fix(app): secrets are kept out of screenshots and the recent apps

The recovery phrase, recovery codes and an authenticator's QR code and
key now show inside a SecretScreen: on Android it holds FLAG_SECURE while
it shows (through a channel each app's MainActivity answers, counting
holds, as several may show at once; ScreenGuard.kt), so screenshots,
screen recordings and the recents view don't get them; on iOS, which has
no such flag, it covers them while the app isn't in front, so the app
switcher's picture doesn't hold them (Dart-side, not checked on a device).
Desktops do neither: a window loses focus whenever its person turns to a
password manager. Todo's debug APK builds with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/halkyon_app.dart

@@ -90,6 +90,7 @@ export 'src/password/widget/password_sign_in_sheet.dart';
 export 'src/password/widget/password_texts.dart';
 export 'src/password/widget/password_widgets.dart';
 export 'src/password/widget/secret_clipboard.dart';
+export 'src/password/widget/secret_screen.dart';
 export 'src/person/person_folders.dart';
 export 'src/sync/app_compatibility.dart';
 export 'src/sync/bloc/sync_status_bloc.dart';

packages/halkyon_app/lib/src/password/widget/password_widgets.dart

@@ -7,6 +7,7 @@ import 'package:halkyon_app/src/app/app_scope.dart';
 import 'package:halkyon_app/src/password/model/account_authenticator.dart';
 import 'package:halkyon_app/src/password/model/phrase_check.dart';
 import 'package:halkyon_app/src/password/widget/secret_clipboard.dart';
+import 'package:halkyon_app/src/password/widget/secret_screen.dart';
 import 'package:halkyon_keys/halkyon_keys.dart' show newPasswordMinLength;
 import 'package:halkyon_ui/halkyon_ui.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
@@ -292,71 +293,74 @@ class const RecoveryPhraseView({required final String phrase, super.key})
   Widget build(BuildContext context) {
     final theme = Theme.of(context);
     final words = wordsOf(phrase);
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.stretch,
-      children: [
-        DecoratedBox(
-          decoration: BoxDecoration(
-            color: theme.colorScheme.surfaceContainerHighest,
-            borderRadius: BorderRadius.circular(12),
-          ),
-          child: Padding(
-            padding: const EdgeInsets.all(12),
-            child: LayoutBuilder(
-              builder: (context, constraints) {
-                final columns = constraints.maxWidth >= 480 ? 4 : 2;
-                final rows = (words.length / columns).ceil();
-                return Row(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    for (var column = 0; column < columns; column++)
-                      Expanded(
-                        child: Column(
-                          crossAxisAlignment: CrossAxisAlignment.start,
-                          children: [
-                            for (
-                              var i = column * rows;
-                              i < (column + 1) * rows && i < words.length;
-                              i++
-                            )
-                              Padding(
-                                padding: const EdgeInsets.symmetric(
-                                  vertical: 2,
-                                ),
-                                child: Text.rich(
-                                  TextSpan(
-                                    children: [
-                                      TextSpan(
-                                        text: '${i + 1}. ',
-                                        style: TextStyle(
-                                          color: theme
-                                              .colorScheme
-                                              .onSurfaceVariant,
-                                        ),
-                                      ),
-                                      TextSpan(text: words[i]),
-                                    ],
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.stretch,
+        children: [
+          DecoratedBox(
+            decoration: BoxDecoration(
+              color: theme.colorScheme.surfaceContainerHighest,
+              borderRadius: BorderRadius.circular(12),
+            ),
+            child: Padding(
+              padding: const EdgeInsets.all(12),
+              child: LayoutBuilder(
+                builder: (context, constraints) {
+                  final columns = constraints.maxWidth >= 480 ? 4 : 2;
+                  final rows = (words.length / columns).ceil();
+                  return Row(
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    children: [
+                      for (var column = 0; column < columns; column++)
+                        Expanded(
+                          child: Column(
+                            crossAxisAlignment: CrossAxisAlignment.start,
+                            children: [
+                              for (
+                                var i = column * rows;
+                                i < (column + 1) * rows && i < words.length;
+                                i++
+                              )
+                                Padding(
+                                  padding: const EdgeInsets.symmetric(
+                                    vertical: 2,
+                                  ),
+                                  child: Text.rich(
+                                    TextSpan(
+                                      children: [
+                                        TextSpan(
+                                          text: '${i + 1}. ',
+                                          style: TextStyle(
+                                            color: theme
+                                                .colorScheme
