mobile: fix app lock issues

apps/mobile/app/common/database/encryption.js

@@ -43,9 +43,8 @@ const IOS_KEYCHAIN_ACCESS_GROUP = "group.org.streetwriters.notesnook";
 const IOS_KEYCHAIN_SERVICE_NAME = "org.streetwriters.notesnook";
 const KEYCHAIN_SERVER_DBKEY = "notesnook:db";
 
-const NOTESNOOK_APPLOCK_KEY_SALT = "3dqclWbOYllfk9kk";
-const NOTESNOOK_DB_KEY_SALT = "2rcgSprDmRvZ1AAa";
-const NOTESNOOK_USER_KEY_SALT = "7qO4qeoM6PbsAJ0Q";
+const NOTESNOOK_APPLOCK_KEY_SALT = "kBwr1Kre86ebOZ8ThLu2OA";
+const NOTESNOOK_DB_KEY_SALT = "SNuzOcEK3amoqL0WvPeKqw";
 
 const DB_KEY_CIPHER = "databaseKeyCipher";
 const USER_KEY_CIPHER = "userKeyCipher";
@@ -117,9 +116,7 @@ export async function setAppLockVerificationCipher(appLockPassword) {
       NOTESNOOK_APPLOCK_KEY_SALT
     );
     const encrypted = await encrypt(appLockCredentials, generatePassword());
-
     CipherStorage.setMap(APPLOCK_CIPHER, encrypted);
-
     DatabaseLogger.info("setAppLockVerificationCipher");
   } catch (e) {
     DatabaseLogger.error(e);
@@ -135,10 +132,8 @@ export async function validateAppLockPassword(appLockPassword) {
   try {
     const appLockCipher = CipherStorage.getMap(APPLOCK_CIPHER);
     if (!appLockCipher) return true;
-    const decrypted = await decrypt(
-      await Sodium.deriveKey(appLockPassword, NOTESNOOK_APPLOCK_KEY_SALT),
-      appLockCipher
-    );
+    const key = await Sodium.deriveKey(appLockPassword, appLockCipher.salt);
+    const decrypted = await decrypt(key, appLockCipher);
 
     DatabaseLogger.info(
       `validateAppLockPassword: ${typeof decrypted === "string"}`
@@ -213,8 +208,7 @@ export async function getDatabaseKey(appLockPassword) {
       if (userKeyCredentials) {
         const userKeyCipher = await encrypt(
           {
-            key: DB_KEY,
-            salt: NOTESNOOK_USER_KEY_SALT
+            key: DB_KEY
           },
           userKeyCredentials.password
         );
@@ -238,8 +232,7 @@ export async function deriveCryptoKey(data) {
     let credentials = await Sodium.deriveKey(data.password, data.salt);
     const userKeyCipher = await encrypt(
       {
-        key: await getDatabaseKey(),
-        salt: NOTESNOOK_USER_KEY_SALT
+        key: await getDatabaseKey()
       },
       credentials.key
     );

apps/mobile/app/components/app-lock-overlay/index.tsx

@@ -34,11 +34,13 @@ import {
 import { MMKV } from "../../common/database/mmkv";
 import { useAppState } from "../../hooks/use-app-state";
 import BiometricService from "../../services/biometrics";
+import { ToastManager } from "../../services/event-manager";
 import SettingsService from "../../services/settings";
 import { useSettingStore } from "../../stores/use-setting-store";
 import { useUserStore } from "../../stores/use-user-store";
 import { NotesnookModule } from "../../utils/notesnook-module";
 import { SIZE } from "../../utils/size";
+import { Toast } from "../toast";
 import { Button } from "../ui/button";
 import { IconButton } from "../ui/icon-button";
 import Input from "../ui/input";
@@ -148,6 +150,12 @@ const AppLockedOverlay = () => {
         lockApp(false);
         enabled(false);
         password.current = undefined;
+      } else {
+        ToastManager.show({
+          heading: `Invalid ${keyboardType === "numeric" ? "pin" : "password"}`,
+          type: "error",
+          context: "local"
+        });
       }
     } catch (e) {
       console.error(e);
@@ -188,11 +196,7 @@ const AppLockedOverlay = () => {
       enabled(false);
     } else {
       SettingsService.appEnteredBackground();
-
-      if (
-        SettingsService.get().privacyScreen ||
-        SettingsService.getProperty("appLockEnabled")
-      ) {
+      if (SettingsService.get().privacyScreen) {
         enabled(true);
       }
     }
@@ -209,6 +213,7 @@ const AppLockedOverlay = () => {
         justifyContent: "center"
       }}
     >
+      <Toast context="local" />
       <View
         style={{
           flex: 1,

