Disable 'Enable biometrics' option if there are not biometric authenticators enrolled.

[jmartinesp]

Type of change

• Feature
• Bugfix
• Technical
• Other :

Content

Fixes #6713 .

Motivation and context

Enabling biometric auth in the app is not restricted to users who have biometric authenticators enrolled in the device. This caused UserNotAuthenticatedException crashes for users who enabled this option without having those authenticators.

Screenshots / GIFs

Tests

• Make sure you have no biometric authenticators enrolled in your device (no fingerprint, no face unlock, etc.).
• Open the app, go to Settings > Security & Privacy > Protect Access.
• Enable PIN code.
• Check 'Enable biometrics' can't be toggled because it's disabled.
• Now add a fingerprint to your device.
• Go back to the app, in 'Protect Access'.
• Check that 'Enable biometrics' can be accessed now.

Note: I had some issues while testing this on emulators, it seems like an emulator bug. Having several fingerprints enrolled and enabling biometrics in the app caused the same UserNotAuthenticatedException crash mentioned above. Apparently, BiometricManager detects the valid authenticators but BiometricPrompt doesn't.

Tested devices

• Physical
• Emulator
• OS version(s): 12

Checklist

• Changes has been tested on an Android device or Android emulator with API 21
• UI change has been tested on both light and dark themes
• Accessibility has been taken into account. See https://github.com/vector-im/element-android/blob/develop/CONTRIBUTING.md#accessibility
• Pull request is based on the develop branch
• Pull request includes a new file under ./changelog.d. See https://github.com/vector-im/element-android/blob/develop/CONTRIBUTING.md#changelog
• Pull request includes screenshots or videos if containing UI changes
• Pull request includes a sign off
• You've made a self review of your PR
• If you have modified the screen flow, or added new screens to the application, you have updated the test UiAllScreensSanityTest.allScreensTest()

[ouchadam]

out of interest, what happens in this onBiometricKeyInvalidated flow?

[jmartinesp]

There are 2 points where the state. isBiometricKeyInvalidated can change and trigger this code:

1. LockScreenViewModel.showBiometricPrompt, this will call BiometricHelper.authenticate that will fail before showing any UI if the system key is not valid and instead it:

• Catches any exceptions.
• Posts a LockScreenViewEvent.AuthError to handle it in the UI.
• If the error was an instance of KeyPermanentlyInvalidatedException, it will call removeBiometricAuthentication() which will disable the 'biometric enabled' option, delete the broken system key and update the current state to display an alert saying that the key has just been invalidated.

2. LockScreenViewModel.updateStateWithBiometricInfo is automatically called when the LockScreenConfiguration changes:

• It calls biometricHelper.isSystemKeyValid.
• This will reach KeyStoreCrypto.hasValidKey(), which tries to retrieve the current system key and either return true or catch both KeyPermanentlyInvalidatedException and UserNotAuthenticatedException, which are thrown when the internal Cipher.init fails, and return false.
• state.isBiometricKeyInvalidated will be updated with this returned value and used to display the same alert as in the case above.

[ouchadam]

thanks for explaining 👍

[ouchadam]

thanks for adding the test case 💯

[ouchadam]

do you think it's worth extracting the useBiometricPref.isEnabled and useBiometricPref.isChecked setting to a reusable function?

[ouchadam]

LGTM 👍 minor extraction comment, will leave up to you!

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

57.1% Coverage
0.0% Duplication