         }
 
-        private DecryptedState decryptData(SecretKey key, int offset) throws DatabaseImporterException {
+        private DecryptedState decryptContent(SecretKey key, int offset) throws DatabaseImporterException {
             byte[] nonce = Arrays.copyOfRange(_data, offset, offset + NONCE_SIZE);
             byte[] tag = Arrays.copyOfRange(_data, _data.length - TAG_SIZE, _data.length);
             CryptParameters params = new CryptParameters(nonce, tag);
@@ -116,35 +114,58 @@ public class AndOtpImporter extends DatabaseImporter {
             }
         }
 
+        private PBKDFTask.Params getKeyDerivationParams(char[] password) throws DatabaseImporterException {
+            byte[] iterBytes = Arrays.copyOfRange(_data, 0, INT_SIZE);
+            int iterations = ByteBuffer.wrap(iterBytes).getInt();
+            if (iterations < 1) {
+                throw new DatabaseImporterException(String.format("Invalid number of iterations for PBKDF: %d", iterations));
+            }
+            // If number of iterations is this high, it's probably not an andOTP file, so
+            // abort early in order to prevent having to wait for an extremely long key derivation
+            // process, only to find out that the user picked the wrong file
+            if (iterations > 10_000_000L) {
+                throw new DatabaseImporterException(String.format("Unexpectedly high number of iterations: %d", iterations));
+            }
+
+            byte[] salt = Arrays.copyOfRange(_data, INT_SIZE, INT_SIZE + SALT_SIZE);
+            return new PBKDFTask.Params("PBKDF2WithHmacSHA1", KEY_SIZE, password, salt, iterations);
+        }
+
+        protected DecryptedState decryptOldFormat(char[] password) throws DatabaseImporterException {
+            // WARNING: DON'T DO THIS IN YOUR OWN CODE
+            // this exists solely to support the old andOTP backup format
+            // it is not a secure way to derive a key from a password
+            MessageDigest hash;
+            try {
+                hash = MessageDigest.getInstance("SHA-256");
+            } catch (NoSuchAlgorithmException e) {
+                throw new RuntimeException(e);
+            }
+            byte[] keyBytes = hash.digest(CryptoUtils.toBytes(password));
+            SecretKey key = new SecretKeySpec(keyBytes, "AES");
+            return decryptContent(key, 0);
+        }
+
+        protected DecryptedState decryptNewFormat(SecretKey key) throws DatabaseImporterException {
+            return decryptContent(key, INT_SIZE + SALT_SIZE);
+        }
+
+        protected DecryptedState decryptNewFormat(char[] password)
+            throws DatabaseImporterException {
+            PBKDFTask.Params params = getKeyDerivationParams(password);
+            SecretKey key = PBKDFTask.deriveKey(params);
+            return decryptNewFormat(key);
+        }
+
         private void decrypt(Context context, char[] password, boolean oldFormat, DecryptListener listener) throws DatabaseImporterException {
             if (oldFormat) {
-                // WARNING: DON'T DO THIS IN YOUR OWN CODE
-                // this exists solely to support the old andOTP backup format
-                // it is not a secure way to derive a key from a password
-                MessageDigest hash;
-                try {
-                    hash = MessageDigest.getInstance("SHA-256");
-                } catch (NoSuchAlgorithmException e) {
-                    throw new RuntimeException(e);
-                }
-                byte[] keyBytes = hash.digest(CryptoUtils.toBytes(password));
-                SecretKey key = new SecretKeySpec(keyBytes, "AES");
-                DecryptedState state = decryptData(key, 0);
+                DecryptedState state = decryptOldFormat(password);
                 listener.onStateDecrypted(state);
             } else {
-                int offset = INT_SIZE + SALT_SIZE;
-
-                byte[] iterBytes = Arrays.copyOfRange(_data, 0, INT_SIZE);
-                int iterations = ByteBuffer.wrap(iterBytes).getInt();
-                if (iterations < 1) {
-                    throw new DatabaseImporterException(String.format("Invalid number of iterations for PBKDF: %d", iterations));
-                }
-
-                byte[] salt = Arrays.copyOfRange(_data, INT_SIZE, offset);
-                AndOtpKeyDerivationTask.Params params = new AndOtpKeyDerivationTask.Params(password, salt, iterations);
-                AndOtpKeyDerivationTask task = new AndOtpKeyDerivationTask(context, key1 -> {
+                PBKDFTask.Params params = getKeyDerivationParams(password);
+                PBKDFTask task = new PBKDFTask(context, key -> {
                     try {
-                        DecryptedState state = decryptData(key1, offset);
+                        DecryptedState state = decryptNewFormat(key);
                         listener.onStateDecrypted(state);
                     } catch (DatabaseImporterException e) {
                         listener.onError(e);
@@ -162,7 +183,7 @@ public class AndOtpImporter extends DatabaseImporter {
                     context.getResources().getString(R.string.andotp_old_format)
             };
 
