From 6d5419964b8bca50b659f58996003de934df0499 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ma=C3=ABl=20Chiotti?=
 <44336112+maelchiotti@users.noreply.github.com>
Date: Fri, 29 May 2026 23:55:02 +0200
Subject: [PATCH] fix: ask for authentication when required (toggling lock
 state, deleting locked label, toggling lock preference...)

---
 lib/common/actions/authentication.dart        | 53 ++++++++++++++++++
 lib/common/actions/labels/delete.dart         | 28 ++++++++++
 lib/common/actions/labels/lock.dart           | 15 ++---
 lib/common/actions/notes/lock.dart            | 28 +++-------
 .../swipe_actions/available_swipe_action.dart |  2 +-
 lib/models/label/label.dart                   | 11 +++-
 lib/models/note/note.dart                     | 12 ++++
 lib/pages/editor/editor_page.dart             |  8 +--
 lib/pages/lock/lock_page.dart                 | 44 +--------------
 .../pages/settings_security_page.dart         | 56 ++++++++++++++++---
 10 files changed, 169 insertions(+), 88 deletions(-)
 create mode 100644 lib/common/actions/authentication.dart

diff --git a/lib/common/actions/authentication.dart b/lib/common/actions/authentication.dart
new file mode 100644
index 00000000..2cde58c0
--- /dev/null
+++ b/lib/common/actions/authentication.dart
@@ -0,0 +1,53 @@
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+import 'package:local_auth/local_auth.dart';
+import 'package:restart_app/restart_app.dart';
+
+import '../constants/constants.dart';
+import '../extensions/build_context_extension.dart';
+import '../preferences/preference_key.dart';
+import '../ui/snack_bar_utils.dart';
+
+/// Asks the user to authenticate for the specified [reason] using the device lock method.
+Future<bool> authenticate(BuildContext context, {required String reason}) async {
+  final localAuthentication = LocalAuthentication();
+
+  final canAuthenticate = await localAuthentication.isDeviceSupported();
+
+  // If the device has no authentication methods available,
+  // disable the app lock and restart it to remove the lock screen
+  if (!canAuthenticate) {
+    await PreferenceKey.lockApp.set(false);
+
+    // The Restart package crashes the app if used in debug mode
+    if (kReleaseMode) {
+      await Restart.restartApp();
+    }
+
+    return false;
+  }
+
+  bool authenticated;
+  try {
+    authenticated = await localAuthentication.authenticate(localizedReason: reason);
+  } on LocalAuthException catch (exception) {
+    if (exception.code != LocalAuthExceptionCode.userCanceled) {
+      logger.w("Authentication failed", exception);
+    }
+
+    authenticated = false;
+  }
+
+  // The authentication failed
+  if (!authenticated) {
+    if (!context.mounted) {
+      return false;
+    }
+
+    SnackBarUtils().show(context, text: context.l.snack_bar_authentication_failed);
+
+    return false;
+  }
+
+  return true;
+}
diff --git a/lib/common/actions/labels/delete.dart b/lib/common/actions/labels/delete.dart
index 6473bb59..ff65db37 100644
--- a/lib/common/actions/labels/delete.dart
+++ b/lib/common/actions/labels/delete.dart
@@ -5,6 +5,7 @@ import '../../../models/label/label.dart';
 import '../../../providers/labels/labels/labels_provider.dart';
 import '../../dialogs/confirmation_dialog.dart';
 import '../../extensions/build_context_extension.dart';
+import '../authentication.dart';
 import 'select.dart';
 
 /// Deletes the [label].
@@ -23,6 +24,19 @@ Future<bool> deleteLabel(BuildContext context, WidgetRef ref, {required Label la
     return false;
   }
 
+  if (!context.mounted) {
+    return false;
+  }
+
+  // If required, ask for authentication
+  if (label.requiresAuthentication) {
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+    if (!authenticated) {
+      return false;
+    }
+  }
+
   return await ref.read(labelsProvider.notifier).delete([label]);
 }
 
@@ -42,6 +56,20 @@ Future<bool> deleteLabels(BuildContext context, WidgetRef ref, {required List<La
     return false;
   }
 
