[local_auth] Remove FingerprintManager uses and fix deprecations #6059

camsim99 · 2022-06-29T23:05:10Z

Fixes

Issue #106298
Partially Issue #78137 by removing Android deprecations (not Flutter deprecations)
Issue #105005 by explicitly setting device credentials as an allowed authenticator if applicable

Also expands test suite for LocalAuthPlugin.java.

Pre-launch Checklist

camsim99 · 2022-07-06T22:56:17Z

...al_auth_android/android/src/main/java/io/flutter/plugins/localauth/AuthenticationHelper.java

@@ -90,9 +92,27 @@ interface AuthCompletionHandler {
            .setConfirmationRequired((Boolean) call.argument("sensitiveTransaction"))
            .setConfirmationRequired((Boolean) call.argument("sensitiveTransaction"));

-    if (allowCredentials) {
-      promptBuilder.setDeviceCredentialAllowed(true);


This method was deprecated in favor of setAllowedAuthenticators (documentation, so all authentication methods need to be known here versus just a boolean indicating whether or not to allow device credentials. See changes below.

camsim99 · 2022-07-06T22:58:25Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

-        authHelper.authenticate();
+    // Handle case where only device credential is available
+    if (!isBiometricOnly && canAuthenticateWithDeviceCredential()) {
+      if (Build.VERSION.SDK_INT >= 30) {


For API 30+, an authentication request can be made by specifying device credentials alone as an allowed authenticator. See documentation.

The docs for https://developer.android.com/reference/androidx/biometric/BiometricPrompt.PromptInfo.Builder#setDeviceCredentialAllowed(boolean) make it sound like all the fallback code we have here is already part of androidx.biometrics already. Can we eliminate all of this code and always just make a single sendAuthenticationRequest call?

I think you may be right. I definitely misunderstood the API and overcomplicated this :/ I'll make the changes and request your review again!

camsim99 · 2022-07-06T23:01:45Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

+                BiometricManager.Authenticators.BIOMETRIC_WEAK
+                    | BiometricManager.Authenticators.DEVICE_CREDENTIAL);
+
+    switch (errorCode) {


I added more error handling below based on the error messages of the new API. I changed some of the error messages, so let me know if those are magic strings and need to be changed back or added elsewhere.

I don't think we should consider the message itself to be API-stable, just the code. (Theoretically someone could be relying on it of course, but they shouldn't be.)

camsim99 · 2022-07-06T23:02:51Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

      return;
    }

-    // API 23 - 28 with fingerprint
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M && fingerprintManager != null) {


The functionality this added is covered by BiometricPrompt now. See documentation.

stuartmorgan-g · 2022-07-08T17:02:25Z

...al_auth_android/android/src/main/java/io/flutter/plugins/localauth/AuthenticationHelper.java

@@ -74,7 +76,7 @@ interface AuthCompletionHandler {
      FragmentActivity activity,
      MethodCall call,
      AuthCompletionHandler completionHandler,
-      boolean allowCredentials) {
+      ArrayList<String> authenticationMethods) {


We should avoid using string-based APIs internally; we have to use them for platform channels, but in other scenarios we should stick to things that would provide compile-time correctness checks.

Stepping back a bit though, do we need this change at all? It looks like this is passing in the enrolled authentication, but I wouldn't expect that we would need to restrict by that, vs. just letting the system pick what's available. Why not keep the bool, and then use it to decide whether to add DEVICE_CREDENTIAL to the default of BIOMETRIC_WEAK | BIOMETRIC_STRONG?

Oh, yes, you're definitely right. Since it's just specifying the allowed authenticators, I can keep the boolean and just add DEVICE_CREDENTIAL depending like you're saying.

...al_auth_android/android/src/main/java/io/flutter/plugins/localauth/AuthenticationHelper.java

stuartmorgan-g · 2022-07-08T17:19:09Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

-        authHelper.authenticate();
+    // Handle case where only device credential is available
+    if (!isBiometricOnly && canAuthenticateWithDeviceCredential()) {
+      if (Build.VERSION.SDK_INT >= 30) {


The docs for https://developer.android.com/reference/androidx/biometric/BiometricPrompt.PromptInfo.Builder#setDeviceCredentialAllowed(boolean) make it sound like all the fallback code we have here is already part of androidx.biometrics already. Can we eliminate all of this code and always just make a single sendAuthenticationRequest call?

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

stuartmorgan-g

LGTM, but one question about whether we can simplify further.

stuartmorgan-g · 2022-07-20T14:25:45Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

-      authHelper.authenticate();
+    boolean allowCredentials = !isBiometricOnly && canAuthenticateWithDeviceCredential();
+
+    if (canAuthenticateWithBiometrics() || allowCredentials) {


I haven't tried this out, so maybe I'm just misunderstanding the docs, but do we even need to do this check and the errorCode computation below? If we just call authenticate, wouldn't we get an immediate error callback for these cases (e.g., we tried to auth with biometrics only, but there were no biometrics) with the right code, which we could then translate into our own error result? It seems like we still may be duplicating some BiometricPrompt logic here.