-            Dialogs.showSecureDialog(new AlertDialog.Builder(context)
+            Dialogs.showSecureDialog(new MaterialAlertDialogBuilder(context)
                     .setTitle(R.string.choose_andotp_importer)
                     .setSingleChoiceItems(choices, 0, null)
                     .setPositiveButton(android.R.string.ok, (dialog, which) -> {
@@ -173,7 +194,7 @@ public class AndOtpImporter extends DatabaseImporter {
                             } catch (DatabaseImporterException e) {
                                 listener.onError(e);
                             }
-                        });
+                        }, dialog1 -> listener.onCanceled());
                     })
                     .create());
         }
@@ -208,7 +229,7 @@ public class AndOtpImporter extends DatabaseImporter {
 
         private static VaultEntry convertEntry(JSONObject obj) throws DatabaseImporterEntryException {
             try {
-                String type = obj.getString("type").toLowerCase();
+                String type = obj.getString("type").toLowerCase(Locale.ROOT);
                 String algo = obj.getString("algorithm");
                 int digits = obj.getInt("digits");
                 byte[] secret = Base32.decode(obj.getString("secret"));
@@ -222,7 +243,7 @@ public class AndOtpImporter extends DatabaseImporter {
                         info = new TotpInfo(secret, algo, digits, obj.getInt("period"));
                         break;
                     case "steam":
-                        info = new SteamInfo(secret, algo, digits, obj.optInt("period", 30));
+                        info = new SteamInfo(secret, algo, digits, obj.optInt("period", TotpInfo.DEFAULT_PERIOD));
                         break;
                     default:
                         throw new DatabaseImporterException("unsupported otp type: " + type);
@@ -245,69 +266,10 @@ public class AndOtpImporter extends DatabaseImporter {
                 }
 
                 return new VaultEntry(info, name, issuer);
-            } catch (DatabaseImporterException | EncodingException | OtpInfoException | JSONException e) {
+            } catch (DatabaseImporterException | EncodingException | OtpInfoException |
+                     JSONException e) {
                 throw new DatabaseImporterEntryException(e, obj.toString());
             }
         }
     }
-
-    private static class AndOtpKeyDerivationTask extends ProgressDialogTask<AndOtpKeyDerivationTask.Params, SecretKey> {
-        private Callback _cb;
-
-        public AndOtpKeyDerivationTask(Context context, Callback cb) {
-            super(context, context.getString(R.string.unlocking_vault));
-            _cb = cb;
-        }
-
-        @Override
-        protected SecretKey doInBackground(AndOtpKeyDerivationTask.Params... args) {
-            setPriority();
-
-            AndOtpKeyDerivationTask.Params params = args[0];
-            SecretKey key;
-            try {
-                SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
-                KeySpec spec = new PBEKeySpec(params.getPassword(), params.getSalt(), params.getIterations(), KEY_SIZE);
-                key = factory.generateSecret(spec);
-            } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
-                throw new RuntimeException(e);
-            }
-
-            return key;
-        }
-
-        @Override
-        protected void onPostExecute(SecretKey key) {
-            super.onPostExecute(key);
-            _cb.onTaskFinished(key);
-        }
-
-        public static class Params {
-            private char[] _password;
-            private byte[] _salt;
-            private int _iterations;
-
-            public Params(char[] password, byte[] salt, int iterations) {
-                _iterations = iterations;
-                _password = password;
-                _salt = salt;
-            }
-
-            public char[] getPassword() {
-                return _password;
-            }
-
-            public int getIterations() {
-                return _iterations;
-            }
-
-            public byte[] getSalt() {
-                return _salt;
-            }
-        }
-
-        public interface Callback {
-            void onTaskFinished(SecretKey key);
-        }
-    }
 }

app/src/main/java/com/beemdevelopment/aegis/importers/AuthenticatorPlusImporter.java

