fix: require auth for pubky approval

Author: ben-kaufman

app/src/main/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalSheet.kt

@@ -32,6 +32,8 @@ import kotlinx.collections.immutable.persistentListOf
 import to.bitkit.R
 import to.bitkit.models.PubkyAuthPermission
 import to.bitkit.models.PubkyProfile
+import to.bitkit.ui.appViewModel
+import to.bitkit.ui.components.AuthCheckView
 import to.bitkit.ui.components.BiometricsView
 import to.bitkit.ui.components.BodyM
 import to.bitkit.ui.components.BodySSB
@@ -61,8 +63,10 @@ fun PubkyAuthApprovalSheet(
 ) {
     val uiState by viewModel.uiState.collectAsStateWithLifecycle()
     var showBiometrics by remember { mutableStateOf(false) }
+    var showAuthCheck by remember { mutableStateOf(false) }
     var pendingAuthUrl by remember { mutableStateOf<String?>(null) }
 
+    val app = appViewModel ?: return
     val settings = settingsViewModel ?: return
     val isPinEnabled by settings.isPinEnabled.collectAsStateWithLifecycle()
     val isBiometricEnabled by settings.isBiometricEnabled.collectAsStateWithLifecycle()
@@ -73,12 +77,29 @@ fun PubkyAuthApprovalSheet(
     LaunchedEffect(Unit) {
         viewModel.effects.collect {
             when (it) {
-                is PubkyAuthApprovalEffect.RequestBiometric -> {
-                    if (isPinEnabled && isBiometricEnabled && isBiometrySupported) {
-                        pendingAuthUrl = it.authUrl
-                        showBiometrics = true
-                    } else {
-                        viewModel.confirmAuthorize(it.authUrl)
+                is PubkyAuthApprovalEffect.RequestLocalAuth -> {
+                    pendingAuthUrl = it.authUrl
+                    when (
+                        resolvePubkyApprovalLocalAuthMode(
+                            isPinEnabled = isPinEnabled,
+                            isBiometricEnabled = isBiometricEnabled,
+                            isBiometrySupported = isBiometrySupported,
+                        )
+                    ) {
+                        PubkyApprovalLocalAuthMode.AuthCheck -> {
+                            showBiometrics = false
+                            showAuthCheck = true
+                        }
+
+                        PubkyApprovalLocalAuthMode.Biometrics -> {
+                            showAuthCheck = false
+                            showBiometrics = true
+                        }
+
+                        PubkyApprovalLocalAuthMode.None -> {
+                            pendingAuthUrl = null
+                            viewModel.confirmAuthorize(it.authUrl)
+                        }
                     }
                 }
                 PubkyAuthApprovalEffect.Dismiss -> onDismiss()
@@ -94,6 +115,22 @@ fun PubkyAuthApprovalSheet(
             onDismiss = { viewModel.dismiss() },
         )
 
+        if (showAuthCheck) {
+            AuthCheckView(
+                appViewModel = app,
+                settingsViewModel = settings,
+                onSuccess = {
+                    showAuthCheck = false
+                    pendingAuthUrl?.let { viewModel.confirmAuthorize(it) }
+                    pendingAuthUrl = null
+                },
+                onBack = {
+                    showAuthCheck = false
+                    pendingAuthUrl = null
+                },
+            )
+        }
+
         if (showBiometrics) {
             BiometricsView(
                 onSuccess = {
@@ -110,6 +147,22 @@ fun PubkyAuthApprovalSheet(
     }
 }
 
+internal enum class PubkyApprovalLocalAuthMode {
+    None,
+    Biometrics,
+    AuthCheck,
+}
+
+internal fun resolvePubkyApprovalLocalAuthMode(
+    isPinEnabled: Boolean,
+    isBiometricEnabled: Boolean,
+    isBiometrySupported: Boolean,
+): PubkyApprovalLocalAuthMode = when {
+    isPinEnabled -> PubkyApprovalLocalAuthMode.AuthCheck
+    isBiometricEnabled && isBiometrySupported -> PubkyApprovalLocalAuthMode.Biometrics
+    else -> PubkyApprovalLocalAuthMode.None
+}
+
 @Composable
 private fun Content(
     uiState: PubkyAuthApprovalUiState,

app/src/main/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalViewModel.kt

@@ -63,7 +63,7 @@ class PubkyAuthApprovalViewModel @Inject constructor(
 
     fun requestAuthorize(authUrl: String) {
         viewModelScope.launch {
-            _effects.emit(PubkyAuthApprovalEffect.RequestBiometric(authUrl))
+            _effects.emit(PubkyAuthApprovalEffect.RequestLocalAuth(authUrl))
         }
     }
 
@@ -112,6 +112,6 @@ sealed interface ApprovalState {
 }
 
 sealed interface PubkyAuthApprovalEffect {
-    data class RequestBiometric(val authUrl: String) : PubkyAuthApprovalEffect
+    data class RequestLocalAuth(val authUrl: String) : PubkyAuthApprovalEffect
     data object Dismiss : PubkyAuthApprovalEffect
 }

app/src/test/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalSheetTest.kt

@@ -0,0 +1,51 @@
+package to.bitkit.ui.screens.profile
+
+import kotlin.test.Test
+import kotlin.test.assertEquals
+
+class PubkyAuthApprovalSheetTest {
+
+    @Test
+    fun `resolve auth mode uses auth check when pin is enabled`() {
+        val result = resolvePubkyApprovalLocalAuthMode(
+            isPinEnabled = true,
+            isBiometricEnabled = true,
+            isBiometrySupported = true,
+        )
+
+        assertEquals(PubkyApprovalLocalAuthMode.AuthCheck, result)
+    }
+
+    @Test
+    fun `resolve auth mode uses biometrics when only biometrics are available`() {
+        val result = resolvePubkyApprovalLocalAuthMode(
+            isPinEnabled = false,
+            isBiometricEnabled = true,
+            isBiometrySupported = true,
+        )
+
+        assertEquals(PubkyApprovalLocalAuthMode.Biometrics, result)
+    }
+
+    @Test
+    fun `resolve auth mode returns none when no local auth is available`() {
+        val result = resolvePubkyApprovalLocalAuthMode(
+            isPinEnabled = false,
+            isBiometricEnabled = false,
+            isBiometrySupported = false,
+        )
+
+        assertEquals(PubkyApprovalLocalAuthMode.None, result)
+    }
+
+    @Test
+    fun `resolve auth mode returns none when biometrics are unsupported and pin is disabled`() {
+        val result = resolvePubkyApprovalLocalAuthMode(
+            isPinEnabled = false,
+            isBiometricEnabled = true,
+            isBiometrySupported = false,
+        )
+
+        assertEquals(PubkyApprovalLocalAuthMode.None, result)
+    }
+}