The hub's API and device sign-in, the token in the Keystore (refs #2) 5ae4af48ddd2

package io.oxygenhub.android

import android.app.Application

import android.os.Build

import io.oxygenhub.android.api.DeviceAuth

import io.oxygenhub.android.api.HubClient

import io.oxygenhub.android.api.HubDeviceAuth

import io.oxygenhub.android.api.hubHttpClient

import io.oxygenhub.android.auth.KeystoreSessionStore

import io.oxygenhub.android.auth.SessionManager

import okhttp3.OkHttpClient

/** The hub the app signs in to unless told otherwise. */

const val DEFAULT_HUB = "https://oxygenhub.io"

/** The app's shared objects, made once. A small hand-made container: no DI framework yet. */

class AppContainer(app: Application) {

    val http: OkHttpClient = hubHttpClient()

    val sessions = SessionManager(KeystoreSessionStore(app)) { session, onUnauthorized ->

        HubClient(session.hub, session.token, http, onUnauthorized)

    }

    fun deviceAuth(hub: String): DeviceAuth = HubDeviceAuth(hub, http)

    /** What the app calls itself on the hub's /device page and token list. */

    val clientName: String = "OxygenHub for Android on ${Build.MODEL}".take(80)

}

class OxygenHubApp : Application() {

    lateinit var container: AppContainer

        private set

    override fun onCreate() {

        super.onCreate()

        container = AppContainer(this)

    }

}

package io.oxygenhub.android.api

import kotlinx.coroutines.delay

import kotlinx.serialization.SerialName

import kotlinx.serialization.Serializable

import okhttp3.HttpUrl.Companion.toHttpUrl

import okhttp3.OkHttpClient

import okhttp3.Request

import okhttp3.RequestBody.Companion.toRequestBody

import java.io.IOException

/** The scopes the app asks for. The user may untick any of them on the web. */

val AppScopes: List<String> = listOf("repo:read", "user:read")

/** Why a device sign-in ended without a token. */

sealed class DeviceFlowException(message: String) : Exception(message) {

    class Denied : DeviceFlowException("The sign-in was denied on the web.")

    class Expired : DeviceFlowException("The code expired before it was approved. Start again for a new one.")

    class Refused(val status: Int, val detail: String) : DeviceFlowException(detail)

}

/**

 * Device sign-in (oxygenhub#67, RFC 8628's shape), as `oh auth login` does

 * it: ask the hub for a code, show it, the user approves it on the hub's

 * `/device` page (signed in there with their password and, if they use one,

 * their second factor), and the app's next poll gets a token. The app never

 * sees a password or a second-factor code.

 */

interface DeviceAuth {

    /** `POST /device/code`: a code to show, and one to poll with. */

    suspend fun requestCode(client: String, scopes: List<String> = AppScopes): DeviceCode

    /**

     * Polls `POST /device/token` every `interval` seconds (five more after a

     * `slow_down`) until the user answers or the code expires.

     */

    suspend fun awaitToken(code: DeviceCode): TokenGrant

    /** The account a new token belongs to, checking that the token works. */

    suspend fun whoAmI(token: String): User

}

class HubDeviceAuth(

    private val hub: String,

    private val http: OkHttpClient,

    /** How the poll waits; tests pass a recorder. */

    private val sleep: suspend (Long) -> Unit = { delay(it) },

) : DeviceAuth {

    private val base = "${hub.trimEnd('/')}/api/v1/".toHttpUrl()

    @Serializable

    private data class CodeRequest(val client: String, val scopes: List<String>)

    @Serializable

    private data class TokenRequest(@SerialName("device_code") val deviceCode: String)

    override suspend fun requestCode(client: String, scopes: List<String>): DeviceCode {

        val (status, body) = post("device/code", HubJson.encodeToString(CodeRequest.serializer(), CodeRequest(client.take(80), scopes)))

        if (status != 200) throw DeviceFlowException.Refused(status, "$hub cannot sign in a device: ${errorDetail(body)}")

        return decode(body, DeviceCode.serializer(), "device/code")

    }

    override suspend fun awaitToken(code: DeviceCode): TokenGrant {

        var interval = code.interval.coerceAtLeast(1)

        val life = code.expiresIn.coerceAtLeast(1) * 1000

        var waited = 0L

        val request = HubJson.encodeToString(TokenRequest.serializer(), TokenRequest(code.deviceCode))

        while (true) {

            sleep(interval * 1000)

            waited += interval * 1000

            if (waited > life) throw DeviceFlowException.Expired()

            val (status, body) = post("device/token", request)

            if (status == 200) return decode(body, TokenGrant.serializer(), "device/token")

            val error = runCatching { HubJson.decodeFromString(OAuthError.serializer(), body) }.getOrNull()

            when (error?.error) {

                "authorization_pending" -> {}

                "slow_down" -> interval += 5

                "access_denied" -> throw DeviceFlowException.Denied()

                "expired_token" -> throw DeviceFlowException.Expired()

                else -> throw DeviceFlowException.Refused(status, "Signing in failed: HTTP $status: ${errorDetail(body)}")

            }

        }

    }

    override suspend fun whoAmI(token: String): User = HubClient(hub, token, http).user()

    /** POSTs JSON, returning the status and body whatever the status: the poll's waits are errors by design. */

    private suspend fun post(path: String, json: String): Pair<Int, String> {

        val request = Request.Builder()

            .url(base.resolve(path)!!)

            .header("Accept", "application/json")

            .post(json.toRequestBody(JsonMedia))

            .build()

        return try {

            http.newCall(request).await().use { r -> r.code to r.body?.string().orEmpty() }

        } catch (e: IOException) {

            throw HubException.Network(e)

        }

    }

    private fun <T> decode(body: String, serializer: kotlinx.serialization.KSerializer<T>, what: String): T = try {

        HubJson.decodeFromString(serializer, body)

    } catch (e: IllegalArgumentException) {

        throw HubException.Unreadable(what, e)

    }

}

package io.oxygenhub.android.api

import kotlinx.coroutines.suspendCancellableCoroutine

import kotlinx.serialization.json.Json

import okhttp3.Call

import okhttp3.Callback

import okhttp3.MediaType.Companion.toMediaType

import okhttp3.OkHttpClient

import okhttp3.Response

import java.io.IOException

import java.util.concurrent.TimeUnit

import kotlin.coroutines.resume

import kotlin.coroutines.resumeWithException

/** The JSON settings every hub answer is read with. */

val HubJson: Json = Json {

    ignoreUnknownKeys = true

    explicitNulls = false

    coerceInputValues = true

}

internal val JsonMedia = "application/json".toMediaType()

/** One HTTP client for the whole app (connection pool, TLS sessions). */

fun hubHttpClient(): OkHttpClient = OkHttpClient.Builder()

    .connectTimeout(15, TimeUnit.SECONDS)

    .readTimeout(60, TimeUnit.SECONDS)

    .build()

/** A hub address as typed, made canonical: `https://host[:port][/path]`, no trailing slash. */

fun normalizeHubUrl(input: String): String? {

    var s = input.trim()

    if (s.isEmpty()) return null

    if (!s.contains("://")) s = "https://$s"

    s = s.trimEnd('/')

    val url = runCatching { java.net.URI(s) }.getOrNull() ?: return null

    if (url.scheme?.lowercase() != "https" || url.host.isNullOrBlank()) return null

    if (url.query != null || url.fragment != null) return null

    return s

}

/** Runs the call without blocking, cancelling it when the coroutine is. */

internal suspend fun Call.await(): Response = suspendCancellableCoroutine { cont ->

    cont.invokeOnCancellation { runCatching { cancel() } }

    enqueue(object : Callback {

        override fun onResponse(call: Call, response: Response) {

            cont.resume(response)

        }

        override fun onFailure(call: Call, e: IOException) {

            if (!cont.isCancelled) cont.resumeWithException(e)

        }

    })

}

/** Why a call to the hub failed. */

sealed class HubException(message: String, cause: Throwable? = null) : Exception(message, cause) {

    /** The hub answered with an error; [detail] is its problem document's reason. */

    class Http(val status: Int, val detail: String) : HubException("HTTP $status: $detail")

    /** The hub could not be reached, or the connection broke. */

    class Network(cause: IOException) : HubException(cause.message ?: "network error", cause)

    /** The hub answered with something this app cannot read. */

    class Unreadable(what: String, cause: Throwable) : HubException("unexpected answer to $what", cause)

}

/** The reason in an error body: a problem's `detail`, an OAuth `error_description`, or the text itself. */

internal fun errorDetail(body: String): String {

    val problem = runCatching { HubJson.decodeFromString<Problem>(body) }.getOrNull()

    if (problem != null && problem.detail.isNotBlank()) return problem.detail

    val oauth = runCatching { HubJson.decodeFromString<OAuthError>(body) }.getOrNull()

    if (oauth != null && oauth.description.isNotBlank()) return oauth.description

    return body.trim().take(200)

}

/** A sentence for the user, for any failure the API layer throws. */

fun Throwable.userMessage(): String = when (this) {

    is HubException.Http -> when (status) {

        401 -> "Your sign-in has ended. Sign in again."

        403 -> "Not allowed: $detail"

        404 -> "Not found: $detail"

        in 500..599 -> "The hub had a problem ($status). Try again in a moment."

        else -> detail.ifBlank { "The hub said HTTP $status." }

    }

    is HubException.Network -> "Can't reach the hub. Check your connection and try again."

    is HubException.Unreadable -> "The hub's answer couldn't be read. The app may need an update."

    else -> message ?: "Something went wrong."

}

package io.oxygenhub.android.api

import kotlinx.serialization.KSerializer

import kotlinx.serialization.builtins.ListSerializer

import okhttp3.HttpUrl

import okhttp3.HttpUrl.Companion.toHttpUrl

import okhttp3.OkHttpClient

import okhttp3.Request

import okhttp3.RequestBody.Companion.toRequestBody

import java.io.IOException

/**

 * What the app asks of a hub, signed in. The view models see only this, so

 * their tests give them a fake. Later screens (oxygenhub-android#3–#5) add

 * to it: a repository's tree, history, proposals, runs.

 */

interface HubApi {

    /** The signed-in account (`GET /user`, scope `user:read`). */

    suspend fun user(): User

    /** Every repository the caller can read (`GET /repos`). */

    suspend fun repositories(): List<Repository>

    /** A repository's issues (`GET /repos/{owner}/{name}/issues?state=`). */

    suspend fun issues(owner: String, name: String, state: IssueState = IssueState.Open): List<Issue>

    /** The inbox: the unread count and the newest entries (`GET /notifications`). */

    suspend fun inbox(limit: Int = 50): Inbox

    /** Marks one notification read (`POST /notifications/{id}/read`). */

    suspend fun markRead(id: Long)

    /** Marks the whole inbox read (`POST /notifications/read`). */

    suspend fun markAllRead()

    /** Revokes the token this client signs in with (`DELETE /user/token`). */

    suspend fun revokeToken()

}

/**

 * The hub's JSON API over OkHttp. [onUnauthorized] runs when the hub

 * refuses the token (revoked on the web, or 90 days unused), so the app

 * can drop the session and ask for a new sign-in.

