feat: Authentication bypass via biometric enrollment change

app/containers/Passcode/PasscodeEnter.test.tsx

@@ -0,0 +1,114 @@
+import React from 'react';
+import { fireEvent, render, waitFor } from '@testing-library/react-native';
+
+import PasscodeEnter from './PasscodeEnter';
+import { biometryAuth } from '../../lib/methods/helpers/localAuthentication';
+import { biometricTrustStore } from '../../lib/biometricTrustStore';
+import UserPreferences from '../../lib/methods/userPreferences';
+import { BIOMETRY_ENABLED_KEY } from '../../lib/constants/localAuthentication';
+
+jest.mock('../../lib/methods/helpers/localAuthentication', () => ({
+	biometryAuth: jest.fn(),
+	resetAttempts: jest.fn(() => Promise.resolve())
+}));
+
+jest.mock('../../lib/biometricTrustStore', () => ({
+	biometricTrustStore: {
+		enrol: jest.fn(),
+		disenrol: jest.fn(() => Promise.resolve()),
+		verify: jest.fn(),
+		probeExists: jest.fn()
+	}
+}));
+
+jest.mock('../../lib/methods/userPreferences', () => ({
+	__esModule: true,
+	default: {
+		getBool: jest.fn(),
+		setBool: jest.fn(),
+		getString: jest.fn(),
+		setString: jest.fn()
+	},
+	useUserPreferences: () => [null, jest.fn()]
+}));
+
+jest.mock('../../i18n', () => ({ t: (key: string) => key }));
+
+const mockedBiometryAuth = biometryAuth as jest.Mock;
+const mockedDisenrol = biometricTrustStore.disenrol as jest.Mock;
+const mockedSetBool = UserPreferences.setBool as jest.Mock;
+
+describe('PasscodeEnter biometry button', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+		mockedDisenrol.mockResolvedValue(undefined);
+	});
+
+	it('enrollmentChanged from button press → disenrols, clears flag, hides biometry button', async () => {
+		mockedBiometryAuth.mockResolvedValueOnce({ kind: 'enrollmentChanged' });
+		const finishProcess = jest.fn();
+
+		const { getByTestId, queryByTestId } = render(<PasscodeEnter hasBiometry skipAutoBiometry finishProcess={finishProcess} />);
+
+		await waitFor(() => expect(getByTestId('biometry-button')).toBeTruthy());
+
+		fireEvent.press(getByTestId('biometry-button'));
+
+		await waitFor(() => expect(mockedDisenrol).toHaveBeenCalledTimes(1));
+		expect(mockedSetBool).toHaveBeenCalledWith(BIOMETRY_ENABLED_KEY, false);
+		expect(finishProcess).not.toHaveBeenCalled();
+		await waitFor(() => expect(queryByTestId('biometry-button')).toBeNull());
+	});
+
+	it('success from button press → finishes process, no invalidation', async () => {
+		mockedBiometryAuth.mockResolvedValueOnce({ kind: 'success' });
+		const finishProcess = jest.fn();
+
+		const { getByTestId } = render(<PasscodeEnter hasBiometry skipAutoBiometry finishProcess={finishProcess} />);
+
+		await waitFor(() => expect(getByTestId('biometry-button')).toBeTruthy());
+
+		fireEvent.press(getByTestId('biometry-button'));
+
+		await waitFor(() => expect(finishProcess).toHaveBeenCalledTimes(1));
+		expect(mockedDisenrol).not.toHaveBeenCalled();
+		expect(mockedSetBool).not.toHaveBeenCalled();
+	});
+
+	it('canceled from button press → flag untouched, biometry button stays', async () => {
+		mockedBiometryAuth.mockResolvedValueOnce({ kind: 'canceled' });
+		const finishProcess = jest.fn();
+
+		const { getByTestId } = render(<PasscodeEnter hasBiometry skipAutoBiometry finishProcess={finishProcess} />);
+
+		await waitFor(() => expect(getByTestId('biometry-button')).toBeTruthy());
+
+		fireEvent.press(getByTestId('biometry-button'));
+
+		await waitFor(() => expect(mockedBiometryAuth).toHaveBeenCalled());
+		expect(mockedDisenrol).not.toHaveBeenCalled();
+		expect(mockedSetBool).not.toHaveBeenCalled();
+		expect(finishProcess).not.toHaveBeenCalled();
+		expect(getByTestId('biometry-button')).toBeTruthy();
+	});
+});
+
+describe('PasscodeEnter enrollmentChanged subtitle', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('renders explanatory subtitle when reason === "enrollmentChanged"', () => {
+		const { getByText } = render(
+			<PasscodeEnter hasBiometry={false} skipAutoBiometry reason='enrollmentChanged' finishProcess={jest.fn()} />
+		);
+
+		expect(getByText('Local_authentication_biometric_enrollment_changed')).toBeTruthy();
+	});
+
+	it('does not render subtitle when reason is undefined', () => {
+		const { queryByText } = render(<PasscodeEnter hasBiometry={false} skipAutoBiometry finishProcess={jest.fn()} />);
+
+		expect(queryByText('Local_authentication_biometric_enrollment_changed')).toBeNull();
+	});
+});

