r-zakarya
57a295ad36
A pattern lock reported "no authentication here", so the cache was written under the plain key. FMX builds its authenticator mask from FBiometricStrengths, and that field starts as the EMPTY SET - the constructor never initialises it. On API 30+ CanAuthenticate therefore calls canAuthenticate(0), which never answers "available", whatever the device can actually do. Asking before setting the strengths cannot succeed. Both entry points now go through AcquireService, which sets Strong + DeviceCredential and only then hands back the service. DeviceCredential is the point: a phone with a pattern or a PIN and no enrolled fingerprint is the common case, not an edge one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