@@ -2,7 +2,7 @@ package com.beemdevelopment.aegis.importers;
 
 import android.content.Context;
 
-import com.beemdevelopment.aegis.ui.Dialogs;
+import com.beemdevelopment.aegis.ui.dialogs.Dialogs;
 import com.beemdevelopment.aegis.util.IOUtils;
 import com.topjohnwu.superuser.io.SuFile;
 
@@ -37,34 +37,41 @@ public class AuthenticatorPlusImporter extends DatabaseImporter {
     }
 
     public static class EncryptedState extends DatabaseImporter.State {
-        private byte[] _data;
+        private final byte[] _data;
 
         private EncryptedState(byte[] data) {
             super(true);
             _data = data;
         }
 
+        protected State decrypt(char[] password) throws DatabaseImporterException {
+            try (ByteArrayInputStream inStream = new ByteArrayInputStream(_data);
+                 ZipInputStream zipStream = new ZipInputStream(inStream, password)) {
+                LocalFileHeader header;
+                while ((header = zipStream.getNextEntry()) != null) {
+                    File file = new File(header.getFileName());
+                    if (file.getName().equals(FILENAME)) {
+                        GoogleAuthUriImporter importer = new GoogleAuthUriImporter(null);
+                        return importer.read(zipStream);
+                    }
+                }
+
+                throw new FileNotFoundException(FILENAME);
+            } catch (IOException e) {
+                throw new DatabaseImporterException(e);
+            }
+        }
+
         @Override
         public void decrypt(Context context, DecryptListener listener) {
             Dialogs.showPasswordInputDialog(context, password -> {
-                try (ByteArrayInputStream inStream = new ByteArrayInputStream(_data);
-                     ZipInputStream zipStream = new ZipInputStream(inStream, password)) {
-                    LocalFileHeader header;
-                    while ((header = zipStream.getNextEntry()) != null) {
-                        File file = new File(header.getFileName());
-                        if (file.getName().equals(FILENAME)) {
-                            GoogleAuthUriImporter importer = new GoogleAuthUriImporter(context);
-                            DatabaseImporter.State state = importer.read(zipStream);
-                            listener.onStateDecrypted(state);
-                            return;
-                        }
-                    }
-
-                    throw new FileNotFoundException(FILENAME);
-                } catch (IOException | DatabaseImporterException e) {
+                try {
+                    DatabaseImporter.State state = decrypt(password);
+                    listener.onStateDecrypted(state);
+                } catch (DatabaseImporterException e) {
                     listener.onError(e);
                 }
-            });
+            }, dialog1 -> listener.onCanceled());
         }
     }
 }

app/src/main/java/com/beemdevelopment/aegis/importers/AuthenticatorProImporter.java