app/containers/Passcode/PasscodeEnter.tsx

@@ -9,30 +9,50 @@ import Locked from './Base/Locked';
 import { TYPE } from './constants';
 import { ATTEMPTS_KEY, LOCKED_OUT_TIMER_KEY, MAX_ATTEMPTS, PASSCODE_KEY } from '../../lib/constants/localAuthentication';
 import { biometryAuth, resetAttempts } from '../../lib/methods/helpers/localAuthentication';
+import { handleBiometricTrustResult, type BiometricInvalidationReason } from '../../lib/biometricTrustStore/handleResult';
 import { getDiff, getLockedUntil } from './utils';
 import { useUserPreferences } from '../../lib/methods/userPreferences';
 import I18n from '../../i18n';
 
 interface IPasscodePasscodeEnter {
 	hasBiometry: boolean;
+	skipAutoBiometry?: boolean;
+	reason?: BiometricInvalidationReason;
 	finishProcess: Function;
 }
 
-const PasscodeEnter = ({ hasBiometry, finishProcess }: IPasscodePasscodeEnter) => {
+const PasscodeEnter = ({
+	hasBiometry: initialHasBiometry,
+	skipAutoBiometry = false,
+	reason: initialReason,
+	finishProcess
+}: IPasscodePasscodeEnter) => {
 	const ref = useRef<IBase>(null);
 	let attempts = 0;
 	let lockedUntil: any = false;
 	const [passcode] = useUserPreferences(PASSCODE_KEY);
 	const [status, setStatus] = useState<TYPE | null>(null);
+	// Mirror hasBiometry/reason locally so an enrolment-change invalidation triggered from the
+	// biometry button immediately hides the button within the same modal session, without
+	// re-emitting LOCAL_AUTHENTICATE_EMITTER (which would orphan the upstream openModal promise).
+	const [hasBiometry, setHasBiometry] = useState<boolean>(initialHasBiometry);
+	const [reason, setReason] = useState<BiometricInvalidationReason | undefined>(initialReason);
 	const { setItem: setAttempts } = useAsyncStorage(ATTEMPTS_KEY);
 	const { setItem: setLockedUntil } = useAsyncStorage(LOCKED_OUT_TIMER_KEY);
 
 	const biometry = async () => {
-		if (hasBiometry && status === TYPE.ENTER) {
-			const result = await biometryAuth();
-			if (result?.success) {
-				finishProcess();
-			}
+		if (!hasBiometry || status !== TYPE.ENTER) {
+			return;
+		}
+		const result = await biometryAuth();
+		const { unlocked, modal } = await handleBiometricTrustResult(result);
+		if (unlocked) {
+			finishProcess();
+			return;
+		}
+		if (modal) {
+			setHasBiometry(modal.hasBiometry);
+			setReason(modal.reason);
 		}
 	};
 
@@ -49,7 +69,9 @@ const PasscodeEnter = ({ hasBiometry, finishProcess }: IPasscodePasscodeEnter) =
 		} else {
 			setStatus(TYPE.ENTER);
 		}
-		biometry();
+		if (!skipAutoBiometry) {
+			biometry();
+		}
 	};
 
 	useEffect(() => {
@@ -79,11 +101,14 @@ const PasscodeEnter = ({ hasBiometry, finishProcess }: IPasscodePasscodeEnter) =
 		return <Locked setStatus={setStatus} />;
 	}
 
