[BUG] Lock overlay bypass via Back x2 + Close (X) button when Unlock Duration > 0 (Shizuku/Usage Stats)

[Il1-ui]

Environment

• App Version: v2.5.1 (F-Droid official repository)
• Device: Samsung Galaxy M12
• OS Version: Android 13

Description

There is a security bypass logic issue when Unlock Time Duration is set to a non-zero value (e.g., 5 minutes) using Shizuku Service or Usage Statistics detection methods.

Under specific UI interactions on the lock overlay, the overlay closes without requiring PIN/biometric authentication, giving full access to the underlying locked app.

Steps to Reproduce

1. Set Unlock Time Duration to 5 minutes (or any value other than immediately).
2. Set detection method to Shizuku Service or Usage Statistics.
3. Open a locked application to bring up the lock screen overlay.
4. Press the system Back button twice ($2\times$).
5. Tap the X (Close) button at the top of the lock overlay without entering the password/PIN.

Expected Behavior

Dismissing the lock screen via Back/X should cancel the access request and either force-close the target app or return to the Home Screen.

Actual Behavior

• The lock overlay disappears and the user is dropped directly inside the locked app without entering any password.
• Note 1: If Unlock Time Duration is set to "Immediately", the issue does not occur.
• Note 2: When using Accessibility Service, pressing Back correctly terminates the locked app process instead of bypassing it.

Proposed Fix

Ensure that closing/dismissing the lock overlay via system gestures or UI buttons clears the session token and forces ACTION_MAIN (Home Screen), regardless of the configured unlock timeout duration.