apps/mobile/app/components/dialog/functions.ts

@@ -44,6 +44,7 @@ type DialogInfo = {
   // eslint-disable-next-line @typescript-eslint/ban-types
   context: "global" | "local" | (string & {});
   secureTextEntry?: boolean;
+  keyboardType?: string;
 };
 
 export function presentDialog(data: Partial<DialogInfo>): void {

apps/mobile/app/components/dialog/index.js

@@ -174,6 +174,7 @@ export const Dialog = ({ context = "global" }) => {
               onSubmit={onPressPositive}
               returnKeyLabel="Done"
               returnKeyType="done"
+              keyboardType={dialogInfo.keyboardType || "default"}
               placeholder={dialogInfo.inputPlaceholder}
             />
           </View>

apps/mobile/app/components/dialogs/applock-password/index.tsx

@@ -19,6 +19,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import { useThemeColors } from "@notesnook/theme";
 import React, { useEffect, useRef, useState } from "react";
 import { TextInput, View } from "react-native";
+import { db } from "../../../common/database";
 import {
   clearAppLockVerificationCipher,
   setAppLockVerificationCipher,
@@ -44,6 +45,7 @@ import BaseDialog from "../../dialog/base-dialog";
 import DialogButtons from "../../dialog/dialog-buttons";
 import DialogHeader from "../../dialog/dialog-header";
 import { Toast } from "../../toast";
+import { Button } from "../../ui/button";
 import { IconButton } from "../../ui/icon-button";
 import Input from "../../ui/input";
 import Seperator from "../../ui/seperator";
@@ -66,6 +68,7 @@ export const AppLockPassword = () => {
     confirmPassword?: string;
   }>({});
   const [secureTextEntry, setSecureTextEntry] = useState(true);
+  const [accountPass, setAccountPass] = useState(false);
 
