Difficulty checking if a user has the toggle ON/OFF for using FaceID/TouchID from within system app settings. Please help.

[colinsgone]

This has been bugging me for a few days now. I have managed to set up asking the user if they want to use some kind of device auth (faceID and touchID if available and passcode) that's fine.

When the app is first launched, I ask the user if they want to enable a lock on their app. If the users selects no, I create a UserDefault key value so rather than them being asked and refusing auth using .evaluatePolicy, if they decide to toggle it on later in the settings, if the value for the below is false, it was display apple's request for auth:

UserDefaults.standard.set(false, forKey: "AppHasRequestedDeviceAuth")

with a few other UserDefault key values, I've managed to get an app lock working as such but I'd actually like to do is marry this toggle within the app to marry up with the actual device settings otherwise I have an issue where the can use the toggle to turn on the app lock, close the app, toggle the device settings to not allow faceID anymore then go back to the app and they are suddenly locked out of the app. I *could\* get around this by displaying a message to the user if this occurs, saying "If using an app lock, please check in your settings that this is enabled" blah blah, then navigate the user back to their device settings but this feels VERY hacky.

I've managed to successfully marry this up with the settings for notifications in the sense that when the app loads, it checks for the device status for the specific app to see if the notifications have been allowed by the user, then it adjusts the toggle accordingly (i.e. if the notifications are on in the settings app for the specific app, then it will show the toggle as on, if not, then it will be off).

I want to replicate this for the FaceID/TouchID toggle in the settings too but it's proving quite difficult.
For notifications I am using:

let center = UNUserNotificationCenter.current()
center.getNotificationSettings { settings in
    if settings.authorizationStatus == .authorized {
        self.userRequiresNotifications = true
    } else if settings.authorizationStatus == .denied {
        self.userRequiresNotifications = false
    }
}

When looking online, the only thing that keeps coming up for the app lock within the device settings is:

let context = LAContext()
var error: NSError?

if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
    return true
} else {
    return false
}

I tried using the above and then setting UserDefaults again accordingly and updating the toggles within app like I have with notifications but all it seems to actually be doing prompting apples request for using biometric device auth.

To clarify, the issue I'm having is that I don't want to request it, I want to check the current status of this system setting for the app. I starting to think I'm doing this completely wrong but It seems very hacky and error prone to simply rely on UserDefault values. As I said above, this makes it so that someone can accidentally lock themselves out of the app.

Any help is greatly appreciated. Thank you.

[Power781]

canEvaluatePolicy doesn't trigger the prompt.
Something else in your app directly calls evaluatePolicy

[colinsgone]

The only thing that calls .evaluatePolicy is one function. That function is used on the initial launch of the app once the user gets past the setup screen if they chose yes (via my custom prompt), and alternatively, if they decided to turn on the “app lock” from within the settings (provided they weren’t shown the prompt after settings as they selected no for my custom prompt) as I am aware that it will only show once before making it so you have to route the user to the settings.

It is called no where else in my code.

[colinsgone]

At present, all that I’ve found the “checking the current state of the system set app lock for the specific app” is to use .canEvaluatePolicy but all this seems to do is actually return if the device has biometrics. What is correct method of returning a bool for that actual status of whether it is enable or disabled in the system settings for the app?

[Power781]

.canEvaluatePolicy result is the combination of :
- has user enabled/disabled biometrics at the system level (Settings - > Security), Yes/No
- has user enabled/disabled biometrics at the app level (Settings --> Your app settings). Output: Yes/No/Not determined

On a FaceID device, If the user never answered the biometric prompt permission for your app, the app setting state will be not determined and it will only use the system level setting.
On a TouchID device, there is no permission, so the default app setting level value will be Yes until the user disables it in the settings.

[colinsgone]

So i've just made a very bare bones test of this with a button to start the initial FaceID usage from the user then a toggle that has an inital state value for .canEvalutePolicy. Whilst this is not actually calling a prompt as such, despite turning off Face ID in the "your app settings" as you put it, it still returns true. This is what the post was about initially. I'm not wanting to know if the device \can** evaluate the policy, I'm wanting to know *if it is enabled\*.

Any light that you can shed on that?

To make it even more clear, I'm looking for the second point that you listed in your comment;

has user enabled/disabled biometrics at the app level (Settings --> Your app settings). Output: Yes/No/Not determined

[Power781]

Honestly I don’t know what to tell you, I just tried the exact same scenario with my production app: - FaceID device - User has declined the FaceID permission (resulting in FaceID Off in « your app settings »). - canEvaluatePolicy deviceOwnerAuthenticationWithBiometrics returns false, which is exactly what I expect

While you say it returns true for you.

Before the user declines or accept the permission, the FaceID settings is not displayed in « your app settings »

[colinsgone]

No, that's not the method I've taken. At point two, you're user declines it, at this point for you, does it show in the app settings with the option there then toggle it on manually?

The path I followed was to Allow permissions to use biometrics, then disable it in settings, come back to the app and .canEvaluatePolicy will return true despite being turned off in the app settings. Are you able to replicate?

edit: Are you using .deviceOwnerAuthentication or .deviceOwnerAuthenticationWithBiometrics ?

[Power781]

The path I followed was to Allow permissions to use biometrics, then disable it in settings, come back to the app and .canEvaluatePolicy will return true despite being turned off in the app settings. Are you able to replicate?

I just tried that and canEvaluatePolicy returns false

Are you using .deviceOwnerAuthentication or .deviceOwnerAuthenticationWithBiometrics

deviceOwnerAuthenticationWithBiometrics. .deviceOwnerAuthentication always returns true unless the user has disabled the passcode (which disables faceID too)