 */

class HubClient(

    hub: String,

    private val token: String,

    private val http: OkHttpClient,

    private val onUnauthorized: () -> Unit = {},

) : HubApi {

    private val base: HttpUrl = "${hub.trimEnd('/')}/api/v1/".toHttpUrl()

    override suspend fun user(): User = get("user", User.serializer())

    override suspend fun repositories(): List<Repository> = get("repos", ListSerializer(Repository.serializer()))

    override suspend fun issues(owner: String, name: String, state: IssueState): List<Issue> =

        get(url("repos", owner, name, "issues") { addQueryParameter("state", state.query) }, ListSerializer(Issue.serializer()))

    override suspend fun inbox(limit: Int): Inbox =

        get(url("notifications") { addQueryParameter("limit", limit.coerceIn(1, 200).toString()) }, Inbox.serializer())

    override suspend fun markRead(id: Long) {

        send("POST", url("notifications", id.toString(), "read"))

    }

    override suspend fun markAllRead() {

        send("POST", url("notifications", "read"))

    }

    override suspend fun revokeToken() {

        send("DELETE", url("user", "token"), notifyUnauthorized = false)

    }

    // The bearer token is never part of a string anything prints.

    override fun toString(): String = "HubClient(${base})"

    private fun url(vararg segments: String, query: HttpUrl.Builder.() -> Unit = {}): HttpUrl {

        val b = base.newBuilder()

        // Each segment is encoded on its own: an owner or name never adds a path level.

        segments.forEach { b.addPathSegment(it) }

        b.query()

        return b.build()

    }

    private suspend fun <T> get(path: String, serializer: KSerializer<T>): T = get(url(*path.split('/').toTypedArray()), serializer)

    private suspend fun <T> get(url: HttpUrl, serializer: KSerializer<T>): T {

        val body = call(request(url).get().build(), notifyUnauthorized = true)

        return try {

            HubJson.decodeFromString(serializer, body)

        } catch (e: IllegalArgumentException) {

            // kotlinx.serialization's errors are IllegalArgumentExceptions.

            throw HubException.Unreadable("GET ${url.encodedPath}", e)

        }

    }

    private suspend fun send(method: String, url: HttpUrl, notifyUnauthorized: Boolean = true) {

        val body = if (method == "DELETE") null else "{}".toRequestBody(JsonMedia)

        call(request(url).method(method, body).build(), notifyUnauthorized)

    }

    private fun request(url: HttpUrl): Request.Builder = Request.Builder()

        .url(url)

        .header("Accept", "application/json")

        .header("Authorization", "Bearer $token")

    private suspend fun call(request: Request, notifyUnauthorized: Boolean): String {

        val response = try {

            http.newCall(request).await()

        } catch (e: IOException) {

            throw HubException.Network(e)

        }

        response.use { r ->

            val text = try {

                r.body?.string().orEmpty()

            } catch (e: IOException) {

                throw HubException.Network(e)

            }

            if (!r.isSuccessful) {

                if (r.code == 401 && notifyUnauthorized) onUnauthorized()

                throw HubException.Http(r.code, errorDetail(text))

            }

            return text

        }

    }

}

package io.oxygenhub.android.api

import kotlinx.serialization.SerialName

import kotlinx.serialization.Serializable

// The hub's JSON, by hand from oxygenhub's crates/hub-api/src/lib.rs (and

// the device flow's answers in crates/hub/src/api/device.rs). Field names

// are the hub's own, snake case; times are milliseconds since the epoch.

// Every field has a default, so an added or missing field never breaks the

// app: the hub's types may still change before 1.0.

/** `GET /api/v1/user`. */

@Serializable

data class User(

    val username: String,

    @SerialName("display_name") val displayName: String = "",

    @SerialName("is_admin") val isAdmin: Boolean = false,

    val keys: List<String> = emptyList(),

    @SerialName("created_ms") val createdMs: Long = 0,

) {

    /** The name to greet: the display name, or the username without one. */

    val shownName: String get() = displayName.ifBlank { username }

}

@Serializable

enum class Visibility {

    @SerialName("public") Public,

    @SerialName("internal") Internal,

    @SerialName("private") Private,

}

/** A repository as `GET /api/v1/repos` lists it. */

@Serializable

data class Repository(

    val owner: String,

    val name: String,

    val description: String = "",

    @SerialName("default_bookmark") val defaultBookmark: String = "main",

    val visibility: Visibility = Visibility.Public,

    @SerialName("created_ms") val createdMs: Long = 0,

    @SerialName("updated_ms") val updatedMs: Long = 0,

    @SerialName("clone_url") val cloneUrl: String = "",

) {

    val slug: String get() = "$owner/$name"

}

@Serializable

data class Label(

    val name: String,

    /** `#rrggbb`. */

    val colour: String = "",

    val description: String = "",

)

/** `GET /api/v1/repos/{owner}/{name}/issues`. */

@Serializable

data class Issue(

    val number: Long,

    val title: String,

    val body: String = "",

    val author: String = "",

    /** `open` or `closed`. */

    val state: String = "open",

    /** Why it closed: `completed`, `not_planned`, … (empty while open). */

    val reason: String = "",

    val labels: List<Label> = emptyList(),

    val assignees: List<String> = emptyList(),

    val milestone: String? = null,

    val comments: Long = 0,

    val locked: Boolean = false,

    val pinned: Boolean = false,

    @SerialName("created_ms") val createdMs: Long = 0,

    @SerialName("updated_ms") val updatedMs: Long = 0,

    @SerialName("closed_ms") val closedMs: Long? = null,

    val url: String = "",

) {

    val isOpen: Boolean get() = state == "open"

}

/** Which issues to list: the hub's `?state=`. */

enum class IssueState(val query: String) { Open("open"), Closed("closed"), All("all") }

/** One entry in the caller's inbox. */

@Serializable

data class Notification(

    val id: Long,

    @SerialName("at_ms") val atMs: Long = 0,

    /** `issue.opened`, `proposal.comment`, `mention`, `review`, … */

    val kind: String = "",

    val title: String = "",

    /** The page on the hub, absolute. */

    val url: String = "",

    val actor: String = "",

    val read: Boolean = false,

)

/** `GET /api/v1/notifications`: the unread count and the newest entries, unread first. */

@Serializable

data class Inbox(

    val unread: Long = 0,

    val items: List<Notification> = emptyList(),

)

/** An RFC 7807 problem: what the API answers with on an error. */

@Serializable

data class Problem(

    val status: Int = 0,

    val title: String = "",

    val detail: String = "",

)

/** The device flow's errors, RFC 8628's shape: `{"error": …, "error_description": …}`. */