   useEffect(() => {
     const subs = [
@@ -73,6 +76,7 @@ export const AppLockPassword = () => {
         eOpenAppLockPasswordDialog,
         (mode: "create" | "change" | "remove") => {
           setMode(mode);
+          setAccountPass(false);
           setVisible(true);
         }
       ),
@@ -126,7 +130,9 @@ export const AppLockPassword = () => {
             mode === "change"
               ? `Change app lock ${keyboardType}`
               : mode === "remove"
-              ? `Remove app lock ${keyboardType}`
+              ? `Enter ${
+                  accountPass ? "account password" : `app lock ${keyboardType}`
+                } to remove ${keyboardType}`
               : `Set up a custom app lock ${keyboardType} to unlock the app`
           }
           icon="shield"
@@ -169,33 +175,39 @@ export const AppLockPassword = () => {
               confirmPasswordInputRef.current?.focus();
             }}
             defaultValue={values.current.password}
-            keyboardType={keyboardType === "pin" ? "number-pad" : "default"}
+            keyboardType={
+              keyboardType === "pin" && !accountPass ? "number-pad" : "default"
+            }
             autoComplete="password"
             returnKeyLabel={mode !== "remove" ? "Next" : "Remove"}
             returnKeyType={mode !== "remove" ? "next" : "done"}
             secureTextEntry={secureTextEntry}
             buttonLeft={
-              <IconButton
-                name={keyboardType === "password" ? "numeric" : "keyboard"}
-                onPress={() => {
-                  setKeyboardType(
-                    keyboardType === "password" ? "pin" : "password"
-                  );
-                  setSecureTextEntry(false);
-                  setImmediate(() => {
-                    setSecureTextEntry(true);
-                  });
-                }}
-                style={{
-                  width: 25,
-                  height: 25,
-                  marginRight: 5
-                }}
-                size={SIZE.lg}
-              />
+              accountPass ? null : (
+                <IconButton
+                  name={keyboardType === "password" ? "numeric" : "keyboard"}
+                  onPress={() => {
+                    setKeyboardType(
+                      keyboardType === "password" ? "pin" : "password"
+                    );
+                    setSecureTextEntry(false);
+                    setImmediate(() => {
+                      setSecureTextEntry(true);
+                    });
+                  }}
+                  style={{
+                    width: 25,
+                    height: 25,
+                    marginRight: 5
+                  }}
+                  size={SIZE.lg}
+                />
+              )
             }
             placeholder={
-              mode === "change"
+              accountPass
+                ? "Account password"
+                : mode === "change"
                 ? `New ${keyboardType}`
                 : `${keyboardType === "pin" ? "Pin" : "Password"}`
             }
@@ -222,6 +234,36 @@ export const AppLockPassword = () => {
               placeholder={`Confirm ${keyboardType}`}
             />
           ) : null}
+
+          {mode === "remove" ? (
+            <>
+              <Button
+                icon={
+                  accountPass ? "checkbox-marked" : "checkbox-blank-outline"
+                }
+                onPress={() => {
+                  setSecureTextEntry(false);
+                  setAccountPass(!accountPass);
+                  setTimeout(() => {
+                    setSecureTextEntry(true);
+                  });
+                }}
+                iconSize={SIZE.lg}
+                type="plain"
+                iconColor={
+                  accountPass ? colors.primary.accent : colors.primary.icon
+                }
+                title="Use account password instead"
+                style={{
+                  width: "100%",
+                  alignSelf: "flex-start",
+                  justifyContent: "flex-start",
+                  paddingHorizontal: 0,
+                  height: 30
+                }}
+              />
+            </>
+          ) : null}
         </View>
 
         <DialogButtons
@@ -249,7 +291,8 @@ export const AppLockPassword = () => {
                 );
                 return;
               }
-              await setAppLockVerificationCipher(values.current.password);
+              const password = values.current.password;
+              setAppLockVerificationCipher(password);
               SettingsService.setProperty("appLockHasPasswordSecurity", true);
             } else if (mode === "change") {
               if (
@@ -277,7 +320,6 @@ export const AppLockPassword = () => {
                 );
                 return;
               }
-
               const isCurrentPasswordCorrect = await validateAppLockPassword(
                 values.current.currentPassword
               );
@@ -293,8 +335,10 @@ export const AppLockPassword = () => {
                 return;
               }
 
+              const password = values.current.password;
+              await clearAppLockVerificationCipher();
               SettingsService.setProperty("appLockHasPasswordSecurity", true);
-              await setAppLockVerificationCipher(values.current.password);
+              await setAppLockVerificationCipher(password);
             } else if (mode === "remove") {
               if (!values.current.password) {
                 ToastManager.error(
@@ -305,14 +349,18 @@ export const AppLockPassword = () => {
                 return;
               }
 
-              const isCurrentPasswordCorrect = await validateAppLockPassword(
-                values.current.password
-              );
+              const isCurrentPasswordCorrect = accountPass
+                ? await db.user.verifyPassword(values.current.password)
+                : await validateAppLockPassword(values.current.password);
 
               if (!isCurrentPasswordCorrect) {
                 ToastManager.error(
                   new Error(
-                    `${keyboardType === "pin" ? "Pin" : "Password"} incorrect`
+                    accountPass
+                      ? "Account password incorrect"
+                      : `${
+                          keyboardType === "pin" ? "Pin" : "Password"
+                        } incorrect`
                   ),
                   undefined,
                   "local"
@@ -342,7 +390,9 @@ export const AppLockPassword = () => {
 
