Alerts from the hub: the phone registers its Cloud Messaging token and an X25519 key kept by the Keystore, and opens and shows what the hub seals to it with the Rust core; Firebase from google-services.json (the release job's firebase-config secret); pins OxygenFlow main (refs #16) aa21eb5e0e5b

package io.oxygenhub.android.alerts

import android.content.Context

import android.security.keystore.KeyGenParameterSpec

import android.security.keystore.KeyProperties

import android.security.keystore.StrongBoxUnavailableException

import android.util.Base64

import androidx.core.content.edit

import java.security.GeneralSecurityException

import java.security.KeyStore

import javax.crypto.Cipher

import javax.crypto.KeyGenerator

import javax.crypto.SecretKey

import javax.crypto.spec.GCMParameterSpec

import uniffi.rust_core.alertNewSecret

import uniffi.rust_core.alertPublicKey

/**

 * The phone's alert key (#16): an X25519 secret, made by the Rust core,

 * that the hub seals each alert to. Kept in app-private preferences only as

 * ciphertext under an AES-GCM key in the Android Keystore (StrongBox where

 * the phone has one), as the session's token is; out of backups, since a

 * restored copy could not be opened anyway. A lost key just means a new one

 * and registering again.

 */

object AlertKey {

    private const val PREFS = "alerts"

    private const val SEALED = "secret.sealed"

    private const val KEYSTORE = "AndroidKeyStore"

    private const val ALIAS = "io.oxygenhub.android.alerts"

    private const val TRANSFORMATION = "AES/GCM/NoPadding"

    /** The secret, made and kept the first time it is asked for. */

    @Synchronized

    fun secret(context: Context): ByteArray {

        val prefs = context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)

        prefs.getString(SEALED, null)?.let { sealed ->

            try {

                return open(sealed)

            } catch (_: GeneralSecurityException) {

                // The Keystore key is gone: a new secret, registered again.

            } catch (_: IllegalArgumentException) {

            }

        }

        val fresh = alertNewSecret()

        prefs.edit { putString(SEALED, seal(fresh)) }

        return fresh

    }

    /** The public key, hex, for the hub. */

    fun publicKeyHex(context: Context): String = alertPublicKey(secret(context)).joinToString("") { "%02x".format(it) }

    private fun seal(plain: ByteArray): String {

        val cipher = Cipher.getInstance(TRANSFORMATION)

        cipher.init(Cipher.ENCRYPT_MODE, key())

        return b64(cipher.iv) + ":" + b64(cipher.doFinal(plain))

    }

    private fun open(sealed: String): ByteArray {

        val parts = sealed.split(':', limit = 2)

        require(parts.size == 2) { "not a sealed secret" }

        val key = existingKey() ?: throw GeneralSecurityException("no key")

        val cipher = Cipher.getInstance(TRANSFORMATION)

        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, Base64.decode(parts[0], Base64.NO_WRAP)))

        return cipher.doFinal(Base64.decode(parts[1], Base64.NO_WRAP))

    }

    private fun b64(bytes: ByteArray): String = Base64.encodeToString(bytes, Base64.NO_WRAP)

    private fun existingKey(): SecretKey? {

        val ks = KeyStore.getInstance(KEYSTORE).apply { load(null) }

        return (ks.getEntry(ALIAS, null) as? KeyStore.SecretKeyEntry)?.secretKey

    }

    private fun key(): SecretKey = existingKey() ?: try {

        generate(strongBox = true)

    } catch (_: StrongBoxUnavailableException) {

        generate(strongBox = false)

    }

    private fun generate(strongBox: Boolean): SecretKey {

        val spec = KeyGenParameterSpec.Builder(ALIAS, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)

            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

            .setKeySize(256)

            .setIsStrongBoxBacked(strongBox)

            .build()

        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEYSTORE).apply { init(spec) }.generateKey()

    }

}

package io.oxygenhub.android.alerts

import android.util.Log

import com.google.firebase.messaging.FirebaseMessagingService

import com.google.firebase.messaging.RemoteMessage

import io.oxygenhub.android.OxygenHubApp

import kotlinx.coroutines.CoroutineScope

import kotlinx.coroutines.Dispatchers

import kotlinx.coroutines.SupervisorJob

import kotlinx.coroutines.launch

/** Cloud Messaging's side of the hub's alerts (#16): a new token, or a sealed alert. */

class AlertService : FirebaseMessagingService() {

    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)

    /** The phone's registration changed: tell the hub, when signed in. */

    override fun onNewToken(token: String) {

        val api = (application as OxygenHubApp).container.sessions.api() ?: return

        scope.launch {

            runCatching { PushAlerts.register(applicationContext, api, token) }

                .onFailure { Log.w("AlertService", "registering with the hub: ${it.message}") }

        }

    }

    /** Only data messages come: open the sealed alert and show it. */

    override fun onMessageReceived(message: RemoteMessage) {

        val sealed = message.data["sealed"] ?: return

        val alert = PushAlerts.open(applicationContext, sealed) ?: return

        PushAlerts.show(applicationContext, alert)

    }

}

package io.oxygenhub.android.alerts

import android.app.Notification

import android.app.NotificationChannel

import android.app.NotificationManager

import android.app.PendingIntent

import android.content.Context

import android.content.Intent

import android.net.Uri

import android.util.Base64

import android.util.Log

import com.google.firebase.FirebaseApp

import com.google.firebase.FirebaseOptions

import com.google.firebase.messaging.FirebaseMessaging

import io.oxygenhub.android.BuildConfig

import io.oxygenhub.android.R

import io.oxygenhub.android.api.HubApi

import kotlinx.coroutines.suspendCancellableCoroutine

import kotlinx.serialization.Serializable

import kotlinx.serialization.json.Json

import uniffi.rust_core.alertOpen

import kotlin.coroutines.resume

import kotlin.coroutines.resumeWithException

/**

 * Alerts from the hub (#16): each notification the account is told reaches

 * the phone through Firebase Cloud Messaging, sealed to the phone's

 * [AlertKey], so Google carries only ciphertext; the app opens it and shows

 * it. Firebase is started by hand from the build's settings (BuildConfig,

 * from google-services.json), so a build without them takes no alerts.

 */

object PushAlerts {

    private const val TAG = "PushAlerts"

    private const val CHANNEL = "hub-alerts"

    /** What the hub seals: the notification's kind, its title and its link. */

    @Serializable

    data class Alert(val kind: String = "", val title: String = "", val url: String = "")

    private val json = Json { ignoreUnknownKeys = true }

    /** Whether this build can take alerts. */

    val available: Boolean get() = BuildConfig.FIREBASE_APP_ID.isNotEmpty()

    /** Start Firebase, once, when this build has its settings. */

    fun start(context: Context) {

        if (!available || FirebaseApp.getApps(context).isNotEmpty()) return

        val options = FirebaseOptions.Builder()

            .setApplicationId(BuildConfig.FIREBASE_APP_ID)

            .setProjectId(BuildConfig.FIREBASE_PROJECT_ID)

            .setGcmSenderId(BuildConfig.FIREBASE_SENDER_ID)

            .setApiKey(BuildConfig.FIREBASE_API_KEY)

            .build()

        FirebaseApp.initializeApp(context, options)

    }

    /** Register this phone with the hub: its Cloud Messaging token and its alert key. */

    suspend fun register(context: Context, api: HubApi, token: String? = null): Boolean {

        if (!available) return false

        start(context)

        val fcm = token ?: suspendCancellableCoroutine { k ->

            FirebaseMessaging.getInstance().token

                .addOnSuccessListener { k.resume(it) }

                .addOnFailureListener { k.resumeWithException(it) }

        }

        return api.registerPush(fcm, AlertKey.publicKeyHex(context))

    }

    /** Open a sealed alert (base64url) with this phone's key; null when it is not for it. */

    fun open(context: Context, sealed: String): Alert? {

        val bytes = try {

            Base64.decode(sealed, Base64.URL_SAFE or Base64.NO_PADDING or Base64.NO_WRAP)

        } catch (_: IllegalArgumentException) {

            return null

        }

        val plain = alertOpen(AlertKey.secret(context), bytes) ?: return null

        return try {

            json.decodeFromString(Alert.serializer(), plain.decodeToString())