@Serializable

data class OAuthError(

    val error: String = "",

    @SerialName("error_description") val description: String = "",

)

/** `POST /api/v1/device/code`'s answer. */

@Serializable

data class DeviceCode(

    @SerialName("device_code") val deviceCode: String,

    @SerialName("user_code") val userCode: String,

    @SerialName("verification_uri") val verificationUri: String,

    @SerialName("verification_uri_complete") val verificationUriComplete: String = "",

    @SerialName("expires_in") val expiresIn: Long = 900,

    val interval: Long = 5,

) {

    /** The page to open: with the code filled in when the hub offers it. */

    val pageToOpen: String get() = verificationUriComplete.ifBlank { verificationUri }

    // The device code is a secret until it is used: never in logs.

    override fun toString(): String = "DeviceCode(userCode=$userCode, verificationUri=$verificationUri)"

}

/** `POST /api/v1/device/token`'s answer once the user approved. */

@Serializable

data class TokenGrant(

    @SerialName("access_token") val accessToken: String,

    @SerialName("token_type") val tokenType: String = "bearer",

    /** The scopes the user allowed, space separated (they may untick some). */

    val scope: String = "",

    val username: String = "",

    @SerialName("expires_in") val expiresIn: Long = 0,

) {

    val scopes: List<String> get() = scope.split(' ').filter { it.isNotBlank() }

    override fun toString(): String = "TokenGrant(username=$username, scope=$scope, accessToken=<redacted>)"

}

package io.oxygenhub.android.auth

import android.content.Context

import android.content.SharedPreferences

import android.security.keystore.KeyGenParameterSpec

import android.security.keystore.KeyProperties

import android.security.keystore.StrongBoxUnavailableException

import android.util.Base64

import androidx.core.content.edit

import java.security.GeneralSecurityException

import java.security.KeyStore

import javax.crypto.Cipher

import javax.crypto.KeyGenerator

import javax.crypto.SecretKey

import javax.crypto.spec.GCMParameterSpec

/**

 * The session in app-private preferences, its token sealed with an AES-GCM

 * key that lives in the Android Keystore (StrongBox where the phone has

 * one) and can never leave it. The preferences hold only the ciphertext;

 * they are kept out of backups (res/xml/backup_rules.xml and

 * data_extraction_rules.xml), since a restored copy could not be opened

 * without the key anyway.

 *

 * Jetpack Security's EncryptedSharedPreferences does the same, but is

 * deprecated; this is the part of it the app needs.

 */

class KeystoreSessionStore(context: Context) : SessionStore {

    private val prefs: SharedPreferences = context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)

    override var lastHub: String?

        get() = prefs.getString(LAST_HUB, null)

        set(value) = prefs.edit { putString(LAST_HUB, value) }

    override fun load(): Session? {

        val hub = prefs.getString(HUB, null) ?: return null

        val username = prefs.getString(USERNAME, null) ?: return null

        val sealed = prefs.getString(TOKEN, null) ?: return null

        val token = try {

            open(sealed)

        } catch (_: GeneralSecurityException) {

            // The key is gone (the lock screen was reset, or the data was

            // restored to another phone): the token cannot be read, so the

            // user signs in again.

            clear()

            return null

        } catch (_: IllegalArgumentException) {

            clear()

            return null

        }

        val scopes = prefs.getString(SCOPES, "").orEmpty().split(' ').filter { it.isNotBlank() }

        return Session(hub, username, token, scopes)

    }

    override fun save(session: Session) {

        prefs.edit {

            putString(HUB, session.hub)

            putString(USERNAME, session.username)

            putString(SCOPES, session.scopes.joinToString(" "))

            putString(TOKEN, seal(session.token))

            putString(LAST_HUB, session.hub)

        }

    }

    override fun clear() {

        prefs.edit {

            remove(HUB)

            remove(USERNAME)

            remove(SCOPES)

            remove(TOKEN)

        }

    }

    private fun seal(plain: String): String {

        val cipher = Cipher.getInstance(TRANSFORMATION)

        cipher.init(Cipher.ENCRYPT_MODE, key())

        val iv = cipher.iv

        val out = cipher.doFinal(plain.toByteArray(Charsets.UTF_8))

        return b64(iv) + ":" + b64(out)

    }

    private fun open(sealed: String): String {

        val (iv, data) = sealed.split(':', limit = 2).let { parts ->

            require(parts.size == 2) { "not a sealed token" }

            Base64.decode(parts[0], Base64.NO_WRAP) to Base64.decode(parts[1], Base64.NO_WRAP)

        }

        val key = existingKey() ?: throw GeneralSecurityException("no key")

        val cipher = Cipher.getInstance(TRANSFORMATION)

        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, iv))

        return String(cipher.doFinal(data), Charsets.UTF_8)

    }

    private fun b64(bytes: ByteArray): String = Base64.encodeToString(bytes, Base64.NO_WRAP)

    private fun existingKey(): SecretKey? {

        val ks = KeyStore.getInstance(KEYSTORE).apply { load(null) }

        return (ks.getEntry(ALIAS, null) as? KeyStore.SecretKeyEntry)?.secretKey

    }

    private fun key(): SecretKey = existingKey() ?: try {

        generate(strongBox = true)

    } catch (_: StrongBoxUnavailableException) {

        generate(strongBox = false)

    }

    private fun generate(strongBox: Boolean): SecretKey {

        val spec = KeyGenParameterSpec.Builder(ALIAS, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)

            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

            .setKeySize(256)

            .setIsStrongBoxBacked(strongBox)

            .build()

        val generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEYSTORE)

        generator.init(spec)

        return generator.generateKey()

    }

    private companion object {

        const val PREFS = "session"

        const val KEYSTORE = "AndroidKeyStore"

        const val ALIAS = "io.oxygenhub.android.session"

        const val TRANSFORMATION = "AES/GCM/NoPadding"

        const val HUB = "hub"

        const val USERNAME = "username"

        const val SCOPES = "scopes"

        const val TOKEN = "token.sealed"

        const val LAST_HUB = "last_hub"

    }

}

package io.oxygenhub.android.auth

/** A signed-in hub: its address, the account, and the device token. */

data class Session(

    /** `https://oxygenhub.io`, no trailing slash. */

    val hub: String,

    val username: String,

    val token: String,

    /** The scopes the user allowed when approving the device. */

    val scopes: List<String> = emptyList(),

) {

    // The token never reaches a log through toString.

    override fun toString(): String = "Session(hub=$hub, username=$username, scopes=$scopes, token=<redacted>)"

}

/** Where the session is kept between launches. */

interface SessionStore {

    fun load(): Session?

    fun save(session: Session)

    fun clear()

    /** The hub last signed in to (or typed), so the sign-in screen offers it again. */

    var lastHub: String?

