Skip to content

fix: alert user on biometric changed TO-454#25423

Merged
ieow merged 11 commits into
mainfrom
cw/fix-biometric-changed
Mar 27, 2026
Merged

fix: alert user on biometric changed TO-454#25423
ieow merged 11 commits into
mainfrom
cw/fix-biometric-changed

Conversation

@ieow

@ieow ieow commented Jan 30, 2026

Copy link
Copy Markdown
Contributor

Description

User change biometric ( add / remove fingerprint) Metamask wallet not able to detect and handle it properly
TO-454

Changelog

CHANGELOG entry: Alert User on biometric changed

Related issues

Fixes:

Manual testing steps

Feature: Detect Biometric Changed

  Scenario: user create MM wallet with biometric enabled
    Given User create MM wallet with biometric enabled

    When user remove 1 of N fingerprint / change faceId from system ( fingerprint/face)
    Then MM should Alert user that biometric changed and previous biometric become invalid

Screenshots/Recordings

Before

Screen.Recording.2026-03-18.at.3.17.33.PM.mov

After

Screen.Recording.2026-03-18.at.3.34.13.PM.mov

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Touches unlock and credential-reset flows: mis-detection could incorrectly reset local auth settings or interrupt login, though changes are scoped and covered by new unit tests.

Overview
Adds handling for the Android "biometrics changed" failure case during Authentication.unlockWallet: when the thrown Error.message contains USER_NOT_AUTHENTICATED, the app shows a non-cancelable alert and then locks the app with reset: true to clear stored credentials.

Refactors auth cleanup by centralizing removal of legacy auth storage flags and remember-me state into clearAuthStorageFlags, reusing it from both storePassword and resetPassword, and ensuring resetPassword also disables OS auth in Redux.

Updates constants and strings to include UNLOCK_WALLET_ERROR_MESSAGES.USER_NOT_AUTHENTICATED plus new login.biometric_changed* i18n keys, and extends tests to cover the new reset behavior and alert/lock paths.

Written by Cursor Bugbot for commit 288036e. This will update automatically on new commits. Configure here.

@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-onboarding Onboarding team label Jan 30, 2026
@ieow ieow changed the title fix: alert user on biometric changed fix: alert user on biometric changed TO-454 Jan 30, 2026
@ieow

ieow commented Jan 30, 2026

Copy link
Copy Markdown
Contributor Author

TO-454

Comment thread app/core/Authentication/Authentication.ts
@sonarqubecloud

Copy link
Copy Markdown

@ieow ieow marked this pull request as ready for review February 2, 2026 08:26
Comment thread app/core/Authentication/Authentication.ts
Comment thread app/core/Authentication/Authentication.ts
@ieow ieow force-pushed the cw/fix-biometric-changed branch from 47df805 to b25997a Compare March 16, 2026 13:35
Comment thread app/core/Authentication/Authentication.test.ts Outdated
Comment thread app/core/Authentication/Authentication.ts Outdated
@github-actions github-actions Bot added the risk-high Extensive testing required · High bug introduction risk label Mar 17, 2026
@github-actions github-actions Bot added risk-high Extensive testing required · High bug introduction risk and removed risk-high Extensive testing required · High bug introduction risk labels Mar 17, 2026
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-high Extensive testing required · High bug introduction risk labels Mar 18, 2026
Cal-L
Cal-L previously approved these changes Mar 19, 2026

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ieow ieow added this pull request to the merge queue Mar 24, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Mar 24, 2026
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-medium Moderate testing recommended · Possible bug introduction risk labels Mar 26, 2026
Comment thread app/core/Authentication/Authentication.test.ts Outdated
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-medium Moderate testing recommended · Possible bug introduction risk labels Mar 26, 2026
Comment thread app/core/Authentication/Authentication.ts Outdated
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-medium Moderate testing recommended · Possible bug introduction risk labels Mar 26, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Comment thread app/core/Authentication/Authentication.ts
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-medium Moderate testing recommended · Possible bug introduction risk labels Mar 27, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeAccounts, SmokeWalletPlatform
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: medium
  • AI Confidence: 72%
click to see 🤖 AI reasoning details

E2E Test Selection:
The changes are in app/core/Authentication/Authentication.ts, a critical core module that handles login, unlock, and password reset flows.

Key changes:

  1. Refactoring: clearAuthStorageFlags() extracted as a private method - previously only called in storePassword, now also called in resetPassword. This is a behavioral change: resetPassword now additionally clears biometry/passcode storage flags and resets allowLoginWithRememberMe Redux state, plus calls updateOsAuthEnabled(false).
  2. New Android biometric error handling: When unlockWallet() fails with USER_NOT_AUTHENTICATED error (Android-specific, triggered when user changes biometrics), a non-dismissible alert is shown prompting re-enablement, then lockApp({ reset: true }) is called instead of reset: false. This is a new code path.
  3. New locale strings: 3 new strings for the biometric changed alert.
  4. New constant: USER_NOT_AUTHENTICATED error message.

Why SmokeAccounts: This tag covers account security flows including credential management, SRP export, and wallet details. The authentication changes directly affect how accounts are secured and accessed. The resetPassword behavioral change could affect account security flows.

Why SmokeWalletPlatform: This tag covers wallet lifecycle including SRP import flows, account deletion, and multi-SRP architecture - all of which go through authentication. The resetPassword change (now clearing auth flags) could affect wallet lifecycle flows.

Why NOT all tags: The changes are well-contained to authentication internals. The new biometric error handling is Android-specific and only triggers in an edge case (biometric change). The refactoring is clean. No UI components were changed. The locale strings are new additions (no existing strings modified). The unit tests provide good coverage of the new behavior.

Performance: No performance impact expected - these are error handling and storage flag cleanup operations, not rendering or data loading changes.

Performance Test Selection:
The changes are in authentication error handling and storage flag cleanup. No UI rendering, list components, data loading, or app startup paths are affected. The new biometric alert is an edge-case error handler. No performance impact expected.

View GitHub Actions results

@github-actions

Copy link
Copy Markdown
Contributor

E2E Fixture Validation — Schema is up to date
17 value mismatches detected (expected — fixture represents an existing user).
View details

@sonarqubecloud

Copy link
Copy Markdown

@ieow ieow added this pull request to the merge queue Mar 27, 2026
Merged via the queue into main with commit dacb6ba Mar 27, 2026
110 checks passed
@ieow ieow deleted the cw/fix-biometric-changed branch March 27, 2026 12:40
@github-actions github-actions Bot locked and limited conversation to collaborators Mar 27, 2026
@metamaskbot metamaskbot added the release-7.73.0 Issue or pull request that will be included in release 7.73.0 label Mar 27, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-7.73.0 Issue or pull request that will be included in release 7.73.0 risk-medium Moderate testing recommended · Possible bug introduction risk size-M team-onboarding Onboarding team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants