Compare commits
17
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 james.maes
|
3eef6431ca
|
||
|
james.maesandClaude Sonnet 5.5
|
9418c03c4b
|
||
|
james.maesandClaude Sonnet 5.5
|
bcbd1b4e98
|
||
|
james.maesandClaude Sonnet 5.5
|
f58e28b0c2
|
||
|
james.maes
|
0ae2101f08
|
||
|
james.maes
|
1f5fd2ef95
|
||
|
james.maesandClaude Sonnet 5.5
|
2c7394a62f
|
||
|
james.maesandClaude Sonnet 5.5
|
9cf789c5b1
|
||
|
james.maesandClaude Sonnet 5.5
|
4d11a9a626
|
||
|
james.maesandClaude Sonnet 5.5
|
f72b90d08c
|
||
 forge-recovery
|
b75fdac881
|
||
|
forge-recoveryandCodex
|
6980c4f7c3
|
||
|
|
e255b7341d
|
||
|
james.maesandClaude Sonnet 5.5
|
ffc5b493fa
|
||
|
james.maesandClaude Sonnet 5.5
|
fb3cc5d2f8
|
||
|
james.maesandClaude Sonnet 5.5
|
47a923a712
|
||
|
forge-recovery
|
a2f0080755
|
No files matched your search
@@ -0,0 +1,13 @@
|
||||
name: QRun Android lifecycle
|
||||
'on':
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
permissions:
|
||||
contents: read
|
||||
actions: read
|
||||
jobs:
|
||||
release:
|
||||
uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/android.yaml@qrun-release-v1
|
||||
with:
|
||||
runner: android-build
|
||||
@@ -1,6 +1,6 @@
|
||||
# Repository guidance
|
||||
|
||||
Read `README.md`, `docs/SESSION-STATE.md`, and `docs/TODO.md` for current scope. Preserve unrelated changes and follow the user's current authorization for commits, publication, and deployment.
|
||||
Read `README.md`, `docs/SESSION-STATE.md`, and `docs/TODO.md` for current scope; `docs/history/` is historical only. Preserve unrelated changes and follow the user's current authorization for commits, publication, and deployment.
|
||||
|
||||
## Build and tests
|
||||
|
||||
@@ -24,4 +24,4 @@ Never log or place passwords, session cookies, or device tokens in process value
|
||||
|
||||
## Repository automation
|
||||
|
||||
CircleCI is managed by `kingsrook/qqq-orb` using `.qqq-ci.yml`; preserve that lane and its main-only library publication. GitHub `Scanner Android` checks build and deliver a debug APK artifact and never publish libraries or production releases. Do not replace managed CI with a stale local template.
|
||||
The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive, so make no ordinary GitHub writes. Protected `main` on Gitea has `.gitea/workflows/qrun-android-release.yaml` calling the shared `KofTwentyTwo/platform-ci` `android.yaml@qrun-release-v1`; pull-request checks come from central Gitea policy, not from that release workflow. It is not a scanner-APK signing pipeline, and no automatic signing CI is configured. CircleCI is managed by `kingsrook/qqq-orb` using `.qqq-ci.yml`; preserve that lane and its main-only library publication. The legacy `.github` `Scanner Android` workflow builds a debug APK artifact and never publishes libraries or production releases; it and the scanner release workflow are not a selected release path. The owner has authorized production signing with the QRun-owned key `qqq-mobile-release` (details and fingerprint in `docs/RELEASING.md`) for signed-APK/MDM distribution. Do not create replacement or additional signing keys, put key material, passwords or vault item details in the repository, or use the legacy GitHub release workflows; create no tags or releases without current authorization. Do not replace managed CI with a stale local template.
|
||||
@@ -1,81 +1,96 @@
|
||||
# QQQ Android
|
||||
|
||||
[](https://github.com/QRun-IO/qqq-android/actions/workflows/scanner.yml)
|
||||
Native Kotlin/Compose clients for QQQ. The `scanner-host` application ("QQQ Mobile", `io.qrun.mobile.scanner`) runs server-defined QQQ apps and processes on Android handhelds, currently Zebra TC22 and MC9400 class devices. It is online only.
|
||||
|
||||
Native Kotlin/Compose clients for QQQ. The new `scanner-host` application runs server-defined QQQ apps and processes on Android handhelds, initially Zebra TC22.
|
||||
Current progress and open items: [status](docs/SESSION-STATE.md), [checklist](docs/TODO.md), [1.0 finish ledger](docs/FINISH-1.0.md). Superseded status notes are kept under [docs/history](docs/history/README.md).
|
||||
|
||||
## Modules
|
||||
|
||||
- `qqq/android/core`: metadata and process HTTP client (`QQQRepository` / `NetworkQQQRepository`).
|
||||
- `qqq/android/mobileapp`: native app picker, authentication, process runner, and widget renderer.
|
||||
- `scanner-host`: server configuration, device registration/approval gate, and Zebra EMDK barcode capture.
|
||||
- `qqqsampleandroidmobileapp`: historical example application.
|
||||
| Module | Purpose |
|
||||
| --- | --- |
|
||||
| `qqq/android/core` | Metadata and process HTTP client (`QQQRepository` / `NetworkQQQRepository`). |
|
||||
| `qqq/android/mobileapp` | Native app picker, authentication, process runner and widget renderer. |
|
||||
| `scanner-host` | The scanner application: server configuration, device registration/approval gate, Zebra EMDK barcode capture, branding, diagnostics, settings. |
|
||||
| `qqqsampleandroidmobileapp` | Historical example application and the shared native test host. |
|
||||
|
||||
The client supports metadata and process execution. It does not implement the record CRUD/fluent API previously described by this README.
|
||||
The libraries support metadata and process execution. They do not implement a record CRUD/fluent API.
|
||||
|
||||
The scanner host uses the versioned semantic UI API for app discovery, native process screens and actions, plus the registered `mobile-scanners` extension for device enrollment, branding, connectivity and session administration. It requires extension 1.1 or later within major 1 and checks compatibility before login. See [the client contract and supported components](docs/UI-API.md); full web-client feature coverage is not implied.
|
||||
## What the scanner host does
|
||||
|
||||
## First scanner application
|
||||
- **Semantic API only.** All operations use the versioned UI API plus the registered `mobile-scanners` extension (device enrollment, branding, status, sessions). The host requires extension 1.1 or later within major 1 and checks `/qqq/v1/version` compatibility before sending credentials. Optional capabilities (for example raw scan bytes, mobile 1.5) are used only when the same server advertises them. See [UI API contract and supported components](docs/UI-API.md); web-client parity is not implied.
|
||||
- **Server-defined screens.** The server supplies the app, native process steps and the `SCANNER` widget; the APK hard-codes no process name. Unknown required controls stop submission explicitly.
|
||||
- **Device approval.** Each installation enrolls a device that a QQQ administrator must approve; the server enforces approval on every scan.
|
||||
- **Zebra scanning.** Uses the device's EMDK service, acquired only while a scanner widget is visible and resumed, and released on leave. No DataWedge profile setup is needed and DataWedge settings are not persistently modified. Other Android devices use explicit manual entry. See [Zebra scanning](docs/ZEBRA-SCANNING.md).
|
||||
- **Runtime branding.** The shared launcher stays "QQQ Mobile"; after connecting, the host reads public `GET /qqq/v1/qbit/mobile-scanners/branding` (`displayName` up to 80 printable characters, `primaryColor` as `#RRGGBB`, optional HTTPS `logoUrl`). Malformed values fall back to QQQ defaults; logos are fetched without session/device headers; branding resets when the server changes. No per-customer build.
|
||||
- **Connection footer and diagnostics.** The footer shows Checking, Connected or Disconnected from `GET /qqq/v1/qbit/mobile-scanners/status` (reachability only, not sign-in or approval). Tap it, or use the menu, for a full-screen view of the latest 100 sanitized events with All/Problems filters, pause, copy/share/clear. The log holds fixed event codes, HTTP status and latency, never credentials, scan values, paths or response text.
|
||||
- **Echo (local print workflow).** Echo is a server-side semantic process (printer, label size, document and optional copies per scan 1–100, chosen once per run). The client uses only generic native controls; printing happens on the server side and nothing printer-specific is installed on the scanner.
|
||||
- **Settings.** Orientation (portrait by default), foreground location reporting (default on, Android permission required, scanning works without it), optional status wallpaper chooser, and About QQQ Mobile (version, public links, bundled open-source licenses).
|
||||
- **Managed configuration and wallpaper.** The app declares Android app restrictions (`qqq_server_url`, `qqq_orientation`) and an optional live status wallpaper. See [device provisioning](docs/DEVICE-PROVISIONING.md); no company profile or MDM rollout has been verified.
|
||||
|
||||
Use the companion `qbit-mobile-scanners` server/demo with QQQ `4.1.0-RC.20`. The demo uses QQQ TABLE_BASED username/password authentication. Credentials are exchanged through the native QQQ session endpoint; the password is not stored.
|
||||
### Online-only behavior
|
||||
|
||||
1. Start the companion demo and install the debug APK.
|
||||
2. Run `adb reverse tcp:8080 tcp:8080` for a USB-connected TC22.
|
||||
3. Open QQQ Mobile, use `http://127.0.0.1:8080/`, and sign in.
|
||||
4. An administrator approves the displayed device ID in QQQ.
|
||||
5. Tap **Check approval**, select the server-provided mobile app, and open **Scan capture**.
|
||||
6. Scan a barcode and wait for **Saved scan** before scanning again. Manual entry is available for development and non-Zebra devices.
|
||||
There is no offline queue. One submitted scan is held in memory until a complete receipt returns the matching `acknowledgedEventId`, `scanSaved: true` and a nonblank `scanId`. After an uncertain response, **Retry same request** keeps the event ID and original timestamp and the server deduplicates; further scans wait for confirmation or explicit abandonment. Leaving then warns that the scan may already be saved and attempts server cancellation, with **Leave anyway** as the explicit fallback. Sign-out clears the pending request; app termination loses in-memory state.
|
||||
|
||||
The server defines the app, native process steps, and `SCANNER` widget; the APK does not hard-code a scan process name. Existing native widget types continue to work.
|
||||
Administrators can inspect sessions, end them and request live viewing of the QQQ app. Viewing shows an informational indicator on the handheld; password screens and background apps cannot be mirrored; whole-device sharing needs Android consent. See [session behavior and limits](docs/UI-API.md#session-activity-and-screen-viewing).
|
||||
|
||||
## Zebra hardware scanning
|
||||
Enrollment credentials are encrypted with the Android Keystore under `noBackupFilesDir`, scoped to the server, and backup is disabled. Redirects are disabled. **Release builds reject HTTP; only development builds allow it for local testing.**
|
||||
|
||||
The normal debug and release APKs use the device-provided Zebra EMDK service. They do not accept DataWedge scan broadcasts. No DataWedge profile setup is required. The scanner is acquired only while a scanner widget is visible and the activity is resumed; leaving or backgrounding releases it. EMDK temporarily takes scanner ownership from DataWedge and restores it on release. The app does not persistently modify DataWedge settings.
|
||||
## Prerequisites
|
||||
|
||||
The same APK runs on other Android devices with explicit manual entry. When the required system library/service is missing or unavailable, the screen explains that hardware scanning is unavailable. [Scanner integration and SDK provenance](docs/ZEBRA-SCANNING.md) describes the lifecycle, compile-only SDK and verification gates. Synthetic broadcasts are accepted only by the separate disposable E2E variant.
|
||||
- Java 21, Android SDK platform 35 with build tools 34/35, and the included Gradle 8.7 wrapper. Set `ANDROID_HOME` or an ignored `local.properties`.
|
||||
- A QQQ server exposing the semantic UI API (core 1.8 or later within major 1; OAuth2 sign-in needs 1.10) and the `mobile-scanners` extension. The companion server/demo is `qbit-mobile-scanners` (its POM pins the QQQ source default, currently `4.1.0-RC.21`; a local server may run an older qualified core, which the host checks before login). Local demo authentication is TABLE_BASED username/password, exchanged through the native QQQ session endpoint; the password is not stored.
|
||||
|
||||
## Customer branding and diagnostics
|
||||
## Installing on a device
|
||||
|
||||
The shared launcher name/icon remain QQQ Mobile. On connecting to a server, the host reads public `GET /qqq/v1/qbit/mobile-scanners/branding` (`displayName`, `primaryColor`, optional `logoUrl`). The name and Material theme apply to login, device approval, and native app screens. Names are limited to 80 printable characters and colors to `#RRGGBB`; malformed values fall back to QQQ defaults. Button foregrounds choose readable black/white contrast. Optional logos must use HTTPS, are fetched without session/device headers or cookies, and cannot prevent login if unavailable. Responses are size-limited, redirects are disabled, and branding is reset when changing servers. Reconnect to pick up server branding changes; no APK rebuild is needed.
|
||||
Two distinct paths. Do not mix their APKs or assumptions.
|
||||
|
||||
The persistent footer shows **Checking**, **Connected**, or **Disconnected** with the last check time. It checks `GET /qqq/v1/qbit/mobile-scanners/status` every five seconds while foregrounded and on network changes; `Connected` means a valid `{ "status": "ok" }` response, not sign-in or device approval. Tap the footer for **Copy**, **Clear**, and **Close** diagnostics. The in-memory log holds the latest 100 fixed event codes with timestamps, HTTP status, and latency for branding, connection checks, native QQQ calls (including login/process requests), and device enrollment/status requests. A transport failure has no HTTP status; an HTTP response retains its status, including 401/403/500 errors. The log contains no credentials, scan values, request paths, queries, raw response text, or exception messages. Changing servers clears the displayed diagnostics. Monitoring never queues or retries a scan.
|
||||
### Local demo (development-signed debug APK, HTTP, same workstation)
|
||||
|
||||
## Online-only behavior
|
||||
For trying the scanner against a local server. The debug APK uses the development certificate and is not a release.
|
||||
|
||||
QQQ administrators can inspect session activity, end sessions, and request live viewing of the QQQ app from a session record. Viewing displays an indicator with **Stop viewing** on the handheld. Password/login screens and background apps cannot be mirrored. Foreground location reporting defaults on and can be disabled in Settings. It requires Android permission and enabled device location providers; scanning works without it. See [session behavior and limits](docs/UI-API.md#session-activity-and-screen-viewing).
|
||||
1. Start the companion demo server and build the debug APK (below).
|
||||
2. Install it with `adb install -r`, naming the device with `-s`.
|
||||
3. Forward the device port to the server: `adb -s <device> reverse tcp:8080 tcp:<server port>`. This works over USB or paired wireless ADB and must be repeated after the connection drops; it is a workstation-attached demo, not autonomous LAN rollout.
|
||||
4. Open QQQ Mobile, connect to `http://127.0.0.1:8080/`, and sign in.
|
||||
5. An administrator approves the displayed device in QQQ (the mobile device approval process); tap **Check approval**, choose the server's mobile app, and open **Scan capture** or Echo.
|
||||
6. Wait for **Saved scan** (or Echo's acknowledgment) before scanning again.
|
||||
|
||||
Open **Settings → About QQQ Mobile** for the app version, Query mascot, [Dogfooding](https://www.qrun.io/dogfooding), [Query](https://www.qrun.io/query) and bundled open-source licenses. Public website links open in the external browser without adding session or device information.
|
||||
See [emulator testing](docs/EMULATOR.md) for an emulator demo, synthetic scans and the disposable E2E variant.
|
||||
|
||||
There is no offline queue. One submitted scan is retained in memory until a complete receipt returns the matching `acknowledgedEventId`, `scanSaved: true`, and a nonblank `scanId`. If a response is uncertain, **Retry same request** preserves its event ID and original timestamp; the server deduplicates it. Further scans wait for confirmation or explicit abandonment. Leaving after an uncertain response warns that the scan may already be saved and attempts server cancellation; if cancellation fails, **Leave anyway** lets the operator exit explicitly. Active requests and pending photos remain protected. Sign-out/reset clears the pending request; app termination loses in-memory state. Repeated physical scans deliberately receive distinct event IDs.
|
||||
### Signed APK (direct install / MDM)
|
||||
|
||||
Enrollment credentials are encrypted with Android Keystore and stored under `noBackupFilesDir`, scoped to the configured server. The app disables backup. Device headers accompany native QQQ requests, and the server enforces approval on every scan. Release builds reject HTTP; only the development build permits it for local testing. The host disables HTTP redirects to avoid forwarding credentials to another origin.
|
||||
For real devices. Requires an **HTTPS** server URL and the production-signed APK built with the QRun-owned key. Follow the [installation guide](docs/INSTALLATION.md) and [release readiness](docs/RELEASING.md). A signed 1.0.0 (versionCode 2) APK exists and was installed and launched on one MC9400, but it has not been qualified end to end, distributed or published, and no release exists. The development-signed and production-signed builds cannot update each other in place.
|
||||
|
||||
## Build
|
||||
|
||||
Requirements: Java 17 or compatible newer runtime, Android SDK platform35, build tools34/35, and the included Gradle8.7 wrapper. Configure `ANDROID_HOME` or ignored `local.properties`.
|
||||
## Build and test
|
||||
|
||||
```powershell
|
||||
.\gradlew.bat :scanner-host:testDebugUnitTest :scanner-host:assembleDebug :scanner-host:lintDebug
|
||||
.\gradlew.bat :qqq:android:core:testDebugUnitTest :qqq:android:mobileapp:testDebugUnitTest :scanner-host:testDebugUnitTest :scanner-host:lintDebug :scanner-host:assembleDebug
|
||||
```
|
||||
|
||||
APK: `scanner-host/build/outputs/apk/debug/scanner-host-debug.apk`.
|
||||
Debug APK: `scanner-host/build/outputs/apk/debug/scanner-host-debug.apk`. `connectedDebugAndroidTest` needs a device or emulator. Scanner flow changes also use the separate E2E variant (`:scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest`, then `node scripts/ci/scanner-e2e.mjs ../qbit-mobile-scanners`) as described in [AGENTS.md](AGENTS.md) and [emulator testing](docs/EMULATOR.md). Device-level acceptance evidence is described in [device testing](docs/DEVICE-TESTING.md).
|
||||
|
||||
The existing libraries also have unit and emulator tests. `testDebugUnitTest` runs JVM tests; `connectedDebugAndroidTest` needs a connected device/emulator. Physical TC22 trigger, lifecycle and scanner-ownership behavior must still be verified on hardware.
|
||||
Limits: JVM, emulator and synthetic-scan tests do not prove physical trigger, lifecycle, label printing or provider behavior; those need hardware. Version-one scope excludes offline queueing and background synchronization.
|
||||
|
||||
See [emulator testing](docs/EMULATOR.md) for a local interactive demo, synthetic scanner broadcasts, and the disposable-emulator smoke check.
|
||||
## CI and automation
|
||||
|
||||
## CI and delivery
|
||||
|
||||
The managed CircleCI Android profile owns shared-library verification and its existing main-only Maven publication. The GitHub **Scanner Android** workflow adds shared/scanner JVM tests, scanner lint, debug APK assembly, SHA256, and downloadable artifacts for pull requests and supported branches. The API35 emulator lane runs the shared native UI tests and real-server scanner E2E on pushes and pull requests. See [emulator testing](docs/EMULATOR.md) for the isolated test package and contract checks.
|
||||
|
||||
The GitHub workflow does not publish libraries or production releases. Signed APK distribution remains a separate release task. See [Contributing](CONTRIBUTING.md), [Security](SECURITY.md), and [Changelog](CHANGELOG.md).
|
||||
The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive and receives no ordinary writes. Protected `main` runs [`.gitea/workflows/qrun-android-release.yaml`](.gitea/workflows/qrun-android-release.yaml) on push and manual dispatch; it calls the shared `KofTwentyTwo/platform-ci` Android workflow (`android.yaml@qrun-release-v1`). That workflow builds, verifies and publishes the SDK libraries; it is not a scanner-APK signing or release pipeline. Pull-request checks come from central Gitea policy. The managed CircleCI profile (`.qqq-ci.yml`) and its main-only library publication are retained. The `.github` workflows are legacy and not a release path. Shared CI design is out of scope for this repository's local use: the demo above needs none of it.
|
||||
|
||||
## Extension points
|
||||
|
||||
`LocalAuthenticatedContent` allows a host to gate authenticated QQQ content. `LocalCustomWidgetRenderer` lets the host render additional metadata-defined widgets without replacing the standard renderer. `NetworkQQQRepository` accepts a server-scoped header provider; credentials never enter process values.
|
||||
`LocalAuthenticatedContent` lets a host gate authenticated QQQ content. `LocalCustomWidgetRenderer` lets the host render additional metadata-defined widgets without replacing the standard renderer. `NetworkQQQRepository` accepts a server-scoped header provider; credentials never enter process values.
|
||||
|
||||
The scanner host supports TABLE_BASED authentication and server-advertised OAuth2 browser sign-in, including Authentik. Updated OAuth2 requires UI API1.10 native-session login and nonce-validation capabilities, the explicit REQUIRED nonce policy and callback registration; it is being qualified and does not infer support from the provider name. Unsupported servers cannot downgrade browser login; TABLE sign-in is unchanged. See [authentication setup and verification](docs/AUTHENTICATION.md). Existing shared-library Auth0 support remains intact.
|
||||
The scanner host supports TABLE_BASED authentication and server-advertised OAuth2 browser sign-in, including Authentik. OAuth2 needs UI API 1.10 native-session login and nonce-validation capabilities, the REQUIRED nonce policy and callback registration, and never infers support from the provider name; unsupported servers cannot downgrade. Real desktop Authentik acceptance has passed; native on-device provider acceptance is still open. See [authentication setup and verification](docs/AUTHENTICATION.md). Existing shared-library Auth0 support remains intact.
|
||||
|
||||
## Source map
|
||||
|
||||
- Managed configuration: [`ManagedConfiguration.kt`](scanner-host/src/main/java/io/qrun/mobile/scanner/ManagedConfiguration.kt), [`app_restrictions.xml`](scanner-host/src/main/res/xml/app_restrictions.xml)
|
||||
- Status wallpaper: [`QqqStatusWallpaperService.kt`](scanner-host/src/main/java/io/qrun/mobile/scanner/QqqStatusWallpaperService.kt)
|
||||
- Orientation policy: [`OrientationPolicy.kt`](scanner-host/src/main/java/io/qrun/mobile/scanner/OrientationPolicy.kt)
|
||||
- Manifest: [`AndroidManifest.xml`](scanner-host/src/main/AndroidManifest.xml)
|
||||
- Company profile generator: [`deployment/company-profile`](deployment/company-profile/), [COMPANY-PROFILE.md](docs/COMPANY-PROFILE.md)
|
||||
|
||||
See also [Contributing](CONTRIBUTING.md), [Security](SECURITY.md) and [Changelog](CHANGELOG.md).
|
||||
|
||||
## License
|
||||
|
||||
Licensed under Apache-2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE). Historical project-owned source headers and the IDE copyright template have been reconciled with the repository's January 2026 license migration. Existing copyright ownership and third-party notices are preserved.
|
||||
Licensed under Apache-2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE). Existing copyright ownership and third-party notices are preserved.
|
||||
@@ -0,0 +1,12 @@
|
||||
# Device Owner enrollment (destructive, separate from the safe profile)
|
||||
|
||||
Not generated and not part of `generate-company-profile.mjs`. Fully managed (Device Owner) provisioning is intended for a new or factory-reset handheld (`docs/DEVICE-PROVISIONING.md`, Android device management). Doing it wipes the device's data and settings, including the current scanner and printing setup.
|
||||
|
||||
Do not start unless all of these are recorded and approved by the owner of the device fleet:
|
||||
|
||||
1. The customer EMM/MDM, its enrollment method and Zebra OEMConfig package (`com.zebra.oemconfig.release` on Android 13+).
|
||||
2. A spare device, not the development TC22, with the ordinary safe profile already reviewed.
|
||||
3. The recovery route if the EMM or EHS locks the device out, and the factory-reset authority.
|
||||
4. Confirmation that the QQQ device approval and Android management states stay separate.
|
||||
|
||||
Enrollment credentials, tokens and QR payloads belong in the EMM, never in this repository.
|
||||
@@ -0,0 +1,230 @@
|
||||
#!/usr/bin/env node
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
// Renders a reviewable Zebra Enterprise Home Screen (EHS) config and, when the device is measured, a StageNow/MX
|
||||
// AppMgr document from one non-secret JSON profile. Only elements documented by Zebra are emitted; see
|
||||
// docs/COMPANY-PROFILE.md for the page citations. Nothing here installs, pushes or changes a device.
|
||||
//
|
||||
// Usage: node generate-company-profile.mjs <profile.json> <output-dir> [--require-ready]
|
||||
|
||||
import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
|
||||
import { join } from "node:path"
|
||||
import { pathToFileURL } from "node:url"
|
||||
|
||||
export const EHS_PACKAGE = "com.zebra.mdna.enterprisehomescreen"
|
||||
export const EHS_ACTIVITY = "com.zebra.mdna.enterprisehomescreen.HomeScreenActivity"
|
||||
const PACKAGE = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/
|
||||
const TITLE_TOKENS = new Set(["bluetooth_address", "bluetooth_name", "imei_number", "mac_address", "network_host_name", "serial_number", "device_name"])
|
||||
const LOGO_EXTENSIONS = [".bmp", ".gif", ".jpg", ".png", ".webp"]
|
||||
const APP_ICON_EXTENSIONS = [".bmp", ".jpg", ".png"]
|
||||
const COLOR_NAMES = new Set(["red", "blue", "green", "black", "white", "gray", "cyan", "magenta", "yellow", "lightgray", "darkgray"])
|
||||
// Keys and values consumed by the app's RestrictionsManager reader (scanner-host res/xml/app_restrictions.xml).
|
||||
export const MANAGED_SERVER_KEY = "qqq_server_url"
|
||||
export const MANAGED_ORIENTATION_KEY = "qqq_orientation"
|
||||
export const MANAGED_ORIENTATIONS = ["SYSTEM", "PORTRAIT", "LANDSCAPE", "REVERSE_PORTRAIT", "REVERSE_LANDSCAPE"]
|
||||
const BLOCKED_WILDCARDS =/^com\.(a|an|and|andr|andro|androi|android)\*?$/
|
||||
|
||||
/*******************************************************************************
|
||||
** Mirror the app's normalizeServerUrl for managed values: HTTPS origin only. Returns the normalized origin or null.
|
||||
*******************************************************************************/
|
||||
export function managedServerUrl(value) {
|
||||
if (typeof value !== "string" || value.length > 2048) return null
|
||||
try {
|
||||
const url = new URL(value.trim())
|
||||
if (url.protocol !== "https:" || !url.hostname || url.username || url.password || url.search || url.hash || url.pathname !== "/") return null
|
||||
return `https://${url.host}/`
|
||||
} catch { return null }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Escape the five characters EHS's XML parser requires to be escaped.
|
||||
*******************************************************************************/
|
||||
export function xml(value) {
|
||||
return String(value).replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """).replace(/'/g, "'")
|
||||
}
|
||||
|
||||
function devicePath(value, extensions, label, errors) {
|
||||
if (value == null) return null
|
||||
if (typeof value !== "string" || !value.startsWith("/enterprise/usr/") || value.split("/").includes("..") || !extensions.some((e) => value.toLowerCase().endsWith(e))) {
|
||||
errors.push(`${label} must be an absolute /enterprise/usr/ path (persists across Enterprise Reset) ending in ${extensions.join(", ")}`)
|
||||
return null
|
||||
}
|
||||
return value
|
||||
}
|
||||
|
||||
function color(value, label, errors) {
|
||||
if (value == null) return null
|
||||
if (typeof value !== "string" || !(/^#([0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(value) || COLOR_NAMES.has(value))) errors.push(`${label} must be #RRGGBB, #AARRGGBB or a documented color name`)
|
||||
return value
|
||||
}
|
||||
|
||||
function validateTitle(title, errors) {
|
||||
if (typeof title !== "string" || title.trim() === "") { errors.push("launcher.title is required"); return { text: "", dynamic: false } }
|
||||
const tokens = [...title.matchAll(/\[([^\]]*)\]/g)].map((m) => m[1])
|
||||
for (const token of tokens) if (!TITLE_TOKENS.has(token)) errors.push(`launcher.title token [${token}] is not a documented device ID`)
|
||||
if (new Set(tokens).size > 1 || tokens.length > 1) errors.push("launcher.title may contain at most one device ID token")
|
||||
if (title.replace(/\[[^\]]*\]/g, "").match(/[\[\]]/)) errors.push("launcher.title square brackets are only allowed around a documented device ID")
|
||||
return { text: title, dynamic: tokens.length === 1 }
|
||||
}
|
||||
|
||||
function validateApp(app, index, list, errors, { icons }) {
|
||||
const where = `${list}[${index}]`
|
||||
if (!app || typeof app !== "object") { errors.push(`${where} must be an object`); return null }
|
||||
const pkg = app.package
|
||||
if (typeof pkg !== "string" || !PACKAGE.test(pkg)) {
|
||||
errors.push(`${where}.package must be an exact package name (wildcards are rejected: least privilege)`)
|
||||
if (typeof pkg === "string" && (pkg.includes("*") && BLOCKED_WILDCARDS.test(pkg))) errors.push(`${where}.package wildcard is blocked by EHS`)
|
||||
return null
|
||||
}
|
||||
if (pkg === EHS_PACKAGE) errors.push(`${where} must not list EHS itself`)
|
||||
if (typeof app.label !== "string" || app.label.trim() === "") errors.push(`${where}.label is required`)
|
||||
else if (app.label.length > 18) errors.push(`${where}.label is longer than 18 characters; EHS truncates it`)
|
||||
if (app.activity != null && (typeof app.activity !== "string" || !PACKAGE.test(app.activity))) errors.push(`${where}.activity must be a class name`)
|
||||
const icon = icons ? devicePath(app.icon, APP_ICON_EXTENSIONS, `${where}.icon`, errors) : null
|
||||
return { label: app.label, package: pkg, activity: app.activity ?? "", icon }
|
||||
}
|
||||
|
||||
function applicationTag(app, indent) {
|
||||
const icon = app.icon ? ` icon="${xml(app.icon)}"` : ""
|
||||
return `${indent}<application label="${xml(app.label)}" package="${xml(app.package)}" activity="${xml(app.activity)}"${icon}/>`
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Validate a profile. Returns normalized values plus the inputs that are still missing before it can be installed.
|
||||
*******************************************************************************/
|
||||
export function validate(profile) {
|
||||
const errors = []
|
||||
const missing = []
|
||||
const warnings = []
|
||||
const p = profile ?? {}
|
||||
if (typeof p.profileId !== "string" || !/^[a-z0-9][a-z0-9-]{1,62}$/.test(p.profileId)) errors.push("profileId must be lowercase letters, digits and hyphens")
|
||||
if (!Number.isInteger(p.revision) || p.revision < 1) errors.push("revision must be a positive integer")
|
||||
|
||||
const device = p.device ?? {}
|
||||
for (const key of ["androidVersion", "mxVersion", "osBuild"]) if (!device[key]) missing.push(`device.${key}: measure on the target device before generating installable MX output`)
|
||||
if (!p.ehs?.installedVersion) missing.push("ehs.installedVersion: select an EHS build supported on the measured firmware (docs checked: 8.0)")
|
||||
|
||||
const q = p.qqq ?? {}
|
||||
if (typeof q.package !== "string" || !PACKAGE.test(q.package)) errors.push("qqq.package must be the existing QQQ package name")
|
||||
if (typeof q.activity !== "string" || !PACKAGE.test(q.activity)) errors.push("qqq.activity must be a fully qualified activity class")
|
||||
if (typeof q.label !== "string" || q.label === "" || q.label.length > 18) errors.push("qqq.label is required (18 characters or fewer)")
|
||||
const endpoint = managedServerUrl(q.endpoint)
|
||||
if (endpoint === null) errors.push("qqq.endpoint must be an https origin with no credentials, path, query or fragment (the app rejects anything else)")
|
||||
else if (new URL(endpoint).hostname.endsWith(".invalid")) missing.push("qqq.endpoint: replace the placeholder with the company QQQ server URL")
|
||||
if (q.orientation != null && !MANAGED_ORIENTATIONS.includes(q.orientation)) errors.push(`qqq.orientation must be one of ${MANAGED_ORIENTATIONS.join(", ")} or omitted`)
|
||||
|
||||
const l = p.launcher ?? {}
|
||||
const title = validateTitle(l.title, errors)
|
||||
const logo = devicePath(l.titleBarLogo, LOGO_EXTENSIONS, "launcher.titleBarLogo", errors)
|
||||
const wallpaper = devicePath(l.wallpaper, LOGO_EXTENSIONS, "launcher.wallpaper", errors)
|
||||
if (!logo) missing.push("launcher.titleBarLogo: company logo file and its /enterprise/usr path")
|
||||
if (!wallpaper) missing.push("launcher.wallpaper: company wallpaper file and its /enterprise/usr path")
|
||||
const textColor = color(l.iconLabelTextColor ?? "#FFFFFFFF", "launcher.iconLabelTextColor", errors)
|
||||
const backgroundColor = color(l.iconLabelBackgroundColor ?? "#00FFFFFF", "launcher.iconLabelBackgroundColor", errors)
|
||||
if (l.iconSize != null) errors.push("launcher.iconSize is unsupported: Zebra's snippet does not show where user_options sits in the config file")
|
||||
|
||||
const apps = []
|
||||
if (!Array.isArray(p.permittedApps) || p.permittedApps.length === 0) errors.push("permittedApps must list at least the QQQ application")
|
||||
else p.permittedApps.forEach((a, i) => { const v = validateApp(a, i, "permittedApps", errors, { icons: true }); if (v) apps.push(v) })
|
||||
if (!apps.some((a) => a.package === q.package)) errors.push("permittedApps must include the qqq.package application")
|
||||
if (new Set(apps.map((a) => a.package)).size !== apps.length) errors.push("permittedApps contains a duplicate package")
|
||||
if (apps.length === 1) missing.push("permittedApps: administrator list of required Android companion apps (camera/photo picker, printing); only QQQ is listed")
|
||||
|
||||
const tools = []
|
||||
;(p.tools ?? []).forEach((a, i) => { const v = validateApp(a, i, "tools", errors, { icons: false }); if (v) tools.push(v) })
|
||||
|
||||
const r = p.restrictions ?? {}
|
||||
for (const [key, allowed] of [["systemSettingsRestricted", [0, 1, 3]], ["recentAppsAccessDisabled", [0, 1]], ["recentAppsButtonDisabled", [0, 1, 2, 3]]]) {
|
||||
if (!allowed.includes(r[key])) errors.push(`restrictions.${key} must be one of ${allowed.join(", ")} (explicit decision required)`)
|
||||
}
|
||||
if (r.systemSettingsRestricted === 3) warnings.push("systemSettingsRestricted 3 requires MX 11.7+ and OSx 11.5.21+ on the device")
|
||||
if (r.systemSettingsRestricted === 1) warnings.push("systemSettingsRestricted 1 (EHS default) hides most Settings panels; confirm Bluetooth printer pairing and Wi-Fi workflows on a spare device")
|
||||
|
||||
const deploy = []
|
||||
;(p.deploy ?? []).forEach((d, i) => {
|
||||
const where = `deploy[${i}]`
|
||||
const known = [EHS_PACKAGE, q.package]
|
||||
if (!d || !known.includes(d.package)) errors.push(`${where}.package must be EHS or the QQQ package`)
|
||||
else if (!["Install", "Upgrade"].includes(d.action)) errors.push(`${where}.action must be Install or Upgrade`)
|
||||
else if (typeof d.apk !== "string" || !d.apk.startsWith("/") || d.apk.split("/").includes("..") || !d.apk.endsWith(".apk")) errors.push(`${where}.apk must be an absolute on-device .apk path already staged`)
|
||||
else deploy.push({ package: d.package, action: d.action, apk: d.apk })
|
||||
})
|
||||
if (!deploy.some((d) => d.package === EHS_PACKAGE)) missing.push("deploy: EHS APK on-device path (artifact delivery method and checksum are an administrator decision)")
|
||||
|
||||
return { errors, missing, warnings, normalized: { title, logo, wallpaper, textColor, backgroundColor, apps, tools, deploy, qqq: q, launcher: l, restrictions: r } }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Render enterprisehomescreen.xml. Tags not parameterized keep the values of Zebra's documented default file.
|
||||
*******************************************************************************/
|
||||
export function renderEhs(profile, n) {
|
||||
const qqqApp = n.apps.find((a) => a.package === n.qqq.package)
|
||||
const lines = ["<?xml version=\"1.0\" encoding=\"utf-8\"?>", `<!-- profile ${xml(profile.profileId)} revision ${profile.revision}; generated for review, see docs/COMPANY-PROFILE.md. EHS docs 8.0. -->`, "<config>"]
|
||||
lines.push(" <kiosk>", applicationTag(qqqApp, " "), " </kiosk>")
|
||||
lines.push(" <applications>", ...n.apps.map((a) => applicationTag(a, " ")), " </applications>")
|
||||
if (n.tools.length > 0) lines.push(" <tools>", ...n.tools.map((a) => applicationTag(a, " ")), " </tools>")
|
||||
// EHS stores a hash here when an administrator sets the password in Admin Mode; it must never be authored.
|
||||
lines.push(" <passwords>", " <admin></admin>", " </passwords>")
|
||||
lines.push(" <preferences>")
|
||||
lines.push(n.title.dynamic ? ` <title><value>${xml(n.title.text)}</value></title>` : ` <title>${xml(n.title.text)}</title>`)
|
||||
if (n.logo) {
|
||||
lines.push(" <title_bar_icon>", " <title_bar_icon_disabled>0</title_bar_icon_disabled>", ` <title_bar_icon_file>${xml(n.logo)}</title_bar_icon_file>`)
|
||||
lines.push(` <reuse_custom_icon>${n.launcher.reuseLogoOnEhsScreens ? 1 : 0}</reuse_custom_icon>`, " </title_bar_icon>")
|
||||
}
|
||||
lines.push(` <icon_label_background_color>${xml(n.backgroundColor)}</icon_label_background_color>`, ` <icon_label_text_color>${xml(n.textColor)}</icon_label_text_color>`)
|
||||
lines.push(" <orientation></orientation>", " <auto_launch_enable>0</auto_launch_enable>", " <service_auto_launch_enable>0</service_auto_launch_enable>")
|
||||
lines.push(` <wallpaper>${xml(n.wallpaper ?? "")}</wallpaper>`)
|
||||
if (n.wallpaper) lines.push(` <wallpaper_stretching_enabled>${n.launcher.wallpaperStretch ? 1 : 0}</wallpaper_stretching_enabled>`)
|
||||
lines.push(" <kiosk_mode_enabled>0</kiosk_mode_enabled>", " <keyguard_camera_disabled>1</keyguard_camera_disabled>", " <keyguard_search_disabled>1</keyguard_search_disabled>")
|
||||
lines.push(" <usb_debugging_disabled>1</usb_debugging_disabled>", ` <system_settings_restricted>${n.restrictions.systemSettingsRestricted}</system_settings_restricted>`)
|
||||
lines.push(` <recent_apps_button_disabled>${n.restrictions.recentAppsButtonDisabled}</recent_apps_button_disabled>`, ` <recent_apps_access_disabled>${n.restrictions.recentAppsAccessDisabled}</recent_apps_access_disabled>`)
|
||||
lines.push(" <wireless_info>", ` <show_ip_address>${profile.launcher?.showIpAddress ? 1 : 0}</show_ip_address>`, " <show_mac_address>0</show_mac_address>", " <show_bssid>0</show_bssid>", " <show_ssid>0</show_ssid>", " <show_scan_result>0</show_scan_result>", " </wireless_info>")
|
||||
lines.push(" <screen_blanking>", " <blanking_enabled>0</blanking_enabled>", " <speed_threshold>10</speed_threshold>", " <blanking_mode>1</blanking_mode>", " </screen_blanking>")
|
||||
lines.push(" </preferences>")
|
||||
lines.push("</config>", "")
|
||||
return lines.join("\n")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Render the StageNow/MX AppMgr document: optional APK installs, then EHS as the default launcher.
|
||||
*******************************************************************************/
|
||||
export function renderMx(profile, n) {
|
||||
const lines = ["<?xml version=\"1.0\" encoding=\"utf-8\"?>", `<!-- profile ${xml(profile.profileId)} revision ${profile.revision}; AppMgr only. Device ${xml(profile.device.model)} Android ${xml(profile.device.androidVersion)} MX ${xml(profile.device.mxVersion)}. -->`, "<wap-provisioningdoc>"]
|
||||
for (const d of n.deploy) lines.push(" <characteristic version=\"4.2\" type=\"AppMgr\">", ` <parm name="Action" value="${d.action}" />`, ` <parm name="APK" value="${xml(d.apk)}" />`, " </characteristic>")
|
||||
lines.push(" <characteristic version=\"4.2\" type=\"AppMgr\">", " <parm name=\"Action\" value=\"SetDefaultLauncher\" />", ` <parm name="Package" value="${EHS_PACKAGE}" />`, " </characteristic>")
|
||||
lines.push("</wap-provisioningdoc>", "")
|
||||
return lines.join("\n")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Validate then write outputs. MX output is withheld until the device is measured.
|
||||
*******************************************************************************/
|
||||
export function generate(profile, outDir) {
|
||||
const { errors, missing, warnings, normalized } = validate(profile)
|
||||
const report = { profileId: profile?.profileId, revision: profile?.revision, ready: false, errors, missing, warnings, files: [] }
|
||||
if (errors.length > 0) return report
|
||||
mkdirSync(outDir, { recursive: true })
|
||||
const emit = (name, text) => { writeFileSync(join(outDir, name), text, "utf8"); report.files.push(name) }
|
||||
emit("enterprisehomescreen.xml", renderEhs(profile, normalized))
|
||||
// Android managed configuration for the EMM; withheld while the endpoint is still a placeholder.