@@ -0,0 +1,380 @@
+package com.beemdevelopment.aegis.importers;
+
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.database.Cursor;
+
+import androidx.lifecycle.Lifecycle;
+
+import com.beemdevelopment.aegis.R;
+import com.beemdevelopment.aegis.encoding.Base32;
+import com.beemdevelopment.aegis.encoding.EncodingException;
+import com.beemdevelopment.aegis.helpers.ContextHelper;
+import com.beemdevelopment.aegis.otp.HotpInfo;
+import com.beemdevelopment.aegis.otp.OtpInfo;
+import com.beemdevelopment.aegis.otp.OtpInfoException;
+import com.beemdevelopment.aegis.otp.SteamInfo;
+import com.beemdevelopment.aegis.otp.TotpInfo;
+import com.beemdevelopment.aegis.ui.dialogs.Dialogs;
+import com.beemdevelopment.aegis.ui.tasks.Argon2Task;
+import com.beemdevelopment.aegis.ui.tasks.PBKDFTask;
+import com.beemdevelopment.aegis.util.IOUtils;
+import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.topjohnwu.superuser.io.SuFile;
+
+import org.bouncycastle.crypto.params.Argon2Parameters;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.UTFDataFormatException;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.List;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.SecretKey;
+import javax.crypto.spec.IvParameterSpec;
+
+public class AuthenticatorProImporter extends DatabaseImporter {
+    private static final String HEADER = "AUTHENTICATORPRO";
+    private static final String HEADER_LEGACY = "AuthenticatorPro";
+    private static final String PKG_NAME = "me.jmh.authenticatorpro";
+    private static final String PKG_DB_PATH = "files/proauth.db3";
+
+    private enum Algorithm {
+        SHA1,
+        SHA256,
+        SHA512
+    }
+
+    public AuthenticatorProImporter(Context context) {
+        super(context);
+    }
+
+    @Override
+    protected SuFile getAppPath() throws DatabaseImporterException, PackageManager.NameNotFoundException {
+        return getAppPath(PKG_NAME, PKG_DB_PATH);
+    }
+
+    @Override
+    protected State read(InputStream stream, boolean isInternal) throws DatabaseImporterException {
+        return isInternal ? readInternal(stream) : readExternal(stream);
+    }
+
+    private State readInternal(InputStream stream) throws DatabaseImporterException {
+        List<SqlEntry> entries = new SqlImporterHelper(requireContext()).read(SqlEntry.class, stream, "authenticator");
+        return new SqlState(entries);
+    }
+
+    private static State readExternal(InputStream stream) throws DatabaseImporterException {
+        byte[] data;
+        try {
+            data = IOUtils.readAll(stream);
+        } catch (IOException e) {
+            throw new DatabaseImporterException(e);
+        }
+
+        try {
+            return new JsonState(new JSONObject(new String(data, StandardCharsets.UTF_8)));
+        } catch (JSONException e) {
+            return readEncrypted(new DataInputStream(new ByteArrayInputStream(data)));
+        }
+    }
+
+    private static State readEncrypted(DataInputStream stream) throws DatabaseImporterException {
+        try {
+            byte[] headerBytes = new byte[HEADER.getBytes(StandardCharsets.UTF_8).length];
+            stream.readFully(headerBytes);
+            String header = new String(headerBytes, StandardCharsets.UTF_8);
+            switch (header) {
+                case HEADER:
+                    return EncryptedState.parseHeader(stream);
+                case HEADER_LEGACY:
+                    return LegacyEncryptedState.parseHeader(stream);
+                default:
+                    throw new DatabaseImporterException("Invalid file header");
+            }
+        } catch (UTFDataFormatException e) {
+            throw new DatabaseImporterException("Invalid file header");
+        } catch (IOException | NoSuchPaddingException | NoSuchAlgorithmException e) {
+            throw new DatabaseImporterException(e);
+        }
+    }
+
+    private static OtpInfo parseOtpInfo(int type, byte[] secret, Algorithm algo, int digits, int period, int counter)
+            throws OtpInfoException, DatabaseImporterEntryException {
+        switch (type) {
+            case 1:
+                return new HotpInfo(secret, algo.name(), digits, counter);
+            case 2:
+                return new TotpInfo(secret, algo.name(), digits, period);
+            case 4:
+                return new SteamInfo(secret, algo.name(), digits, period);
+            default:
+                throw new DatabaseImporterEntryException(String.format("Unsupported otp type: %d", type), null);
+        }
+    }
+
+    static class EncryptedState extends State {
+        private static final int KEY_SIZE = 32;
+        private static final int MEMORY_COST = 16; // 2^16 KiB = 64 MiB
+        private static final int PARALLELISM = 4;
+        private static final int ITERATIONS = 3;
+        private static final int SALT_SIZE = 16;
+        private static final int IV_SIZE = 12;
+
+        private final Cipher _cipher;
+        private final byte[] _salt;
+        private final byte[] _iv;
+        private final byte[] _data;
+
+        public EncryptedState(Cipher cipher, byte[] salt, byte[] iv, byte[] data) {
