AndroidTokenEncryptionHandler
Android TokenEncryptionHandler backed by the Android Keystore, with optional biometric gating.
A single instance encrypts with one fixed policy chosen at construction — either a plain Keystore-resident RSA/AES envelope (requireBiometric = false), or the same envelope protected by a biometric-gated key (requireBiometric = true). This mirrors the JVM JceTokenEncryptionHandler's "one strategy per instance" model. For per-credential mixed security tiers (some biometric, some not), construct multiple RoomTokenStorage instances with different keyAlias values.
promptInfo must be non-null before a decrypt call is attempted when requireBiometric is true, or that call fails with IllegalArgumentException. If different operations need different prompt text, construct separate RoomTokenStorage instances (see keyAlias above) rather than mutating this instance — neither TokenStorage.getToken nor TokenEncryptionHandler.decrypt take a per-call prompt, so a single instance can only ever show one prompt anyway.
Parameters
the Android Keystore alias used for this handler's RSA key pair.
when true, a biometric (or device credential, depending on Keystore capability) challenge is required to decrypt.
seconds after a successful biometric challenge during which decryption may proceed without re-prompting; 0 means "auth-per-use" (every decrypt shows the prompt). Ignored when requireBiometric is false.
the BiometricPrompt.PromptInfo to display for biometric challenges. Required (non-null) when requireBiometric is true.
the KeyStore used to store/retrieve the RSA key pair.
the generator used to create the RSA key pair on first use.