18.1+: Restrict tile usage when locked, credit @GrapheneOS

TODO: backport to older branches

Signed-off-by: Tad <tad@spotco.us>

Misc/Features/GrapheneOS.txt

@@ -75,6 +75,10 @@ https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/993f35ba0d4
 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/9312b4b33dc4e3bfbb2869321cdd9e965df6409a
 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/10a3b946b97fe73daa342952f56ed7217ffd22cc
 
+[implemented] tile restrictions
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/6c3be72e795b4b2de830dd981787f197cc1aa7ee
+12 https://github.com/GrapheneOS/platform_frameworks_base/commit/6f7cde6351b1ba2fb0513d713ad20d42e7f18745
+
 [implemented] disable apps
 13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/2c9112d7e9137d91694bf1478f2558fdb898cad8
 

Patches/LineageOS-18.1/android_frameworks_base/0025-tile_restrictions.patch

@@ -0,0 +1,698 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: inthewaves <inthewaves@pm.me>
+Date: Thu, 10 Sep 2020 16:47:59 -0700
+Subject: [PATCH]  SystemUI: Require unlocking to use sensitive QS tiles
+
+- Airplane mode
+- Battery saver
+- Bluetooth
+- DataSaver
+- Hotspot
+- NFC
+- Rotation lock
+- Wi-Fi
+- Work mode
+---
+ .../systemui/qs/tiles/AirplaneModeTile.java   | 30 +++++++++++++--
+ .../systemui/qs/tiles/BatterySaverTile.java   | 25 ++++++++++++-
+ .../systemui/qs/tiles/BluetoothTile.java      | 37 +++++++++++++++++--
+ .../systemui/qs/tiles/DataSaverTile.java      | 34 +++++++++++++++--
+ .../systemui/qs/tiles/HotspotTile.java        | 33 +++++++++++++++--
+ .../android/systemui/qs/tiles/NfcTile.java    | 35 ++++++++++++++++--
+ .../systemui/qs/tiles/RotationLockTile.java   | 33 +++++++++++++++--
+ .../android/systemui/qs/tiles/WifiTile.java   | 36 ++++++++++++++++--
+ .../systemui/qs/tiles/WorkModeTile.java       | 25 ++++++++++++-
+ 9 files changed, 265 insertions(+), 23 deletions(-)
+
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+index b24fdbfc562f..2065800a4016 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+@@ -38,6 +38,7 @@ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.GlobalSetting;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+@@ -48,11 +49,14 @@ public class AirplaneModeTile extends QSTileImpl<BooleanState> {
+     private final ActivityStarter mActivityStarter;
+     private final BroadcastDispatcher mBroadcastDispatcher;
+ 
++    private final KeyguardStateController mKeyguard;
++
+     private boolean mListening;
+ 
+     @Inject
+     public AirplaneModeTile(QSHost host, ActivityStarter activityStarter,
+-            BroadcastDispatcher broadcastDispatcher) {
++            BroadcastDispatcher broadcastDispatcher,
++            KeyguardStateController keyguardStateController) {
+         super(host);
+         mActivityStarter = activityStarter;
+         mBroadcastDispatcher = broadcastDispatcher;
+@@ -63,6 +67,15 @@ public class AirplaneModeTile extends QSTileImpl<BooleanState> {
+                 handleRefreshState(value);
+             }
+         };
++
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -70,8 +83,7 @@ public class AirplaneModeTile extends QSTileImpl<BooleanState> {
+         return new BooleanState();
+     }
+ 
+-    @Override
+-    public void handleClick() {
++    private void handleClickInner() {
+         boolean airplaneModeEnabled = mState.value;
+         MetricsLogger.action(mContext, getMetricsCategory(), !airplaneModeEnabled);
+         if (!airplaneModeEnabled && TelephonyProperties.in_ecm_mode().orElse(false)) {
+@@ -82,6 +94,18 @@ public class AirplaneModeTile extends QSTileImpl<BooleanState> {
+         setEnabled(!airplaneModeEnabled);
+     }
+ 
++    @Override
++    public void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     private void setEnabled(boolean enabled) {
+         final ConnectivityManager mgr =
+                 (ConnectivityManager) mContext.getSystemService(Context.CONNECTIVITY_SERVICE);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+index 7150e4350304..2b11125360d3 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+@@ -23,11 +23,13 @@ import android.widget.Switch;
+ import com.android.internal.annotations.VisibleForTesting;
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.R;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.SecureSetting;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BatteryController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+@@ -38,6 +40,9 @@ public class BatterySaverTile extends QSTileImpl<BooleanState> implements
+     @VisibleForTesting
+     protected final SecureSetting mSetting;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     private int mLevel;
+     private boolean mPowerSave;
+     private boolean mCharging;
+@@ -46,7 +51,8 @@ public class BatterySaverTile extends QSTileImpl<BooleanState> implements
+     private Icon mIcon = ResourceIcon.get(com.android.internal.R.drawable.ic_qs_battery_saver);
+ 
+     @Inject
+-    public BatterySaverTile(QSHost host, BatteryController batteryController) {
++    public BatterySaverTile(QSHost host, BatteryController batteryController,
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mBatteryController = batteryController;
+         mBatteryController.observe(getLifecycle(), this);
+@@ -58,6 +64,16 @@ public class BatterySaverTile extends QSTileImpl<BooleanState> implements
+                 handleRefreshState(null);
+             }
+         };
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -97,6 +113,13 @@ public class BatterySaverTile extends QSTileImpl<BooleanState> implements
+         if (getState().state == Tile.STATE_UNAVAILABLE) {
+             return;
+         }
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                mBatteryController.setPowerSaveMode(!mPowerSave);
++            });
++            return;
++        }
+         mBatteryController.setPowerSaveMode(!mPowerSave);
+     }
+ 
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+index 14061838fb1b..d7fb0b23add6 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+@@ -45,6 +45,7 @@ import com.android.systemui.qs.QSDetailItems.Item;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BluetoothController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import java.util.ArrayList;
+ import java.util.Collection;
+@@ -60,15 +61,27 @@ public class BluetoothTile extends QSTileImpl<BooleanState> {
+     private final BluetoothDetailAdapter mDetailAdapter;
+     private final ActivityStarter mActivityStarter;
+ 
++    private final KeyguardStateController mKeyguard;
++
+     @Inject
+     public BluetoothTile(QSHost host,
+             BluetoothController bluetoothController,
+-            ActivityStarter activityStarter) {
++            ActivityStarter activityStarter,
