1 - Setting Up A Permission Store

So. You Want To Guard An App.

Every app gets its own permission store — a single encrypted file that holds every requester → permission → level mapping for that app. Before you can grant or check anything, that file has to exist.

There are three pieces you'll pass around constantly, so let's name them once:

Piece What it is Who provides it
Save Directory The folder the store file lives in Your app / the Manager
Permission Class The store's name — usually the app's name. The file on disk is <PermissionClass>.json Your app
Encryption Key The per-app key used to encrypt/decrypt the store XRUIOS.Manager — not the user's master key
The encryption key is not the user's main key. A manager should generate a key specifically for this app. If two apps shared a key, one could read and rewrite the other's permissions. One app, one key.

Everything is wrapped in SecureData so it isn't sitting in plaintext:

var saveDir   = @"C:\XRUIOS\Permissions".ToSecureData();
var permClass = "CameraApp".ToSecureData();
var appKey    = managerIssuedKey; // SecureData handed to you by XRUIOS.Manager

Step 1 - Create The Store

var handler = new Handler();

await handler.SetupPermFile(saveDir, permClass, appKey);

This creates CameraApp.json in your save directory, writes an encrypted Label and an empty permissions directory, and that's it. No dummy/placeholder requester is seeded — the store starts genuinely empty.

SetupPermFile refuses to overwrite. If a store already exists at that path it throws a PermissionStoreException rather than wiping real permissions. That's on purpose.

Step 2 - Check Whether A Store Exists

If you don't know whether the app has been set up yet:

bool exists = await handler.PermissionFileExists(permClass, saveDir);

if (!exists)
    await handler.SetupPermFile(saveDir, permClass, appKey);
Note the argument order: PermissionFileExists(PermissionClass, SaveDirectory). It looks up <PermissionClass>.json — the same file everything else reads. (Earlier builds checked the wrong filename; if you're updating old code, this is why a check might have always come back false.)

That's the whole setup

One file per app, created once, keyed to that app. From here you actually put permissions in it — head to 2 - Granting, Checking and Revoking.