feat: add configurable biometric authentication policies for SecureCredentialsManager #867

subhankarmaiti · 2025-09-08T06:43:07Z

Changes

This PR introduces configurable biometric authentication policies for SecureCredentialsManager, allowing developers to control when biometric prompts are shown when accessing stored credentials. This enhancement improves user experience by reducing authentication friction while maintaining security.

References

auth0/react-native-auth0#687 (comment)

Testing

Run the included unit tests: ./gradlew :auth0:testDebugUnitTest --tests "*BiometricPolicyTest"
Use the sample app to test different policies:
- Always Policy: Biometric prompt appears every time
- Session Policy (5 min): Prompt appears once, then cached for 5 minutes
- AppLifecycle Policy: Prompt appears once until app restart or manual clear

This change adds unit test coverage
This change adds integration test coverage
This change has been tested on the latest version of the platform/language or why not

Checklist

I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors

… updated API

…session management

…K-6524-biometric-policy

…ndling

Copilot

Pull Request Overview

This PR adds configurable biometric authentication policies to SecureCredentialsManager, allowing developers to control when biometric prompts are shown based on different authentication strategies (Always, Session-based, or App Lifecycle-based).

Key changes:

Introduction of BiometricPolicy sealed class with three policy types
Enhanced LocalAuthenticationOptions to include policy configuration
Session management functionality in SecureCredentialsManager

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`BiometricPolicy.kt`	New sealed class defining three biometric authentication policies
`LocalAuthenticationOptions.kt`	Added policy parameter and builder method for biometric policy configuration
`SecureCredentialsManager.kt`	Integrated session validation logic and biometric session management
`SecureCredentialsManagerBiometricPolicyTest.kt`	Comprehensive test coverage for new biometric policy functionality
`EXAMPLES.md`	Updated documentation with examples and explanations of BiometricPolicy usage

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-09T07:48:17Z

auth0/src/main/java/com/auth0/android/authentication/storage/SecureCredentialsManager.kt

+        private const val NO_SESSION = -1L
+        private val lastBiometricAuthTime = AtomicLong(NO_SESSION)


The lastBiometricAuthTime is declared as a companion object property, making it shared across all instances of SecureCredentialsManager. This creates a potential issue where multiple manager instances would interfere with each other's session state. Consider making this an instance variable instead of a companion object property.

Agree, why does lastBiometricAuthTime defined as companion object property. This needs to be class property

auth0/src/main/java/com/auth0/android/authentication/storage/SecureCredentialsManager.kt

Copilot · 2025-09-09T07:48:18Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+import java.util.concurrent.Executor
+
+@RunWith(RobolectricTestRunner::class)
+public class SecureCredentialsManagerBiometricPolicyTest {


The public modifier is unnecessary for test classes in Kotlin. Test classes should have default (internal) visibility.

Suggested change

public class SecureCredentialsManagerBiometricPolicyTest {

class SecureCredentialsManagerBiometricPolicyTest {

it requires to run the test cases.

Copilot · 2025-09-09T07:48:18Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+    private val testExecutor = Executor { command -> command.run() }
+
+    @Before
+    public fun setUp() {


The public modifier is unnecessary for test methods in Kotlin. Test methods should have default (internal) visibility.

Suggested change

public fun setUp() {

fun setUp() {

it requires to run the test cases.

…tion options are null

pmathew92 · 2025-09-12T12:42:47Z

auth0/src/main/java/com/auth0/android/authentication/storage/BiometricPolicy.kt

+     * The session is invalidated by calling clearBiometricSession() or after the default timeout.
+     * @param timeoutInSeconds The duration for which the session remains valid. Defaults to 3600 seconds (1 hour).
+     */
+    public data class AppLifecycle(val timeoutInSeconds: Int = 3600) : BiometricPolicy() // Default 1 hour