+                                                .onSurfaceVariant,
+                                          ),
+                                        ),
+                                        TextSpan(text: words[i]),
+                                      ],
+                                    ),
+                                    style: theme.textTheme.bodyLarge,
                                   ),
-                                  style: theme.textTheme.bodyLarge,
                                 ),
-                              ),
-                          ],
+                            ],
+                          ),
                         ),
-                      ),
-                  ],
-                );
-              },
+                    ],
+                  );
+                },
+              ),
             ),
           ),
-        ),
-        const SizedBox(height: 12),
-        // Saved or written down, never copied ([copySecret]).
-        KeepTextButtons(
-          text: phrase,
-          fileName: 'halkyon-recovery-phrase.txt',
-          copyable: false,
-        ),
-      ],
+          const SizedBox(height: 12),
+          // Saved or written down, never copied ([copySecret]).
+          KeepTextButtons(
+            text: phrase,
+            fileName: 'halkyon-recovery-phrase.txt',
+            copyable: false,
+          ),
+        ],
+      ),
     );
   }
 }
@@ -446,39 +450,42 @@ class const RecoveryCodesView({required final List<String> codes, super.key})
   @override
   Widget build(BuildContext context) {
     final theme = Theme.of(context);
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.stretch,
-      children: [
-        DecoratedBox(
-          decoration: BoxDecoration(
-            color: theme.colorScheme.surfaceContainerHighest,
-            borderRadius: BorderRadius.circular(12),
-          ),
-          child: Padding(
-            padding: const EdgeInsets.all(12),
-            child: Wrap(
-              spacing: 24,
-              runSpacing: 8,
-              children: [
-                // Not selectable: Copy empties the clipboard again, the
-                // system's own copy wouldn't.
-                for (final code in codes)
-                  Text(
-                    code,
-                    style: theme.textTheme.bodyLarge?.copyWith(
-                      fontFeatures: const [FontFeature.tabularFigures()],
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.stretch,
+        children: [
+          DecoratedBox(
+            decoration: BoxDecoration(
+              color: theme.colorScheme.surfaceContainerHighest,
+              borderRadius: BorderRadius.circular(12),
+            ),
+            child: Padding(
+              padding: const EdgeInsets.all(12),
+              child: Wrap(
+                spacing: 24,
+                runSpacing: 8,
+                children: [
+                  // Not selectable: Copy empties the clipboard again, the
+                  // system's own copy wouldn't.
+                  for (final code in codes)
+                    Text(
+                      code,
+                      style: theme.textTheme.bodyLarge?.copyWith(
+                        fontFeatures: const [FontFeature.tabularFigures()],
+                      ),
                     ),
-                  ),
-              ],
+                ],
+              ),
             ),
           ),
-        ),
-        const SizedBox(height: 12),
-        KeepTextButtons(
-          text: codes.join('\n'),
-          fileName: 'halkyon-recovery-codes.txt',
-        ),
-      ],
+          const SizedBox(height: 12),
+          KeepTextButtons(
+            text: codes.join('\n'),
+            fileName: 'halkyon-recovery-codes.txt',
+          ),
+        ],
+      ),
     );
   }
 }
@@ -553,108 +560,114 @@ class const AuthenticatorSetupView({
     // Only an otpauth URI is shown as a QR code or opened ([AuthenticatorSetup.isAuthenticatorUri]).
     final opens = setup.isAuthenticatorUri;
     final phone = opens && (Platform.isAndroid || Platform.isIOS);
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.stretch,
-      children: [
-        SheetIntro(l10n.passwordAuthenticatorIntro),
-        if (opens) ...[
-          Center(child: QrCodeView(data: setup.uri)),
-          const SizedBox(height: 12),
-        ],
-        Text(l10n.passwordAuthenticatorKey, style: theme.textTheme.labelLarge),
-        const SizedBox(height: 4),
-        Row(
-          children: [
-            Expanded(
-              // Not selectable: Copy empties the clipboard again.
-              child: Text(
-                setup.secret,
-                style: theme.textTheme.bodyLarge?.copyWith(
-                  fontFeatures: const [FontFeature.tabularFigures()],
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.stretch,
+        children: [
+          SheetIntro(l10n.passwordAuthenticatorIntro),
+          if (opens) ...[
+            Center(child: QrCodeView(data: setup.uri)),
+            const SizedBox(height: 12),
+          ],
+          Text(
+            l10n.passwordAuthenticatorKey,
+            style: theme.textTheme.labelLarge,
+          ),
+          const SizedBox(height: 4),
+          Row(
+            children: [
+              Expanded(
+                // Not selectable: Copy empties the clipboard again.
+                child: Text(
+                  setup.secret,
+                  style: theme.textTheme.bodyLarge?.copyWith(
+                    fontFeatures: const [FontFeature.tabularFigures()],
+                  ),
                 ),
               ),
-            ),
-            IconButton(
-              tooltip: l10n.passwordCopy,
-              icon: const Icon(LucideIcons.copy),
-              onPressed: () async {
