fix(app): secrets are kept out of screenshots and the recent apps

The recovery phrase, recovery codes and an authenticator's QR code and
key now show inside a SecretScreen: on Android it holds FLAG_SECURE while
it shows (through a channel each app's MainActivity answers, counting
holds, as several may show at once; ScreenGuard.kt), so screenshots,
screen recordings and the recents view don't get them; on iOS, which has
no such flag, it covers them while the app isn't in front, so the app
switcher's picture doesn't hold them (Dart-side, not checked on a device).
Desktops do neither: a window loses focus whenever its person turns to a
password manager. Todo's debug APK builds with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_flutter/android/app/src/main/kotlin/app/halkyon/learn/MainActivity.kt

@@ -19,6 +19,7 @@ class MainActivity : FlutterActivity() {
     super.configureFlutterEngine(flutterEngine)
     val messenger = flutterEngine.dartExecutor.binaryMessenger
     PomodoroService.appBack()
+    ScreenGuard.attach(this, messenger)
     // A question searched with the device's own web search (its default
     // browser or search app answers ACTION_WEB_SEARCH); false where none does,
     // and the app opens a search engine's address instead.

apps/learn/halkyon_learn_flutter/android/app/src/main/kotlin/app/halkyon/learn/ScreenGuard.kt

@@ -0,0 +1,36 @@
+package app.halkyon.learn
+
+import android.app.Activity
+import android.view.WindowManager
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodChannel
+
+/**
+ * Keeps the window's content out of screenshots, screen recordings and the
+ * recents view (FLAG_SECURE) while halkyon_app shows something secret: the
+ * recovery phrase, recovery codes, an authenticator's key. Its SecretScreen
+ * holds as each shows and releases as it goes; counted, as several may show
+ * at once.
+ */
+object ScreenGuard {
+  fun attach(activity: Activity, messenger: BinaryMessenger) {
+    var holds = 0
+    MethodChannel(messenger, "app.halkyon/screen_guard").setMethodCallHandler { call, result ->
+      when (call.method) {
+        "hold" -> {
+          holds++
+          activity.window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+          result.success(null)
+        }
+        "release" -> {
+          holds = maxOf(0, holds - 1)
+          if (holds == 0) {
+            activity.window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+          }
+          result.success(null)
+        }
+        else -> result.notImplemented()
+      }
+    }
+  }
+}

apps/todo/halkyon_todo_flutter/android/app/src/main/kotlin/app/halkyon/todo/MainActivity.kt

@@ -1,5 +1,12 @@
 package app.halkyon.todo
 
 import io.flutter.embedding.android.FlutterActivity
+import io.flutter.embedding.engine.FlutterEngine
 
-class MainActivity : FlutterActivity()
+class MainActivity : FlutterActivity() {
+  override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
+    super.configureFlutterEngine(flutterEngine)
+    // Secrets halkyon_app shows kept out of screenshots and recents.
+    ScreenGuard.attach(this, flutterEngine.dartExecutor.binaryMessenger)
+  }
+}

apps/todo/halkyon_todo_flutter/android/app/src/main/kotlin/app/halkyon/todo/ScreenGuard.kt

@@ -0,0 +1,36 @@
+package app.halkyon.todo
+
+import android.app.Activity
+import android.view.WindowManager
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodChannel
+
+/**
+ * Keeps the window's content out of screenshots, screen recordings and the
+ * recents view (FLAG_SECURE) while halkyon_app shows something secret: the
+ * recovery phrase, recovery codes, an authenticator's key. Its SecretScreen
+ * holds as each shows and releases as it goes; counted, as several may show
+ * at once.
+ */
+object ScreenGuard {
+  fun attach(activity: Activity, messenger: BinaryMessenger) {
+    var holds = 0
+    MethodChannel(messenger, "app.halkyon/screen_guard").setMethodCallHandler { call, result ->
+      when (call.method) {
+        "hold" -> {
+          holds++
+          activity.window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+          result.success(null)
+        }
+        "release" -> {
+          holds = maxOf(0, holds - 1)
+          if (holds == 0) {
+            activity.window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+          }
+          result.success(null)
+        }
+        else -> result.notImplemented()
+      }
+    }
+  }
+}