+  if (!context.mounted) {
+    return false;
+  }
+
+  // If required, ask for authentication
+  final requiresAuthentication = labels.any((label) => label.requiresAuthentication);
+  if (requiresAuthentication) {
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+    if (!authenticated) {
+      return false;
+    }
+  }
+
   final succeeded = await ref.read(labelsProvider.notifier).delete(labels);
 
   if (context.mounted) {
diff --git a/lib/common/actions/labels/lock.dart b/lib/common/actions/labels/lock.dart
index 2d6705c7..fc4dfea1 100644
--- a/lib/common/actions/labels/lock.dart
+++ b/lib/common/actions/labels/lock.dart
@@ -1,23 +1,18 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:local_auth/local_auth.dart';
 
 import '../../../models/label/label.dart';
 import '../../../providers/labels/labels/labels_provider.dart';
 import '../../extensions/build_context_extension.dart';
-import '../../preferences/preference_key.dart';
+import '../authentication.dart';
 import 'select.dart';
 
 /// Toggles whether the [labels] are locked.
 Future<bool> toggleLockLabels(BuildContext context, WidgetRef ref, {required List<Label> labels}) async {
-  final lockLabelPreference = PreferenceKey.lockLabel.preferenceOrDefault;
-  final anyLocked = labels.any((label) => label.locked);
-
-  // If the lock label setting is enabled and a label was locked, then ask to authenticate
-  if (lockLabelPreference && anyLocked) {
-    final bool authenticated = await LocalAuthentication().authenticate(
-      localizedReason: context.l.lock_page_reason_action,
-    );
+  // If required, ask for authentication
+  final requiresAuthentication = labels.any((label) => label.requiresAuthentication);
+  if (requiresAuthentication) {
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
 
     if (!authenticated) {
       return false;
diff --git a/lib/common/actions/notes/lock.dart b/lib/common/actions/notes/lock.dart
index 6be84d40..df4e65a9 100644
--- a/lib/common/actions/notes/lock.dart
+++ b/lib/common/actions/notes/lock.dart
@@ -1,35 +1,23 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:local_auth/local_auth.dart';
 
 import '../../../models/note/note.dart';
 import '../../../models/note/note_status.dart';
 import '../../../providers/notes/notes_provider.dart';
 import '../../../providers/notifiers/notifiers.dart';
 import '../../extensions/build_context_extension.dart';
-import '../../preferences/preference_key.dart';
+import '../authentication.dart';
 import 'select.dart';
 
 /// Toggles whether the [notes] are locked.
-Future<bool> toggleLockNotes(
-  BuildContext context,
-  WidgetRef ref, {
-  required List<Note> notes,
-  bool requireAuthentication = false,
-}) async {
-  if (requireAuthentication) {
-    final lockNotePreference = PreferenceKey.lockNote.preferenceOrDefault;
-    final anyLocked = notes.any((note) => note.locked);
+Future<bool> toggleLockNotes(BuildContext context, WidgetRef ref, {required List<Note> notes}) async {
+  // If required, ask for authentication
+  final requiresAuthentication = notes.any((note) => note.requiresAuthentication);
+  if (requiresAuthentication) {
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
 
-    // If the lock note setting is enabled and a note was locked, then ask to authenticate
-    if (lockNotePreference && anyLocked) {
-      final bool authenticated = await LocalAuthentication().authenticate(
-        localizedReason: context.l.lock_page_reason_action,
-      );
-
-      if (!authenticated) {
-        return false;
-      }
+    if (!authenticated) {
+      return false;
     }
   }
 
diff --git a/lib/common/preferences/enums/swipe_actions/available_swipe_action.dart b/lib/common/preferences/enums/swipe_actions/available_swipe_action.dart
index 555afd7d..7fa7866f 100644
--- a/lib/common/preferences/enums/swipe_actions/available_swipe_action.dart
+++ b/lib/common/preferences/enums/swipe_actions/available_swipe_action.dart
@@ -186,7 +186,7 @@ enum AvailableSwipeAction {
         return false;
       case lock:
       case unlock:
-        await toggleLockNotes(context, ref, notes: [note], requireAuthentication: true);
+        await toggleLockNotes(context, ref, notes: [note]);
         return false;
       case archive:
         return await archiveNote(context, ref, note: note);
diff --git a/lib/models/label/label.dart b/lib/models/label/label.dart
index 9e58bc72..afac9b51 100644
--- a/lib/models/label/label.dart
+++ b/lib/models/label/label.dart
@@ -3,6 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:isar_community/isar.dart';
 import 'package:json_annotation/json_annotation.dart';
 
+import '../../common/preferences/preference_key.dart';
 import '../note/note.dart';
 
 part 'label.g.dart';
@@ -46,6 +47,14 @@ class Label extends Equatable implements Comparable<Label> {
   @JsonKey(defaultValue: false)
   bool locked;
 
