Harden Archive lock: foreground-only biometric suppress, no stale handlers

- Relock on true background even during Face ID suppress (suppress only
  while still foreground).
- Refresh willRelock/didBecomeActive handlers on every bind; drop dual
  first-wins closures that could keep a previous account's context.
- Dismiss waits for full archived peer ids instead of empty-set first pass.
- Always clear biometric suppress on LocalAuth completion.

Co-authored-by: D3C0Y <decoder-dev@users.noreply.github.com>

Author: decoder-dev

CHANGELOG.md

@@ -6,6 +6,11 @@
 
 ## [Unreleased]
 
+## [v12.9.2-4013]
+
+### Fixed
+- **Archive lock:** Face ID resign no longer skips a real Home-background relock; suppress only applies while still foreground. Dual willRelock/didBecomeActive callbacks collapsed to session handlers refreshed on every bind (no stale account after switch). Dismiss waits for full archived peer-id set instead of first applying empty (App Switcher leak). Biometric suppress counter always cleared on auth completion.
+
 ## [v12.9.2-3950-pre]
 
 ### Changed

submodules/ChatListUI/Sources/ArchiveLockHelpers.swift

@@ -361,19 +361,22 @@ public func relockArchiveSessionIfLeavingArchivedSurface(
 public func bindArchiveLockSession(context: AccountContext) {
     ArchiveLockSession.shared.bindBackgroundRelock(
         applicationIsActive: context.sharedContext.applicationBindings.applicationIsActive,
-        willRelock: { [weak context] in
-            guard let context else {
-                return
-            }
-            prepareArchivePrivacyOnResignActive(context: context)
-        },
-        didBecomeActive: { [weak context] in
-            guard let context else {
-                return
-            }
-            restoreArchivePrivacyOnBecomeActive(context: context)
-        }
+        applicationInForeground: context.sharedContext.applicationBindings.applicationInForeground
     )
+    // Refresh every bind so account switches do not keep a stale primary's prepare/restore.
+    // (bindBackgroundRelock itself is first-wins for the subscription only.)
+    ArchiveLockSession.shared.willRelockHandler = { [weak context] in
+        guard let context else {
+            return
+        }
+        prepareArchivePrivacyOnResignActive(context: context)
+    }
+    ArchiveLockSession.shared.didBecomeActiveHandler = { [weak context] in
+        guard let context else {
+            return
+        }
+        restoreArchivePrivacyOnBecomeActive(context: context)
+    }
     ArchiveLockSession.shared.bindPasswordProtection(accountId: context.account.id.int64, isPasswordConfigured: archivePasswordProtectionSignal(context: context))
     ArchiveLockSession.shared.bindLockedPeerIds(accountId: context.account.id.int64, lockedPeerIds: archiveLockedPeerIdsSignal(context: context))
 }
@@ -439,11 +442,20 @@ public func ensureArchiveUnlocked(
         // falls through to the password prompt — never a dead end.
         if settings.useBiometrics, LocalAuth.biometricAuthentication != nil {
             // Biometric UI resigns active; suppress Archive background-relock for that window
-            // so Face ID does not clear reveal / dismiss the folder mid-unlock.
+            // so Face ID does not clear reveal / dismiss the folder mid-unlock. Always end
+            // suppress on next *or* completion so a cancelled auth cannot stick the counter.
             ArchiveLockSession.shared.beginSuppressBackgroundRelock()
+            var endedSuppress = false
+            let endSuppress = {
+                guard !endedSuppress else {
+                    return
+                }
+                endedSuppress = true
+                ArchiveLockSession.shared.endSuppressBackgroundRelock()
+            }
             let _ = (LocalAuth.auth(reason: ArchiveLockLocalizedString.biometricReason)
             |> deliverOnMainQueue).start(next: { success, _ in
-                ArchiveLockSession.shared.endSuppressBackgroundRelock()
+                endSuppress()
                 if success {
                     // Same reset the password path does on success. Both outcomes mean the owner
                     // proved who they are, and the counter throttles guessing, not the owner — but
@@ -455,6 +467,8 @@ public func ensureArchiveUnlocked(
                 } else {
                     showPasswordPrompt()
                 }
+            }, completed: {
+                endSuppress()
             })
         } else {
             showPasswordPrompt()
@@ -903,12 +917,17 @@ public func dismissOpenArchiveControllers(from navigationController: UINavigatio
         apply(ArchiveLockSession.shared.currentLockedPeerIds())
         return
     }
-    apply(ArchiveLockSession.shared.currentLockedPeerIds())
+    // Do not apply an empty peer-id set first: that would pop the Archive folder but leave
+    // archived chats / Peer Info / gallery on the stack until the async fetch lands (App
+    // Switcher leak window). Wait for the full id set when we have a context; otherwise only
+    // the folder match (empty ids still dismisses `.archive` chat lists) is available.
     if let context {
         let _ = (context.account.postbox.transaction { transaction -> Set<EnginePeer.Id> in
             return Set(transaction.chatListGetAllPeerIds(groupId: Namespaces.PeerGroup.archive))
         }
         |> deliverOnMainQueue).startStandalone(next: apply)
+    } else {
+        apply([])
     }
 }
 

