feat: add biometric authentication for SignIn and Settings

Adds biometric sign-in (Touch ID / Face ID on iOS, BiometricPrompt on
Android) for unlocking the SQLCipher-encrypted database. Users enable it
from Settings; on next launch the SignIn screen offers a "Use biometric"
button that retrieves the password from OS-secured storage after a
successful biometric prompt.

Architecture:
- Common: expect class BiometricInteractor with BiometricResult /
  DecryptedPasswordResult sealed types (mirrors LocaleInteractor's
  expect/actual pattern in core/presentation).
- Android: BiometricPrompt + Android Keystore. Password is encrypted
  with an AES-GCM key marked setUserAuthenticationRequired(true) and
  setInvalidatedByBiometricEnrollment(true), then stored in plain
  SharedPreferences. Cipher is unlocked via BiometricPrompt.CryptoObject
  so decryption literally requires a fresh biometric scan. MainActivity
  attaches itself to a small BiometricActivityHolder for prompt access.
- iOS: LAContext + Keychain Services with kSecAccessControlBiometryCurrentSet
  on a generic-password Keychain item. Item invalidates on biometric
  re-enrollment.
- JVM/Web get no-op stubs so the multiplatform build stays green.

Settings flow: a ChangeBiometric(true) action navigates to the new
BiometricEnrollDialog where the user re-types the password, then
encryptAndStorePassword runs the biometric prompt. Disabling clears the
stored ciphertext. Whenever the DB password changes via Change/Enter/
Confirm ViewModels, any stored biometric password is cleared and a
snackbar tells the user to re-enable in Settings.

Tests: SignInViewModelTest gets two new biometric paths; existing
ViewModel tests are updated to pass the new mock BiometricInteractor.

https://claude.ai/code/session_01AHoV8HEQJ86WRccDv4i6hK

Author: claude

app/android/src/main/AndroidManifest.xml

@@ -1,6 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
+    <uses-permission android:name="android.permission.USE_BIOMETRIC" />
+
     <application
         android:name=".MainApplication"
         android:icon="@mipmap/ic_launcher"
@@ -9,6 +11,7 @@
         android:theme="@style/Theme.NoteDelight">
         <activity
             android:name=".MainActivity"
+            android:configChanges="orientation|screenSize|keyboardHidden"
             android:exported="true"
             android:windowSoftInputMode="adjustResize">
             <intent-filter>

app/android/src/main/java/com/softartdev/notedelight/MainActivity.kt

@@ -3,13 +3,23 @@ package com.softartdev.notedelight
 import android.os.Bundle
 import androidx.activity.compose.setContent
 import androidx.appcompat.app.AppCompatActivity
+import com.softartdev.notedelight.interactor.BiometricActivityHolder
+import org.koin.android.ext.android.inject
 
 class MainActivity : AppCompatActivity() {
 
+    private val biometricActivityHolder: BiometricActivityHolder by inject()
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+        biometricActivityHolder.attach(this)
         setContent {
             App()
         }
     }
+
+    override fun onDestroy() {
+        biometricActivityHolder.detach()
+        super.onDestroy()
+    }
 }

app/iosApp/iosApp/Info.plist

@@ -4,6 +4,8 @@
 <dict>
 	<key>ITSAppUsesNonExemptEncryption</key>
 	<false/>
+	<key>NSFaceIDUsageDescription</key>
+	<string>Used to unlock your encrypted notes.</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
 	<key>CFBundleExecutable</key>

core/presentation/build.gradle.kts

@@ -47,6 +47,7 @@ kotlin {
         }
         androidMain.dependencies {
             implementation(libs.androidx.appcompat)
+            implementation(libs.androidx.biometric)
         }
         val androidHostTest by getting {
             dependencies {

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/adaptive/AdaptiveInteractorTest.kt

