laantungir/Amber
1
0
Fork 0
mirror of https://github.com/greenart7c3/Amber.git synced 2026-10-05 19:08:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: clarify biometric/PIN lock is UI-only

Browse Source 
Document that the biometric/PIN prompt is an app-launch UI gate rendered
only by MainActivity and SignerActivity. It does not protect signing:
the ContentProvider IPC and NIP-46 relay paths sign in the background
based solely on the permission database, and auto-accept rules sign
silently without triggering the prompt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018rF3hwjVvtjJMZffdN7zpL
This commit is contained in:
Claude
2026-06-19 09:26:39 +00:00
parent 089424a7e6
commit 535496a54e
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+15 -1
View File
@@ -64,6 +64,17 @@ Permissions are stored in `ApplicationEntity` + `ApplicationPermissionsEntity` (
Before showing the approval UI, all three ingestion paths query the database; if a matching auto-accept rule exists, signing proceeds silently.
### Biometric / PIN lock is UI-only
The biometric/PIN prompt (`useAuth` / `usePin` in `AmberSettings`, configured in `SecurityScreen`) is **only an app-launch UI gate**, not a signing gate. It is rendered by `BiometricAuthScreen`, which is invoked exclusively from the two UI entry points — `MainActivity` and `SignerActivity` — to unlock the app's screens before any approval bottom sheet is shown.
It does **not** protect the signing operations themselves:
- **ContentProvider IPC** (`SignerProvider`) and **NIP-46 relay events** (`EventNotificationConsumer` → `BunkerRequestUtils`) never touch `BiometricAuthScreen`, `Biometrics`, `useAuth`, or `usePin`. They sign in the background based purely on the permission database.
- When an auto-accept rule matches, all three paths sign silently **without** triggering the biometric/PIN prompt — including `nostrsigner://` intents, which auto-finish before the UI is interacted with.
In other words, the lock controls who can open and navigate the app UI; it does not stand between a request and `Account.sign()`. Authorization for automatic signing is governed solely by the permission system (`rememberType` / `acceptUntil` / `kind`).
### Key files
| File | Purpose |
@@ -74,4 +85,7 @@ Before showing the approval UI, all three ingestion paths query the database; if
| `SignerProvider.kt` | ContentProvider IPC signing |
| `BunkerRequestUtils.kt` | NIP-46 protocol handling, relay responses |
| `AccountStateViewModel.kt` | Auth state, account switching, toast notifications |
| `ConnectivityService.kt` | Foreground service, network monitoring, relay reconnection |
| `ConnectivityService.kt` | Foreground service, network monitoring, relay reconnection |
| `BiometricAuthScreen.kt` | UI-only app-launch lock (biometric/PIN); not a signing gate |
| `Biometrics.kt` | Wraps `BiometricPrompt` / keyguard credential prompt |
| `SecurityScreen.kt` | Toggles `useAuth` / `usePin` and the re-prompt interval |