        } catch (e: IllegalArgumentException) {

            Log.w(TAG, "an alert that does not read: ${e.message}")

            null

        }

    }

    /** Show [alert]; a tap opens its link. */

    fun show(context: Context, alert: Alert) {

        val manager = context.getSystemService(NotificationManager::class.java) ?: return

        manager.createNotificationChannel(

            NotificationChannel(CHANNEL, "Alerts from the hub", NotificationManager.IMPORTANCE_DEFAULT).apply {

                description = "What your inbox on the hub is told: builds, reviews, mentions"

            },

        )

        val id = (alert.kind + alert.url).hashCode()

        val open = Intent(Intent.ACTION_VIEW, Uri.parse(alert.url)).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)

        val tap = PendingIntent.getActivity(context, id, open, PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)

        val notification = Notification.Builder(context, CHANNEL)

            .setSmallIcon(R.drawable.ic_launcher_monochrome)

            .setContentTitle(alert.title.substringBefore(": ", alert.title))

            .setContentText(alert.title.substringAfter(": ", alert.title))

            .setStyle(Notification.BigTextStyle().bigText(alert.title.substringAfter(": ", alert.title)))

            .setContentIntent(tap)

            .setAutoCancel(true)

            .build()

        manager.notify(id, notification)

    }

}

    // Firebase's client settings (google-services.json) for alerts (#16).

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

# Firebase client settings (#16): the release job writes it from a secret.

/app/google-services.json

- **Alerts from the hub (#16):** what your inbox on the hub is told (builds broken and fixed, reviews, mentions…) also reaches the phone through Firebase Cloud Messaging, sealed to an X25519 key the phone made (kept wrapped by the Android Keystore), so Google carries only ciphertext; the app opens it with the Rust core (`flow_core::alert`, as the hub seals it) and shows it, and a tap opens its link. Each signed-in session registers the phone (`PUT /user/push`); signing out ends it. Firebase starts by hand from `google-services.json` (the release job's `firebase-config` secret), with no Google Gradle plugin and only `firebase-messaging`; a build without it takes no alerts. The hub sends once it runs on GCP.

// The Firebase client settings alerts need (#16), read from

// app/google-services.json without Google's Gradle plugin: none, no alerts.

val firebase: Map<String, String> = run {

    val file = File(projectDir, "google-services.json")

    if (!file.isFile) return@run emptyMap()

    @Suppress("UNCHECKED_CAST")

    val json = groovy.json.JsonSlurper().parse(file) as Map<String, Any?>

    val project = json["project_info"] as Map<String, Any?>

    val client = (json["client"] as List<Map<String, Any?>>).first {

        ((it["client_info"] as Map<String, Any?>)["android_client_info"] as Map<String, Any?>)["package_name"] == "io.oxygenhub.android"

    }

    mapOf(

        "app_id" to (client["client_info"] as Map<String, Any?>)["mobilesdk_app_id"].toString(),

        "project_id" to project["project_id"].toString(),

        "sender_id" to project["project_number"].toString(),

        "api_key" to ((client["api_key"] as List<Map<String, Any?>>).first()["current_key"]).toString(),

    )

}

        // Firebase for alerts (#16), from google-services.json when the

        // build has one (the release job writes it from a secret); empty,

        // the app takes no alerts.

        buildConfigField("String", "FIREBASE_APP_ID", "\"${firebase["app_id"].orEmpty()}\"")

        buildConfigField("String", "FIREBASE_PROJECT_ID", "\"${firebase["project_id"].orEmpty()}\"")

        buildConfigField("String", "FIREBASE_SENDER_ID", "\"${firebase["sender_id"].orEmpty()}\"")

        buildConfigField("String", "FIREBASE_API_KEY", "\"${firebase["api_key"].orEmpty()}\"")

        buildConfig = true

    implementation(platform(libs.firebase.bom))

    implementation(libs.firebase.messaging)