packages/halkyon_app/lib/halkyon_app.dart

@@ -90,6 +90,7 @@ export 'src/password/widget/password_sign_in_sheet.dart';
 export 'src/password/widget/password_texts.dart';
 export 'src/password/widget/password_widgets.dart';
 export 'src/password/widget/secret_clipboard.dart';
+export 'src/password/widget/secret_screen.dart';
 export 'src/person/person_folders.dart';
 export 'src/sync/app_compatibility.dart';
 export 'src/sync/bloc/sync_status_bloc.dart';

packages/halkyon_app/lib/src/password/widget/password_widgets.dart

@@ -7,6 +7,7 @@ import 'package:halkyon_app/src/app/app_scope.dart';
 import 'package:halkyon_app/src/password/model/account_authenticator.dart';
 import 'package:halkyon_app/src/password/model/phrase_check.dart';
 import 'package:halkyon_app/src/password/widget/secret_clipboard.dart';
+import 'package:halkyon_app/src/password/widget/secret_screen.dart';
 import 'package:halkyon_keys/halkyon_keys.dart' show newPasswordMinLength;
 import 'package:halkyon_ui/halkyon_ui.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
@@ -292,7 +293,9 @@ class const RecoveryPhraseView({required final String phrase, super.key})
   Widget build(BuildContext context) {
     final theme = Theme.of(context);
     final words = wordsOf(phrase);
-    return Column(
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
         crossAxisAlignment: CrossAxisAlignment.stretch,
         children: [
           DecoratedBox(
@@ -357,6 +360,7 @@ class const RecoveryPhraseView({required final String phrase, super.key})
             copyable: false,
           ),
         ],
+      ),
     );
   }
 }
@@ -446,7 +450,9 @@ class const RecoveryCodesView({required final List<String> codes, super.key})
   @override
   Widget build(BuildContext context) {
     final theme = Theme.of(context);
-    return Column(
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
         crossAxisAlignment: CrossAxisAlignment.stretch,
         children: [
           DecoratedBox(
@@ -479,6 +485,7 @@ class const RecoveryCodesView({required final List<String> codes, super.key})
             fileName: 'halkyon-recovery-codes.txt',
           ),
         ],
+      ),
     );
   }
 }
@@ -553,7 +560,9 @@ class const AuthenticatorSetupView({
     // Only an otpauth URI is shown as a QR code or opened ([AuthenticatorSetup.isAuthenticatorUri]).
     final opens = setup.isAuthenticatorUri;
     final phone = opens && (Platform.isAndroid || Platform.isIOS);
-    return Column(
+    // Kept out of screenshots and recent apps while it shows.
+    return SecretScreen(
+      child: Column(
         crossAxisAlignment: CrossAxisAlignment.stretch,
         children: [
           SheetIntro(l10n.passwordAuthenticatorIntro),
@@ -561,7 +570,10 @@ class const AuthenticatorSetupView({
             Center(child: QrCodeView(data: setup.uri)),
             const SizedBox(height: 12),
           ],
-        Text(l10n.passwordAuthenticatorKey, style: theme.textTheme.labelLarge),
+          Text(
+            l10n.passwordAuthenticatorKey,
+            style: theme.textTheme.labelLarge,
+          ),
           const SizedBox(height: 4),
           Row(
             children: [
@@ -655,6 +667,7 @@ class const AuthenticatorSetupView({
             ),
           ],
         ],
+      ),
     );
   }
 }