++            KeyguardStateController keyguardStateController) {
+         super(host);
+         mController = bluetoothController;
+         mActivityStarter = activityStarter;
+         mDetailAdapter = (BluetoothDetailAdapter) createDetailAdapter();
+         mController.observe(getLifecycle(), mCallback);
++
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -81,8 +94,7 @@ public class BluetoothTile extends QSTileImpl<BooleanState> {
+         return new BooleanState();
+     }
+ 
+-    @Override
+-    protected void handleClick() {
++    private void handleClickInner() {
+         // Secondary clicks are header clicks, just toggle.
+         final boolean isEnabled = mState.value;
+         // Immediately enter transient enabling state when turning bluetooth on.
+@@ -90,6 +102,18 @@ public class BluetoothTile extends QSTileImpl<BooleanState> {
+         mController.setBluetoothEnabled(!isEnabled);
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     @Override
+     public Intent getLongClickIntent() {
+         return new Intent(Settings.ACTION_BLUETOOTH_SETTINGS);
+@@ -102,6 +126,13 @@ public class BluetoothTile extends QSTileImpl<BooleanState> {
+                     new Intent(Settings.ACTION_BLUETOOTH_SETTINGS), 0);
+             return;
+         }
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                showDetail(true);
++            });
++            return;
++        }
+         showDetail(true);
+         if (!mState.value) {
+             mController.setBluetoothEnabled(true);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+index 8ba60840a666..94e4c05e1c0a 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+@@ -23,11 +23,13 @@ import android.widget.Switch;
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.Prefs;
+ import com.android.systemui.R;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.SystemUIDialog;
+ import com.android.systemui.statusbar.policy.DataSaverController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.policy.NetworkController;
+ 
+ import javax.inject.Inject;
+@@ -37,11 +39,25 @@ public class DataSaverTile extends QSTileImpl<BooleanState> implements
+ 
+     private final DataSaverController mDataSaverController;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     @Inject
+-    public DataSaverTile(QSHost host, NetworkController networkController) {
++    public DataSaverTile(QSHost host, NetworkController networkController,
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mDataSaverController = networkController.getDataSaverController();
+         mDataSaverController.observe(getLifecycle(), this);
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -53,8 +69,8 @@ public class DataSaverTile extends QSTileImpl<BooleanState> implements
+     public Intent getLongClickIntent() {
+         return new Intent(Settings.ACTION_DATA_SAVER_SETTINGS);
+     }
+-    @Override
+-    protected void handleClick() {
++
++    private void handleClickInner() {
+         if (mState.value
+                 || Prefs.getBoolean(mContext, Prefs.Key.QS_DATA_SAVER_DIALOG_SHOWN, false)) {
+             // Do it right away.
+@@ -73,6 +89,18 @@ public class DataSaverTile extends QSTileImpl<BooleanState> implements
+         Prefs.putBoolean(mContext, Prefs.Key.QS_DATA_SAVER_DIALOG_SHOWN, true);
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     private void toggleDataSaver() {
+         mState.value = !mDataSaverController.isDataSaverEnabled();
+         mDataSaverController.setDataSaverEnabled(mState.value);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+index 1ab77f3f7524..330caa07764b 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+@@ -26,11 +26,13 @@ import android.widget.Switch;
+ 
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.R;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.DataSaverController;
+ import com.android.systemui.statusbar.policy.HotspotController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+@@ -41,17 +43,31 @@ public class HotspotTile extends QSTileImpl<BooleanState> {
+     private final HotspotController mHotspotController;
+     private final DataSaverController mDataSaverController;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     private final HotspotAndDataSaverCallbacks mCallbacks = new HotspotAndDataSaverCallbacks();
+     private boolean mListening;
+ 
+     @Inject
+     public HotspotTile(QSHost host, HotspotController hotspotController,
+-            DataSaverController dataSaverController) {
++            DataSaverController dataSaverController, ActivityStarter activityStarter,
++            KeyguardStateController keyguardStateController) {
+         super(host);
+         mHotspotController = hotspotController;
+         mDataSaverController = dataSaverController;
+         mHotspotController.observe(this, mCallbacks);
+         mDataSaverController.observe(this, mCallbacks);
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -84,8 +100,7 @@ public class HotspotTile extends QSTileImpl<BooleanState> {
+         return new BooleanState();
+     }
+ 
+-    @Override
+-    protected void handleClick() {
++    private void handleClickInner() {
+         final boolean isEnabled = mState.value;
+         if (!isEnabled && mDataSaverController.isDataSaverEnabled()) {
+             return;
+@@ -95,6 +110,18 @@ public class HotspotTile extends QSTileImpl<BooleanState> {
+         mHotspotController.setHotspotEnabled(!isEnabled);
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     @Override
+     public CharSequence getTileLabel() {
+         return mContext.getString(R.string.quick_settings_hotspot_label);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+index e56a2eb9892d..c7bdfd1e075f 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+@@ -30,9 +30,11 @@ import android.widget.Switch;
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.R;
+ import com.android.systemui.broadcast.BroadcastDispatcher;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+@@ -44,12 +46,27 @@ public class NfcTile extends QSTileImpl<BooleanState> {
+     private NfcAdapter mAdapter;
+     private BroadcastDispatcher mBroadcastDispatcher;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     private boolean mListening;
+ 
++
+     @Inject
+-    public NfcTile(QSHost host, BroadcastDispatcher broadcastDispatcher) {
++    public NfcTile(QSHost host, BroadcastDispatcher broadcastDispatcher,
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mBroadcastDispatcher = broadcastDispatcher;
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -84,8 +101,7 @@ public class NfcTile extends QSTileImpl<BooleanState> {
+         return new Intent(Settings.ACTION_NFC_SETTINGS);
+     }
+ 
+-    @Override
+-    protected void handleClick() {
