[pmathew92]

Changes

SecureCredentialsManager with LocalAuthenticationOptions could deliver two results for a single getCredentials() / getApiCredentials() call when the user presented an unrecognized biometric and then authenticated successfully (for example via the device credential fallback).

LocalAuthenticationManager.onAuthenticationFailed() called resultCallback.onFailure(BIOMETRICS_INVALID_USER). BiometricPrompt invokes onAuthenticationFailed() when a biometric is read but not recognized; it is not a terminal event, and the prompt stays open. The terminal result always arrives later via onAuthenticationSucceeded() or onAuthenticationError().

Impact before this change:

• Callback API: the caller received onFailure(BIOMETRICS_INVALID_USER) while the prompt was still open, then onSuccess after the user authenticated. Callers that settle on the first result (e.g. react-native-auth0) showed a failure and dropped the success, while the biometric session was still started.
• Coroutine API (awaitCredentials / awaitApiCredentials): the continuation was resumed twice, throwing IllegalStateException: Already resumed. runCatchingOnExecutor converted that into an UNKNOWN_ERROR failure, which attempted a third resume and threw again from the executor thread.

References

• Fixes getCredentials fails on an unrecognized fingerprint while the biometric prompt is still open #1095

Testing

New unit tests in LocalAuthenticationManagerTest:

• An unrecognized biometric alone delivers no result.
• An unrecognized biometric followed by success delivers only onSuccess(true).
• An unrecognized biometric followed by ERROR_LOCKOUT delivers only BIOMETRIC_ERROR_LOCKOUT.

New coroutine tests in SecureCredentialsManagerTest, using a real LocalAuthenticationManager (spy with only authenticate() stubbed) so the actual onAuthenticationFailed() path is exercised:

• awaitCredentials() returns credentials when an unrecognized biometric is followed by success.
• awaitCredentials() throws only BIOMETRIC_ERROR_LOCKOUT when an unrecognized biometric is followed by lockout.
• awaitApiCredentials() returns API credentials when an unrecognized biometric is followed by success.

With the old onFailure call restored, all six new tests fail, and the three coroutine tests fail with IllegalStateException: Already resumed. With the fix, LocalAuthenticationManagerTest (40) and SecureCredentialsManagerTest (135) pass.

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Team
• Run ID: b8360f48-77bf-4125-bb18-cf930cfc4a18

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}