packages/halkyon_app/lib/src/password/widget/secret_screen.dart

@@ -0,0 +1,111 @@
+import 'dart:io';
+
+import 'package:flutter/services.dart';
+import 'package:material_ui/material_ui.dart';
+
+/// Keeps the window's content out of screenshots, screen recordings and
+/// the system's view of recent apps while something secret shows (the
+/// recovery phrase, recovery codes, an authenticator's key), held as each
+/// shows and released as it goes.
+abstract interface class ScreenGuard() {
+  /// One more secret shows.
+  Future<void> hold();
+
+  /// One secret less shows.
+  Future<void> release();
+}
+
+/// [ScreenGuard] through Android's `FLAG_SECURE`, which each app's
+/// `MainActivity` sets while any is held (`ScreenGuard.kt`, counting them,
+/// as several may show at once); nothing to do elsewhere: iOS has no such
+/// flag (its app switcher's picture is covered by [SecretScreen] instead),
+/// and desktops none either.
+class const PlatformScreenGuard({final bool? android}) implements ScreenGuard {
+  /// The channel each app's activity answers.
+  static const channel = MethodChannel('app.halkyon/screen_guard');
+
+  bool get _android => android ?? Platform.isAndroid;
+
+  @override
+  Future<void> hold() => _ask('hold');
+
+  @override
+  Future<void> release() => _ask('release');
+
+  Future<void> _ask(String method) async {
+    if (!_android) {
+      return;
+    }
+    try {
+      await channel.invokeMethod<void>(method);
+    } on MissingPluginException {
+      // An app without the channel: nothing kept out.
+    } on PlatformException {
+      // A window that won't take the flag: nothing kept out.
+    }
+  }
+}
+
+/// [child], something secret, kept out of screenshots and recent apps while
+/// it shows ([guard]); and where [coversWhenAway] (iOS, whose app switcher
+/// shows a picture of the app taken as it leaves), covered while the app
+/// isn't in front.
+class const SecretScreen({
+  required final Widget child,
+  final ScreenGuard guard = const PlatformScreenGuard(),
+
+  /// Whether it covers [child] while the app isn't in front; by default on
+  /// iOS alone. Not on desktops, where a window loses focus whenever the
+  /// person turns to another (to type a code into a password manager), nor
+  /// on Android, whose flag keeps it out already.
+  final bool? coversWhenAway,
+  super.key,
+}) extends StatefulWidget {
+  /// The cover, found by tests.
+  static const coverKey = Key('secret-screen-cover');
+
+  @override
+  State<SecretScreen> createState() => _SecretScreenState();
+}
+
+class _SecretScreenState() extends State<SecretScreen> {
+  late final AppLifecycleListener _lifecycle;
+  var _away = false;
+
+  @override
+  void initState() {
+    super.initState();
+    widget.guard.hold();
+    _lifecycle = AppLifecycleListener(
+      onStateChange: (state) {
+        final away = state != AppLifecycleState.resumed;
+        if (away != _away && mounted) {
+          setState(() => _away = away);
+        }
+      },
+    );
+  }
+
+  @override
+  void dispose() {
+    _lifecycle.dispose();
+    widget.guard.release();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    if (!(_away && (widget.coversWhenAway ?? Platform.isIOS))) {
+      return widget.child;
+    }
+    return Stack(
+      children: [
+        widget.child,
+        Positioned.fill(
+          key: SecretScreen.coverKey,
+          child: ColoredBox(color: Theme.of(context).colorScheme.surface),
+        ),
+      ],
+    );
+  }
+}

packages/halkyon_app/lib/src/testing/fake_screen_guard.dart

@@ -0,0 +1,13 @@
+import 'package:halkyon_app/src/password/widget/secret_screen.dart';
+
+/// [ScreenGuard] counting what is held, as a test reads it.
+class FakeScreenGuard() implements ScreenGuard {
+  /// How many secrets show.
+  int held = 0;
+
+  @override
+  Future<void> hold() async => held++;
+
+  @override
+  Future<void> release() async => held--;
+}

