fix(biometric) Incorrect error reported on Android with no device passcode set and fallback allowed (#2648)

* Fix incorrect error being reported in certain cases with fallback allowed

* Add change file

* Rework original solution due to overlooking authenticators logic on API >= `Build.VERSION_CODES.R`

* fix(biometric): don't cast the Android error message to String

* fix(biometric): report a missing device credential before showing the Android prompt

Replaces the override of ERROR_NO_BIOMETRICS in the prompt callback, which keyed on
the caller's flag rather than the device state and missed the no-hardware errors.

* fix(biometric): load the missing device credential message from a string resource

* chore(biometric): drop stray semicolon

* docs(biometric): mention the passcodeNotSet error code rename in the change file

* test(e2e): cover the biometric passcodeNotSet rejection on Android

---------

Co-authored-by: Lucas Nogueira <lucas@tauri.app>

plugins/biometric/android/src/main/java/BiometricActivity.kt

@@ -38,14 +38,23 @@ class BiometricActivity : AppCompatActivity() {
         var title = intent.getStringExtra(BiometricPlugin.TITLE)
         val subtitle = intent.getStringExtra(BiometricPlugin.SUBTITLE)
         val description = intent.getStringExtra(BiometricPlugin.REASON)
-        allowDeviceCredential = false
+        val allowDeviceCredentialArg = intent.getBooleanExtra(BiometricPlugin.DEVICE_CREDENTIAL, false)
         // Android docs say we should check if the device is secure before enabling device credential fallback
         val manager = getSystemService(
             Context.KEYGUARD_SERVICE
         ) as KeyguardManager
-        if (manager.isDeviceSecure) {
-            allowDeviceCredential =
-                intent.getBooleanExtra(BiometricPlugin.DEVICE_CREDENTIAL, false)
+        val allowDeviceCredential = allowDeviceCredentialArg && manager.isDeviceSecure
+
+        // Android requires a secure lock screen to enroll biometrics, so with the fallback
+        // allowed and no device credential set there is nothing to authenticate with.
+        // Report it up front (like iOS does) instead of relying on the prompt's error.
+        if (allowDeviceCredentialArg && !manager.isDeviceSecure) {
+            finishActivity(
+                BiometryResultType.ERROR,
+                BiometricPrompt.ERROR_NO_DEVICE_CREDENTIAL,
+                getString(R.string.tauri_biometric_no_device_credential)
+            )
+            return
         }
 
         if (title.isNullOrEmpty()) {
@@ -73,6 +82,7 @@ class BiometricActivity : AppCompatActivity() {
                 if (negativeButtonText.isNullOrEmpty()) "Cancel" else negativeButtonText
             )
         }
+
         builder.setConfirmationRequired(
             intent.getBooleanExtra(BiometricPlugin.CONFIRMATION_REQUIRED, true)
         )
@@ -89,7 +99,7 @@ class BiometricActivity : AppCompatActivity() {
                     finishActivity(
                         BiometryResultType.ERROR,
                         errorCode,
-                        errorMessage as String
+                        errorMessage.toString()
                     )
                 }
 
@@ -122,8 +132,4 @@ class BiometricActivity : AppCompatActivity() {
         setResult(Activity.RESULT_OK, intent)
         finish()
     }
-
-    companion object {
-        var allowDeviceCredential = false
-    }
 }

plugins/biometric/android/src/main/java/BiometricPlugin.kt

@@ -73,7 +73,7 @@ class BiometricPlugin(private val activity: Activity): Plugin(activity) {
            biometryErrorCodeMap[BiometricPrompt.ERROR_LOCKOUT_PERMANENT] = "biometryLockout"
            biometryErrorCodeMap[BiometricPrompt.ERROR_NEGATIVE_BUTTON] = "userCancel"
            biometryErrorCodeMap[BiometricPrompt.ERROR_NO_BIOMETRICS] = "biometryNotEnrolled"
-           biometryErrorCodeMap[BiometricPrompt.ERROR_NO_DEVICE_CREDENTIAL] = "noDeviceCredential"
+           biometryErrorCodeMap[BiometricPrompt.ERROR_NO_DEVICE_CREDENTIAL] = "passcodeNotSet"
            biometryErrorCodeMap[BiometricPrompt.ERROR_NO_SPACE] = "systemCancel"
            biometryErrorCodeMap[BiometricPrompt.ERROR_TIMEOUT] = "systemCancel"
            biometryErrorCodeMap[BiometricPrompt.ERROR_UNABLE_TO_PROCESS] = "systemCancel"

plugins/biometric/android/src/main/res/values/strings.xml

@@ -0,0 +1,3 @@
+<resources>
+    <string name="tauri_biometric_no_device_credential">No device credential set</string>
+</resources>