+  /// Whether the label requires authentication to be accessed.
+  @ignore
+  bool get requiresAuthentication {
+    final lockLabel = PreferenceKey.lockLabel.preferenceOrDefault;
+
+    return lockLabel && locked;
+  }
+
   /// Whether the note is selected.
   ///
   /// Excluded from JSON because it's only needed temporarily during multi-selection.
@@ -70,7 +79,7 @@ class Label extends Equatable implements Comparable<Label> {
   }
 
   /// Default constructor of a label.
-  Label({required this.name, required this.colorHex}) : visible = true, pinned = false, locked = true;
+  Label({required this.name, required this.colorHex}) : visible = true, pinned = false, locked = false;
 
   /// Label from [json] data.
   factory Label.fromJson(Map<String, dynamic> json) => _$LabelFromJson(json);
diff --git a/lib/models/note/note.dart b/lib/models/note/note.dart
index 8b655eaf..2dbd4c2c 100644
--- a/lib/models/note/note.dart
+++ b/lib/models/note/note.dart
@@ -169,6 +169,18 @@ sealed class Note implements Comparable<Note> {
   @ignore
   bool get hasLockedLabel => labels.any((label) => label.locked);
 
+  /// Whether the note requires authentication to be accessed.
+  @ignore
+  bool get requiresAuthentication {
+    final lockNote = PreferenceKey.lockNote.preferenceOrDefault;
+    final lockLabel = PreferenceKey.lockLabel.preferenceOrDefault;
+
+    final shouldLockNote = lockNote && locked;
+    final shouldLockLabel = lockLabel && hasLockedLabel;
+
+    return shouldLockNote || shouldLockLabel;
+  }
+
   /// The [labels] as markdown.
   @ignore
   String get labelsAsMarkdown => '> ${labelsNamesVisibleSorted.join(', ')}';
diff --git a/lib/pages/editor/editor_page.dart b/lib/pages/editor/editor_page.dart
index 753b5514..fca4a0e5 100644
--- a/lib/pages/editor/editor_page.dart
+++ b/lib/pages/editor/editor_page.dart
@@ -71,9 +71,6 @@ class _EditorState extends ConsumerState<EditorPage> {
               return const LoadingPlaceholder();
             }
 
-            final lockNote = PreferenceKey.lockNote.preferenceOrDefault;
-            final lockLabel = PreferenceKey.lockLabel.preferenceOrDefault;
-
             final showEditorModeButton = PreferenceKey.editorModeButton.preferenceOrDefault;
             final focusTitleOnNewNote = PreferenceKey.focusTitleOnNewNote.preferenceOrDefault;
             final enableLabels = PreferenceKey.enableLabels.preferenceOrDefault;
@@ -141,10 +138,7 @@ class _EditorState extends ConsumerState<EditorPage> {
             );
 
             // If the note should not be locked, directly return the editor
-            final shouldLockNote = lockNote && currentNote.locked;
-            final shouldLockLabel = lockLabel && currentNote.hasLockedLabel;
-            final shouldLock = shouldLockNote || shouldLockLabel;
-            if (!shouldLock) {
+            if (!currentNote.requiresAuthentication) {
               return editor;
             }
 
diff --git a/lib/pages/lock/lock_page.dart b/lib/pages/lock/lock_page.dart
index 434ffe55..345a730a 100644
--- a/lib/pages/lock/lock_page.dart
+++ b/lib/pages/lock/lock_page.dart
@@ -1,15 +1,10 @@
 import 'package:after_layout/after_layout.dart';
-import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:gap/gap.dart';
-import 'package:local_auth/local_auth.dart';
-import 'package:restart_app/restart_app.dart';
 
+import '../../common/actions/authentication.dart';
 import '../../common/constants/sizes.dart';
-import '../../common/extensions/build_context_extension.dart';
-import '../../common/preferences/preference_key.dart';
-import '../../common/ui/snack_bar_utils.dart';
 import '../../common/widgets/asset.dart';
 import '../../l10n/app_localizations/app_localizations.g.dart';
 import '../../providers/notifiers/lock_notifier.dart';
@@ -42,15 +37,6 @@ class LockPage extends ConsumerStatefulWidget {
 }
 
 class _LockPageState extends ConsumerState<LockPage> with AfterLayoutMixin<LockPage> {
-  late final LocalAuthentication localAuthentication;
-
-  @override
-  void initState() {
-    super.initState();
-
-    localAuthentication = LocalAuthentication();
-  }
-
   @override
   Future<void> afterFirstLayout(BuildContext context) async {
     final l = AppLocalizations.of(context);
@@ -61,35 +47,9 @@ class _LockPageState extends ConsumerState<LockPage> with AfterLayoutMixin<LockP
 