}

/** A store in memory, for tests and previews. */

class MemorySessionStore(private var session: Session? = null, override var lastHub: String? = null) : SessionStore {

    override fun load(): Session? = session

    override fun save(session: Session) {

        this.session = session

    }

    override fun clear() {

        session = null

    }

}

package io.oxygenhub.android.auth

import io.oxygenhub.android.api.HubApi

import io.oxygenhub.android.api.HubException

import kotlinx.coroutines.flow.MutableStateFlow

import kotlinx.coroutines.flow.StateFlow

import kotlinx.coroutines.flow.asStateFlow

/** What signing out did on the hub. */

enum class SignOutResult {

    /** The token is revoked on the hub. */

    Revoked,

    /** The hub no longer knew the token (revoked or expired already). */

    AlreadyGone,

    /** Signed out here, but the hub could not be told: revoke it under Settings, Tokens. */

    NotRevoked,

}

/**

 * The app's one session: who is signed in, the API client for them, and

 * signing in and out. [apiFactory] makes the client for a session; it is

 * given a callback to run when the hub refuses the token.

 */

class SessionManager(

    private val store: SessionStore,

    private val apiFactory: (Session, onUnauthorized: () -> Unit) -> HubApi,

) {

    private val _session = MutableStateFlow(store.load())

    val session: StateFlow<Session?> = _session.asStateFlow()

    /** Why the last session ended without the user signing out, for the sign-in screen to say. */

    private val _ended = MutableStateFlow<String?>(null)

    val ended: StateFlow<String?> = _ended.asStateFlow()

    private var api: Pair<Session, HubApi>? = null

    val lastHub: String? get() = store.lastHub

    /** The client for the signed-in session, or null when signed out. */

    fun api(): HubApi? {

        val s = _session.value ?: return null

        api?.let { (owner, client) -> if (owner == s) return client }

        return apiFactory(s) { expired(s) }.also { api = s to it }

    }

    fun signedIn(session: Session) {

        store.save(session)

        _ended.value = null

        _session.value = session

    }

    fun rememberHub(hub: String) {

        store.lastHub = hub

    }

    /** Revokes the token on the hub, then forgets it here whatever the hub said. */

    suspend fun signOut(): SignOutResult {

        val client = api()

        val result = when {

            client == null -> SignOutResult.AlreadyGone

            else -> try {

                client.revokeToken()

                SignOutResult.Revoked

            } catch (e: HubException.Http) {

                if (e.status == 401) SignOutResult.AlreadyGone else SignOutResult.NotRevoked

            } catch (_: HubException) {

                SignOutResult.NotRevoked

            }

        }

        forget()

        if (result == SignOutResult.NotRevoked) {

            _ended.value = "Signed out here, but the hub couldn't be reached to revoke the token. " +

                "Revoke it on the hub under Settings, Tokens."

        }

        return result

    }

    /** The hub refused the token: forget it and ask for a new sign-in. */

    private fun expired(session: Session) {

        if (_session.value != session) return

        forget()

        _ended.value = "Your sign-in to ${session.hub} has ended (the token was revoked or not used for 90 days). Sign in again."

    }

    private fun forget() {

        store.clear()

        api = null

        _session.value = null

    }

    fun dismissEnded() {

        _ended.value = null

    }

}

package io.oxygenhub.android

import io.oxygenhub.android.api.HubApi

import io.oxygenhub.android.api.Inbox

import io.oxygenhub.android.api.Issue

import io.oxygenhub.android.api.IssueState

import io.oxygenhub.android.api.Repository

import io.oxygenhub.android.api.User

/** A hub in memory: answers from the fixtures, or the failure set for a call. */

class FakeHubApi : HubApi {

    var user: () -> User = { Fixtures.user }

    var repositories: () -> List<Repository> = { Fixtures.repos }

    var issues: (IssueState) -> List<Issue> = { state ->

        Fixtures.issues.filter { state == IssueState.All || it.state == state.query }

    }

    var inbox: () -> Inbox = { Fixtures.inbox }

    var markRead: (Long) -> Unit = {}

    var markAllRead: () -> Unit = {}

    var revoke: () -> Unit = {}

    val calls = mutableListOf<String>()

    override suspend fun user(): User = user.invoke().also { calls += "user" }

    override suspend fun repositories(): List<Repository> = repositories.invoke().also { calls += "repos" }

    override suspend fun issues(owner: String, name: String, state: IssueState): List<Issue> =

        issues.invoke(state).also { calls += "issues $owner/$name ${state.query}" }

    override suspend fun inbox(limit: Int): Inbox = inbox.invoke().also { calls += "inbox" }

    override suspend fun markRead(id: Long) {

        calls += "read $id"

        markRead.invoke(id)

    }

    override suspend fun markAllRead() {

        calls += "read all"

        markAllRead.invoke()

    }

    override suspend fun revokeToken() {

        calls += "revoke"

        revoke.invoke()

