Fix isKeyPermanentlyInvalidated to walk full exception cause chain

[Copilot]

isKeyPermanentlyInvalidated() only checked the top-level exception class, while keystore/crypto failures are frequently wrapped. This meant biometric key invalidation could be silently misclassified as a generic init or decrypt failure.

Changes

• VaultStorage.kt: Rewrote isKeyPermanentlyInvalidated() to traverse the full cause chain, mirroring the existing pattern in isStaleKeyset()

// Before: only top-level check
private fun isKeyPermanentlyInvalidated(e: Exception): Boolean =
    Build.VERSION.SDK_INT >= Build.VERSION_CODES.M &&
            e.javaClass.name == "android.security.keystore.KeyPermanentlyInvalidatedException"

// After: walks the full cause chain
private fun isKeyPermanentlyInvalidated(e: Exception): Boolean {
    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return false
    var cause: Throwable? = e
    while (cause != null) {
        if (cause.javaClass.name == "android.security.keystore.KeyPermanentlyInvalidatedException") return true
        cause = cause.cause
    }
    return false
}

BiometricInvalidatedException is now reliably thrown wherever KeyPermanentlyInvalidatedException appears in the chain, regardless of wrapping depth.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.