Ah, I see. I guess the idea before was that we could catch any issues before trying to authenticate (I assume the old APIs required this), but you're right. Now, we can just send the request and the AuthenticationHelper should catch it since it provides the callbacks for authentication requests.

On this note, in a follow-up PR I will add tests for AuthenticationHelper since that will do all of the error handling and is currently not tested.

stuartmorgan-g · 2022-07-20T14:26:37Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

+                BiometricManager.Authenticators.BIOMETRIC_WEAK
+                    | BiometricManager.Authenticators.DEVICE_CREDENTIAL);
+
+    switch (errorCode) {


I don't think we should consider the message itself to be API-stable, just the code. (Theoretically someone could be relying on it of course, but they shouldn't be.)

stuartmorgan-g · 2022-07-20T14:28:53Z

...h/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/LocalAuthPlugin.java

-    result.error("NotSupported", "This device does not support required security features", null);
+      @Override
+      public void onError(String code, String error) {
+        if (authInProgress.compareAndSet(true, false)) {


I see that this is pre-existing, but do you know why only error cases set this back to false? Is there another call elsewhere for success/failure?

Yeah, the other callbacks call helper methods that set it back to false, as well!

stuartmorgan-g · 2022-07-22T15:16:37Z

I think you need to remove this line:

plugins/packages/local_auth/local_auth_android/android/src/main/java/io/flutter/plugins/localauth/AuthenticationHelper.java

Line 151 in 107ab29

if (promptInfo.isDeviceCredentialAllowed()) return;

now that we're just doing a single call. I assume that was there because we used to have multiple calls for biometric vs non-biometric attempts, but now we just have the one. It looks like with that line still there, we'd have a case where we would never return a result.

Otherwise, stillLGTM!

…tions (flutter/plugins#6059)

…tter#6059)

Make initial fix

6cabfa2

github-actions bot added p: local_auth platform-android labels Jun 29, 2022

camsim99 added 4 commits July 1, 2022 10:58

Format and fix tests

c6c9436

Bump version and update comment

7505487

Revise tests

f1bc7e2

Add default for no error case

6951af6

camsim99 commented Jul 6, 2022

View reviewed changes

camsim99 marked this pull request as ready for review July 6, 2022 23:04

camsim99 requested a review from stuartmorgan-g July 6, 2022 23:04

camsim99 mentioned this pull request Jul 7, 2022

[local_auth] Fixes show dialog when biometrics is not enrolled on Android devices. #6041

Closed

11 tasks

stuartmorgan-g reviewed Jul 8, 2022

View reviewed changes

camsim99 added 5 commits July 11, 2022 13:41

Make first round of changes

9e94747

Remove unecessary test and robolectric

49d6743

Slightly modify test to make more sense

75b5c51

Add missing return statement

4201c1b

Put back version code

0f11170

camsim99 requested a review from stuartmorgan-g July 13, 2022 22:33

Make small logic fix

d3e7599

stuartmorgan-g approved these changes Jul 20, 2022

View reviewed changes

camsim99 added 2 commits July 20, 2022 15:28

Remove unecessary handling

a0c3f2e

Merge remote-tracking branch 'upstream/main' into issue_106298

107ab29

camsim99 added 2 commits July 22, 2022 09:59

Remove unecessary line

7315060

Merge remote-tracking branch 'upstream/main' into issue_106298

7662f2e

camsim99 added the autosubmit Merge PR when tree becomes green via auto submit App label Jul 26, 2022

auto-submit bot merged commit 04e8d66 into flutter:main Jul 27, 2022

This was referenced Jul 27, 2022

[local_auth] USE_FINGERPRINT android permission is deprecated flutter/flutter#106298

Closed

[local_auth] Replace USE_FINGERPRINT to USE_BIOMETRIC post deprecation in example and README #6032

Merged

engine-flutter-autoroll mentioned this pull request Jul 28, 2022

Roll Plugins from 7f55fac531a0 to 6d387c55642d (8 revisions) flutter/flutter#108547

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Jul 28, 2022

04e8d661b [local_auth] Remove FingerprintManager uses and fix depreca…

f90f918

…tions (flutter/plugins#6059)

yutaaraki-toydium pushed a commit to yutaaraki-toydium/plugins that referenced this pull request Aug 12, 2022

[local_auth] Remove FingerprintManager uses and fix deprecations (flu…

b24c1b7

…tter#6059)

mauricioluz pushed a commit to mauricioluz/plugins that referenced this pull request Jan 26, 2023

[local_auth] Remove FingerprintManager uses and fix deprecations (flu…

ddf8d0b

…tter#6059)

[local_auth] Remove FingerprintManager uses and fix deprecations #6059

[local_auth] Remove FingerprintManager uses and fix deprecations #6059

Uh oh!

Conversation

camsim99 commented Jun 29, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pre-launch Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

camsim99 Jul 6, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stuartmorgan-g left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stuartmorgan-g commented Jul 22, 2022

Uh oh!

Uh oh!

camsim99 commented Jun 29, 2022 •

edited

Loading

camsim99 Jul 6, 2022 •

edited

Loading