New bridge method GET_BIOMETRICS_AUTHENTICATION_STATUS

[jdelga]

Message type: GET_BIOMETRICS_AUTHENTICATION_STATUS

Originator: Both

Min app version: 25.7

Description

We need a new bridge method to retrieve information about the availability of Biometrics.

Payload definition

getBiometricsAuthenticationStatus: () => Promise<{
result: 'DISABLED' | 'ENABLED' | 'DEVICE_HAS_NO_AUTHENTICATION',
}>;

• DISABLED -> The device has an authentication method (device PIN code at least, and biometrics optionally) but it has the biometrics option disabled in the app
• ENABLED -> The device has an authentication method (device PIN code at least, and biometrics optionally) and it has the biometrics option enabled in the app (it requires authentication when launching the app)
• DEVICE_HAS_NO_AUTHENTICATION -> The device has not any authentication method (it has no device PIN code neither biometrics)

Comments

We should consider another option instead of a new method:

As well as we did with the method triggerPinOrBiometricAuthentication, which was extended to support both biometric systems (old & new), we should consider extending the current method getPinCodeInfo in the same way, so, if the new system is enabled, retrieve its information, and if it is not, we retrieve the old one.

Possible error cases

404 -> The OB has no the new biometrics 2.0 functionality
500 -> User is not logged

[dhidalgofadrique]

If we extend the getPinCodeInfo we should rename it

[jprietoTuenti]

May there be some benefit on having different responses for the feature being "disabled" and being "not yet configured"? Do we have any case in which the webview has to behave differently in both?

I'm thinking something like showing the user some information about the feature if it was never configured or directly redirect to the settings if the user rejected the feature in the past, for example.

[dhidalgofadrique]

In the app the "not yet configured" state is managed as disabled (which is the default value if the user hasn't set it). Obviously for this bridge method we'll check first the DEVICE_HAS_NO_AUTHENTICATION and then the enabled/disabled

[pladaria]

related spec: https://confluence.tid.es/display/CTO/%5BB2X%5D+Tech+Spec%3A+AuthClasses+2%2C+Biometrics+for+session+extension

[jdelga]

So, as we talked, this feature is expected to be available only for brands that have device authentication enabled. Do you agree with the following implementation ?

Message type: GET_BIOMETRICS_AUTHENTICATION_STATUS
Method name: getBiometricsAuthenticationStatus

Brand has USE_DEVICE_AUTHENTICATION disabled -> ERROR
Device does not support Biometry -> DEVICE_HAS_NO_AUTHENTICATION
si el usuario la tiene habilitada -> ENABLED
else -> DISABLED

CC @atabel

[dhidalgofadrique]

So, as we talked, this feature is expected to be available only for brands that have device authentication enabled. Do you agree with the following implementation ?

Message type: GET_BIOMETRICS_AUTHENTICATION_STATUS Method name: getBiometricsAuthenticationStatus

Brand has USE_DEVICE_AUTHENTICATION disabled -> ERROR Device does not support Biometry -> DEVICE_HAS_NO_AUTHENTICATION si el usuario la tiene habilitada -> ENABLED else -> DISABLED

CC @atabel

Regarding to the

Brand has USE_DEVICE_AUTHENTICATION disabled -> ERROR

in theory if a brand doesn't use this feature (is still using the olf PIN) shouldn't invoke this bridge method...

[jdelga]

in theory if a brand doesn't use this feature (is still using the olf PIN) shouldn't invoke this bridge method...

I agree, but it could be called anyway, that's why IMO we should add some protection or warning.

[dhidalgofadrique]

As we talked here if an OB that has not the new biometry functionality send this bridge message, the app will response with a 404 error (updated description)

[jdelga]

We should add an error code of 500 when the user is not logged, same as TriggerPinOrBiometricAuthentication : https://github.com/Telefonica/android-messenger/blob/b0d446c22d1c73fb2713e976b4af9742a6790841/web/src/main/java/com/tuenti/web/bridge/messagehandlers/TriggerPinOrBiometricAuthentication.kt#L59