    }

}

package io.oxygenhub.android

import io.oxygenhub.android.api.HubJson

import io.oxygenhub.android.api.Inbox

import io.oxygenhub.android.api.Issue

import io.oxygenhub.android.api.Repository

import io.oxygenhub.android.api.User

import kotlinx.serialization.builtins.ListSerializer

/** The JSON fixtures under src/test/resources/fixtures, written from oxygenhub's hub-api types. */

object Fixtures {

    fun text(name: String): String =

        requireNotNull(Fixtures::class.java.classLoader!!.getResource("fixtures/$name")) { "no fixture $name" }.readText()

    val user: User get() = HubJson.decodeFromString(User.serializer(), text("user.json"))

    val repos: List<Repository> get() = HubJson.decodeFromString(ListSerializer(Repository.serializer()), text("repos.json"))

    val issues: List<Issue> get() = HubJson.decodeFromString(ListSerializer(Issue.serializer()), text("issues.json"))

    val inbox: Inbox get() = HubJson.decodeFromString(Inbox.serializer(), text("inbox.json"))

}

package io.oxygenhub.android.api

import io.oxygenhub.android.Fixtures

import kotlinx.coroutines.test.runTest

import kotlinx.serialization.json.jsonArray

import kotlinx.serialization.json.jsonObject

import kotlinx.serialization.json.jsonPrimitive

import okhttp3.OkHttpClient

import okhttp3.mockwebserver.MockResponse

import okhttp3.mockwebserver.MockWebServer

import org.junit.After

import org.junit.Assert.assertEquals

import org.junit.Assert.assertTrue

import org.junit.Assert.fail

import org.junit.Before

import org.junit.Test

class DeviceFlowTest {

    private lateinit var server: MockWebServer

    private val sleeps = mutableListOf<Long>()

    @Before

    fun setUp() {

        server = MockWebServer()

        server.start()

        sleeps.clear()

    }

    @After

    fun tearDown() {

        server.shutdown()

    }

    private fun auth() = HubDeviceAuth(server.url("/").toString().trimEnd('/'), OkHttpClient()) { sleeps += it }

    private fun answer(name: String, code: Int) = MockResponse().setResponseCode(code).setBody(Fixtures.text(name))

    private fun code() = HubJson.decodeFromString(DeviceCode.serializer(), Fixtures.text("device_code.json"))

    @Test

    fun requestingACodeNamesTheAppAndItsScopes() = runTest {

        server.enqueue(answer("device_code.json", 200))

        val code = auth().requestCode("OxygenHub for Android on Pixel 10 Pro Fold")

        assertEquals("BCDF-GHJK", code.userCode)

        val req = server.takeRequest()

        assertEquals("POST", req.method)

        assertEquals("/api/v1/device/code", req.path)

        assertEquals(null, req.getHeader("Authorization"))

        val body = HubJson.parseToJsonElement(req.body.readUtf8()).jsonObject

        assertEquals("OxygenHub for Android on Pixel 10 Pro Fold", body["client"]!!.jsonPrimitive.content)

        assertEquals(AppScopes, body["scopes"]!!.jsonArray.map { it.jsonPrimitive.content })

    }

    @Test

    fun aHubThatCannotSignInDevices() = runTest {

        server.enqueue(MockResponse().setResponseCode(400).setBody("""{"error":"invalid_scope","error_description":"unknown scope"}"""))

        try {

            auth().requestCode("app")

            fail("expected a refusal")

        } catch (e: DeviceFlowException.Refused) {

            assertEquals(400, e.status)

            assertTrue(e.message!!.endsWith("unknown scope"))

        }

    }

    @Test

    fun pollsUntilApprovedSlowingDownWhenTold() = runTest {

        server.enqueue(answer("device_authorization_pending.json", 400))

        server.enqueue(answer("device_slow_down.json", 400))

        server.enqueue(answer("device_authorization_pending.json", 400))

        server.enqueue(answer("device_token.json", 200))

        val grant = auth().awaitToken(code())

        assertEquals("oxy_test_not_a_real_token", grant.accessToken)

        assertEquals(listOf(5000L, 5000L, 10000L, 10000L), sleeps)

        repeat(4) {

            val req = server.takeRequest()

            assertEquals("/api/v1/device/token", req.path)

            val body = HubJson.parseToJsonElement(req.body.readUtf8()).jsonObject

            assertEquals(code().deviceCode, body["device_code"]!!.jsonPrimitive.content)

        }

    }

    @Test(expected = DeviceFlowException.Denied::class)

    fun denied() = runTest {

        server.enqueue(answer("device_access_denied.json", 400))

        auth().awaitToken(code())

    }

    @Test(expected = DeviceFlowException.Expired::class)

    fun expiredOnTheHub() = runTest {

        server.enqueue(answer("device_expired_token.json", 400))

        auth().awaitToken(code())

    }

    @Test

    fun expiresHereWhenTheHubNeverAnswers() = runTest {

        // A code with ten seconds to live, polled every five: two polls, then give up.

        repeat(5) { server.enqueue(answer("device_authorization_pending.json", 400)) }

        try {

            auth().awaitToken(code().copy(expiresIn = 10))

            fail("expected expiry")

        } catch (_: DeviceFlowException.Expired) {

        }

        assertEquals(2, server.requestCount)

    }

    @Test

    fun anUnexpectedAnswerStops() = runTest {

        server.enqueue(MockResponse().setResponseCode(500).setBody("""{"error":"server_error","error_description":"db down"}"""))

        try {

            auth().awaitToken(code())

            fail("expected a refusal")

        } catch (e: DeviceFlowException.Refused) {

            assertEquals(500, e.status)

            assertTrue(e.message!!.contains("db down"))

        }

    }

    @Test

    fun whoAmIUsesTheNewToken() = runTest {

        server.enqueue(answer("user.json", 200))

        assertEquals("andymccall", auth().whoAmI("oxy_new").username)

        val req = server.takeRequest()

        assertEquals("/api/v1/user", req.path)

        assertEquals("Bearer oxy_new", req.getHeader("Authorization"))