|
||||
if (!missing.some((m) => m.startsWith("qqq.endpoint"))) {
|
||||
const managed = { [MANAGED_SERVER_KEY]: managedServerUrl(profile.qqq.endpoint) }
|
||||
if (profile.qqq.orientation != null) managed[MANAGED_ORIENTATION_KEY] = profile.qqq.orientation
|
||||
emit("managed-configuration.json", JSON.stringify(managed, null, 2) + "\n")
|
||||
} else report.warnings.push("managed-configuration.json withheld: qqq.endpoint is still a placeholder")
|
||||
const mxReady =!missing.some((m) => m.startsWith("device.") || m.startsWith("deploy:"))
|
||||
if (mxReady) emit("stagenow-mx-appmgr.xml", renderMx(profile, normalized))
|
||||
else report.warnings.push("stagenow-mx-appmgr.xml withheld: device measurements and EHS APK path are missing")
|
||||
report.ready = missing.length === 0
|
||||
writeFileSync(join(outDir, "profile-report.json"), JSON.stringify(report, null, 2) + "\n", "utf8")
|
||||
report.files.push("profile-report.json")
|
||||
return report
|
||||
}
|
||||
|
||||
if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
|
||||
const [input, outDir, ...flags] = process.argv.slice(2)
|
||||
if (!input || !outDir) { console.error("usage: generate-company-profile.mjs <profile.json> <output-dir> [--require-ready]"); process.exit(64) }
|
||||
const report = generate(JSON.parse(readFileSync(input, "utf8")), outDir)
|
||||
console.log(JSON.stringify(report, null, 2))
|
||||
if (report.errors.length > 0) process.exit(1)
|
||||
if (flags.includes("--require-ready") && !report.ready) process.exit(2)
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
import assert from "node:assert/strict"
|
||||
import { mkdtempSync, readFileSync, readdirSync } from "node:fs"
|
||||
import { tmpdir } from "node:os"
|
||||
import { join } from "node:path"
|
||||
import test from "node:test"
|
||||
import { EHS_PACKAGE, MANAGED_ORIENTATIONS, generate, managedServerUrl, validate, xml } from "./generate-company-profile.mjs"
|
||||
|
||||
const example = () => JSON.parse(readFileSync(new URL("./profile.example.json", import.meta.url), "utf8"))
|
||||
const measured = () => {
|
||||
const p = example()
|
||||
Object.assign(p.device, { androidVersion: "14", mxVersion: "14.0.0.0", osBuild: "measured-build" })
|
||||
p.ehs.installedVersion = "8.0"
|
||||
p.qqq.endpoint = "https://qqq.company.test"
|
||||
p.permittedApps.push({ label: "Camera", package: "com.example.camera", activity: null, icon: null })
|
||||
p.deploy = [{ package: EHS_PACKAGE, action: "Install", apk: "/enterprise/usr/persist/EHS.apk" }]
|
||||
return p
|
||||
}
|
||||
const out = () => mkdtempSync(join(tmpdir(), "company-profile-"))
|
||||
|
||||
test("example is valid but reports every unmeasured input and withholds MX output", () => {
|
||||
const dir = out()
|
||||
const report = generate(example(), dir)
|
||||
assert.deepEqual(report.errors, [])
|
||||
assert.equal(report.ready, false)
|
||||
assert.ok(report.missing.some((m) => m.startsWith("device.mxVersion")))
|
||||
assert.ok(report.missing.some((m) => m.startsWith("permittedApps")))
|
||||
assert.ok(report.missing.some((m) => m.startsWith("qqq.endpoint")))
|
||||
assert.deepEqual(readdirSync(dir).sort(), ["enterprisehomescreen.xml", "profile-report.json"])
|
||||
})
|
||||
|
||||
test("measured profile is ready and emits documented EHS and MX elements only", () => {
|
||||
const dir = out()
|
||||
const report = generate(measured(), dir)
|
||||
assert.deepEqual(report.errors, [])
|
||||
assert.equal(report.ready, true)
|
||||
const ehs = readFileSync(join(dir, "enterprisehomescreen.xml"), "utf8")
|
||||
assert.match(ehs, /<title><value>Company \[serial_number\]<\/value><\/title>/)
|
||||
assert.match(ehs, /<wallpaper>\/enterprise\/usr\/company\/wallpaper\.png<\/wallpaper>/)
|
||||
assert.match(ehs, /<usb_debugging_disabled>1<\/usb_debugging_disabled>/)
|
||||
assert.match(ehs, /<kiosk_mode_enabled>0<\/kiosk_mode_enabled>/)
|
||||
assert.match(ehs, /<admin><\/admin>/)
|
||||
const mx = readFileSync(join(dir, "stagenow-mx-appmgr.xml"), "utf8")
|
||||
assert.match(mx, /value="SetDefaultLauncher"/)
|
||||
assert.match(mx, new RegExp(`name="Package" value="${EHS_PACKAGE.replace(/\./g, "\\.")}"`))
|
||||
assert.doesNotMatch(ehs, /<admin>[^<]+<\/admin>/)
|
||||
assert.doesNotMatch(mx + ehs, /token|secret/i)
|
||||
})
|
||||
|
||||
test("security-weakening or undocumented inputs are rejected", () => {
|
||||
const cases = [
|
||||
(p) => { p.permittedApps.push({ label: "All", package: "com.android.*" }) },
|
||||
(p) => { p.permittedApps.push({ label: "Wild", package: "com.mobility.*" }) },
|
||||
(p) => { p.launcher.wallpaper = "/sdcard/wallpaper.png" },
|
||||
(p) => { p.launcher.wallpaper = "/enterprise/usr/../x.png" },
|
||||
(p) => { p.qqq.endpoint = "http://qqq.company.test" },
|
||||
(p) => { p.qqq.endpoint = "https://user:pw@qqq.company.test" },
|
||||
(p) => { p.launcher.title = "Dynamic [username]" },
|
||||
(p) => { p.restrictions.systemSettingsRestricted = 2 },
|
||||
(p) => { delete p.restrictions.recentAppsAccessDisabled },
|
||||
(p) => { p.launcher.iconSize = "XL" },
|
||||
(p) => { p.permittedApps.push({ label: "A very long label over limit", package: "com.example.long" }) },
|
||||
(p) => { p.permittedApps = [{ label: "Other", package: "com.example.other" }] },
|
||||
(p) => { p.deploy = [{ package: "com.evil.app", action: "Install", apk: "/enterprise/usr/persist/x.apk" }] },
|
||||
]
|
||||
for (const mutate of cases) {
|
||||
const p = measured()
|
||||
mutate(p)
|
||||
assert.ok(validate(p).errors.length > 0, mutate.toString())
|
||||
}
|
||||
})
|
||||
|
||||
test("managed configuration uses the app's exact keys and is withheld for a placeholder endpoint", () => {
|
||||
const withheld = out()
|
||||
const placeholder = generate(example(), withheld)
|
||||
assert.ok(!readdirSync(withheld).includes("managed-configuration.json"))
|
||||
assert.ok(placeholder.warnings.some((w) => w.startsWith("managed-configuration.json withheld")))
|
||||
|
||||
const dir = out()
|
||||
const p = measured()
|
||||
p.qqq.endpoint = " https://QQQ.Company.test "
|
||||
p.qqq.orientation = "REVERSE_LANDSCAPE"
|
||||
assert.deepEqual(generate(p, dir).errors, [])
|
||||
assert.deepEqual(JSON.parse(readFileSync(join(dir, "managed-configuration.json"), "utf8")), {
|
||||
qqq_server_url: "https://qqq.company.test/",
|
||||
qqq_orientation: "REVERSE_LANDSCAPE",
|
||||
})
|
||||
|
||||
const noOrientation = out()
|
||||
generate(measured(), noOrientation)
|
||||
assert.deepEqual(Object.keys(JSON.parse(readFileSync(join(noOrientation, "managed-configuration.json"), "utf8"))), ["qqq_server_url"])
|
||||
})
|
||||
|
||||
test("managed server URL accepts only an https origin, mirroring the app", () => {
|
||||
assert.equal(managedServerUrl("https://qqq.company.test"), "https://qqq.company.test/")
|
||||
assert.equal(managedServerUrl("https://qqq.company.test:8443/"), "https://qqq.company.test:8443/")
|
||||
for (const bad of ["http://qqq.company.test", "https://u:p@qqq.company.test", "https://qqq.company.test/app", "https://qqq.company.test/?x=1", "https://qqq.company.test/#f", "ftp://qqq.company.test", "nonsense", "", null, 7, `https://${"a".repeat(2100)}`]) {
|
||||
assert.equal(managedServerUrl(bad), null, String(bad))
|
||||
const p = measured()
|
||||
p.qqq.endpoint = bad
|
||||
assert.ok(validate(p).errors.length > 0, String(bad))
|
||||
}
|
||||
})
|
||||
|
||||
test("orientation must be an exact app value", () => {
|
||||
for (const good of MANAGED_ORIENTATIONS) {
|
||||
const p = measured()
|
||||
p.qqq.orientation = good
|
||||
assert.deepEqual(validate(p).errors, [])
|
||||
}
|
||||
for (const bad of ["portrait", "Landscape", "AUTO", "SENSOR", "", 90]) {
|
||||
const p = measured()
|
||||
p.qqq.orientation = bad
|
||||
assert.ok(validate(p).errors.length > 0, String(bad))
|
||||
}
|
||||
})
|
||||
|
||||
test("XML special characters in labels are escaped", () => {
|
||||
assert.equal(xml(`a&b<c>"d"'e'`), "a&b<c>"d"'e'")
|
||||
const p = measured()
|
||||
p.permittedApps[1].label = "Pick & <Scan>"
|
||||
const dir = out()
|
||||
assert.deepEqual(generate(p, dir).errors, [])
|
||||
assert.match(readFileSync(join(dir, "enterprisehomescreen.xml"), "utf8"), /label="Pick & <Scan>"/)
|
||||
})
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"profileId": "example-company",
|
||||
"revision": 1,
|
||||
"device": {
|
||||
"model": "TC22",
|
||||
"androidVersion": null,
|
||||
"mxVersion": null,
|
||||
"osBuild": null
|
||||
},
|
||||
"ehs": {
|
||||
"docsVersion": "8.0",
|
||||
"installedVersion": null
|
||||
},
|
||||
"qqq": {
|
||||
"package": "io.qrun.mobile.scanner",
|
||||
"activity": "io.qrun.mobile.scanner.ScannerActivity",
|
||||
"label": "QQQ Mobile",
|
||||
"endpoint": "https://qqq.example.invalid",
|
||||
"orientation": null
|
||||
},
|
||||
"launcher": {
|
||||
"title": "Company [serial_number]",
|
||||
"titleBarLogo": "/enterprise/usr/company/logo.png",
|
||||
"reuseLogoOnEhsScreens": true,
|
||||
"wallpaper": "/enterprise/usr/company/wallpaper.png",
|
||||
"wallpaperStretch": false,
|
||||
"iconLabelTextColor": "#FFFFFFFF",
|
||||
"iconLabelBackgroundColor": "#00FFFFFF",
|
||||
"iconSize": null
|
||||
},
|
||||
"permittedApps": [
|
||||
{ "label": "QQQ Mobile", "package": "io.qrun.mobile.scanner", "activity": "io.qrun.mobile.scanner.ScannerActivity", "icon": null }
|
||||
],
|
||||
"tools": [],
|
||||
"restrictions": {
|
||||
"systemSettingsRestricted": 1,
|
||||
"recentAppsAccessDisabled": 1,
|
||||
"recentAppsButtonDisabled": 1
|
||||
},
|
||||
"deploy": []
|
||||
}
|
||||
@@ -6,12 +6,12 @@ The existing mobile-scanners 1.1 transport captures only eligible QQQ app conten
|
||||
|
||||
The additive 1.2 contract advertises supported capture modes in the session heartbeat. Missing capabilities and missing mode fields mean `APP_CONTENT`. `DEVICE_SCREEN` is selected only by an authenticated, approved device operator using Android's own consent dialog. An administrator cannot grant that consent. The existing admin-only viewer and current device/session authorization remain mandatory; a mode change invalidates old leases and pixels. Each new lease and frame carries its mode, preventing a full-display frame from being accepted as app-content capture. The session record exposes the current mode to the administrator.
|
||||
|
||||
Android uses a nonexported `mediaProjection` foreground service, an ongoing notification with Stop, one in-memory consent result, one virtual display and a bounded ImageReader. No audio, remote control, screen recording or saved screenshots are added. Frame size/rate/byte limits and ephemeral latest-only server retention stay unchanged. A single MobileSessionController owns heartbeats/uploads; device mode changes its capture source and allows background heartbeats while consent and the current authenticated session remain valid. Location telemetry retains its existing foreground-only rules.
|
||||
Android uses a nonexported `mediaProjection` foreground service, an ongoing informational notification, one in-memory consent result, one virtual display and a bounded ImageReader. No audio, remote control, screen recording or saved screenshots are added. Frame size/rate/byte limits and ephemeral latest-only server retention stay unchanged. A single MobileSessionController owns heartbeats/uploads; device mode changes its capture source and allows background heartbeats while consent and the current authenticated session remain valid. Location telemetry retains its existing foreground-only rules.
|
||||
|
||||
Starting requires an explicit operator action and system approval for this sharing session, plus an enabled sharing notification. While waiting for an administrator's bounded lease, no frame is uploaded; absence of a lease times out after 30 seconds. Once viewing has begun, lease loss/expiry, network failure, operator/system Stop, device lock, approval loss, logout, server change or controller disposal invalidates capture immediately and releases projection/display/images/service. A service watchdog independently enforces the lease deadline even during encoding or an outstanding request. There is no automatic restart or remembered consent. Activity recreation may end sharing and require fresh consent; it must never silently broaden or revive a grant. Explicit/system Stop pauses all viewing; app-content viewing remains available through the existing Allow viewing control.
|
||||
Starting requires an explicit operator action and system approval for this sharing session, plus an enabled sharing notification. While waiting for an administrator's bounded lease, no frame is uploaded; absence of a lease times out after 30 seconds. Once viewing has begun, lease loss/expiry, network failure, system Stop, device lock, approval loss, logout, server change or controller disposal invalidates capture immediately and releases projection/display/images/service. A service watchdog independently enforces the lease deadline even during encoding or an outstanding request. There is no automatic restart or remembered consent. Activity recreation may end sharing and require fresh consent; it must never silently broaden or revive a grant. System Stop suspends viewing until a fresh sharing grant is started. The app has no Stop viewing, Allow viewing, or custom notification stop action. Android system consent and stop controls remain available.
|
||||
|
||||
Implementation files: Android SessionScreen/MobileSessionApi/MobileSessionController, new DeviceScreenCaptureService and operator control, ScannerActivity wiring and manifest; server MobileSessionService/MobileScreenService/MobileSessionSchemas/ScreenSpec, session metadata/H2 additive migration and extension version. Existing standard rendering and authenticated session APIs are reused; no parallel media server or business-screen framework is added.
|
||||
|
||||
Required tests cover old1.1 fallback, mode mismatch/lease rotation, revoked/ended sessions, bounded no-viewer timeout, late consent/capture after logout, denial/cancel/duplicate result, stale frame disposal, system Stop and notification Stop. Actual Android consent, background display capture, rotation/lock and protected-window behavior require a separate approved native test; synthetic tests do not establish physical capture acceptance.
|
||||
Required tests cover old1.1 fallback, mode mismatch/lease rotation, revoked/ended sessions, bounded no-viewer timeout, late consent/capture after logout, denial/cancel/duplicate result, stale frame disposal, system Stop. Actual Android consent, background display capture, rotation/lock and protected-window behavior require a separate approved native test; synthetic tests do not establish physical capture acceptance.
|
||||
|
||||
Android's [official MediaProjection guide](https://developer.android.com/media/grow/media-projection) requires new consent for each projection session, one-use projection tokens and callback cleanup. Android14+ requires the mediaProjection foreground-service type/permission and supports display or app selection. The device-screen control requests the default display where supported and keeps the system confirmation visible. Protected windows remain protected by Android; we do not attempt to bypass them. A consenting user may expose other apps and notifications, which the control must explain before starting.
|
||||
@@ -0,0 +1,85 @@
|
||||
# Company scanner profile package
|
||||
|
||||
Status 2026-11-02: **prepared, not applied.** Nothing here has been installed on, pushed to or tested against a device. No device, setting, credential or server was changed. The target device's Android build, MX version and installed EHS version have **not been measured**; Zebra documentation versions below are the documentation reviewed, not device facts. Context and layering: `docs/DEVICE-PROVISIONING.md`.
|
||||
|
||||
Files: `deployment/company-profile/`
|
||||
|
||||
| File | Purpose |
|
||||
| --- | --- |
|
||||
| `profile.example.json` | Non-secret parameters. Unmeasured or unknown values are `null` or placeholders on purpose. |
|
||||
| `generate-company-profile.mjs` | Validates the profile and renders `enterprisehomescreen.xml`, `managed-configuration.json` (once the endpoint is real) and `stagenow-mx-appmgr.xml` (only when the device is measured). No dependencies. |
|
||||
| `generate-company-profile.test.mjs` | `node:test` cases for rendering, withholding and rejection. |
|
||||
| `DEVICE-OWNER-ENROLLMENT.md` | The separate, destructive enrollment path. Not generated. |
|
||||
|
||||
```text
|
||||
node deployment/company-profile/generate-company-profile.mjs my-profile.json out/ [--require-ready]
|
||||
node --test deployment/company-profile/
|
||||
```
|
||||
|
||||
Exit 1 on validation errors; 2 with `--require-ready` while any input is still missing. `out/profile-report.json` lists `missing` and `warnings`. One shared APK serves every customer: customer differences are only profile values (title, logo, wallpaper, app list), never a build.
|
||||
|
||||
## What the generated EHS file contains
|
||||
|
||||
Only tags from Zebra's EHS 8.0 Advanced Settings (`techdocs.zebra.com/ehs/latest/guide/settings/`): `kiosk`, `applications`, `tools`, `passwords`, and in `preferences` the `title` (static, or `<value>` with one documented device-ID token), `title_bar_icon` (`title_bar_icon_disabled`, `title_bar_icon_file`, `reuse_custom_icon`), icon label colours, `orientation`, `wallpaper`, `wallpaper_stretching_enabled`, the keyguard/USB/settings/recent-apps tags, `wireless_info` and `screen_blanking`. Tags not parameterised keep the values of Zebra's documented default file. Constraints enforced from that page: images only under `/enterprise/usr` (the persistent location), documented image formats, app labels of at most 18 characters, XML escaping, no wildcard packages (rejected for least privilege), no EHS self-listing.
|
||||
|
||||
Layout: EHS shows apps in listed order (links first when both exist). Arbitrary pixel placement is not a documented feature; folders are not in the pages reviewed and are not generated.
|
||||
|
||||
Explicit non-goals, enforced by the generator: `usb_debugging_disabled` is always `1`, `kiosk_mode_enabled` is always `0`, no `bypass keyguard`, `<passwords>` is always empty, `launcher.iconSize` is rejected (the Zebra snippet does not show where `user_options` sits).
|
||||
|
||||
## What the generated MX file contains
|
||||
|
||||
`AppMgr` characteristics only (`techdocs.zebra.com/mx/appmgr/`): optional `Install`/`Upgrade` of an APK already on the device, then `SetDefaultLauncher` for `com.zebra.mdna.enterprisehomescreen` (EHS setup page, `.../ehs/latest/guide/setup/`). Characteristic version `4.2` is the version used in Zebra's examples; `SetDefaultLauncher` is listed as MX 4.1+. **Not generated:** AccessMgr (allowlist and permission grants can lock out settings or break the scanner; Zebra's schema needs a device-specific review) and file delivery of the EHS XML and images to `/enterprise/usr` (Zebra recommends StageNow, DNA Cloud or an EMM for moving files; the StageNow file-delivery parameters were not in the cached pages, so they are not guessed).
|
||||
|
||||
## Hazards to review before any device
|
||||
|
||||
1. **EHS defaults disable USB debugging.** Zebra: `usb_debugging_disabled` 1 "or if left unspecified will prevent user access to the file system and all ADB functionality". Installing EHS on the current development TC22 will cut ADB. Use a spare device; Zebra advises restoring USB debugging before uninstalling EHS.
|
||||
2. **Pushing the XML overwrites the existing file**, including the stored admin password hash. Set the EHS admin password in Admin Mode on a reference device; never author it. Decide whether to deploy that device's exported file.
|
||||
3. **`system_settings_restricted` 1 (default) hides most Settings panels** and Zebra warns it might prevent some MX features. Confirm Bluetooth printer pairing and Wi-Fi workflows. The profile requires this value explicitly.
|
||||
4. **Default launcher:** EHS must be re-designated after any reinstall. Test Home/Back/recovery before relying on it.
|
||||
5. **MediaProjection consent is still per session** on Android 14; nothing here grants it.
|
||||
6. **Managed bootstrap is consumed by the app, but only through an EMM.** `managed-configuration.json` is a reviewable key/value payload for the EMM's Android managed-configuration (app restrictions) field; StageNow/MX and the EHS XML do not deliver it, and no Zebra schema is claimed for it. See "Managed configuration" below.
|
||||
|
||||
## Inputs still required (also in `profile-report.json`)
|
||||
|
||||
- Measured on the target TC22: `device.androidVersion`, `device.mxVersion`, `device.osBuild`; choose and record `ehs.installedVersion` for that firmware (docs reviewed: EHS 8.0).
|
||||
- Company logo and wallpaper image files, delivered to `/enterprise/usr/...`, and their paths.
|
||||
- Real company `qqq.endpoint` (HTTPS origin) and optional `qqq.orientation`; the EMM to push them as app restrictions.
|
||||
- Administrator list of permitted Android companion apps (camera/photo picker, printing) with exact package and activity names from the device.
|
||||
- On-device EHS APK path and the artifact delivery/checksum method; the QQQ APK path if the profile should also deploy it.
|
||||
- Decisions: `systemSettingsRestricted`, recent-apps values, `show IP` visibility, who sets the EHS admin password, EMM versus StageNow, and whether a device-owner fleet is wanted.
|
||||
|
||||
## Managed configuration (implemented in the shared APK)
|
||||
|
||||
The app declares `res/xml/app_restrictions.xml` (manifest `android.content.APP_RESTRICTIONS`) and reads it with `RestrictionsManager` (`ManagedConfiguration.kt`). Two keys, both optional; unmanaged installs behave exactly as before.
|
||||
|
||||
| Key | Values | Behaviour |
|
||||
| --- | --- | --- |
|
||||
| `qqq_server_url` | HTTPS origin only: no credentials, path, query or fragment; HTTP is rejected even in debug builds | No saved server: the connect form is prefilled with it and says the administrator configured it; the person still taps Connect. Different saved server: never switched silently. Settings shows a notice with "Use administrator's server", which runs the existing confirmed Change-server path (ends the session, logs out) and then shows the prefilled form. |
|
||||
| `qqq_orientation` | exactly `SYSTEM`, `PORTRAIT`, `LANDSCAPE`, `REVERSE_PORTRAIT`, `REVERSE_LANDSCAPE` | A bootstrap default applied when the managed value changes (last applied value is remembered); a later local choice stands until the administrator changes it again. Unknown values are rejected, not defaulted. |
|
||||
|
||||
Changes are re-read when the host resumes and while it is resumed (system `ACTION_APPLICATION_RESTRICTIONS_CHANGED`, not exported). Rejected keys are tracked by name only; values are never logged. No credentials, business metadata or branding are accepted this way. In the profile: `qqq.endpoint` and optional `qqq.orientation` produce `managed-configuration.json` (withheld while the endpoint is a placeholder). The EMM must be told to push those two keys as app restrictions for `io.qrun.mobile.scanner`.
|
||||
|
||||
## Dynamic status wallpaper (implemented, optional)
|
||||
|
||||
EHS has no QQQ-user or IP field (title tokens are device IDs only; Wireless Info shows the IP when `show_ip_address` is 1, exposed as `launcher.showIpAddress`), so the shared APK carries an optional native live wallpaper: `QqqStatusWallpaperService`, declared with the system-only `BIND_WALLPAPER` guard. It is inactive until a person picks it: Settings → "Status wallpaper…" opens Android's standard live-wallpaper chooser preselected to it. Nothing is applied silently; no new permission and no second app.
|
||||
|
||||
- **What it shows:** company brand name always (the server's public brand name/colour already used by the host, or the default). On the unlocked home screen only, also: signed-in display name, server host and the default network's IP (address and interface, via a network callback, no polling). Preview, lock screen, a locked keyguard, a missing keyguard service and lock-only wallpaper show the brand alone. Identity is withdrawn when the screen turns off or the wallpaper stops being visible.
|
||||
- **Freshness is not overstated.** The existing heartbeat runs only while the app is foreground. Shown while foreground: "Signed in: NAME". After the app leaves the screen: the name with "Last confirmed HH:mm (app in background)". After 15 minutes in the background the name is replaced by "Session unverified". States are UNKNOWN (new process, destroyed host), SIGNED_OUT and SIGNED_IN; the snapshot lives only in memory, so process death and server change return it to UNKNOWN, and logout, revocation and unauthorized responses clear the name. It holds no token, cookie, credential or session id and logs nothing.
|
||||
- **Limit:** a wallpaper is visible only where the launcher or a transparent window shows it. Whether EHS reveals it is unproven; EHS draws its own `<wallpaper>` image, so leave that empty when testing.
|
||||
|
||||
## Status of the implementation
|
||||
|
||||
| Item | Status |
|
||||
| --- | --- |
|
||||
| Wallpaper service, manifest/resources, managed configuration, settings entry, activity wiring | Compiled into the debug and E2E APKs built after the last source edit (2026-11-02 15:34). Not installed; not run on a device. |
|
||||
| JVM unit tests `WallpaperStatusTest` (13), `ManagedConfigurationTest` (8) | Pass in the host unit-test run after the last source edit. |
|
||||
| Generator tests for managed keys, URL and orientation | Seven generator tests pass (root run). |
|
||||
| Visibility behind EHS, lock-screen behaviour, keyguard/wake timing, Android 14 wallpaper flags on a TC22, EMM delivery of restrictions | **Untested on hardware.** |
|
||||
|
||||
APIs used that should be confirmed by the build and a device, because the SDK jar was not readable in this session: `WallpaperService.Engine.getWallpaperFlags()` (API 34, guarded), `KeyguardManager.isKeyguardLocked`, `ConnectivityManager.registerDefaultNetworkCallback` (API 24), `RestrictionsManager.getApplicationRestrictions`, `WallpaperManager.ACTION_CHANGE_LIVE_WALLPAPER` / `EXTRA_LIVE_WALLPAPER_COMPONENT`, `ContextCompat.registerReceiver` with `RECEIVER_NOT_EXPORTED` (core 1.13.1).
|
||||
|
||||
## Validation status
|
||||
|
||||
- Authored against the cached Zebra pages `qqq-zebra-docs-ehs-settings.md`, `-ehs-setup.md`, `-mx-appmgr.md` and `-mx-accessmgr.md` (untrusted reference content; facts above cite their official page).
|
||||
- Seven generator tests pass (`node --test deployment/company-profile/`), including managed keys, URL and orientation.
|
||||
- Nothing has been validated against Zebra's StageNow importer or a device.
|
||||
@@ -1,6 +1,6 @@
|
||||
# Company provisioning for Zebra handhelds
|
||||
|
||||
Research checked 2026-10-31. Target: Zebra TC22, Android 14, DataWedge 13.0.325, QQQ Mobile package `io.qrun.mobile.scanner`. This is a design recommendation, not an installed profile or a completed hardware qualification. No device configuration, enrollment, reset or runtime changes were made for this research. Production signing and distribution remain deferred.
|
||||
Research checked 2026-10-31. Target: Zebra TC22, Android 14, DataWedge 13.0.325, QQQ Mobile package `io.qrun.mobile.scanner`. This is a design recommendation, not an installed profile or a completed hardware qualification. No device configuration, enrollment, reset or runtime changes were made for this research. No company profile, EHS, OEMConfig or MDM configuration has been applied to or verified on any device, and no fleet rollout is claimed. The scanner application itself is current source; see [Implemented in the app](#implemented-in-the-app). The signed-APK/MDM channel is chosen but not rolled out ([RELEASING](RELEASING.md)).
|
||||
|
||||
## Recommended approach
|
||||
|
||||
@@ -71,14 +71,35 @@ These are design inputs, not a finalized XML schema or implemented managed-confi
|
||||
| Profile identity | Customer/profile ID, revision, target model/Android/MX range, rollout ring, rollback revision |
|
||||
| Device identity | Assigned short name, description, asset ID; explicitly map Android device name and QQQ device record |
|
||||
| Network/trust | Network-policy reference, certificate/credential delivery reference, proxy/DNS/time policy; no embedded passwords in repository fixtures |
|
||||
| Apps | Package IDs, approved version/channel, artifact reference/checksum, signing identity once decided, required companion activities |
|
||||
| Apps | Package IDs, approved version/channel, artifact reference/checksum, signing certificate fingerprint (see [RELEASING](RELEASING.md)), required companion activities |
|
||||
| Launcher | Title, logo/wallpaper asset references, ordered app list/folders, multi-app or kiosk policy, admin recovery reference |
|
||||
| Scanner | DataWedge profile association, expected intent/output contract, required decoders; preserve the verified QQQ scan transport |
|
||||
| App bootstrap | HTTPS QQQ server URL, tenant/branding discovery hints, supported configuration revision, optional orientation policy |
|
||||
| App bootstrap | HTTPS QQQ server URL (`qqq_server_url`) and optional orientation policy (`qqq_orientation`) are implemented; tenant/branding hints and a configuration revision are not |
|
||||
| Capabilities | Camera/location policy, diagnostics visibility, screen-sharing policy, required permission decisions; no blanket grants |
|
||||
| Operations | Update window, reporting/retention policy, support contact, rollback and recovery procedure references |
|
||||
|
||||
QQQ can support Android managed app configurations without customer-specific builds, but the app must declare and consume the configuration schema. Source inspection found no RestrictionsManager/app-restrictions declaration or wallpaper component in the current scanner host. This is proposed work. Managed settings should supply bootstrap/policy only; business screens and processes remain on the versioned QQQ semantic API. Reconcile admin-managed values with user preferences explicitly. [Android managed configurations](https://developer.android.com/work/managed-configurations).
|
||||
Managed settings supply bootstrap/policy only; business screens and processes remain on the versioned QQQ semantic API. Admin-managed values are reconciled with user preferences explicitly (see below). [Android managed configurations](https://developer.android.com/work/managed-configurations).
|
||||
|
||||
## Implemented in the app
|
||||
|
||||
The scanner host source now includes the pieces below. They are implemented and unit-tested; none has been delivered through an EMM/MDM or StageNow profile on a device.
|
||||
|
||||
**Managed configuration** ([`app_restrictions.xml`](../scanner-host/src/main/res/xml/app_restrictions.xml), declared in the manifest through `android.content.APP_RESTRICTIONS`; logic in [`ManagedConfiguration.kt`](../scanner-host/src/main/java/io/qrun/mobile/scanner/ManagedConfiguration.kt)). Exactly two keys:
|
||||
|
||||
| Key | Type | Behavior |
|
||||
| --- | --- | --- |
|
||||
| `qqq_server_url` | string | Must be an HTTPS origin with no credentials, path, query or fragment, at most 2048 characters; HTTP is never accepted, even in debug builds. With no saved server it prefills the connect form. A different saved server is never switched silently: Settings offers "Use administrator's server", which runs the existing confirm, end-session and sign-out path. |
|
||||
| `qqq_orientation` | choice | One of `SYSTEM`, `PORTRAIT`, `LANDSCAPE`, `REVERSE_PORTRAIT`, `REVERSE_LANDSCAPE`. Applied as a default only when the managed value changes; a later local choice stands until the managed value changes again. |
|
||||
|
||||
Invalid values are rejected, not defaulted, and only the key name is recorded. The keys must stay in step with the [company profile generator](../deployment/company-profile/) and [COMPANY-PROFILE](COMPANY-PROFILE.md).
|
||||
|
||||
**Optional status wallpaper** ([`QqqStatusWallpaperService.kt`](../scanner-host/src/main/java/io/qrun/mobile/scanner/QqqStatusWallpaperService.kt), with a Settings entry and preview). A live wallpaper service bound only by the system (`BIND_WALLPAPER`). It is inactive until a person confirms it in Android's live-wallpaper chooser; nothing is applied silently and no wallpaper permission is requested. It paints the company name and, only on the unlocked home screen, the approved session display name, the current network addresses and a time; the lock screen, preview, screen-off and invisible states show brand only. The snapshot is in memory only and withdrawn when it ages out. EHS compatibility with this wallpaper is unproven. Verified on a TC22 only as the brand-only system preview; it was never applied there.
|
||||
|
||||
## Current limits
|
||||
|
||||
- Whether a given EMM/OEMConfig can deliver these two restriction keys, and the EHS/StageNow/MDM profiles themselves, are unverified.
|
||||
- A static company wallpaper plus the in-app status remains the recommended first step; the live wallpaper is optional.
|
||||
- Device-owner enrollment, kiosk mode and rollout remain explicit future actions.
|
||||
|
||||
## Safe qualification and rollout
|
||||
|
||||
@@ -86,4 +107,4 @@ QQQ can support Android managed app configurations without customer-specific bui
|
||||
2. Produce a versioned, customer-parameterized profile with no repository secrets. Review settings and exclusions before generating installable artifacts. Keep development debugging available on a development-only profile.
|
||||
3. Test on a spare TC22 first: network/trust, installation, app approval, scan delivery, camera uploads, location behavior, Home/Back/menu/logout and orientation. Check reboot and network-change behavior, plus management connectivity loss.
|
||||
4. Verify restrictions and recovery together: app allowlist, settings access, permission denial, policy update, rollback and retained data. Test the dynamic status option separately, including logout/remote revocation, stale state and lock-screen visibility.
|
||||
5. After signing/distribution decisions, qualify signed upgrades and management deployment in a small pilot ring. Expand only after documented acceptance. Device-owner enrollment/reset and production kiosk activation remain explicit rollout actions, not part of this research.
|
||||
5. With the signed-APK/MDM channel chosen, qualify signed upgrades and management deployment in a small pilot ring. Expand only after documented acceptance. Device-owner enrollment/reset and production kiosk activation remain explicit rollout actions, not part of this research.
|
||||
@@ -1,6 +1,6 @@
|
||||
# Echo native UI acceptance fixture
|
||||
|
||||
The explicit Echo scenario exercises the real Android host, TABLE login, enrollment/approval, semantic printer/media choices, real Echo process and H2 persistence. Its test-only backend accepts **simulated** jobs. Passing it does not qualify EMDK, barcode rendering, printer adapters or physical output.
|
||||
The explicit Echo scenario exercises the real Android host, TABLE login, enrollment/approval, semantic printer/media/document choices, real Echo process and H2 persistence. Its test-only backend accepts **simulated** jobs. Passing it does not qualify EMDK, barcode rendering, printer adapters or physical output.
|
||||
|
||||
The backend owner supplies `com.kingsrook.examples.echo.fixture.EchoHttpFixture` from the isolated optional Echo test module, launched with a free loopback port, `ECHO_FIXTURE_TYPE=echo-ui-e2e` and private `ECHO_FIXTURE_SCANNER_PASSWORD`/`ECHO_FIXTURE_ADMIN_PASSWORD`. Readiness is `ECHO_UI_E2E_READY port=N simulatedPrinting=true`. It uses in-memory H2 and no real printing/generation adapter. Root owns launch, the exact private dependency tuple and approval of the concrete APK/fixture cohort.
|
||||
|
||||
@@ -33,10 +33,10 @@ Only after root launches the private fixture and approves the exact cohort:
|
||||
node scripts/ci/scanner-device-echo-e2e.mjs --serial TC22_SERIAL --fixture PRIVATE_ECHO_FIXTURE.json
|
||||
```
|
||||
|
||||
The native test signs in, enrolls and approves through existing helpers; opens Apps → Echo; selects `Simulated printer` / `Simulated 4 x 6 in — 300 dpi` once through the semantic possible-value controls; injects two public synthetic values with CODE128/QR types through the E2E-only driver; checks `Print queued` and absent manual controls; rotates/recreates without another acceptance; then uses Apps/Leave and verifies the run closes. Independent reads use standard QQQ `echoScan` and read-only `echoFixtureRun` queries as the scanner with approved-device headers, retaining the real actor/device locks. No custom business verification endpoint or administrator bypass is used.
|
||||
The native test signs in, enrolls and approves through existing helpers; opens Apps → Echo; selects the printer, media and an INTEGER Document through semantic possible-value controls, reselects the printer to verify stale dependent selections are cleared and Next is refused until reselection, then retains all three choices; injects two public synthetic values with CODE128/QR types through the E2E-only driver; checks `Print queued` and absent manual controls; rotates/recreates without another acceptance; then uses Apps/Leave and verifies the run closes. Independent reads use standard QQQ `echoScan` and read-only `echoFixtureRun` queries as the scanner with approved-device headers, retaining the real actor/device locks. No custom business verification endpoint or administrator bypass is used.
|
||||
|
||||
The existing OpenAPI proxy audits all observed requests and requires native cancellation. Fixed stage markers and operation IDs/counts, APK hashes and a simulation-labelled `echo-proof.json` are written under `scanner-host/build/native-device-e2e/`; credentials, serial and opaque identifiers are redacted from instrumentation output. No normal app data, global animation settings, DataWedge profile or existing forwarding is replaced. The runner removes only its own reverse and newly installed disposable packages; cleanup failures fail the run and its proof.
|
||||
|
||||
At preparation time, compilation and source/unit guards are the only authorized checks. Native/device acceptance remains pending until the explicit approved invocation completes; do not describe this fixture as physical printing evidence.
|
||||
The user-authorized TC22 invocation completed successfully after the bounded compilation/guards. This fixture remains simulated printing, not physical printing evidence.
|
||||
|
||||
Recorded acceptance: all5stages passed onTC22 with169JVMtests,8Nodeguards,zero-warninglint and86/86documentednative requests. Printing is simulated. The proof explicitly leaves physicalScannerQualified and physicalPrintingQualified false.
|
||||
Current recorded acceptance: all7 stages passed on TC22, including Document selection and stale selection clearing. Root verified99 focused/host JVM tests,8 Node guards, zero lint errors/warnings, and112/112 documented native requests. Printing is simulated. The proof explicitly leaves physicalScannerQualified and physicalPrintingQualified false.
|
||||
@@ -0,0 +1,19 @@
|
||||
# Finish ledger for 1.0
|
||||
|
||||
As of 2026-11-04. This is not a release and no 1.0 is published. Older ledgers are in [docs/history](history/README.md); the checklist is [TODO](TODO.md).
|
||||
|
||||
| Area | State | Evidence / limit |
|
||||
| --- | --- | --- |
|
||||
| Source | Merged to protected `main` | Application source for the tested APKs; Gitea workflow present |
|
||||
| Local demo | Accepted | Server on port 57832; TC22 development APK; operator-reported manual acceptance ALL PASS 2026-11-04 incl. label count/fidelity, camera, GPS, screen viewing (not instrumented, no per-case artifacts) |
|
||||
| Echo | Local semantic flow qualified | Printing and inputs simulated in disposable runs; physical label count/fidelity operator-reported pass (not instrumented) |
|
||||
| MC9400 | Demo-configured and approved | Physical trigger scan to backend not yet verified |
|
||||
| Signed APK | Built and verified locally, not distributed | 1.0.0 / versionCode 2; installed and launched once on an MC9400 before the demo switch; no end-to-end qualification |
|
||||
| Release | Not done | Needs HTTPS server, device qualification and distribution; no tag, no publication, no signing CI |
|
||||
| Authentik | Desktop passes; on-device callback unverified | No separate native provider/callback evidence |
|
||||
| Dependencies | Qualified inputs, not a public cohort | Generation, Record Files, Scripting owner inputs behind the local server |
|
||||
| MDM / company profile | Prepared, unverified | Nothing applied on a device |
|
||||
|
||||
## Pointers
|
||||
|
||||
Release procedure and key custody (no secrets): [RELEASING](RELEASING.md). Installation: [INSTALLATION](INSTALLATION.md). Authentik: [REAL-AUTHENTIK-ACCEPTANCE](REAL-AUTHENTIK-ACCEPTANCE.md). Physical scanner evidence: [PHYSICAL-TC22-ACCEPTANCE](PHYSICAL-TC22-ACCEPTANCE.md).
|
||||
@@ -0,0 +1,72 @@
|
||||
# Installing QQQ Mobile directly
|
||||
|
||||
Use this for the **production-signed** APK on a small number of devices. Move to MDM later (see [RELEASING](RELEASING.md)). Automated scanner-APK signing/publication is not configured; that is not a blocker to direct installation.
|
||||
|
||||
This guide is not the local demo. The demo uses the development-signed debug APK, plain HTTP and `adb reverse` port forwarding to a workstation server; see [README](../README.md#installing-on-a-device). The two builds have different signers and cannot update each other.
|
||||
|
||||
| Item | Value |
|
||||
| --- | --- |
|
||||
| File | `QQQ-Mobile-1.0.0.apk` (locally signed) |
|
||||
| Application ID | `io.qrun.mobile.scanner` |
|
||||
| Version | 1.0.0, versionCode 2 |
|
||||
| APK SHA-256 | `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51` |
|
||||
|
||||
The same APK is used for every customer; branding comes from the server at runtime. Compare the SHA-256 before installing. The checksum shows the file is intact, not who signed it.
|
||||
|
||||
This APK was installed and launched once on a fresh Zebra MC9400 (Android 13): install succeeded, the Connect screen appeared and the installed bytes matched the hash above. It has **not** been enrolled, scanned or navigated, because no HTTPS server was available, so these steps are not hardware-qualified until the first install is confirmed (below). That MC9400 now runs the development demo build instead.
|
||||
|
||||
## Before you start
|
||||
|
||||
- The device is connected to Wi-Fi.
|
||||
- You have an **HTTPS** QQQ server URL the device can reach. Release builds reject HTTP. The server is not chosen yet: use the address you are given, and do not guess one.
|
||||
- You have the QQQ credentials for the sign-in the server offers. None are in this guide.
|
||||
|
||||
## Install: copy the file (recommended)
|
||||
|
||||
1. Copy `QQQ-Mobile-1.0.0.apk` to the device's **Downloads** folder.
|
||||
2. Open **Files**, go to Downloads, and tap the APK.
|
||||
3. If Android asks, allow that Files app to install apps, then continue. You can turn the permission off again afterward.
|
||||
|
||||
## Install: USB debugging (alternative)
|
||||
|
||||
Requires USB debugging enabled on the device, a computer the device has been asked to trust, and [Android Platform Tools](https://developer.android.com/tools/adb).
|
||||
|
||||
```powershell
|
||||
adb devices
|
||||
adb -s DEVICE_SERIAL install -r QQQ-Mobile-1.0.0.apk
|
||||
```
|
||||
|
||||
Replace `DEVICE_SERIAL` with the serial of the device you chose from `adb devices`. Always name the target with `-s`. Do not add `-d` (downgrade) or `-t`.
|
||||
|
||||
## First launch and enrollment
|
||||
|
||||
1. Open **QQQ Mobile** and enter the HTTPS server URL, then tap **Connect**.
|
||||
2. Sign in with the method the server shows.
|
||||
3. The device enrolls and shows a **Device ID** with status pending.
|
||||
4. A QQQ administrator reviews the device, sets its name and approves it in QQQ.
|
||||
5. On the device, tap **Check approval**, then open the server's apps (**Apps**).
|
||||
|
||||
Grant location when Android asks; scanning works without it. Zebra devices with EMDK need no DataWedge profile set up by hand ([Zebra scanning](ZEBRA-SCANNING.md)).
|
||||
|
||||
## Confirm the first new install
|
||||
|
||||
On the first device only, check each of these:
|
||||
|
||||
- The footer shows **Connected**.
|
||||
- One scan is captured and the server keeps it (**Saved scan**).
|
||||
- Navigation to **Apps** and back works.
|
||||
- Echo: choose the printer, document and copies once. The server does the printing.
|
||||
|
||||
Printer clients belong on the server side. No printer driver goes on the scanner.
|
||||
|
||||
## Updates
|
||||
|
||||
For a later build signed by the same key with a higher versionCode, run the same `adb -s DEVICE_SERIAL install -r QQQ-Mobile-<version>.apk` command. Data is preserved.
|
||||
|
||||
## Devices running the development-signed build
|
||||
|
||||
Devices running the development-signed demo build (the TC22, and the MC9400 in demo mode) cannot be updated by this APK, because the signer differs. Android is expected to refuse the install. This is not a fault: do not uninstall the app or reset the device to get around it. Moving that device needs a planned one-time migration that includes re-enrollment.
|
||||
|
||||
## References
|
||||
|
||||
- Android Debug Bridge, [installing and updating apps](https://developer.android.com/tools/adb#move) and [enabling USB debugging](https://developer.android.com/tools/adb#Enabling): <https://developer.android.com/tools/adb>
|
||||
@@ -17,7 +17,7 @@ Every screen provides one **hamburger navigation drawer**, a clear current app/p
|
||||
| Diagnostics | Server reachability details, recent safe logs, retry/check connection and app/version information. Reachable from the connection footer and secondary menu. |
|
||||
| Administration | Approval and fleet management remain in QQQ administration. A handheld pending approval shows its short name and administrator instructions. |
|
||||
|
||||
The default-on foreground location reporting toggle, permission recovery and actual provider/fix status belong under device settings. Android location permission is requested once when an approved signed-in session first becomes foreground with reporting enabled; denial leaves scanning usable. Camera permission is requested when the operator chooses Take photo. A live viewing indicator and Stop viewing control remain visible while an administrator is viewing the app; they are not hidden in settings.
|
||||
The default-on foreground location reporting toggle, permission recovery and actual provider/fix status belong under device settings. Android location permission is requested once when an approved signed-in session first becomes foreground with reporting enabled; denial leaves scanning usable. Camera permission is requested when the operator chooses Take photo. A live viewing indicator remains visible while an administrator is viewing the app. The app provides no pause or stop viewing control, including in Settings; Android's system consent and stop controls remain available for optional whole-device sharing.
|
||||
|
||||
The owner also requires a device-local Orientation preference in Settings: System default, Portrait, Landscape, Reverse portrait and Reverse landscape. Persist the selection across app restarts and apply it across login, menus and processes. Use Android's activity orientation policy without changing system-wide rotation settings. Rotation or a policy change must preserve drafts and pending upload identity. Licenses belong in the same secondary Settings layer and must remain readable offline.
|
||||
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
# Real Authentik native acceptance (opt-in, physical TC22)
|
||||
|
||||
This is the only test that runs the Android OAuth2 callback against a real provider. It is skipped by default
|
||||
(`RealAuthentikAcceptanceTest` needs `-e realAuthentik true`) and is never part of the synthetic E2E scenarios.
|
||||
Until it passes on the device, [AUTHENTICATION.md](AUTHENTICATION.md) makes no claim of an Android Authentik round trip.
|
||||
|
||||
## What it exercises
|
||||
|
||||
The unmodified flow: `oauth2.signIn` -> real AppAuth external browser -> the real provider -> the exported
|
||||
`OAuth2RedirectActivity` (`io.qrun.mobile.scanner.e2e.oauth://callback/oauth2redirect`) -> the real QQQ code exchange ->
|
||||
device pending -> real administrator approval (`mobileDeviceApprove`) -> catalog; then operator A's **Sign out of company**
|
||||
(RP-initiated, through the browser) and a fresh login of operator B without clearing any browser state. It asserts the
|
||||
principal QQQ shows (`Current User: ...`), exactly one ACTIVE session for the device, A's session no longer ACTIVE, B's
|
||||
different, an optional exact server actor, and that no password form is ever offered. It injects no callback, ActivityResult,
|
||||
token or discovery document.
|
||||
|
||||
## Trust and transport
|
||||
|
||||
- `scanner-host/src/e2e/res/xml/network_security_config.xml` (E2E package only) keeps system trust and the existing cleartext
|
||||
`127.0.0.1` fixture traffic, and additionally lets the literal host `localhost` trust a **user-installed** CA over HTTPS only.