+            super(true);
+            _cipher = cipher;
+            _salt = salt;
+            _iv = iv;
+            _data = data;
+        }
+
+        public JsonState decrypt(char[] password) throws DatabaseImporterException {
+            Argon2Task.Params params = getKeyDerivationParams(password);
+            SecretKey key = Argon2Task.deriveKey(params);
+            return decrypt(key);
+        }
+
+        public JsonState decrypt(SecretKey key) throws DatabaseImporterException {
+            try {
+                _cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(_iv));
+                byte[] decrypted = _cipher.doFinal(_data);
+                return new JsonState(new JSONObject(new String(decrypted, StandardCharsets.UTF_8)));
+            } catch (InvalidAlgorithmParameterException | IllegalBlockSizeException
+                     | JSONException | InvalidKeyException | BadPaddingException e) {
+                throw new DatabaseImporterException(e);
+            }
+        }
+
+        @Override
+        public void decrypt(Context context, DecryptListener listener) throws DatabaseImporterException {
+            Dialogs.showPasswordInputDialog(context, R.string.enter_password_aegis_title, 0, (Dialogs.TextInputListener) password -> {
+                Argon2Task.Params params = getKeyDerivationParams(password);
+                Argon2Task task = new Argon2Task(context, key -> {
+                    try {
+                        AuthenticatorProImporter.JsonState state = decrypt(key);
+                        listener.onStateDecrypted(state);
+                    } catch (DatabaseImporterException e) {
+                        listener.onError(e);
+                    }
+                });
+                Lifecycle lifecycle = ContextHelper.getLifecycle(context);
+                task.execute(lifecycle, params);
+            }, dialog -> listener.onCanceled());
+        }
+
+        private Argon2Task.Params getKeyDerivationParams(char[] password) {
+            Argon2Parameters argon2Params = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
+                    .withIterations(ITERATIONS)
+                    .withParallelism(PARALLELISM)
+                    .withMemoryPowOfTwo(MEMORY_COST)
+                    .withSalt(_salt)
+                    .build();
+            return new Argon2Task.Params(password, argon2Params, KEY_SIZE);
+        }
+
+        private static EncryptedState parseHeader(DataInputStream stream)
+            throws IOException, NoSuchPaddingException, NoSuchAlgorithmException {
+            byte[] salt = new byte[SALT_SIZE];
+            stream.readFully(salt);
+
+            byte[] iv = new byte[IV_SIZE];
+            stream.readFully(iv);
+
+            Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
+            return new EncryptedState(cipher, salt, iv, IOUtils.readAll(stream));
+        }
+    }
+
+    static class LegacyEncryptedState extends State {
+        private static final int ITERATIONS = 64000;
+        private static final int KEY_SIZE = 32 * Byte.SIZE;
+        private static final int SALT_SIZE = 20;
+
+        private final Cipher _cipher;
+        private final byte[] _salt;
+        private final byte[] _iv;
+        private final byte[] _data;
+
+        public LegacyEncryptedState(Cipher cipher, byte[] salt, byte[] iv, byte[] data) {
+            super(true);
+            _cipher = cipher;
+            _salt = salt;
+            _iv = iv;
+            _data = data;
+        }
+
+        public JsonState decrypt(char[] password) throws DatabaseImporterException {
+            PBKDFTask.Params params = getKeyDerivationParams(password);
+            SecretKey key = PBKDFTask.deriveKey(params);
+            return decrypt(key);
+        }
+
+        public JsonState decrypt(SecretKey key) throws DatabaseImporterException {
+            try {
+                _cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(_iv));
+                byte[] decrypted = _cipher.doFinal(_data);
+                return new JsonState(new JSONObject(new String(decrypted, StandardCharsets.UTF_8)));
+            } catch (InvalidAlgorithmParameterException | IllegalBlockSizeException
+                     | JSONException | InvalidKeyException | BadPaddingException e) {
+                throw new DatabaseImporterException(e);
+            }
+        }
+
+        @Override
+        public void decrypt(Context context, DecryptListener listener) throws DatabaseImporterException {
+            Dialogs.showPasswordInputDialog(context, R.string.enter_password_aegis_title, 0, (Dialogs.TextInputListener) password -> {
+                PBKDFTask.Params params = getKeyDerivationParams(password);
+                PBKDFTask task = new PBKDFTask(context, key -> {
+                    try {
+                        AuthenticatorProImporter.JsonState state = decrypt(key);
+                        listener.onStateDecrypted(state);
+                    } catch (DatabaseImporterException e) {
+                        listener.onError(e);