        <!-- Alerts from the hub (#16): sealed data messages through Cloud Messaging. -->

            android:name=".alerts.AlertService"

            android:exported="false">

            <intent-filter>

                <action android:name="com.google.firebase.MESSAGING_EVENT" />

            </intent-filter>

        </service>

        <service

import android.util.Log

import io.oxygenhub.android.alerts.PushAlerts

import kotlinx.coroutines.CoroutineScope

import kotlinx.coroutines.Dispatchers

import kotlinx.coroutines.SupervisorJob

import kotlinx.coroutines.flow.distinctUntilChanged

import kotlinx.coroutines.flow.filterNotNull

import kotlinx.coroutines.launch

        // Alerts from the hub (#16): each signed-in session registers this

        // phone; signing out revokes the token, which ends it on the hub.

        if (PushAlerts.available) {

            PushAlerts.start(this)

            CoroutineScope(SupervisorJob() + Dispatchers.IO).launch {

                container.sessions.session.filterNotNull().distinctUntilChanged().collect {

                    val api = container.sessions.api() ?: return@collect

                    runCatching { PushAlerts.register(this@OxygenHubApp, api) }

                        .onFailure { Log.w("OxygenHubApp", "alerts: registering with the hub: ${it.message}") }

                }

            }

        }

     * This phone takes alerts (#16): its Cloud Messaging [fcmToken] and its

     * alert key's [publicKey] (hex), for the token it signed in with

     * (`PUT /user/push`). Whether the hub sends alerts at all.

     */

    suspend fun registerPush(fcmToken: String, publicKey: String): Boolean

    /**

    override suspend fun registerPush(fcmToken: String, publicKey: String): Boolean =

        sendJson("PUT", url("user", "push"), buildJsonObject {

            put("fcm_token", fcmToken)

            put("public_key", publicKey)

        }, PushRegistered.serializer()).alerts

/** What `PUT /user/push` answers (#16): whether the hub sends alerts at all. */

@Serializable

data class PushRegistered(val alerts: Boolean = false)

    <exclude domain="sharedpref" path="alerts.xml" />

        <exclude domain="sharedpref" path="alerts.xml" />

        <exclude domain="sharedpref" path="alerts.xml" />

    override suspend fun registerPush(fcmToken: String, publicKey: String): Boolean = true.also { calls += "push" }

# Phone alerts (#16): Cloud Messaging only, no analytics.

firebaseBom = "34.19.0"

firebase-bom = { group = "com.google.firebase", name = "firebase-bom", version.ref = "firebaseBom" }

firebase-messaging = { group = "com.google.firebase", name = "firebase-messaging" }

 "curve25519-dalek",

 "ring",

 "flow-core",

# Sealed alerts (#16): the phone's key and opening what the hub sends.

flow-core = { path = "../oxygenflow/crates/flow-core" }

/// A new X25519 secret for this phone's alerts (#16), to keep wrapped by

/// the Android Keystore.

#[uniffi::export]

pub fn alert_new_secret() -> Vec<u8> {

    flow_core::alert::new_secret().to_vec()

}

/// The public key of an alert secret, for the hub; empty for a secret that

/// is not 32 bytes.

#[uniffi::export]

pub fn alert_public_key(secret: Vec<u8>) -> Vec<u8> {

    <[u8; 32]>::try_from(secret.as_slice()).map(|s| flow_core::alert::public_key(&s).to_vec()).unwrap_or_default()

}

/// Open an alert the hub sealed to this phone; `None` when it was not

/// sealed to `secret` or was changed on the way.

#[uniffi::export]

pub fn alert_open(secret: Vec<u8>, sealed: Vec<u8>) -> Option<Vec<u8>> {

    let s = <[u8; 32]>::try_from(secret.as_slice()).ok()?;

    flow_core::alert::open(&s, &sealed)

}

# android-keystore-password; and firebase-config (google-services.json, for

# alerts). Locally, give the same files:

#   KEYSTORE_B64=path PASSWORD_FILE=path [FIREBASE_CONFIG=path] scripts/release.sh

# Firebase's client settings for alerts (#16): google-services.json, the

# repository's firebase-config secret; without it the release takes no alerts.

firebase=${FIREBASE_CONFIG:-/run/secrets/firebase-config}

if [ -s "$firebase" ]; then

    cp "$firebase" app/google-services.json

    trap 'rm -rf "$keys" app/google-services.json' EXIT

else

    echo "release: no $firebase: this release takes no alerts" >&2

fi