|
||||
Nothing is pinned or bypassed; debug, qa and release builds are unchanged.
|
||||
- The temporary fixture CA must be installed by the person holding the device, through Android settings (a screen lock/PIN is
|
||||
required), and removed afterwards. Neither this test nor the launcher installs, probes or changes trust. The browser must
|
||||
also trust that CA, otherwise it shows a certificate warning: do not continue past it.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
The provider fixture and QQQ are running (QQQ `https://localhost:18443`, Authentik `https://localhost:19443`) with the exact E2E
|
||||
callback registered for login and post-logout; a physical TC22 with `ANDROID_SERIAL` set only in the environment, unlocked and
|
||||
awake; the disposable packages absent; and a private config file **outside the repository** (it holds a live administrator
|
||||
session cookie):
|
||||
|
||||
```json
|
||||
{
|
||||
"fixtureType": "real-authentik-android",
|
||||
"qqqOrigin": "https://localhost:18443",
|
||||
"adminCookie": "<Cookie header value of an admin QQQ session; never printed>",
|
||||
"operators": {
|
||||
"A": { "display": "<exact Current User text for the first operator>", "actor": "<optional server actor value>" },
|
||||
"B": { "display": "<exact Current User text for the second operator>", "actor": "<optional server actor value>" }
|
||||
},
|
||||
"sessionActorField": "<optional mobileSession column holding the actor; omit to skip>"
|
||||
}
|
||||
```
|
||||
|
||||
## Run
|
||||
|
||||
```text
|
||||
./gradlew :scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest
|
||||
node scripts/ci/real-authentik-android.mjs --config <private-config.json> --confirm-temporary-ca-installed
|
||||
node --test scripts/ci/real-authentik-android.test.mjs # guard tests, no device needed
|
||||
```
|
||||
|
||||
The launcher refuses emulators and any device that is not a Zebra TC22, refuses a config inside the checkout or with a different
|
||||
origin, and refuses if `io.qrun.mobile.scanner.e2e` or its `.test` package already exists (it never uses `install -r`). It adds
|
||||
`adb reverse` for `tcp:18443` and `tcp:19443` only when absent (never rebinding; a differing existing mapping is an error),
|
||||
never touches `tcp:8080` or any other mapping, never reads or changes the normal `io.qrun.mobile.scanner` package or its data,
|
||||
pushes the config through `run-as` stdin (never to shared storage), and afterwards removes only the pushed file, the two
|
||||
disposable packages and the reverse mappings it created. Output is fixed stage text and a PASS/failure sentence: no serial, URL,
|
||||
cookie, token or credential. The operator types provider credentials in the browser when an `ACTION:` line appears (bounds: 45 s
|
||||
for the browser to appear, 600 s per login, 300 s for company logout, 40 min total).
|
||||
|
||||
## Limits
|
||||
|
||||
No browser automation is included, so the operator enters credentials. The test cannot verify CA installation; a missing CA
|
||||
shows up as the browser never opening within the bound. Process death during the browser step loses the in-memory attempt by
|
||||
design; rerun. A pass proves this provider/server/package combination only; it is not production-provider, release-build or
|
||||
EMDK trigger qualification.
|
||||
+38
-25
@@ -1,43 +1,56 @@
|
||||
# Scanner APK releases
|
||||
# Scanner APK release readiness
|
||||
|
||||
Status: release automation is prepared, but the signing identity, complete native acceptance, final security review and first release are not yet qualified. Current installed demo APKs use a development certificate. Do not label them production releases.
|
||||
Status (November 4, 2026): **a QRun-owned production signing key exists with a verified backup, and a locally signed, verified 1.0.0 (versionCode 2) APK exists. It was installed and launched once on a fresh MC9400, but it has not been qualified end to end, distributed or published, and no release exists.** The owner selected direct signed-APK / MDM distribution. Current local demo devices (TC22 and, by the user's later choice, the MC9400) run the development-signed debug APK (0.1.0, versionCode 1) against the local HTTP server; that is not a production release. Manual TC22 acceptance was reported all-pass by the operator on November 4 (operator report, no per-case artifacts) for the development-signed build; it does not qualify the production signer and is not requested again for that build.
|
||||
|
||||
The [November 1 independent automation review](RELEASE-AUTOMATION-REVIEW.md) found no actionable finding in the exact reviewed workflow/build files. External GitHub protections, the production identity and actual signed-device acceptance remain unverified.
|
||||
## Decisions (made)
|
||||
|
||||
Owner decision, October 31: leave signing and distribution until the final step because the distribution channel has not been chosen. Do not generate signing keys, populate production signing secrets, create release tags or treat the candidate GitHub APK workflow as a selected distribution channel. Complete implementation, audits, tests, documentation and ordinary CI first; then return to the owner for the distribution decision.
|
||||
- **Channel:** signed APK distributed directly / through MDM. Google Play is not part of this channel, and no purchased or public-CA certificate is required.
|
||||
- **Key:** a new QRun-owned Android signing key, organization identity QRunIO, application ID `io.qrun.mobile.scanner`. Alias `qqq-mobile-release`, PKCS12, RSA 4096, valid through 2056-10-27.
|
||||
- **Certificate SHA-256:** `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF`. This is the fingerprint every distributed APK must show.
|
||||
- **Storage and backup:** the keystore and its credentials are stored as a keystore Document (QQQ Mobile Android release keystore) and a Password item (QQQ Mobile Android release signing credentials) in the owner's Personal 1Password account, vault `QRun`. Recovery was verified on 2026-11-04: both items were recovered from the vault, the recovered file's SHA-256 matched, and the recovered keystore opened with a certificate matching the one above. Keys, passwords, item IDs and local private paths never belong in this repository.
|
||||
- **Signing path:** build an unsigned APK, then sign it in isolation with `apksigner`, so the key is not passed to the application build. The Gradle environment-variable signing below remains supported but is not the selected local path.
|
||||
- **CI:** no signing secrets or CI signing activation exist. Shared CI/CD redesign is owned elsewhere; no scanner-APK Gitea release workflow exists and none is being added here. Automated scanner-APK signing/publication is not configured and is not needed for direct installation or the local demo.
|
||||
- **Direct install:** see the [installation guide](INSTALLATION.md). Local signing and manual distribution do not depend on the shared CI work.
|
||||
|
||||
The shared library keeps its existing main-only CircleCI publication. The scanner application uses a separate `scanner-v<semantic-version>` tag and GitHub release. One APK serves customers through the selected server's runtime branding. The application ID and launcher identity remain `io.qrun.mobile.scanner` / QQQ Mobile.
|
||||
## What exists today
|
||||
|
||||
## Release prerequisites
|
||||
- **Gitea CI (actual).** `.gitea/workflows/qrun-android-release.yaml` is in the repository, runs on push to `main` (and manual dispatch) and calls the central `KofTwentyTwo/platform-ci` Android workflow at `qrun-release-v1`. A central main run (3634) passed and published the SDK AARs. It is **not** a scanner-APK signing or release pipeline: it uses no scanner signing secrets and produces no production-signed scanner APK.
|
||||
- **Gradle signing (supported, not selected).** `scanner-host/build.gradle.kts` reads four environment variables: `SCANNER_KEYSTORE`, `SCANNER_STORE_PASSWORD`, `SCANNER_KEY_ALIAS`, `SCANNER_KEY_PASSWORD`.
|
||||
- All four set: the `release` build type is signed with them.
|
||||
- None set: `assembleRelease` produces an **unsigned** APK, which is what the isolated signing step consumes.
|
||||
- Some but not all set: the build fails immediately.
|
||||
- Debug, `e2e` and `qa` builds keep the development debug signing.
|
||||
- Version comes from `-PscannerVersionName` (semantic version, default `0.1.0`) and `-PscannerVersionCode` (1 to 2100000000, default `1`).
|
||||
- **Identity.** One APK serves all customers; branding is applied at runtime from the selected server's metadata, so no per-customer key or build is needed.
|
||||
- **Legacy GitHub workflows (historical only).** `.github/workflows/release-scanner.yml` and `scanner.yml` predate Gitea as primary forge. They are not a release path; do not run or follow them. The [November 1 review](RELEASE-AUTOMATION-REVIEW.md) covered those files only.
|
||||
|
||||
- Merge only after the exact source passes the shared library, host, real-server native and companion browser tests, plus the independent security review. Update the immutable companion-server revision in `scanner.yml` to the qualified server commit first.
|
||||
- Complete the navigation and physical TC22 acceptance matrix, camera/Record Files integration qualification, dependency attribution and production HTTPS/authentication/storage checks documented in the project TODO and companion readiness report.
|
||||
- Establish an organization-owned release keystore and backed-up recovery process outside Git. Keep that signing identity for upgrades. Configure the `scanner-release` GitHub environment before adding secrets: restrict deployment tags to `scanner-v*`, protect release-tag creation/update/deletion with repository rules, and limit authorized release maintainers. Store `SCANNER_KEYSTORE_BASE64`, `SCANNER_STORE_PASSWORD`, `SCANNER_KEY_ALIAS`, and `SCANNER_KEY_PASSWORD` in that environment, not repository-wide secrets. A workflow environment declaration alone does not create these protection policies; actual GitHub configuration must be reviewed before loading production keys. Never place secrets in Gradle properties committed to source or pass passwords on the command line.
|
||||
- Set repository variable `SCANNER_CERTIFICATE_SHA256` to the intended certificate's SHA-256 digest, 64 hex characters without separators. The build compares the resulting APK signer to this independently configured public fingerprint.
|
||||
- Set repository variable `SCANNER_VERSION_CODE` to a positive integer greater than every previously distributed scanner version code. Android's maximum is 2100000000. Release workflows are serialized across tags and compare the selected code with every published `scanner-v*` release's `BUILD.txt`, including prereleases. Missing or malformed prior build evidence fails closed. Account for any APK distributed outside GitHub manually as well; changing the display version alone is insufficient.
|
||||
## First release: 1.0.0 (versionCode 2)
|
||||
|
||||
## Build and publication
|
||||
Version `1.0.0`, `versionCode` 2 was built unsigned (`lintRelease` and `assembleRelease`: 0 errors, 0 warnings, 2 information) from source matching protected `main` `0ae2101f082c241ca6a70462dc9ec3057aa6c906`; only documentation differs. It was then signed in isolation with `apksigner` on 2026-11-04 (16:22:05 UTC).
|
||||
|
||||
Create the immutable `scanner-v1.0.0` tag only after the prerequisites pass. Use a prerelease suffix for a qualified release candidate, for example `scanner-v1.0.0-rc.1`. Do not move a published tag or replace released APK bytes.
|
||||
**Signed artifact (local, complete):** `QQQ-Mobile-1.0.0.apk`, application ID `io.qrun.mobile.scanner`, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`. Verification passed: signature schemes v2 and v3, exactly one signer whose certificate SHA-256 is `BDDB2D2F...5B17A9FF` (the fingerprint above), 16 KiB alignment, non-debuggable. The checksum shows integrity only, not signer correctness. The APK is not published or distributed and is kept outside this repository.
|
||||
|
||||
Push one release tag at a time and wait for its workflow to finish. GitHub's default concurrency group serializes execution but retains only one pending run; it is not a durable multi-release queue. The workflow reuses the validated version code during signing and rechecks the remote tag's commit immediately before publication. Immutable tag protection remains necessary to close concurrent tag-change races.
|
||||
**Device evidence (MC9400, November 4):** the signed APK was installed on a fresh MC9400 (Android 13, EMDK present), launched without a startup crash, showed the Connect screen, and its installed bytes read back with the exact hash above. It was not enrolled: release builds require HTTPS and the only server available was the local HTTP demo. The same key and signer are unchanged. The user then chose to run the MC9400 in demo mode like the TC22, so that fresh, unenrolled production install was replaced with the development debug APK and port forwarding to the local server. No signed-build enrollment, scan or navigation was tested. The TC22 and its data were untouched throughout.
|
||||
|
||||
The tag workflow first calls the existing scanner verification workflow, including native emulator and real-server tests. Before signing, it verifies the tag's commit is an ancestor of protected `main` and enforces the increasing version code. It then builds a non-debuggable release APK, runs release lint, verifies its signature against the expected certificate, verifies package/version metadata and writes checksums and the source commit. Only the final publication job receives repository write permission. A failed verification or absent signing configuration prevents publication. The temporary keystore is removed at the end of the signing step. Signing passwords stay in masked environment variables and never become workflow outputs or artifacts. Repository/environment protection is essential because a maintainer able to change trusted workflow code could otherwise remove its in-workflow checks.
|
||||
Remaining steps:
|
||||
|
||||
The candidate APK release contains `qqq-mobile-<version>.apk`, `SHA256SUMS`, `signature.txt`, `BUILD.txt`, `aboutlibraries.json`, `LICENSE` and `NOTICE`. The notices are generated from the release runtime and also packaged for offline access in Settings. Download and verify these assets, then qualify the actual signed bytes on a device before customer rollout. Checksums establish artifact integrity; they do not replace signer verification or functional acceptance. Signing/distribution remains deferred by the owner until the final step.
|
||||
1. Qualify the **actual production-signed APK** on a device: install, enrollment, scanner path ([Zebra scanning](ZEBRA-SCANNING.md)), Back/Apps navigation, and update over a prior production build. Use a planned device migration or a spare device; do not use a demo device implicitly, and note that moving a demo device to the signed build removes its development install and enrollment.
|
||||
2. Provide an **HTTPS** server. Source release builds disallow cleartext; HTTP is limited to debug builds. The local demo does not need HTTPS.
|
||||
3. Use the first direct installation to confirm the device flow, then distribute the same APK to the remaining devices. MDM can be introduced later.
|
||||
4. Automated scanner-APK signing/release workflow is not configured and is separate from manual distribution; create no tags or releases without current authorization.
|
||||
|
||||
For local release builds, supply the four `SCANNER_*` signing environment variables (use `SCANNER_KEYSTORE` for the local keystore path, not the CI-only base64 variable), then run:
|
||||
## Release requirements
|
||||
|
||||
```text
|
||||
./gradlew :scanner-host:lintRelease :scanner-host:assembleRelease -PscannerVersionName=1.0.0-rc.1 -PscannerVersionCode=2
|
||||
```
|
||||
- Keep this signer and a strictly increasing `versionCode` for every distributed build, including builds distributed outside CI.
|
||||
- Never put passwords or keystores in Git, command lines, logs or committed Gradle properties. Recover them from the vault only for the signing step and remove temporary keystore copies afterward.
|
||||
- Lint and build the release variant: `./gradlew :scanner-host:lintRelease :scanner-host:assembleRelease -PscannerVersionName=<semver> -PscannerVersionCode=<increasing integer>`, with no signing variables set for the isolated path.
|
||||
|
||||
Without signing variables, local release assembly produces an unsigned APK for inspection. Partial signing configuration fails immediately. Debug/E2E builds retain their existing development signing and default version unless explicitly overridden. Unsigned and debug APKs must not be distributed as production releases.
|
||||
## Updates, compatibility and recovery
|
||||
|
||||
## Upgrade and Zebra rollout
|
||||
Android updates in place only when the signer matches and `versionCode` does not decrease. Losing this key, or its backup, means installed copies can no longer be updated in place; they would have to be uninstalled and reinstalled, which removes enrollment and session state. Keep the vault backup recoverable and re-verify it (hash, open, certificate comparison) after any change to it.
|
||||
|
||||
Android accepts an in-place application update only with a compatible signing identity and version code. The existing development-signed TC22 installation cannot simply be replaced by an unrelated production certificate. Preserve its test evidence and explicitly plan that migration: reinstalling removes private enrollment/session state and requires enrollment/approval again. Do not silently uninstall the operator's application to make a release install work.
|
||||
Development-signed demo installations (TC22, and the MC9400 in demo mode) cannot be upgraded by the production key. Moving one requires an explicit migration: preserve its test evidence, plan re-enrollment, and never uninstall or reset a device or application implicitly. No update or key-rotation policy beyond keeping this one permanent signer is defined here.
|
||||
|
||||
For Zebra devices, qualify the device-provided EMDK scanner path described in [Zebra scanning](ZEBRA-SCANNING.md). Production must exclude the synthetic scan receiver and compile-only SDK implementation. Verify actual trigger capture, repeated and empty reads, rotation/reacquisition, background/leave/logout release, and restoration of scanner ownership to other applications. The production path requires no DataWedge profile changes; do not persistently disable DataWedge or treat its recipient signature check as sender authentication. Complete the separately signed ordinary-UID broadcast rejection test against the isolated production-path QA build, then qualify Back/Apps navigation, session termination, reconnect behavior and photo capture using the actual signed release APK. Subsequent customer updates should preserve server selection and device enrollment and keep the same signing identity. Customer branding comes from server metadata and does not require rebuilding the APK.
|
||||
## Not yet established
|
||||
|
||||
GitHub APK delivery supports manual or MDM distribution. Play distribution, managed enterprise rollout, signing-key rotation and a production backend deployment need their own qualified configuration; this workflow does not claim to establish them.
|
||||
Production-signed-APK device qualification, first distribution, an HTTPS production server, an automated scanner release workflow and its secret handling, and key-rotation planning. SDK publication by the central workflow is done and its completed audits are not reopened here. Other pending items are in [TODO](TODO.md).
|
||||
+25
-227
@@ -1,238 +1,36 @@
|
||||
## November 1 — Echo native semantic choices verified on TC22
|
||||
# Current status
|
||||
|
||||
Claude implemented named process possible values using the actual published `searchProcessPossibleValues` JSON contract, dependent-field metadata, cancellation/error/retry and stale-response rejection. The unchanged Echo fixture now completes login, enrollment/approval, printer/media selection once, two accepted synthetic scans, rotation/recreation without duplicates, and Apps/Leave closing the run on the real TC22. All86observed requests matched published semantic operations. Disposable-package cleanup passed; normal package/data and real printers were preserved.
|
||||
As of 2026-11-04. Scope: the scanner host and the local Echo workflow only. This is the authoritative current view; earlier rolling notes are historical and kept in [docs/history](history/README.md). Nothing here claims a finished or released 1.0. Checklist: [TODO](TODO.md). Ledger: [FINISH-1.0](FINISH-1.0.md).
|
||||
|
||||
Validation:169JVMtests,8Nodeguards,236-file source standards, zero lint errors/warnings and bothE2EAPKs pass. This is simulated printing, not EMDK or physical output qualification. The remaining immediate blocker is the real Generation/Printing adapter and template/host composition, followed by physical print/rescan. Normal installed APK remains625a275; normal server API1.9/mobile1.1. Production signing remains deferred.
|
||||
# Session state
|
||||
## Source
|
||||
|
||||
## Echo semantic presentation source checkpoint
|
||||
- Protected `main` contains all application work (PR 8 and PR 10 merged). Application source is unchanged by the documentation and signing work after that merge.
|
||||
- The Gitea workflow `.gitea/workflows/qrun-android-release.yaml` exists on `main`; it calls the shared platform Android workflow and is not a scanner-APK release pipeline (see [RELEASING](RELEASING.md)).
|
||||
- Documentation is published separately (signing guide and this reconciliation). Shared CI/CD redesign is outside this repository's local use and does not gate the demo.
|
||||
|
||||
The optional extension 1.4 acknowledgmentLabel and manualEntryEnabled hints are published on feature/echo-scanner-presentation (draft PR9). Existing defaults remain Saved scan/manual enabled; Echo uses Print queued/manual disabled. Strict compilation, 167 JVM cases, lint zero errors/warnings and debug assembly pass. Hardware, lifecycle and receipt predicates are unchanged. The server companion passes 69 consumer cases plus two contract cases; the optional Echo module passes 15 strict QQQ/H2 tests.
|
||||
## Local demo: accepted
|
||||
|
||||
The normal TC22 remains the separately installed 625a275 build (APK AF13778A…3E9216), preserving sign-in/data. Its About screen was opened and Query artwork, both public links and licenses verified through filtered accessibility data. New Echo-native UI/actual owner adapters/physical printing remain unqualified; printing and document/scripting owners have acknowledged their implementation lanes. The running normal server remains API1.9/mobile1.1. Production signing/distribution stays the owner's final step.
|
||||
- Local server on the workstation (port 57832): public QQQ 4.1.0-RC.21 plus released Printing 1.0 and qualified document, files and scripting owner inputs. UI API 1.10, mobile-scanners 1.5, printing 2.3, mobile-record-files 1.0.
|
||||
- TC22 runs the development-signed debug APK (version 0.1.0, versionCode 1, SHA-256 `38A11155BF6A9C089A1EE6D9E44401E8FF39497B7150B51A85F1F916148BE60D`), reaching the server through device port 8080 forwarded to the workstation.
|
||||
- The operator reported the outstanding manual TC22 acceptance group ALL PASS on 2026-11-04, including label count/fidelity, camera and GPS, and screen viewing. This is operator-reported acceptance, not instrumented or per-case evidence; no per-case artifacts are recorded and the checks are not requested again.
|
||||
- Desktop-browser Authentik acceptance passed with strict TLS (nonce rejection, login, company logout, fresh second operator).
|
||||
|
||||
## November 1 standards fixes and About update
|
||||
## MC9400 (second device)
|
||||
|
||||
Applied the scoped standards review: copyright/SPDX, explicit imports, declaration headers, native official/three-space formatter profile, mechanical CI source gate and Kotlin warnings-as-errors. Strict compilation and163 JVM tests pass; all46 disposable sample native tests pass on TC22, and production QA instrumentation compiles. The native suite uses fixture providers; actual Android external-browser/provider acceptance remains separate. The existing formatter reports one unstable Gradle script and full formatter CI runner provisioning remains explicit in the review.
|
||||
- A production-signed 1.0.0 (versionCode 2) APK was installed on a fresh MC9400 (Android 13, EMDK present) and launched; installed bytes matched the signed APK hash. No fatal crash at startup.
|
||||
- At the user's request the MC9400 now runs the same development APK as the TC22 in demo mode, with device port 8080 forwarded to the workstation server over paired wireless ADB. It signed in and was approved through the ordinary mobile device approval process (status APPROVED).
|
||||
- **Remaining check:** a physical MC9400 trigger scan confirmed in the backend. Not yet verified; no scan claim is made.
|
||||
|
||||
Settings → About QQQ Mobile now shows bundled Query artwork, app version, Dogfooding/Query public links and open-source licenses. The normal APK rebuild uses drawable-nodpi for the artwork. No credential/device parameters are added to website links. The preceding diagnostics/default-on GPS update remains installed until the preserving update recorded below; actual GPS fix is still open.
|
||||
## Signed release
|
||||
|
||||
The real API1.10 Authentik desktop sequence now passes negative nonce rejection, A login, explicit company logout, old-cookie rejection, fresh B credentials/principal in the same retained browser context, and B local logout. Its provider-specific User Logout flow is required for company sign-out; default ordinary client logout stays local. Server0b53f34 is published and all8hosted checks pass. CorePR1369's exact architecture allow-list correction is being verified; full fresh core CI is not yet green.
|
||||
- Direct signed-APK / MDM distribution was chosen. A QRun-owned key exists (alias `qqq-mobile-release`, certificate SHA-256 `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF`) with a verified backup. Key, passwords and vault details are not in this repository.
|
||||
- Signed `QQQ-Mobile-1.0.0.apk` (versionCode 2, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`) exists locally, built from `main` application source: lint 0 errors/0 warnings, v2/v3 signature with the exact certificate, alignment and non-debuggable verified.
|
||||
- It is **not** published, tagged or distributed, and no production release exists. No automatic signing CI is configured. The signed artifact is kept outside the repository.
|
||||
- Production qualification needs an HTTPS server and a full device pass of the signed build ([RELEASING](RELEASING.md), [INSTALLATION](INSTALLATION.md)). The local demo does not need HTTPS; release builds reject HTTP.
|
||||
|
||||
## November 1 diagnostics and location update
|
||||
## Open (not claimed)
|
||||
|
||||
Diagnostics now uses a full-screen, scrollable native view with a connection summary, local-time newest-first activity, All/Problems filters, pause/resume, copy/share/clear and Back. Existing footer and menu entry points still block process input while diagnostics is open. Location reporting defaults on for approved signed-in foreground sessions; Android grants remain required, explicit opt-out persists and automatic permission requests are not repeated after denial. Controls remain under Settings → Device permissions.
|
||||
|
||||
The combined client passes 159 JVM tests, zero-error/zero-warning debug lint, normal/E2E APK builds and the focused diagnostics interaction test on TC22 using the separate E2E package. The new UI/default policy still needs normal-package field observation. This does not establish a physical GPS fix, background tracking, real provider sign-out or production release readiness.
|
||||
|
||||
The preceding signed checkpoint1c766bf was installed in place as APK E34AC3C6…C1874EB with private backup, matching signer and no data clear. The operator and backend confirm one Code128 and one QR event on these bytes, including exact leading-zero value001234567890 from EMDK/QRCODE. Apps → menu → Scan Capture round trip was also confirmed. The normal server remains API1.9/mobile1.1; API1.10 core159 tests, current contract3 tests and coherent scanner/demo/files/browser78 cases pass separately while real Authentik acceptance continues.
|
||||
|
||||
## November 1 native authentication checkpoint
|
||||
|
||||
The optional company sign-out and original-nonce client changes pass 151 JVM tests, zero-error/zero-warning lint, debug assembly and native-test compilation. All 28 selected OAuth2 login/logout and authentication-lifecycle native tests also pass on the TC22 in the disposable sample application, with no failures or skips. The normal scanner package/data were preserved and its Activity is foreground again. These native tests use synthetic provider adapters; they do not establish real Authentik or external-browser acceptance.
|
||||
|
||||
Independent review covered all 26 implementation/test/documentation files in the frozen patch and found no security candidates (completed scan c358cde3-b51d-4451-b07d-8d1afe6c4485). This is a patch review, not a fresh audit of every unchanged file. Native OAuth now requires API1.10, the advertised nonce-validation feature and REQUIRED policy; TABLE authentication remains compatible. Company sign-out is separately advertised and explicitly selected; the automatic sign-out policy remains undecided.
|
||||
|
||||
The paired server changes and real A-to-company-logout-to-B acceptance remain in progress. Earlier real-provider testing established operator A and local QQQ invalidation, but retained browser SSO silently reused A; that failed handoff remains failed. This checkpoint is source publication, not a production release or installation of these bytes on the normal TC22 package. Signing/distribution remain the owner's final step. All historical entries below retain their original scope.
|
||||
|
||||
## November 1 status and visible QR fixture
|
||||
|
||||
All eleven hosted checks at portrait-default7de2b508 passed. Public QR fixture checkpoint2e0fd962 is signed and pushed; docs/TEST-BARCODES.md records independent ZXing decoding of001234567890. Physical QR acceptance is still pending. Normal TC22 APK C89161C…C6340 remains installed with portrait requested, and the backend now has nine trusted EMDK Code128 events (eight on prior F3AF and one after the portrait update).
|
||||
|
||||
Release1.0 remains incomplete: actual Authentik acceptance remains pending; the local TLS proxy correction is verified, and provider configuration returned a validation error under diagnosis; physical QR, camera/gallery, navigation/failure, projection and GPS acceptance remain open. Filesystem portability passes142 discovered/138 passed/four existing skips, and the separate RF HTTP consumer now passes18 cases on a transitional custom-filesystem tuple. This supersedes its earlier fixture-compilation failure; it does not establish immutable/default dependency adoption or change the normal API1.9/mobile1.1 runtime on57832. Signing/distribution remain last by owner instruction. Current summaries supersede dated open-state statements below without changing their historical evidence or sealed review scopes.
|
||||
|
||||
## November 1 portrait default installed; prior source fully green
|
||||
|
||||
The user requested portrait lock by default. Missing/invalid preferences now choose Portrait; all explicit saved choices remain available. Four focused policy tests, debug lint (zero errors/warnings) and debug assembly pass. Development APK C89161C…C6340 was installed in place after signer verification and a new private-data backup; no app data was cleared. Android reports the normal Activity resumed with SCREEN_ORIENTATION_PORTRAIT, and a direct screenshot confirms the signed-in Apps menu. Barcode/lifecycle acceptance of these new APK bytes remains pending; earlier F3AF physical evidence is preserved.
|
||||
|
||||
All eleven hosted checks at229fce3 passed, including both GitHub native runs (jobs124829276568/124828879619):35 shared cases, PixelCopy and all seven semantic scenarios. Logs show session-login-action-ready, session-fresh-login and the semantic request audit in both runs. Server documentation checkpoint2de8470 also passes all eight checks. Fresh checks will qualify the portrait-default source update. The operator confirmed the eight earlier Code128 events were deliberate trigger pulls. The QR was not visible in chat; a direct image link was supplied after unreliable browser automation, and current QR acceptance remains pending.
|
||||
|
||||
## November 1 physical EMDK positive control verified
|
||||
|
||||
The operator reported Saved scan on the normal F3AF development app. Direct ownership-guarded backend inspection verifies eight new Code128 records for QQQ-TEST-123456, source zebra-emdk, TC22 attribution and eight distinct event IDs. This closes the current trusted hardware positive-control gap for Code128 only. Operator confirmation of repeated trigger intent and the current leading-zero QR remain pending; [physical acceptance](PHYSICAL-TC22-ACCEPTANCE.md) records exact APK/runtime and remaining lifecycle/retry/ownership gates. No normal app/data clear or QA run occurred.
|
||||
|
||||
Strict Firefox profile-only CA trust now passes issuer/hostname checks using the supported PLAYWRIGHT_FIREFOX_POLICIES_JSON entry point. Windows trust is unchanged; the earlier Windows-root approval question is obsolete. Actual provider startup/exchange remains unexecuted while an independently reviewed known-listener guard is prepared for genuine TIME_WAIT rows. Independent architecture closure of Android229/server2de reports no additional concrete source blocker and maps A1-A11 controls/tests; runtime/deployment/dependency/signing limits remain. Record Files compatibility now has a concrete exact-revision filesystem dependency gate in a new private cache; no frozen0515/default/runtime adoption occurred.
|
||||
|
||||
## November 1 native CI — rotation passes, fresh-login test readiness under correction
|
||||
|
||||
Android5ba PR run41297344726 passed:35 shared native cases, PixelCopy and all seven semantic scenarios, including session-monitor. The duplicate push run41297340376 also passed rotation/recreation/mirroring/administrator termination, then timed out waiting for Username after clicking Log back in. Its request audit shows completed Android logout200 and no second Android manageSession. Static review confirms that the test awaited only the label, which also renders while the logout action is disabled. This supports a test-readiness race; the failure artifact does not record the button state at the click, so no production cause is asserted. The correction waits for a final signed-out message and enabled action, asserts enabled and clicks once; it retains all fresh-login/session assertions. The opt-in device-screen test uses the same readiness requirement. Fresh native execution remains required.
|
||||
|
||||
Independent release automation review of three exact5ba files found no actionable source finding; [scope and hashes](RELEASE-AUTOMATION-REVIEW.md) retain external-configuration limits. A separate API1.9/mobile1.2 backend-only smoke passed readiness and shutdown with private credentials removed. Its launcher initially failed closed on the Node shim PID; actual Node resolution corrected the helper, and the unsuccessful fixture also cleaned up. No TC22 QA test, ordinary-app cleanup or normal-server replacement occurred.
|
||||
|
||||
## November 1 TC22 walkthrough — reported disappearance investigated
|
||||
|
||||
After the operator reported that touching the handheld crashed or moved the app, direct ADB inspection found the normal scanner process alive and its Activity resumed/focused, with no crash-buffer entries. A direct screen capture showed the connected sign-in screen; the black desktop mirror was not reliable evidence of an app crash. Restored the existing scanner demo login using locally encrypted credentials, and a subsequent direct capture confirmed the Apps menu. Opened Scan Capture to resume the manual walkthrough. No production defect has been reproduced or fixed by this inspection; physical trigger/navigation acceptance remains pending. No QA instrumentation or app cleanup was launched over the operator's normal app.
|
||||
|
||||
## November 1 morning — normal app updated; native test correction pending hosted verification
|
||||
|
||||
The normal TC22 application is now updated in place to the reviewed development APK `F3AF638E…E9FAA`. Matching signing identity and a new owner-only private-data backup were verified; app data/enrollment were not cleared. Non-streaming installation completed and the normal process is running against the preserved API1.9/mobile1.1 demo. This supersedes older unchanged-normal-APK statements below. Operator login/navigation/scanning confirmation is pending; no production release is claimed.
|
||||
|
||||
Published `e04fdb2` passed CircleCI and CodeQL, but both GitHub native runs failed the same session test: it requested rotation then another Activity recreation without waiting for configuration convergence, and the barcode draft was empty. The test now waits for landscape/resumed configuration and asserts the draft after rotation and again after explicit recreation. This is a test synchronization correction awaiting native execution, not a demonstrated production draft fix. Physical barcode attempts separately hit a wrong expected value (operator confirmed the old test code), a transient focus assertion and an ADB timeout; none is a full hardware pass. Focus preconditions now wait briefly within the120second stage deadline, and install timeouts identify the operation.
|
||||
|
||||
The opt-in QA screen-consent harness, shared HTTP helpers and both QA/E2E test packages compile. Its early safety checks reject missing operator opt-in and both protected demo ports without device access. Actual consent/Home/Stop/expiry/end-session acceptance remains pending. The harness author stopped at the workspace agent-credit limit; root completed the compile corrections and continues directly. A real Authentik fixture is compiled with pinned images downloaded, but no services or OS trust changes have occurred; temporary Windows CA approval is still pending.
|
||||
|
||||
## November 1 — refined device-screen client and published paired server
|
||||
|
||||
The refined client passes137 JVM tests, all package/lint gates, fresh four-APK inspection and the TC22 ordinary-UID scan-ingress regression. Continuous image draining retains one latest buffer; repeated Share is blocked through service binding. Fresh independent follow-up review found no concrete issue. The source-pinned1.2 server `1041693` is published and passes39 server/six demo/all15 browser tests with strict195-JAR/2,441-class provenance in a cloned private Maven cache. Hosted client CI now targets that exact source. No actual projection consent/physical trigger is proved; the normal APK remains unchanged and its running demo remains qualified1.1. See [candidate scope and hashes](DEVICE-SCREEN-ACCEPTANCE.md).
|
||||
|
||||
## November 1 — initial consent-based device-screen checkpoint
|
||||
|
||||
The optional device-screen client and paired1.2 server pass initial compilation and automated gates:135 Android JVM tests, lint/all package builds,39 server and six real-HTTP demo tests. Parent and fresh independent static review found no reportable client issue across the nine changed-file inventory; actual consent and projection behavior remain unverified. See [scope, hashes and remaining acceptance](DEVICE-SCREEN-ACCEPTANCE.md). The normal operator APK and qualified1.1 demo remain separate. Frame freshness/binding refinements and final native acceptance are still required.
|
||||
|
||||
## November 1 — hosted Back focus failure and physical-trigger checkpoint
|
||||
|
||||
Published Android head `6845abc5289fa975e6f50b23b159c3131a82eee1` has a successful CodeQL check; not all CI is green. CircleCI android-test job 140 fails three NavigationTests before injecting Back: their Activity is resumed and the device is interactive/unlocked, but Activity/decor window focus stays false for five seconds. Both job attempts reproduce the failure. Retained JUnit contains no focused-window owner, so the cause is not yet established. Failure-only diagnostics now classify the focused window as own/system/other, report bounded own-window flags and the known network-dialog visibility; they retain the five-second focus requirement and actual Back injection. CircleCI unit job 141 passed. One GitHub native run failed and the other was still running at inspection; neither is claimed successful.
|
||||
|
||||
The physical QA attempt using APK hash prefix `CFFF` reached its first hardware-ready stage but recorded no acknowledged operator scan. A final near-deadline HTTP poll timed out; this is not physical scanner acceptance. Evidence is preserved under `C:/Users/james/.cache/qqq-tc22-physical-attempt-20261101-0210`; `physicalTriggerVerified` remains false. A separate, unqualified test follow-up is prepared to avoid sub-second status polls and label deadline failures without extending the 120-second stage bound. Its compilation is deferred until the concurrent scanner changes are ready; it is not part of this diagnostic checkpoint.
|
||||
|
||||
The earlier normal-server ownership hold is resolved. After correcting the CIM positive control, the owner completed the reviewed upgrade to the frozen `ecf`/`b14` API 1.9 / mobile-scanners 1.1 TABLE runtime. A fresh backup, original-column invariants, old-after-new recovery logins before and after stopping the predecessor, and live login/metadata/logout for both demo accounts passed. Two devices and three scans, including the leading-zero value, were preserved. Private evidence is retained in `C:/Users/james/.cache/qqq-normal-api19-002594902b1942bda2480c512ed644ab/normal-verification.json`. The normal operator APK remains unchanged. Further optional screen-capture source is under separate implementation; these diagnostic edits do not qualify it.
|
||||
|
||||
## October 31 — published client checkpoint and probe target clarity
|
||||
|
||||
Signed client checkpoint `d316567` is published to existing draftPR8 and the clean canonical feature checkout is fast-forwarded to it. Fresh hosted checks found two CodeQL intent-redirection annotations in the separate permissionless test probe. Inline static triage at that exact revision classified both as not actionable: the exact QA/E2E package allowlist dominates both fixed-action broadcast sends, no arbitrary activity/service is launched, and the probe adds no sender authority. No alert was dismissed or completed audit rewritten. The probe now maps accepted requests to explicit final package literals rather than forwarding even the validated caller string. Probe-only build/lint and repeated ordinary-UID eight-forgery/manual-positive acceptance pass; production APK hashes are unchanged. Publish this source clarity follow-up and inspect fresh CodeQL/client checks before release. Physical trigger and whole-handheld viewing scope questions remain pending.
|
||||
|
||||
## October 31 — final SDK/navigation candidate verified for publication
|
||||
|
||||
All three Android Back handlers and the toolbar arrow now use one live Main-owned drawer-first action, preserving standalone fallbacks. The native regression first proved a real process-level bypass opening Leave behind the drawer; the corrected case passes with one actual Android Back, preserved process/draft and zero cancellations. It also covers seven other overlay/focus gates. Current source passes127 JVM tests,34 TC22 shared cases in115.717s and the additional overlay case in17.948s. A distinct-signer ordinary-UID test passes against the exact current QA APK: eight forged broadcasts cause zero extra process steps/records, while a manual positive control saves through the real API. Actual physical trigger proof is still false/pending; the barcode-visibility question is unanswered.
|
||||
|
||||
All four APKs pass fresh DEX, manifest, native-hash and packaged-notice inspection. Independent review of the final SDK/navigation patch found no concrete defects requiring changes. See [exact hashes and evidence boundaries](TRUSTED-SCANNER-ACCEPTANCE.md). The final code is ready for an explicitly authorized signed source checkpoint; hosted client checks must run after publication. Coreecf has18 hosted successes and published serverbf174a6 has8. New whole-handheld viewing scope clarification is pending; current capture is QQQ Mobile only. Normal operator app/server and emulator remain unchanged by these tests.
|
||||
|
||||
## October 31 — coherent backend accepted and published; final Android gate running
|
||||
|
||||
The owner explicitly authorized signed commits and publication after automatic review required direct commit approval. Core `ecf0f550` is published to draftPR1334. Server code `b14d925` plus acceptance documentation `bf174a6` is published to draftPR6. Fresh37 server/five demo tests, strict runtime provenance (195 JARs/2,440 unique QQQ classes/zero duplicates, Guava33.7.2-jre/H2 2.2.224), actual API1.9/mobile1.1 discovery and all15 browser tests pass. The normal operator runtime remains unchanged. Hosted checks are running; one Windows job failed to download PSScriptAnalyzer before project analysis and received one scoped retry.
|
||||
|
||||
The trusted scanner now also blocks physical input behind drawer/Settings/Diagnostics/Account/leave overlays and lost window focus, with a live callback guard. Two new coordinator tests and one production-widget QA native regression are added. Auth0 stable3.0.0 and Coil3.0.4 replace inherited prereleases; two native raster/SVG/error rendering cases are added. These source changes require the new combined build and device run. The first build correctly rejected stale notices: AboutLibraries10.9.2 did not declare its dependency graph as an incremental input. A lazy resolved-coordinate input now invalidates its standard generator; strict license/version gates remain enabled. The combined gate is running again. Earlier APK hashes and hardware evidence do not qualify these changes.
|
||||
|
||||
## October 31 — trusted scanning packages verified; runtime provenance caught a mixed dependency
|
||||
|
||||
The approved optional EMDK implementation passes all 49 scanner JVM tests, debug/release lint, debug/unsigned-release/E2E assembly, and production-path QA/probe assembly. The separately signed adversarial probe has a verified distinct test certificate; its temporary private key was deleted. These results do not establish physical trigger or injection resistance: disposable TC22 acceptance is next, and the normal operator APK remains unchanged.
|
||||
|
||||
Exact-source core `ecf0f550a0357cec6387c2b54efca128a405a629` passes the full selected dependency closure: 4,507 tests discovered, zero failures/errors, 16 existing skips, plus the configured coverage/static gates. Scanner server `a8ed108` passes 37 tests and its demo passes five. Runtime provenance then correctly rejected an old RC.20 backend dependency in the demo classpath. Browser and QA fixture execution are held while the consumer dependency management is corrected; these test passes are not qualification of that mixed runtime. The verifier remains strict, and no shared artifact or normal server was replaced.
|
||||
|
||||
## October 31 final client audit and isolated integration follow-up
|
||||
|
||||
The owner explicitly accepted Zebra's EMDK terms and selected native trusted scanning. The optional adapter is now being implemented; the earlier 32-test result does not qualify that new hardware path. Wrapper checkpoint `7e0cbee` and the five verified client security fixes `df532ff` are signed local commits, not yet pushed. Core's local `331a99d` additionally pins patched Guava; its full selected dependency-closure suite and verification analyses are running in a fresh private repository. On Windows, only the inspected cosmetic shell coverage-summary execution is omitted because of quoting; actual coverage checks and static analyses remain enabled. Hosted Ubuntu retains that summary.
|
||||
|
||||
The completed remediation batch passes 109 JVM tests, scanner lint with zero errors/warnings, debug/native-test and unsigned sample release assembly. All 32 selected TC22 native cases pass in 117.325 seconds, including ten new authentication lifecycle tests. Actual packaged sample release controls deny cleartext and backup and include all ten cloud/transfer exclusions. Five audit fixes have regression evidence; trusted scan ingress remains open pending the separate EMDK license decision. The new debug APK `8c4d3886...c512a` is not installed over the operator app. See [the scoped review checkpoint](SECURITY-REVIEW-2026-10-31.md).
|
||||
|
||||
The deep client audit completed and sealed against clean published `d1de0bf`, with one medium and five low findings. The medium finding is delayed password-session adoption after logout/server switch, including retained original-server models. Low findings cover sample release cleartext, failed Auth0 local sign-out, unauthenticated exported scan input, stale legacy Auth0 callbacks, and sample session backup. Source fixes are being prepared with delayed-response/provider and host regression tests; none is closed merely from editing source. Static coverage is partial, with external provider/server/dependency implementations and bundled binary implementation gaps excluded. Real configured Authentik and physical operator acceptance remain separate.
|
||||
|
||||
An isolated `fix/hosted-native-ci` checkout keeps this work separate from the audited source and installed operator app. Core draft PR #1334 publishes reviewed native API 1.9, credential-safe logging and explicit-null parser fixes at `00f6c49ef4c21bedb7c62ccad535bd6de1008948`. Focused source gates passed 154 tests with two pre-existing disabled cases, plus a separate 17-test null/HTTP gate. Server `a8ed108` canonical UTC migration passes 37 root and five demo tests and every hosted check.
|
||||
|
||||
A fresh private Maven repository and unique CI-only core version are qualifying the fixture from those exact commits; no shared artifacts or operator runtime are replaced. Hosted acceptance must include the nullable admin form and session-monitor scenarios. A failure-only focus diagnostic preserves the five-second guard and actual Back input; the cause of the hosted focus loss remains unproven.
|
||||
|
||||
## October 31 unconfirmed scan exit correction
|
||||
|
||||
The operator reported Leave process permanently disabled with “The last scan is not confirmed.” The existing JVM harness reproduced that settled missing receipts remained a hard navigation block. A new regression failed before the correction. Settled unconfirmed scans now show an explicit warning that they may already be saved; Stay retains the original retry event, while Leave process uses the existing server cancellation and clears the event after cancellation succeeds. Failed cancellation retains the event and exposes a separate, explicit Leave anyway choice that clears local state without another request; the dialog warns that the server process may still run and saved changes are not undone. Active requests and pending photos remain hard blockers, and receipt validation is unchanged. Added JVM guards/cancellation/fallback cases and a native lost-response/malformed-receipt/Stay/failed-cancellation/explicit-exit regression. Final bounded verification passed all 46 mobile JVM tests, scanner lint/debug APK and sample/test APK assembly in 18 seconds. The TC22 follow-up passed all 21 selected native cases in 53.482 seconds, including the new lost-response/failed-cancellation/explicit-exit case. The operator update is being coordinated separately; actual configured Authentik acceptance remains pending.