+                    }
+                });
+                Lifecycle lifecycle = ContextHelper.getLifecycle(context);
+                task.execute(lifecycle, params);
+            }, dialog -> listener.onCanceled());
+        }
+
+        private PBKDFTask.Params getKeyDerivationParams(char[] password) {
+            return new PBKDFTask.Params("PBKDF2WithHmacSHA1", KEY_SIZE, password, _salt, ITERATIONS);
+        }
+
+        private static LegacyEncryptedState parseHeader(DataInputStream stream)
+            throws IOException, NoSuchPaddingException, NoSuchAlgorithmException {
+            byte[] salt = new byte[SALT_SIZE];
+            stream.readFully(salt);
+
+            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+            int ivSize = cipher.getBlockSize();
+            byte[] iv = new byte[ivSize];
+            stream.readFully(iv);
+            return new LegacyEncryptedState(cipher, salt, iv, IOUtils.readAll(stream));
+        }
+    }
+
+    private static class JsonState extends State {
+        private final JSONObject _obj;
+
+        public JsonState(JSONObject obj) {
+            super(false);
+            _obj = obj;
+        }
+
+        @Override
+        public Result convert() throws DatabaseImporterException {
+            Result res = new Result();
+
+            try {
+                JSONArray array = _obj.getJSONArray("Authenticators");
+                for (int i = 0; i < array.length(); i++) {
+                    JSONObject obj = array.getJSONObject(i);
+                    try {
+                        res.addEntry(convertEntry(obj));
+                    } catch (DatabaseImporterEntryException e) {
+                        res.addError(e);
+                    }
+                }
+            } catch (JSONException e) {
+                throw new DatabaseImporterException(e);
+            }
+
+            return res;
+        }
+
+        private static VaultEntry convertEntry(JSONObject obj) throws DatabaseImporterEntryException {
+            try {
+                int type = obj.getInt("Type");
+                String issuer = obj.getString("Issuer");
+                Object nullableUsername = obj.get("Username");
+                String username = nullableUsername == JSONObject.NULL ? "" : nullableUsername.toString();
+                byte[] secret = Base32.decode(obj.getString("Secret"));
+                Algorithm algo = Algorithm.values()[obj.getInt("Algorithm")];
+                int digits = obj.getInt("Digits");
+                int period = obj.getInt("Period");
+                int counter = obj.getInt("Counter");
+
+                OtpInfo info = parseOtpInfo(type, secret, algo, digits, period, counter);
+                return new VaultEntry(info, username, issuer);
+            } catch (OtpInfoException | EncodingException | JSONException e) {
+                throw new DatabaseImporterEntryException(e, null);
+            }
+        }
+    }
+
+    private static class SqlState extends State {
+        private final List<SqlEntry> _entries;
+
+        public SqlState(List<SqlEntry> entries) {
+            super(false);
+            _entries = entries;
+        }
+
+        @Override
+        public Result convert() throws DatabaseImporterException {
+            Result res = new Result();
+
+            for (SqlEntry entry : _entries) {
+                try {
+                    res.addEntry(entry.convert());
+                } catch (DatabaseImporterEntryException e) {
+                    res.addError(e);
+                }
+            }
+
+            return res;
+        }
+    }
+
+    private static class SqlEntry extends SqlImporterHelper.Entry {
+        private final int _type;
+        private final String _issuer;
+        private final String _username;
+        private final String _secret;
+        private final Algorithm _algo;
+        private final int _digits;
+        private final int _period;
+        private final int _counter;
+
+        public SqlEntry(Cursor cursor) {
+            super(cursor);
+            _type = SqlImporterHelper.getInt(cursor, "type");
+            _issuer = SqlImporterHelper.getString(cursor, "issuer");
+            _username = SqlImporterHelper.getString(cursor, "username");
+            _secret = SqlImporterHelper.getString(cursor, "secret");
+            _algo = Algorithm.values()[SqlImporterHelper.getInt(cursor, "algorithm")];
+            _digits = SqlImporterHelper.getInt(cursor, "digits");
+            _period = SqlImporterHelper.getInt(cursor, "period");
+            _counter = SqlImporterHelper.getInt(cursor, "counter");
+        }
+
+        public VaultEntry convert() throws DatabaseImporterEntryException {
+            try {
+                byte[] secret = Base32.decode(_secret);
+                OtpInfo info = parseOtpInfo(_type, secret, _algo, _digits, _period, _counter);
+                return new VaultEntry(info, _username, _issuer);
+            } catch (EncodingException | OtpInfoException e) {
+                throw new DatabaseImporterEntryException(e, null);
+            }
+        }
+    }
+}

