feat: Add configurable biometric authentication policies for CredentialsManager

[subhankarmaiti]

This PR introduces configurable biometric authentication policies for CredentialsManager, allowing developers to control when biometric prompts are shown. This reduces authentication friction while maintaining security.

New Features:

• BiometricPolicy enum with three strategies: .always, .session(timeoutInSeconds:), .appLifecycle(timeoutInSeconds:)
• isBiometricSessionValid() - Check session validity
• clearBiometricSession() - Manually invalidate session
• Thread-safe session management using NSLock

Files Modified:

• New: Auth0/BiometricPolicy.swift
• Modified: Auth0/CredentialsManager.swift, Auth0/BioAuthentication.swift
• New: Auth0Tests/BiometricPolicySpec.swift (33 test cases)
• Updated: EXAMPLES.md, sample app with policy demonstrations

References

• Android PR: feat: add configurable biometric authentication policies for SecureCredentialsManager Auth0.Android#867
• Issue: Will be getAccessTokenSilently available? react-native-auth0#687

Usage Examples

Always Policy (Default)

credentialsManager.enableBiometrics(withTitle: "Unlock with Face ID")

Session Policy

credentialsManager.enableBiometrics(
    withTitle: "Unlock with Face ID",
    policy: .session(timeoutInSeconds: 300)
)

App Lifecycle Policy

credentialsManager.enableBiometrics(
    withTitle: "Unlock with Face ID",
    policy: .appLifecycle() // Default: 3600 seconds
)

Manual Session Management

// Check validity
let isValid = credentialsManager.isBiometricSessionValid()

// Force re-authentication
CredentialsManager.clearBiometricSession()

Migration Guide

No breaking changes. Existing code works unchanged:

// Before and After - no changes needed
credentialsManager.enableBiometrics(withTitle: "Unlock")

Opt into new policies:

// Session-based authentication
credentialsManager.enableBiometrics(
    withTitle: "Unlock", 
    policy: .session(timeoutInSeconds: 300)
)

// Clear on background (optional)
func applicationDidEnterBackground(_ application: UIApplication) {
    CredentialsManager.clearBiometricSession()
}

Checklist

• Matches design document and Android PR Release 2.9.0 #867
• 33 new test cases added and passing
• Documentation updated (EXAMPLES.md)
• Sample app demonstrates all policies
• Thread-safe implementation
• Backward compatible
• No breaking changes

[NandanPrabhu]

https://github.com/auth0/Auth0.swift/pull/1019/files#r2540941166