|
||||
|
||||
## October 31 navigation/authentication review checkpoint
|
||||
|
||||
The combined client checkpoint passed 102 JVM tests (26 core, 43 mobileapp, 33 scanner), scanner lint, debug/E2E APK assembly and native-test compilation. The final follow-up build passed in 1m3s (266 tasks, 34 executed). The TC22 rerun passed all 20 selected navigation/input/account/OAuth tests in 49.235 seconds, including all seven synthetic AppAuth cases. The first run exposed Back during drawer opening; the handler now also handles a drawer targeting Open, and the native helper waits for settled UI before hardware Back. [Native acceptance evidence](NATIVE-AUTH-ACCEPTANCE.md) distinguishes real handheld execution from the simulated browser/provider. No actual Authentik sign-in is claimed. New hosted CI is required after publication.
|
||||
|
||||
Independent source review found no concrete defect in the native authentication/navigation patch; this is not final security or deployment clearance. [AppAuth package evidence](third-party/APPAUTH-VERIFICATION.md) confirms 131 bundled entries, 126 external runtime dependencies, nine complete texts and unchanged eight native libraries in the inspected debug/E2E APKs. OAuth2 depends on the companion core UI API1.9 native-session contract, still pending publication/host adoption. TABLE_BASED remains usable on compatible API1.8 servers. Production signing/distribution and actual shared-operator/provider acceptance remain separate gates.
|
||||
|
||||
## October 31 semantic authentication — synthetic native acceptance passed
|
||||
|
||||
The combined source passes 102 JVM tests (core26/mobile43/scanner33), scanner lint and debug/E2E/test APK assembly. All seven synthetic native OAuth cases and the navigation/input/account suite passed on TC22 as described above. Generated notices contain 131 entries including AppAuth. The initial sandbox run stopped at the existing debug-key lock; scoped rerun preserved the key and completed successfully. Testing used the separate sample package; no emulator or normal operator installation was started for this checkpoint.
|
||||
|
||||
The native descriptor now requires an advertised `prompt: "login"` policy, applied through AppAuth and bound to each pending attempt. Missing/unsupported prompt policies fail closed. Focused tests cover policy changes and mismatched returned requests; the real shared-handheld acceptance gate includes switching operators with an existing browser SSO session. This requests fresh authentication; it is not global IdP logout or verified `auth_time` proof.
|
||||
|
||||
The owner requires Authentik when configured by the server. Generic OAuth2 browser sign-in is implemented against an additive UI API1.9 `nativeSessionLogin` capability, with explicit issuer/discovery/callback metadata and an `authenticationFlow` marker on the existing session exchange. AppAuth performs authorization with S256; the secret and code exchange stay on QQQ. TABLE_BASED remains unchanged and native bearer metadata is kept distinct. Client gates, callback/lifecycle checks, deferred cookie adoption and focused tests are implemented; actual configured Authentik acceptance remains pending. See [AUTHENTICATION.md](AUTHENTICATION.md). No live provider settings or operator data were changed.
|
||||
|
||||
## October 31 navigation correction — native acceptance passed
|
||||
|
||||
The primary navigation uses one hamburger drawer with All apps and server-authorized app entries, plus Settings and Diagnostics fixed at its bottom. The duplicate toolbar Apps button and Switch app overflow action are removed. Back remains beside the hamburger within apps/processes, Account stays separate, and prelogin/pending-approval drawers hide business destinations. Drawer dismissal and secondary surfaces preserve active work; selecting a primary destination retains the existing leave and pending-upload guards. Compilation and the selected native navigation suite passed, including the drawer-opening Back correction above. The successful checkpoint below describes earlier session/photo acceptance. No installed operator app, server or data was changed for this correction.
|
||||
|
||||
## Current verified checkpoint — October 31
|
||||
|
||||
All 12 shared TC22 navigation/input/account tests pass. TC22 orientation (all five persisted policies), offline licenses, synthetic camera/gallery/rotation/remote-logout cleanup, and the full session-monitor scenario pass. Session monitoring includes real JPEG app pixels, background clearing, renewed viewing on resume, operator pause, administrator termination and fresh login. Photo/session request audits match published semantic operations. JVM reports total 91 tests (22 core, 36 mobileapp, 33 scanner), zero failures; scanner lint passes. Notice coverage gates and packaged APK inspection pass for debug/release/E2E (125 runtime dependencies, 130 entries and nine complete license texts), and negative omission/blank-text cases fail as required with generated metadata restored.
|
||||
|
||||
The false-offline investigation was a test-clock issue, not a demonstrated timezone defect. The independent standalone file-backed JVM test in America/Chicago passed across 18 seconds. No timezone workaround or relaxed heartbeat/offline policy was added. Remaining work: publish the Android review checkpoint and verify fresh hosted CI, finish independent full audits/native attribution, qualify immutable optional dependencies/CI and real lens/operator acceptance, then return to signing/distribution as the owner requested. The normal installed app and operator demo remain on their earlier versions; isolated test acceptance is not deployment. Historical entries below preserve earlier failures and are superseded by this checkpoint.
|
||||
|
||||
Viewing diagnosis resolved the apparent offline state: the test advanced only16ms of Compose coroutine time per250ms wall polling, so heartbeat LaunchedEffect timers did not run during125 widget polls. The standalone non-UTC file-JVM regression passed and audit ordering confirmed zero heartbeats during those polls. The helper now advances by elapsed monotonic wall time. The next TC22 run reached `session-mirror-frame`: actual app JPEG pixels were delivered/decoded and background clearing passed. It then failed the already-identified old resume assertion because no viewer demand was renewed. Resume now polls the admin widget again; rebuild/full scenario rerun is active in the current turn. No production heartbeat interval or offline threshold was relaxed. The standalone regression source is in the companion demo, added by the read-only diagnosis agent and verified separately.
|
||||
|
||||
Latest viewing diagnostics: eligibility is available=true, but no indicator/frame upload occurs; 125 widget requests and 18 native heartbeats succeed. A real HTTP regression now explicitly requests the viewer widget as a browser (without the Android client header) before the native heartbeat; both demo tests PASS, ruling out the simple cross-channel lease-isolation hypothesis in that fixture. Actual core widget response fields are `layout`, `blocks`, `type`, `blockTypeName`; corrected the diagnostic extractor to read `blocks` (the earlier blank status was an incorrect `subBlocks` assumption). That diagnostic change needs rebuild/rerun to obtain the actual server widget status. All runs in this checkpoint are terminal. No production state-sharing change was made on an unproven hypothesis.
|
||||
|
||||
The window-focus synchronization rerun advanced past capture eligibility: no APP_NOT_FOCUSED failure remains in that run. It now times out at the viewer indicator. Request audit shows 125 successful web widget renders and 18 successful Android heartbeats, with no screen-upload operation. Added bounded failure diagnostics for current server availability/reason and the widget's status text (never image data or credentials), to distinguish lease issuance from client rendering. This newest diagnostic needs rebuild/rerun. All native processes from that run are terminal. Android changes are staged as a review checkpoint, but later focus/diagnostic edits remain unstaged; re-stage and verify before committing.
|
||||
|
||||
Screen-viewing follow-up reproduced a stale tracked-focus flag: server reported APP_NOT_FOCUSED while instrumentation confirmed interactive=true, no keyguard/device lock, both Activity/decor focus=true and lifecycle RESUMED. ScannerActivity now observes actual view-tree window-focus events, resynchronizes on resume, and removes the observer on destruction. Existing captureAppScreen independently checks actual decor focus, so capture protection remains enforced. Scanner unit/lint/E2E APK verification passed (build1m19s); the focused real-server TC22 scenario is rerunning in the active root turn. The operator demo remains on extension1.0; no normal-app update was made.
|
||||
|
||||
TC22 photo acceptance PASSES against the verified guarded0352 fixture: synthetic external-camera result automatically uploads, exact hash/size/provenance/parent and collection association are inspected, gallery staging survives rotation/recreation, leaving is blocked while pending, and remote session termination clears the private copied original without deleting the selected gallery source. All recorded native requests match published semantic operations. The run exposed and fixed a real UI-thread defect: ScannerActivity now dispatches unauthorized-session navigation on the main thread and ignores callbacks for a superseded session. Scanner unit/lint/APK rebuild passed before the successful native rerun. Fixture owner metadata remains in the private task cache; do not infer a normal-app deployment or actual lens capture from this synthetic result. Real session-viewing acceptance is starting next in the active root turn.
|
||||
|
||||
TC22 navigation/input/account acceptance now PASSES all 12 tests on rebuilt sample APKs. Orientation (all five policies) and offline licenses also pass. The guarded Record Files private launcher needed execution outside the sandbox for its process to survive; current private fixture PID111928 was started with a 900-second lifetime, with protected metadata path in the task cache. The first native photo run reached Saved and verified exact bytes/provenance/parent, then failed because the test assumed stored collection order was zero-based. Actual owner storage is one-based while manifest/receipt order is zero-based. Corrected that assertion and the duplicate Apps selector; photo rebuild exec64104 is active in the current turn, then rerun the synthetic camera/gallery/rotation/remote-logout scenario. Preserve fixture ownership and stop only that verified fixture when finished. Session mirroring acceptance and final audits remain open.
|
||||
|
||||
Latest navigation rerun is terminal: 11 of 12 TC22 tests pass. Restored account/server assertions now pass. The remaining failure selected both the menu action and the closed drawer heading named Switch app; a stable menu-action identifier and matching test selector are added. Those last two changes need rebuild/rerun. No native test or fixture remains active from this run.
|
||||
|
||||
TC22 follow-up: orientation and offline licenses each PASS their instrumentation scenario. Shared navigation ran 12 tests: 10 passed, with failures from duplicate visible/closed-drawer Apps selectors and an old account-dialog expectation that server selection still lived there. Added a stable toolbar Apps identifier, preserved the account user assertion, and verified restored server selection under Settings instead. Rebuilt sample/test APKs successfully; navigation rerun is starting in the current root turn. Guarded server changes and passing 18-test evidence are committed/pushed as84ffd7c on the existing draft PR; no merge or production release.
|
||||
|
||||
Latest TC22 result: the rebuilt orientation acceptance PASSED (one instrumentation test covering all five policies, persisted selection, actual fixed screen axis, Activity recreation and a fresh Activity launch). The bounded configuration-convergence wait resolved the prior timing failure; the axis assertion remains enforced. Guarded Record Files integration now passes all 18 tests and runtime/Checkstyle verification, with evidence retained in the companion module. Root is running TC22 licenses followed by shared navigation acceptance as exec session85018; poll that handle before starting another device run. No operator-app update or production release is implied by isolated test acceptance.
|
||||
|
||||
Latest verification follow-up: the notice-integrated APK build log ends BUILD SUCCESSFUL. Explicit TC22 orientation acceptance ran and failed because the observed screen axis was still portrait when landscape was requested. A bounded 15-second configuration convergence wait was added to the native test while retaining its final axis assertion; rebuild/rerun remains required. The disposable test runner cleaned its resources. Emulator remains closed. Record Files guarded-artifact verification has four unresolved intake-event concurrency test failures; see the companion integration session state. No production release is qualified.
|
||||
|
||||
2026-10-31 Android acceptance follow-up: the bounded pre-notices build passed 89 JVM tests (core22/mobile36/scanner31), normal and isolated APK assembly, and scanner lint with zero errors/warnings; broader modules retain inherited vector/dependency warnings. The emulator remains off after confirmed workstation stutter. On TC22, session capture remained safely blocked with APP_NOT_FOCUSED after recreation; no mirror frame was uploaded. The 12 shared navigation/input/account tests then ran: six passed and six failed (stale account/server-confirmation assertions, duplicate catalog/drawer text selectors, and a hardware Back case). Assertion corrections and window-focus diagnostics are prepared; these failures are not counted as passes. Orientation Settings, retained manual draft state, synthetic photo E2E, explicit physical photo fixture support, and bundled-license Settings entry are now implemented but require the next compilation/native acceptance. The license owner is running the bounded integration qualification. Ordinary scanner app/data, DataWedge settings and existing USB reverses were preserved.
|
||||
|
||||
## 2026-10-31 — Navigation hierarchy and release preparation
|
||||
|
||||
Owner explicitly deferred signing/distribution to the final step until the channel is chosen. No signing key or production signing configuration has been created. Continue implementation, audits, native/physical acceptance, documentation and ordinary CI; do not create release tags or force a distribution decision early.
|
||||
|
||||
Workstation interruption: user reports whole-desktop pauses whenever the emulator acts and explicitly confirmed the workstation is smooth after closing it. All local emulator/build runs were paused and emulator-5554 shut down gracefully without clearing application data. TC22 remains connected. Sampled host had 48 logical CPUs, CPU17%, about152GiB free RAM of256GiB, GPU10% with6.1GiB/30GiB used; these samples do not rule out brief spikes. WHPX is operational outside the sandbox. The running host-GPU emulator log includes OpenGL context preemption/restore failure and external-memory import errors; graphics interoperability is a hypothesis, not a proven root cause. Saved AVD config now uses software graphics, previous config backed up locally, but no comparison run has been made. Do not restart the emulator automatically. Continue acceptance on TC22/hosted CI or schedule a controlled software-renderer comparison later.
|
||||
|
||||
Android checkpoint: primary Apps, an app-switching drawer, separate Account and Settings, host device/location settings and shared leave confirmation are implemented. A bounded build with the emulator closed passed 85 JVM tests (core22/mobile35/scanner28), scanner lint with zero errors/warnings, isolated scanner APK/test APK and shared native-test compilation. The focused native long-form test passed after waiting for actual IME dismissal; the earlier immediate assertion raced its animation. Expanded native navigation cases are compiled but not run. Photo capture/picker, registered Record Files transport, stable retry identity, exact receipts and lifecycle tests are implemented. Subsequent camera auto-upload/destruction cleanup, the public mobile-record-files vocabulary gate and associated tests await the next bounded build after concurrent asset/backend work finishes. No emulator restart is authorized; physical acceptance uses the separate explicit runner in [DEVICE-TESTING.md](DEVICE-TESTING.md).
|
||||
|
||||
The session native test now passes login/approval/catalog/process and recreation, including parent-app metadata and denied-location reporting, against the corrected file-H2 server. It still timed out before the administrator-viewing indicator. The test now waits for explicit screen eligibility and renews the widget viewer lease like the real admin poller; that change is unverified. Actual PixelCopy pixel-boundary instrumentation passed earlier, but full session/mirror/admin-end native acceptance is not complete. Ordinary synchronous process responses have no generic status endpoint: the host retains the process reference, prevents replay and describes uncertainty before explicit cancellation; it does not promise unsupported result checking.
|
||||
|
||||
Current plan: finish native navigation/session acceptance; integrate camera/gallery with the actual Record Files runtime; freeze paired revisions for final independent reviews; qualify signed delivery and hosted CI before publication. Apps → app → process is primary navigation. Account/sign-out, Settings and diagnostics are secondary surfaces that preserve active work. Toolbar and Android Back share one guarded leave policy. See [NAVIGATION-UX.md](NAVIGATION-UX.md); implementation and native acceptance are underway, not yet complete.
|
||||
|
||||
Latest intermediate results: Android 76 JVM tests and lint with zero errors/warnings; shared native 11/12, with the remaining form/IME assertion under investigation. Companion server 37 tests, two real HTTP acceptance tests and all 15 browser E2E tests pass. The H2 last-connection close/compaction issue was reproduced and fixed with the demo database lifetime setting; the browser suite now completes in 59.4 seconds. These counts describe their tested intermediate source, not a final release.
|
||||
|
||||
Record Files now has actual registered ingestion routes and a frozen 19-file consumer bundle (`retained-contract-20261031-0238`), all hashes verified by the optional integration owner. Camera/gallery implementation will use its existing storage and durable receipts. Atomic authorization across revocation and upload commit remains a shared contract issue; runtime compatibility and native acceptance are still being qualified.
|
||||
|
||||
Release preparation adds optional environment-only signing, validated version properties and a separate scanner-tag workflow that calls the native verification lane before building/signing/publishing. Actionlint passes. The signing identity/secrets, actual signed build/upgrade and final publication have not been configured or verified. See [RELEASING.md](RELEASING.md). Debug/E2E defaults and the operator's installed TC22 application are preserved.
|
||||
|
||||
## 2026-10-30 — Sessions, screen viewing and audit corrections (uncommitted)
|
||||
|
||||
The host now requires mobile-scanners `>=1.1.0 <2.0.0` and uses registered heartbeat/end/screen operations. Session telemetry contains screen metadata only. Administrator viewing leases enable bounded own-window PixelCopy JPEGs with a visible operator stop control. Capture blocks login/password screens, unrendered transitions, background/unfocused windows and ended sessions; checks repeat after capture and before upload. Foreground location is optional and permission denial leaves scanning usable. Device approval displays the server-generated short name and supports administrator renaming through QQQ.
|
||||
|
||||
Audit fixes require complete scanner receipts and reject invalid explicit maxLength. Navigation now follows NavController's actual destination, including system Back and controller replacement. Shared renderer/authentication fixes are being completed by the parallel review agent. Current intermediate verification: 75 JVM tests passed, APK builds passed, lint zero errors/eight warnings before dependency catalog cleanup. Actual PixelCopy instrumentation passed after an emulator startup ANR was resolved by a cold restart preserving data. Shared native suite passed 11 of 12 tests; a new short-viewport login regression found the IME obscuring the button and its fix is awaiting rerun. Both new navigation tests passed. Real-server session/end/viewing scenarios are implemented but await the rebuilt companion server and final native run. These are work-in-progress results, not publication or production acceptance.
|
||||
|
||||
At this October 30 checkpoint, Record Files camera/gallery routes were unavailable. The October 31 checkpoint above supersedes that dependency status. Version one remains online only.
|
||||
|
||||
## 2026-10-30 — Semantic API migration in progress
|
||||
|
||||
The current work makes the scanner host use the registered semantic UI API contract for every client operation. Public `/qqq/v1/version` discovery gates credentials, branding and metadata; the supported range is core `>=1.8.0 <2.0.0` and mobile-scanners `>=1.0.0 <2.0.0`, with `android` advertised in `clientChannels`. The four mobile extension operations now resolve under `/qqq/v1/qbit/mobile-scanners`. The native renderer applies server-directed completion, field/step updates, form submission and cancellation, and explicitly blocks unsupported required controls. Review fixes honor hidden fields and explicit null clearing, and keep generic fields named `eventId` separate from scanner retry context. See [UI-API.md](UI-API.md) for the exact rendering boundary; this is not a claim of full web-client parity.
|
||||
|
||||
The final combined JVM suites passed 53 tests: core 21, mobileapp 23 and scanner-host 9. Lint passed with zero errors and six warnings; normal debug and isolated E2E/test APKs assembled. A native administration regression exposed that core QQQ completes a process by omitting nextStep from its COMPLETE response. The renderer now honors that server signal, preserves the final display step until submitted, and closes completed processes without issuing cancellation; a ViewModel regression verifies the full sequence. The companion qbit passed root verification/install with 23 tests and demo HTTP verification; all six migrated browser E2E scenarios passed in 2.9 minutes. The first native run exposed HTTP400 because the server had not registered the Android client channel. The server now registers it while preserving existing channel policies, and the real HTTP regression sends the Android header on all requests and passes. All six native semantic scenarios passed across focused runs: incompatible core major, missing extension, missing Android channel, supported-server scan, additive-future metadata scan, and native administrative approve/revoke/cancel. The first five passed before the terminal-state correction; the final administration scenario passed afterward in 255.917 seconds. Its OpenAPI audit matched all 31 requests to 13 published operations, including backend cancellation. Safe stage markers show both processes reaching completion and Close, then a populated form being cancelled without changing persisted status. The emulator was CPU-bound with animations enabled; the runner now wakes/unlocks only the selected emulator, temporarily disables its animation scales and restores them during cleanup, allows 60 seconds for UI conditions and 300 seconds for instrumentation. The six shared native sample tests also passed. Hosted Android verification remains pending; earlier records below apply to their earlier revisions.
|
||||
|
||||
Active plan: publish the Android branch and verify hosted results. The companion server is published at 7dd02b8874882ca2edcdcd89109b3dee6b4b0c88 with all server CI checks green, and the Android workflow pins that revision. The six shared native sample instrumentation tests passed on API35. The local server and emulator restarted after the workstation crash with data preserved.
|
||||
|
||||
Physical acceptance now includes the Zebra TC22 on Android 14 with DataWedge 13.0.325. The latest normal APK was installed with login/enrollment preserved; browser record approval displayed one device approved. The native catalog and Scan Capture opened with Connected status. The DataWedge profile associates all scanner-app activities, enables barcode input, disables keystroke output, and sends the SCAN action/default category as a broadcast to the explicit package with signature checking enabled. The user performed two deliberate physical triggers and saw Saved scan. The matching persisted Code128 row was independently inspected in the backend: synthetic barcode QQQ-TEST-123456, symbology LABEL-TYPE-CODE128, source scanner, user scanner, TC22/Android14/app0.1.0, mobileScanApp/mobileScanCapture, and capture/receipt timestamps. The two deliberate Code128 triggers produced two records, one event per trigger. A subsequent physical QR scan also displayed Saved scan; the independently inspected row preserved the leading-zero barcode 001234567890, symbology LABEL-TYPE-QRCODE, scanner source and the same TC22/user/app/process attribution with capture/receipt timestamps. The table contained exactly three records for two Code128 triggers and one QR trigger. Connection-loss/retry and revoked-device behavior still need physical-device acceptance; emulator checks do not replace those cases.
|
||||
|
||||
## Earlier verification records
|
||||
|
||||
2026-10-30 process E2E follow-up: added a real scanner-host Compose instrumentation scenario against a fresh QQQ demo database. It drives server selection and login, confirms pending enrollment, approves through the real admin process, selects the native app/process, submits a leading-zero manual barcode, waits for the actual saved-scan acknowledgment, independently queries durable provenance, and verifies a revoked device cannot save through its already-open process. The final scenario passed on API35 (one end-to-end test, 50.932 seconds), including completion of administrative result screens. It uses the separate `io.qrun.mobile.scanner.e2e` application; the operator's app, accounts, data and existing forwarding are preserved. Random test credentials are passed through stdin to private app storage and redacted from reports. The runner removes both test APKs and cleans up its temporary server/database and dedicated forwarding; only the normal scanner package remained installed after verification. Added a pinned companion-server checkout and this E2E to the push/PR emulator lane; hosted execution remains unverified until publication. Final required Gradle verification passed: 28 JVM tests, lint zero errors/six existing warnings, normal debug APK and isolated E2E/test APKs assembled. Actionlint, Node syntax validation and diff whitespace checks passed.
|
||||
|
||||
2026-10-30 follow-up: the scanner could show a blocking “No Network Connection” dialog while its server footer correctly said Connected. The shared legacy callback used one Boolean for multiple networks; losing either network incorrectly marked all connectivity unavailable. It now tracks network handles, with two regression tests that fail against the old logic. Scanner hosts opt out of the legacy internet-presence modal and use the existing server reachability footer; server authentication and device approval are unchanged. All 28 JVM tests and six native API35 instrumentation tests passed, lint has zero errors/six warnings, and the replacement APK was installed without clearing app data. Scanner activity and its existing session were restored after tests.
|
||||
|
||||
The local AVD is configured for host NVIDIA graphics (`hw.gpu.enabled=yes`, `hw.gpu.mode=host`), with the previous config backed up under the user's cache. Reopening with `-gpu host -no-snapshot` and restoring adb reverse showed Home frame percentiles of 16/17/18 ms (50th/90th/99th) and scanner 19/22/48 ms. These are post-restart observations, not a controlled before/after benchmark; the original slow process had already exited. The actual previous renderer had used the GPU despite the saved AVD setting, so disabled GPU is not established as the root cause. The admin browser is open at the demo login on port57832.
|
||||
|
||||
2026-10-29 verification: all 26 JVM tests passed, lint reported zero errors/six warnings, and the debug APK assembled successfully. Runtime diagnostics now include sanitized native API and device-request outcomes, in addition to branding and heartbeat events. Android 15 system-bar insets were corrected after emulator inspection. The shared mobile library now declares its connectivity permission for all consumers. Login copy uses a neutral title beneath the customer branding. CI APK artifacts include their own `SHA256SUMS`; local builds can be hashed with `Get-FileHash`.
|
||||
|
||||
Repository implementation is published for review in [PR #8](https://github.com/QRun-IO/qqq-android/pull/8); it has not been merged or released. The branding/diagnostics commit `a5621c5` passed all hosted CircleCI, scanner build and CodeQL checks. The optional manually dispatched hosted emulator lane was skipped; local native emulator tests passed. The companion qbit is published at https://github.com/QRun-IO/qbit-mobile-scanners, with all hosted server/CodeQL/demo checks passing and protected branches/security settings enabled.
|
||||
|
||||
Final-APK acceptance passed: six native UI tests, safe Android 15 header insets, customer branding, neutral login text, diagnostic panel and Connected → Disconnected → Connected recovery. APK SHA256: `A25451EA7A1360474428F1B806134DDFD059190FB99E81B4F69E720808C3209C`. The visible API35 emulator is left at login with `http://127.0.0.1:8080/` forwarded to host demo port57832. No credentials were entered or scans submitted through the emulator; the full operator/approval/capture walkthrough and physical TC22 remain pending. The server HTTP acceptance suite separately verifies the complete authorization/capture flow.
|
||||
|
||||
Earlier implementation records follow; the publication and emulator statements above supersede their original pending status.
|
||||
|
||||
Runtime branding and diagnostics added: public server metadata supplies display name, primary color, and an optional HTTPS logo; malformed/missing metadata uses QQQ defaults and server changes reset presentation. A persistent foreground connection footer checks the public status endpoint, with bounded credential-free diagnostics Copy/Clear. Shared top-bar colors now use the matching Material foreground role and its connectivity callback is disposed correctly. Branding/status protocol, isolation, malformed input, response redaction, and log bounds have JVM regression tests. Validation passed: full 23 JVM tests (core12, mobileapp4, scanner7), debug APK assembly, and lint with zero errors / six warnings. The new APK SHA256 is F388AF488688DE87811FE32C94D07601DC3DD61ADAC139069ADCFA627E21D01C. Updated emulator UI acceptance is pending.
|
||||
|
||||
Follow-up: diagnostics now also collect fixed native QQQ/device request outcomes through an optional, exception-isolated observer (status and latency only). Added regression cases for HTTP errors, transport failure, observer exceptions, and category formatting. Emulator confirmed F388 branding/login/Connected footer/diagnostics; observed Android15 system-bar overlap corrected with safe-drawing insets. Final verification for these follow-ups is pending.
|
||||
|
||||
2026-10-29: Implementing QQQ Mobile scanner host and native host extensions. First target is Zebra TC22, online only. Backend companion is `qbit-mobile-scanners`; metadata-defined apps/processes remain the native execution model. Device approval is mandatory. Local demo uses QQQ TABLE_BASED auth on QQQ4.1.0-RC.20.
|
||||
|
||||
Implemented server selection, per-server enrollment credentials, approval gate, SCANNER widget DataWedge input, explicit same-event retry, native password login, host extension points, and removal of session/token logging from touched authentication paths. No commit or push.
|
||||
|
||||
Validation passed: 19 JVM tests (core12, mobileapp4, scanner3), debug APK assembly, APK signature verification, and lint with zero errors. Five lint warnings remain: three inherited Navigation custom-check compatibility warnings and two dependency/catalog notices. Real sanitized demo HTTP metadata/process/init fixtures deserialize through the native DTOs. Server logout, HttpOnly-cookie login, and per-origin header isolation have regression tests. Physical TC22 acceptance remains required.
|
||||
|
||||
Previous pre-branding debug APK SHA256: B3E160CE3279C369CEDB425AC6E777A2729CE8A2E430E7D6F46D35C6376F8214.
|
||||
|
||||
Repository readiness added: pinned GitHub scanner tests/lint/APK artifacts and optional emulator workflow; CODEOWNERS, contribution/security/conduct guidance, issue/PR templates, Dependabot, changelog, editor/line-ending policy, and scoped agent instructions. `actionlint`, `shellcheck`, `shfmt`, and `git diff --check` passed. Upstream main `63fca89` was fast-forwarded and all implementation files restored without conflicts; the managed CircleCI Android profile and QRun-IO Maven registry updates are preserved. The full Gradle verification command passed again after reconciliation (16 executed tasks, remaining unchanged tasks up to date). Remote CI and emulator acceptance have not yet been recorded here.
|
||||
- Release qualification of the signed APK end to end (HTTPS server, enrollment, scan, navigation, update).
|
||||
- Actual on-device Authentik callback: unverified; no separate evidence, remains production qualification.
|
||||
- Dependency publication: the Generation, Record Files and Scripting owner inputs behind the local server are qualified inputs, not a fully public, reproducible or released cohort.
|
||||
- Company profile / MDM rollout: nothing applied or verified on a device ([DEVICE-PROVISIONING](DEVICE-PROVISIONING.md)).
|
||||
+25
-86
@@ -1,96 +1,35 @@
|
||||
# TODO
|
||||
# Checklist
|
||||
|
||||
- [x] Add metadata-driven Echo acknowledgment/manual-entry hints with old defaults; 167 JVM tests, strict compilation, lint zero errors/warnings and debug build pass.
|
||||
- [ ] Qualify native Echo setup/scan/print-acceptance/leave with the actual owner adapters and independently decoded physical output; source tests are not physical printing evidence.
|
||||
- [x] Verify Query artwork, Dogfooding/Query links and licenses on the normal TC22 About screen using filtered accessibility data.
|
||||
As of 2026-11-04, scanner host and local Echo scope only. Narrative: [SESSION-STATE](SESSION-STATE.md). Completed and superseded items are kept in [docs/history](history/README.md).
|
||||
|
||||
- [x] Apply scoped copyright/import/header/formatter corrections, mechanical CI gate and Kotlin warnings-as-errors;163JVM plus46TC22 sample native cases pass. See [review](CODING-STANDARDS-REVIEW-2026-11-01.md) for the remaining formatter CI limitation.
|
||||
- [x] Add Query artwork, app version, Dogfooding/Query links and license access under Settings → About QQQ Mobile.
|
||||
- [x] Qualify real Authentik desktop nonce rejection and retained-browser A → company logout → fresh B; actual Android callback acceptance remains separate.
|
||||
## Local demo (accepted)
|
||||
|
||||
- [ ] Resolve the explicitly retained [legacy source follow-ups](LEGACY-SOURCE-FOLLOWUPS.md): metadata typing, renderer contracts, navigation/action validation and build identity. Removing inline work markers does not implement these features.
|
||||
- [x] Application work merged to protected `main`; `.gitea/workflows/qrun-android-release.yaml` present.
|
||||
- [x] Local server on port 57832 (QQQ 4.1.0-RC.21, Printing 1.0, qualified owner inputs) running UI API 1.10, mobile 1.5, printing 2.3, record-files 1.0.
|
||||
- [x] TC22 on the development APK against that server; operator reported the outstanding manual acceptance group ALL PASS (2026-11-04), including label count/fidelity, camera, GPS and screen viewing; operator-reported, not instrumented or per-case evidence.
|
||||
- [x] Echo setup (printer, label size, document, copies 1–100) and semantic native flow qualified, with simulated inputs/printing in disposable runs.
|
||||
- [x] Real desktop Authentik acceptance with strict TLS.
|
||||
|
||||
- [x] Replace the raw diagnostics popup with tested full-screen status/activity, filtering, pause, copy/share/clear and Back; 159 client JVM tests, zero-warning lint/build and the focused TC22 diagnostics UI test pass.
|
||||
- [x] Default foreground location reporting on, preserving explicit opt-out and one-time Android permission behavior; settings/policy tests pass.
|
||||
- [x] Verify current trusted EMDK Code128, QR leading zeros and menu/reopen on installed checkpoint1c766bf/E34AC3C6.
|
||||
- [ ] Observe the diagnostics/location update on the normal package, grant/deny/restore location permission and verify an actual provider fix; keep physical lifecycle/outage/retry and provider acceptance gates open.
|
||||
## MC9400 remaining check
|
||||
|
||||
- [x] Verify the API1.10 original-nonce and optional company-logout client patch: 151 JVM tests, zero-warning lint/build and 28 disposable TC22 native authentication/lifecycle tests pass; independent 26-file source review completed with no findings.
|
||||
- [ ] Qualify the paired strict server policy and actual Authentik A-to-company-logout-to-B handoff, including the exported native callback and real SDK/browser logging boundary; synthetic native tests do not close this gate.
|
||||
- [x] Production-signed APK installed and launched on a fresh MC9400; hash read back.
|
||||
- [x] Switched to the TC22 development APK demo configuration at the user's request; signed in and approved (APPROVED).
|
||||
- [ ] Physical MC9400 trigger scan reaches the backend (Saved scan and a matching server record).
|
||||
|
||||
- [x] Verify current TC22 Code128 hardware trigger-to-save on the trusted EMDK path with operator Saved scan, matching backend source/model and distinct event identities; see [physical evidence](PHYSICAL-TC22-ACCEPTANCE.md).
|
||||
- [ ] Finish current EMDK leading-zero QR, repeat-intent, lifecycle/ownership and retry/leave acceptance; historical DataWedge scans do not qualify these checks.
|
||||
## Release qualification
|
||||
|
||||
- [x] Verify the synchronized rotation/recreation assertions in both5ba GitHub native runs; one entire run passed and the other reached a later fresh-login timeout.
|
||||
- [x] Verify final fresh-login readiness at229fce3 and the later portrait-default7de checkpoint: all eleven hosted checks pass, including native navigation/input, PixelCopy and semantic scenarios with a new session. QR documentation2e0fd962 does not qualify physical QR acceptance.
|
||||
- [x] Make portrait the default for missing/invalid preferences while preserving explicit choices; four focused tests, lint/debug assembly and preserving TC22 install pass, with actual requested portrait orientation confirmed.
|
||||
- [ ] Finish the operator walkthrough on the newly updated normal TC22 app; private data/enrollment and the development signing identity were preserved.
|
||||
- [x] Compile the opt-in screen-consent QA harness and ordinary E2E tests; verify early opt-in/protected-port safety gates. Actual permission/display acceptance remains open.
|
||||
- [x] Compile/review additive consent-based device-screen client and paired1.2 server:137 JVM, package/lint/APK inspection, ordinary-UID TC22 scan-input rejection,39 server/six demo/all15 browser cases and strict provenance pass. Actual projection acceptance remains separate.
|
||||
- [ ] Execute opt-in actual Android consent, notification, Home/background pixels, Stop, lease expiry, lock/rotation and forced-session-end acceptance on the refined device-screen candidate.
|
||||
- [x] Supersede the historical hosted Back/focus failure gate with all eleven passing checks at7de; retain the failed-job diagnostics and actual Back/focus regression requirements in history.
|
||||
- [x] Establish the current EMDK Code128 positive control after the historical failed attempt: eight priorF3AF events and oneC891 event are verified. Preserve the failed-attempt evidence and bounded operator stage; QR/lifecycle/retry acceptance remains open above.
|
||||
- [x] Resolve normal backend ownership and perform the reviewed API 1.9 upgrade with fresh backup, original-column/data checks, recovery logins and live account validation; preserve the operator APK. Private verification confirms two devices and three scans retained.
|
||||
- [x] Signed-APK/MDM channel chosen; QRun-owned key created with verified backup; signed 1.0.0 (versionCode 2) built and verified locally.
|
||||
- [x] Direct-install guide written ([INSTALLATION](INSTALLATION.md)).
|
||||
- [ ] Qualify the production-signed APK on a device against an HTTPS server (enrollment, scanner path, navigation, update).
|
||||
- [ ] First distribution to the remaining devices; MDM later. No tag or release exists.
|
||||
- [ ] Automatic signing/publication pipeline: not configured; owned by the shared CI design, not needed for manual distribution.
|
||||
- [ ] Actual on-device Authentik callback (unverified; no separate evidence).
|
||||
|
||||
- [x] Verify five client audit fixes: password/legacy callback origin binding, independent local Auth0 sign-out, sample release HTTPS and no-backup session storage. The batch passes 109 JVM tests and all 32 selected TC22 native cases; packaged release controls are inspected. See [review scope and evidence](SECURITY-REVIEW-2026-10-31.md).
|
||||
- [x] Verify the trusted scanner-ingress replacement with production-path ordinary-UID rejection and actual installed EMDK Code128 positive controls. Preserve the historical security report scope; this does not close the remaining physical lifecycle/QR matrix.
|
||||
- [x] Correct the demo's mixed RC.20 runtime and test-engine dependencies; qualify exact-source core `ecf0f550a0357cec6387c2b54efca128a405a629` with server `b14d925b741e815d1cfa4f62301f19207f25b03f`. Fresh37 server/five demo, strict provenance and all15 nullable-admin/session-monitor/browser cases pass. Core full closure:4,507 discovered/16 existing skips/zero failures/errors.
|
||||
- [x] Reverify hosted Back/focus behavior at7de with real Back injection and the focus guard; historical failures remain documented in session state.
|
||||
- [x] Qualify stable Auth03.0.0/Coil3.0.4, notice-generator incremental inputs and overlay/window-focus scan gating:127 JVM,34 shared TC22 cases, an additional eight-overlay native regression, ordinary-UID injection rejection and all package/lint/notice gates pass. See [candidate acceptance](TRUSTED-SCANNER-ACCEPTANCE.md).
|
||||
- [x] Resolve viewing scope through optional operator-consented DEVICE_SCREEN on mobile1.2 source, retaining default APP_CONTENT and old-server compatibility. Actual projection acceptance remains open; normal mobile1.1 runtime exposes app-content only.
|
||||
## Dependencies and provisioning
|
||||
|
||||
- [x] Verify the unconfirmed-scan exit correction: 46 mobile JVM tests and all 21 selected TC22 native cases pass, including failed cancellation and explicit Leave anyway with preserved receipt/retry identity and in-flight/photo guards.
|
||||
- [ ] Finish the operator walkthrough of the unconfirmed-scan exit correction on the normal scanner installation.
|
||||
- [ ] Public, reproducible publication of the Generation, Record Files and Scripting owner inputs (currently qualified inputs).
|
||||
- [ ] Company profile / EHS / OEMConfig / MDM deployment verified on a device ([DEVICE-PROVISIONING](DEVICE-PROVISIONING.md), [COMPANY-PROFILE](COMPANY-PROFILE.md)).
|
||||
- [ ] Legacy source follow-ups ([LEGACY-SOURCE-FOLLOWUPS](LEGACY-SOURCE-FOLLOWUPS.md)).
|
||||
- [ ] Extend the [native component boundary](UI-API.md) (possible values, record lists, specialized forms, reports) with conformance and E2E coverage as needed.
|
||||
|
||||
- [x] Qualify semantic OAuth2 client protocol/policy and generated notices; all seven synthetic browser-result cases and the selected native navigation suite passed on TC22. See [acceptance evidence](NATIVE-AUTH-ACCEPTANCE.md).
|
||||
- [ ] Complete actual configured Authentik acceptance: real browser/exported-callback round trip, authorization rotation/process death, and next-operator switching with prior browser SSO. See [authentication deployment](AUTHENTICATION.md).
|
||||
- [x] Verify the single hamburger drawer correction: no duplicate Apps/Switch app controls, fixed Settings/Diagnostics, signed-out gating, drawer Back preserving drafts, and guarded Home/app switching with exactly one cancellation.
|
||||
|
||||
- [x] Verify persisted device Orientation choices on TC22, including process draft and pending-photo preservation across rotation.
|
||||
|
||||
- [x] Implement and verify [navigation UX](NAVIGATION-UX.md): primary Apps/app/process navigation, secondary Account/Settings/diagnostics, shared Back/leave policy, protected in-flight operations and sign-out lifecycle.
|
||||
- [x] Prepare independent scanner release workflow and environment-only signing/version configuration; actionlint passes.
|
||||
- [x] Independently review the exact release workflow, reusable verification and Gradle signing configuration; see [review scope and hashes](RELEASE-AUTOMATION-REVIEW.md). No actionable source finding; external protection settings are not verified by this review.
|
||||
- [ ] Configure reviewed GitHub release protections and the organization signing identity, verify the actual signed APK and upgrade/migration, and publish only after all [release prerequisites](RELEASING.md) pass. Signing/distribution remains owner-deferred until the final step.
|
||||
|
||||
- [x] Correct false legacy network blocking while the scanner's server is reachable; preserve multi-network connectivity for shared clients.
|
||||
- [x] Persist workstation host-GPU configuration and document cold-start commands.
|
||||
|
||||
- [x] Add runtime server branding and a foreground connection footer with bounded sanitized diagnostics.
|
||||
- [x] Verify customer header/theme, diagnostics and connection loss/recovery on the emulator.
|
||||
- [ ] Verify customer-specific logo assets and physical TC22 appearance.
|
||||
|
||||
- [x] Complete Gradle unit tests, debug APK, signature, and lint verification (26 tests; zero lint errors).
|
||||
- [ ] Complete the current EMDK physical matrix: QR, lifecycle/ownership, retry/revocation, bad credentials, sign-out and re-login. The completed DataWedge checks below are historical and do not qualify current EMDK behavior.
|
||||
- [x] Verify TC22 physical Code128 and QR triggers through DataWedge intent output, visible Saved scan, preserved leading-zero QR data and independently inspected backend provenance; two Code128 triggers plus one QR trigger produced exactly three records.
|
||||
- [ ] Verify release APK signing/distribution separately; current deliverable is a debug APK.
|
||||
- [x] Reconcile exact historical project-owned source license boilerplate and the IDE template with the existing Apache-2.0 migration; preserve copyright ownership and other notices.
|
||||
- [ ] Verify third-party asset/dependency attribution and signed release/upgrade delivery before production distribution.
|
||||
- [ ] Configure and test production identity-provider integration; TABLE_BASED remains supported, and native OAuth2 requires explicit server advertisement and callback registration.
|
||||
- [x] Implement public `/qqq/v1/version` compatibility checks before credentials or native screens, including required features and the registered mobile-scanners extension.
|
||||
- [x] Implement semantic process completion, field/step updates, editable/view forms, backend cancellation and explicit unsupported-component blocking.
|
||||
- [x] Verify semantic migration JVM suites: 53 tests passed (core 21/mobileapp 23/scanner 9), including hidden fields, explicit null clearing, generic event ID isolation and completion when the server omits `nextStep`.
|
||||
- [x] Verify companion browser E2E after the semantic migration: six scenarios passed in 2.9 minutes.
|
||||
- [x] Require Android client-channel discovery; companion real HTTP tests use the Android header on every request and pass.
|
||||
- [x] Complete final JVM/lint/build verification of this semantic API migration: 53 tests, zero lint errors/six warnings, normal debug and isolated E2E/test APKs.
|
||||
- [x] Verify all six native scenarios across focused runs and the OpenAPI request audit: incompatible core, missing extension, missing Android channel, baseline/additive scans and native administrative forms.
|
||||
- [x] Identify the TC22 through ADB, authorize USB debugging, install the latest normal APK with login/enrollment preserved, approve its device record and open native Scan Capture with Connected status. Initial Code128 decoding passed; the remaining physical matrix is still pending.
|
||||
- [ ] Extend the [documented native component boundary](UI-API.md) with remote possible values, record lists, specialized forms and table/report/download screens as required; add conformance and rendered E2E coverage for each new capability.
|
||||
|
||||
Offline queue/background synchronization is deliberately outside version one.
|
||||
- [x] Implement semantic mobile session activity, server termination, demand-based own-app screen viewing and optional foreground location.
|
||||
- [x] Add capture lifetime/lease/race tests, complete scanner receipt checks, strict maxLength and NavController regression coverage.
|
||||
- [x] Verify short-viewport login and focused long-form submission after IME Done and dismissal handling.
|
||||
- [x] Complete integrated session/native administrator termination E2E and all 12 shared TC22 navigation/input/account tests; local emulator remains closed.
|
||||
- [x] Freeze and review session/whole-device source within the documented security scopes and independent architecture A1–A11 closure. Final release revision/scope and external-runtime gates remain in the release ledger.
|
||||
- [x] Integrate camera/gallery with Record Files typed routes and guarded optional bridge fixture; synthetic native E2E verifies persisted receipt, rotation and forced-logout cleanup.
|
||||
- [ ] Complete actual camera-lens/operator acceptance after final runtime installation; synthetic activity results do not prove the OEM camera application flow.
|
||||
- [x] Supersede the October31 hosted checkpoint gate with all eleven passing hosted checks at7de; retain earlier revision-specific results as history.
|
||||
- [x] Verify the published push/PR native E2E lanes through the current7de hosted checkpoint; physical operator acceptance remains separate.
|
||||
- [x] Run the native sample instrumentation suite (six passed on API35).
|
||||
- [x] Add and run real-server scanner-host E2E: login, pending enrollment, approval, native app/process selection, manual scan persistence and revoked-device denial. Use an isolated app ID and database.
|
||||
- [x] Run and verify native real-server E2E on pushes and pull requests; current7de hosted checks pass.
|
||||
- [ ] Complete the final operator walkthrough on TC22 after updating the preserved demo/runtime, including outage/reconnect and real camera capture.
|
||||
|
||||
- [x] Implement named semantic process choices and qualify Echo native setup/two scans/rotation/Apps Leave onTC22 (169JVM,8guards,86documentedrequests; printing simulated).
|
||||
- [ ] Finish real Echo host/owner adapters, print a physical label and rescan exact value/type; then preserved-data demo upgrade.
|
||||
Offline queueing and background synchronization are outside version one.
|
||||
+1
-1
@@ -67,7 +67,7 @@ The approved, authenticated host sends foreground activity through the registere
|
||||
|
||||
An administrator viewing the ordinary QQQ session record renews a short screen-viewing lease through its standard widget. The host uses PixelCopy on its own app-content rectangle only, at most once per second, bounded to 640×1280 pixels and 256 KiB JPEG. No OS screen, other application or remote control is exposed. Capture requires the resumed, focused, approved authenticated screen, completed rendering and a live lease. Password screens, loading transitions, backgrounding and logout block capture and clear the server's displayed frame. Screen/session state is checked after capture and immediately before upload. Lease timing uses server-relative duration and Android's monotonic clock, not the handheld wall clock. Frames are not saved locally.
|
||||
|
||||
The operator sees a screen-viewing indicator and can stop viewing until they allow it again. Foreground location reporting defaults on when no saved choice exists; an explicit saved off choice is preserved. Settings exposes the reporting toggle, precise/approximate Android permission, provider availability and fix status. The host requests coarse and fine Android permission together once, on the first approved signed-in foreground session with reporting enabled. Denial never prevents scans or triggers repeated automatic prompts; Settings links to Android permission settings for recovery. Precise permission permits GPS updates, while approximate permission uses available network location. Device location providers must also be enabled; the reporting preference cannot turn on Android GPS. No background location permission is requested or background tracking performed. Updates stop outside approved signed-in foreground sessions or when reporting is disabled. Heartbeats report coordinates, accuracy and capture time only when a foreground fix exists; QQQ shows the age of the last known observation separately. Earlier clients stored no reporting preference, so a previously missing Android grant is not treated as an explicit reporting opt-out.
|
||||
The operator sees an informational screen-viewing indicator. The app provides no operator pause or stop controls; administrator viewing remains subject to server leases and authorization. Optional whole-device sharing still requires Android consent and honors system revocation. Foreground location reporting defaults on when no saved choice exists; an explicit saved off choice is preserved. Settings exposes the reporting toggle, precise/approximate Android permission, provider availability and fix status. The host requests coarse and fine Android permission together once, on the first approved signed-in foreground session with reporting enabled. Denial never prevents scans or triggers repeated automatic prompts; Settings links to Android permission settings for recovery. Precise permission permits GPS updates, while approximate permission uses available network location. Device location providers must also be enabled; the reporting preference cannot turn on Android GPS. No background location permission is requested or background tracking performed. Updates stop outside approved signed-in foreground sessions or when reporting is disabled. Heartbeats report coordinates, accuracy and capture time only when a foreground fix exists; QQQ shows the age of the last known observation separately. Earlier clients stored no reporting preference, so a previously missing Android grant is not treated as an explicit reporting opt-out.
|
||||
|
||||
## Record photos
|
||||
|
||||
|
||||
@@ -6,6 +6,8 @@ The app first requires the system's `com.symbol.emdk` shared library and enabled
|
||||
|
||||
## Lifecycle and process contract
|
||||
|
||||
When verified discovery for the current server advertises mobile-scanners 1.5 or newer within major 1, each capture can also send `rawDataBase64` and `aimIdentifier`. The EMDK callback encodes its exact `getRawData()` output once before returning; the immutable event survives HTTP retries unchanged. Older servers receive the legacy event fields. Raw input is bounded to 8192 bytes; null, empty or oversized raw input is omitted rather than truncated. These are SDK bytes, which may include framing, not a claim of original symbol codewords. Current hardware capture leaves AIM absent: no prefix inference or scanner configuration change is implemented. Decoder qualification and native raw-byte acceptance remain required for full Echo fidelity.
|
||||
|
||||
The adapter acquires the default scanner only while the server-defined SCANNER widget is visible and its Activity is resumed. HARD trigger reads are armed after IDLE, with one outstanding read. A decoded string is passed unchanged to the existing ScanEvent and semantic process submission, with its EMDK symbology and adapter-owned `zebra-emdk` source. New reads wait until the prior event is confirmed or explicitly abandoned by the existing process flow. Manual events remain `manual`. Neither source label is server-side attestation.
|
||||
|
||||
An IDLE callback with no pending read also rearms after a trigger release or timeout without a decode. If IDLE precedes the data callback, accepting that data blocks further input and cancels any read armed in between. A rapid pause/resume during an earlier asynchronous manager-open request can temporarily encounter the one-manager guard; **Reconnect scanner** retries explicitly after the prior manager has released. An unconfirmed release remains blocked until the app restarts.