-                final messenger = ScaffoldMessenger.maybeOf(context);
-                await copySecret(setup.secret.replaceAll(' ', ''));
-                messenger?.showSnackBar(
-                  SnackBar(content: Text(l10n.passwordCopied)),
-                );
-              },
+              IconButton(
+                tooltip: l10n.passwordCopy,
+                icon: const Icon(LucideIcons.copy),
+                onPressed: () async {
+                  final messenger = ScaffoldMessenger.maybeOf(context);
+                  await copySecret(setup.secret.replaceAll(' ', ''));
+                  messenger?.showSnackBar(
+                    SnackBar(content: Text(l10n.passwordCopied)),
+                  );
+                },
+              ),
+            ],
+          ),
+          if (phone) ...[
+            const SizedBox(height: 8),
+            Align(
+              alignment: AlignmentDirectional.centerStart,
+              child: OutlinedButton.icon(
+                icon: const Icon(LucideIcons.externalLink),
+                label: Text(l10n.passwordAuthenticatorOpen),
+                onPressed: () async {
+                  final messenger = ScaffoldMessenger.maybeOf(context);
+                  final opened = await launchUrl(
+                    Uri.parse(setup.uri),
+                    mode: LaunchMode.externalApplication,
+                  );
+                  if (!opened) {
+                    messenger?.showSnackBar(
+                      SnackBar(content: Text(l10n.passwordAuthenticatorNoApp)),
+                    );
+                  }
+                },
+              ),
             ),
           ],
-        ),
-        if (phone) ...[
-          const SizedBox(height: 8),
-          Align(
-            alignment: AlignmentDirectional.centerStart,
-            child: OutlinedButton.icon(
-              icon: const Icon(LucideIcons.externalLink),
-              label: Text(l10n.passwordAuthenticatorOpen),
-              onPressed: () async {
-                final messenger = ScaffoldMessenger.maybeOf(context);
-                final opened = await launchUrl(
-                  Uri.parse(setup.uri),
-                  mode: LaunchMode.externalApplication,
-                );
-                if (!opened) {
-                  messenger?.showSnackBar(
-                    SnackBar(content: Text(l10n.passwordAuthenticatorNoApp)),
-                  );
-                }
-              },
-            ),
-          ),
-        ],
-        const SizedBox(height: 16),
-        Text(l10n.passwordAuthenticatorCodeIntro),
-        const SizedBox(height: 8),
-        CodeField(
-          controller: code,
-          kind: CodeKind.totp,
-          enabled: enabled,
-          errorText: errorText,
-          textInputAction: password == null && existingCode == null
-              ? TextInputAction.done
-              : TextInputAction.next,
-          onSubmitted: password == null && existingCode == null
-              ? (_) => onDone?.call()
-              : null,
-        ),
-        if (password case final password?) ...[
           const SizedBox(height: 16),
-          Text(
-            existingCode == null
-                ? l10n.passwordAuthenticatorPasswordIntro
-                : l10n.passwordAuthenticatorOwnerIntro,
-          ),
-          const SizedBox(height: 8),
-          PasswordField(
-            controller: password,
-            label: l10n.passwordCurrent,
-            enabled: enabled,
-            errorText: existingCode == null ? existingErrorText : null,
-            textInputAction: existingCode == null
-                ? TextInputAction.done
-                : TextInputAction.next,
-            onSubmitted: existingCode == null ? (_) => onDone?.call() : null,
-          ),
-        ],
-        if (existingCode case final existing?) ...[
+          Text(l10n.passwordAuthenticatorCodeIntro),
           const SizedBox(height: 8),
           CodeField(
-            controller: existing,
+            controller: code,
             kind: CodeKind.totp,
-            label: l10n.passwordExistingCode,
             enabled: enabled,
-            errorText: existingErrorText,
-            onSubmitted: (_) => onDone?.call(),
+            errorText: errorText,
+            textInputAction: password == null && existingCode == null
+                ? TextInputAction.done
+                : TextInputAction.next,
+            onSubmitted: password == null && existingCode == null
+                ? (_) => onDone?.call()
+                : null,
           ),
+          if (password case final password?) ...[
+            const SizedBox(height: 16),
+            Text(
+              existingCode == null
+                  ? l10n.passwordAuthenticatorPasswordIntro
+                  : l10n.passwordAuthenticatorOwnerIntro,
+            ),
+            const SizedBox(height: 8),
+            PasswordField(
+              controller: password,
+              label: l10n.passwordCurrent,
+              enabled: enabled,
+              errorText: existingCode == null ? existingErrorText : null,
+              textInputAction: existingCode == null
+                  ? TextInputAction.done
+                  : TextInputAction.next,
+              onSubmitted: existingCode == null ? (_) => onDone?.call() : null,
+            ),
+          ],
+          if (existingCode case final existing?) ...[
+            const SizedBox(height: 8),
+            CodeField(
+              controller: existing,
+              kind: CodeKind.totp,
+              label: l10n.passwordExistingCode,
+              enabled: enabled,
+              errorText: existingErrorText,
+              onSubmitted: (_) => onDone?.call(),
+            ),
+          ],
         ],
-      ],
+      ),
     );
   }
 }

