git.iko.soy/opencode-android
on a0ce9ce help sign in
opencode-android/app/src/main/java/soy/iko/opencode/ui/AppLockGate.kt
310 lines 16 kB history raw
1package soy.iko.opencode.ui
3import android.content.Context
4import android.content.ContextWrapper
5import android.os.Build
6import androidx.biometric.BiometricManager
7import androidx.biometric.BiometricPrompt
8import androidx.compose.foundation.clickable
9import androidx.compose.foundation.layout.Arrangement
10import androidx.compose.foundation.layout.Column
11import androidx.compose.foundation.layout.Spacer
12import androidx.compose.foundation.layout.fillMaxSize
13import androidx.compose.foundation.layout.padding
14import androidx.compose.foundation.layout.size
15import androidx.compose.material.icons.Icons
16import androidx.compose.material.icons.filled.Fingerprint
17import androidx.compose.material.icons.filled.Lock
18import androidx.compose.material3.Button
19import androidx.compose.material3.Icon
20import androidx.compose.material3.MaterialTheme
21import androidx.compose.material3.Surface
22import androidx.compose.material3.Text
23import androidx.compose.runtime.Composable
24import androidx.compose.runtime.DisposableEffect
25import androidx.compose.runtime.LaunchedEffect
26import androidx.compose.runtime.getValue
27import androidx.compose.runtime.mutableStateOf
28import androidx.compose.runtime.remember
29import androidx.compose.runtime.saveable.rememberSaveable
30import androidx.compose.runtime.saveable.rememberSaveableStateHolder
31import androidx.compose.runtime.setValue
32import androidx.compose.ui.Alignment
33import androidx.compose.ui.Modifier
34import androidx.compose.ui.platform.LocalContext
35import androidx.compose.ui.res.stringResource
36import androidx.compose.ui.semantics.LiveRegionMode
37import androidx.compose.ui.semantics.Role
38import androidx.compose.ui.semantics.liveRegion
39import androidx.compose.ui.semantics.semantics
40import androidx.compose.ui.unit.dp
41import androidx.core.content.ContextCompat
42import androidx.fragment.app.FragmentActivity
43import androidx.lifecycle.Lifecycle
44import androidx.lifecycle.LifecycleEventObserver
45import androidx.lifecycle.compose.LocalLifecycleOwner
46import soy.iko.opencode.R
47import soy.iko.opencode.ui.components.LoadingSize
48import soy.iko.opencode.ui.components.LoadingSpinner
50/**
51 * The set of authenticators the app lock accepts. Device credential (PIN/pattern/password)
52 * can only be combined with a biometric class from Android 11 (API 30) on; on 26–29 we ask
53 * for a strong biometric alone, so the lock is only offered (in Settings) when one is enrolled.
54 */
55private val lockAuthenticators: Int
56 get() = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
57 BiometricManager.Authenticators.BIOMETRIC_STRONG or BiometricManager.Authenticators.DEVICE_CREDENTIAL
58 } else {
59 BiometricManager.Authenticators.BIOMETRIC_STRONG
60 }
62/** Whether device authentication is currently possible, so Settings can gate the toggle. */
63fun canAuthenticateForAppLock(context: Context): Boolean =
64 BiometricManager.from(context).canAuthenticate(lockAuthenticators) == BiometricManager.BIOMETRIC_SUCCESS
66/**
67 * Whether app-lock auth is *permanently* impossible on this device (no hardware, nothing
68 * enrolled, or a pending security update). Only these states may fail the gate open. A transient
69 * error (sensor busy / temporarily unavailable) must NOT fail open — that would unlock the app on
70 * a momentary glitch — so the gate stays locked and lets the user retry.
71 */
72private fun appLockPermanentlyUnavailable(context: Context): Boolean =
73 when (BiometricManager.from(context).canAuthenticate(lockAuthenticators)) {
74 BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED,
75 BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE,
76 BiometricManager.BIOMETRIC_ERROR_SECURITY_UPDATE_REQUIRED -> true
77 else -> false
78 }
80/** Unwrap a [FragmentActivity] from a (possibly wrapped) Compose [Context]. */
81private fun Context.findFragmentActivity(): FragmentActivity? {
82 var ctx: Context? = this
83 while (ctx is ContextWrapper) {
84 if (ctx is FragmentActivity) return ctx
85 ctx = ctx.baseContext
86 }
87 return null
90/**
91 * Gates [content] behind device authentication when [enabled]. The content stays composed
92 * underneath an opaque lock overlay (so navigation state survives a re-lock), and the app
93 * re-locks whenever it's sent to the background. If no [FragmentActivity] is available or the
94 * device can't authenticate, the gate is a no-op — the setting is only offered when
95 * [canAuthenticateForAppLock] is true, so this fallback just prevents a hard lock-out.