    }

}

package io.oxygenhub.android.api

import io.oxygenhub.android.Fixtures

import kotlinx.coroutines.test.runTest

import okhttp3.OkHttpClient

import okhttp3.mockwebserver.MockResponse

import okhttp3.mockwebserver.MockWebServer

import okhttp3.mockwebserver.SocketPolicy

import org.junit.After

import org.junit.Assert.assertEquals

import org.junit.Assert.assertFalse

import org.junit.Assert.assertTrue

import org.junit.Assert.fail

import org.junit.Before

import org.junit.Test

class HubClientTest {

    private lateinit var server: MockWebServer

    private val http = OkHttpClient()

    private var unauthorized = 0

    @Before

    fun setUp() {

        server = MockWebServer()

        server.start()

        unauthorized = 0

    }

    @After

    fun tearDown() {

        server.shutdown()

    }

    // MockWebServer speaks plain HTTP; the client takes any base it is given.

    private fun client() = HubClient(server.url("/").toString().trimEnd('/'), "oxy_secret", http) { unauthorized++ }

    private fun json(name: String, code: Int = 200) =

        MockResponse().setResponseCode(code).setHeader("Content-Type", "application/json").setBody(Fixtures.text(name))

    @Test

    fun userSendsTheBearerToken() = runTest {

        server.enqueue(json("user.json"))

        val u = client().user()

        assertEquals("andymccall", u.username)

        val req = server.takeRequest()

        assertEquals("GET", req.method)

        assertEquals("/api/v1/user", req.path)

        assertEquals("Bearer oxy_secret", req.getHeader("Authorization"))

        assertEquals("application/json", req.getHeader("Accept"))

    }

    @Test

    fun repositories() = runTest {

        server.enqueue(json("repos.json"))

        assertEquals(3, client().repositories().size)

        assertEquals("/api/v1/repos", server.takeRequest().path)

    }

    @Test

    fun issuesAskForTheState() = runTest {

        server.enqueue(json("issues.json"))

        val issues = client().issues("andymccall", "oxygenhub-android", IssueState.All)

        assertEquals(3, issues.size)

        assertEquals("/api/v1/repos/andymccall/oxygenhub-android/issues?state=all", server.takeRequest().path)

    }

    @Test

    fun pathSegmentsAreEncoded() = runTest {

        server.enqueue(MockResponse().setBody("[]"))

        client().issues("a b", "c/d")

        assertEquals("/api/v1/repos/a%20b/c%2Fd/issues?state=open", server.takeRequest().path)

    }

    @Test

    fun inboxWithALimit() = runTest {

        server.enqueue(json("inbox.json"))

        assertEquals(2, client().inbox(500).unread)

        assertEquals("/api/v1/notifications?limit=200", server.takeRequest().path)

    }

    @Test

    fun markingRead() = runTest {

        server.enqueue(MockResponse().setResponseCode(204))

        server.enqueue(MockResponse().setResponseCode(204))

        client().markRead(41)

        client().markAllRead()

        val one = server.takeRequest()

        assertEquals("POST", one.method)

        assertEquals("/api/v1/notifications/41/read", one.path)

        val all = server.takeRequest()

        assertEquals("POST", all.method)

        assertEquals("/api/v1/notifications/read", all.path)

    }

    @Test

    fun revokingDeletesTheOwnToken() = runTest {

        server.enqueue(MockResponse().setResponseCode(204))

        client().revokeToken()

        val req = server.takeRequest()

        assertEquals("DELETE", req.method)

        assertEquals("/api/v1/user/token", req.path)

        assertEquals("Bearer oxy_secret", req.getHeader("Authorization"))

    }

    @Test

    fun aProblemBecomesAnHttpError() = runTest {

        server.enqueue(json("problem_403.json", 403).setHeader("Content-Type", "application/problem+json"))

        try {

            client().user()

            fail("expected an error")

        } catch (e: HubException.Http) {

            assertEquals(403, e.status)

            assertEquals("this token lacks the user:read scope", e.detail)

            assertEquals("Not allowed: this token lacks the user:read scope", e.userMessage())

        }

        assertEquals(0, unauthorized)

    }

    @Test

    fun aRefusedTokenEndsTheSession() = runTest {

        server.enqueue(json("problem_401.json", 401))

        try {

            client().repositories()

            fail("expected an error")

        } catch (e: HubException.Http) {

            assertEquals(401, e.status)

        }

        assertEquals(1, unauthorized)

    }

    @Test

    fun revokingARefusedTokenDoesNotCallBack() = runTest {

        server.enqueue(json("problem_401.json", 401))

        try {

            client().revokeToken()

            fail("expected an error")

        } catch (e: HubException.Http) {

            assertEquals(401, e.status)

        }

        assertEquals(0, unauthorized)

    }

    @Test

    fun anUnreadableAnswer() = runTest {

        server.enqueue(MockResponse().setBody("<html>a proxy's page</html>"))

        try {

            client().repositories()

            fail("expected an error")

        } catch (e: HubException.Unreadable) {

            assertTrue(e.message!!.contains("/api/v1/repos"))

        }

    }

    @Test

    fun aBrokenConnection() = runTest {

        server.enqueue(MockResponse().setSocketPolicy(SocketPolicy.DISCONNECT_AT_START))

        try {

            client().user()

            fail("expected an error")

        } catch (e: HubException.Network) {

            assertEquals("Can't reach the hub. Check your connection and try again.", e.userMessage())

        }

    }

    @Test

    fun theTokenIsNotInToString() {

        assertFalse(client().toString().contains("oxy_secret"))

    }

}

package io.oxygenhub.android.api

import io.oxygenhub.android.Fixtures

import org.junit.Assert.assertEquals

import org.junit.Assert.assertFalse

import org.junit.Assert.assertNull

import org.junit.Assert.assertTrue

import org.junit.Test

class ModelsTest {

    @Test

    fun user() {

        val u = Fixtures.user

        assertEquals("andymccall", u.username)

        assertEquals("Andy McCall", u.displayName)

        assertEquals("Andy McCall", u.shownName)

        assertTrue(u.isAdmin)

        assertEquals(1, u.keys.size)

        assertEquals(1790530000000, u.createdMs)

    }

    @Test

    fun shownNameFallsBackToUsername() {

        assertEquals("claude", User(username = "claude").shownName)