app/src/main/java/com/beemdevelopment/aegis/importers/AuthyImporter.java

@@ -12,10 +12,11 @@ import com.beemdevelopment.aegis.encoding.Hex;
 import com.beemdevelopment.aegis.otp.OtpInfo;
 import com.beemdevelopment.aegis.otp.OtpInfoException;
 import com.beemdevelopment.aegis.otp.TotpInfo;
-import com.beemdevelopment.aegis.ui.Dialogs;
+import com.beemdevelopment.aegis.ui.dialogs.Dialogs;
 import com.beemdevelopment.aegis.util.JsonUtils;
 import com.beemdevelopment.aegis.util.PreferenceParser;
 import com.beemdevelopment.aegis.vault.VaultEntry;
+import com.topjohnwu.superuser.Shell;
 import com.topjohnwu.superuser.io.SuFile;
 import com.topjohnwu.superuser.io.SuFileInputStream;
 
@@ -42,6 +43,7 @@ import javax.crypto.SecretKey;
 import javax.crypto.SecretKeyFactory;
 import javax.crypto.spec.IvParameterSpec;
 import javax.crypto.spec.PBEKeySpec;
+import javax.crypto.spec.SecretKeySpec;
 
 public class AuthyImporter extends DatabaseImporter {
     private static final String _subPath = "shared_prefs";
@@ -66,14 +68,20 @@ public class AuthyImporter extends DatabaseImporter {
     }
 
     @Override
-    public State readFromApp() throws PackageManager.NameNotFoundException, DatabaseImporterException {
+    public State readFromApp(Shell shell) throws PackageManager.NameNotFoundException, DatabaseImporterException {
         SuFile path = getAppPath();
+        path.setShell(shell);
 
         JSONArray array;
         JSONArray authyArray;
         try {
-            array = readFile(new SuFile(path, String.format("%s.xml", _authFilename)), String.format("%s.key", _authFilename));
-            authyArray = readFile(new SuFile(path, String.format("%s.xml", _authyFilename)), String.format("%s.key", _authyFilename));
+            SuFile file1 = new SuFile(path, String.format("%s.xml", _authFilename));
+            file1.setShell(shell);
+            SuFile file2 = new SuFile(path, String.format("%s.xml", _authyFilename));
+            file2.setShell(shell);
+
+            array = readFile(file1, String.format("%s.key", _authFilename));
+            authyArray = readFile(file2, String.format("%s.key", _authyFilename));
         } catch (IOException | XmlPullParserException e) {
             throw new DatabaseImporterException(e);
         }
@@ -128,7 +136,7 @@ public class AuthyImporter extends DatabaseImporter {
     }
 
     private JSONArray readFile(SuFile file, String key) throws IOException, XmlPullParserException {
-        try (SuFileInputStream inStream = new SuFileInputStream(file)) {
+        try (InputStream inStream = SuFileInputStream.open(file)) {
             XmlPullParser parser = Xml.newPullParser();
             parser.setFeature(XmlPullParser.FEATURE_PROCESS_NAMESPACES, false);
             parser.setInput(inStream, null);
@@ -154,47 +162,56 @@ public class AuthyImporter extends DatabaseImporter {
             _array = array;
         }
 