++    private void handleClickInner() {
+         if (getAdapter() == null) {
+             return;
+         }
+@@ -96,6 +112,18 @@ public class NfcTile extends QSTileImpl<BooleanState> {
+         }
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     @Override
+     protected void handleSecondaryClick() {
+         handleClick();
+@@ -149,4 +177,5 @@ public class NfcTile extends QSTileImpl<BooleanState> {
+             refreshState();
+         }
+     };
++
+ }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+index 5dcb4e3b1fb9..6bd153da0db7 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+@@ -25,9 +25,11 @@ import android.widget.Switch;
+ 
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.R;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.policy.RotationLockController;
+ import com.android.systemui.statusbar.policy.RotationLockController.RotationLockControllerCallback;
+ 
+@@ -39,11 +41,25 @@ public class RotationLockTile extends QSTileImpl<BooleanState> {
+     private final Icon mIcon = ResourceIcon.get(com.android.internal.R.drawable.ic_qs_auto_rotate);
+     private final RotationLockController mController;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     @Inject
+-    public RotationLockTile(QSHost host, RotationLockController rotationLockController) {
++    public RotationLockTile(QSHost host, RotationLockController rotationLockController,
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mController = rotationLockController;
+         mController.observe(this, mCallback);
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -56,13 +72,24 @@ public class RotationLockTile extends QSTileImpl<BooleanState> {
+         return new Intent(Settings.ACTION_DISPLAY_SETTINGS);
+     }
+ 
+-    @Override
+-    protected void handleClick() {
++    private void handleClickInner() {
+         final boolean newState = !mState.value;
+         mController.setRotationLocked(!newState);
+         refreshState(newState);
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     @Override
+     public CharSequence getTileLabel() {
+         return getState().label;
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
+index 1279d42eb64d..9cede4ef92ef 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
+@@ -43,6 +43,7 @@ import com.android.systemui.qs.QSDetailItems.Item;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSIconViewImpl;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.policy.NetworkController;
+ import com.android.systemui.statusbar.policy.NetworkController.AccessPointController;
+ import com.android.systemui.statusbar.policy.NetworkController.IconState;
+@@ -66,15 +67,26 @@ public class WifiTile extends QSTileImpl<SignalState> {
+     private final ActivityStarter mActivityStarter;
+     private boolean mExpectDisabled;
+ 
++    private final KeyguardStateController mKeyguard;
++
+     @Inject
+     public WifiTile(QSHost host, NetworkController networkController,
+-            ActivityStarter activityStarter) {
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mController = networkController;
+         mWifiController = mController.getAccessPointController();
+         mDetailAdapter = (WifiDetailAdapter) createDetailAdapter();
+         mActivityStarter = activityStarter;
+         mController.observe(getLifecycle(), mSignalCallback);
++
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -111,8 +123,7 @@ public class WifiTile extends QSTileImpl<SignalState> {
+         return WIFI_SETTINGS;
+     }
+ 
+-    @Override
+-    protected void handleClick() {
++    private void handleClickInner() {
+         // Secondary clicks are header clicks, just toggle.
+         mState.copyTo(mStateBeforeClick);
+         boolean wifiEnabled = mState.value;
+@@ -130,6 +141,18 @@ public class WifiTile extends QSTileImpl<SignalState> {
+         }
+     }
+ 
++    @Override
++    protected void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                handleClickInner();
++            });
++            return;
++        }
++        handleClickInner();
++    }
++
+     @Override
+     protected void handleSecondaryClick() {
+         if (!mWifiController.canConfigWifi()) {
+@@ -137,6 +160,13 @@ public class WifiTile extends QSTileImpl<SignalState> {
+                     new Intent(Settings.ACTION_WIFI_SETTINGS), 0);
+             return;
+         }
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                showDetail(true);
++            });
++            return;
++        }
+         showDetail(true);
+         if (!mState.value) {
+             mController.setWifiEnabled(true);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+index 318c0c4660cb..a8171878ecbd 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+@@ -23,10 +23,12 @@ import android.widget.Switch;
+ 
+ import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
+ import com.android.systemui.R;
++import com.android.systemui.plugins.ActivityStarter;
+ import com.android.systemui.plugins.qs.QSTile.BooleanState;
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.ManagedProfileController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+@@ -37,11 +39,25 @@ public class WorkModeTile extends QSTileImpl<BooleanState> implements
+ 
+     private final ManagedProfileController mProfileController;
+ 
++    private final ActivityStarter mActivityStarter;
++    private final KeyguardStateController mKeyguard;
++
+     @Inject
+-    public WorkModeTile(QSHost host, ManagedProfileController managedProfileController) {
++    public WorkModeTile(QSHost host, ManagedProfileController managedProfileController,
++            ActivityStarter activityStarter, KeyguardStateController keyguardStateController) {
+         super(host);
+         mProfileController = managedProfileController;
+         mProfileController.observe(getLifecycle(), this);
++
++        mActivityStarter = activityStarter;
++        mKeyguard = keyguardStateController;
++        final KeyguardStateController.Callback callback = new KeyguardStateController.Callback() {
++            @Override
++            public void onKeyguardShowingChanged() {
++                refreshState();
++            }
++        };
++        mKeyguard.observe(this, callback);
+     }
+ 
+     @Override
+@@ -56,6 +72,13 @@ public class WorkModeTile extends QSTileImpl<BooleanState> implements
+ 
+     @Override
+     public void handleClick() {
++        if (mKeyguard.isMethodSecure() && mKeyguard.isShowing()) {
++            mActivityStarter.postQSRunnableDismissingKeyguard(() -> {
++                mHost.openPanels();
++                mProfileController.setWorkModeEnabled(!mState.value);
++            });
++            return;
++        }
+         mProfileController.setWorkModeEnabled(!mState.value);
+     }
+ 