@@ -8,6 +8,7 @@ import com.softartdev.notedelight.CoroutineDispatchersStub
 import com.softartdev.notedelight.PrintLogWriter
 import com.softartdev.notedelight.db.NoteDAO
 import com.softartdev.notedelight.interactor.AdaptiveInteractor
+import com.softartdev.notedelight.interactor.BiometricInteractor
 import com.softartdev.notedelight.interactor.LocaleInteractor
 import com.softartdev.notedelight.interactor.SnackbarInteractor
 import com.softartdev.notedelight.model.SettingsCategory
@@ -66,6 +67,7 @@ class AdaptiveInteractorTest {
     private val mockDeleteNoteUseCase = Mockito.mock(DeleteNoteUseCase::class.java)
     private val mockSnackbarInteractor = Mockito.mock(SnackbarInteractor::class.java)
     private val mockLocaleInteractor = Mockito.mock(LocaleInteractor::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockAppVersionUseCase = Mockito.mock(AppVersionUseCase::class.java)
     private val checkSqlCipherVersionUseCase = CheckSqlCipherVersionUseCase(mockSafeRepo)
     private val revealFileListUseCase = RevealFileListUseCase()
@@ -118,6 +120,7 @@ class AdaptiveInteractorTest {
             revealFileListUseCase = revealFileListUseCase,
             localeInteractor = mockLocaleInteractor,
             adaptiveInteractor = adaptiveInteractor,
+            biometricInteractor = mockBiometricInteractor,
             coroutineDispatchers = coroutineDispatchers,
         )
         Mockito.`when`(mockNoteDAO.pagingDataFlow).thenReturn(flowOf(PagingData.empty()))

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/settings/SettingsViewModelTest.kt

@@ -4,6 +4,7 @@ import androidx.arch.core.executor.testing.InstantTaskExecutorRule
 import app.cash.turbine.test
 import com.softartdev.notedelight.CoroutineDispatchersStub
 import com.softartdev.notedelight.interactor.AdaptiveInteractor
+import com.softartdev.notedelight.interactor.BiometricInteractor
 import com.softartdev.notedelight.interactor.LocaleInteractor
 import com.softartdev.notedelight.interactor.SnackbarInteractor
 import com.softartdev.notedelight.interactor.SnackbarMessage
@@ -44,6 +45,7 @@ class SettingsViewModelTest {
     private val mockRouter = Mockito.mock(Router::class.java)
     private val mockSnackbarInteractor = Mockito.mock(SnackbarInteractor::class.java)
     private val mockLocaleInteractor = Mockito.mock(LocaleInteractor::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockAppVersionUseCase = Mockito.mock(AppVersionUseCase::class.java)
     private val adaptiveInteractor = AdaptiveInteractor()
     private val coroutineDispatchers = CoroutineDispatchersStub(mainDispatcherRule.testDispatcher.scheduler)
@@ -58,12 +60,13 @@ class SettingsViewModelTest {
         revealFileListUseCase = RevealFileListUseCase(),
         localeInteractor = mockLocaleInteractor,
         adaptiveInteractor = adaptiveInteractor,
+        biometricInteractor = mockBiometricInteractor,
         coroutineDispatchers = coroutineDispatchers,
     )
 
     @After
     fun tearDown() = runTest {
-        Mockito.reset(mockSafeRepo, mockSnackbarInteractor, mockRouter, mockAppVersionUseCase)
+        Mockito.reset(mockSafeRepo, mockSnackbarInteractor, mockRouter, mockAppVersionUseCase, mockBiometricInteractor)
     }
 
     @Test

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/settings/security/change/ChangeViewModelTest.kt

@@ -5,6 +5,7 @@ import app.cash.turbine.test
 import co.touchlab.kermit.Logger
 import com.softartdev.notedelight.CoroutineDispatchersStub
 import com.softartdev.notedelight.PrintLogWriter
+import com.softartdev.notedelight.interactor.BiometricInteractor
 import com.softartdev.notedelight.interactor.SnackbarInteractor
 import com.softartdev.notedelight.navigation.Router
 import com.softartdev.notedelight.presentation.MainDispatcherRule
@@ -34,6 +35,7 @@ class ChangeViewModelTest {
 