+        protected DecryptedState decrypt(char[] password) throws DatabaseImporterException {
+            try {
+                for (int i = 0; i < _array.length(); i++) {
+                    JSONObject obj = _array.getJSONObject(i);
+                    String secretString = JsonUtils.optString(obj, "encryptedSecret");
+                    if (secretString == null) {
+                        continue;
+                    }
+
+                    byte[] encryptedSecret = Base64.decode(secretString);
+                    byte[] salt = obj.getString("salt").getBytes(StandardCharsets.UTF_8);
+                    SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
+                    KeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_SIZE);
+                    SecretKey key = factory.generateSecret(spec);
+                    key = new SecretKeySpec(key.getEncoded(), "AES");
+
+                    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+                    IvParameterSpec ivSpec = new IvParameterSpec(IV);
+                    cipher.init(Cipher.DECRYPT_MODE, key, ivSpec);
+
+                    byte[] secret = cipher.doFinal(encryptedSecret);
+                    obj.remove("encryptedSecret");
+                    obj.remove("salt");
+                    obj.put("decryptedSecret", new String(secret, StandardCharsets.UTF_8));
+                }
+
+                return new DecryptedState(_array);
+            } catch (JSONException
+                    | EncodingException
+                    | NoSuchAlgorithmException
+                    | InvalidKeySpecException
+                    | InvalidAlgorithmParameterException
+                    | InvalidKeyException
+                    | NoSuchPaddingException
+                    | BadPaddingException
+                    | IllegalBlockSizeException e) {
+                throw new DatabaseImporterException(e);
+            }
+        }
+
         @Override
         public void decrypt(Context context, DecryptListener listener) {
             Dialogs.showPasswordInputDialog(context, R.string.enter_password_authy_message, password -> {
                 try {
-                    for (int i = 0; i < _array.length(); i++) {
-                        JSONObject obj = _array.getJSONObject(i);
-                        String secretString = JsonUtils.optString(obj, "encryptedSecret");
-                        if (secretString == null) {
-                            continue;
-                        }
-
-                        byte[] encryptedSecret = Base64.decode(secretString);
-                        byte[] salt = obj.getString("salt").getBytes(StandardCharsets.UTF_8);
-                        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
-                        KeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_SIZE);
-                        SecretKey key = factory.generateSecret(spec);
-
-                        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
-                        IvParameterSpec ivSpec = new IvParameterSpec(IV);
-                        cipher.init(Cipher.DECRYPT_MODE, key, ivSpec);
-
-                        byte[] secret = cipher.doFinal(encryptedSecret);
-                        obj.remove("encryptedSecret");
-                        obj.remove("salt");
-                        obj.put("decryptedSecret", new String(secret, StandardCharsets.UTF_8));
-                    }
-
-                    DecryptedState state = new DecryptedState(_array);
+                    DecryptedState state = decrypt(password);
                     listener.onStateDecrypted(state);
-                } catch (JSONException
-                        | EncodingException
-                        | NoSuchAlgorithmException
-                        | InvalidKeySpecException
-                        | InvalidAlgorithmParameterException
-                        | InvalidKeyException
-                        | NoSuchPaddingException
-                        | BadPaddingException
-                        | IllegalBlockSizeException e) {
+                } catch (DatabaseImporterException e) {
                     listener.onError(e);
                 }
-            });
+            }, dialog1 -> listener.onCanceled());
         }
     }
 
@@ -235,7 +252,7 @@ public class AuthyImporter extends DatabaseImporter {
                 authyEntryInfo.AccountType = JsonUtils.optString(entry, "accountType");
                 authyEntryInfo.Name = entry.optString("name");
 
-                boolean isAuthy = !entry.optString("accountType", "authy").equals("authenticator");
+                boolean isAuthy = entry.has("secretSeed");
                 sanitizeEntryInfo(authyEntryInfo, isAuthy);
 
                 byte[] secret;
@@ -246,7 +263,7 @@ public class AuthyImporter extends DatabaseImporter {
                 }
 
                 int digits = entry.getInt("digits");
-                OtpInfo info = new TotpInfo(secret, "SHA1", digits, digits == 7 ? 10 : 30);
+                OtpInfo info = new TotpInfo(secret, OtpInfo.DEFAULT_ALGORITHM, digits, isAuthy ? 10 : TotpInfo.DEFAULT_PERIOD);
                 return new VaultEntry(info, authyEntryInfo.Name, authyEntryInfo.Issuer);
             } catch (OtpInfoException | JSONException | EncodingException e) {
                 throw new DatabaseImporterEntryException(e, entry.toString());
@@ -274,6 +291,10 @@ public class AuthyImporter extends DatabaseImporter {
                 info.Issuer = info.Name;
                 info.Name = "";
             }
+
+            if (info.Name.startsWith(": ")) {
+                info.Name = info.Name.substring(2);
+            }
         }
     }