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
> Historical record, superseded by [current status](../SESSION-STATE.md). Do not treat as current.
|
||||
|
||||
# Finish ledger for 1.0 (current: November 3, 2026)
|
||||
|
||||
Nothing here is a 1.0 release. History is in SESSION-STATE.md.
|
||||
|
||||
## Source published (not merged, not released)
|
||||
|
||||
- Android `f72b90d08cf29d2785cef1d5c5e7eeaf75f9afd2`: signed application code published in PR 10 (read back over SSH before this documentation update). Gitea CI 3480 succeeded: unit-test, device-test, package, secrets, gate. A clean git merge-tree with `main` b75fdac was verified; nothing was merged. Pull requests #8 and #10 remain open. This documentation update leaves runtime code unchanged.
|
||||
- Server `c0e27b36fd16c00eaca3451af3df43f4deedada1`: signed and published in Gitea PR 7, including the verified QQQ 4.1.0-RC.21 dependency update and Record Files test fix.
|
||||
- Generation copies: signed `aac68907e67906aeef4e0cd687d28bc98b738f8c` on `feature/echo-generation-copies` (base PR 343 head `8f473fa`), 13 paths, 21/21 manifest match, real PostgreSQL 17 migration passes. Owner integration and publication are not acknowledged.
|
||||
|
||||
## Implemented and installed (normal TC22 and local server 57832)
|
||||
|
||||
- APK `4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E`: same signer, no data clear. Connected, Apps/Settings, portrait, location on and the brand-only wallpaper preview were verified. No wallpaper or company profile was applied. The device shows Echo setup, Copies 1.
|
||||
- Server on 57832: UI API 1.10, mobile-scanners 1.5, printing 2.3, mobile-record-files 1.0, with the original database, accounts, approval and printer. Echo Copies per scan (default 1, range 1-100, one job per scan). Its core is not upgraded to RC.21.
|
||||
|
||||
## Tested
|
||||
|
||||
- Android: 222 JVM tests, lint 0 errors/0 warnings (2 info), debug/E2E/test APK builds, 23 Node tests, 255-file standards.
|
||||
- Disposable TC22 Echo ten stages, 109/109 semantic requests; inputs and printing are simulated.
|
||||
- Server RC.21 gate PASS: 377 unique tests (Generation 179, Printing bridge 16, scanner 53, demo 8, mobile Record Files 18, Echo 68, Echo demo 35), zero failures/errors/skips, Checkstyle PASS, plus 15 real admin-browser E2E on public RC.21. Earlier MySQL timeouts did not recur. Evidence: `C:/Users/james/.cache/qqq-rc21-copies-gate-076d059d8d0641d9a85874ec64008def/verified-summary.json`.
|
||||
- Honest scope: this is public core RC.21 plus qualified owner inputs. The Printing-bridge tests still resolve three private `pu507` libraries through the owner Printing POM, and other owner qbits are private inputs. It is not a fully public or released cohort.
|
||||
- Real Authentik desktop acceptance passes with strict TLS (nonce, A, logout, fresh B). The native harness is compiled with 8 launcher guards passing.
|
||||
|
||||
## Still open (none of these is claimed done)
|
||||
|
||||
- Generation: canonical owner integration, then public reproducible inputs for the owner qbits and a coherent published cohort.
|
||||
- Source: primary CI on the final source, merge, review completion and release.
|
||||
- Manual on the TC22 (operator remote): physical trigger, scan value/type, AIM, label count, rescan, photo capture/upload, GPS, projection, company profile/wallpaper deployment.
|
||||
- Native Authentik on the device: temporary CA installation, PIN interaction and the real callback. No trust bypass.
|
||||
- Signing and distribution: explicitly last, by user decision.
|
||||
|
||||
## Pointers
|
||||
|
||||
Runtime `C:/Users/james/.cache/qqq-local-all-qbits-current.txt`; native proof `scanner-host/build/native-device-e2e/echo-proof.json`; Generation handoff `C:/Users/james/.cache/qqq-generation-copies-handoff.md`; Authentik `docs/REAL-AUTHENTIK-ACCEPTANCE.md`.
|
||||
@@ -0,0 +1,7 @@
|
||||
# Historical status notes
|
||||
|
||||
These files are historical records, not current status. They preserve the rolling notes as they stood at the end of 2026-11-04, including statements that were later superseded (for example signing deferral, open pull requests, and a missing release workflow). For the current view see [status](../SESSION-STATE.md), [checklist](../TODO.md) and [finish ledger](../FINISH-1.0.md).
|
||||
|
||||
- [SESSION-STATE-through-2026-11-04.md](SESSION-STATE-through-2026-11-04.md): rolling session log, newest first.
|
||||
- [TODO-through-2026-11-04.md](TODO-through-2026-11-04.md): rolling checklist.
|
||||
- [FINISH-1.0-through-2026-11-03.md](FINISH-1.0-through-2026-11-03.md): November 3 finish ledger.
|
||||
@@ -0,0 +1,319 @@
|
||||
> Historical record, superseded by [current status](../SESSION-STATE.md). Do not treat as current.
|
||||
|
||||
## November 4 — production signing custody (current; supersedes the signing-deferral notes below)
|
||||
|
||||
The owner decided on signed-APK/MDM distribution with a new QRun-owned Android key, stored in a QRun vault in the owner's Personal 1Password account. Key alias `qqq-mobile-release`, PKCS12 RSA 4096, certificate SHA-256 `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF`, valid through 2056-10-27; app ID `io.qrun.mobile.scanner`. Backup recovery was verified 2026-11-04 (recovered file hash, keystore opened, certificate compared). Root built unsigned 1.0.0/versionCode 2 (`lintRelease` + `assembleRelease`: 0 errors, 0 warnings, 2 information) from source matching protected main `0ae2101f082c241ca6a70462dc9ec3057aa6c906` (only docs differ), then signed it in isolation with `apksigner` at 2026-11-04T16:22:05Z; the key was not passed to the application build. **Local signed artifact and verification are complete:** `QQQ-Mobile-1.0.0.apk`, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`; v2+v3 verify, exactly one signer with the certificate above, 16 KiB alignment pass, non-debuggable, app ID `io.qrun.mobile.scanner`. It is not installed, published or production-qualified; the development-signed TC22 install and data are intact. Remaining: qualification of the actual production-signed APK on a migrated or different device (normal device untouched), first distribution (needs an HTTPS server), and paused CI wiring. No Infisical/CI activation, no scanner release workflow, no tags; the shared CI hold is unchanged. Runtime app code is unchanged from main `0ae2101`; Android guide PR 12 is still open. The November 4 manual all-pass was for the development-signed build and is not requested again; it does not qualify the new signer. See [RELEASING.md](../RELEASING.md). Entries below, including the deferral of signing, are historical.
|
||||
|
||||
## November 4 — signing readiness documentation (historical)
|
||||
|
||||
[RELEASING.md](../RELEASING.md) was rewritten as concise Gitea-first release readiness. This documentation update has been checked against the actual Gradle configuration and Gitea caller. No keys, secrets, tags, releases, CI, build or source were changed. Central main Android lifecycle 3634 passed and published SDK AARs but is not a scanner-APK signing pipeline. Local Gradle signing via `SCANNER_KEYSTORE`/`SCANNER_STORE_PASSWORD`/`SCANNER_KEY_ALIAS`/`SCANNER_KEY_PASSWORD` exists; release builds are unsigned without them. Production signing still needs the owner's channel decision (direct/MDM vs Play), an organization-owned key with secure storage and a backup owner, and signed-APK device acceptance. The operator reported manual acceptance all-pass on November 4; the last recorded installed build was development-signed. Signing/distribution remains last; older entries below are historical.
|
||||
|
||||
## November 3 — verified widget-state reset fix
|
||||
|
||||
`ProcessViewModel.reset()` now clears `widgetState` so last scanner feedback no longer carries into a new run. The regression proves ordinary step updates retain feedback and reset clears it. Root verified all 57 mobileapp JVM tests (zero failures/errors/skips), scanner lint (zero errors/warnings), debug APK assembly and the 255-file standards gate. Prior head `9cf789c` passed hosted CI3553 in 16m22s; this fix still needs its own hosted checks and normal PR10 → PR8 → main integration. The installed APK and manual acceptance are separate gates; signing/distribution remains deferred.
|
||||
|
||||
## November 3 — current checkpoint (verified; supersedes all older entries below)
|
||||
|
||||
- **Source:** `f72b90d08cf29d2785cef1d5c5e7eeaf75f9afd2` is the signed application-code commit published in PR 10, independently read back over SSH before this documentation update. Gitea CI 3480 **succeeded** on it (unit-test, device-test, package, secrets and gate; root read the UI). Root also verified a clean git merge-tree of `f72b90d` with actual `main` b75fdac and merged nothing. Pull requests #8 and #10 remain open; no 1.0 is released. This documentation update leaves runtime code unchanged from CI-passing `f72b90d`.
|
||||
- **Installed:** the updated normal APK `4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E` is installed with the same signer and no data clear. Connected, Apps/Settings, portrait, location on and the brand-only system wallpaper preview were verified. No wallpaper or company profile was applied.
|
||||
- **Fresh verification:** 222 JVM tests, lint 0 errors/0 warnings (2 info), APK builds, 23 Node tests, 255-file source standards pass. A fresh disposable TC22 Echo ten-stage run passed 109/109 semantic requests (simulated inputs and printing).
|
||||
- **Authentik:** fresh real desktop acceptance passes (nonce rejection, A login, logout with old-cookie replay rejected, fresh B without clearing cookies, logout) against the same isolated TLS fixture. The opt-in native harness is integrated and compiled, and its 8 launcher guards pass; the on-device run still needs the temporary CA and PIN interaction. No trust bypass. The normal server on 57832 is unchanged and ready.
|
||||
- **Server side:** server `45f9cbd` is signed and pushed (Gitea PR 7); the public QQQ 4.1.0-RC.21 source update is prepared for the next signed commit. The final RC.21 gate passed: 377 unique tests (Generation 179, Printing bridge 16, scanner 53, demo 8, mobile Record Files 18, Echo 68, Echo demo 35), zero failures/errors/skips, Checkstyle PASS, plus 15 real admin-browser E2E on public RC.21; the earlier MySQL timeouts did not recur. This is public core RC.21 with qualified owner inputs (three private `pu507` libraries still resolve through the owner Printing POM), not a fully public or released cohort. The normal runtime core was not upgraded.
|
||||
- **Still open (not claimed):** Generation canonical owner integration and public reproducible owner inputs; primary source CI, merge and release; manual TC22 trigger, value/type, AIM, label count, rescan, photo, GPS, projection and profile checks (operator remote); native Authentik CA, PIN and callback; signing/distribution, explicitly last. The normal TC22 shows Echo setup, Copies 1, Connected.
|
||||
|
||||
## November 3 — final client installed; Authentik harness integrated (earlier; superseded by the checkpoint above)
|
||||
|
||||
The verified debug APK 4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E is installed on the normal TC22 with the same signer and install -r. Existing sign-in, device approval and Connected status survived. Navigation, portrait setting, foreground-location toggle and the brand-only system wallpaper preview were verified; wallpaper was not applied. Feedback, managed configuration and AIM code are now installed, with physical trigger/fidelity still unqualified.
|
||||
|
||||
Fresh verification passes 222 JVM tests, lint zero errors/warnings, debug/E2E/test APK builds, 23 Node tests and the 255-file source standard check. The updated disposable TC22 Echo suite passed all ten stages with every request matching semantic operations; simulated input/printing only. The actual Authentik desktop test passed again on November 3 with strict TLS: nonce rejection, operator A, company logout, old-cookie rejection and fresh operator B. The opt-in real Authentik Android harness is now in the repository and compiles; native execution awaits temporary CA installation/device interaction. No normal app/server trust change was made.
|
||||
|
||||
Echo server source is signed and published at 45f9cbd in Gitea PR7. Generation copies now has an isolated canonical Git integration, with additive PostgreSQL migration verified on real PostgreSQL17. Shared source/dependency publication and hosted CI remain separate gates; no production 1.0 release or physical print claim. Earlier installed-APK/uncompiled-harness notes below are historical.
|
||||
|
||||
## November 2 — Echo copies live and native acceptance complete
|
||||
|
||||
Echo setup now exposes optional **Copies per scan**, default 1, range 1–100. The server pins it for the run and submits one job with that copy count for each scan. The normal TC22 is connected and left on the fresh setup screen showing 1. Its installed APK remains D8109C61E71660D2195337DA988F7F692CC4A0DBE95F61230930D6549CAB4D9B; no client upgrade was needed for this generic semantic field.
|
||||
|
||||
Disposable TC22 Echo acceptance passed ten stages and 116/116 documented requests, including default 1, rejecting 0/101, selected 3 across two scans, recreation and Apps/Leave. Inputs and printing are simulated; physical label count is unconfirmed. The combined source passes 222 JVM tests, lint with zero errors/warnings, APK compilation and 15 Node tests. New scan-feedback, managed-profile/wallpaper and AIM source is not installed on the normal app.
|
||||
|
||||
The existing local server on port 57832 now advertises mobile-scanners 1.5 and mobile-record-files 1.0, retaining the original database, approval, accounts and printer settings. Server/owner gates passed 377 unique tests across the qualified module runs. Generation copies changes remain in the isolated owner handoff, awaiting canonical adoption/publication. Physical trigger/print/rescan, camera/GPS/projection and native Authentik remain open; the operator is remote and temporary CA installation is unconfirmed. Signing/distribution stays last. Older checkpoints below are historical; see FINISH-1.0.md for the current ledger.
|
||||
|
||||
## November 2 — administrator viewing controls
|
||||
|
||||
Removed app-authored Stop viewing / Allow viewing, Stop device screen sharing and the custom notification Stop sharing action. The visible indicator, Android consent/system revocation, password/lifecycle guards, server authorization and lease expiry remain unchanged. The existing native regression verifies an informational non-clickable indicator with no stop/allow buttons, continued JPEG frames after resume, background frame clearing, administrator session termination and fresh login.
|
||||
|
||||
Verification: 185 JVM tests (44 core, 56 mobileapp, 85 host), eight Node guard tests, lint zero errors/warnings (two existing informational hints), debug/QA/test APK builds, and the real TC22 session-monitor scenario passed; all 112 native requests matched published semantic operations. The disposable QA packages were removed. Whole-device Android consent was not rerun for this UI removal.
|
||||
|
||||
Installed the verified debug APK D8109C61E71660D2195337DA988F7F692CC4A0DBE95F61230930D6549CAB4D9B on the normal TC22 with install -r and no data clear. The process restart required sign-in; restored the existing scanner account and verified Connected, the Echo catalog entry and existing approval. Local server57832 remains HTTP200 and the print service remains Running. This APK also contains the previously verified optional raw-scan metadata client, gated off against the unchanged installed mobile1.4 server. Existing unrelated source/test changes are preserved. No commits, publication or broader release work resumed for this scoped request.
|
||||
|
||||
## November 2 — current checkpoint
|
||||
|
||||
Source candidate: immutable `ScannerCapture` retains SDK raw bytes as canonical Base64 before the callback returns and routes them through the ordinary semantic process payload. New optional fields are sent only after same-server discovery advertises mobile-scanners >=1.5,<2; older servers still receive the five legacy keys. Barcode text and symbology remain unchanged, scan/capture string representations are redacted, and a failed-submit regression proves the entire event is resent unchanged. Verification passes 185 JVM tests (44 core, 56 mobileapp, 85 host), lint with zero errors/warnings (two existing informational hints), debug/E2E APK builds and QA Android-test compilation. New native tests and operator installation have not run. The SDK configuration is unchanged and AIM extraction is not implemented by this transport slice.
|
||||
|
||||
Completed and verified:
|
||||
|
||||
- Android source `fb3cc5d` is signed and published as Gitea PR 10. It passes 174 JVM tests (44 core, 55 mobileapp, 75 host), lint with zero errors and zero warnings, and the debug APK build.
|
||||
- The native `SameOriginInterceptor` fixes the cookie-bearing heartbeat that returned 403. The server's same-origin guard is not weakened.
|
||||
- The normal TC22 installation was updated without clearing data. Existing login and device approval, heartbeat, the real print client's printer, fresh 4x1 media and published document selection, and Cancel then Leave all work against the one local server.
|
||||
- That server is one QQQ demo on host port 57832. It runs Mobile Scanners/Echo, Collaboration/Record Files, Document Generation and Printing (API 1.10.0, mobile 1.4.0, printing 2.3.0). On this workstation, device port 8080 forwards to host port 57832. The original accounts, enrollment and approval are retained.
|
||||
- The Printing owner has aligned the loaded 4x1 stock (101600 x 25400 microns at 300 dpi) and updated the real media revision. A real Echo 4x1 barcode document is published. The TC22 selected the actual printer, the fresh 4x1 media and that document, and Next succeeded and shows Scanner ready and Connected.
|
||||
- The emulator is off because it stalls this workstation. Do not restart it automatically.
|
||||
|
||||
Not yet done:
|
||||
|
||||
- No physical Echo print or rescan has been proven. One separate synthetic HTTP Echo event reached the actual Windows spooler; physical paper and handheld print/rescan remain unconfirmed. One physical scan of QQQ-TEST-123456 has been requested from the user.
|
||||
- Still open for 1.0: physical Code128 and leading-zero QR scan, print and rescan; full provider, camera, GPS, projection and device qualification; public coherent artifacts; primary Gitea CI; and final signing and distribution. Signing is deliberately last, by the user's decision. The first demo working does not collapse these requirements, and nothing here claims release readiness.
|
||||
- Core native API merge continuation PR 1337 (a42f9e5) was reviewed with no actionable conflict regression and its 57 focused tests were verified. Normal CI and publication are not established, and default dependencies are not repinned.
|
||||
|
||||
The entries below are historical. Where they describe the printer media report, the 4x1 document or the same-origin fix as pending, this checkpoint supersedes them.
|
||||
|
||||
## November 2 — native cookie Origin compatibility verified on TC22
|
||||
|
||||
The combined Echo Demo on57832 (reached through device port8080) returned200 for login, then403 for the cookie-bearing session heartbeat POST, because Android's native QQQ requests omitted `Origin`. The server's same-origin guard remains enforced. Core now has a small `SameOriginInterceptor`: it sets `Origin` from the actual request URL's canonical scheme/host/port only (default ports omitted, IPv6 bracketed, never credentials/input/headers) and is installed last so additional headers cannot override it. It is used by `NetworkQQQRepository` and the `DeviceApi`, `MobileSessionApi` and `RecordFilesApi` clients. Version discovery, presentation/logo fetches, OIDC/browser/token requests and redirect refusal are unchanged.
|
||||
|
||||
All174 JVM tests passed (44core/55mobileapp/75host), with zero failures/errors/skips. Lint has zero errors/warnings and two existing informational hints; debug APK build passed. MockWebServer tests cover exact Origin plus cookie on real POSTs, canonicalization, override resistance and redirect non-forwarding. Session and record-file host tests assert the header on their actual requests.
|
||||
|
||||
The verified APK (SHA256 `0B872005B2FA84F693E73CC49133F5C1C02F732A034AA0635A2B50682A61A98E`) was installed on the normal TC22 without clearing its data. Existing scanner login and device approval work against the actual combined server; heartbeat remains connected. Echo opens its three required choices, the approved printer and its reported media load, and Cancel -> Leave returns to the app normally. This directly qualifies setup/session/cancel against the strict host, not a physical print. The earlier112-request/two-synthetic-scan acceptance remains separate. (Superseded: the printing owner has since reported the 4x1 media and the 4x1 document is published; see the current checkpoint above. Physical printing is still unproven.) Emulator stays off.
|
||||
|
||||
## November 1 — required Document choice verified on the real TC22
|
||||
|
||||
Echo asks for printer, paper/label size and Document once; all subsequent scans use those server-pinned choices. Android production code is unchanged: the generic semantic INTEGER/PVS/dependency controls handle it. The updated separate E2E app passed all7 stages on the actual TC22 (select Document, clear stale choices on parent change, validate required fields, queue two scans, recreate without duplication, Apps/Leave/CLOSED). All112 requests matched published semantic operations. Disposable app/reverse/fixture cleanup passed, normal app/data preserved, emulator off. Printing and scanner inputs are simulated; physicalScannerQualified/physicalPrintingQualified remain false.
|
||||
|
||||
Verification:99 focused/host JVM tests,8 Node guards, zero lint errors/warnings and both disposable APKs compiled; after a test-only fixed-footer click correction, the actual TC22 acceptance passed. Companion server source8da274e is signed/pushed with45 library and24 composed demo tests passing. Private live server53118 still has header fix101efc8 pending document-choice rollout; real printer pairing retry awaits the current Windows consent. Installed normal APK324227CC... remains sourcea2f0080, whose production code is identical to this test-only change. Full physical/provider/camera/GPS/projection/public artifact/signing gates remain open.
|
||||
## November 1 — Echo native semantic choices verified on TC22
|
||||
|
||||
Claude implemented named process possible values using the actual published `searchProcessPossibleValues` JSON contract, dependent-field metadata, cancellation/error/retry and stale-response rejection. The unchanged Echo fixture now completes login, enrollment/approval, printer/media selection once, two accepted synthetic scans, rotation/recreation without duplicates, and Apps/Leave closing the run on the real TC22. All86observed requests matched published semantic operations. Disposable-package cleanup passed; normal package/data and real printers were preserved.
|
||||
|
||||
Validation:169JVMtests,8Nodeguards,236-file source standards, zero lint errors/warnings and bothE2EAPKs pass. This is simulated printing, not EMDK or physical output qualification. The remaining immediate blocker is the real Generation/Printing adapter and template/host composition, followed by physical print/rescan. Normal installed APK remains625a275; normal server API1.9/mobile1.1. Production signing remains deferred.
|
||||
# Session state
|
||||
|
||||
## Echo semantic presentation source checkpoint
|
||||
|
||||
The optional extension 1.4 acknowledgmentLabel and manualEntryEnabled hints are published on feature/echo-scanner-presentation (draft PR9). Existing defaults remain Saved scan/manual enabled; Echo uses Print queued/manual disabled. Strict compilation, 167 JVM cases, lint zero errors/warnings and debug assembly pass. Hardware, lifecycle and receipt predicates are unchanged. The server companion passes 69 consumer cases plus two contract cases; the optional Echo module passes 15 strict QQQ/H2 tests.
|
||||
|
||||
The normal TC22 remains the separately installed 625a275 build (APK AF13778A…3E9216), preserving sign-in/data. Its About screen was opened and Query artwork, both public links and licenses verified through filtered accessibility data. New Echo-native UI/actual owner adapters/physical printing remain unqualified; printing and document/scripting owners have acknowledged their implementation lanes. The running normal server remains API1.9/mobile1.1. Production signing/distribution stays the owner's final step.
|
||||
|
||||
## November 1 standards fixes and About update
|
||||
|
||||
Applied the scoped standards review: copyright/SPDX, explicit imports, declaration headers, native official/three-space formatter profile, mechanical CI source gate and Kotlin warnings-as-errors. Strict compilation and163 JVM tests pass; all46 disposable sample native tests pass on TC22, and production QA instrumentation compiles. The native suite uses fixture providers; actual Android external-browser/provider acceptance remains separate. The existing formatter reports one unstable Gradle script and full formatter CI runner provisioning remains explicit in the review.
|
||||
|
||||
Settings → About QQQ Mobile now shows bundled Query artwork, app version, Dogfooding/Query public links and open-source licenses. The normal APK rebuild uses drawable-nodpi for the artwork. No credential/device parameters are added to website links. The preceding diagnostics/default-on GPS update remains installed until the preserving update recorded below; actual GPS fix is still open.
|
||||
|
||||
The real API1.10 Authentik desktop sequence now passes negative nonce rejection, A login, explicit company logout, old-cookie rejection, fresh B credentials/principal in the same retained browser context, and B local logout. Its provider-specific User Logout flow is required for company sign-out; default ordinary client logout stays local. Server0b53f34 is published and all8hosted checks pass. CorePR1369's exact architecture allow-list correction is being verified; full fresh core CI is not yet green.
|
||||
|
||||
## November 1 diagnostics and location update
|
||||
|
||||
Diagnostics now uses a full-screen, scrollable native view with a connection summary, local-time newest-first activity, All/Problems filters, pause/resume, copy/share/clear and Back. Existing footer and menu entry points still block process input while diagnostics is open. Location reporting defaults on for approved signed-in foreground sessions; Android grants remain required, explicit opt-out persists and automatic permission requests are not repeated after denial. Controls remain under Settings → Device permissions.
|
||||
|
||||
The combined client passes 159 JVM tests, zero-error/zero-warning debug lint, normal/E2E APK builds and the focused diagnostics interaction test on TC22 using the separate E2E package. The new UI/default policy still needs normal-package field observation. This does not establish a physical GPS fix, background tracking, real provider sign-out or production release readiness.
|
||||
|
||||
The preceding signed checkpoint1c766bf was installed in place as APK E34AC3C6…C1874EB with private backup, matching signer and no data clear. The operator and backend confirm one Code128 and one QR event on these bytes, including exact leading-zero value001234567890 from EMDK/QRCODE. Apps → menu → Scan Capture round trip was also confirmed. The normal server remains API1.9/mobile1.1; API1.10 core159 tests, current contract3 tests and coherent scanner/demo/files/browser78 cases pass separately while real Authentik acceptance continues.
|
||||
|
||||
## November 1 native authentication checkpoint
|
||||
|
||||
The optional company sign-out and original-nonce client changes pass 151 JVM tests, zero-error/zero-warning lint, debug assembly and native-test compilation. All 28 selected OAuth2 login/logout and authentication-lifecycle native tests also pass on the TC22 in the disposable sample application, with no failures or skips. The normal scanner package/data were preserved and its Activity is foreground again. These native tests use synthetic provider adapters; they do not establish real Authentik or external-browser acceptance.
|
||||
|
||||
Independent review covered all 26 implementation/test/documentation files in the frozen patch and found no security candidates (completed scan c358cde3-b51d-4451-b07d-8d1afe6c4485). This is a patch review, not a fresh audit of every unchanged file. Native OAuth now requires API1.10, the advertised nonce-validation feature and REQUIRED policy; TABLE authentication remains compatible. Company sign-out is separately advertised and explicitly selected; the automatic sign-out policy remains undecided.
|
||||
|
||||
The paired server changes and real A-to-company-logout-to-B acceptance remain in progress. Earlier real-provider testing established operator A and local QQQ invalidation, but retained browser SSO silently reused A; that failed handoff remains failed. This checkpoint is source publication, not a production release or installation of these bytes on the normal TC22 package. Signing/distribution remain the owner's final step. All historical entries below retain their original scope.
|
||||
|
||||
## November 1 status and visible QR fixture
|
||||
|
||||
All eleven hosted checks at portrait-default7de2b508 passed. Public QR fixture checkpoint2e0fd962 is signed and pushed; docs/TEST-BARCODES.md records independent ZXing decoding of001234567890. Physical QR acceptance is still pending. Normal TC22 APK C89161C…C6340 remains installed with portrait requested, and the backend now has nine trusted EMDK Code128 events (eight on prior F3AF and one after the portrait update).
|
||||
|
||||
Release1.0 remains incomplete: actual Authentik acceptance remains pending; the local TLS proxy correction is verified, and provider configuration returned a validation error under diagnosis; physical QR, camera/gallery, navigation/failure, projection and GPS acceptance remain open. Filesystem portability passes142 discovered/138 passed/four existing skips, and the separate RF HTTP consumer now passes18 cases on a transitional custom-filesystem tuple. This supersedes its earlier fixture-compilation failure; it does not establish immutable/default dependency adoption or change the normal API1.9/mobile1.1 runtime on57832. Signing/distribution remain last by owner instruction. Current summaries supersede dated open-state statements below without changing their historical evidence or sealed review scopes.
|
||||
|
||||
## November 1 portrait default installed; prior source fully green
|
||||
|
||||
The user requested portrait lock by default. Missing/invalid preferences now choose Portrait; all explicit saved choices remain available. Four focused policy tests, debug lint (zero errors/warnings) and debug assembly pass. Development APK C89161C…C6340 was installed in place after signer verification and a new private-data backup; no app data was cleared. Android reports the normal Activity resumed with SCREEN_ORIENTATION_PORTRAIT, and a direct screenshot confirms the signed-in Apps menu. Barcode/lifecycle acceptance of these new APK bytes remains pending; earlier F3AF physical evidence is preserved.
|
||||
|
||||
All eleven hosted checks at229fce3 passed, including both GitHub native runs (jobs124829276568/124828879619):35 shared cases, PixelCopy and all seven semantic scenarios. Logs show session-login-action-ready, session-fresh-login and the semantic request audit in both runs. Server documentation checkpoint2de8470 also passes all eight checks. Fresh checks will qualify the portrait-default source update. The operator confirmed the eight earlier Code128 events were deliberate trigger pulls. The QR was not visible in chat; a direct image link was supplied after unreliable browser automation, and current QR acceptance remains pending.
|
||||
|
||||
## November 1 physical EMDK positive control verified
|
||||
|
||||
The operator reported Saved scan on the normal F3AF development app. Direct ownership-guarded backend inspection verifies eight new Code128 records for QQQ-TEST-123456, source zebra-emdk, TC22 attribution and eight distinct event IDs. This closes the current trusted hardware positive-control gap for Code128 only. Operator confirmation of repeated trigger intent and the current leading-zero QR remain pending; [physical acceptance](../PHYSICAL-TC22-ACCEPTANCE.md) records exact APK/runtime and remaining lifecycle/retry/ownership gates. No normal app/data clear or QA run occurred.
|
||||
|
||||
Strict Firefox profile-only CA trust now passes issuer/hostname checks using the supported PLAYWRIGHT_FIREFOX_POLICIES_JSON entry point. Windows trust is unchanged; the earlier Windows-root approval question is obsolete. Actual provider startup/exchange remains unexecuted while an independently reviewed known-listener guard is prepared for genuine TIME_WAIT rows. Independent architecture closure of Android229/server2de reports no additional concrete source blocker and maps A1-A11 controls/tests; runtime/deployment/dependency/signing limits remain. Record Files compatibility now has a concrete exact-revision filesystem dependency gate in a new private cache; no frozen0515/default/runtime adoption occurred.
|
||||
|
||||
## November 1 native CI — rotation passes, fresh-login test readiness under correction
|
||||
|
||||
Android5ba PR run41297344726 passed:35 shared native cases, PixelCopy and all seven semantic scenarios, including session-monitor. The duplicate push run41297340376 also passed rotation/recreation/mirroring/administrator termination, then timed out waiting for Username after clicking Log back in. Its request audit shows completed Android logout200 and no second Android manageSession. Static review confirms that the test awaited only the label, which also renders while the logout action is disabled. This supports a test-readiness race; the failure artifact does not record the button state at the click, so no production cause is asserted. The correction waits for a final signed-out message and enabled action, asserts enabled and clicks once; it retains all fresh-login/session assertions. The opt-in device-screen test uses the same readiness requirement. Fresh native execution remains required.
|
||||
|
||||
Independent release automation review of three exact5ba files found no actionable source finding; [scope and hashes](../RELEASE-AUTOMATION-REVIEW.md) retain external-configuration limits. A separate API1.9/mobile1.2 backend-only smoke passed readiness and shutdown with private credentials removed. Its launcher initially failed closed on the Node shim PID; actual Node resolution corrected the helper, and the unsuccessful fixture also cleaned up. No TC22 QA test, ordinary-app cleanup or normal-server replacement occurred.
|
||||
|
||||
## November 1 TC22 walkthrough — reported disappearance investigated
|
||||
|
||||
After the operator reported that touching the handheld crashed or moved the app, direct ADB inspection found the normal scanner process alive and its Activity resumed/focused, with no crash-buffer entries. A direct screen capture showed the connected sign-in screen; the black desktop mirror was not reliable evidence of an app crash. Restored the existing scanner demo login using locally encrypted credentials, and a subsequent direct capture confirmed the Apps menu. Opened Scan Capture to resume the manual walkthrough. No production defect has been reproduced or fixed by this inspection; physical trigger/navigation acceptance remains pending. No QA instrumentation or app cleanup was launched over the operator's normal app.
|
||||
|
||||
## November 1 morning — normal app updated; native test correction pending hosted verification
|
||||
|
||||
The normal TC22 application is now updated in place to the reviewed development APK `F3AF638E…E9FAA`. Matching signing identity and a new owner-only private-data backup were verified; app data/enrollment were not cleared. Non-streaming installation completed and the normal process is running against the preserved API1.9/mobile1.1 demo. This supersedes older unchanged-normal-APK statements below. Operator login/navigation/scanning confirmation is pending; no production release is claimed.
|
||||
|
||||
Published `e04fdb2` passed CircleCI and CodeQL, but both GitHub native runs failed the same session test: it requested rotation then another Activity recreation without waiting for configuration convergence, and the barcode draft was empty. The test now waits for landscape/resumed configuration and asserts the draft after rotation and again after explicit recreation. This is a test synchronization correction awaiting native execution, not a demonstrated production draft fix. Physical barcode attempts separately hit a wrong expected value (operator confirmed the old test code), a transient focus assertion and an ADB timeout; none is a full hardware pass. Focus preconditions now wait briefly within the120second stage deadline, and install timeouts identify the operation.
|
||||
|
||||
The opt-in QA screen-consent harness, shared HTTP helpers and both QA/E2E test packages compile. Its early safety checks reject missing operator opt-in and both protected demo ports without device access. Actual consent/Home/Stop/expiry/end-session acceptance remains pending. The harness author stopped at the workspace agent-credit limit; root completed the compile corrections and continues directly. A real Authentik fixture is compiled with pinned images downloaded, but no services or OS trust changes have occurred; temporary Windows CA approval is still pending.
|
||||
|
||||
## November 1 — refined device-screen client and published paired server
|
||||
|
||||
The refined client passes137 JVM tests, all package/lint gates, fresh four-APK inspection and the TC22 ordinary-UID scan-ingress regression. Continuous image draining retains one latest buffer; repeated Share is blocked through service binding. Fresh independent follow-up review found no concrete issue. The source-pinned1.2 server `1041693` is published and passes39 server/six demo/all15 browser tests with strict195-JAR/2,441-class provenance in a cloned private Maven cache. Hosted client CI now targets that exact source. No actual projection consent/physical trigger is proved; the normal APK remains unchanged and its running demo remains qualified1.1. See [candidate scope and hashes](../DEVICE-SCREEN-ACCEPTANCE.md).
|
||||
|
||||
## November 1 — initial consent-based device-screen checkpoint
|
||||
|
||||
The optional device-screen client and paired1.2 server pass initial compilation and automated gates:135 Android JVM tests, lint/all package builds,39 server and six real-HTTP demo tests. Parent and fresh independent static review found no reportable client issue across the nine changed-file inventory; actual consent and projection behavior remain unverified. See [scope, hashes and remaining acceptance](../DEVICE-SCREEN-ACCEPTANCE.md). The normal operator APK and qualified1.1 demo remain separate. Frame freshness/binding refinements and final native acceptance are still required.
|
||||
|
||||
## November 1 — hosted Back focus failure and physical-trigger checkpoint
|
||||
|
||||
Published Android head `6845abc5289fa975e6f50b23b159c3131a82eee1` has a successful CodeQL check; not all CI is green. CircleCI android-test job 140 fails three NavigationTests before injecting Back: their Activity is resumed and the device is interactive/unlocked, but Activity/decor window focus stays false for five seconds. Both job attempts reproduce the failure. Retained JUnit contains no focused-window owner, so the cause is not yet established. Failure-only diagnostics now classify the focused window as own/system/other, report bounded own-window flags and the known network-dialog visibility; they retain the five-second focus requirement and actual Back injection. CircleCI unit job 141 passed. One GitHub native run failed and the other was still running at inspection; neither is claimed successful.
|
||||
|
||||
The physical QA attempt using APK hash prefix `CFFF` reached its first hardware-ready stage but recorded no acknowledged operator scan. A final near-deadline HTTP poll timed out; this is not physical scanner acceptance. Evidence is preserved under `C:/Users/james/.cache/qqq-tc22-physical-attempt-20261101-0210`; `physicalTriggerVerified` remains false. A separate, unqualified test follow-up is prepared to avoid sub-second status polls and label deadline failures without extending the 120-second stage bound. Its compilation is deferred until the concurrent scanner changes are ready; it is not part of this diagnostic checkpoint.
|
||||
|
||||
The earlier normal-server ownership hold is resolved. After correcting the CIM positive control, the owner completed the reviewed upgrade to the frozen `ecf`/`b14` API 1.9 / mobile-scanners 1.1 TABLE runtime. A fresh backup, original-column invariants, old-after-new recovery logins before and after stopping the predecessor, and live login/metadata/logout for both demo accounts passed. Two devices and three scans, including the leading-zero value, were preserved. Private evidence is retained in `C:/Users/james/.cache/qqq-normal-api19-002594902b1942bda2480c512ed644ab/normal-verification.json`. The normal operator APK remains unchanged. Further optional screen-capture source is under separate implementation; these diagnostic edits do not qualify it.
|
||||
|
||||
## October 31 — published client checkpoint and probe target clarity
|
||||
|
||||
Signed client checkpoint `d316567` is published to existing draftPR8 and the clean canonical feature checkout is fast-forwarded to it. Fresh hosted checks found two CodeQL intent-redirection annotations in the separate permissionless test probe. Inline static triage at that exact revision classified both as not actionable: the exact QA/E2E package allowlist dominates both fixed-action broadcast sends, no arbitrary activity/service is launched, and the probe adds no sender authority. No alert was dismissed or completed audit rewritten. The probe now maps accepted requests to explicit final package literals rather than forwarding even the validated caller string. Probe-only build/lint and repeated ordinary-UID eight-forgery/manual-positive acceptance pass; production APK hashes are unchanged. Publish this source clarity follow-up and inspect fresh CodeQL/client checks before release. Physical trigger and whole-handheld viewing scope questions remain pending.
|
||||
|
||||
## October 31 — final SDK/navigation candidate verified for publication
|
||||
|
||||
All three Android Back handlers and the toolbar arrow now use one live Main-owned drawer-first action, preserving standalone fallbacks. The native regression first proved a real process-level bypass opening Leave behind the drawer; the corrected case passes with one actual Android Back, preserved process/draft and zero cancellations. It also covers seven other overlay/focus gates. Current source passes127 JVM tests,34 TC22 shared cases in115.717s and the additional overlay case in17.948s. A distinct-signer ordinary-UID test passes against the exact current QA APK: eight forged broadcasts cause zero extra process steps/records, while a manual positive control saves through the real API. Actual physical trigger proof is still false/pending; the barcode-visibility question is unanswered.
|
||||
|
||||
All four APKs pass fresh DEX, manifest, native-hash and packaged-notice inspection. Independent review of the final SDK/navigation patch found no concrete defects requiring changes. See [exact hashes and evidence boundaries](../TRUSTED-SCANNER-ACCEPTANCE.md). The final code is ready for an explicitly authorized signed source checkpoint; hosted client checks must run after publication. Coreecf has18 hosted successes and published serverbf174a6 has8. New whole-handheld viewing scope clarification is pending; current capture is QQQ Mobile only. Normal operator app/server and emulator remain unchanged by these tests.
|
||||
|
||||
## October 31 — coherent backend accepted and published; final Android gate running
|
||||
|
||||
The owner explicitly authorized signed commits and publication after automatic review required direct commit approval. Core `ecf0f550` is published to draftPR1334. Server code `b14d925` plus acceptance documentation `bf174a6` is published to draftPR6. Fresh37 server/five demo tests, strict runtime provenance (195 JARs/2,440 unique QQQ classes/zero duplicates, Guava33.7.2-jre/H2 2.2.224), actual API1.9/mobile1.1 discovery and all15 browser tests pass. The normal operator runtime remains unchanged. Hosted checks are running; one Windows job failed to download PSScriptAnalyzer before project analysis and received one scoped retry.
|
||||
|
||||
The trusted scanner now also blocks physical input behind drawer/Settings/Diagnostics/Account/leave overlays and lost window focus, with a live callback guard. Two new coordinator tests and one production-widget QA native regression are added. Auth0 stable3.0.0 and Coil3.0.4 replace inherited prereleases; two native raster/SVG/error rendering cases are added. These source changes require the new combined build and device run. The first build correctly rejected stale notices: AboutLibraries10.9.2 did not declare its dependency graph as an incremental input. A lazy resolved-coordinate input now invalidates its standard generator; strict license/version gates remain enabled. The combined gate is running again. Earlier APK hashes and hardware evidence do not qualify these changes.
