Skip to content

fix: Preserve password settings when device auth enrollment cannot open - #9546

Open
mvanhorn wants to merge 1 commit into
duckduckgo:developfrom
mvanhorn:fix/8365-preserve-password-settings-screen
Open

fix: Preserve password settings when device auth enrollment cannot open#9546
mvanhorn wants to merge 1 commit into
duckduckgo:developfrom
mvanhorn:fix/8365-preserve-password-settings-screen

Conversation

@mvanhorn

@mvanhorn mvanhorn commented Aug 20, 2026

Copy link
Copy Markdown

Task/Issue URL:
Tech Design URL (if applicable):
API Proposals URL(s) (if applicable):

Description

Update the existing CTA handler in AutofillManagementDisabledMode so launching the enrollment intent no longer unconditionally finishes the host activity. Keeping the activity alive lets Android Settings appear normally on capable devices and leaves the disabled-state explanation available when enrollment is unavailable or returns immediately; the activity's existing lifecycle checks can refresh capability state when the user comes back. Add a Robolectric regression test around the production fragment and CTA that verifies the appropriate settings intent is launched while the host activity remains open, including the API 30 path matching the report.

On BlueStacks and other devices without usable biometric or device-credential enrollment, the Passwords/Autofill disabled-state CTA launches Android's biometric enrollment activity, which can return immediately without changing any settings. AutofillManagementDisabledMode then unconditionally finishes its host activity, leaving the user outside the screen with no progress and no useful recovery path. A maintainer confirmed this dismissal as an app-side bug while noting that supporting Sync or password storage without device authentication is a separate, harder security problem. This plan fixes only the confirmed navigation defect and keeps the existing authentication requirement intact.

Fixes #8365

Steps to test this PR

  • [ ]
  • [ ]
  • On API 30 with a non-special-cased manufacturer, tapping Set up in Settings launches ACTION_BIOMETRIC_ENROLL and does not finish the host activity. - When the launched enrollment activity returns immediately without enrolling authentication, the Passwords/Autofill disabled screen remains available instead of navigating the user away. - Existing manufacturer and older-API intent selection and fallback behavior remain unchanged; the regression test should assert only the affected API 30 navigation contract rather than duplicate every intent-routing branch.

UI changes

Before After
!(Upload before screenshot) (Upload after screenshot)

Note

Low Risk
Small navigation fix in autofill UI with no changes to auth requirements, credential storage, or enrollment intent selection.

Overview
Fixes a navigation bug on the Passwords/Autofill disabled screen when users tap Set up in Settings to open device authentication enrollment.

AutofillManagementDisabledMode no longer calls requireActivity().finish() after starting the enrollment/settings intent. The host activity stays open so users can return to the disabled-state explanation when enrollment is unavailable or returns immediately (e.g. BlueStacks), instead of being dismissed with no recovery path. Manufacturer-specific intent routing and settings fallbacks are unchanged.

Adds a Robolectric regression test on API 30 that verifies ACTION_BIOMETRIC_ENROLL is started and the host activity is not finishing.

Reviewed by Cursor Bugbot for commit 8f62a58. Bugbot is set up for automated code reviews on this repo. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Sync and Password settings require device security, not available in all devices

1 participant