Patches/LineageOS-19.1/android_frameworks_base/0032-tile_restrictions.patch

@@ -0,0 +1,671 @@
+From 6f7cde6351b1ba2fb0513d713ad20d42e7f18745 Mon Sep 17 00:00:00 2001
+From: Danny Lin <danny@kdrag0n.dev>
+Date: Tue, 5 Oct 2021 21:01:09 -0700
+Subject: [PATCH] SystemUI: Require unlocking to use sensitive QS tiles
+
+- Airplane mode
+- Battery saver
+- Bluetooth
+- Cellular
+- DataSaver
+- Internet
+- Hotspot
+- NFC
+- Rotation lock
+- Wi-Fi
+- Work mode
+
+This is the same idea as the following commits from GrapheneOS, but
+simplified to reduce changes made to each individual QS tile:
+
+commit 45670099ed63c9fbde6ff1bd13d27b674416d21d
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:22:41 2020 -0700
+
+    require unlocking to use work mode tile
+
+commit 4b7c9559dfba84e10142fcd53b3edac9c75b0748
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:21:16 2020 -0700
+
+    require unlocking to use battery saver tile
+
+commit f45c24a4728531441c60320eda0a4fce4285de06
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:19:36 2020 -0700
+
+    require unlocking to use cellular quick tile
+
+commit c18f6f868aee5b8f27fcc1966089f814f9f89ab2
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:15:46 2020 -0700
+
+    require unlocking to use hotspot quick tile
+
+commit 442c94e1ee499eed467863362f8eb62bb88027a4
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:13:58 2020 -0700
+
+    require unlocking to use data saver quick tile
+
+commit cf84259708f9bf650c8494e16025725b1bfa5e23
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:11:58 2020 -0700
+
+    require unlocking to use rotation lock quick tile
+
+commit 61eb5a6392c53e4d44cb91cdb4df27c3055ef439
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:08:33 2020 -0700
+
+    require unlocking to use Wi-Fi quick tile
+
+commit ad122f0a5a46e2445b5866d3ff83fdc7623b76f6
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:05:18 2020 -0700
+
+    require unlocking to use airplane mode quick tile
+
+commit a3686b6f905fb734b3a4f6db545e8a3ef3fc3cc7
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:02:20 2020 -0700
+
+    require unlocking to use Bluetooth quick tile
+
+commit 3046535a40f53835eb0b57d4c12a29828ba90f30
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 16:47:59 2020 -0700
+
+    require unlocking to use NFC quick tile
+
+commit 991e4579ad329df28a6e18bb0de8a5368d91bb73
+Author: flawedworld <flawedworld@flawed.world>
+Date:   Thu Dec 9 16:24:47 2021 +0000
+
+    SystemUI: Require unlocking to use Internet quick tile
+---
+ .../systemui/qs/tiles/AirplaneModeTile.java   | 14 +++--
+ .../systemui/qs/tiles/BatterySaverTile.java   | 14 +++--
+ .../systemui/qs/tiles/BluetoothTile.java      | 14 +++--
+ .../systemui/qs/tiles/CellularTile.java       | 14 +++--
+ .../systemui/qs/tiles/DataSaverTile.java      | 14 +++--
+ .../systemui/qs/tiles/HotspotTile.java        | 14 +++--
+ .../systemui/qs/tiles/InternetTile.java       | 13 +++--
+ .../android/systemui/qs/tiles/NfcTile.java    | 14 +++--
+ .../systemui/qs/tiles/RotationLockTile.java   | 14 +++--
+ .../android/systemui/qs/tiles/SecureQSTile.kt | 58 +++++++++++++++++++
+ .../android/systemui/qs/tiles/WifiTile.java   | 14 +++--
+ .../systemui/qs/tiles/WorkModeTile.java       | 14 +++--
+ 12 files changed, 167 insertions(+), 44 deletions(-)
+ create mode 100644 packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+index 22cd6f86b165..f76966030528 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+@@ -48,13 +48,14 @@
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ import dagger.Lazy;
+ 
+ /** Quick settings tile: Airplane mode **/
+-public class AirplaneModeTile extends QSTileImpl<BooleanState> {
++public class AirplaneModeTile extends SecureQSTile<BooleanState> {
+     private final Icon mIcon = ResourceIcon.get(com.android.internal.R.drawable.ic_qs_airplane);
+     private final GlobalSetting mSetting;
+     private final BroadcastDispatcher mBroadcastDispatcher;
+@@ -73,10 +74,11 @@ public AirplaneModeTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             BroadcastDispatcher broadcastDispatcher,
+-            Lazy<ConnectivityManager> lazyConnectivityManager
++            Lazy<ConnectivityManager> lazyConnectivityManager,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBroadcastDispatcher = broadcastDispatcher;
+         mLazyConnectivityManager = lazyConnectivityManager;
+ 
+@@ -95,7 +97,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    public void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         boolean airplaneModeEnabled = mState.value;
+         MetricsLogger.action(mContext, getMetricsCategory(), !airplaneModeEnabled);
+         if (!airplaneModeEnabled && TelephonyProperties.in_ecm_mode().orElse(false)) {
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+index e3024fa0eddc..f68572bc3e75 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+@@ -40,11 +40,12 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BatteryController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.util.settings.SecureSettings;
+ 
+ import javax.inject.Inject;
+ 
+-public class BatterySaverTile extends QSTileImpl<BooleanState> implements
++public class BatterySaverTile extends SecureQSTile<BooleanState> implements
+         BatteryController.BatteryStateChangeCallback {
+ 
+     private final BatteryController mBatteryController;
+@@ -69,10 +70,11 @@ public BatterySaverTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             BatteryController batteryController,
+-            SecureSettings secureSettings
++            SecureSettings secureSettings,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBatteryController = batteryController;
+         mBatteryController.observe(getLifecycle(), this);
+         int currentUser = host.getUserContext().getUserId();
+@@ -123,7 +125,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (getState().state == Tile.STATE_UNAVAILABLE) {
+             return;
+         }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+index 65b6617c5a25..7c24a8c9c10e 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+@@ -53,6 +53,7 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BluetoothController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import java.util.ArrayList;
+ import java.util.Collection;
+@@ -61,7 +62,7 @@
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Bluetooth **/
+-public class BluetoothTile extends QSTileImpl<BooleanState> {
++public class BluetoothTile extends SecureQSTile<BooleanState> {
+     private static final Intent BLUETOOTH_SETTINGS = new Intent(Settings.ACTION_BLUETOOTH_SETTINGS);
+ 
+     private final BluetoothController mController;
+@@ -77,10 +78,11 @@ public BluetoothTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            BluetoothController bluetoothController
++            BluetoothController bluetoothController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = bluetoothController;
+         mDetailAdapter = (BluetoothDetailAdapter) createDetailAdapter();
+         mController.observe(getLifecycle(), mCallback);
+@@ -97,7 +99,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         // Secondary clicks are header clicks, just toggle.
+         final boolean isEnabled = mState.value;
+         // Immediately enter transient enabling state when turning bluetooth on.
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/CellularTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/CellularTile.java
+index e5601f29af0b..e7ed5575e302 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/CellularTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/CellularTile.java
+@@ -62,11 +62,12 @@
+ import com.android.systemui.statusbar.connectivity.NetworkController;
+ import com.android.systemui.statusbar.connectivity.SignalCallback;
+ import com.android.systemui.statusbar.phone.SystemUIDialog;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Cellular **/
+-public class CellularTile extends QSTileImpl<SignalState> {
++public class CellularTile extends SecureQSTile<SignalState> {
+     private static final String ENABLE_SETTINGS_DATA_PLAN = "enable.settings.data.plan";
+ 
+     private final NetworkController mController;
+@@ -85,10 +86,11 @@ public CellularTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            NetworkController networkController
++            NetworkController networkController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = networkController;
+         mDataController = mController.getMobileDataController();
+         mDetailAdapter = new CellularDetailAdapter();
+@@ -119,7 +121,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (getState().state == Tile.STATE_UNAVAILABLE) {
+             return;
+         }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+index a2577d6e7f60..591d31889491 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+@@ -40,10 +40,11 @@
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.SystemUIDialog;
+ import com.android.systemui.statusbar.policy.DataSaverController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+-public class DataSaverTile extends QSTileImpl<BooleanState> implements
++public class DataSaverTile extends SecureQSTile<BooleanState> implements
+         DataSaverController.Listener{
+ 
+     private final DataSaverController mDataSaverController;
+@@ -60,10 +61,11 @@ public DataSaverTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             DataSaverController dataSaverController,
+-            DialogLaunchAnimator dialogLaunchAnimator
++            DialogLaunchAnimator dialogLaunchAnimator,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mDataSaverController = dataSaverController;
+         mDialogLaunchAnimator = dialogLaunchAnimator;
+         mDataSaverController.observe(getLifecycle(), this);
+@@ -79,7 +81,11 @@ public Intent getLongClickIntent() {
+         return new Intent(Settings.ACTION_DATA_SAVER_SETTINGS);
+     }
