Log encryption failure cause under DEBUG in encryptWithCipher

[wksantiago]

Mirrors decryptWithCipher: logs the discarded cause under BuildConfig.DEBUG before throwing StorageException, so encrypt failures are diagnosable.

Summary by CodeRabbit

• Bug Fixes
  • Improved diagnostic logging for encryption failures in debug builds while preserving existing production behavior and error messages.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c7af59f5-0610-48ae-9ba9-3e81a16b2260

📥 Commits

Reviewing files that changed from the base of the PR and between 4949d1d and c52197f.

📒 Files selected for processing (1)

• app/src/main/kotlin/io/privkey/keep/storage/AndroidKeystoreStorage.kt

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The encryption failure path now logs the exception type and message in debug builds before throwing the existing StorageException. Production behavior and exception text remain unchanged.

Changes

Encryption Failure Logging

Layer / File(s)	Summary
Encryption failure diagnostics app/src/main/kotlin/io/privkey/keep/storage/AndroidKeystoreStorage.kt	Debug builds log encryption failure details before the existing StorageException is thrown.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to c5219

This change only improves DEBUG diagnostics for encryption failures without altering normal exception behavior or production data handling; no actionable merge-blocking risk remains.

Suggested reviewers: kwsantiago

Poem

A rabbit checks the cipher glow,
Logs the fault so clues can show.
The same exception hops along,
Production stays steady and strong.
Debug ears now hear the wrong.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the DEBUG logging change in encryptWithCipher.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-encrypt-cipher-cause-logging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kwsantiago]

Verified and no blockers. This is the change I asked for, and it earns its place: the discarded cause here is exactly what I had to patch in locally to diagnose the #508 investigation, and the same opacity is why #483 sat filed as an Android 17 encryption bug longer than it should have.

The mirror claim is accurate. decryptWithCipher already had this shape, so encrypt now matches its neighbour rather than introducing a new convention.

Checked the obvious risk in a change that adds logging next to secret material: data is not logged. Only the exception class, its message and its stack trace, none of which carry the plaintext, and a Keystore failure message is an error code and operation context. DEBUG-gated, and the thrown StorageException("Failed to encrypt share") is unchanged, so release behaviour and caller-visible behaviour are both identical.

On the base. This branch sits on ea3365e and is missing 4949d1d (#510). I checked that with git merge-base --is-ancestor before running anything, having burned myself on exactly that in #508, and rather than test the stale tip I merged main in locally and ran against what will actually land. #510 does not touch encryptWithCipher, and ea3365e was already 291/0, so the gap does not move the baseline either way, but the numbers below are from the merge result rather than the branch as pushed.

Pixel 9a, Android 17, main merged in: 291 tests, 0 failures, 5 skipped. Local gate green (unit tests, lintDebug, RNG hygiene guard). CI green on the branch.