From 258ba516c9c698abcd6c9e40d2bdce0c2ad388f4 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Mon, 1 Sep 2025 17:59:10 +0200
Subject: [PATCH] Invert setting

---
 .../desktop_native/core/src/biometric/windows.rs   |  2 +-
 .../src/app/accounts/settings.component.html       |  8 ++++----
 .../desktop/src/app/accounts/settings.component.ts | 14 ++++++++------
 apps/desktop/src/locales/en/messages.json          |  4 ++--
 4 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/apps/desktop/desktop_native/core/src/biometric/windows.rs b/apps/desktop/desktop_native/core/src/biometric/windows.rs
index 03a420296d2..881075ef29f 100644
--- a/apps/desktop/desktop_native/core/src/biometric/windows.rs
+++ b/apps/desktop/desktop_native/core/src/biometric/windows.rs
@@ -142,7 +142,7 @@ impl super::BiometricTrait for BiometricLockSystem {
     }
 
     async fn unlock(&self, user_id: &str, _hwnd: Vec<u8>) -> Result<Vec<u8>> {
-        // Allow restoring focus to the previous window (broweser)
+        // Allow restoring focus to the previous window (browser)
         let previous_active_window = super::windows_focus::get_active_window();
         let _focus_scopeguard = scopeguard::guard((), |_| {
             if let Some(hwnd) = previous_active_window {
diff --git a/apps/desktop/src/app/accounts/settings.component.html b/apps/desktop/src/app/accounts/settings.component.html
index d97ec894540..a7596f47e0e 100644
--- a/apps/desktop/src/app/accounts/settings.component.html
+++ b/apps/desktop/src/app/accounts/settings.component.html
@@ -83,13 +83,13 @@
               </div>
               <div class="form-group" *ngIf="this.form.value.biometric && this.isWindows">
                 <div class="checkbox form-group-child">
-                  <label for="allowBiometricUnlockOnAppRestart">
+                  <label for="requireMasterPasswordOnAppRestart">
                     <input
-                      id="allowBiometricUnlockOnAppRestart"
+                      id="requireMasterPasswordOnAppRestart"
                       type="checkbox"
-                      formControlName="allowBiometricUnlockOnAppRestart"
+                      formControlName="requireMasterPasswordOnAppRestart"
                     />
-                    {{ "allowBiometricUnlockOnAppRestart" | i18n }}
+                    {{ "requireMasterPasswordOnAppRestart" | i18n }}
                   </label>
                 </div>
               </div>
diff --git a/apps/desktop/src/app/accounts/settings.component.ts b/apps/desktop/src/app/accounts/settings.component.ts
index c7fbecd5300..dcf9e5fe477 100644
--- a/apps/desktop/src/app/accounts/settings.component.ts
+++ b/apps/desktop/src/app/accounts/settings.component.ts
@@ -136,7 +136,7 @@ export class SettingsComponent implements OnInit, OnDestroy {
     vaultTimeoutAction: [VaultTimeoutAction.Lock],
     pin: [null as boolean | null],
     biometric: false,
-    allowBiometricUnlockOnAppRestart: false,
+    requireMasterPasswordOnAppRestart: true,
     autoPromptBiometrics: false,
     // Account Preferences
     clearClipboard: [null],
@@ -351,9 +351,9 @@ export class SettingsComponent implements OnInit, OnDestroy {
       ),
       pin: this.userHasPinSet,
       biometric: await this.vaultTimeoutSettingsService.isBiometricLockSet(),
-      allowBiometricUnlockOnAppRestart: await this.biometricsService.hasPersistentKey(
+      requireMasterPasswordOnAppRestart: !(await this.biometricsService.hasPersistentKey(
         activeAccount.id,
-      ),
+      )),
       autoPromptBiometrics: await firstValueFrom(this.biometricStateService.promptAutomatically$),
       clearClipboard: await firstValueFrom(this.autofillSettingsService.clearClipboardDelay$),
       minimizeOnCopyToClipboard: await firstValueFrom(this.desktopSettingsService.minimizeOnCopy$),
@@ -446,15 +446,17 @@ export class SettingsComponent implements OnInit, OnDestroy {
         takeUntil(this.destroy$),
       )
       .subscribe();
-    this.form.controls.allowBiometricUnlockOnAppRestart.valueChanges
+    this.form.controls.requireMasterPasswordOnAppRestart.valueChanges
       .pipe(
-        concatMap(async (enabled) => {
+        concatMap(async (requireMasterPassword) => {
           const userKey = await firstValueFrom(this.keyService.userKey$(activeAccount.id));
-          if (enabled) {
+          if (!requireMasterPassword) {
+            // Allow biometric unlock on app restart
             if (!(await this.biometricsService.hasPersistentKey(activeAccount.id))) {
               await this.biometricsService.enrollPersistent(activeAccount.id, userKey);
             }
           } else {
+            // Require master password on app restart
             await this.biometricsService.deleteBiometricUnlockKeyForUser(activeAccount.id);
             await this.biometricsService.setBiometricProtectedUnlockKeyForUser(
               activeAccount.id,
diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index a7293dcd2d0..6f86389572a 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -1846,8 +1846,8 @@
   "lockWithMasterPassOnRestart1": {
     "message": "Lock with master password on restart"
   },
-  "allowBiometricUnlockOnAppRestart": {
-    "message": "Allow biometric unlock for the first unlock after restarting the app"
+  "requireMasterPasswordOnAppRestart": {
+    "message": "Require master password or PIN on app restart"
   },
   "deleteAccount": {
     "message": "Delete account"