Implement biometric-protected GPG unlock

crates/storage/tests/config_contract.rs

@@ -210,6 +210,31 @@ fn mobile_tab_defaults_and_persists_through_storage_configuration() -> TestResul
     Ok(())
 }
 
+#[test]
+fn biometric_preference_is_secret_free_and_defaults_to_disabled() -> TestResult {
+    let fixture = ConfigurationFixture::new()?;
+    fs::create_dir_all(fixture.temporary.path().join("cwd/vault"))?;
+    fixture.write_explicit(fixture.valid_contents())?;
+    let config = fixture.loader().load(Some(&fixture.explicit_path()))?;
+    assert!(!config.biometric_unlock_enabled());
+
+    config.update_biometric_unlock(true)?;
+    let contents = fs::read_to_string(fixture.explicit_path())?;
+    assert!(contents.contains("biometric_unlock_enabled = true"));
+    assert!(!contents.to_ascii_lowercase().contains("passphrase"));
+    let reloaded = fixture.loader().load(Some(&fixture.explicit_path()))?;
+    assert!(reloaded.biometric_unlock_enabled());
+
+    reloaded.update_biometric_unlock(false)?;
+    assert!(
+        !fixture
+            .loader()
+            .load(Some(&fixture.explicit_path()))?
+            .biometric_unlock_enabled()
+    );
+    Ok(())
+}
+
 #[test]
 fn desktop_vault_switch_preserves_and_reloads_the_shared_configuration() -> TestResult {
     let fixture = ConfigurationFixture::new()?;