     private val mockCheckPasswordUseCase = Mockito.mock(CheckPasswordUseCase::class.java)
     private val mockChangePasswordUseCase = Mockito.mock(ChangePasswordUseCase::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockRouter = Mockito.mock(Router::class.java)
     private val mockSnackbarInteractor = Mockito.mock(SnackbarInteractor::class.java)
     private val coroutineDispatchers = CoroutineDispatchersStub(
@@ -42,6 +44,7 @@ class ChangeViewModelTest {
     private val viewModel = ChangeViewModel(
         checkPasswordUseCase = mockCheckPasswordUseCase,
         changePasswordUseCase = mockChangePasswordUseCase,
+        biometricInteractor = mockBiometricInteractor,
         snackbarInteractor = mockSnackbarInteractor,
         router = mockRouter,
         coroutineDispatchers = coroutineDispatchers
@@ -53,7 +56,7 @@ class ChangeViewModelTest {
     @After
     fun tearDown() {
         Logger.setLogWriters()
-        Mockito.reset(mockCheckPasswordUseCase, mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter)
+        Mockito.reset(mockCheckPasswordUseCase, mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter, mockBiometricInteractor)
     }
 
     @Test

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/settings/security/confirm/ConfirmViewModelTest.kt

@@ -5,6 +5,7 @@ import app.cash.turbine.test
 import co.touchlab.kermit.Logger
 import com.softartdev.notedelight.CoroutineDispatchersStub
 import com.softartdev.notedelight.PrintLogWriter
+import com.softartdev.notedelight.interactor.BiometricInteractor
 import com.softartdev.notedelight.interactor.SnackbarInteractor
 import com.softartdev.notedelight.navigation.Router
 import com.softartdev.notedelight.presentation.MainDispatcherRule
@@ -32,13 +33,15 @@ class ConfirmViewModelTest {
     val mainDispatcherRule = MainDispatcherRule()
 
     private val mockChangePasswordUseCase = Mockito.mock(ChangePasswordUseCase::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockRouter = Mockito.mock(Router::class.java)
     private val mockSnackbarInteractor = Mockito.mock(SnackbarInteractor::class.java)
     private val coroutineDispatchers = CoroutineDispatchersStub(
         scheduler = mainDispatcherRule.testDispatcher.scheduler
     )
     private val viewModel = ConfirmViewModel(
         changePasswordUseCase = mockChangePasswordUseCase,
+        biometricInteractor = mockBiometricInteractor,
         snackbarInteractor = mockSnackbarInteractor,
         router = mockRouter,
         coroutineDispatchers = coroutineDispatchers
@@ -50,7 +53,7 @@ class ConfirmViewModelTest {
     @After
     fun tearDown() {
         Logger.setLogWriters()
-        Mockito.reset(mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter)
+        Mockito.reset(mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter, mockBiometricInteractor)
     }
 
     @Test

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/settings/security/enter/EnterViewModelTest.kt

@@ -5,6 +5,7 @@ import app.cash.turbine.test
 import co.touchlab.kermit.Logger
 import com.softartdev.notedelight.CoroutineDispatchersStub
 import com.softartdev.notedelight.PrintLogWriter
+import com.softartdev.notedelight.interactor.BiometricInteractor
 import com.softartdev.notedelight.interactor.SnackbarInteractor
 import com.softartdev.notedelight.navigation.Router
 import com.softartdev.notedelight.presentation.MainDispatcherRule
@@ -34,6 +35,7 @@ class EnterViewModelTest {
 
     private val mockCheckPasswordUseCase = Mockito.mock(CheckPasswordUseCase::class.java)
     private val mockChangePasswordUseCase = Mockito.mock(ChangePasswordUseCase::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockRouter = Mockito.mock(Router::class.java)
     private val mockSnackbarInteractor = Mockito.mock(SnackbarInteractor::class.java)
     private val coroutineDispatchers = CoroutineDispatchersStub(
@@ -42,6 +44,7 @@ class EnterViewModelTest {
     private val viewModel = EnterViewModel(
         checkPasswordUseCase = mockCheckPasswordUseCase,
         changePasswordUseCase = mockChangePasswordUseCase,
+        biometricInteractor = mockBiometricInteractor,
         snackbarInteractor = mockSnackbarInteractor,
         router = mockRouter,
         coroutineDispatchers = coroutineDispatchers
@@ -53,7 +56,7 @@ class EnterViewModelTest {
     @After
     fun tearDown() {
         Logger.setLogWriters()
-        Mockito.reset(mockCheckPasswordUseCase, mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter)
+        Mockito.reset(mockCheckPasswordUseCase, mockChangePasswordUseCase, mockSnackbarInteractor, mockRouter, mockBiometricInteractor)
     }
 
