[Question] why cipher cannot be used if `authenticationValidityDurationSeconds` is not -1?

[abdallah-odeh]

You have this code block in your repo

 if (cipher == null || options.authenticationValidityDurationSeconds >= 0) {
  // if authenticationValidityDurationSeconds is not -1 we can't use a CryptoObject
  logger.debug { "Authenticating without cipher. ${options.authenticationValidityDurationSeconds}" }
  prompt.authenticate(promptBuilder.build())
} else {
  prompt.authenticate(promptBuilder.build(), BiometricPrompt.CryptoObject(cipher))
}

so why cipher is ignored if the duration is over zero?

[hpoul]

this is actually kind of documented in https://pub.dev/documentation/biometric_storage/latest/biometric_storage/StorageFileInitOptions/androidBiometricOnly.html

which references https://github.com/authpass/biometric_storage/issues/12#issuecomment-902508609 .. hope that answers that question.