+	const subtitle = reason === 'enrollmentChanged' ? I18n.t('Local_authentication_biometric_enrollment_changed') : null;
+
 	return (
 		<Base
 			ref={ref}
 			type={TYPE.ENTER}
 			title={I18n.t('Passcode_enter_title')}
+			subtitle={subtitle}
 			showBiometry={hasBiometry}
 			onEndProcess={onEndProcess}
 			onBiometryPress={biometry}

app/i18n/locales/ar.json

@@ -324,6 +324,7 @@
   "Local_authentication_auto_lock_3600": "بعد ساعة",
   "Local_authentication_auto_lock_60": "بعد دقيقة",
   "Local_authentication_auto_lock_900": "بعد 15 دقيقة",
+  "Local_authentication_biometric_enrollment_changed": "تم تغيير تسجيل المقاييس الحيوية، يرجى استخدام كلمة المرور",
   "Local_authentication_biometry_fallback": "استخدم كلمة المرور",
   "Local_authentication_biometry_title": "صادق",
   "Local_authentication_change_passcode": "تغيير كلمة المرور",

app/i18n/locales/bn-IN.json

@@ -451,6 +451,7 @@
   "Local_authentication_auto_lock_3600": "1 ঘণ্টা পরে",
   "Local_authentication_auto_lock_60": "1 মিনিট পরে",
   "Local_authentication_auto_lock_900": "15 মিনিট পরে",
+  "Local_authentication_biometric_enrollment_changed": "বায়োমেট্রিক নিবন্ধন পরিবর্তিত হয়েছে, অনুগ্রহ করে আপনার পাসকোড ব্যবহার করুন",
   "Local_authentication_biometry_fallback": "পাসকোড ব্যবহার করুন",
   "Local_authentication_biometry_title": "প্রমাণীকরণ",
   "Local_authentication_change_passcode": "পাসকোড পরিবর্তন করুন",

app/i18n/locales/cs.json

@@ -483,6 +483,7 @@
   "Local_authentication_auto_lock_3600": "Po 1 hodině",
   "Local_authentication_auto_lock_60": "Po 1 minutě",
   "Local_authentication_auto_lock_900": "Po 15 minutách",
+  "Local_authentication_biometric_enrollment_changed": "Biometrické údaje se změnily, použijte prosím přístupový kód",
   "Local_authentication_biometry_fallback": "Použít přístupový kód",
   "Local_authentication_biometry_title": "Ověřit",
   "Local_authentication_change_passcode": "Změnit heslo",

app/i18n/locales/de.json

@@ -445,6 +445,7 @@
   "Local_authentication_auto_lock_3600": "Nach 1 Stunde",
   "Local_authentication_auto_lock_60": "Nach 1 Minute",
   "Local_authentication_auto_lock_900": "Nach 15 Minuten",
+  "Local_authentication_biometric_enrollment_changed": "Die biometrischen Daten wurden geändert, bitte verwenden Sie Ihren Sicherheitscode",
   "Local_authentication_biometry_fallback": "Sicherheitscode benutzen",
   "Local_authentication_biometry_title": "Authentifizieren",
   "Local_authentication_change_passcode": "Ändere Sicherheitscode",

app/i18n/locales/en.json

@@ -498,6 +498,7 @@
   "Local_authentication_auto_lock_3600": "After 1 hour",
   "Local_authentication_auto_lock_60": "After 1 minute",
   "Local_authentication_auto_lock_900": "After 15 minutes",
+  "Local_authentication_biometric_enrollment_changed": "Biometric enrollment changed, please use your passcode",
   "Local_authentication_biometry_fallback": "Use passcode",
   "Local_authentication_biometry_title": "Authenticate",
   "Local_authentication_change_passcode": "Change passcode",

app/i18n/locales/fi.json

@@ -426,6 +426,7 @@
   "Local_authentication_auto_lock_3600": "1 tunnin kuluttua",
   "Local_authentication_auto_lock_60": "1 minuutin kuluttua",
   "Local_authentication_auto_lock_900": "15 minuutin kuluttua",
+  "Local_authentication_biometric_enrollment_changed": "Biometriset tiedot ovat muuttuneet, käytä salasanaasi",
   "Local_authentication_biometry_fallback": "Käytä salasanaa",
   "Local_authentication_biometry_title": "Todenna",
   "Local_authentication_change_passcode": "Vaihda salasana",

app/i18n/locales/fr.json

@@ -391,6 +391,7 @@
   "Local_authentication_auto_lock_3600": "Après 1 heure",
   "Local_authentication_auto_lock_60": "Après 1 minute",
   "Local_authentication_auto_lock_900": "Après 15 minutes",
+  "Local_authentication_biometric_enrollment_changed": "Les données biométriques ont changé, veuillez utiliser votre code d'accès",
   "Local_authentication_biometry_fallback": "Utiliser le code d'accès",
   "Local_authentication_biometry_title": "Authentifier",
   "Local_authentication_change_passcode": "Changer le code d'accès",