packages/halkyon_app/lib/src/password/widget/secret_screen.dart

@@ -0,0 +1,111 @@
+import 'dart:io';
+
+import 'package:flutter/services.dart';
+import 'package:material_ui/material_ui.dart';
+
+/// Keeps the window's content out of screenshots, screen recordings and
+/// the system's view of recent apps while something secret shows (the
+/// recovery phrase, recovery codes, an authenticator's key), held as each
+/// shows and released as it goes.
+abstract interface class ScreenGuard() {
+  /// One more secret shows.
+  Future<void> hold();
+
+  /// One secret less shows.
+  Future<void> release();
+}
+
+/// [ScreenGuard] through Android's `FLAG_SECURE`, which each app's
+/// `MainActivity` sets while any is held (`ScreenGuard.kt`, counting them,
+/// as several may show at once); nothing to do elsewhere: iOS has no such
+/// flag (its app switcher's picture is covered by [SecretScreen] instead),
+/// and desktops none either.
+class const PlatformScreenGuard({final bool? android}) implements ScreenGuard {
+  /// The channel each app's activity answers.
+  static const channel = MethodChannel('app.halkyon/screen_guard');
+
+  bool get _android => android ?? Platform.isAndroid;
+
+  @override
+  Future<void> hold() => _ask('hold');
+
+  @override
+  Future<void> release() => _ask('release');
+
+  Future<void> _ask(String method) async {
+    if (!_android) {
+      return;
+    }
+    try {
+      await channel.invokeMethod<void>(method);
+    } on MissingPluginException {
+      // An app without the channel: nothing kept out.
+    } on PlatformException {
+      // A window that won't take the flag: nothing kept out.
+    }
+  }
+}
+
+/// [child], something secret, kept out of screenshots and recent apps while
+/// it shows ([guard]); and where [coversWhenAway] (iOS, whose app switcher
+/// shows a picture of the app taken as it leaves), covered while the app
+/// isn't in front.
+class const SecretScreen({
+  required final Widget child,
+  final ScreenGuard guard = const PlatformScreenGuard(),
+
+  /// Whether it covers [child] while the app isn't in front; by default on
+  /// iOS alone. Not on desktops, where a window loses focus whenever the
+  /// person turns to another (to type a code into a password manager), nor
+  /// on Android, whose flag keeps it out already.
+  final bool? coversWhenAway,
+  super.key,
+}) extends StatefulWidget {
+  /// The cover, found by tests.
+  static const coverKey = Key('secret-screen-cover');
+
+  @override
+  State<SecretScreen> createState() => _SecretScreenState();
+}
+
+class _SecretScreenState() extends State<SecretScreen> {
+  late final AppLifecycleListener _lifecycle;
+  var _away = false;
+
+  @override
+  void initState() {
+    super.initState();
+    widget.guard.hold();
+    _lifecycle = AppLifecycleListener(
+      onStateChange: (state) {
+        final away = state != AppLifecycleState.resumed;
+        if (away != _away && mounted) {
+          setState(() => _away = away);
+        }
+      },
+    );
+  }
+
+  @override
+  void dispose() {
+    _lifecycle.dispose();
+    widget.guard.release();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    if (!(_away && (widget.coversWhenAway ?? Platform.isIOS))) {
+      return widget.child;
+    }
+    return Stack(
+      children: [
+        widget.child,
+        Positioned.fill(
+          key: SecretScreen.coverKey,
+          child: ColoredBox(color: Theme.of(context).colorScheme.surface),
+        ),
+      ],
+    );
+  }
+}