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (mState.value
+                 || Prefs.getBoolean(mContext, Prefs.Key.QS_DATA_SAVER_DIALOG_SHOWN, false)) {
+             // Do it right away.
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+index 87edc2cf8bac..04742b53321c 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+@@ -42,11 +42,12 @@
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.DataSaverController;
+ import com.android.systemui.statusbar.policy.HotspotController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Hotspot **/
+-public class HotspotTile extends QSTileImpl<BooleanState> {
++public class HotspotTile extends SecureQSTile<BooleanState> {
+ 
+     private final Icon mEnabledStatic = ResourceIcon.get(R.drawable.ic_hotspot);
+ 
+@@ -67,10 +68,11 @@ public HotspotTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             HotspotController hotspotController,
+-            DataSaverController dataSaverController
++            DataSaverController dataSaverController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mHotspotController = hotspotController;
+         mDataSaverController = dataSaverController;
+         mHotspotController.observe(this, mCallbacks);
+@@ -108,7 +110,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         final boolean isEnabled = mState.value;
+         if (!isEnabled && mDataSaverController.isDataSaverEnabled()) {
+             return;
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
+index cd81b4a11703..61be4e7ccd40 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
+@@ -53,6 +53,7 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.qs.tiles.dialog.InternetDialogFactory;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.connectivity.AccessPointController;
+ import com.android.systemui.statusbar.connectivity.IconState;
+ import com.android.systemui.statusbar.connectivity.MobileDataIndicators;
+@@ -67,7 +68,7 @@
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Internet **/
+-public class InternetTile extends QSTileImpl<SignalState> {
++public class InternetTile extends SecureQSTile<SignalState> {
+     private static final Intent WIFI_SETTINGS = new Intent(Settings.ACTION_WIFI_SETTINGS);
+ 
+     protected final NetworkController mController;
+@@ -92,10 +93,11 @@ public InternetTile(
+             QSLogger qsLogger,
+             NetworkController networkController,
+             AccessPointController accessPointController,
+-            InternetDialogFactory internetDialogFactory
++            InternetDialogFactory internetDialogFactory,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mInternetDialogFactory = internetDialogFactory;
+         mHandler = mainHandler;
+         mController = networkController;
+@@ -122,7 +124,10 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
+         mHandler.post(() -> mInternetDialogFactory.create(true,
+                 mAccessPointController.canConfigMobileData(),
+                 mAccessPointController.canConfigWifi(), view));
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+index b9bc0e5ca814..1bd913ea9496 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+@@ -45,11 +45,12 @@
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Enable/Disable NFC **/
+-public class NfcTile extends QSTileImpl<BooleanState> {
++public class NfcTile extends SecureQSTile<BooleanState> {
+ 
+     private static final String NFC = "nfc";
+     private final Icon mIcon = ResourceIcon.get(R.drawable.ic_qs_nfc);
+@@ -69,10 +70,11 @@ public NfcTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            BroadcastDispatcher broadcastDispatcher
++            BroadcastDispatcher broadcastDispatcher,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBroadcastDispatcher = broadcastDispatcher;
+     }
+ 
+@@ -114,7 +116,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (getAdapter() == null) {
+             return;
+         }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+index 0bbb5bdd851a..c28d09f80f74 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+@@ -40,13 +40,14 @@
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.policy.RotationLockController;
+ import com.android.systemui.statusbar.policy.RotationLockController.RotationLockControllerCallback;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Rotation **/
+-public class RotationLockTile extends QSTileImpl<BooleanState> {
++public class RotationLockTile extends SecureQSTile<BooleanState> {
+ 
+     private final Icon mIcon = ResourceIcon.get(com.android.internal.R.drawable.ic_qs_auto_rotate);
+     private final RotationLockController mController;
+@@ -61,10 +62,11 @@ public RotationLockTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            RotationLockController rotationLockController
++            RotationLockController rotationLockController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = rotationLockController;
+         mController.observe(this, mCallback);
+     }
+@@ -80,7 +82,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         final boolean newState = !mState.value;
+         mController.setRotationLocked(!newState);
+         refreshState(newState);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt b/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+new file mode 100644
+index 000000000000..30a5461fbb59
+--- /dev/null
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+@@ -0,0 +1,58 @@
++/*
++ * Copyright (C) 2021 The Android Open Source Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package com.android.systemui.qs.tiles
++
++import android.os.Handler
++import android.os.Looper
++import android.view.View
++import com.android.systemui.plugins.qs.QSTile
++import com.android.systemui.qs.QSHost
++import com.android.systemui.plugins.FalsingManager
++import com.android.internal.logging.MetricsLogger
++import com.android.systemui.plugins.ActivityStarter
++import com.android.systemui.plugins.statusbar.StatusBarStateController
++import com.android.systemui.qs.logging.QSLogger
++import com.android.systemui.statusbar.policy.KeyguardStateController
++import com.android.systemui.qs.tileimpl.QSTileImpl
++
++internal abstract class SecureQSTile<TState : QSTile.State> protected constructor(
++    host: QSHost, backgroundLooper: Looper, mainHandler: Handler, falsingManager: FalsingManager,
++    metricsLogger: MetricsLogger, statusBarStateController: StatusBarStateController,
++    activityStarter: ActivityStarter, qsLogger: QSLogger,
++    private val mKeyguard: KeyguardStateController,
++) : QSTileImpl<TState>(
++    host, backgroundLooper, mainHandler, falsingManager, metricsLogger, statusBarStateController,
++    activityStarter, qsLogger,
++) {
++    abstract override fun newTileState(): TState
++
++    protected abstract fun handleClick(view: View?, keyguardShowing: Boolean)
++
++    override fun handleClick(view: View?) {
++        handleClick(view, mKeyguard.isMethodSecure && mKeyguard.isShowing)
++    }
++
++    protected fun checkKeyguard(view: View?, keyguardShowing: Boolean): Boolean {
++        return if (keyguardShowing) {
++            mActivityStarter.postQSRunnableDismissingKeyguard {
++                handleClick(view, false)
++            }
++            true
++        } else {
++            false
++        }
++    }
++}
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
+index e79ca0c93212..89cebab4fda4 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/WifiTile.java
+@@ -58,6 +58,7 @@
+ import com.android.systemui.statusbar.connectivity.SignalCallback;
+ import com.android.systemui.statusbar.connectivity.WifiIcons;
+ import com.android.systemui.statusbar.connectivity.WifiIndicators;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.wifitrackerlib.WifiEntry;
+ 
+ import java.util.List;
+@@ -65,7 +66,7 @@
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Wifi **/
+-public class WifiTile extends QSTileImpl<SignalState> {
++public class WifiTile extends SecureQSTile<SignalState> {
+     private static final Intent WIFI_SETTINGS = new Intent(Settings.ACTION_WIFI_SETTINGS);
+ 
+     protected final NetworkController mController;
+@@ -87,10 +88,11 @@ public WifiTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             NetworkController networkController,
+-            AccessPointController accessPointController
++            AccessPointController accessPointController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = networkController;
+         mWifiController = accessPointController;
+         mDetailAdapter = (WifiDetailAdapter) createDetailAdapter();
+@@ -133,7 +135,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         // Secondary clicks are header clicks, just toggle.
+         mState.copyTo(mStateBeforeClick);
+         boolean wifiEnabled = mState.value;
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+index 8df8c63702c3..7fc1726632ea 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+@@ -39,11 +39,12 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.ManagedProfileController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Work profile on/off */
+-public class WorkModeTile extends QSTileImpl<BooleanState> implements
++public class WorkModeTile extends SecureQSTile<BooleanState> implements
+         ManagedProfileController.Callback {
+     private final Icon mIcon = ResourceIcon.get(R.drawable.stat_sys_managed_profile_status);
+ 
+@@ -59,10 +60,11 @@ public WorkModeTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            ManagedProfileController managedProfileController
++            ManagedProfileController managedProfileController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mProfileController = managedProfileController;
+         mProfileController.observe(getLifecycle(), this);
+     }
+@@ -78,7 +80,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    public void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         mProfileController.setWorkModeEnabled(!mState.value);
+     }
+ 