submodules/TelegramUIPreferences/Sources/ChatArchiveSettings.swift

@@ -508,12 +508,11 @@ public final class ArchiveLockSession {
 
     /// Re-lock Archive when the app leaves the active state.
     ///
-    /// `willRelock` runs on the main queue *before* `relock()` so callers can cover Archive UI
-    /// for the app-switcher snapshot while `isUnlocked` is still true. `didBecomeActive` runs
-    /// when the app returns so that covering view can be removed if App Lock did not take over.
-    /// Session-level `willRelockHandler` / `didBecomeActiveHandler` are also invoked at fire
-    /// time so they can be registered after this binding has already claimed the slot.
-    public func bindBackgroundRelock(applicationIsActive: Signal<Bool, NoError>, willRelock: (() -> Void)? = nil, didBecomeActive: (() -> Void)? = nil) {
+    /// Handlers are looked up at fire time (`willRelockHandler` / `didBecomeActiveHandler`) so
+    /// account switches can refresh them without rebinding the subscription. `applicationInForeground`
+    /// distinguishes Face ID resign-active (still foreground — suppressible) from a true Home
+    /// background (always relock, even mid-biometric).
+    public func bindBackgroundRelock(applicationIsActive: Signal<Bool, NoError>, applicationInForeground: Signal<Bool, NoError>) {
         // Claim the "binding" slot atomically with a placeholder before subscribing, so two
         // concurrent callers can't both observe "not yet bound" and both subscribe — only the
         // caller that wins the claim installs a real disposable; the loser's subscription is
@@ -527,23 +526,25 @@ public final class ArchiveLockSession {
         if alreadyBound {
             return
         }
-        let disposable = (applicationIsActive
-        |> distinctUntilChanged
-        |> deliverOnMainQueue).startStrict(next: { [weak self] isActive in
+        let disposable = (combineLatest(applicationIsActive, applicationInForeground)
+        |> distinctUntilChanged(isEqual: { lhs, rhs in
+            return lhs.0 == rhs.0 && lhs.1 == rhs.1
+        })
+        |> deliverOnMainQueue).startStrict(next: { [weak self] isActive, inForeground in
+            guard let self else {
+                return
+            }
             if isActive {
-                didBecomeActive?()
-                self?.didBecomeActiveHandler?()
+                self.didBecomeActiveHandler?()
             } else {
-                guard let self else {
-                    return
-                }
                 self.lock.lock()
                 let suppressed = self.suppressBackgroundRelockCount > 0
                 self.lock.unlock()
-                if suppressed {
+                // Face ID/Touch ID resigns active while still foreground — skip. A real
+                // background (Home / app switcher settle) must always relock.
+                if suppressed && inForeground {
                     return
                 }
-                willRelock?()
                 self.willRelockHandler?()
                 self.relock()
             }