     @Test

core/presentation/src/androidHostTest/kotlin/com/softartdev/notedelight/presentation/signin/SignInViewModelTest.kt

@@ -5,13 +5,18 @@ import androidx.compose.ui.autofill.AutofillManager
 import app.cash.turbine.test
 import com.softartdev.notedelight.StubEditable
 import com.softartdev.notedelight.anyObject
+import com.softartdev.notedelight.interactor.BiometricInteractor
+import com.softartdev.notedelight.interactor.BiometricResult
+import com.softartdev.notedelight.interactor.DecryptedPasswordResult
 import com.softartdev.notedelight.navigation.AppNavGraph
 import com.softartdev.notedelight.navigation.Router
 import com.softartdev.notedelight.presentation.MainDispatcherRule
 import com.softartdev.notedelight.usecase.crypt.CheckPasswordUseCase
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.test.runTest
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
@@ -27,14 +32,17 @@ class SignInViewModelTest {
     val mainDispatcherRule = MainDispatcherRule()
 
     private val mockCheckPasswordUseCase = Mockito.mock(CheckPasswordUseCase::class.java)
+    private val mockBiometricInteractor = Mockito.mock(BiometricInteractor::class.java)
     private val mockRouter = Mockito.mock(Router::class.java)
     private val mockAutofillManager = Mockito.mock(AutofillManager::class.java)
-    
+
     private lateinit var signInViewModel: SignInViewModel
 
     @Before
     fun setUp() {
-        signInViewModel = SignInViewModel(mockCheckPasswordUseCase, mockRouter)
+        signInViewModel = SignInViewModel(
+            mockCheckPasswordUseCase, mockBiometricInteractor, mockRouter
+        )
         signInViewModel.autofillManager = mockAutofillManager
     }
 
@@ -114,4 +122,48 @@ class SignInViewModelTest {
             cancelAndIgnoreRemainingEvents()
         }
     }
+
+    @Test
+    fun refreshBiometricVisibleWhenAvailable() = runTest {
+        Mockito.`when`(mockBiometricInteractor.hasStoredPassword()).thenReturn(true)
+        Mockito.`when`(mockBiometricInteractor.canAuthenticate()).thenReturn(true)
+        signInViewModel.biometricVisibleFlow.test {
+            assertFalse(awaitItem())
+            signInViewModel.onAction(SignInAction.RefreshBiometric)
+            assertTrue(awaitItem())
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
+
+    @Test
+    fun biometricSignInSuccess() = runTest {
+        val pass = StubEditable("pass")
+        Mockito.`when`(
+            mockBiometricInteractor.decryptStoredPassword(
+                anyObject(), anyObject(), anyObject()
+            )
+        ).thenReturn(DecryptedPasswordResult.Success(pass))
+        Mockito.`when`(mockCheckPasswordUseCase(pass)).thenReturn(true)
+        signInViewModel.stateFlow.test {
+            assertEquals(SignInResult.ShowSignInForm, awaitItem())
+            signInViewModel.onAction(SignInAction.OnBiometricClick("t", "s", "c"))
+            Mockito.verify(mockRouter).navigateClearingBackStack(route = AppNavGraph.Main)
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
+
+    @Test
+    fun biometricSignInUnavailableClearsState() = runTest {
+        Mockito.`when`(
+            mockBiometricInteractor.decryptStoredPassword(
+                anyObject(), anyObject(), anyObject()
+            )
+        ).thenReturn(DecryptedPasswordResult.Failure(BiometricResult.Unavailable))
+        signInViewModel.biometricVisibleFlow.test {
+            assertFalse(awaitItem())
+            signInViewModel.onAction(SignInAction.OnBiometricClick("t", "s", "c"))
+            Mockito.verify(mockBiometricInteractor).clearStoredPassword()
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
 }