|
||||
|
||||
## October 31 — trusted scanning packages verified; runtime provenance caught a mixed dependency
|
||||
|
||||
The approved optional EMDK implementation passes all 49 scanner JVM tests, debug/release lint, debug/unsigned-release/E2E assembly, and production-path QA/probe assembly. The separately signed adversarial probe has a verified distinct test certificate; its temporary private key was deleted. These results do not establish physical trigger or injection resistance: disposable TC22 acceptance is next, and the normal operator APK remains unchanged.
|
||||
|
||||
Exact-source core `ecf0f550a0357cec6387c2b54efca128a405a629` passes the full selected dependency closure: 4,507 tests discovered, zero failures/errors, 16 existing skips, plus the configured coverage/static gates. Scanner server `a8ed108` passes 37 tests and its demo passes five. Runtime provenance then correctly rejected an old RC.20 backend dependency in the demo classpath. Browser and QA fixture execution are held while the consumer dependency management is corrected; these test passes are not qualification of that mixed runtime. The verifier remains strict, and no shared artifact or normal server was replaced.
|
||||
|
||||
## October 31 final client audit and isolated integration follow-up
|
||||
|
||||
The owner explicitly accepted Zebra's EMDK terms and selected native trusted scanning. The optional adapter is now being implemented; the earlier 32-test result does not qualify that new hardware path. Wrapper checkpoint `7e0cbee` and the five verified client security fixes `df532ff` are signed local commits, not yet pushed. Core's local `331a99d` additionally pins patched Guava; its full selected dependency-closure suite and verification analyses are running in a fresh private repository. On Windows, only the inspected cosmetic shell coverage-summary execution is omitted because of quoting; actual coverage checks and static analyses remain enabled. Hosted Ubuntu retains that summary.
|
||||
|
||||
The completed remediation batch passes 109 JVM tests, scanner lint with zero errors/warnings, debug/native-test and unsigned sample release assembly. All 32 selected TC22 native cases pass in 117.325 seconds, including ten new authentication lifecycle tests. Actual packaged sample release controls deny cleartext and backup and include all ten cloud/transfer exclusions. Five audit fixes have regression evidence; trusted scan ingress remains open pending the separate EMDK license decision. The new debug APK `8c4d3886...c512a` is not installed over the operator app. See [the scoped review checkpoint](../SECURITY-REVIEW-2026-10-31.md).
|
||||
|
||||
The deep client audit completed and sealed against clean published `d1de0bf`, with one medium and five low findings. The medium finding is delayed password-session adoption after logout/server switch, including retained original-server models. Low findings cover sample release cleartext, failed Auth0 local sign-out, unauthenticated exported scan input, stale legacy Auth0 callbacks, and sample session backup. Source fixes are being prepared with delayed-response/provider and host regression tests; none is closed merely from editing source. Static coverage is partial, with external provider/server/dependency implementations and bundled binary implementation gaps excluded. Real configured Authentik and physical operator acceptance remain separate.
|
||||
|
||||
An isolated `fix/hosted-native-ci` checkout keeps this work separate from the audited source and installed operator app. Core draft PR #1334 publishes reviewed native API 1.9, credential-safe logging and explicit-null parser fixes at `00f6c49ef4c21bedb7c62ccad535bd6de1008948`. Focused source gates passed 154 tests with two pre-existing disabled cases, plus a separate 17-test null/HTTP gate. Server `a8ed108` canonical UTC migration passes 37 root and five demo tests and every hosted check.
|
||||
|
||||
A fresh private Maven repository and unique CI-only core version are qualifying the fixture from those exact commits; no shared artifacts or operator runtime are replaced. Hosted acceptance must include the nullable admin form and session-monitor scenarios. A failure-only focus diagnostic preserves the five-second guard and actual Back input; the cause of the hosted focus loss remains unproven.
|
||||
|
||||
## October 31 unconfirmed scan exit correction
|
||||
|
||||
The operator reported Leave process permanently disabled with “The last scan is not confirmed.” The existing JVM harness reproduced that settled missing receipts remained a hard navigation block. A new regression failed before the correction. Settled unconfirmed scans now show an explicit warning that they may already be saved; Stay retains the original retry event, while Leave process uses the existing server cancellation and clears the event after cancellation succeeds. Failed cancellation retains the event and exposes a separate, explicit Leave anyway choice that clears local state without another request; the dialog warns that the server process may still run and saved changes are not undone. Active requests and pending photos remain hard blockers, and receipt validation is unchanged. Added JVM guards/cancellation/fallback cases and a native lost-response/malformed-receipt/Stay/failed-cancellation/explicit-exit regression. Final bounded verification passed all 46 mobile JVM tests, scanner lint/debug APK and sample/test APK assembly in 18 seconds. The TC22 follow-up passed all 21 selected native cases in 53.482 seconds, including the new lost-response/failed-cancellation/explicit-exit case. The operator update is being coordinated separately; actual configured Authentik acceptance remains pending.
|
||||
|
||||
## October 31 navigation/authentication review checkpoint
|
||||
|
||||
The combined client checkpoint passed 102 JVM tests (26 core, 43 mobileapp, 33 scanner), scanner lint, debug/E2E APK assembly and native-test compilation. The final follow-up build passed in 1m3s (266 tasks, 34 executed). The TC22 rerun passed all 20 selected navigation/input/account/OAuth tests in 49.235 seconds, including all seven synthetic AppAuth cases. The first run exposed Back during drawer opening; the handler now also handles a drawer targeting Open, and the native helper waits for settled UI before hardware Back. [Native acceptance evidence](../NATIVE-AUTH-ACCEPTANCE.md) distinguishes real handheld execution from the simulated browser/provider. No actual Authentik sign-in is claimed. New hosted CI is required after publication.
|
||||
|
||||
Independent source review found no concrete defect in the native authentication/navigation patch; this is not final security or deployment clearance. [AppAuth package evidence](../third-party/APPAUTH-VERIFICATION.md) confirms 131 bundled entries, 126 external runtime dependencies, nine complete texts and unchanged eight native libraries in the inspected debug/E2E APKs. OAuth2 depends on the companion core UI API1.9 native-session contract, still pending publication/host adoption. TABLE_BASED remains usable on compatible API1.8 servers. Production signing/distribution and actual shared-operator/provider acceptance remain separate gates.
|
||||
|
||||
## October 31 semantic authentication — synthetic native acceptance passed
|
||||
|
||||
The combined source passes 102 JVM tests (core26/mobile43/scanner33), scanner lint and debug/E2E/test APK assembly. All seven synthetic native OAuth cases and the navigation/input/account suite passed on TC22 as described above. Generated notices contain 131 entries including AppAuth. The initial sandbox run stopped at the existing debug-key lock; scoped rerun preserved the key and completed successfully. Testing used the separate sample package; no emulator or normal operator installation was started for this checkpoint.
|
||||
|
||||
The native descriptor now requires an advertised `prompt: "login"` policy, applied through AppAuth and bound to each pending attempt. Missing/unsupported prompt policies fail closed. Focused tests cover policy changes and mismatched returned requests; the real shared-handheld acceptance gate includes switching operators with an existing browser SSO session. This requests fresh authentication; it is not global IdP logout or verified `auth_time` proof.
|
||||
|
||||
The owner requires Authentik when configured by the server. Generic OAuth2 browser sign-in is implemented against an additive UI API1.9 `nativeSessionLogin` capability, with explicit issuer/discovery/callback metadata and an `authenticationFlow` marker on the existing session exchange. AppAuth performs authorization with S256; the secret and code exchange stay on QQQ. TABLE_BASED remains unchanged and native bearer metadata is kept distinct. Client gates, callback/lifecycle checks, deferred cookie adoption and focused tests are implemented; actual configured Authentik acceptance remains pending. See [AUTHENTICATION.md](../AUTHENTICATION.md). No live provider settings or operator data were changed.
|
||||
|
||||
## October 31 navigation correction — native acceptance passed
|
||||
|
||||
The primary navigation uses one hamburger drawer with All apps and server-authorized app entries, plus Settings and Diagnostics fixed at its bottom. The duplicate toolbar Apps button and Switch app overflow action are removed. Back remains beside the hamburger within apps/processes, Account stays separate, and prelogin/pending-approval drawers hide business destinations. Drawer dismissal and secondary surfaces preserve active work; selecting a primary destination retains the existing leave and pending-upload guards. Compilation and the selected native navigation suite passed, including the drawer-opening Back correction above. The successful checkpoint below describes earlier session/photo acceptance. No installed operator app, server or data was changed for this correction.
|
||||
|
||||
## Current verified checkpoint — October 31
|
||||
|
||||
All 12 shared TC22 navigation/input/account tests pass. TC22 orientation (all five persisted policies), offline licenses, synthetic camera/gallery/rotation/remote-logout cleanup, and the full session-monitor scenario pass. Session monitoring includes real JPEG app pixels, background clearing, renewed viewing on resume, operator pause, administrator termination and fresh login. Photo/session request audits match published semantic operations. JVM reports total 91 tests (22 core, 36 mobileapp, 33 scanner), zero failures; scanner lint passes. Notice coverage gates and packaged APK inspection pass for debug/release/E2E (125 runtime dependencies, 130 entries and nine complete license texts), and negative omission/blank-text cases fail as required with generated metadata restored.
|
||||
|
||||
The false-offline investigation was a test-clock issue, not a demonstrated timezone defect. The independent standalone file-backed JVM test in America/Chicago passed across 18 seconds. No timezone workaround or relaxed heartbeat/offline policy was added. Remaining work: publish the Android review checkpoint and verify fresh hosted CI, finish independent full audits/native attribution, qualify immutable optional dependencies/CI and real lens/operator acceptance, then return to signing/distribution as the owner requested. The normal installed app and operator demo remain on their earlier versions; isolated test acceptance is not deployment. Historical entries below preserve earlier failures and are superseded by this checkpoint.
|
||||
|
||||
Viewing diagnosis resolved the apparent offline state: the test advanced only16ms of Compose coroutine time per250ms wall polling, so heartbeat LaunchedEffect timers did not run during125 widget polls. The standalone non-UTC file-JVM regression passed and audit ordering confirmed zero heartbeats during those polls. The helper now advances by elapsed monotonic wall time. The next TC22 run reached `session-mirror-frame`: actual app JPEG pixels were delivered/decoded and background clearing passed. It then failed the already-identified old resume assertion because no viewer demand was renewed. Resume now polls the admin widget again; rebuild/full scenario rerun is active in the current turn. No production heartbeat interval or offline threshold was relaxed. The standalone regression source is in the companion demo, added by the read-only diagnosis agent and verified separately.
|
||||
|
||||
Latest viewing diagnostics: eligibility is available=true, but no indicator/frame upload occurs; 125 widget requests and 18 native heartbeats succeed. A real HTTP regression now explicitly requests the viewer widget as a browser (without the Android client header) before the native heartbeat; both demo tests PASS, ruling out the simple cross-channel lease-isolation hypothesis in that fixture. Actual core widget response fields are `layout`, `blocks`, `type`, `blockTypeName`; corrected the diagnostic extractor to read `blocks` (the earlier blank status was an incorrect `subBlocks` assumption). That diagnostic change needs rebuild/rerun to obtain the actual server widget status. All runs in this checkpoint are terminal. No production state-sharing change was made on an unproven hypothesis.
|
||||
|
||||
The window-focus synchronization rerun advanced past capture eligibility: no APP_NOT_FOCUSED failure remains in that run. It now times out at the viewer indicator. Request audit shows 125 successful web widget renders and 18 successful Android heartbeats, with no screen-upload operation. Added bounded failure diagnostics for current server availability/reason and the widget's status text (never image data or credentials), to distinguish lease issuance from client rendering. This newest diagnostic needs rebuild/rerun. All native processes from that run are terminal. Android changes are staged as a review checkpoint, but later focus/diagnostic edits remain unstaged; re-stage and verify before committing.
|
||||
|
||||
Screen-viewing follow-up reproduced a stale tracked-focus flag: server reported APP_NOT_FOCUSED while instrumentation confirmed interactive=true, no keyguard/device lock, both Activity/decor focus=true and lifecycle RESUMED. ScannerActivity now observes actual view-tree window-focus events, resynchronizes on resume, and removes the observer on destruction. Existing captureAppScreen independently checks actual decor focus, so capture protection remains enforced. Scanner unit/lint/E2E APK verification passed (build1m19s); the focused real-server TC22 scenario is rerunning in the active root turn. The operator demo remains on extension1.0; no normal-app update was made.
|
||||
|
||||
TC22 photo acceptance PASSES against the verified guarded0352 fixture: synthetic external-camera result automatically uploads, exact hash/size/provenance/parent and collection association are inspected, gallery staging survives rotation/recreation, leaving is blocked while pending, and remote session termination clears the private copied original without deleting the selected gallery source. All recorded native requests match published semantic operations. The run exposed and fixed a real UI-thread defect: ScannerActivity now dispatches unauthorized-session navigation on the main thread and ignores callbacks for a superseded session. Scanner unit/lint/APK rebuild passed before the successful native rerun. Fixture owner metadata remains in the private task cache; do not infer a normal-app deployment or actual lens capture from this synthetic result. Real session-viewing acceptance is starting next in the active root turn.
|
||||
|
||||
TC22 navigation/input/account acceptance now PASSES all 12 tests on rebuilt sample APKs. Orientation (all five policies) and offline licenses also pass. The guarded Record Files private launcher needed execution outside the sandbox for its process to survive; current private fixture PID111928 was started with a 900-second lifetime, with protected metadata path in the task cache. The first native photo run reached Saved and verified exact bytes/provenance/parent, then failed because the test assumed stored collection order was zero-based. Actual owner storage is one-based while manifest/receipt order is zero-based. Corrected that assertion and the duplicate Apps selector; photo rebuild exec64104 is active in the current turn, then rerun the synthetic camera/gallery/rotation/remote-logout scenario. Preserve fixture ownership and stop only that verified fixture when finished. Session mirroring acceptance and final audits remain open.
|
||||
|
||||
Latest navigation rerun is terminal: 11 of 12 TC22 tests pass. Restored account/server assertions now pass. The remaining failure selected both the menu action and the closed drawer heading named Switch app; a stable menu-action identifier and matching test selector are added. Those last two changes need rebuild/rerun. No native test or fixture remains active from this run.
|
||||
|
||||
TC22 follow-up: orientation and offline licenses each PASS their instrumentation scenario. Shared navigation ran 12 tests: 10 passed, with failures from duplicate visible/closed-drawer Apps selectors and an old account-dialog expectation that server selection still lived there. Added a stable toolbar Apps identifier, preserved the account user assertion, and verified restored server selection under Settings instead. Rebuilt sample/test APKs successfully; navigation rerun is starting in the current root turn. Guarded server changes and passing 18-test evidence are committed/pushed as84ffd7c on the existing draft PR; no merge or production release.
|
||||
|
||||
Latest TC22 result: the rebuilt orientation acceptance PASSED (one instrumentation test covering all five policies, persisted selection, actual fixed screen axis, Activity recreation and a fresh Activity launch). The bounded configuration-convergence wait resolved the prior timing failure; the axis assertion remains enforced. Guarded Record Files integration now passes all 18 tests and runtime/Checkstyle verification, with evidence retained in the companion module. Root is running TC22 licenses followed by shared navigation acceptance as exec session85018; poll that handle before starting another device run. No operator-app update or production release is implied by isolated test acceptance.
|
||||
|
||||
Latest verification follow-up: the notice-integrated APK build log ends BUILD SUCCESSFUL. Explicit TC22 orientation acceptance ran and failed because the observed screen axis was still portrait when landscape was requested. A bounded 15-second configuration convergence wait was added to the native test while retaining its final axis assertion; rebuild/rerun remains required. The disposable test runner cleaned its resources. Emulator remains closed. Record Files guarded-artifact verification has four unresolved intake-event concurrency test failures; see the companion integration session state. No production release is qualified.
|
||||
|
||||
2026-10-31 Android acceptance follow-up: the bounded pre-notices build passed 89 JVM tests (core22/mobile36/scanner31), normal and isolated APK assembly, and scanner lint with zero errors/warnings; broader modules retain inherited vector/dependency warnings. The emulator remains off after confirmed workstation stutter. On TC22, session capture remained safely blocked with APP_NOT_FOCUSED after recreation; no mirror frame was uploaded. The 12 shared navigation/input/account tests then ran: six passed and six failed (stale account/server-confirmation assertions, duplicate catalog/drawer text selectors, and a hardware Back case). Assertion corrections and window-focus diagnostics are prepared; these failures are not counted as passes. Orientation Settings, retained manual draft state, synthetic photo E2E, explicit physical photo fixture support, and bundled-license Settings entry are now implemented but require the next compilation/native acceptance. The license owner is running the bounded integration qualification. Ordinary scanner app/data, DataWedge settings and existing USB reverses were preserved.
|
||||
|
||||
## 2026-10-31 — Navigation hierarchy and release preparation
|
||||
|
||||
Owner explicitly deferred signing/distribution to the final step until the channel is chosen. No signing key or production signing configuration has been created. Continue implementation, audits, native/physical acceptance, documentation and ordinary CI; do not create release tags or force a distribution decision early.
|
||||
|
||||
Workstation interruption: user reports whole-desktop pauses whenever the emulator acts and explicitly confirmed the workstation is smooth after closing it. All local emulator/build runs were paused and emulator-5554 shut down gracefully without clearing application data. TC22 remains connected. Sampled host had 48 logical CPUs, CPU17%, about152GiB free RAM of256GiB, GPU10% with6.1GiB/30GiB used; these samples do not rule out brief spikes. WHPX is operational outside the sandbox. The running host-GPU emulator log includes OpenGL context preemption/restore failure and external-memory import errors; graphics interoperability is a hypothesis, not a proven root cause. Saved AVD config now uses software graphics, previous config backed up locally, but no comparison run has been made. Do not restart the emulator automatically. Continue acceptance on TC22/hosted CI or schedule a controlled software-renderer comparison later.
|
||||
|
||||
Android checkpoint: primary Apps, an app-switching drawer, separate Account and Settings, host device/location settings and shared leave confirmation are implemented. A bounded build with the emulator closed passed 85 JVM tests (core22/mobile35/scanner28), scanner lint with zero errors/warnings, isolated scanner APK/test APK and shared native-test compilation. The focused native long-form test passed after waiting for actual IME dismissal; the earlier immediate assertion raced its animation. Expanded native navigation cases are compiled but not run. Photo capture/picker, registered Record Files transport, stable retry identity, exact receipts and lifecycle tests are implemented. Subsequent camera auto-upload/destruction cleanup, the public mobile-record-files vocabulary gate and associated tests await the next bounded build after concurrent asset/backend work finishes. No emulator restart is authorized; physical acceptance uses the separate explicit runner in [DEVICE-TESTING.md](../DEVICE-TESTING.md).
|
||||
|
||||
The session native test now passes login/approval/catalog/process and recreation, including parent-app metadata and denied-location reporting, against the corrected file-H2 server. It still timed out before the administrator-viewing indicator. The test now waits for explicit screen eligibility and renews the widget viewer lease like the real admin poller; that change is unverified. Actual PixelCopy pixel-boundary instrumentation passed earlier, but full session/mirror/admin-end native acceptance is not complete. Ordinary synchronous process responses have no generic status endpoint: the host retains the process reference, prevents replay and describes uncertainty before explicit cancellation; it does not promise unsupported result checking.
|
||||
|
||||
Current plan: finish native navigation/session acceptance; integrate camera/gallery with the actual Record Files runtime; freeze paired revisions for final independent reviews; qualify signed delivery and hosted CI before publication. Apps → app → process is primary navigation. Account/sign-out, Settings and diagnostics are secondary surfaces that preserve active work. Toolbar and Android Back share one guarded leave policy. See [NAVIGATION-UX.md](../NAVIGATION-UX.md); implementation and native acceptance are underway, not yet complete.
|
||||
|
||||
Latest intermediate results: Android 76 JVM tests and lint with zero errors/warnings; shared native 11/12, with the remaining form/IME assertion under investigation. Companion server 37 tests, two real HTTP acceptance tests and all 15 browser E2E tests pass. The H2 last-connection close/compaction issue was reproduced and fixed with the demo database lifetime setting; the browser suite now completes in 59.4 seconds. These counts describe their tested intermediate source, not a final release.
|
||||
|
||||
Record Files now has actual registered ingestion routes and a frozen 19-file consumer bundle (`retained-contract-20261031-0238`), all hashes verified by the optional integration owner. Camera/gallery implementation will use its existing storage and durable receipts. Atomic authorization across revocation and upload commit remains a shared contract issue; runtime compatibility and native acceptance are still being qualified.
|
||||
|
||||
Release preparation adds optional environment-only signing, validated version properties and a separate scanner-tag workflow that calls the native verification lane before building/signing/publishing. Actionlint passes. The signing identity/secrets, actual signed build/upgrade and final publication have not been configured or verified. See [RELEASING.md](../RELEASING.md). Debug/E2E defaults and the operator's installed TC22 application are preserved.
|
||||
|
||||
## 2026-10-30 — Sessions, screen viewing and audit corrections (uncommitted)
|
||||
|
||||
The host now requires mobile-scanners `>=1.1.0 <2.0.0` and uses registered heartbeat/end/screen operations. Session telemetry contains screen metadata only. Administrator viewing leases enable bounded own-window PixelCopy JPEGs with a visible operator stop control. Capture blocks login/password screens, unrendered transitions, background/unfocused windows and ended sessions; checks repeat after capture and before upload. Foreground location is optional and permission denial leaves scanning usable. Device approval displays the server-generated short name and supports administrator renaming through QQQ.
|
||||
|
||||
Audit fixes require complete scanner receipts and reject invalid explicit maxLength. Navigation now follows NavController's actual destination, including system Back and controller replacement. Shared renderer/authentication fixes are being completed by the parallel review agent. Current intermediate verification: 75 JVM tests passed, APK builds passed, lint zero errors/eight warnings before dependency catalog cleanup. Actual PixelCopy instrumentation passed after an emulator startup ANR was resolved by a cold restart preserving data. Shared native suite passed 11 of 12 tests; a new short-viewport login regression found the IME obscuring the button and its fix is awaiting rerun. Both new navigation tests passed. Real-server session/end/viewing scenarios are implemented but await the rebuilt companion server and final native run. These are work-in-progress results, not publication or production acceptance.
|
||||
|
||||
At this October 30 checkpoint, Record Files camera/gallery routes were unavailable. The October 31 checkpoint above supersedes that dependency status. Version one remains online only.
|
||||
|
||||
## 2026-10-30 — Semantic API migration in progress
|
||||
|
||||
The current work makes the scanner host use the registered semantic UI API contract for every client operation. Public `/qqq/v1/version` discovery gates credentials, branding and metadata; the supported range is core `>=1.8.0 <2.0.0` and mobile-scanners `>=1.0.0 <2.0.0`, with `android` advertised in `clientChannels`. The four mobile extension operations now resolve under `/qqq/v1/qbit/mobile-scanners`. The native renderer applies server-directed completion, field/step updates, form submission and cancellation, and explicitly blocks unsupported required controls. Review fixes honor hidden fields and explicit null clearing, and keep generic fields named `eventId` separate from scanner retry context. See [UI-API.md](../UI-API.md) for the exact rendering boundary; this is not a claim of full web-client parity.
|
||||
|
||||
The final combined JVM suites passed 53 tests: core 21, mobileapp 23 and scanner-host 9. Lint passed with zero errors and six warnings; normal debug and isolated E2E/test APKs assembled. A native administration regression exposed that core QQQ completes a process by omitting nextStep from its COMPLETE response. The renderer now honors that server signal, preserves the final display step until submitted, and closes completed processes without issuing cancellation; a ViewModel regression verifies the full sequence. The companion qbit passed root verification/install with 23 tests and demo HTTP verification; all six migrated browser E2E scenarios passed in 2.9 minutes. The first native run exposed HTTP400 because the server had not registered the Android client channel. The server now registers it while preserving existing channel policies, and the real HTTP regression sends the Android header on all requests and passes. All six native semantic scenarios passed across focused runs: incompatible core major, missing extension, missing Android channel, supported-server scan, additive-future metadata scan, and native administrative approve/revoke/cancel. The first five passed before the terminal-state correction; the final administration scenario passed afterward in 255.917 seconds. Its OpenAPI audit matched all 31 requests to 13 published operations, including backend cancellation. Safe stage markers show both processes reaching completion and Close, then a populated form being cancelled without changing persisted status. The emulator was CPU-bound with animations enabled; the runner now wakes/unlocks only the selected emulator, temporarily disables its animation scales and restores them during cleanup, allows 60 seconds for UI conditions and 300 seconds for instrumentation. The six shared native sample tests also passed. Hosted Android verification remains pending; earlier records below apply to their earlier revisions.
|
||||
|
||||
Active plan: publish the Android branch and verify hosted results. The companion server is published at 7dd02b8874882ca2edcdcd89109b3dee6b4b0c88 with all server CI checks green, and the Android workflow pins that revision. The six shared native sample instrumentation tests passed on API35. The local server and emulator restarted after the workstation crash with data preserved.
|
||||
|
||||
Physical acceptance now includes the Zebra TC22 on Android 14 with DataWedge 13.0.325. The latest normal APK was installed with login/enrollment preserved; browser record approval displayed one device approved. The native catalog and Scan Capture opened with Connected status. The DataWedge profile associates all scanner-app activities, enables barcode input, disables keystroke output, and sends the SCAN action/default category as a broadcast to the explicit package with signature checking enabled. The user performed two deliberate physical triggers and saw Saved scan. The matching persisted Code128 row was independently inspected in the backend: synthetic barcode QQQ-TEST-123456, symbology LABEL-TYPE-CODE128, source scanner, user scanner, TC22/Android14/app0.1.0, mobileScanApp/mobileScanCapture, and capture/receipt timestamps. The two deliberate Code128 triggers produced two records, one event per trigger. A subsequent physical QR scan also displayed Saved scan; the independently inspected row preserved the leading-zero barcode 001234567890, symbology LABEL-TYPE-QRCODE, scanner source and the same TC22/user/app/process attribution with capture/receipt timestamps. The table contained exactly three records for two Code128 triggers and one QR trigger. Connection-loss/retry and revoked-device behavior still need physical-device acceptance; emulator checks do not replace those cases.
|
||||
|
||||
## Earlier verification records
|
||||
|
||||
2026-10-30 process E2E follow-up: added a real scanner-host Compose instrumentation scenario against a fresh QQQ demo database. It drives server selection and login, confirms pending enrollment, approves through the real admin process, selects the native app/process, submits a leading-zero manual barcode, waits for the actual saved-scan acknowledgment, independently queries durable provenance, and verifies a revoked device cannot save through its already-open process. The final scenario passed on API35 (one end-to-end test, 50.932 seconds), including completion of administrative result screens. It uses the separate `io.qrun.mobile.scanner.e2e` application; the operator's app, accounts, data and existing forwarding are preserved. Random test credentials are passed through stdin to private app storage and redacted from reports. The runner removes both test APKs and cleans up its temporary server/database and dedicated forwarding; only the normal scanner package remained installed after verification. Added a pinned companion-server checkout and this E2E to the push/PR emulator lane; hosted execution remains unverified until publication. Final required Gradle verification passed: 28 JVM tests, lint zero errors/six existing warnings, normal debug APK and isolated E2E/test APKs assembled. Actionlint, Node syntax validation and diff whitespace checks passed.
|
||||
|
||||
2026-10-30 follow-up: the scanner could show a blocking “No Network Connection” dialog while its server footer correctly said Connected. The shared legacy callback used one Boolean for multiple networks; losing either network incorrectly marked all connectivity unavailable. It now tracks network handles, with two regression tests that fail against the old logic. Scanner hosts opt out of the legacy internet-presence modal and use the existing server reachability footer; server authentication and device approval are unchanged. All 28 JVM tests and six native API35 instrumentation tests passed, lint has zero errors/six warnings, and the replacement APK was installed without clearing app data. Scanner activity and its existing session were restored after tests.
|
||||
|
||||
The local AVD is configured for host NVIDIA graphics (`hw.gpu.enabled=yes`, `hw.gpu.mode=host`), with the previous config backed up under the user's cache. Reopening with `-gpu host -no-snapshot` and restoring adb reverse showed Home frame percentiles of 16/17/18 ms (50th/90th/99th) and scanner 19/22/48 ms. These are post-restart observations, not a controlled before/after benchmark; the original slow process had already exited. The actual previous renderer had used the GPU despite the saved AVD setting, so disabled GPU is not established as the root cause. The admin browser is open at the demo login on port57832.
|
||||
|
||||
2026-10-29 verification: all 26 JVM tests passed, lint reported zero errors/six warnings, and the debug APK assembled successfully. Runtime diagnostics now include sanitized native API and device-request outcomes, in addition to branding and heartbeat events. Android 15 system-bar insets were corrected after emulator inspection. The shared mobile library now declares its connectivity permission for all consumers. Login copy uses a neutral title beneath the customer branding. CI APK artifacts include their own `SHA256SUMS`; local builds can be hashed with `Get-FileHash`.
|
||||
|
||||
Repository implementation is published for review in [PR #8](https://github.com/QRun-IO/qqq-android/pull/8); it has not been merged or released. The branding/diagnostics commit `a5621c5` passed all hosted CircleCI, scanner build and CodeQL checks. The optional manually dispatched hosted emulator lane was skipped; local native emulator tests passed. The companion qbit is published at https://github.com/QRun-IO/qbit-mobile-scanners, with all hosted server/CodeQL/demo checks passing and protected branches/security settings enabled.
|
||||
|
||||
Final-APK acceptance passed: six native UI tests, safe Android 15 header insets, customer branding, neutral login text, diagnostic panel and Connected → Disconnected → Connected recovery. APK SHA256: `A25451EA7A1360474428F1B806134DDFD059190FB99E81B4F69E720808C3209C`. The visible API35 emulator is left at login with `http://127.0.0.1:8080/` forwarded to host demo port57832. No credentials were entered or scans submitted through the emulator; the full operator/approval/capture walkthrough and physical TC22 remain pending. The server HTTP acceptance suite separately verifies the complete authorization/capture flow.
|
||||
|
||||
Earlier implementation records follow; the publication and emulator statements above supersede their original pending status.
|
||||
|
||||
Runtime branding and diagnostics added: public server metadata supplies display name, primary color, and an optional HTTPS logo; malformed/missing metadata uses QQQ defaults and server changes reset presentation. A persistent foreground connection footer checks the public status endpoint, with bounded credential-free diagnostics Copy/Clear. Shared top-bar colors now use the matching Material foreground role and its connectivity callback is disposed correctly. Branding/status protocol, isolation, malformed input, response redaction, and log bounds have JVM regression tests. Validation passed: full 23 JVM tests (core12, mobileapp4, scanner7), debug APK assembly, and lint with zero errors / six warnings. The new APK SHA256 is F388AF488688DE87811FE32C94D07601DC3DD61ADAC139069ADCFA627E21D01C. Updated emulator UI acceptance is pending.
|
||||
|
||||
Follow-up: diagnostics now also collect fixed native QQQ/device request outcomes through an optional, exception-isolated observer (status and latency only). Added regression cases for HTTP errors, transport failure, observer exceptions, and category formatting. Emulator confirmed F388 branding/login/Connected footer/diagnostics; observed Android15 system-bar overlap corrected with safe-drawing insets. Final verification for these follow-ups is pending.
|
||||
|
||||
2026-10-29: Implementing QQQ Mobile scanner host and native host extensions. First target is Zebra TC22, online only. Backend companion is `qbit-mobile-scanners`; metadata-defined apps/processes remain the native execution model. Device approval is mandatory. Local demo uses QQQ TABLE_BASED auth on QQQ4.1.0-RC.20.
|
||||
|
||||
Implemented server selection, per-server enrollment credentials, approval gate, SCANNER widget DataWedge input, explicit same-event retry, native password login, host extension points, and removal of session/token logging from touched authentication paths. No commit or push.
|
||||
|
||||
Validation passed: 19 JVM tests (core12, mobileapp4, scanner3), debug APK assembly, APK signature verification, and lint with zero errors. Five lint warnings remain: three inherited Navigation custom-check compatibility warnings and two dependency/catalog notices. Real sanitized demo HTTP metadata/process/init fixtures deserialize through the native DTOs. Server logout, HttpOnly-cookie login, and per-origin header isolation have regression tests. Physical TC22 acceptance remains required.
|
||||
|
||||
Previous pre-branding debug APK SHA256: B3E160CE3279C369CEDB425AC6E777A2729CE8A2E430E7D6F46D35C6376F8214.
|
||||
|
||||
Repository readiness added: pinned GitHub scanner tests/lint/APK artifacts and optional emulator workflow; CODEOWNERS, contribution/security/conduct guidance, issue/PR templates, Dependabot, changelog, editor/line-ending policy, and scoped agent instructions. `actionlint`, `shellcheck`, `shfmt`, and `git diff --check` passed. Upstream main `63fca89` was fast-forwarded and all implementation files restored without conflicts; the managed CircleCI Android profile and QRun-IO Maven registry updates are preserved. The full Gradle verification command passed again after reconciliation (16 executed tasks, remaining unchanged tasks up to date). Remote CI and emulator acceptance have not yet been recorded here.
|
||||
@@ -0,0 +1,142 @@
|
||||
> Historical record, superseded by [current status](../SESSION-STATE.md). Do not treat as current.
|
||||
|
||||
# TODO
|
||||
Current status (November 4):
|
||||
|
||||
- [x] Rewrite [RELEASING.md](../RELEASING.md) as concise Gitea-first signing/release readiness; legacy GitHub workflows marked historical. No keys, secrets, tags, releases, CI, build or source changed.
|
||||
- [x] Production signing decisions made (November 4): signed APK/MDM; new QRun-owned key `qqq-mobile-release` (PKCS12 RSA 4096, certificate SHA-256 `BDDB2D2F...5B17A9FF`, valid through 2056-10-27); backup in the owner's Personal 1Password vault `QRun`, recovery verified 2026-11-04. No CI/Infisical activation; shared CI/CD redesign paused separately.
|
||||
- [x] Local signed artifact and verification complete (November 4): 1.0.0/versionCode 2 from main `0ae2101` (lint/assemble 0 errors, 0 warnings), signed in isolation; `QQQ-Mobile-1.0.0.apk` SHA-256 `EE5AC896...79394D51`, v2+v3 verify, single signer with the fingerprint above, 16 KiB alignment, non-debuggable. Not installed, published or production-qualified; TC22 development-signed install/data intact.
|
||||
- [x] Direct-install guide prepared ([INSTALLATION.md](../INSTALLATION.md)) for a couple of devices; not deployed, and no physical test of the production APK is claimed yet. MDM follows later.
|
||||
- [ ] Qualify the actual production-signed APK on a planned migration or other device (install, enrollment, scanner path, navigation, update). The development-signed TC22 cannot upgrade in place to the new key; never uninstall/reset it implicitly. Requires an HTTPS server.
|
||||
- [ ] First direct installation and device qualification, then distribution to the remaining devices; MDM can follow later. Automated signing/publication pipeline work remains paused with the shared CI hold, independently of authorized manual distribution. Details in [RELEASING.md](../RELEASING.md).
|
||||
|
||||
Latest November 3 checkpoint (current; supersedes the older entries below):
|
||||
|
||||
- [x] Android `f72b90d` the signed application-code commit published in PR 10 (SSH read-back verified); Gitea CI 3480 succeeded (unit-test, device-test, package, secrets, gate); clean merge-tree with `main` b75fdac, nothing merged. Pull requests #8 and #10 remain open; merge and release not done. This update changes documentation only.
|
||||
- [x] Fresh disposable TC22 Echo ten-stage run: 109/109 semantic requests (simulated inputs/printing); installed APK `4AAB6951...AB850E` unchanged data.
|
||||
- [x] Fresh real Authentik desktop acceptance passes; native harness compiled, 8 launcher guards pass. [ ] On-device run awaits the temporary CA and PIN; no trust bypass.
|
||||
- [x] Server-side RC.21 gate PASS: 377 unique tests plus 15 real admin-browser E2E on public RC.21; the earlier MySQL timeouts did not recur. [ ] It is public core RC.21 with qualified private owner inputs, not a public/released cohort; the normal runtime core is not upgraded and Echo on RC.21 is not installed.
|
||||
|
||||
- [x] Install final client over the normal TC22 with signature match/data preserved; existing sign-in/approval and Connected verified. Settings include portrait, location reporting and working wallpaper preview.
|
||||
- [x] Fresh 222 JVM tests, lint zero errors/warnings, all APK builds, 23 Node tests and 255-file standards gate; updated ten-stage native Echo acceptance passes with simulated scans/printing.
|
||||
- [x] Integrate and compile opt-in real Authentik Android acceptance; real-provider desktop acceptance rerun passes all six phases with strict TLS.
|
||||
- [ ] Run real native Authentik after temporary CA installation/device interaction. Confirm physical scanner/label count/fidelity, camera/GPS/projection/profile behavior. Complete shared artifact publication/hosted CI; signing remains last.
|
||||
|
||||
Current checkpoint (November 2, copies adoption; supersedes older source/runtime notes below):
|
||||
|
||||
- [x] Verify optional Copies per scan through the actual generic native UI: default 1, range 1–100, selected 3 retained across two scans/recreation, and Apps/Leave; ten stages, 116 documented requests. Normal TC22 setup shows 1 against the updated local server.
|
||||
- [x] Combined candidate gate: 222 JVM tests, lint zero errors/warnings, debug/E2E/test APK compilation and 15 Node tests. Normal installed APK remains D8109C61; newer feedback/profile/wallpaper/AIM code is not installed.
|
||||
- [ ] Physically confirm label quantity and barcode fidelity. Native Authentik and camera/GPS/projection qualification remain open while the operator is remote; temporary CA installation is unconfirmed.
|
||||
- [ ] Coordinate canonical Generation copies adoption and coherent publication/CI. Signing/distribution remains last.
|
||||
|
||||
- [x] Implement negotiated mobile1.5 raw-byte transport with immutable capture, same-server capability gating and byte-identical failed-request retry;185 JVM tests, lint0errors/0warnings, debug/E2E builds and QA test compilation pass.
|
||||
- [ ] Qualify new raw-byte delivery on TC22 and complete actual AIM extraction/decoder-profile checks. Current source leaves AIM absent and does not change hardware configuration; full Echo fidelity is still open.
|
||||
- [x] Verify native `Origin` compatibility:174 JVM tests, lint0errors0warnings and APK build pass; normal TC22 login/approval/heartbeat/Echo setup/printer-media choices/Cancel-Leave pass against the strict local Echo host through8080->57832, preserving data.
|
||||
|
||||
- [x] Verify generic INTEGER Document choice/dependency clearing on actual TC22:7 stages,112 semantic requests,99 focused/host tests and8 Node guards; simulated printing, normal data preserved.
|
||||
- [x] Connect the installed print client to the single local server and publish the actual Echo4x1 document through native QQQ processes.
|
||||
- [x] Resolve the printing agent's earlier 4x6 media report versus loaded 4x1 stock: the Printing owner aligned 101600 x 25400 micron/300 dpi media and the TC22 selected the real printer, fresh 4x1 media and published document; Next succeeded.
|
||||
- [ ] Complete one physical Code128 (QQQ-TEST-123456) scan, print and rescan on the TC22, then leading-zero QR. One separate synthetic HTTP Echo event reached the actual Windows spooler; physical paper and handheld print/rescan remain unconfirmed.
|
||||
- [ ] Qualify public coherent artifacts and primary Gitea CI; signing and distribution stay last by user decision. Core PR 1337 normal CI and publication are not established; do not repin default dependencies.
|
||||
|
||||
- [x] Add metadata-driven Echo acknowledgment/manual-entry hints with old defaults; 167 JVM tests, strict compilation, lint zero errors/warnings and debug build pass.
|
||||
- [ ] Qualify native Echo scan/print-acceptance with independently decoded physical output (setup and Leave against the real owner adapters are verified; source tests are not physical printing evidence).
|
||||
- [x] Verify Query artwork, Dogfooding/Query links and licenses on the normal TC22 About screen using filtered accessibility data.
|
||||
|
||||
- [x] Apply scoped copyright/import/header/formatter corrections, mechanical CI gate and Kotlin warnings-as-errors;163JVM plus46TC22 sample native cases pass. See [review](../CODING-STANDARDS-REVIEW-2026-11-01.md) for the remaining formatter CI limitation.
|
||||
- [x] Add Query artwork, app version, Dogfooding/Query links and license access under Settings → About QQQ Mobile.
|
||||
- [x] Qualify real Authentik desktop nonce rejection and retained-browser A → company logout → fresh B; actual Android callback acceptance remains separate.
|
||||
|
||||
- [ ] Resolve the explicitly retained [legacy source follow-ups](../LEGACY-SOURCE-FOLLOWUPS.md): metadata typing, renderer contracts, navigation/action validation and build identity. Removing inline work markers does not implement these features.
|
||||
|
||||
- [x] Replace the raw diagnostics popup with tested full-screen status/activity, filtering, pause, copy/share/clear and Back; 159 client JVM tests, zero-warning lint/build and the focused TC22 diagnostics UI test pass.
|
||||
- [x] Default foreground location reporting on, preserving explicit opt-out and one-time Android permission behavior; settings/policy tests pass.
|
||||
- [x] Verify current trusted EMDK Code128, QR leading zeros and menu/reopen on installed checkpoint1c766bf/E34AC3C6.
|
||||
- [ ] Observe the diagnostics/location update on the normal package, grant/deny/restore location permission and verify an actual provider fix; keep physical lifecycle/outage/retry and provider acceptance gates open.
|
||||
|
||||
- [x] Verify the API1.10 original-nonce and optional company-logout client patch: 151 JVM tests, zero-warning lint/build and 28 disposable TC22 native authentication/lifecycle tests pass; independent 26-file source review completed with no findings.
|
||||
- [ ] Qualify the paired strict server policy and actual Authentik A-to-company-logout-to-B handoff, including the exported native callback and real SDK/browser logging boundary; synthetic native tests do not close this gate.
|
||||
|
||||
- [x] Verify current TC22 Code128 hardware trigger-to-save on the trusted EMDK path with operator Saved scan, matching backend source/model and distinct event identities; see [physical evidence](../PHYSICAL-TC22-ACCEPTANCE.md).
|
||||
- [ ] Finish current EMDK leading-zero QR, repeat-intent, lifecycle/ownership and retry/leave acceptance; historical DataWedge scans do not qualify these checks.
|
||||
|
||||
- [x] Verify the synchronized rotation/recreation assertions in both5ba GitHub native runs; one entire run passed and the other reached a later fresh-login timeout.
|
||||
- [x] Verify final fresh-login readiness at229fce3 and the later portrait-default7de checkpoint: all eleven hosted checks pass, including native navigation/input, PixelCopy and semantic scenarios with a new session. QR documentation2e0fd962 does not qualify physical QR acceptance.
|
||||
- [x] Make portrait the default for missing/invalid preferences while preserving explicit choices; four focused tests, lint/debug assembly and preserving TC22 install pass, with actual requested portrait orientation confirmed.
|
||||
- [ ] Finish the operator walkthrough on the newly updated normal TC22 app; private data/enrollment and the development signing identity were preserved.
|
||||
- [x] Compile the opt-in screen-consent QA harness and ordinary E2E tests; verify early opt-in/protected-port safety gates. Actual permission/display acceptance remains open.
|
||||
- [x] Compile/review additive consent-based device-screen client and paired1.2 server:137 JVM, package/lint/APK inspection, ordinary-UID TC22 scan-input rejection,39 server/six demo/all15 browser cases and strict provenance pass. Actual projection acceptance remains separate.
|
||||
- [ ] Execute opt-in actual Android consent, notification, Home/background pixels, Stop, lease expiry, lock/rotation and forced-session-end acceptance on the refined device-screen candidate.
|
||||
- [x] Supersede the historical hosted Back/focus failure gate with all eleven passing checks at7de; retain the failed-job diagnostics and actual Back/focus regression requirements in history.
|
||||
- [x] Establish the current EMDK Code128 positive control after the historical failed attempt: eight priorF3AF events and oneC891 event are verified. Preserve the failed-attempt evidence and bounded operator stage; QR/lifecycle/retry acceptance remains open above.
|
||||
- [x] Resolve normal backend ownership and perform the reviewed API 1.9 upgrade with fresh backup, original-column/data checks, recovery logins and live account validation; preserve the operator APK. Private verification confirms two devices and three scans retained.
|
||||
|
||||
- [x] Verify five client audit fixes: password/legacy callback origin binding, independent local Auth0 sign-out, sample release HTTPS and no-backup session storage. The batch passes 109 JVM tests and all 32 selected TC22 native cases; packaged release controls are inspected. See [review scope and evidence](../SECURITY-REVIEW-2026-10-31.md).
