From ef2ead73f83bad613f77788be866b6f3976c8132 Mon Sep 17 00:00:00 2001
From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 22:26:49 +0800
Subject: [PATCH] fix(mobile): turning the lock off takes Face ID too

Anyone holding the phone, unlocked, could switch the app lock off from
Settings. Off now asks for Face ID or the passcode, as on does.
---
 mobile/src/main.ts | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/mobile/src/main.ts b/mobile/src/main.ts
index 1c0413d9..d509236d 100644
--- a/mobile/src/main.ts
+++ b/mobile/src/main.ts
@@ -630,13 +630,14 @@ function settingsScreen() {
               class: "row choice",
               onclick: async () => {
                 // Turning it on proves it works first, so no one locks
-                // themselves out.
-                if (!prefs.lock) {
-                  try {
-                    await authenticate("Turn on the tty7 lock", { allowDeviceCredential: true });
-                  } catch {
-                    return;
-                  }
+                // themselves out; turning it off takes the owner too, not
+                // whoever holds the phone.
+                try {
+                  await authenticate(prefs.lock ? "Turn off the tty7 lock" : "Turn on the tty7 lock", {
+                    allowDeviceCredential: true,
+                  });
+                } catch {
+                  return;
                 }
                 setPref("lock", !prefs.lock);
                 draw();