96 */
97@Composable
98fun AppLockGate(enabled: Boolean, reLockDelaySeconds: Int = 0, content: @Composable () -> Unit) {
99 if (!enabled) {
100 content()
101 return
102 }
103 val context = LocalContext.current
104 val activity = remember(context) { context.findFragmentActivity() }
105 if (activity == null) {
106 content()
107 return
108 }
109 // Fail open only if device authentication is *permanently* impossible (e.g. the user enabled
110 // app-lock while a credential was enrolled and later removed their PIN/biometric): authenticate()
111 // would otherwise always hit onAuthenticationError and strand the user on a permanent lockout.
112 // A transient authenticator error keeps the lock up (the user retries) rather than unlocking.
113 if (appLockPermanentlyUnavailable(context)) {
114 // Surface a one-time warning so the user knows their app-lock setting is on but isn't
115 // actually protecting the app — without this they'd have to discover it by opening
116 // Settings and seeing the "unavailable" state. A Toast (not a snackbar) because the
117 // gate sits above the Scaffold/SnackbarHost; the warning is informational, not an action.
118 LaunchedEffect(Unit) {
119 android.widget.Toast.makeText(
120 context,
121 context.getString(R.string.app_lock_disabled_warning),
122 android.widget.Toast.LENGTH_LONG,
123 ).show()
124 }
125 content()
126 return
127 }
129 // Deliberately NOT rememberSaveable: the unlocked flag must never be persisted into the
130 // saved-instance-state Bundle. On API 26-27 onSaveInstanceState runs *before* onStop, so a
131 // saveable `true` would be written to the Bundle before ON_STOP resets it; after a background
132 // process-kill and restore the app would come back unlocked with no biometric prompt — an
133 // app-lock bypass. Rotation is handled by the activity's configChanges (no recreation), so a
134 // plain remember still avoids re-prompting on rotation while re-locking on real recreation.
135 var unlocked by remember { mutableStateOf(false) }
136 // Wall-clock time of the most recent ON_STOP. Used with [reLockDelaySeconds] so a quick
137 // app-switch (e.g. glancing at another app for a few seconds) doesn't re-prompt — the most
138 // common reason users disable biometric locks. A killed process resets unlocked anyway, so the
139 // grace period only governs the in-memory re-lock decision across a surviving background stint.
140 //
141 // rememberSaveable (not plain remember): a config change NOT in the manifest's configChanges
142 // (e.g. a locale change, which recreates the Activity) would otherwise reset this to 0L, and
143 // the new DisposableEffect observer gets ON_START delivered synchronously — the grace check
144 // sees lastStopTimeMs == 0 and re-locks even though the user unlocked 2s ago and only changed
145 // the system language. The stop timestamp is not security-sensitive (it's a wall-clock value),
146 // so persisting it through the Bundle is safe and preserves the grace period across recreation.
147 val lastStopTimeMs = rememberSaveable { longArrayOf(0L) }
148 val reLockDelayMs = reLockDelaySeconds * 1000L
150 val title = stringResource(R.string.app_lock_prompt_title)
151 val subtitle = stringResource(R.string.app_lock_prompt_subtitle)
153 // Track an in-flight prompt so a recomposition (or the retry button) can't stack two
154 // BiometricPrompts, which throws.
155 var authInFlight by remember { mutableStateOf(false) }
156 // Monotonic id for the current prompt. The system dismisses an in-flight BiometricPrompt when
157 // the app backgrounds and posts its onAuthenticationError asynchronously; without this, that
158 // stale error could land after ON_START already started a NEW prompt and clear authInFlight
159 // mid-prompt — letting a recomposition or the "Unlock" button (enabled = !authInFlight) stack
160 // a second prompt. Each prompt captures its id and only mutates state while it's still current.
161 val promptId = remember { intArrayOf(0) }
163 fun authenticate() {
164 if (authInFlight || unlocked) return
165 authInFlight = true
166 val myPrompt = ++promptId[0]
167 val executor = ContextCompat.getMainExecutor(activity)
168 val callback = object : BiometricPrompt.AuthenticationCallback() {
169 override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
170 if (myPrompt != promptId[0]) return
171 authInFlight = false
172 unlocked = true
173 }
175 override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
176 // User cancelled / lockout / hardware error: stay locked and let them retry
177 // via the button rather than looping the system prompt. Ignore a stale error
178 // from a prompt already superseded by a newer one (see promptId above).
179 if (myPrompt != promptId[0]) return
180 authInFlight = false
181 }
183 override fun onAuthenticationFailed() {
184 // A single non-matching attempt; the system UI lets the user try again.
185 }
186 }
187 val info = BiometricPrompt.PromptInfo.Builder()
188 .setTitle(title)
189 .setSubtitle(subtitle)
190 .setAllowedAuthenticators(lockAuthenticators)
191 .build()
192 runCatching { BiometricPrompt(activity, executor, callback).authenticate(info) }
193 .onFailure { if (myPrompt == promptId[0]) authInFlight = false }
194 }
196 // Re-lock when the app is backgrounded, and re-prompt when it returns to the foreground.
197 // The re-prompt fires on ON_START rather than by keying an effect on `unlocked`: ON_STOP
198 // already cleared `unlocked` while backgrounded, so an effect keyed on it would see no
199 // change on return and never re-fire, stranding the user on the manual "Unlock" button.
