Ensure that the current user is the device owner before linking a new device. (#5773)

ElementX/Sources/Services/AppLock/AppLockServiceProtocol.swift

@@ -34,6 +34,22 @@ enum AppLockServiceBiometricResult {
     case interrupted
 }
 
+/// The result of an attempt to verify that the user is the device owner.
+enum AppLockDeviceOwnerResult {
+    /// The device owner was successfully verified.
+    case verified
+    /// The verification completed without verifying the user.
+    case unverified
+    /// Verification isn't available because a device passcode isn't set.
+    case unavailable
+    /// Verification isn't available, but an App Lock PIN is set and can be used instead.
+    case appLockPINRequired
+    /// The verification attempt was cancelled.
+    case cancelled
+    /// The verification couldn't be completed due to an error.
+    case error
+}
+
 protocol AppLockServiceProtocol: AnyObject {
     /// The use of a PIN code is mandatory for this device.
     var isMandatory: Bool { get }
@@ -72,6 +88,13 @@ protocol AppLockServiceProtocol: AnyObject {
     /// Attempt to unlock the app using FaceID or TouchID.
     func unlockWithBiometrics() async -> AppLockServiceBiometricResult
     
+    /// Verifies the device owner via the device passcode/biometrics, e.g. to gate a sensitive action.
+    ///
+    /// This is a standalone identity check: it does **not** unlock the app or touch any App Lock
+    /// state (the grace-period timer or PIN attempt count).
+    /// - Parameter reason: The localised reason shown in the system prompt.
+    func verifyDeviceOwner(reason: String) async -> AppLockDeviceOwnerResult
+    
     /// The number of attempts the user had made to unlock with a PIN code.
     ///
     /// Note: We don't track the biometric attempts as LAContext does that automatically.