|
||||
- [x] Verify the trusted scanner-ingress replacement with production-path ordinary-UID rejection and actual installed EMDK Code128 positive controls. Preserve the historical security report scope; this does not close the remaining physical lifecycle/QR matrix.
|
||||
- [x] Correct the demo's mixed RC.20 runtime and test-engine dependencies; qualify exact-source core `ecf0f550a0357cec6387c2b54efca128a405a629` with server `b14d925b741e815d1cfa4f62301f19207f25b03f`. Fresh37 server/five demo, strict provenance and all15 nullable-admin/session-monitor/browser cases pass. Core full closure:4,507 discovered/16 existing skips/zero failures/errors.
|
||||
- [x] Reverify hosted Back/focus behavior at7de with real Back injection and the focus guard; historical failures remain documented in session state.
|
||||
- [x] Qualify stable Auth03.0.0/Coil3.0.4, notice-generator incremental inputs and overlay/window-focus scan gating:127 JVM,34 shared TC22 cases, an additional eight-overlay native regression, ordinary-UID injection rejection and all package/lint/notice gates pass. See [candidate acceptance](../TRUSTED-SCANNER-ACCEPTANCE.md).
|
||||
- [x] Resolve viewing scope through optional operator-consented DEVICE_SCREEN on mobile1.2 source, retaining default APP_CONTENT and old-server compatibility. Actual projection acceptance remains open; normal mobile1.1 runtime exposes app-content only.
|
||||
|
||||
- [x] Verify the unconfirmed-scan exit correction: 46 mobile JVM tests and all 21 selected TC22 native cases pass, including failed cancellation and explicit Leave anyway with preserved receipt/retry identity and in-flight/photo guards.
|
||||
- [ ] Finish the operator walkthrough of the unconfirmed-scan exit correction on the normal scanner installation.
|
||||
|
||||
- [x] Qualify semantic OAuth2 client protocol/policy and generated notices; all seven synthetic browser-result cases and the selected native navigation suite passed on TC22. See [acceptance evidence](../NATIVE-AUTH-ACCEPTANCE.md).
|
||||
- [ ] Complete actual configured Authentik acceptance: real browser/exported-callback round trip, authorization rotation/process death, and next-operator switching with prior browser SSO. See [authentication deployment](../AUTHENTICATION.md).
|
||||
- [x] Verify the single hamburger drawer correction: no duplicate Apps/Switch app controls, fixed Settings/Diagnostics, signed-out gating, drawer Back preserving drafts, and guarded Home/app switching with exactly one cancellation.
|
||||
|
||||
- [x] Verify persisted device Orientation choices on TC22, including process draft and pending-photo preservation across rotation.
|
||||
|
||||
- [x] Implement and verify [navigation UX](../NAVIGATION-UX.md): primary Apps/app/process navigation, secondary Account/Settings/diagnostics, shared Back/leave policy, protected in-flight operations and sign-out lifecycle.
|
||||
- [x] Prepare independent scanner release workflow and environment-only signing/version configuration; actionlint passes.
|
||||
- [x] Independently review the exact release workflow, reusable verification and Gradle signing configuration; see [review scope and hashes](../RELEASE-AUTOMATION-REVIEW.md). No actionable source finding; external protection settings are not verified by this review.
|
||||
- [ ] Configure reviewed GitHub release protections and the organization signing identity, verify the actual signed APK and upgrade/migration, and publish only after all [release prerequisites](../RELEASING.md) pass. Signing/distribution remains owner-deferred until the final step.
|
||||
|
||||
- [x] Correct false legacy network blocking while the scanner's server is reachable; preserve multi-network connectivity for shared clients.
|
||||
- [x] Persist workstation host-GPU configuration and document cold-start commands.
|
||||
|
||||
- [x] Add runtime server branding and a foreground connection footer with bounded sanitized diagnostics.
|
||||
- [x] Verify customer header/theme, diagnostics and connection loss/recovery on the emulator.
|
||||
- [ ] Verify customer-specific logo assets and physical TC22 appearance.
|
||||
|
||||
- [x] Complete Gradle unit tests, debug APK, signature, and lint verification (26 tests; zero lint errors).
|
||||
- [ ] Complete the current EMDK physical matrix: QR, lifecycle/ownership, retry/revocation, bad credentials, sign-out and re-login. The completed DataWedge checks below are historical and do not qualify current EMDK behavior.
|
||||
- [x] Verify TC22 physical Code128 and QR triggers through DataWedge intent output, visible Saved scan, preserved leading-zero QR data and independently inspected backend provenance; two Code128 triggers plus one QR trigger produced exactly three records.
|
||||
- [ ] Verify release APK signing/distribution separately; current deliverable is a debug APK.
|
||||
- [x] Reconcile exact historical project-owned source license boilerplate and the IDE template with the existing Apache-2.0 migration; preserve copyright ownership and other notices.
|
||||
- [ ] Verify third-party asset/dependency attribution and signed release/upgrade delivery before production distribution.
|
||||
- [ ] Configure and test production identity-provider integration; TABLE_BASED remains supported, and native OAuth2 requires explicit server advertisement and callback registration.
|
||||
- [x] Implement public `/qqq/v1/version` compatibility checks before credentials or native screens, including required features and the registered mobile-scanners extension.
|
||||
- [x] Implement semantic process completion, field/step updates, editable/view forms, backend cancellation and explicit unsupported-component blocking.
|
||||
- [x] Verify semantic migration JVM suites: 53 tests passed (core 21/mobileapp 23/scanner 9), including hidden fields, explicit null clearing, generic event ID isolation and completion when the server omits `nextStep`.
|
||||
- [x] Verify companion browser E2E after the semantic migration: six scenarios passed in 2.9 minutes.
|
||||
- [x] Require Android client-channel discovery; companion real HTTP tests use the Android header on every request and pass.
|
||||
- [x] Complete final JVM/lint/build verification of this semantic API migration: 53 tests, zero lint errors/six warnings, normal debug and isolated E2E/test APKs.
|
||||
- [x] Verify all six native scenarios across focused runs and the OpenAPI request audit: incompatible core, missing extension, missing Android channel, baseline/additive scans and native administrative forms.
|
||||
- [x] Identify the TC22 through ADB, authorize USB debugging, install the latest normal APK with login/enrollment preserved, approve its device record and open native Scan Capture with Connected status. Initial Code128 decoding passed; the remaining physical matrix is still pending.
|
||||
- [ ] Extend the [documented native component boundary](../UI-API.md) with remote possible values, record lists, specialized forms and table/report/download screens as required; add conformance and rendered E2E coverage for each new capability.
|
||||
|
||||
Offline queue/background synchronization is deliberately outside version one.
|
||||
- [x] Implement semantic mobile session activity, server termination, demand-based own-app screen viewing and optional foreground location.
|
||||
- [x] Add capture lifetime/lease/race tests, complete scanner receipt checks, strict maxLength and NavController regression coverage.
|
||||
- [x] Verify short-viewport login and focused long-form submission after IME Done and dismissal handling.
|
||||
- [x] Complete integrated session/native administrator termination E2E and all 12 shared TC22 navigation/input/account tests; local emulator remains closed.
|
||||
- [x] Freeze and review session/whole-device source within the documented security scopes and independent architecture A1–A11 closure. Final release revision/scope and external-runtime gates remain in the release ledger.
|
||||
- [x] Integrate camera/gallery with Record Files typed routes and guarded optional bridge fixture; synthetic native E2E verifies persisted receipt, rotation and forced-logout cleanup.
|
||||
- [ ] Complete actual camera-lens/operator acceptance after final runtime installation; synthetic activity results do not prove the OEM camera application flow.
|
||||
- [x] Supersede the October31 hosted checkpoint gate with all eleven passing hosted checks at7de; retain earlier revision-specific results as history.
|
||||
- [x] Verify the published push/PR native E2E lanes through the current7de hosted checkpoint; physical operator acceptance remains separate.
|
||||
- [x] Run the native sample instrumentation suite (six passed on API35).
|
||||
- [x] Add and run real-server scanner-host E2E: login, pending enrollment, approval, native app/process selection, manual scan persistence and revoked-device denial. Use an isolated app ID and database.
|
||||
- [x] Run and verify native real-server E2E on pushes and pull requests; current7de hosted checks pass.
|
||||
- [ ] Complete the final operator walkthrough on TC22 after updating the preserved demo/runtime, including outage/reconnect and real camera capture.
|
||||
|
||||
- [x] Implement named semantic process choices and qualify Echo native setup/two scans/rotation/Apps Leave onTC22 (169JVM,8guards,86documentedrequests; printing simulated).
|
||||
- [x] Real Echo host and owner adapters are composed and running in the single local server (see the Origin item above).
|
||||
- [ ] Print a physical label and rescan the exact value and type (tracked above).
|
||||
|
||||
- [x] Clear scanner feedback on process reset; 57 mobileapp JVM tests, zero-warning scanner lint, debug build and 255-file standards pass. Hosted checks and PR10 → PR8 → main integration remain pending.
|
||||
|
||||
# Scoped administrator viewing update — November 2
|
||||
|
||||
- [x] Remove app-authored viewing stop controls, verify the existing native session-monitor flow and install on TC22 with app data preserved. Retain the visible indicator, Android consent/system stop controls, server leases and authorization.
|
||||
+2
@@ -106,6 +106,8 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
|
||||
}
|
||||
response
|
||||
}
|
||||
// Last, so a caller-supplied additional header can never override the request's own origin.
|
||||
.addInterceptor(SameOriginInterceptor())
|
||||
.build()
|
||||
)
|
||||
.baseUrl(baseUrl)
|
||||
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package com.kingsrook.qqq.frontend.android.core.controllers
|
||||
|
||||
import okhttp3.HttpUrl
|
||||
import okhttp3.Interceptor
|
||||
import okhttp3.Response
|
||||
|
||||
/*******************************************************************************
|
||||
** Native requests have no browser to supply `Origin`, yet cookie-bearing QQQ mutations must present their own origin.
|
||||
** The value is always the canonical scheme/host/port of the actual request URL: never credentials, input or header state.
|
||||
** Install it only on clients that talk to the selected QQQ server, never on provider, logo or download clients, and
|
||||
** after any header-adding interceptor so that it has the final say.
|
||||
*******************************************************************************/
|
||||
class SameOriginInterceptor : Interceptor {
|
||||
/*******************************************************************************
|
||||
** Replace any existing `Origin` with the origin of the URL being requested; redirects stay refused by the clients.
|
||||
*******************************************************************************/
|
||||
override fun intercept(chain: Interceptor.Chain): Response =
|
||||
chain.proceed(chain.request().newBuilder().header("Origin", httpOrigin(chain.request().url)).build())
|
||||
|
||||
companion object {
|
||||
/*******************************************************************************
|
||||
** `scheme://host[:port]` with the scheme's default port omitted and IPv6 hosts bracketed.
|
||||
*******************************************************************************/
|
||||
fun httpOrigin(url: HttpUrl): String {
|
||||
val host = if (url.host.contains(':')) "[${url.host}]" else url.host
|
||||
val port = if (url.port == HttpUrl.defaultPort(url.scheme)) "" else ":${url.port}"
|
||||
return "${url.scheme}://$host$port"
|
||||
}
|
||||
}
|
||||
}
|
||||
+5
@@ -44,6 +44,11 @@ class UiApiCompatibility(
|
||||
@Volatile
|
||||
private var verified: UiApiVersion? = null
|
||||
|
||||
/*******************************************************************************
|
||||
** Non-blocking view of an already verified result; never performs discovery, so it is safe on the UI thread.
|
||||
*******************************************************************************/
|
||||
fun verifiedVersion(): UiApiVersion? = verified
|
||||
|
||||
/*******************************************************************************
|
||||
** Call on an IO thread. Synchronization prevents competing startup requests bypassing discovery.
|
||||
*******************************************************************************/
|
||||
|
||||
+33
@@ -65,6 +65,7 @@ class NetworkQQQRepositoryTest {
|
||||
assertEquals("run", body.getJSONObject("processValues").getString("echoRunId"))
|
||||
assertEquals("form", body.getString("useCase"))
|
||||
assertEquals(listOf("4x6", "7"), options.map { it.id.toString() })
|
||||
assertTrue("A JSON integer id must stay an integer for INTEGER fields", options[1].id is Int)
|
||||
assertEquals(listOf("4 x 6 in", "Seven"), options.map { it.label })
|
||||
assertTrue(repository.processPossibleValues("echoPrint", "mediaId", emptyMap(), emptyMap()).isEmpty())
|
||||
}
|
||||
@@ -139,6 +140,38 @@ class NetworkQQQRepositoryTest {
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Cookie-bearing native mutations (session/process POSTs) carry the exact request origin, and a caller-supplied
|
||||
** additional header can neither add a different Origin nor remove the real one. Login (no cookie yet) carries it too.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun cookieBearingPostsCarryTheExactRequestOriginEvenIfAdditionalHeadersTryToSetOne() = runBlocking()
|
||||
{
|
||||
MockWebServer().use { server ->
|
||||
server.start()
|
||||
server.enqueue(MockResponse().setBody(VERSION_FIXTURE))
|
||||
server.enqueue(MockResponse().setHeader("Content-Type", "application/json").setBody("""{"type":"COMPLETE","processUUID":"process","nextStep":"result","values":{}}"""))
|
||||
server.enqueue(MockResponse().setHeader("Content-Type", "application/json").setBody("{}"))
|
||||
val origin = server.url("/").toString()
|
||||
val repository = NetworkQQQRepository(origin, additionalHeaders = { mapOf("Origin" to "https://evil.example", "X-QQQ-Device-Id" to "test-device") })
|
||||
repository.setEnvironment(Environment("test", origin))
|
||||
repository.setSessionUUID("synthetic-session")
|
||||
repository.processStep("edit", "process", "input", mapOf("a" to "b"), 1000)
|
||||
repository.logout()
|
||||
server.takeRequest()
|
||||
// Forwarded debug servers may listen elsewhere (for example 8080): only the URL the client used matters.
|
||||
val expected = "http://${server.hostName}:${server.port}"
|
||||
listOf(server.takeRequest(), server.takeRequest()).forEach { request ->
|
||||
assertEquals("POST", request.method)
|
||||
assertEquals("sessionUUID=synthetic-session", request.getHeader("Cookie"))
|
||||
assertEquals(expected, request.getHeader("Origin"))
|
||||
assertEquals(1, request.headers.values("Origin").size)
|
||||
assertEquals("http://" + request.getHeader("Host"), request.getHeader("Origin"))
|
||||
assertEquals("test-device", request.getHeader("X-QQQ-Device-Id"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
|
||||
+70
@@ -0,0 +1,70 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package com.kingsrook.qqq.frontend.android.core.controllers
|
||||
|
||||
import okhttp3.HttpUrl.Companion.toHttpUrl
|
||||
import okhttp3.OkHttpClient
|
||||
import okhttp3.Request
|
||||
import okhttp3.mockwebserver.MockResponse
|
||||
import okhttp3.mockwebserver.MockWebServer
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** Native clients present the exact origin of the URL they actually request, canonicalized like a browser.
|
||||
*******************************************************************************/
|
||||
class SameOriginInterceptorTest {
|
||||
/*******************************************************************************
|
||||
** The origin comes only from scheme/host/port: a debug loopback forward keeps its device-side port
|
||||
** (whatever the server listens on behind it), defaults are omitted, and IPv6 hosts stay bracketed.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun originIsTheCanonicalSchemeHostAndPortOfTheRequestUrl() {
|
||||
fun origin(url: String) = SameOriginInterceptor.httpOrigin(url.toHttpUrl())
|
||||
assertEquals("http://127.0.0.1:57832", origin("http://127.0.0.1:57832/qqq/v1/manageSession"))
|
||||
assertEquals("http://127.0.0.1", origin("http://127.0.0.1:80/"))
|
||||
assertEquals("https://qqq.example.test", origin("https://qqq.example.test/"))
|
||||
assertEquals("https://qqq.example.test", origin("https://qqq.example.test:443/path"))
|
||||
assertEquals("https://qqq.example.test:8443", origin("https://qqq.example.test:8443/"))
|
||||
assertEquals("http://qqq.example.test:443", origin("http://QQQ.Example.Test:443/"))
|
||||
assertEquals("http://[::1]:57832", origin("http://[::1]:57832/"))
|
||||
assertEquals("https://[2001:db8::1]", origin("https://[2001:db8::1]:443/"))
|
||||
assertEquals("Credentials, path, query and fragment are never part of an origin", "http://127.0.0.1:57832",
|
||||
origin("http://user:secret@127.0.0.1:57832/a/b?token=x#fragment"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The header the interceptor sets is final, even when an earlier layer tried to supply a different one.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun overridesAnyExistingOriginAndMatchesTheServerRequestHost() {
|
||||
MockWebServer().use { server ->
|
||||
server.enqueue(MockResponse().setBody("{}"))
|
||||
server.start()
|
||||
val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false).addInterceptor(SameOriginInterceptor()).build()
|
||||
client.newCall(Request.Builder().url(server.url("/")).header("Origin", "https://evil.example").build()).execute().close()
|
||||
val request = server.takeRequest()
|
||||
assertEquals("http://" + request.getHeader("Host"), request.getHeader("Origin"))
|
||||
assertEquals(1, request.headers.values("Origin").size)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** A redirect is still refused, so neither the cookie nor this origin reaches another server.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun refusedRedirectNeverReachesAnotherOrigin() {
|
||||
MockWebServer().use { first ->
|
||||
MockWebServer().use { other ->
|
||||
first.start()
|
||||
other.start()
|
||||
first.enqueue(MockResponse().setResponseCode(307).setHeader("Location", other.url("/stolen").toString()))
|
||||
val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false).addInterceptor(SameOriginInterceptor()).build()
|
||||
client.newCall(Request.Builder().url(first.url("/")).header("Cookie", "sessionUUID=synthetic").build()).execute().use { assertEquals(307, it.code) }
|
||||
assertEquals(1, first.requestCount)
|
||||
assertEquals(0, other.requestCount)
|
||||
assertNull(other.takeRequest(100, java.util.concurrent.TimeUnit.MILLISECONDS))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+6
@@ -69,6 +69,11 @@ open class ProcessViewModel : ViewModel() {
|
||||
private set
|
||||
var submissionError: String? by mutableStateOf(null)
|
||||
private set
|
||||
/*******************************************************************************
|
||||
** Client-only widget state for this process instance. It survives step changes and recreation, is
|
||||
** replaced with the process, and is never submitted, saved, logged or shared between processes.
|
||||
*******************************************************************************/
|
||||
val widgetState = mutableStateMapOf<String, Any>()
|
||||
private var processComplete: Boolean by mutableStateOf(false)
|
||||
private var initializing = false
|
||||
|
||||
@@ -335,6 +340,7 @@ open class ProcessViewModel : ViewModel() {
|
||||
fieldResets.clear()
|
||||
remoteOptions.clear()
|
||||
remoteOptionErrors.clear()
|
||||
widgetState.clear()
|
||||
initializing = false
|
||||
unconfirmedSubmission = false
|
||||
clientWork.clear()
|
||||
|
||||
+172
@@ -418,6 +418,37 @@ class ProcessSubmissionTest {
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The optional fidelity keys are ordinary undeclared event values; a lost response must resend all of them.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun failedScanSubmissionResendsTheSameEntireEventMapIncludingFidelityValues() = runTest()
|
||||
{
|
||||
Dispatchers.setMain(StandardTestDispatcher(testScheduler))
|
||||
try {
|
||||
val repository = SubmissionRepository().apply { stepFailures = 1 }
|
||||
val model = model(repository)
|
||||
model.doInit()
|
||||
advanceUntilIdle()
|
||||
val event = mapOf(
|
||||
"barcode" to "000123", "symbology" to "LABEL-TYPE-QRCODE", "scanSource" to "zebra-emdk",
|
||||
"eventId" to "scan-1", "capturedAt" to "2026-01-01T00:00:00Z",
|
||||
"aimIdentifier" to "]Q1", "rawDataBase64" to "AAECAw=="
|
||||
)
|
||||
model.runStep(event, ProcessAcknowledgment("acknowledgedEventId", "scan-1"))
|
||||
advanceUntilIdle()
|
||||
assertTrue(model.unconfirmedSubmission)
|
||||
assertEquals(event, model.pendingStepValues)
|
||||
repository.responseValues = mapOf("acknowledgedEventId" to "scan-1")
|
||||
model.retryPendingStep()
|
||||
advanceUntilIdle()
|
||||
assertEquals(listOf(event, event), repository.submissions)
|
||||
assertNull(model.pendingStepValues)
|
||||
} finally {
|
||||
Dispatchers.resetMain()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@@ -597,6 +628,145 @@ class ProcessSubmissionTest {
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Setup chain printer -> media -> document, where the document is an INTEGER-keyed choice depending on both parents.
|
||||
** Ancestor changes must clear the whole stale suffix, block Next until reselection, keep the integer id typed on
|
||||
** submission, and never let a late reply for the old parents restore the old document.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun integerDocumentChoiceDependsOnPrinterAndMediaAndNeverSurvivesAParentChange() = runTest()
|
||||
{
|
||||
Dispatchers.setMain(StandardTestDispatcher(testScheduler))
|
||||
try {
|
||||
fun choice(id: Int, label: String) = com.kingsrook.qqq.frontend.android.core.model.QPossibleValue(id, label)
|
||||
val printer = QFieldMetaData("printerId", "Printer", type = QFieldType.STRING, isRequired = true, possibleValueSourceName = "printers")
|
||||
val media = QFieldMetaData(
|
||||
"mediaId", "Paper or label size", type = QFieldType.STRING, isRequired = true, possibleValueSourceName = "media",
|
||||
possibleValueSourceDependsOn = listOf("printerId"), possibleValueSourceDependencyBehavior = "DISABLE_UNTIL_SET"
|
||||
)
|
||||
val document = QFieldMetaData(
|
||||
"templateId", "Document", type = QFieldType.INTEGER, isRequired = true, possibleValueSourceName = "documents",
|
||||
possibleValueSourceDependsOn = listOf("printerId", "mediaId"), possibleValueSourceDependencyBehavior = "DISABLE_UNTIL_SET"
|
||||
)
|
||||
val repository = SubmissionRepository().apply {
|
||||
inputOverride = QFrontendStepMetaData("input", "Input", components = listOf(QFrontendComponent(QComponentType.EDIT_FORM)), formFields = listOf(printer, media, document))
|
||||
possibleValueResolver = { field, values ->
|
||||
when (field) {
|
||||
"printerId" -> listOf(choice(1, "P1"))
|
||||
"mediaId" -> if (values["printerId"] == "p1") listOf(choice(2, "M1")) else if (values["printerId"] == "p2") listOf(choice(3, "M2")) else emptyList()
|
||||
else -> when (values["printerId"] to values["mediaId"]) {
|
||||
"p1" to "m1" -> listOf(choice(7, "Seven"), choice(9, "Nine"))
|
||||
"p1" to "m1b" -> listOf(choice(11, "Eleven"))
|
||||
"p2" to "m2" -> listOf(choice(13, "Thirteen"))
|
||||
else -> emptyList()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
val model = model(repository)
|
||||
model.doInit()
|
||||
advanceUntilIdle()
|
||||
listOf(printer, media, document).forEach { model.loadRemoteOptions(it) }
|
||||
advanceUntilIdle()
|
||||
assertEquals("Choose Printer and Paper or label size first.", model.remoteOptionsBlockedReason(document))
|
||||
|
||||
fun choose(name: String, value: Any?) { model.processValues[name] = value; model.fieldChanged(name); }
|
||||
choose("printerId", "p1")
|
||||
advanceUntilIdle()
|
||||
assertEquals("Choose Paper or label size first.", model.remoteOptionsBlockedReason(document))
|
||||
choose("mediaId", "m1")
|
||||
advanceUntilIdle()
|
||||
assertNull(model.remoteOptionsBlockedReason(document))
|
||||
val requested = repository.possibleValueRequests.last()
|
||||
assertEquals("documents is searched with both parent values", mapOf("printerId" to "p1", "mediaId" to "m1"), requested.second.filterKeys { it != "templateId" }.filterValues { it != null })
|
||||
assertEquals(listOf(7, 9), model.remoteOptions["templateId"]?.map { it.id })
|
||||
assertTrue("Choice ids stay true integers", model.remoteOptions["templateId"]!!.all { it.id is Int })
|
||||
|
||||
// Required: nothing selected means Next must not submit.
|
||||
model.runStep()
|
||||
advanceUntilIdle()
|
||||
assertEquals("Document is required.", model.fieldErrors["templateId"])
|
||||
assertTrue(repository.submissions.isEmpty())
|
||||
|
||||
// Changing media clears the document and Next stays blocked until it is chosen again.
|
||||
choose("templateId", 7)
|
||||
choose("mediaId", "m1b")
|
||||
assertNull("Document chosen for the old media is cleared", model.processValues["templateId"])
|
||||
assertEquals(1, model.fieldResets["templateId"])
|
||||
advanceUntilIdle()
|
||||
assertEquals(listOf(11), model.remoteOptions["templateId"]?.map { it.id })
|
||||
model.runStep()
|
||||
advanceUntilIdle()
|
||||
assertEquals("Document is required.", model.fieldErrors["templateId"])
|
||||
assertTrue(repository.submissions.isEmpty())
|
||||
|
||||
// Changing the printer clears media and the document; the old document id is not an offered choice.
|
||||
choose("mediaId", "m1")
|
||||
advanceUntilIdle()
|
||||
choose("templateId", 9)
|
||||
val gate = CompletableDeferred<Unit>()
|
||||
repository.possibleValueGate = gate
|
||||
model.loadRemoteOptions(document)
|
||||
runCurrent()
|
||||
choose("printerId", "p2")
|
||||
assertNull(model.processValues["mediaId"])
|
||||
assertNull(model.processValues["templateId"])
|
||||
assertEquals(2, model.fieldResets["templateId"])
|
||||
assertEquals("Choose Paper or label size first.", model.remoteOptionsBlockedReason(document))
|
||||
// A reply for the old printer/media that was already in flight is discarded, not republished.
|
||||
repository.possibleValueGate = null
|
||||
gate.complete(Unit)
|
||||
advanceUntilIdle()
|
||||
assertNull("Late old-parent reply cannot restore choices", model.remoteOptions["templateId"])
|
||||
assertNull("Late old-parent reply cannot restore the old document", model.processValues["templateId"])
|
||||
model.runStep()
|
||||
advanceUntilIdle()
|
||||
assertTrue(model.fieldErrors.containsKey("mediaId") && model.fieldErrors.containsKey("templateId"))
|
||||
assertTrue(repository.submissions.isEmpty())
|
||||
|
||||
// After reselection the typed integer id is what is submitted.
|
||||
choose("mediaId", "m2")
|
||||
advanceUntilIdle()
|
||||
assertEquals(listOf(13), model.remoteOptions["templateId"]?.map { it.id })
|
||||
choose("templateId", model.remoteOptions["templateId"]!!.single().id)
|
||||
model.runStep()
|
||||
advanceUntilIdle()
|
||||
val submitted = repository.submissions.single()
|
||||
assertEquals("p2", submitted["printerId"])
|
||||
assertEquals("m2", submitted["mediaId"])
|
||||
assertEquals(13, submitted["templateId"])
|
||||
assertTrue("Document is submitted as an integer, not text or a decimal", submitted["templateId"] is Int)
|
||||
assertEquals("result", model.activeStepName)
|
||||
} finally {
|
||||
Dispatchers.resetMain()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Last scanner feedback is per run: ordinary step updates keep it, a reset (new run) drops it.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun widgetStateSurvivesStepUpdatesButIsClearedOnReset() = runTest()
|
||||
{
|
||||
Dispatchers.setMain(StandardTestDispatcher(testScheduler))
|
||||
try {
|
||||
val repository = SubmissionRepository()
|
||||
val model = model(repository)
|
||||
model.doInit()
|
||||
advanceUntilIdle()
|
||||
model.widgetState["scanner.lastScan"] = "000123"
|
||||
model.processValues["eventId"] = "ordinary-business-id"
|
||||
model.runStep()
|
||||
advanceUntilIdle()
|
||||
assertEquals("result", model.activeStepName)
|
||||
assertEquals("000123", model.widgetState["scanner.lastScan"])
|
||||
model.reset()
|
||||
assertTrue(model.widgetState.isEmpty())
|
||||
} finally {
|
||||
Dispatchers.resetMain()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@@ -629,6 +799,7 @@ class ProcessSubmissionTest {
|
||||
val possibleValueRequests = mutableListOf<Pair<String, Map<String, Any?>>>()
|
||||
var possibleValueFailure = false
|
||||
var possibleValueGate: CompletableDeferred<Unit>? = null
|
||||
var possibleValueResolver: ((String, Map<String, Any?>) -> List<com.kingsrook.qqq.frontend.android.core.model.QPossibleValue>)? = null
|
||||
private val input = QFrontendStepMetaData(
|
||||
"input", "Input", components = listOf(QFrontendComponent(QComponentType.EDIT_FORM)),
|
||||
formFields = listOf(QFieldMetaData("eventId", "Event", type = QFieldType.STRING, isRequired = true, isHidden = hiddenEventId))
|
||||
@@ -669,6 +840,7 @@ class ProcessSubmissionTest {
|
||||
possibleValueRequests.add(fieldName to values.toMap())
|
||||
possibleValueGate?.await()
|
||||
if (possibleValueFailure) throw java.io.IOException("Choices unavailable")
|
||||
possibleValueResolver?.let { return it(fieldName, values.toMap()) }
|
||||
return when {
|
||||
fieldName == "printerId" -> listOf(com.kingsrook.qqq.frontend.android.core.model.QPossibleValue("printer", "Simulated printer"))
|
||||
values["printerId"] == "printer" -> listOf(com.kingsrook.qqq.frontend.android.core.model.QPossibleValue("4x6", "4 x 6 in"))
|
||||
|
||||
+273
@@ -0,0 +1,273 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import android.os.Bundle
|
||||
import androidx.compose.ui.semantics.SemanticsProperties
|
||||
import androidx.compose.ui.semantics.getOrNull
|
||||
import androidx.compose.ui.test.SemanticsMatcher
|
||||
import androidx.compose.ui.test.assertIsEnabled
|
||||
import androidx.compose.ui.test.hasClickAction
|
||||
import androidx.compose.ui.test.hasTestTag
|
||||
import androidx.compose.ui.test.hasText
|
||||
import androidx.compose.ui.test.isEnabled
|
||||
import androidx.compose.ui.test.junit4.createAndroidComposeRule
|
||||
import androidx.compose.ui.test.onAllNodesWithTag
|
||||
import androidx.compose.ui.test.onAllNodesWithText
|
||||
import androidx.compose.ui.test.onNodeWithTag
|
||||
import androidx.compose.ui.test.onNodeWithText
|
||||
import androidx.compose.ui.test.performClick
|
||||
import androidx.compose.ui.test.performTextReplacement
|
||||
import androidx.test.ext.junit.runners.AndroidJUnit4
|
||||
import androidx.test.platform.app.InstrumentationRegistry
|
||||
import java.io.File
|
||||
import java.net.URI
|
||||
import java.util.concurrent.TimeUnit
|
||||
import okhttp3.OkHttpClient
|
||||
import org.json.JSONObject
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertNotEquals
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Assume.assumeTrue
|
||||
import org.junit.Rule
|
||||
import org.junit.Test
|
||||
import org.junit.runner.RunWith
|
||||
|
||||
/*******************************************************************************
|
||||
** Opt-in acceptance against the real fixture Authentik and real QQQ (docs/REAL-AUTHENTIK-ACCEPTANCE.md).
|
||||
** Skipped unless the instrumentation argument realAuthentik=true is passed, so ordinary runs never reach it.
|
||||
** Nothing here injects a callback, ActivityResult, token or discovery document, and nothing clears browser
|
||||
** state: the external browser, the exported callback activity and the QQQ code exchange run as in production.
|
||||
** The person holding the device types each operator's provider credentials into the browser themselves.
|
||||
** Progress is reported only as fixed stage names; no URL, query, token, cookie or credential is emitted.
|
||||
*******************************************************************************/
|
||||
@RunWith(AndroidJUnit4::class)
|
||||
class RealAuthentikAcceptanceTest {
|
||||
@get:Rule
|
||||
val ui = createAndroidComposeRule<ScannerActivity>()
|
||||
private val instrumentation = InstrumentationRegistry.getInstrumentation()
|
||||
private val context get() = instrumentation.targetContext
|
||||
private val client = OkHttpClient.Builder().callTimeout(20, TimeUnit.SECONDS).build()
|
||||
private lateinit var admin: SessionAcceptanceClient
|
||||
private lateinit var deviceId: String
|
||||
private var actorField: String = ""
|
||||
|
||||
/*******************************************************************************
|
||||
** A signs in through the browser, company sign-out runs, then B must authenticate afresh.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun browserCallbackThenCompanyLogoutThenFreshSecondOperator() {
|
||||
assumeTrue(InstrumentationRegistry.getArguments().getString("realAuthentik") == "true")
|
||||
check(context.packageName == "io.qrun.mobile.scanner.e2e") { "Requires the disposable E2E package" }
|
||||
val file = File(context.filesDir, "real-auth.json")
|
||||
val config = try { JSONObject(file.readText()) } catch (exception: Exception) { throw AssertionError("Fixture configuration is invalid") }
|
||||
finally { file.delete() }
|
||||
check(config.optString("fixtureType") == "real-authentik-android")
|
||||
val server = URI(config.getString("qqqOrigin"))
|
||||
check(server.scheme == "https" && server.host == "localhost" && server.port == 18443 && server.userInfo == null &&
|
||||
server.query == null && server.fragment == null && server.path in setOf("", "/"))
|
||||
val origin = "https://localhost:18443"
|
||||
val operators = config.getJSONObject("operators")
|
||||
val a = operators.getJSONObject("A")
|
||||
val b = operators.getJSONObject("B")
|
||||
check(a.getString("display") != b.getString("display")) { "Operators must have distinct display names" }
|
||||
actorField = config.optString("sessionActorField")
|
||||
admin = SessionAcceptanceClient(origin, config.getString("adminCookie"), client)
|
||||
|
||||
var lastSession: String? = null
|
||||
try {
|
||||
waitFor("QQQ server URL")
|
||||
ui.onNodeWithText("QQQ server URL").performTextReplacement("$origin/")
|
||||
click("Connect")
|
||||
// OAuth2 is advertised: the browser button exists and no local password form is offered.
|
||||
await("browser-login-offered") { ui.onAllNodesWithTag("oauth2.signIn").fetchSemanticsNodes().isNotEmpty() }
|
||||
assertTrue("No password fallback may be offered", ui.onAllNodesWithText("Password").fetchSemanticsNodes().isEmpty())
|
||||
stage("login-screen-verified")
|
||||
|
||||
// Operator A: real browser, real provider redirect, exported callback, real QQQ exchange.
|
||||
browserLogin("A")
|
||||
deviceId = DeviceCredentials(context, "$origin/").deviceId
|
||||
assertTrue("A new device must wait for administrator approval", pendingShown())
|
||||
stage("device-pending-A")
|
||||
approveAndOpenCatalog()
|
||||
assertPrincipal(a.getString("display"))
|
||||
val sessionA = activeSession(a.optString("actor"))
|
||||
stage("operator-A-verified")
|
||||
|
||||
// Optional company sign-out; no browser state is cleared by this harness.
|
||||
companySignOut()
|
||||
await("operator-A-session-ended") { sessionStatus(sessionA) != "ACTIVE" }
|
||||
stage("operator-A-qqq-session-ended")
|
||||
click("Log back in")
|
||||
|
||||
// Operator B must authenticate again; a silent reuse of A would show A as the principal.
|
||||
await("browser-login-offered-B") { ui.onAllNodesWithTag("oauth2.signIn").fetchSemanticsNodes().isNotEmpty() }
|
||||
browserLogin("B")
|
||||
if (pendingShown()) approveAndOpenCatalog()
|
||||
else await("catalog-B", 60) { catalogShown() }
|
||||
assertPrincipal(b.getString("display"))
|
||||
lastSession = activeSession(b.optString("actor"))
|
||||
assertNotEquals("B must hold a different QQQ session than A", sessionA, lastSession)
|
||||
stage("operator-B-verified")
|
||||
} finally {
|
||||
// End only the disposable device session; the supplied admin session belongs to root and is left alone.
|
||||
lastSession?.let { runCatching { admin.apply("mobileSessionEnd", JSONObject().put("sessionId", it)) } }
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Start AppAuth from the native button, require a real external browser, then wait for the operator.
|
||||
*******************************************************************************/
|
||||
private fun browserLogin(label: String) {
|
||||
click("oauth2.signIn", tag = true)
|
||||
stage("browser-$label-requested")
|
||||
var browser: String? = null
|
||||
await("external-browser-foreground-$label", 45) {
|
||||
browser = foreignPackage()
|
||||
browser != null || ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isNotEmpty()
|
||||
}
|
||||
assertTrue(
|
||||
"Browser sign-in never reached an external browser. Check temporary CA trust, reverse mappings and server advertisement.",
|
||||
browser != null
|
||||
)
|
||||
stage("browser-$label-operator-enter-credentials")
|
||||
// The provider's callback re-enters through the exported redirect activity; only then is the app foreground again.
|
||||
await("callback-returned-$label", 600) {
|
||||
activePackage() == context.packageName && (
|
||||
pendingShown() || catalogShown() || ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isNotEmpty())
|
||||
}
|
||||
assertTrue("Native sign-in did not complete after the browser returned", ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isEmpty())
|
||||
stage("callback-exchange-$label-complete")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Approve this device through the real administrator process, then re-check approval in the app.
|
||||
*******************************************************************************/
|
||||
private fun approveAndOpenCatalog() {
|
||||
admin.apply("mobileDeviceApprove", JSONObject().put("deviceId", deviceId))
|
||||
click("Check approval")
|
||||
await("approved-catalog", 60) { catalogShown() }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The principal shown by QQQ comes from the provider claims QQQ validated, not from this harness.
|
||||
*******************************************************************************/
|
||||
private fun assertPrincipal(display: String) {
|
||||
click("topBar.accountIcon", tag = true)
|
||||
await("principal-visible") { ui.onAllNodesWithText("Current User: $display").fetchSemanticsNodes().isNotEmpty() }
|
||||
click("Close")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Run optional RP-initiated logout through the browser and require explicit completion.
|
||||
*******************************************************************************/
|
||||
private fun companySignOut() {
|
||||
click("topBar.accountIcon", tag = true)
|
||||
await("company-signout-offered", 30) { ui.onAllNodesWithText("Sign out of company").fetchSemanticsNodes().isNotEmpty() }
|
||||
click("Sign out of company")
|
||||
// The confirmation dialog explains the effect; its button carries the same label as the Account item.
|
||||
await("company-signout-confirm") {
|
||||
ui.onAllNodesWithText("Sign out of QQQ and continue in your browser", substring = true).fetchSemanticsNodes().isNotEmpty() &&
|
||||
ui.onAllNodes(hasText("Sign out of company") and hasClickAction() and isEnabled()).fetchSemanticsNodes().size == 1
|
||||
}
|
||||
click("Sign out of company")
|
||||
stage("company-signout-requested")
|
||||
await("company-signout-browser", 45) { foreignPackage() != null }
|
||||
stage("company-signout-operator-confirm-if-asked")
|
||||
await("company-signout-returned", 300) {
|
||||
activePackage() == context.packageName && ui.onAllNodesWithTag("oauth2.logoutMessage").fetchSemanticsNodes().isNotEmpty()
|
||||
}
|
||||
await("company-signout-result", 30) { logoutMessage().contains("Company sign-out") }
|
||||
val message = logoutMessage()
|
||||
assertTrue("Company sign-out must be verified complete", message.contains("Company sign-out completed.") && !message.contains("did not complete"))
|
||||
stage("company-signout-verified")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The visible company sign-out progress/result text.
|
||||
*******************************************************************************/
|
||||
private fun logoutMessage(): String = ui.onNodeWithTag("oauth2.logoutMessage").fetchSemanticsNode().config
|
||||
.getOrNull(SemanticsProperties.Text)?.joinToString("") { it.text }.orEmpty()
|
||||
|
||||
/*******************************************************************************
|
||||
** The single ACTIVE session for this device, optionally checked for its server-derived actor.
|
||||
*******************************************************************************/
|
||||
private fun activeSession(expectedActor: String): String {
|
||||
var found: JSONObject? = null
|
||||
await("active-session", 30) {
|
||||
found = admin.sessions().singleOrNull { it.optString("deviceId") == deviceId && it.optString("status") == "ACTIVE" }
|
||||
found != null
|
||||
}
|
||||
val row = requireNotNull(found)
|
||||
if (actorField.isNotBlank() && expectedActor.isNotBlank()) assertEquals("Server actor must match the provider user", expectedActor, row.optString(actorField))
|
||||
return row.getString("id")
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun sessionStatus(id: String) = admin.sessions().single { it.getString("id") == id }.optString("status")
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun pendingShown() = ui.onAllNodesWithText("An administrator must approve this device before you can run mobile apps.").fetchSemanticsNodes().isNotEmpty()
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun catalogShown() = ui.onAllNodes(SemanticsMatcher("test tag starts with appHome.rowForApp:") {
|
||||
it.config.getOrNull(SemanticsProperties.TestTag)?.startsWith("appHome.rowForApp:") == true
|
||||
}).fetchSemanticsNodes().isNotEmpty()
|
||||
|
||||
/*******************************************************************************
|
||||
** The active window's package when it is neither this app nor system chrome (that is, the browser).
|
||||
*******************************************************************************/
|
||||
private fun foreignPackage(): String? = activePackage()?.takeIf { it != context.packageName && it != "com.android.systemui" && it != "android" }
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun activePackage(): String? {
|
||||
val root = instrumentation.uiAutomation.rootInActiveWindow ?: return null
|
||||
return try {
|
||||
root.packageName?.toString()
|
||||
} finally {
|
||||
@Suppress("DEPRECATION") root.recycle()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun click(label: String, tag: Boolean = false) {
|
||||
val matcher = (if (tag) hasTestTag(label) else hasText(label, substring = false)) and hasClickAction()
|
||||
await("enabled-app-control") { ui.onAllNodes(matcher and isEnabled()).fetchSemanticsNodes().isNotEmpty() }
|
||||
ui.onNode(matcher).assertIsEnabled().performClick()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun waitFor(text: String) = await("app-control") { ui.onAllNodesWithText(text, substring = false).fetchSemanticsNodes().isNotEmpty() }
|
||||
|
||||
/*******************************************************************************
|
||||
** Fixed stage identifiers only; the launcher maps them to operator instructions.
|
||||
*******************************************************************************/
|
||||
private fun stage(name: String) = instrumentation.sendStatus(0, Bundle().apply { putString("qqqStage", name) })
|
||||
|
||||
/*******************************************************************************
|
||||
** Bounded wait that keeps Compose's clock moving while the app is in the background.
|
||||
*******************************************************************************/
|
||||
private fun await(name: String, seconds: Long = 40, predicate: () -> Boolean) {
|
||||
val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(seconds)
|
||||
var previous = System.nanoTime()
|
||||
do {
|
||||
val now = System.nanoTime()
|
||||
ui.mainClock.advanceTimeBy(TimeUnit.NANOSECONDS.toMillis(now - previous).coerceAtLeast(16))
|
||||
previous = now
|
||||
if (predicate()) return
|
||||
Thread.sleep(250)
|
||||
} while (System.nanoTime() < deadline)
|
||||
throw AssertionError("Real-provider stage did not complete within its bound: $name")
|
||||
}
|
||||
}
|
||||
@@ -13,12 +13,25 @@ import android.provider.MediaStore
|
||||
import android.util.Base64
|
||||
|
||||
import androidx.compose.ui.test.hasClickAction
|
||||
import androidx.compose.ui.test.assert
|
||||
import androidx.compose.ui.test.assertHasNoClickAction
|
||||
import androidx.compose.ui.test.assertIsDisplayed
|
||||
import androidx.compose.ui.test.assertIsEnabled
|
||||
import androidx.compose.ui.test.assertIsNotEnabled
|
||||
import androidx.compose.ui.test.assertTextContains
|
||||
import androidx.compose.ui.test.assertTextEquals
|
||||
import androidx.compose.ui.test.SemanticsMatcher
|
||||
import androidx.compose.ui.semantics.SemanticsActions
|
||||
import androidx.compose.ui.semantics.SemanticsProperties
|
||||
import androidx.compose.ui.semantics.getOrNull
|
||||
import androidx.compose.ui.test.hasSetTextAction
|
||||
import androidx.core.view.WindowCompat
|
||||
import androidx.core.view.ViewCompat
|
||||
import androidx.core.view.WindowInsetsCompat
|
||||
import androidx.compose.ui.test.hasAnyAncestor
|
||||
import androidx.compose.ui.test.hasText
|
||||
import androidx.compose.ui.test.isEnabled
|
||||
import androidx.compose.ui.test.isPopup
|
||||
import androidx.compose.ui.test.junit4.createAndroidComposeRule
|
||||
import androidx.compose.ui.test.onAllNodesWithText
|
||||
import androidx.compose.ui.test.onFirst
|
||||
@@ -109,12 +122,79 @@ class ScannerEndToEndTest {
|
||||
return (0 until records.length()).map { records.getJSONObject(it).getJSONObject("values") }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Discover choices through the same versioned `searchProcessPossibleValues` POST the renderer uses
|
||||
** ({values, processValues, useCase:form}), so no document id or label is assumed by this harness.
|
||||
*******************************************************************************/
|
||||
fun choices(field: String, values: JSONObject): List<Pair<Any, String>> {
|
||||
val request = Request.Builder().url("$origin/qqq/v1/processes/echoPrint/possibleValues/$field").header("Cookie", scannerCookie)
|
||||
.post(JSONObject().put("values", values).put("processValues", JSONObject()).put("useCase", "form").toString().toRequestBody("application/json".toMediaType()))
|
||||
device.headers().forEach { (name, value) -> request.header(name, value) }
|
||||
val options = executeJson(request.build()).optJSONArray("options") ?: return emptyList()
|
||||
return (0 until options.length()).map { options.getJSONObject(it) }.map { it.get("id") to it.getString("label") }
|
||||
}
|
||||
val printerChoice = choices("printerId", JSONObject().put("mediaId", JSONObject.NULL).put("templateId", JSONObject.NULL)).single { it.second == "Simulated printer" }
|
||||
val mediaChoice = choices("mediaId", JSONObject().put("printerId", printerChoice.first).put("templateId", JSONObject.NULL)).single { it.second == "Simulated 4 x 6 in — 300 dpi" }
|
||||
val documents = choices("templateId", JSONObject().put("printerId", printerChoice.first).put("mediaId", mediaChoice.first))
|
||||
assertTrue("Document choices must be offered for the selected printer/media with unique labels and true JSON integer ids",
|
||||
documents.isNotEmpty() && documents.map { it.second }.toSet().size == documents.size && documents.all { it.first is Int || it.first is Long })
|
||||
// Choose a different document after the stale-selection check when more than one is offered, so restoring the old one is detectable.