             close();
           }}
-          positiveTitle="Save"
+          positiveTitle={
+            mode === "remove" ? "Remove" : mode === "change" ? "Change" : "Save"
+          }
           negativeTitle="Cancel"
           positiveType="transparent"
           loading={false}

apps/mobile/app/screens/settings/functions.js

@@ -90,13 +90,26 @@ export async function verifyUserWithApplock() {
         positiveText: "Verify",
         secureTextEntry: true,
         negativeText: "Cancel",
+        keyboardType: keyboardType,
         positivePress: async (value) => {
           try {
             const verified = await validateAppLockPassword(value);
+            if (!verified) {
+              ToastManager.show({
+                heading: `Invalid ${
+                  keyboardType === "numeric" ? "pin" : "password"
+                }`,
+                type: "error",
+                context: "local"
+              });
+              return false;
+            }
             resolve(verified);
           } catch (e) {
             resolve(false);
+            return false;
           }
+          return true;
         }
       });
     } else {

apps/mobile/app/screens/settings/settings-data.tsx

@@ -871,6 +871,9 @@ export const settingsGroups: SettingSection[] = [
             type: "switch",
             property: "appLockEnabled",
             onChange: () => {
+              SettingsService.set({
+                privacyScreen: true
+              });
               SettingsService.setPrivacyScreen(SettingsService.get());
             },
             onVerify: async () => {
@@ -973,7 +976,7 @@ export const settingsGroups: SettingSection[] = [
                 SettingsService.getProperty("applockKeyboardType") === "numeric"
                   ? "pin"
                   : "password"
-              }, app lock will fallback to using account password to unlock the app`,
+              }, app lock will be disabled if no other security method is enabled.`,
             hidden: () => {
               return !SettingsService.getProperty("appLockHasPasswordSecurity");
             },

apps/mobile/app/services/settings.ts

@@ -76,6 +76,17 @@ function migrateAppLock() {
   DatabaseLogger.debug("App lock Migrated");
 }
 
+function migrateSettings(settings: SettingStore["settings"]) {
+  const version = settings.settingsVersion;
+  if (!version) {
+    settings.settingsVersion = 1;
+    settings.privacyScreen = settings.appLockEnabled
+      ? true
+      : settings.privacyScreen;
+    MMKV.setString("appSettings", JSON.stringify(settings));
+  }
+}
+
 function init() {
   scale.fontScale = 1;
   const settingsJson = MMKV.getString("appSettings");
@@ -83,14 +94,17 @@ function init() {
   if (!settingsJson) {
     MMKV.setString("appSettings", JSON.stringify(settings));
   } else {
+    const settingsParsed = JSON.parse(settingsJson);
+    migrateSettings(settingsParsed);
     settings = {
       ...settings,
-      ...JSON.parse(settingsJson)
+      ...settingsParsed
     };
   }
   if (settings.fontScale) {
     scale.fontScale = settings.fontScale;
   }
+
   setTimeout(() => setPrivacyScreen(settings), 1);
   updateSize();
   useSettingStore.getState().setSettings({ ...settings });
@@ -98,7 +112,7 @@ function init() {
 }
 
 function setPrivacyScreen(settings: SettingStore["settings"]) {
-  if (settings.privacyScreen || settings.appLockEnabled) {
+  if (settings.privacyScreen) {
     if (Platform.OS === "android") {
       NotesnookModule.setSecureMode(true);
     } else {

apps/mobile/app/stores/use-setting-store.ts

@@ -81,6 +81,7 @@ export type Settings = {
   biometricsAuthEnabled?: boolean;
   backgroundSync?: boolean;
   applockKeyboardType: "numeric" | "default";
+  settingsVersion?: number;
 };
 
 type DimensionsType = {
@@ -169,7 +170,8 @@ export const defaultSettings: SettingStore["settings"] = {
   markdownShortcuts: true,
   biometricsAuthEnabled: false,
   appLockHasPasswordSecurity: false,
-  backgroundSync: true
+  backgroundSync: true,
+  settingsVersion: 0
 };
 
 export const useSettingStore = create<SettingStore>((set, get) => ({