app/i18n/locales/hi-IN.json

@@ -451,6 +451,7 @@
   "Local_authentication_auto_lock_3600": "1 घंटा के बाद",
   "Local_authentication_auto_lock_60": "1 मिनट के बाद",
   "Local_authentication_auto_lock_900": "15 मिनट के बाद",
+  "Local_authentication_biometric_enrollment_changed": "बायोमेट्रिक पंजीकरण बदल गया है, कृपया अपना पासकोड उपयोग करें",
   "Local_authentication_biometry_fallback": "पासकोड का उपयोग करें",
   "Local_authentication_biometry_title": "प्रमाणीकरण करें",
   "Local_authentication_change_passcode": "पासकोड बदलें",

app/i18n/locales/hu.json

@@ -452,6 +452,7 @@
   "Local_authentication_auto_lock_3600": "1 óra elteltével",
   "Local_authentication_auto_lock_60": "1 perc elteltével",
   "Local_authentication_auto_lock_900": "15 perc elteltével",
+  "Local_authentication_biometric_enrollment_changed": "A biometrikus adatok megváltoztak, használja a jelkódját",
   "Local_authentication_biometry_fallback": "Jelkód használata",
   "Local_authentication_biometry_title": "Hitelesítés",
   "Local_authentication_change_passcode": "Jelkód módosítása",

app/i18n/locales/it.json

@@ -353,6 +353,7 @@
   "Local_authentication_auto_lock_3600": "Dopo 1 ora",
   "Local_authentication_auto_lock_60": "Dopo 1 minuto",
   "Local_authentication_auto_lock_900": "Dopo 15 minuti",
+  "Local_authentication_biometric_enrollment_changed": "I dati biometrici sono cambiati, usa il Passcode",
   "Local_authentication_biometry_fallback": "Usa passcode",
   "Local_authentication_biometry_title": "Autenticazione",
   "Local_authentication_change_passcode": "Cambia Passcode",

app/i18n/locales/nl.json

@@ -391,6 +391,7 @@
   "Local_authentication_auto_lock_3600": "Na 1 uur",
   "Local_authentication_auto_lock_60": "Na 1 minuut",
   "Local_authentication_auto_lock_900": "Na 15 minuten",
+  "Local_authentication_biometric_enrollment_changed": "Biometrische gegevens zijn gewijzigd, gebruik je toegangscode",
   "Local_authentication_biometry_fallback": "Gebruik toegangscode",
   "Local_authentication_biometry_title": "Authenticeren",
   "Local_authentication_change_passcode": "Wijzig toegangscode",

app/i18n/locales/no.json

@@ -477,6 +477,7 @@
   "Local_authentication_auto_lock_3600": "Etter 1 time",
   "Local_authentication_auto_lock_60": "Etter 1 minutt",
   "Local_authentication_auto_lock_900": "Etter 15 minutter",
+  "Local_authentication_biometric_enrollment_changed": "Biometrisk registrering er endret, bruk passordet ditt",
   "Local_authentication_biometry_fallback": "Bruk passord",
   "Local_authentication_biometry_title": "Autentiser",
   "Local_authentication_change_passcode": "Endre passord",

app/i18n/locales/pt-BR.json

@@ -493,6 +493,7 @@
   "Local_authentication_auto_lock_3600": "Após 1 hora",
   "Local_authentication_auto_lock_60": "Após 1 minuto",
   "Local_authentication_auto_lock_900": "Após 15 minutos",
+  "Local_authentication_biometric_enrollment_changed": "O cadastro biométrico foi alterado, use sua senha",
   "Local_authentication_biometry_fallback": "Usar senha",
   "Local_authentication_biometry_title": "Autenticar",
   "Local_authentication_change_passcode": "Alterar senha",

app/i18n/locales/ru.json

@@ -416,6 +416,7 @@
   "Local_authentication_auto_lock_3600": "Через 1 час",
   "Local_authentication_auto_lock_60": "Через 1 минуту",
   "Local_authentication_auto_lock_900": "Через 15 минут",
+  "Local_authentication_biometric_enrollment_changed": "Биометрические данные изменились, пожалуйста, используйте ваш Пароль",
   "Local_authentication_biometry_fallback": "Использовать пароль",
   "Local_authentication_biometry_title": "Аутентификация",
   "Local_authentication_change_passcode": "Изменить Пароль",