This needs the @jvmoverloads annotation to work with seamlessly java

pmathew92 · 2025-09-12T12:47:35Z

auth0/src/main/java/com/auth0/android/authentication/storage/SecureCredentialsManager.kt

+            is BiometricPolicy.AppLifecycle -> {
+                val timeoutMillis = biometricPolicy.timeoutInSeconds * 1000L
+                System.currentTimeMillis() - lastAuth < timeoutMillis
+            }


The two cases can be combined

return when (biometricPolicy) { is BiometricPolicy.Session , is BiometricPolicy.AppLifecycle -> { val timeoutMillis = biometricPolicy.timeoutInSeconds * 1000L System.currentTimeMillis() - lastAuth < timeoutMillis } is BiometricPolicy.Always -> false } ```

pmathew92 · 2025-09-12T12:50:48Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+
+        assert(policy1 === policy2) // Same instance
+        assert(policy1 == policy2) // Equal
+    }


This test case is not needed

pmathew92 · 2025-09-12T12:51:24Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+    }
+
+    @Test
+    public fun `BiometricPolicy Session should be data class with timeout parameter`() {


Can be removed

pmathew92 · 2025-09-12T12:51:29Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+    }
+
+    @Test
+    public fun `BiometricPolicy AppLifecycle should be data class with default timeout`() {


Can be removed

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Copilot · 2025-09-30T06:06:00Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+    // =========================
+
+    @Test
+    public fun `BiometricPolicy Always should be object type`() {


The public visibility modifier is unnecessary for test methods in Kotlin and should be removed. Kotlin defaults to public visibility for functions, making this redundant.

Copilot · 2025-09-30T06:06:00Z

...java/com/auth0/android/authentication/storage/SecureCredentialsManagerBiometricPolicyTest.kt

+    }
+
+    @Test
+    public fun `BiometricPolicy Session should be data class with timeout parameter`() {


The public visibility modifier is unnecessary for test methods in Kotlin and should be removed. Kotlin defaults to public visibility for functions, making this redundant.

subhankarmaiti added 7 commits August 14, 2025 00:04

feat: Add configurable biometric policies to SecureCredentialsManager

8528a0f

feat: Enhance biometric authentication with configurable policies and…

ed711a6

… updated API

feat: Update biometric policy to include default timeout and improve …

f6b41ba

…session management

Merge branch 'main' of https://github.com/auth0/Auth0.Android into SD…

797fd98

…K-6524-biometric-policy

feat: Add unit tests for SecureCredentialsManager biometric policy ha…

2b80204

…ndling

feat: Update examples to include session-based biometric policy usage

2867d4c

refactor: Remove biometric policy options and related UI elements

7b9db65

subhankarmaiti requested a review from a team as a code owner September 8, 2025 06:43

pmathew92 requested a review from Copilot September 9, 2025 07:46

Copilot AI reviewed Sep 9, 2025

View reviewed changes

subhankarmaiti and others added 2 commits September 10, 2025 16:55

fix: Ensure default biometric policy is applied when local authentica…

17f861a

…tion options are null

Merge branch 'main' into SDK-6524-biometric-policy

e97ee89

pmathew92 reviewed Sep 12, 2025

View reviewed changes

pmathew92 requested a review from Copilot September 30, 2025 06:04

Copilot AI reviewed Sep 30, 2025

View reviewed changes

		private const val NO_SESSION = -1L
		private val lastBiometricAuthTime = AtomicLong(NO_SESSION)

	public class SecureCredentialsManagerBiometricPolicyTest {
	class SecureCredentialsManagerBiometricPolicyTest {

feat: add configurable biometric authentication policies for SecureCredentialsManager #867

Are you sure you want to change the base?

feat: add configurable biometric authentication policies for SecureCredentialsManager #867

Uh oh!

Conversation

subhankarmaiti commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

References

Testing

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

subhankarmaiti Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

subhankarmaiti Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

subhankarmaiti commented Sep 8, 2025 •

edited

Loading

pmathew92 Sep 12, 2025 •

edited

Loading