200 // addObserver also delivers the current state's ON_START to a freshly-added observer, so
201 // this covers the initial prompt on first show too; the authInFlight/unlocked guards in
202 // authenticate() make the overlapping triggers safe.
203 val lifecycleOwner = LocalLifecycleOwner.current
204 DisposableEffect(lifecycleOwner) {
205 val observer = LifecycleEventObserver { _, event ->
206 when (event) {
207 Lifecycle.Event.ON_STOP -> {
208 // Record the stop time but DON'T clear unlocked yet — the re-lock decision is
209 // made on the next ON_START, so a brief background stint under the grace period
210 // returns the user straight to their session without a re-prompt. authInFlight
211 // is still cleared because the system dismisses an in-flight prompt on background.
212 lastStopTimeMs[0] = System.currentTimeMillis()
213 authInFlight = false
214 }
215 Lifecycle.Event.ON_START -> {
216 // Only re-lock (and re-prompt) if more than the grace period elapsed since the
217 // last ON_STOP, or the app is freshly starting (lastStopTimeMs == 0).
218 val elapsed = System.currentTimeMillis() - lastStopTimeMs[0]
219 if (unlocked && lastStopTimeMs[0] != 0L && elapsed < reLockDelayMs) {
220 // Within the grace period — stay unlocked, no re-prompt.
221 } else {
222 unlocked = false
223 authenticate()
224 }
225 }
226 else -> {}
227 }
228 }
229 lifecycleOwner.lifecycle.addObserver(observer)
230 onDispose { lifecycleOwner.lifecycle.removeObserver(observer) }
231 }
233 // Compose content ONLY while unlocked. Drawing the lock as an overlay *over* a still-composed
234 // content() cannot cover a Dialog / ModalBottomSheet / DropdownMenu / Popup: those render in
235 // separate windows z-ordered above the Activity content, so an open permission dialog or picker
236 // sheet would stay visible and interactive above the lock — an authentication bypass. Not
237 // composing content while locked removes those sub-windows entirely. The SaveableStateHolder
238 // preserves navigation/scroll/input state across the re-lock so unlocking returns the user where
239 // they were, replacing the previous "keep composed underneath" approach.
240 val stateHolder = rememberSaveableStateHolder()
241 if (unlocked) {
242 stateHolder.SaveableStateProvider(APP_LOCK_CONTENT_KEY) { content() }
243 } else {
244 // A Fingerprint glyph hints at the primary unlock method when a biometric is enrolled;
245 // fall back to the generic lock on credential-only setups. Computed once: enrollment
246 // doesn't change while the gate is shown, and re-prompting on each frame is wasteful.
247 val biometricAvailable = remember(context) {
248 BiometricManager.from(context)
249 .canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG) ==
250 BiometricManager.BIOMETRIC_SUCCESS
251 }
252 val unlockLabel = stringResource(R.string.app_unlock)
253 Surface(
254 modifier = Modifier.fillMaxSize(),
255 color = MaterialTheme.colorScheme.background,
256 ) {
257 // The whole surface is tappable to re-trigger the prompt (in addition to the button),
258 // so a user who dismissed the system prompt can retry by tapping anywhere — not just
259 // by finding the Unlock button.
260 Column(
261 modifier = Modifier
262 .fillMaxSize()
263 .clickable(
264 enabled = !authInFlight,
265 role = Role.Button,
266 onClickLabel = unlockLabel,
267 ) { authenticate() }
268 .padding(32.dp),
269 horizontalAlignment = Alignment.CenterHorizontally,
270 verticalArrangement = Arrangement.Center,
271 ) {
272 Icon(
273 if (biometricAvailable) Icons.Filled.Fingerprint else Icons.Filled.Lock,
274 contentDescription = null,
275 modifier = Modifier.size(56.dp),
276 tint = MaterialTheme.colorScheme.primary,
277 )
278 Text(
279 stringResource(R.string.app_locked),
280 style = MaterialTheme.typography.titleMedium,
281 modifier = Modifier
282 .padding(top = 16.dp)
283 .semantics { liveRegion = LiveRegionMode.Polite },
284 )
285 Text(
286 stringResource(R.string.app_locked_hint),
287 style = MaterialTheme.typography.bodyMedium,
288 color = MaterialTheme.colorScheme.onSurfaceVariant,
289 modifier = Modifier.padding(top = 4.dp),
290 )
291 Button(
292 onClick = { authenticate() },
293 enabled = !authInFlight,
294 modifier = Modifier.padding(top = 24.dp),
295 ) {
296 if (authInFlight) {
297 LoadingSpinner(
298 size = LoadingSize.Small,
299 color = MaterialTheme.colorScheme.primary,
300 )
301 Spacer(Modifier.size(8.dp))
302 }
303 Text(unlockLabel)
304 }
305 }
306 }
307 }
310private const val APP_LOCK_CONTENT_KEY = "app_lock_content"