   /// Asks the user to authenticate to unlock the application.
   Future<void> unlock(AppLocalizations l) async {
-    final canAuthenticate = await localAuthentication.isDeviceSupported();
-
-    // If the device has no authentication methods available,
-    // then disable the app lock and restart it to remove the lock screen
-    if (!canAuthenticate) {
-      await PreferenceKey.lockApp.set(false);
-
-      // The Restart package crashes the app if used in debug mode
-      if (kReleaseMode) {
-        await Restart.restartApp();
-      }
-
-      return;
-    }
+    final bool authenticated = await authenticate(context, reason: widget.reason);
 
-    final bool authenticated = await localAuthentication.authenticate(localizedReason: widget.reason);
-
-    // The authentication failed
     if (!authenticated) {
-      if (!mounted) {
-        return;
-      }
-
-      SnackBarUtils().show(context, text: context.l.snack_bar_authentication_failed);
-
-      return;
-    }
-
-    if (!mounted) {
       return;
     }
 
diff --git a/lib/pages/settings/pages/settings_security_page.dart b/lib/pages/settings/pages/settings_security_page.dart
index 5c2b8878..05313a4d 100644
--- a/lib/pages/settings/pages/settings_security_page.dart
+++ b/lib/pages/settings/pages/settings_security_page.dart
@@ -4,6 +4,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:local_auth/local_auth.dart';
 import 'package:settings_tiles/settings_tiles.dart';
 
+import '../../../common/actions/authentication.dart';
 import '../../../common/constants/constants.dart';
 import '../../../common/constants/paddings.dart';
 import '../../../common/extensions/build_context_extension.dart';
@@ -44,6 +45,15 @@ class _SettingsBehaviorPageState extends ConsumerState<SettingsSecurityPage> {
 
   /// Toggles whether the application is locked to [toggled].
   Future<void> toggledLockApp(bool toggled) async {
+    // If the lock is being disabled, ask for authentication
+    if (!toggled) {
+      final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+      if (!authenticated) {
+        return;
+      }
+    }
+
     await PreferenceKey.lockApp.set(toggled);
 
     lockAppNotifier.value = toggled;
@@ -55,8 +65,31 @@ class _SettingsBehaviorPageState extends ConsumerState<SettingsSecurityPage> {
     setState(() {});
   }
 
+  /// Sets the application lock delay to [delay].
+  Future<void> submittedLockAppDelay(double delay) async {
+    // Ask for authentication
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+    if (!authenticated) {
+      return;
+    }
+
+    setState(() {
+      PreferenceKey.lockAppDelay.set(delay.toInt());
+    });
+  }
+
   /// Toggles whether the notes can be locked to [toggled].
   Future<void> toggledLockNote(bool toggled) async {
+    // If the lock is being disabled, ask for authentication
+    if (!toggled) {
+      final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+      if (!authenticated) {
+        return;
+      }
+    }
+
     await PreferenceKey.lockNote.set(toggled);
 
     // If the note lock is disabled and the available swipe actions are 'Lock / Unlock', set them to disabled
@@ -83,20 +116,29 @@ class _SettingsBehaviorPageState extends ConsumerState<SettingsSecurityPage> {
 
   /// Toggles whether the labels can be locked to [toggled].
   Future<void> toggledLockLabel(bool toggled) async {
+    // If the lock is being disabled, ask for authentication
+    if (!toggled) {
+      final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+      if (!authenticated) {
+        return;
+      }
+    }
+
     await PreferenceKey.lockLabel.set(toggled);
 
     setState(() {});
   }
 
-  /// Sets the application lock delay to [delay].
-  Future<void> submittedLockAppDelay(double delay) async {
-    setState(() {
-      PreferenceKey.lockAppDelay.set(delay.toInt());
-    });
-  }
-
   /// Sets the note lock delay to [delay].
   Future<void> submittedLockNoteDelay(double delay) async {
+    // Ask for authentication
+    final authenticated = await authenticate(context, reason: context.l.lock_page_reason_action);
+
+    if (!authenticated) {
+      return;
+    }
+
     setState(() {
       PreferenceKey.lockNoteDelay.set(delay.toInt());
     });