app/i18n/locales/sl-SI.json

@@ -401,6 +401,7 @@
   "Local_authentication_auto_lock_3600": "Po 1 uri",
   "Local_authentication_auto_lock_60": "Po 1 minuti",
   "Local_authentication_auto_lock_900": "Po 15 minutah",
+  "Local_authentication_biometric_enrollment_changed": "Biometrični podatki so se spremenili, uporabite svoje geslo",
   "Local_authentication_biometry_fallback": "Uporabite geslo",
   "Local_authentication_biometry_title": "Overiti",
   "Local_authentication_change_passcode": "Spremenite geslo",

app/i18n/locales/sv.json

@@ -425,6 +425,7 @@
   "Local_authentication_auto_lock_3600": "Efter 1 timme",
   "Local_authentication_auto_lock_60": "Efter 1 minut",
   "Local_authentication_auto_lock_900": "Efter 15 minuter",
+  "Local_authentication_biometric_enrollment_changed": "Biometriska uppgifter har ändrats, använd din lösenkod",
   "Local_authentication_biometry_fallback": "Använd lösenkod",
   "Local_authentication_biometry_title": "Autentisering",
   "Local_authentication_change_passcode": "Ändra lösenkod",

app/i18n/locales/ta-IN.json

@@ -451,6 +451,7 @@
   "Local_authentication_auto_lock_3600": "1 மணி நேரத்திற்கு பிற",
   "Local_authentication_auto_lock_60": "1 நிமிடத்திற்கு பிற",
   "Local_authentication_auto_lock_900": "15 நிமிடத்திற்கு பிற",
+  "Local_authentication_biometric_enrollment_changed": "உயிர்முறை பதிவில் மாற்றம் ஏற்பட்டுள்ளது, தயவுசெய்து உங்கள் கடவுச்சொல்லைப் பயன்படுத்தவும்",
   "Local_authentication_biometry_fallback": "கடவுச்சொல் பயன்படுத்துக",
   "Local_authentication_biometry_title": "அங்கீகரிக்க",
   "Local_authentication_change_passcode": "கடவுச்சொல் மாற்று",

app/i18n/locales/te-IN.json

@@ -450,6 +450,7 @@
   "Local_authentication_auto_lock_3600": "1 గంట తరువాత",
   "Local_authentication_auto_lock_60": "1 నిమిషాల తరువాత",
   "Local_authentication_auto_lock_900": "15 నిమిషాల తరువాత",
+  "Local_authentication_biometric_enrollment_changed": "బయోమెట్రిక్ నమోదు మారింది, దయచేసి మీ పాస్‌కోడ్‌ను ఉపయోగించండి",
   "Local_authentication_biometry_fallback": "పాస్‌కోడ్ ఉపయోగించండి",
   "Local_authentication_biometry_title": "ధ్యానం పెట్టినవారు",
   "Local_authentication_change_passcode": "పాస్‌కోడ్ను మార్చండి",

app/i18n/locales/tr.json

@@ -338,6 +338,7 @@
   "Local_authentication_auto_lock_3600": "1 saat sonra",
   "Local_authentication_auto_lock_60": "1 dakika sonra",
   "Local_authentication_auto_lock_900": "15 dakika sonra",
+  "Local_authentication_biometric_enrollment_changed": "Biyometrik kayıt değişti, lütfen parolanızı kullanın",
   "Local_authentication_biometry_fallback": "Parola kullan",
   "Local_authentication_biometry_title": "Doğrula",
   "Local_authentication_change_passcode": "Parolayı Değiştir",

app/i18n/locales/zh-CN.json

@@ -323,6 +323,7 @@
   "Local_authentication_auto_lock_3600": "一小时后",
   "Local_authentication_auto_lock_60": "1分钟后",
   "Local_authentication_auto_lock_900": "15分钟后",
+  "Local_authentication_biometric_enrollment_changed": "生物识别设置已更改，请使用您的通关密码",
   "Local_authentication_biometry_fallback": "使用通关密码",
   "Local_authentication_biometry_title": "验证",
   "Local_authentication_change_passcode": "变更通关密码",

app/i18n/locales/zh-TW.json

@@ -339,6 +339,7 @@
   "Local_authentication_auto_lock_3600": "一小時後",
   "Local_authentication_auto_lock_60": "1分鐘後",
   "Local_authentication_auto_lock_900": "15分鐘後",
+  "Local_authentication_biometric_enrollment_changed": "生物辨識設定已變更，請使用您的通關密碼",
   "Local_authentication_biometry_fallback": "使用通關密碼",
   "Local_authentication_biometry_title": "驗證",
   "Local_authentication_change_passcode": "變更通關密碼",