packages/halkyon_app/lib/testing.dart

@@ -7,6 +7,7 @@ export 'src/testing/fake_account_crypto.dart';
 export 'src/testing/fake_auth_gateway.dart';
 export 'src/testing/fake_instance_checker.dart';
 export 'src/testing/fake_password_gateway.dart';
+export 'src/testing/fake_screen_guard.dart';
 export 'src/testing/memory_account_key_store.dart';
 export 'src/testing/memory_file_saver.dart';
 export 'src/testing/memory_instance_store.dart';

packages/halkyon_app/test/password/widget/secret_screen_test.dart

@@ -0,0 +1,110 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_app/testing.dart';
+import 'package:material_ui/material_ui.dart';
+
+void main() {
+  Future<void> pump(WidgetTester tester, Widget child) => tester.pumpWidget(
+    MaterialApp(
+      localizationsDelegates: testLocalizationsDelegates,
+      supportedLocales: HalkyonAppLocalizations.supportedLocales,
+      home: Scaffold(body: SingleChildScrollView(child: child)),
+    ),
+  );
+
+  testWidgets('keeps the screen out of screenshots and recent apps while a '
+      'secret shows, and lets it go after', (tester) async {
+    final guard = FakeScreenGuard();
+    await pump(
+      tester,
+      SecretScreen(guard: guard, child: const Text('the phrase')),
+    );
+    expect(guard.held, 1);
+
+    await pump(tester, const Text('something else'));
+    expect(guard.held, 0);
+  });
+
+  testWidgets('covers the secret while the app is not in front, where asked '
+      '(iOS, whose app switcher shows a picture of it)', (tester) async {
+    await pump(
+      tester,
+      SecretScreen(
+        guard: FakeScreenGuard(),
+        coversWhenAway: true,
+        child: const Text('the phrase'),
+      ),
+    );
+    expect(find.byKey(SecretScreen.coverKey), findsNothing);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.inactive);
+    await tester.pump();
+    expect(find.byKey(SecretScreen.coverKey), findsOneWidget);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pump();
+    expect(find.byKey(SecretScreen.coverKey), findsNothing);
+  });
+
+  testWidgets('the phrase, the recovery codes and an authenticator are each '
+      'shown as a secret', (tester) async {
+    final code = TextEditingController();
+    addTearDown(code.dispose);
+    for (final view in [
+      const RecoveryPhraseView(
+        phrase:
+            'abandon abandon abandon abandon abandon abandon abandon abandon '
+            'abandon abandon abandon abandon abandon abandon abandon abandon '
+            'abandon abandon abandon abandon abandon abandon abandon art',
+      ),
+      const RecoveryCodesView(codes: ['AAAA-BBBB']),
+      AuthenticatorSetupView(
+        setup: const AuthenticatorSetup(
+          id: 'a',
+          uri: 'otpauth://totp/x:anna?secret=JBSWY3DPEHPK3PXP',
+        ),
+        code: code,
+      ),
+    ]) {
+      await tester.pumpWidget(
+        AppScope(
+          dependencies: TestAppDependencies(gateway: FakeAuthGateway()),
+          child: MaterialApp(
+            localizationsDelegates: testLocalizationsDelegates,
+            supportedLocales: HalkyonAppLocalizations.supportedLocales,
+            home: Scaffold(body: SingleChildScrollView(child: view)),
+          ),
+        ),
+      );
+      expect(find.byType(SecretScreen), findsOneWidget, reason: '$view');
+    }
+  });
+
+  testWidgets("the platform's guard asks Android's activity, counted", (
+    tester,
+  ) async {
+    final calls = <String>[];
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      PlatformScreenGuard.channel,
+      (call) async {
+        calls.add(call.method);
+        return null;
+      },
+    );
+    addTearDown(
+      () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        PlatformScreenGuard.channel,
+        null,
+      ),
+    );
+    const guard = PlatformScreenGuard(android: true);
+    await guard.hold();
+    await guard.release();
+    expect(calls, ['hold', 'release']);
+
+    // Elsewhere, nothing to ask.
+    calls.clear();
+    await const PlatformScreenGuard(android: false).hold();
+    expect(calls, isEmpty);
+  });
+}