Patches/LineageOS-20.0/android_frameworks_base/0041-tile_restrictions.patch

@@ -0,0 +1,577 @@
+From 6c3be72e795b4b2de830dd981787f197cc1aa7ee Mon Sep 17 00:00:00 2001
+From: Danny Lin <danny@kdrag0n.dev>
+Date: Wed, 6 Oct 2021 07:01:09 +0300
+Subject: [PATCH] SystemUI: Require unlocking to use sensitive QS tiles
+
+- Airplane mode
+- Battery saver
+- Bluetooth
+- Cellular
+- DataSaver
+- Internet
+- Hotspot
+- NFC
+- Rotation lock
+- Wi-Fi
+- Work mode
+
+This is the same idea as the following commits from GrapheneOS, but
+simplified to reduce changes made to each individual QS tile:
+
+commit 45670099ed63c9fbde6ff1bd13d27b674416d21d
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:22:41 2020 -0700
+
+    require unlocking to use work mode tile
+
+commit 4b7c9559dfba84e10142fcd53b3edac9c75b0748
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:21:16 2020 -0700
+
+    require unlocking to use battery saver tile
+
+commit f45c24a4728531441c60320eda0a4fce4285de06
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:19:36 2020 -0700
+
+    require unlocking to use cellular quick tile
+
+commit c18f6f868aee5b8f27fcc1966089f814f9f89ab2
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:15:46 2020 -0700
+
+    require unlocking to use hotspot quick tile
+
+commit 442c94e1ee499eed467863362f8eb62bb88027a4
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:13:58 2020 -0700
+
+    require unlocking to use data saver quick tile
+
+commit cf84259708f9bf650c8494e16025725b1bfa5e23
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:11:58 2020 -0700
+
+    require unlocking to use rotation lock quick tile
+
+commit 61eb5a6392c53e4d44cb91cdb4df27c3055ef439
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:08:33 2020 -0700
+
+    require unlocking to use Wi-Fi quick tile
+
+commit ad122f0a5a46e2445b5866d3ff83fdc7623b76f6
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:05:18 2020 -0700
+
+    require unlocking to use airplane mode quick tile
+
+commit a3686b6f905fb734b3a4f6db545e8a3ef3fc3cc7
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 17:02:20 2020 -0700
+
+    require unlocking to use Bluetooth quick tile
+
+commit 3046535a40f53835eb0b57d4c12a29828ba90f30
+Author: inthewaves <inthewaves@pm.me>
+Date:   Thu Sep 10 16:47:59 2020 -0700
+
+    require unlocking to use NFC quick tile
+
+commit 991e4579ad329df28a6e18bb0de8a5368d91bb73
+Author: flawedworld <flawedworld@flawed.world>
+Date:   Thu Dec 9 16:24:47 2021 +0000
+
+    SystemUI: Require unlocking to use Internet quick tile
+---
+ .../systemui/qs/tiles/AirplaneModeTile.java   | 14 +++--
+ .../systemui/qs/tiles/BatterySaverTile.java   | 14 +++--
+ .../systemui/qs/tiles/BluetoothTile.java      | 14 +++--
+ .../systemui/qs/tiles/DataSaverTile.java      | 14 +++--
+ .../systemui/qs/tiles/HotspotTile.java        | 14 +++--
+ .../systemui/qs/tiles/InternetTile.java       | 13 +++--
+ .../android/systemui/qs/tiles/NfcTile.java    | 14 +++--
+ .../systemui/qs/tiles/RotationLockTile.java   | 14 +++--
+ .../android/systemui/qs/tiles/SecureQSTile.kt | 58 +++++++++++++++++++
+ .../systemui/qs/tiles/WorkModeTile.java       | 14 +++--
+ 10 files changed, 147 insertions(+), 36 deletions(-)
+ create mode 100644 packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+index 92a83bba8a68..4efb900e2d4e 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/AirplaneModeTile.java
+@@ -49,6 +49,7 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.settings.UserTracker;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.util.settings.GlobalSettings;
+ 
+ import javax.inject.Inject;
+@@ -56,7 +57,7 @@
+ import dagger.Lazy;
+ 
+ /** Quick settings tile: Airplane mode **/
+-public class AirplaneModeTile extends QSTileImpl<BooleanState> {
++public class AirplaneModeTile extends SecureQSTile<BooleanState> {
+ 
+     public static final String TILE_SPEC = "airplane";
+ 
+@@ -79,10 +80,11 @@ public AirplaneModeTile(
+             BroadcastDispatcher broadcastDispatcher,
+             Lazy<ConnectivityManager> lazyConnectivityManager,
+             GlobalSettings globalSettings,
+-            UserTracker userTracker
++            UserTracker userTracker,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBroadcastDispatcher = broadcastDispatcher;
+         mLazyConnectivityManager = lazyConnectivityManager;
+ 
+@@ -102,7 +104,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    public void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         boolean airplaneModeEnabled = mState.value;
+         MetricsLogger.action(mContext, getMetricsCategory(), !airplaneModeEnabled);
+         if (!airplaneModeEnabled && TelephonyProperties.in_ecm_mode().orElse(false)) {
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+index 027a464251c9..848bcbf9cc28 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BatterySaverTile.java
+@@ -41,11 +41,12 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BatteryController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.util.settings.SecureSettings;
+ 
+ import javax.inject.Inject;
+ 
+-public class BatterySaverTile extends QSTileImpl<BooleanState> implements
++public class BatterySaverTile extends SecureQSTile<BooleanState> implements
+         BatteryController.BatteryStateChangeCallback {
+ 
+     public static final String TILE_SPEC = "battery";
+@@ -70,10 +71,11 @@ public BatterySaverTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             BatteryController batteryController,
+-            SecureSettings secureSettings
++            SecureSettings secureSettings,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBatteryController = batteryController;
+         mBatteryController.observe(getLifecycle(), this);
+         int currentUser = host.getUserContext().getUserId();
+@@ -129,7 +131,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (getState().state == Tile.STATE_UNAVAILABLE) {
+             return;
+         }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+index df1c8dfdde96..f19d8d43c9ed 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/BluetoothTile.java
+@@ -48,13 +48,14 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BluetoothController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import java.util.List;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Bluetooth **/
+-public class BluetoothTile extends QSTileImpl<BooleanState> {
++public class BluetoothTile extends SecureQSTile<BooleanState> {
+ 
+     public static final String TILE_SPEC = "bt";
+ 
+@@ -72,10 +73,11 @@ public BluetoothTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            BluetoothController bluetoothController
++            BluetoothController bluetoothController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = bluetoothController;
+         mController.observe(getLifecycle(), mCallback);
+     }
+@@ -86,7 +88,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         // Secondary clicks are header clicks, just toggle.
+         final boolean isEnabled = mState.value;
+         // Immediately enter transient enabling state when turning bluetooth on.
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+index add517e18516..a72decde98c5 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/DataSaverTile.java
+@@ -42,10 +42,11 @@
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.SystemUIDialog;
+ import com.android.systemui.statusbar.policy.DataSaverController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+-public class DataSaverTile extends QSTileImpl<BooleanState> implements
++public class DataSaverTile extends SecureQSTile<BooleanState> implements
+         DataSaverController.Listener{
+ 
+     public static final String TILE_SPEC = "saver";
+@@ -66,10 +67,11 @@ public DataSaverTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             DataSaverController dataSaverController,
+-            DialogLaunchAnimator dialogLaunchAnimator
++            DialogLaunchAnimator dialogLaunchAnimator,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mDataSaverController = dataSaverController;
+         mDialogLaunchAnimator = dialogLaunchAnimator;
+         mDataSaverController.observe(getLifecycle(), this);
+@@ -85,7 +87,11 @@ public Intent getLongClickIntent() {
+         return new Intent(Settings.ACTION_DATA_SAVER_SETTINGS);
+     }
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (mState.value
+                 || Prefs.getBoolean(mContext, Prefs.Key.QS_DATA_SAVER_DIALOG_SHOWN, false)) {
+             // Do it right away.
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+index 6bf8b7666054..d1481cff5bcc 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/HotspotTile.java
+@@ -45,11 +45,12 @@
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.DataSaverController;
+ import com.android.systemui.statusbar.policy.HotspotController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Hotspot **/
+-public class HotspotTile extends QSTileImpl<BooleanState> {
++public class HotspotTile extends SecureQSTile<BooleanState> {
+ 
