MyFinalKey

Builds on the encryption foundation from 1.7.0. No new IAP products, no new permissions. One new SDK added: @sentry/react-native for crash reporting (no user PII collected, DSN-only telemetry). --- USER-VISIBLE CHANGES --- 1. Vault Data Isolation (all task screens) Every vault storage path is now scoped to the authenticated user's ID. Previously, some paths used a shared prefix — now each user's financial, property, professional, utility, funeral, membership, document, and portal credential data is stored under their own namespace. Existing data was migrated automatically. 2. Keyholder Access Controls Keyholders can no longer access passwords, loyalty points, documents, or portal credentials. Access is gated through the unified_access_grants table. Successor access is unchanged. 3. End-of-Life Unlock Flow Single terminal unlock transition that honors the requireSecretCodeValidation policy. Prevents duplicate grants and ensures the death verification flow completes atomically. 4. Invitation Acceptance Improvements - Terminal screens (accepted/expired/error) now have properly sized buttons and clear stale invitation tokens - Invitation lockout UX improved for beta testers - Final Wishes "view-as" access now works for all 18 categories 5. Successor Prompt Banner Dashboard banner now correctly recognizes pending successor invitations and drives users to complete the trusted-party handshake. 6. Feedback Button → Modal The floating feedback tab replaced with a bottom-sheet modal, eliminating overlap with navigation elements. 7. Idle Lock Overlay Improved auto-lock behavior when app is backgrounded. 8. Dashboard Full-Screen Scroll Entire dashboard (header + cards) now scrolls as one view. --- SECURITY FIXES --- - PBKDF2 key derivation: length parameter corrected from bytes to bits per react-native-aes-crypto API (was producing 256-bit keys from a 32-bit derivation — now correctly derives 256-bit keys) - Atomic master-key enrollment with native CSPRNG for trusted-party wrapping - Vault keychain unlock cache no longer gated behind biometric check - Duplicate trusted-party grants prevented - Owner-only access enforced on /api/vault/sensitive-data/:userId - Profile image cache namespaced per userId --- CRASH REPORTING --- @sentry/react-native added for production crash monitoring. No user PII collected. Only crash stack traces and device metadata (OS version, app version) are transmitted to Sentry. DSN configured server-side. --- REVIEWER TEST FLOW --- Same test accounts as previous submissions: Account #1 (Owner): appreview-owner@myfinalkey.com / Review2026! Account #2 (Spouse): appreview-spouse@myfinalkey.com / Review2026! Key flows to verify: 1. Log in → Dashboard scrolls fully (header + cards) 2. Settings → Recovery Code (set/change code flow) 3. Settings → Add Successor → send invitation 4. Accept invitation from Account #2 5. Verify keyholder cannot access passwords/documents 6. Family Plan and Refer a Friend flows unchanged from 1.6.0 --- PRIVACY --- No new user data collected. Sentry receives only crash telemetry (stack traces, device model, OS version). Recovery Code never leaves the device. All vault data encrypted with AES-256-CBC + HMAC-SHA-256.