From fde915826c0c0a8e475af6942f1d07fff4e17f00 Mon Sep 17 00:00:00 2001
From: Fabian Freund <github@fabi.online>
Date: Tue, 7 Jul 2026 17:58:30 +0200
Subject: [PATCH] new option: Lock on Startup Only

---
 .../features/geckoview/domain/repositories/tab.g.dart    | 2 +-
 .../features/tabs/domain/repositories/tab.g.dart         | 2 +-
 .../lib/features/user/data/models/auth_settings.dart     | 6 +++++-
 .../lib/features/user/data/models/auth_settings.g.dart   | 1 +
 .../user/domain/presentation/screens/profile_edit.dart   | 9 +++++++++
 .../user/domain/services/local_authentication.dart       | 2 ++
 6 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/apps/weblibre/lib/features/geckoview/domain/repositories/tab.g.dart b/apps/weblibre/lib/features/geckoview/domain/repositories/tab.g.dart
index 85410d80..ff5c47ff 100644
--- a/apps/weblibre/lib/features/geckoview/domain/repositories/tab.g.dart
+++ b/apps/weblibre/lib/features/geckoview/domain/repositories/tab.g.dart
@@ -41,7 +41,7 @@ final class TabRepositoryProvider
   }
 }
 
-String _$tabRepositoryHash() => r'749b131347685933ac36a3afcdd49f7def7155a9';
+String _$tabRepositoryHash() => r'e80c972b0d1a328c170354c123d2730028a774b2';
 
 abstract class _$TabRepository extends $Notifier<void> {
   void build();
diff --git a/apps/weblibre/lib/features/geckoview/features/tabs/domain/repositories/tab.g.dart b/apps/weblibre/lib/features/geckoview/features/tabs/domain/repositories/tab.g.dart
index ce7de63a..a340a5b2 100644
--- a/apps/weblibre/lib/features/geckoview/features/tabs/domain/repositories/tab.g.dart
+++ b/apps/weblibre/lib/features/geckoview/features/tabs/domain/repositories/tab.g.dart
@@ -41,7 +41,7 @@ final class TabDataRepositoryProvider
   }
 }
 
-String _$tabDataRepositoryHash() => r'cb923fb0723271cd64d66a720dc3e1aed2d86c71';
+String _$tabDataRepositoryHash() => r'adc1c664b492e41a96a0310d92252dbbacc1a089';
 
 abstract class _$TabDataRepository extends $Notifier<void> {
   void build();
diff --git a/apps/weblibre/lib/features/user/data/models/auth_settings.dart b/apps/weblibre/lib/features/user/data/models/auth_settings.dart
index 8c2ff54b..8fdeb106 100644
--- a/apps/weblibre/lib/features/user/data/models/auth_settings.dart
+++ b/apps/weblibre/lib/features/user/data/models/auth_settings.dart
@@ -23,7 +23,7 @@ import 'package:json_annotation/json_annotation.dart';
 
 part 'auth_settings.g.dart';
 
-enum AutoLockMode { background, timeout }
+enum AutoLockMode { background, timeout, startup }
 
 @CopyWith()
 @JsonSerializable()
@@ -56,6 +56,10 @@ class AuthSettings with FastEquatable {
     return copyWith(autoLockMode: AutoLockMode.timeout, timeout: value);
   }
 
+  AuthSettings withStartupLock() {
+    return copyWith(autoLockMode: AutoLockMode.startup);
+  }
+
   factory AuthSettings.fromJson(Map<String, dynamic> json) =>
       _$AuthSettingsFromJson(json);
 
diff --git a/apps/weblibre/lib/features/user/data/models/auth_settings.g.dart b/apps/weblibre/lib/features/user/data/models/auth_settings.g.dart
index 4a0a3135..87e0ef3c 100644
--- a/apps/weblibre/lib/features/user/data/models/auth_settings.g.dart
+++ b/apps/weblibre/lib/features/user/data/models/auth_settings.g.dart
@@ -105,4 +105,5 @@ Map<String, dynamic> _$AuthSettingsToJson(AuthSettings instance) =>
 const _$AutoLockModeEnumMap = {
   AutoLockMode.background: 'background',
   AutoLockMode.timeout: 'timeout',
+  AutoLockMode.startup: 'startup',
 };
diff --git a/apps/weblibre/lib/features/user/domain/presentation/screens/profile_edit.dart b/apps/weblibre/lib/features/user/domain/presentation/screens/profile_edit.dart
index aec83074..c90a57ff 100644
--- a/apps/weblibre/lib/features/user/domain/presentation/screens/profile_edit.dart
+++ b/apps/weblibre/lib/features/user/domain/presentation/screens/profile_edit.dart
@@ -68,6 +68,7 @@ class ProfileEditScreen extends HookConsumerWidget {
           .authenticate(
             authKey: profileAccessAuthKey(profile!.id),
             localizedReason: 'Require authentication for profile',
+            settings: authSettings,
           );
 
       if (!authResult) {
@@ -222,6 +223,14 @@ class _AuthSection extends StatelessWidget {
                         title: Text('Lock After Timeout'),
                         subtitle: Text('Lock after a period of inactivity'),
                       ),
+                      RadioListTile.adaptive(
+                        value: AutoLockMode.startup,
+                        title: Text('Lock on Startup Only'),
+                        subtitle: Text(
+                          'Unlock once when the app starts; stay unlocked '
+                          'until the app is fully closed',
+                        ),
+                      ),
                     ],
                   ),
                 ),
diff --git a/apps/weblibre/lib/features/user/domain/services/local_authentication.dart b/apps/weblibre/lib/features/user/domain/services/local_authentication.dart
index 7f78d7ba..195724b8 100644
--- a/apps/weblibre/lib/features/user/domain/services/local_authentication.dart
+++ b/apps/weblibre/lib/features/user/domain/services/local_authentication.dart
@@ -46,6 +46,8 @@ class LocalAuthenticationService extends _$LocalAuthenticationService {
     }
 
     // Background mode cache stays valid until app background eviction.
+    // Startup mode cache is never evicted, so it stays valid for the whole
+    // process lifetime.
     return true;
   }