    }

    @Test

    fun repositoriesWithEveryVisibilityAndAnUnknownField() {

        val r = Fixtures.repos

        assertEquals(3, r.size)

        assertEquals("andymccall/oxygenflow", r[0].slug)

        assertEquals(Visibility.Public, r[0].visibility)

        assertEquals(Visibility.Private, r[1].visibility)

        assertEquals(Visibility.Internal, r[2].visibility)

        assertEquals("trunk", r[2].defaultBookmark)

        assertEquals(1792878439999, r[0].updatedMs)

        assertEquals("https://oxygenhub.io/andymccall/oxygenflow", r[0].cloneUrl)

    }

    @Test

    fun issues() {

        val i = Fixtures.issues

        assertEquals(listOf(3L, 2L, 1L), i.map { it.number })

        val two = i[1]

        assertTrue(two.isOpen)

        assertTrue(two.pinned)

        assertEquals("0.1", two.milestone)

        assertEquals(listOf("claude"), two.assignees)

        assertEquals(Label("feature", "#0064e0", "Something new"), two.labels.single())

        assertNull(two.closedMs)

        val one = i[2]

        assertFalse(one.isOpen)

        assertEquals("completed", one.reason)

        assertEquals(1792875000000, one.closedMs)

        assertNull(one.milestone)

    }

    @Test

    fun inbox() {

        val inbox = Fixtures.inbox

        assertEquals(2, inbox.unread)

        assertEquals(listOf(41L, 40L, 12L), inbox.items.map { it.id })

        assertEquals("issue.opened", inbox.items[0].kind)

        assertFalse(inbox.items[0].read)

        assertEquals("", inbox.items[1].actor)

        assertTrue(inbox.items[2].read)

    }

    @Test

    fun deviceCodeAndToken() {

        val code = HubJson.decodeFromString(DeviceCode.serializer(), Fixtures.text("device_code.json"))

        assertEquals("BCDF-GHJK", code.userCode)

        assertEquals("https://oxygenhub.io/device?code=BCDF-GHJK", code.pageToOpen)

        assertEquals(900, code.expiresIn)

        assertEquals(5, code.interval)

        val grant = HubJson.decodeFromString(TokenGrant.serializer(), Fixtures.text("device_token.json"))

        assertEquals(listOf("repo:read", "user:read"), grant.scopes)

        assertEquals("andymccall", grant.username)

    }

    @Test

    fun pageToOpenWithoutTheCompleteUri() {

        val code = DeviceCode("d", "BCDF-GHJK", "https://hub.example/device")

        assertEquals("https://hub.example/device", code.pageToOpen)

    }

    @Test

    fun secretsStayOutOfToString() {

        val code = HubJson.decodeFromString(DeviceCode.serializer(), Fixtures.text("device_code.json"))

        assertFalse(code.toString().contains("oxydev_"))

        val grant = HubJson.decodeFromString(TokenGrant.serializer(), Fixtures.text("device_token.json"))

        assertFalse(grant.toString().contains("oxy_test_not_a_real_token"))

    }

    @Test

    fun errorDetails() {

        assertEquals("this token lacks the user:read scope", errorDetail(Fixtures.text("problem_403.json")))

        assertEquals("not yet approved", errorDetail(Fixtures.text("device_authorization_pending.json")))

        assertEquals("plain text", errorDetail("plain text\n"))

    }

    @Test

    fun hubUrls() {

        assertEquals("https://oxygenhub.io", normalizeHubUrl("https://oxygenhub.io/"))

        assertEquals("https://oxygenhub.io", normalizeHubUrl("  oxygenhub.io "))

        assertEquals("https://hub.example:7343/forge", normalizeHubUrl("hub.example:7343/forge/"))

        assertNull(normalizeHubUrl("http://oxygenhub.io"))

        assertNull(normalizeHubUrl(""))

        assertNull(normalizeHubUrl("https://"))

        assertNull(normalizeHubUrl("https://oxygenhub.io/?x=1"))

    }

}

package io.oxygenhub.android.auth

import io.oxygenhub.android.FakeHubApi

import io.oxygenhub.android.api.HubException

import kotlinx.coroutines.test.runTest

import org.junit.Assert.assertEquals

import org.junit.Assert.assertFalse

import org.junit.Assert.assertNotNull

import org.junit.Assert.assertNull

import org.junit.Assert.assertSame

import org.junit.Test

import java.io.IOException

class SessionManagerTest {

    private val session = Session("https://oxygenhub.io", "andymccall", "oxy_secret", listOf("repo:read", "user:read"))

    private val fake = FakeHubApi()

    private var onUnauthorized: () -> Unit = {}

    private fun manager(store: SessionStore = MemorySessionStore()) = SessionManager(store) { _, cb ->

        onUnauthorized = cb

        fake

    }

    @Test

    fun signingInSavesTheSession() {

        val store = MemorySessionStore()

        val m = manager(store)

        assertNull(m.session.value)

        assertNull(m.api())

        m.signedIn(session)

        assertEquals(session, store.load())

        assertEquals(session, m.session.value)

        assertSame(m.api(), m.api())

    }

    @Test

    fun aSavedSessionIsThereAtStart() {

        val m = manager(MemorySessionStore(session))

        assertEquals(session, m.session.value)

        assertNotNull(m.api())

    }

    @Test

    fun signingOutRevokesTheToken() = runTest {

        val store = MemorySessionStore(session)

        val m = manager(store)

        assertEquals(SignOutResult.Revoked, m.signOut())

        assertEquals(listOf("revoke"), fake.calls)

        assertNull(store.load())

        assertNull(m.session.value)

        assertNull(m.ended.value)

    }

    @Test

    fun aTokenTheHubNoLongerKnows() = runTest {

        fake.revoke = { throw HubException.Http(401, "unknown or expired token") }

        val m = manager(MemorySessionStore(session))

        assertEquals(SignOutResult.AlreadyGone, m.signOut())

        assertNull(m.session.value)