packages/halkyon_app/lib/src/testing/fake_screen_guard.dart

@@ -0,0 +1,13 @@
+import 'package:halkyon_app/src/password/widget/secret_screen.dart';
+
+/// [ScreenGuard] counting what is held, as a test reads it.
+class FakeScreenGuard() implements ScreenGuard {
+  /// How many secrets show.
+  int held = 0;
+
+  @override
+  Future<void> hold() async => held++;
+
+  @override
+  Future<void> release() async => held--;
+}

packages/halkyon_app/lib/testing.dart

@@ -7,6 +7,7 @@ export 'src/testing/fake_account_crypto.dart';
 export 'src/testing/fake_auth_gateway.dart';
 export 'src/testing/fake_instance_checker.dart';
 export 'src/testing/fake_password_gateway.dart';
+export 'src/testing/fake_screen_guard.dart';
 export 'src/testing/memory_account_key_store.dart';
 export 'src/testing/memory_file_saver.dart';
 export 'src/testing/memory_instance_store.dart';

packages/halkyon_app/test/password/widget/secret_screen_test.dart

@@ -0,0 +1,110 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_app/testing.dart';
+import 'package:material_ui/material_ui.dart';
+
+void main() {
+  Future<void> pump(WidgetTester tester, Widget child) => tester.pumpWidget(
+    MaterialApp(
+      localizationsDelegates: testLocalizationsDelegates,
+      supportedLocales: HalkyonAppLocalizations.supportedLocales,
+      home: Scaffold(body: SingleChildScrollView(child: child)),
+    ),
+  );
+
+  testWidgets('keeps the screen out of screenshots and recent apps while a '
+      'secret shows, and lets it go after', (tester) async {
+    final guard = FakeScreenGuard();
+    await pump(
+      tester,
+      SecretScreen(guard: guard, child: const Text('the phrase')),
+    );
+    expect(guard.held, 1);
+
+    await pump(tester, const Text('something else'));
+    expect(guard.held, 0);
+  });
+
+  testWidgets('covers the secret while the app is not in front, where asked '
+      '(iOS, whose app switcher shows a picture of it)', (tester) async {
+    await pump(
+      tester,
+      SecretScreen(
+        guard: FakeScreenGuard(),
+        coversWhenAway: true,
+        child: const Text('the phrase'),
+      ),
+    );
+    expect(find.byKey(SecretScreen.coverKey), findsNothing);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.inactive);
+    await tester.pump();
+    expect(find.byKey(SecretScreen.coverKey), findsOneWidget);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pump();
+    expect(find.byKey(SecretScreen.coverKey), findsNothing);
+  });
+
+  testWidgets('the phrase, the recovery codes and an authenticator are each '
+      'shown as a secret', (tester) async {
+    final code = TextEditingController();
+    addTearDown(code.dispose);
+    for (final view in [
+      const RecoveryPhraseView(
+        phrase:
+            'abandon abandon abandon abandon abandon abandon abandon abandon '
+            'abandon abandon abandon abandon abandon abandon abandon abandon '
+            'abandon abandon abandon abandon abandon abandon abandon art',
+      ),
+      const RecoveryCodesView(codes: ['AAAA-BBBB']),
+      AuthenticatorSetupView(
+        setup: const AuthenticatorSetup(
+          id: 'a',
+          uri: 'otpauth://totp/x:anna?secret=JBSWY3DPEHPK3PXP',
+        ),
+        code: code,
+      ),
+    ]) {
+      await tester.pumpWidget(
+        AppScope(
+          dependencies: TestAppDependencies(gateway: FakeAuthGateway()),
+          child: MaterialApp(
+            localizationsDelegates: testLocalizationsDelegates,
+            supportedLocales: HalkyonAppLocalizations.supportedLocales,
+            home: Scaffold(body: SingleChildScrollView(child: view)),
+          ),
+        ),
+      );
+      expect(find.byType(SecretScreen), findsOneWidget, reason: '$view');
+    }
+  });
+
+  testWidgets("the platform's guard asks Android's activity, counted", (
+    tester,
+  ) async {
+    final calls = <String>[];
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      PlatformScreenGuard.channel,
+      (call) async {
+        calls.add(call.method);
+        return null;
+      },
+    );
+    addTearDown(
+      () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        PlatformScreenGuard.channel,
+        null,
+      ),
+    );
+    const guard = PlatformScreenGuard(android: true);
+    await guard.hold();
+    await guard.release();
+    expect(calls, ['hold', 'release']);
+
+    // Elsewhere, nothing to ask.
+    calls.clear();
+    await const PlatformScreenGuard(android: false).hold();
+    expect(calls, isEmpty);
+  });
+}