+     public static final String TILE_SPEC = "hotspot";
+     private final HotspotController mHotspotController;
+@@ -69,10 +70,11 @@ public HotspotTile(
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+             HotspotController hotspotController,
+-            DataSaverController dataSaverController
++            DataSaverController dataSaverController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mHotspotController = hotspotController;
+         mDataSaverController = dataSaverController;
+         mHotspotController.observe(this, mCallbacks);
+@@ -110,7 +112,11 @@ public BooleanState newTileState() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         final boolean isEnabled = mState.value;
+         if (!isEnabled && mDataSaverController.isDataSaverEnabled()) {
+             return;
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
+index 75d01723667d..6cbd91706d1e 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/InternetTile.java
+@@ -54,6 +54,7 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.qs.tiles.dialog.InternetDialogFactory;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.connectivity.AccessPointController;
+ import com.android.systemui.statusbar.connectivity.IconState;
+ import com.android.systemui.statusbar.connectivity.MobileDataIndicators;
+@@ -67,7 +68,7 @@
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Internet **/
+-public class InternetTile extends QSTileImpl<SignalState> {
++public class InternetTile extends SecureQSTile<SignalState> {
+ 
+     public static final String TILE_SPEC = "internet";
+ 
+@@ -99,10 +100,11 @@ public InternetTile(
+             QSLogger qsLogger,
+             NetworkController networkController,
+             AccessPointController accessPointController,
+-            InternetDialogFactory internetDialogFactory
++            InternetDialogFactory internetDialogFactory,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mInternetDialogFactory = internetDialogFactory;
+         mHandler = mainHandler;
+         mController = networkController;
+@@ -129,7 +131,10 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
+         mHandler.post(() -> mInternetDialogFactory.create(true,
+                 mAccessPointController.canConfigMobileData(),
+                 mAccessPointController.canConfigWifi(), view));
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+index e189f80a7c23..87a386349541 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/NfcTile.java
+@@ -45,11 +45,12 @@
+ import com.android.systemui.qs.QSHost;
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Enable/Disable NFC **/
+-public class NfcTile extends QSTileImpl<BooleanState> {
++public class NfcTile extends SecureQSTile<BooleanState> {
+ 
+     public static final String TILE_SPEC = "nfc";
+ 
+@@ -72,10 +73,11 @@ public NfcTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            BroadcastDispatcher broadcastDispatcher
++            BroadcastDispatcher broadcastDispatcher,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mBroadcastDispatcher = broadcastDispatcher;
+     }
+ 
+@@ -117,7 +119,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         if (getAdapter() == null) {
+             return;
+         }
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+index 8888c733c3c1..3c9aef445efe 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/RotationLockTile.java
+@@ -48,6 +48,7 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.policy.BatteryController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ import com.android.systemui.statusbar.policy.RotationLockController;
+ import com.android.systemui.statusbar.policy.RotationLockController.RotationLockControllerCallback;
+ import com.android.systemui.util.settings.SecureSettings;
+@@ -55,7 +56,7 @@
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Rotation **/
+-public class RotationLockTile extends QSTileImpl<BooleanState> implements
++public class RotationLockTile extends SecureQSTile<BooleanState> implements
+         BatteryController.BatteryStateChangeCallback {
+ 
+     public static final String TILE_SPEC = "rotation";
+@@ -81,10 +82,11 @@ public RotationLockTile(
+             RotationLockController rotationLockController,
+             SensorPrivacyManager privacyManager,
+             BatteryController batteryController,
+-            SecureSettings secureSettings
++            SecureSettings secureSettings,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mController = rotationLockController;
+         mController.observe(this, mCallback);
+         mPrivacyManager = privacyManager;
+@@ -126,7 +128,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    protected void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         final boolean newState = !mState.value;
+         mController.setRotationLocked(!newState);
+         refreshState(newState);
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt b/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+new file mode 100644
+index 000000000000..30a5461fbb59
+--- /dev/null
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/SecureQSTile.kt
+@@ -0,0 +1,58 @@
++/*
++ * Copyright (C) 2021 The Android Open Source Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package com.android.systemui.qs.tiles
++
++import android.os.Handler
++import android.os.Looper
++import android.view.View
++import com.android.systemui.plugins.qs.QSTile
++import com.android.systemui.qs.QSHost
++import com.android.systemui.plugins.FalsingManager
++import com.android.internal.logging.MetricsLogger
++import com.android.systemui.plugins.ActivityStarter
++import com.android.systemui.plugins.statusbar.StatusBarStateController
++import com.android.systemui.qs.logging.QSLogger
++import com.android.systemui.statusbar.policy.KeyguardStateController
++import com.android.systemui.qs.tileimpl.QSTileImpl
++
++internal abstract class SecureQSTile<TState : QSTile.State> protected constructor(
++    host: QSHost, backgroundLooper: Looper, mainHandler: Handler, falsingManager: FalsingManager,
++    metricsLogger: MetricsLogger, statusBarStateController: StatusBarStateController,
++    activityStarter: ActivityStarter, qsLogger: QSLogger,
++    private val mKeyguard: KeyguardStateController,
++) : QSTileImpl<TState>(
++    host, backgroundLooper, mainHandler, falsingManager, metricsLogger, statusBarStateController,
++    activityStarter, qsLogger,
++) {
++    abstract override fun newTileState(): TState
++
++    protected abstract fun handleClick(view: View?, keyguardShowing: Boolean)
++
++    override fun handleClick(view: View?) {
++        handleClick(view, mKeyguard.isMethodSecure && mKeyguard.isShowing)
++    }
++
++    protected fun checkKeyguard(view: View?, keyguardShowing: Boolean): Boolean {
++        return if (keyguardShowing) {
++            mActivityStarter.postQSRunnableDismissingKeyguard {
++                handleClick(view, false)
++            }
++            true
++        } else {
++            false
++        }
++    }
++}
+diff --git a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+index 6a5c99032457..665e8a16dae9 100644
+--- a/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
++++ b/packages/SystemUI/src/com/android/systemui/qs/tiles/WorkModeTile.java
+@@ -43,11 +43,12 @@
+ import com.android.systemui.qs.logging.QSLogger;
+ import com.android.systemui.qs.tileimpl.QSTileImpl;
+ import com.android.systemui.statusbar.phone.ManagedProfileController;
++import com.android.systemui.statusbar.policy.KeyguardStateController;
+ 
+ import javax.inject.Inject;
+ 
+ /** Quick settings tile: Work profile on/off */
+-public class WorkModeTile extends QSTileImpl<BooleanState> implements
++public class WorkModeTile extends SecureQSTile<BooleanState> implements
+         ManagedProfileController.Callback {
+ 
+     public static final String TILE_SPEC = "work";
+@@ -66,10 +67,11 @@ public WorkModeTile(
+             StatusBarStateController statusBarStateController,
+             ActivityStarter activityStarter,
+             QSLogger qsLogger,
+-            ManagedProfileController managedProfileController
++            ManagedProfileController managedProfileController,
++            KeyguardStateController keyguardStateController
+     ) {
+         super(host, backgroundLooper, mainHandler, falsingManager, metricsLogger,
+-                statusBarStateController, activityStarter, qsLogger);
++                statusBarStateController, activityStarter, qsLogger, keyguardStateController);
+         mProfileController = managedProfileController;
+         mProfileController.observe(getLifecycle(), this);
+     }
+@@ -85,7 +87,11 @@ public Intent getLongClickIntent() {
+     }
+ 
+     @Override
+-    public void handleClick(@Nullable View view) {
++    protected void handleClick(@Nullable View view, boolean keyguardShowing) {
++        if (checkKeyguard(view, keyguardShowing)) {
++            return;
++        }
++
+         mProfileController.setWorkModeEnabled(!mState.value);
+     }
+ 

