Add support for Face ID/Touch ID to app lock. (#1966)

* Fix biometrics with low grace period and backgrounding before unlocked.

* Trigger permissions alert when enabling Face ID.

ElementX/Sources/Services/AppLock/AppLockService.swift

@@ -21,9 +21,10 @@ import LocalAuthentication
 class AppLockService: AppLockServiceProtocol {
     private let keychainController: KeychainControllerProtocol
     private let appSettings: AppSettings
-    private let context = LAContext()
+    private let context: LAContext
     
     private let timer: AppLockTimer
+    private let unlockPolicy: LAPolicy = .deviceOwnerAuthenticationWithBiometrics
     
     var isMandatory: Bool { appSettings.appLockIsMandatory }
     
@@ -38,21 +39,34 @@ class AppLockService: AppLockServiceProtocol {
         }
     }
     
-    var biometryType: LABiometryType { context.biometryType }
-    var biometricUnlockEnabled = false // Needs to be stored, not sure if in the keychain or defaults yet.
+    var biometryType: LABiometryType {
+        updateBiometrics()
+        guard context.evaluatedPolicyDomainState != nil else { return .none }
+        return context.biometryType
+    }
+    
+    var biometricUnlockEnabled: Bool {
+        keychainController.containsPINCodeBiometricState()
+    }
+    
+    var biometricUnlockTrusted: Bool {
+        guard let state = keychainController.pinCodeBiometricState() else { return false }
+        updateBiometrics()
+        return state == context.evaluatedPolicyDomainState
+    }
     
     var numberOfPINAttempts: AnyPublisher<Int, Never> { appSettings.$appLockNumberOfPINAttempts }
-    var numberOfBiometricAttempts: AnyPublisher<Int, Never> { appSettings.$appLockNumberOfBiometricAttempts }
     
     private var disabledSubject: PassthroughSubject<Void, Never> = .init()
     var disabledPublisher: AnyPublisher<Void, Never> { disabledSubject.eraseToAnyPublisher() }
     
-    init(keychainController: KeychainControllerProtocol, appSettings: AppSettings) {
+    init(keychainController: KeychainControllerProtocol, appSettings: AppSettings, context: LAContext = .init()) {
         self.keychainController = keychainController
         self.appSettings = appSettings
+        self.context = context
         timer = AppLockTimer(gracePeriod: appSettings.appLockGracePeriod)
         
-        configureBiometrics()
+        updateBiometrics()
     }
     
     func setupPINCode(_ pinCode: String) -> Result<Void, AppLockServiceError> {
@@ -74,11 +88,27 @@ class AppLockService: AppLockServiceProtocol {
         return .success(())
     }
     
+    func enableBiometricUnlock() -> Result<Void, AppLockServiceError> {
+        guard isEnabled else { return .failure(.pinNotSet) }
+        guard let state = context.evaluatedPolicyDomainState else { return .failure(.biometricUnlockNotSupported) }
+        
+        do {
+            try keychainController.setPINCodeBiometricState(state)
+            return .success(())
+        } catch {
+            MXLog.error("Keychain access error: \(error)")
+            return .failure(.keychainError)
+        }
+    }
+    
+    func disableBiometricUnlock() {
+        keychainController.removePINCodeBiometricState()
+    }
+    
     func disable() {
-        biometricUnlockEnabled = false
         keychainController.removePINCode()
+        keychainController.removePINCodeBiometricState()
         appSettings.appLockNumberOfPINAttempts = 0
-        appSettings.appLockNumberOfBiometricAttempts = 0
         disabledSubject.send()
     }
     
@@ -96,35 +126,68 @@ class AppLockService: AppLockServiceProtocol {
             appSettings.appLockNumberOfPINAttempts += 1
             return false
         }
+        
+        if biometricUnlockEnabled, !biometricUnlockTrusted {
+            MXLog.info("Fixing trust for biometric unlock.")
+            updateBiometrics()
+            _ = enableBiometricUnlock()
+        }
+        
         return completeUnlock()
     }
     
-    func unlockWithBiometrics() -> Bool {
+    func unlockWithBiometrics() async -> Bool {
         guard biometryType != .none, biometricUnlockEnabled else {
-            MXLog.warning("\(biometryType) failed.")
-            appSettings.appLockNumberOfBiometricAttempts += 1
+            MXLog.error("Biometric unlock not setup.")
+            return false
+        }
+        
+        guard biometricUnlockTrusted else {
+            MXLog.error("Biometrics have changed. PIN should be shown.")
+            return false
+        }
+        
+        do {
+            let context = unlockContext()
+            guard try await context.evaluatePolicy(unlockPolicy, localizedReason: L10n.screenAppLockBiometricUnlockReasonIos) else {
+                MXLog.warning("\(context.biometryType) failed without error.")
+                return false
+            }
+            return completeUnlock()
+        } catch {
+            MXLog.error("\(context.biometryType) failed: \(error)")
             return false
         }
-        return completeUnlock()
     }
     
     // MARK: - Private
     
-    /// Queries the context for supported biometrics.
-    private func configureBiometrics() {
+    /// Queries the context for supported biometrics and enrolment state.
+    private func updateBiometrics() {
         var error: NSError?
-        context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error)
+        context.canEvaluatePolicy(unlockPolicy, error: &error)
         
         if let error {
             MXLog.error("Biometrics error: \(error)")
         }
     }
     
-    /// Shared logic for completing an unlock via a PIN or biometry.
+    /// Creates a context specifically for unlocking the app. The titles are customised,
+    /// and the fresh context ensures that the user is promoted to unlock based on
+    /// `timer.gracePeriod` rather than any system to defined grace period.
+    private func unlockContext() -> LAContext {
+        // Keep using the injected context for tests etc.
+        guard type(of: context) == LAContext.self else { return context }
+        
+        let context = LAContext()
+        context.localizedFallbackTitle = L10n.actionEnterPin
+        return context
+    }
+    
+    /// Shared logic for completing an unlock via a PIN or biometrics.
     private func completeUnlock() -> Bool {
         timer.registerUnlock()
         appSettings.appLockNumberOfPINAttempts = 0
-        appSettings.appLockNumberOfBiometricAttempts = 0
         return true
     }
 }