Scripts/LineageOS-18.1/Patch.sh

@@ -166,6 +166,7 @@ applyPatch "$DOS_PATCHES/android_frameworks_base/0021-SUPL_Toggle.patch"; #Add a
 applyPatch "$DOS_PATCHES/android_frameworks_base/0022-Allow_Disabling_NTP.patch"; #Dont ping ntp server when nitz time update is toggled off (GrapheneOS)
 applyPatch "$DOS_PATCHES/android_frameworks_base/0023-System_JobScheduler_Allowance.patch"; #DeviceIdleJobsController: don't ignore whitelisted system apps (GrapheneOS)
 if [ "$DOS_MICROG_SUPPORT" = true ]; then applyPatch "$DOS_PATCHES/android_frameworks_base/0024-Unprivileged_microG_Handling.patch"; fi; #Unprivileged microG handling (heavily based off of a CalyxOS patch)
+applyPatch "$DOS_PATCHES/android_frameworks_base/0025-tile_restrictions.patch"; #SystemUI: Require unlocking to use sensitive QS tiles (GrapheneOS)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0006-Do-not-throw-in-setAppOnInterfaceLocked.patch"; #Fix random reboots on broken kernels when an app has data restricted XXX: ugly (DivestOS)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0007-ABI_Warning.patch"; #Warn when running activity from 32 bit app on ARM64 devices. (AOSP)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0008-No_Crash_GSF.patch"; #Don't crash apps that depend on missing Gservices provider (GrapheneOS)

Scripts/LineageOS-19.1/Patch.sh

@@ -176,6 +176,7 @@ applyPatch "$DOS_PATCHES/android_frameworks_base/0028-SUPL_Toggle.patch"; #Add a
 applyPatch "$DOS_PATCHES/android_frameworks_base/0029-Allow_Disabling_NTP.patch"; #Dont ping ntp server when nitz time update is toggled off (GrapheneOS)
 applyPatch "$DOS_PATCHES/android_frameworks_base/0030-System_JobScheduler_Allowance.patch"; #DeviceIdleJobsController: don't ignore whitelisted system apps (GrapheneOS)
 if [ "$DOS_MICROG_SUPPORT" = true ]; then applyPatch "$DOS_PATCHES/android_frameworks_base/0031-Unprivileged_microG_Handling.patch"; fi; #Unprivileged microG handling (heavily based off of a CalyxOS patch)
+applyPatch "$DOS_PATCHES/android_frameworks_base/0032-tile_restrictions.patch"; #SystemUI: Require unlocking to use sensitive QS tiles (GrapheneOS)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0007-ABI_Warning.patch"; #Warn when running activity from 32 bit app on ARM64 devices. (AOSP)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0008-No_Crash_GSF.patch"; #Don't crash apps that depend on missing Gservices provider (GrapheneOS)
 hardenLocationConf services/core/java/com/android/server/location/gnss/gps_debug.conf; #Harden the default GPS config

Scripts/LineageOS-20.0/Patch.sh

@@ -189,6 +189,7 @@ fi;
 applyPatch "$DOS_PATCHES/android_frameworks_base/0038-no-camera-lpad.patch"; #Do not auto-grant Camera permission to the eUICC LPA UI app (GrapheneOS)
 applyPatch "$DOS_PATCHES/android_frameworks_base/0039-package_hooks.patch"; #Add hooks for modifying PackageManagerService behavior (GrapheneOS)
 applyPatch "$DOS_PATCHES/android_frameworks_base/0040-euicc-restrictions.patch"; #Integrate Google's EuiccSupportPixel package (GrapheneOS)
+applyPatch "$DOS_PATCHES/android_frameworks_base/0041-tile_restrictions.patch"; #SystemUI: Require unlocking to use sensitive QS tiles (GrapheneOS)
 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0008-No_Crash_GSF.patch"; #Don't crash apps that depend on missing Gservices provider (GrapheneOS)
 hardenLocationConf services/core/java/com/android/server/location/gnss/gps_debug.conf; #Harden the default GPS config
 sed -i 's/DEFAULT_USE_COMPACTION = false;/DEFAULT_USE_COMPACTION = true;/' services/core/java/com/android/server/am/CachedAppOptimizer.java; #Enable app compaction by default (GrapheneOS)