|
||||
val firstDocument = documents.first()
|
||||
val finalDocument = documents.last()
|
||||
// Persisted setup column holding the chosen document id; confirm against the server fixture schema.
|
||||
val documentColumn = "templateId"
|
||||
// Persisted setup column and process field for the optional Copies per scan integer. The Echo owner must expose
|
||||
// both; the Printing service's own limit is 1..100, and this test does not hard-code any other bound.
|
||||
val copiesColumn = "copies"
|
||||
val selectedCopies = 3
|
||||
fun assertCopiesPinned(row: JSONObject) {
|
||||
val pinnedCopies = row.opt(copiesColumn)
|
||||
assertTrue("Setup must pin Copies per scan as the true JSON integer $selectedCopies the operator chose (found: $pinnedCopies); " +
|
||||
"the Echo fixture run table must expose an integer '$copiesColumn' column",
|
||||
pinnedCopies is Number && pinnedCopies.toLong() == selectedCopies.toLong())
|
||||
}
|
||||
fun assertSetupPinned(row: JSONObject) {
|
||||
assertTrue("Setup must pin the selected printer and media once", row.getString("state") == "OPEN" &&
|
||||
row.getString("printerRecordId") == "fixture-printer" && row.getString("mediaId") == "fixture-4x6")
|
||||
val persisted = row.opt(documentColumn)
|
||||
assertTrue("Setup must persist the chosen document as the same integer id the choices returned",
|
||||
persisted is Number && persisted.toLong() == (finalDocument.first as Number).toLong())
|
||||
assertCopiesPinned(row)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The metadata-driven integer control: a text field labelled by the server's field label, found by its set-text action.
|
||||
*******************************************************************************/
|
||||
val copiesField = hasText("Copies per scan") and hasSetTextAction()
|
||||
fun copiesValue(): String? = ui.onNode(copiesField).performScrollTo().fetchSemanticsNode().config.getOrNull(SemanticsProperties.EditableText)?.text
|
||||
fun enterCopies(value: String) {
|
||||
ui.onNode(copiesField).performScrollTo().performTextReplacement(value)
|
||||
// Dismiss the keyboard as a person would, so later read-only scan-display assertions measure the app, not this input.
|
||||
ui.activityRule.scenario.onActivity { WindowCompat.getInsetsController(it.window, it.window.decorView).hide(WindowInsetsCompat.Type.ime()) }
|
||||
ui.waitForIdle()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The only enabled, unselected choice control (earlier fields already hold labels).
|
||||
*******************************************************************************/
|
||||
fun openOnlyRemainingChoice() {
|
||||
ui.waitUntil(timeoutMillis = 60_000) {
|
||||
ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().size == 1 &&
|
||||
ui.onAllNodes(hasText("Choose a value") and isEnabled()).fetchSemanticsNodes().size == 1
|
||||
}
|
||||
ui.onNodeWithText("Choose a value").performScrollTo().performClick()
|
||||
}
|
||||
|
||||
val priorRuns = rows("echoFixtureRun").map { it.getString("id") }.toSet()
|
||||
ui.onNodeWithTag("appHome.rowForApp:echo").performClick()
|
||||
waitForTag("appHome.rowForProcess:echoPrint")
|
||||
ui.onNodeWithTag("appHome.rowForProcess:echoPrint").performClick()
|
||||
waitFor("Printer")
|
||||
waitFor("Paper or label size")
|
||||
waitFor("Document")
|
||||
waitFor("Copies per scan")
|
||||
assertEquals("Copies per scan must default to 1 from the server's field metadata", "1", copiesValue())
|
||||
stage("echo-copies-defaulted")
|
||||
ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
|
||||
waitFor("Simulated printer")
|
||||
ui.onNodeWithText("Simulated printer").performClick()
|
||||
@@ -123,14 +203,63 @@ class ScannerEndToEndTest {
|
||||
ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
|
||||
waitFor("Simulated 4 x 6 in — 300 dpi")
|
||||
ui.onNodeWithText("Simulated 4 x 6 in — 300 dpi").performClick()
|
||||
// Document depends on both printer and media; it is the only unselected control left once media holds its label.
|
||||
openOnlyRemainingChoice()
|
||||
waitFor(firstDocument.second)
|
||||
ui.onNodeWithText(firstDocument.second).performClick()
|
||||
waitFor(firstDocument.second)
|
||||
stage("echo-document-selected")
|
||||
|
||||
// Choosing a controlling field again drops every dependent selection and blocks Next until they are reselected.
|
||||
ui.onNodeWithText("Simulated printer").performScrollTo().performClick()
|
||||
ui.onNode(hasText("Simulated printer") and hasAnyAncestor(isPopup())).performClick()
|
||||
ui.waitUntil(timeoutMillis = 60_000) { ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().size == 2 }
|
||||
assertTrue("The stale document must not stay selected", ui.onAllNodesWithText(firstDocument.second).fetchSemanticsNodes().isEmpty())
|
||||
waitFor("Choose Paper or label size first.")
|
||||
ui.onNodeWithText("Next", substring = false).performClick()
|
||||
waitFor("Paper or label size is required.")
|
||||
waitFor("Document is required.")
|
||||
assertTrue("Next must not start setup without a reselected document", ui.onAllNodesWithText("Scanner ready. Press the handheld trigger.").fetchSemanticsNodes().isEmpty() &&
|
||||
rows("echoFixtureRun").none { it.getString("id") !in priorRuns && it.optString("printerRecordId").isNotBlank() })
|
||||
ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
|
||||
waitFor("Simulated 4 x 6 in — 300 dpi")
|
||||
ui.onNodeWithText("Simulated 4 x 6 in — 300 dpi").performClick()
|
||||
openOnlyRemainingChoice()
|
||||
waitFor(finalDocument.second)
|
||||
ui.onNodeWithText(finalDocument.second).performClick()
|
||||
waitFor(finalDocument.second)
|
||||
assertTrue("Only the reselected document may remain chosen", firstDocument == finalDocument || ui.onAllNodesWithText(firstDocument.second).fetchSemanticsNodes().isEmpty())
|
||||
stage("echo-stale-document-cleared")
|
||||
assertEquals("Reselecting a controlling choice must not disturb the independent Copies per scan value", "1", copiesValue())
|
||||
// The field's advertised bounds (Printing's 1..100) are enforced by the renderer before any run is created.
|
||||
for ((invalid, message) in listOf("0" to "Copies per scan is below the allowed minimum.", "101" to "Copies per scan exceeds the allowed maximum.")) {
|
||||
enterCopies(invalid)
|
||||
ui.onNodeWithText("Next", substring = false).performClick()
|
||||
waitFor(message)
|
||||
assertTrue("Invalid Copies per scan must not start setup", ui.onAllNodesWithText("Scanner ready. Press the handheld trigger.").fetchSemanticsNodes().isEmpty() &&
|
||||
rows("echoFixtureRun").none { it.getString("id") !in priorRuns && it.optString("printerRecordId").isNotBlank() })
|
||||
}
|
||||
enterCopies(selectedCopies.toString())
|
||||
assertEquals("The chosen quantity must be held by the metadata-driven integer field", selectedCopies.toString(), copiesValue())
|
||||
stage("echo-copies-selected")
|
||||
ui.onNodeWithText("Next", substring = false).performClick()
|
||||
waitFor("Scanner ready. Press the handheld trigger.")
|
||||
assertTrue("Echo must not offer manual barcode input", ui.onAllNodesWithText("Manual barcode").fetchSemanticsNodes().isEmpty())
|
||||
assertTrue("Echo must not offer manual submission", ui.onAllNodesWithText("Submit barcode").fetchSemanticsNodes().isEmpty())
|
||||
// The scan display is read-only and present although Echo disables manual entry; nothing opens the keyboard.
|
||||
fun assertScanDisplay(barcode: String?, symbology: String?, status: String) {
|
||||
ui.onNodeWithTag("scanner-barcode").performScrollTo().assertIsDisplayed()
|
||||
.assert(SemanticsMatcher.keyNotDefined(SemanticsActions.SetText))
|
||||
if (barcode != null) ui.onNodeWithTag("scanner-barcode").assert(hasText(barcode))
|
||||
ui.onNodeWithTag("scanner-symbology").assertTextEquals("Symbology: ${symbology ?: "—"}")
|
||||
ui.onNodeWithTag("scanner-status").assertTextEquals(status)
|
||||
assertTrue("Read-only scan display must not open the keyboard",
|
||||
ViewCompat.getRootWindowInsets(ui.activity.window.decorView)?.isVisible(WindowInsetsCompat.Type.ime()) != true)
|
||||
}
|
||||
assertScanDisplay(null, null, "Waiting for scan")
|
||||
val run = rows("echoFixtureRun").single { it.getString("id") !in priorRuns }
|
||||
val runId = run.getString("id")
|
||||
assertTrue("Setup must pin the selected printer and media once", run.getString("state") == "OPEN" &&
|
||||
run.getString("printerRecordId") == "fixture-printer" && run.getString("mediaId") == "fixture-4x6")
|
||||
assertSetupPinned(run)
|
||||
stage("echo-setup-selected")
|
||||
|
||||
var receipt = ""
|
||||
@@ -147,12 +276,14 @@ class ScannerEndToEndTest {
|
||||
val row = requireNotNull(accepted)
|
||||
receipt = row.getString("mobileScanId")
|
||||
waitFor("Print queued $receipt", substring = true)
|
||||
assertScanDisplay(sample.first, sample.second, "Confirmed by server")
|
||||
assertTrue("Accepted Echo scans must preserve exact type and approved-device attribution",
|
||||
row.getString("symbology") == sample.second && row.getString("rendererSymbology") == (if (index == 0) "code128" else "qr") &&
|
||||
row.getString("scanSource") == "e2e-fixture" && row.getString("deviceId") == device.deviceId && row.getString("actorId") == "scanner")
|
||||
assertTrue("Only a synthetic accepted job may acknowledge this fixture scan",
|
||||
row.getString("id") == receipt && row.getString("printJobId") == "fixture-job-$receipt" && row.getString("eventId").isNotBlank())
|
||||
assertTrue("Each event must create exactly one accepted Echo scan", rows("echoScan").count { it.optString("runId") == runId } == index + 1)
|
||||
assertSetupPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
|
||||
stage(if (index == 0) "echo-first-queued" else "echo-second-queued")
|
||||
}
|
||||
|
||||
@@ -160,10 +291,13 @@ class ScannerEndToEndTest {
|
||||
waitFor("Print queued $receipt", substring = true)
|
||||
ui.activityRule.scenario.recreate()
|
||||
waitFor("Print queued $receipt", substring = true)
|
||||
assertScanDisplay("000-ECHO-QR", "QRCODE", "Confirmed by server")
|
||||
assertTrue("Recreation must retain scan phase without showing printer selection", ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().isEmpty())
|
||||
val acceptedRows = rows("echoScan").filter { it.optString("runId") == runId }
|
||||
assertTrue("Rotation/recreation must not accept another event", acceptedRows.size == 2 && acceptedRows.map { it.getString("eventId") }.toSet().size == 2 &&
|
||||
acceptedRows.map { it.getString("printJobId") }.toSet().size == 2)
|
||||
assertSetupPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
|
||||
stage("echo-copies-persisted")
|
||||
stage("echo-recreation-stable")
|
||||
ui.onNodeWithTag("topBar.menuIcon").performClick()
|
||||
ui.onNodeWithTag("drawer.home").performClick()
|
||||
@@ -172,6 +306,7 @@ class ScannerEndToEndTest {
|
||||
waitForTag("appHome.rowForApp:echo")
|
||||
waitForServer { rows("echoFixtureRun").single { it.getString("id") == runId }.getString("state") == "CLOSED" }
|
||||
assertTrue("Leaving must close this run without accepting extra print work", rows("echoScan").count { it.optString("runId") == runId } == 2)
|
||||
assertCopiesPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
|
||||
stage("echo-run-closed")
|
||||
}
|
||||
|
||||
@@ -407,9 +542,11 @@ class ScannerEndToEndTest {
|
||||
screenWidget()
|
||||
ui.onAllNodesWithText("Screen being viewed by an administrator").fetchSemanticsNodes().isNotEmpty()
|
||||
}
|
||||
ui.onNodeWithText("Stop viewing").performClick()
|
||||
waitFor("Screen viewing paused")
|
||||
waitForServer { screenWidget().toString().contains("OPERATOR_PAUSED") && findImage(screenWidget()) == null }
|
||||
// Scanner users have no in-app control to pause or disable administrator viewing.
|
||||
assertTrue("No in-app Stop viewing control", ui.onAllNodesWithText("Stop viewing").fetchSemanticsNodes().isEmpty())
|
||||
assertTrue("No in-app Allow viewing control", ui.onAllNodesWithText("Allow viewing").fetchSemanticsNodes().isEmpty())
|
||||
ui.onNodeWithText("Screen being viewed by an administrator").assertHasNoClickAction()
|
||||
waitForServer { findImage(screenWidget()).orEmpty().startsWith("data:image/jpeg;base64,") }
|
||||
val launch = processCall("mobileSessionEnd", "/init", JSONObject())
|
||||
val applied = processCall("mobileSessionEnd", "/${launch.getString("processUUID")}/step/input", JSONObject().put("sessionId", sessionId))
|
||||
if (applied.optString("nextStep") == "result") processCall("mobileSessionEnd", "/${launch.getString("processUUID")}/step/result", JSONObject())
|
||||
@@ -637,11 +774,65 @@ class ScannerEndToEndTest {
|
||||
assertEquals("scanner", scans.single().getString("userId"))
|
||||
assertEquals("manual", scans.single().getString("scanSource"))
|
||||
assertTrue(scans.single().has("receivedAt"))
|
||||
|
||||
// Scanner-sourced fixture event with exact raw bytes (NUL, high bytes, embedded ]Q1) and an explicit AIM
|
||||
// identifier, delivered through the disposable e2e driver. Text, type and bytes are fixed and non-sensitive.
|
||||
val scannedBarcode = "000-NATIVE-RAW-0123"
|
||||
val scannedSymbology = "LABEL-TYPE-QRCODE"
|
||||
val rawBytes = byteArrayOf(0x00, 0xFF.toByte(), 0x80.toByte(), ']'.code.toByte(), 'Q'.code.toByte(), '1'.code.toByte(), 'A'.code.toByte(), 0x00, 0xFE.toByte())
|
||||
// The same >=1.5 negotiation rule as production, read independently from public discovery of this scenario's server.
|
||||
val fidelityNegotiated = mobileScannersAtLeast15()
|
||||
fun scanRows() = jsonRequest("/qqq/v1/table/mobileScan/query", JSONObject()).getJSONArray("records")
|
||||
val beforeScan = scanRows().length()
|
||||
waitFor("Scanner ready. Press the handheld trigger.")
|
||||
context.sendBroadcast(Intent("io.qrun.mobile.scanner.SCAN").setPackage(context.packageName)
|
||||
.addCategory(Intent.CATEGORY_DEFAULT).putExtra("com.symbol.datawedge.data_string", scannedBarcode)
|
||||
.putExtra("com.symbol.datawedge.label_type", scannedSymbology)
|
||||
.putExtra("io.qrun.mobile.scanner.e2e.raw_data", rawBytes)
|
||||
.putExtra("io.qrun.mobile.scanner.e2e.aim_identifier", "]Q1"))
|
||||
var scanned: JSONObject? = null
|
||||
waitForServer {
|
||||
val rows = scanRows()
|
||||
scanned = (0 until rows.length()).map { rows.getJSONObject(it).getJSONObject("values") }
|
||||
.singleOrNull { it.optString("barcode") == scannedBarcode }
|
||||
scanned != null
|
||||
}
|
||||
val persisted = requireNotNull(scanned)
|
||||
// The acknowledgment names this event's id, so it cannot be the earlier manual acknowledgment.
|
||||
waitFor("Saved scan ${persisted.getString("id")}", substring = true)
|
||||
assertEquals("e2e-fixture", persisted.getString("scanSource"))
|
||||
assertEquals(device.deviceId, persisted.getString("deviceId"))
|
||||
assertEquals(scannedBarcode, persisted.getString("barcode"))
|
||||
assertEquals(scannedSymbology, persisted.getString("symbology"))
|
||||
if (fidelityNegotiated) {
|
||||
assertTrue("Persisted raw bytes must equal the exact bytes sent, including NUL and high bytes",
|
||||
rawBytes.contentEquals(Base64.decode(persisted.getString("rawDataBase64"), Base64.NO_WRAP)))
|
||||
assertEquals("]Q1", persisted.getString("aimIdentifier"))
|
||||
} else {
|
||||
assertTrue("A server without scan fidelity must receive and persist legacy fields only",
|
||||
persisted.isNull("rawDataBase64") && persisted.isNull("aimIdentifier"))
|
||||
}
|
||||
assertEquals("One scanner event must create exactly one durable scan", beforeScan + 1, scanRows().length())
|
||||
stage(if (fidelityNegotiated) "native-raw-scan-persisted" else "native-legacy-scan-persisted")
|
||||
|
||||
val beforeRevoke = scanRows()
|
||||
runAdmin("mobileDeviceRevoke", device.deviceId)
|
||||
// The active heartbeat revokes the open UI as well as protected process submissions.
|
||||
waitFor("Log back in")
|
||||
val afterRevoke = jsonRequest("/qqq/v1/table/mobileScan/query", JSONObject()).getJSONArray("records")
|
||||
assertEquals("Revoked devices cannot save through an already-open process", records.length(), afterRevoke.length())
|
||||
val afterRevoke = scanRows()
|
||||
assertEquals("Revoked devices cannot save through an already-open process", beforeRevoke.length(), afterRevoke.length())
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Public, credential-free discovery: mobile-scanners at its fixed path with version >=1.5.0 and <2.
|
||||
*******************************************************************************/
|
||||
private fun mobileScannersAtLeast15(): Boolean {
|
||||
val discovery = executeJson(Request.Builder().url("$origin/qqq/v1/version").get().build())
|
||||
val extensions = discovery.optJSONArray("extensions") ?: return false
|
||||
val extension = (0 until extensions.length()).map { extensions.getJSONObject(it) }.singleOrNull { it.optString("name") == "mobile-scanners" } ?: return false
|
||||
if (extension.optString("pathPrefix") != "/qbit/mobile-scanners") return false
|
||||
val parts = Regex("(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)").matchEntire(extension.optString("version"))?.groupValues ?: return false
|
||||
return parts[1] == "1" && (parts[2].toIntOrNull() ?: return false) >= 5
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<manifest xmlns:android="http://schemas.android.com/apk/res/android" xmlns:tools="http://schemas.android.com/tools">
|
||||
<!-- Isolated test application; the normal debug/release identities are untouched. -->
|
||||
<!-- Isolated test application; the normal debug/release identities are untouched.
|
||||
networkSecurityConfig supersedes usesCleartextTraffic on API 24+; the config itself keeps cleartext for
|
||||
the 127.0.0.1 fixtures and adds user-CA trust for the host localhost only (see docs/REAL-AUTHENTIK-ACCEPTANCE.md). -->
|
||||
<application android:usesCleartextTraffic="true" android:label="QQQ Mobile E2E"
|
||||
android:networkSecurityConfig="@xml/network_security_config"
|
||||
tools:replace="android:usesCleartextTraffic,android:label" />
|
||||
</manifest>
|
||||
@@ -8,6 +8,8 @@ import android.content.IntentFilter
|
||||
import androidx.core.content.ContextCompat
|
||||
|
||||
internal const val HARDWARE_SCAN_SOURCE = "e2e-fixture"
|
||||
internal const val E2E_RAW_DATA_EXTRA = "io.qrun.mobile.scanner.e2e.raw_data"
|
||||
internal const val E2E_AIM_IDENTIFIER_EXTRA = "io.qrun.mobile.scanner.e2e.aim_identifier"
|
||||
|
||||
/*******************************************************************************
|
||||
** Disposable E2E package only. No debug/release source set contains this ingress.
|
||||
@@ -25,7 +27,10 @@ internal fun createScannerDriver(context: Context): ScannerDriver = object : Sca
|
||||
val data = intent.getStringExtra("com.symbol.datawedge.data_string") ?: return
|
||||
if (intent.getStringExtra("com.symbol.datawedge.decode_mode") == "multiple" || intent.hasExtra("com.symbol.datawedge.barcodes")) return
|
||||
pending = false
|
||||
listener?.scanned(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN")
|
||||
// Test-only fixture metadata: exact bytes and an explicit AIM identifier, never derived from the text.
|
||||
val raw = intent.getByteArrayExtra(E2E_RAW_DATA_EXTRA)
|
||||
val aim = intent.getStringExtra(E2E_AIM_IDENTIFIER_EXTRA)
|
||||
listener?.scanned(ScannerCapture.of(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN", raw, aim))
|
||||
listener?.idle()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!-- Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 -->
|
||||
<!-- E2E package only. Keeps the existing cleartext 127.0.0.1 fixture traffic and system trust everywhere, and lets
|
||||
ONLY the literal host "localhost" additionally trust a user-installed (temporary, user-approved) test CA.
|
||||
localhost is HTTPS-only. Debug, qa and release builds never see this file. No certificate is pinned or bypassed. -->
|
||||
<network-security-config>
|
||||
<base-config cleartextTrafficPermitted="true">
|
||||
<trust-anchors>
|
||||
<certificates src="system" />
|
||||
</trust-anchors>
|
||||
</base-config>
|
||||
<domain-config cleartextTrafficPermitted="false">
|
||||
<domain includeSubdomains="false">localhost</domain>
|
||||
<trust-anchors>
|
||||
<certificates src="system" />
|
||||
<certificates src="user" />
|
||||
</trust-anchors>
|
||||
</domain-config>
|
||||
</network-security-config>
|
||||
@@ -16,6 +16,15 @@
|
||||
android:icon="@drawable/ic_scanner"
|
||||
android:label="QQQ Mobile" android:theme="@android:style/Theme.Material.Light.NoActionBar">
|
||||
<uses-library android:name="com.symbol.emdk" android:required="false" />
|
||||
<meta-data android:name="android.content.APP_RESTRICTIONS" android:resource="@xml/app_restrictions" />
|
||||
<!-- Optional live wallpaper; inactive until chosen in Android's wallpaper chooser. Only the system may bind it. -->
|
||||
<service android:name=".QqqStatusWallpaperService" android:exported="true" android:label="@string/status_wallpaper_label"
|
||||
android:permission="android.permission.BIND_WALLPAPER">
|
||||
<intent-filter>
|
||||
<action android:name="android.service.wallpaper.WallpaperService" />
|
||||
</intent-filter>
|
||||
<meta-data android:name="android.service.wallpaper" android:resource="@xml/status_wallpaper" />
|
||||
</service>
|
||||
<service android:name=".DeviceScreenCaptureService" android:foregroundServiceType="mediaProjection" android:exported="false" />
|
||||
<provider android:name="androidx.core.content.FileProvider" android:authorities="${applicationId}.photos"
|
||||
android:exported="false" android:grantUriPermissions="true">
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
/*******************************************************************************
|
||||
** What a configuration read-back proves after the AIM output profile was requested.
|
||||
*******************************************************************************/
|
||||
internal enum class AimReadback { CONFIRMED, UNCHANGED, INDETERMINATE }
|
||||
|
||||
/*******************************************************************************
|
||||
** Classify the value the scanner reports (null when it could not be read) against the value it held before the
|
||||
** request and the AIM value requested. AIM wins even when the original was already AIM; only exactly the original
|
||||
** counts as unchanged; an unreadable or any other value is indeterminate and must be restored or failed, never
|
||||
** trusted. Generic so the rule is independent of the vendor SDK's enum.
|
||||
*******************************************************************************/
|
||||
internal fun <T : Any> classifyAimReadback(original: T, aim: T, effective: T?): AimReadback = when {
|
||||
effective == null -> AimReadback.INDETERMINATE
|
||||
effective == aim -> AimReadback.CONFIRMED
|
||||
effective == original -> AimReadback.UNCHANGED
|
||||
else -> AimReadback.INDETERMINATE
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Strict reading of the application-owned EMDK "AIM code identifier" output profile. Only a driver that
|
||||
** applied ScannerConfig.scanParams.codeIdType=AIM and read the same value back may call [split]; without
|
||||
** that confirmation the SDK text is user payload and must never be stripped or interpreted.
|
||||
*******************************************************************************/
|
||||
internal object AimOutputProfile {
|
||||
private val AIM = Regex("\\][A-Za-z][0-9A-Za-z]")
|
||||
|
||||
// AIM symbology character each known EMDK label must report; the modifier character is not checked here.
|
||||
private val FAMILY = mapOf(
|
||||
"CODE128" to 'C', "CODE39" to 'A', "CODE93" to 'G', "I2OF5" to 'I', "QRCODE" to 'Q', "DATAMATRIX" to 'd',
|
||||
"PDF417" to 'L', "AZTEC" to 'z', "EAN13" to 'E', "EAN8" to 'E', "UPCA" to 'E', "UPCE0" to 'E', "UPCE1" to 'E'
|
||||
)
|
||||
|
||||
/*******************************************************************************
|
||||
** The configured identifier and the user payload that followed it, taken exactly as the SDK delivered them.
|
||||
*******************************************************************************/
|
||||
internal data class Split(val aimIdentifier: String, val payload: String)
|
||||
|
||||
/*******************************************************************************
|
||||
** Remove exactly the first three characters when they form an AIM identifier consistent with the label.
|
||||
** A missing, malformed or label-inconsistent prefix returns null: the scan is not trusted, never guessed.
|
||||
** An empty payload is refused, and a payload that itself begins with an identifier is left intact.
|
||||
*******************************************************************************/
|
||||
fun split(text: String, label: String): Split? {
|
||||
if (text.length < 4 || !AIM.matches(text.substring(0, 3))) return null
|
||||
val family = FAMILY[label.removePrefix("LABEL-TYPE-")]
|
||||
if (family != null && text[1] != family) return null
|
||||
return Split(text.substring(0, 3), text.substring(3))
|
||||
}
|
||||
}
|
||||
@@ -8,6 +8,7 @@ import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
|
||||
import android.os.Build
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
|
||||
import kotlinx.coroutines.Dispatchers
|
||||
import kotlinx.coroutines.withContext
|
||||
import okhttp3.MediaType.Companion.toMediaType
|
||||
@@ -33,7 +34,7 @@ class DeviceApi(
|
||||
var displayName: String = ""
|
||||
private set
|
||||
private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
|
||||
.addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).build()
|
||||
.addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).addInterceptor(SameOriginInterceptor()).build()
|
||||
|
||||
/*******************************************************************************
|
||||
** Check enrollment on demand; approval remains a server-side decision.
|
||||
|
||||
@@ -6,7 +6,6 @@ import android.app.KeyguardManager
|
||||
import android.app.Notification
|
||||
import android.app.NotificationChannel
|
||||
import android.app.NotificationManager
|
||||
import android.app.PendingIntent
|
||||
import android.app.Service
|
||||
import android.content.BroadcastReceiver
|
||||
import android.content.Context
|
||||
@@ -81,9 +80,6 @@ class DeviceScreenCaptureService : Service() {
|
||||
** Establish the visible sharing notification before accepting consent; never restart projection automatically.
|
||||
*******************************************************************************/
|
||||
override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
|
||||
if (intent?.action == STOP) {
|
||||
finishProjection(); return START_NOT_STICKY
|
||||
}
|
||||
try {
|
||||
val manager = getSystemService(NotificationManager::class.java)
|
||||
manager.createNotificationChannel(NotificationChannel(CHANNEL, "Device screen sharing", NotificationManager.IMPORTANCE_LOW))
|
||||
@@ -91,13 +87,9 @@ class DeviceScreenCaptureService : Service() {
|
||||
finishProjection()
|
||||
return START_NOT_STICKY
|
||||
}
|
||||
val stop = PendingIntent.getService(
|
||||
this, 0, Intent(this, DeviceScreenCaptureService::class.java).setAction(STOP),
|
||||
PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
|
||||
)
|
||||
val notification = Notification.Builder(this, CHANNEL).setSmallIcon(R.drawable.ic_scanner)
|
||||
.setContentTitle("QQQ device screen sharing").setContentText("Other apps and notifications may be visible to your administrator.")
|
||||
.setOngoing(true).addAction(Notification.Action.Builder(null, "Stop sharing", stop).build()).build()
|
||||
.setOngoing(true).build()
|
||||
if (Build.VERSION.SDK_INT >= 29) startForeground(NOTIFICATION_ID, notification, ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION)
|
||||
else startForeground(NOTIFICATION_ID, notification)
|
||||
foregroundReady = true
|
||||
@@ -340,11 +332,10 @@ class DeviceScreenCaptureService : Service() {
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Keep notification and stop-action identifiers private to the nonexported projection service.
|
||||
** Keep notification identifiers private to the nonexported projection service.
|
||||
*******************************************************************************/
|
||||
private companion object {
|
||||
const val CHANNEL = "qqq-device-screen"
|
||||
const val STOP = "io.qrun.mobile.scanner.STOP_DEVICE_SCREEN"
|
||||
const val NOTIFICATION_ID = 8716
|
||||
}
|
||||
}
|
||||
@@ -187,7 +187,6 @@ internal fun DeviceScreenSharingControl(sharing: DeviceScreenSharing, controller
|
||||
}
|
||||
if (sharing.active) {
|
||||
Text("Sharing this device screen, including other apps and notifications.")
|
||||
TextButton(onClick = { controller.pauseViewing() }) { Text("Stop device screen sharing") }
|
||||
} else if (controller.supportsDeviceScreen) {
|
||||
val canNotify = remember(permissionRevision) {
|
||||
Build.VERSION.SDK_INT < 33 ||
|
||||
@@ -201,7 +200,7 @@ internal fun DeviceScreenSharingControl(sharing: DeviceScreenSharing, controller
|
||||
}
|
||||
if (disclosure) AlertDialog(
|
||||
onDismissRequest = { disclosure = false }, title = { Text("Share this device screen?") },
|
||||
text = { Text("An authorized administrator can see other apps and notifications while viewing this session. Android will ask for permission. Sharing stops if the viewer disconnects, you sign out, or this activity restarts. Use Stop sharing in the notification or Android's sharing indicator at any time.") },
|
||||
text = { Text("An authorized administrator can see other apps and notifications while viewing this session. Android will ask for permission. Sharing stops if the viewer disconnects, you sign out, or this activity restarts. Android shows its own sharing indicator while this device screen is shared.") },
|
||||
dismissButton = { TextButton(onClick = { disclosure = false }) { Text("Cancel") } },
|
||||
confirmButton = {
|
||||
TextButton(onClick = {
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import android.content.Context
|
||||
import android.content.RestrictionsManager
|
||||
import androidx.compose.material3.MaterialTheme
|
||||
import androidx.compose.material3.Text
|
||||
import androidx.compose.material3.TextButton
|
||||
import androidx.compose.runtime.Composable
|
||||
|
||||
/** Android managed-configuration keys; they must match res/xml/app_restrictions.xml and the company profile generator. */
|
||||
internal const val MANAGED_SERVER_URL = "qqq_server_url"
|
||||
internal const val MANAGED_ORIENTATION = "qqq_orientation"
|
||||
|
||||
/*******************************************************************************
|
||||
** Validated administrator bootstrap values. Absent or rejected keys are null, which leaves unmanaged behaviour unchanged.
|
||||
** Only key names, never values, are recorded for rejected input.
|
||||
*******************************************************************************/
|
||||
internal data class ManagedValues(val serverUrl: String? = null, val orientation: OrientationPolicy? = null, val rejectedKeys: List<String> = emptyList())
|
||||
|
||||
/*******************************************************************************
|
||||
** What a managed server URL means for the current installation.
|
||||
*******************************************************************************/
|
||||
internal enum class ManagedServerAction { NONE, PREFILL, OFFER_CHANGE }
|
||||
|
||||
/*******************************************************************************
|
||||
** Pure validation and reconciliation rules for managed configuration.
|
||||
*******************************************************************************/
|
||||
internal object ManagedConfiguration {
|
||||
private const val MAX_URL = 2048
|
||||
|
||||
/*******************************************************************************
|
||||
** Accept only an HTTPS origin without credentials, path, query or fragment (managed values never allow HTTP, even
|
||||
** in debug builds), and only an exact existing orientation name. Anything else is rejected, never defaulted.
|
||||
*******************************************************************************/
|
||||
fun parse(serverUrl: String?, orientation: String?): ManagedValues {
|
||||
val rejected = mutableListOf<String>()
|
||||
val url = serverUrl?.takeIf { it.isNotBlank() }?.let { raw ->
|
||||
try {
|
||||
require(raw.length <= MAX_URL) { "URL too long" }
|
||||
normalizeServerUrl(raw, allowHttp = false)
|
||||
} catch (exception: Exception) {
|
||||
rejected += MANAGED_SERVER_URL
|
||||
null
|
||||
}
|
||||
}
|
||||
val policy = orientation?.takeIf { it.isNotBlank() }?.let { raw ->
|
||||
OrientationPolicy.entries.firstOrNull { it.name == raw } ?: run { rejected += MANAGED_ORIENTATION; null }
|
||||
}
|
||||
return ManagedValues(url, policy, rejected)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** No saved server: offer the managed URL in the connect form. A different saved server is never switched silently;
|
||||
** the person is offered the existing change-server path (confirm, end session, sign out).
|
||||
*******************************************************************************/
|
||||
fun serverAction(savedServer: String?, managedServer: String?): ManagedServerAction = when {
|
||||
managedServer == null -> ManagedServerAction.NONE
|
||||
savedServer == null -> ManagedServerAction.PREFILL
|
||||
savedServer == managedServer -> ManagedServerAction.NONE
|
||||
else -> ManagedServerAction.OFFER_CHANGE
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Managed orientation is a bootstrap default applied only when the administrator's value changes. A later local
|
||||
** choice stands until the managed value changes again. Null means nothing to apply.
|
||||
*******************************************************************************/
|
||||
fun orientationToApply(managed: OrientationPolicy?, lastApplied: String?): OrientationPolicy? =
|
||||
managed?.takeIf { it.name != lastApplied }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Read this application's current restrictions; a missing service or no restrictions yields no managed values.
|
||||
*******************************************************************************/
|
||||
internal fun readManagedValues(context: Context): ManagedValues {
|
||||
val manager = context.getSystemService(Context.RESTRICTIONS_SERVICE) as? RestrictionsManager ?: return ManagedValues()
|
||||
val restrictions = manager.applicationRestrictions
|
||||
return ManagedConfiguration.parse(restrictions.getString(MANAGED_SERVER_URL), restrictions.getString(MANAGED_ORIENTATION))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Settings notice shown only when the managed server differs from the connected one. The button runs the caller's
|
||||
** existing confirmed change-server flow; this composable changes nothing itself.
|
||||
*******************************************************************************/
|
||||
@Composable
|
||||
internal fun ManagedServerNotice(connectedServer: String, managedServer: String?, onChange: () -> Unit) {
|
||||
if (ManagedConfiguration.serverAction(connectedServer, managedServer) != ManagedServerAction.OFFER_CHANGE) return
|
||||
Text("Your administrator configured a different server: $managedServer", style = MaterialTheme.typography.bodySmall)
|
||||
TextButton(onClick = onChange) { Text("Use administrator's server") }
|
||||
}
|
||||
@@ -5,6 +5,7 @@ import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.MOBILE_SCANNERS_PATH
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiException
|
||||
import java.io.IOException
|
||||
@@ -53,7 +54,7 @@ internal class MobileSessionApi(
|
||||
onOutcome: (RequestOutcome) -> Unit = {},
|
||||
) : MobileSessionTransport {
|
||||
private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
|
||||
.callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).build()
|
||||
.callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()
|
||||
|
||||
/*******************************************************************************
|
||||
** Send the current eligible session metadata and accept only the server's bounded lease policy.
|
||||
|
||||
@@ -0,0 +1,297 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import android.app.Activity
|
||||
import android.app.KeyguardManager
|
||||
import android.app.WallpaperManager
|
||||
import android.content.ActivityNotFoundException
|
||||
import android.content.BroadcastReceiver
|
||||
import android.content.ComponentName
|
||||
import android.content.Context
|
||||
import android.content.Intent
|
||||
import android.content.IntentFilter
|
||||
import android.graphics.Canvas
|
||||
import android.graphics.Color
|
||||
import android.graphics.Paint
|
||||
import android.graphics.Typeface
|
||||
import android.net.ConnectivityManager
|
||||
import android.net.LinkProperties
|
||||
import android.net.Network
|
||||
import android.os.Build
|
||||
import android.os.Handler
|
||||
import android.os.Looper
|
||||
import android.os.SystemClock
|
||||
import android.service.wallpaper.WallpaperService
|
||||
import android.view.SurfaceHolder
|
||||
import androidx.compose.material3.MaterialTheme
|
||||
import androidx.compose.material3.Text
|
||||
import androidx.compose.material3.TextButton
|
||||
import androidx.compose.runtime.Composable
|
||||
import androidx.compose.runtime.getValue
|
||||
import androidx.compose.runtime.mutableStateOf
|
||||
import androidx.compose.runtime.remember
|
||||
import androidx.compose.runtime.setValue
|
||||
import androidx.core.content.ContextCompat
|
||||
import java.time.Instant
|
||||
import java.time.ZoneId
|
||||
import java.time.format.DateTimeFormatter
|
||||
|
||||
/*******************************************************************************
|
||||
** The one in-process publisher. The wallpaper engine runs in this application's main process, so the snapshot
|
||||
** is shared by reference and disappears with the process; nothing is written to disk.
|
||||
*******************************************************************************/
|
||||
internal object WallpaperStatus {
|
||||
val store = WallpaperStatusStore(SystemClock::elapsedRealtime, System::currentTimeMillis)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Optional live wallpaper showing the company name and, on the unlocked home screen only, the approved session
|
||||
** display name and current IP. Inactive until a person selects it in Android's wallpaper chooser.
|
||||
*******************************************************************************/
|
||||
class QqqStatusWallpaperService : WallpaperService() {
|
||||
/*******************************************************************************
|
||||
** One engine per wallpaper surface; the framework destroys it when the wallpaper is replaced.
|
||||
*******************************************************************************/
|
||||
override fun onCreateEngine(): Engine = StatusEngine()
|
||||
|
||||
/*******************************************************************************
|
||||
** Draws text with a single Canvas pass. Network, keyguard and store observation exist only while visible.
|
||||
*******************************************************************************/
|
||||
private inner class StatusEngine : Engine(), WallpaperStatusListener {
|
||||
private val main = Handler(Looper.getMainLooper())
|
||||
private val connectivity = getSystemService(Context.CONNECTIVITY_SERVICE) as? ConnectivityManager
|
||||
private val keyguard = getSystemService(Context.KEYGUARD_SERVICE) as? KeyguardManager
|
||||
private val paint = Paint(Paint.ANTI_ALIAS_FLAG)
|
||||
private val timeFormat = DateTimeFormatter.ofPattern("HH:mm").withZone(ZoneId.systemDefault())
|
||||
private var observing = false
|
||||
private var destroyed = false
|
||||
private var networkCallback: ConnectivityManager.NetworkCallback? = null
|
||||
private var currentNetwork: Network? = null
|
||||
private var networkKnown = false
|
||||
private var networkAddresses: String? = null
|
||||
private val redraw = Runnable { draw() }
|
||||
private val screenReceiver = object : BroadcastReceiver() {
|
||||
/*******************************************************************************
|
||||
** Withdraw identity the moment the screen turns off; redraw once the user unlocks.
|
||||
*******************************************************************************/
|
||||
override fun onReceive(context: Context, intent: Intent) {
|
||||
if (intent.action == Intent.ACTION_SCREEN_OFF) drawBrandOnly() else draw()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Observe only while visible. Becoming invisible first paints brand-only so a stale frame cannot flash on wake.
|
||||
*******************************************************************************/
|
||||
override fun onVisibilityChanged(visible: Boolean) {
|
||||
if (destroyed) return
|
||||
if (visible) {
|
||||
startObserving()
|
||||
draw()
|
||||
} else {
|
||||
drawBrandOnly()
|
||||
stopObserving()
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Repaint when the surface size changes.
|
||||
*******************************************************************************/
|
||||
override fun onSurfaceChanged(holder: SurfaceHolder, format: Int, width: Int, height: Int) {
|
||||
super.onSurfaceChanged(holder, format, width, height)
|
||||
if (observing) draw() else drawBrandOnly()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Release the network callback, receiver, store listener and pending timers; nothing outlives the engine.
|
||||
*******************************************************************************/
|
||||
override fun onDestroy() {
|
||||
destroyed = true
|
||||
stopObserving()
|
||||
super.onDestroy()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The store may notify from any thread; repaint on the main looper.
|
||||
*******************************************************************************/
|
||||
override fun changed() {
|
||||
main.post(redraw)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Start network, unlock and store observation once per visible period.
|
||||
*******************************************************************************/
|
||||
private fun startObserving() {
|
||||
if (observing) return
|
||||
observing = true
|
||||
WallpaperStatus.store.addListener(this)
|
||||
ContextCompat.registerReceiver(
|
||||
this@QqqStatusWallpaperService, screenReceiver,
|
||||
IntentFilter().apply { addAction(Intent.ACTION_USER_PRESENT); addAction(Intent.ACTION_SCREEN_OFF) },
|
||||
ContextCompat.RECEIVER_NOT_EXPORTED
|
||||
)
|
||||
val callback = object : ConnectivityManager.NetworkCallback() {
|
||||
/*******************************************************************************
|
||||
** Addresses are reported here after the default network becomes available and whenever they change.
|
||||
*******************************************************************************/
|
||||
override fun onLinkPropertiesChanged(network: Network, linkProperties: LinkProperties) {
|
||||
val text = formatNetworkAddresses(linkProperties.interfaceName, linkProperties.linkAddresses.mapNotNull { it.address.hostAddress })
|
||||
main.post { if (observing) { currentNetwork = network; networkKnown = true; networkAddresses = text; draw() } }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Ignore the loss of a network that already stopped being the default.
|
||||
*******************************************************************************/
|
||||
override fun onLost(network: Network) {
|
||||
main.post { if (observing && network == currentNetwork) { currentNetwork = null; networkKnown = true; networkAddresses = null; draw() } }
|
||||
}
|
||||
}
|
||||
try {
|
||||
connectivity?.registerDefaultNetworkCallback(callback)
|
||||
networkCallback = callback
|
||||
} catch (exception: RuntimeException) {
|
||||
networkKnown = false
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Undo everything startObserving did and cancel scheduled work. Safe to call repeatedly.
|
||||
*******************************************************************************/
|
||||
private fun stopObserving() {
|
||||
main.removeCallbacks(redraw)
|
||||
if (!observing) return
|
||||
observing = false
|
||||
WallpaperStatus.store.removeListener(this)
|
||||
try {
|
||||
unregisterReceiver(screenReceiver)
|
||||
} catch (exception: IllegalArgumentException) { /* Already unregistered. */
|
||||
}
|
||||
networkCallback?.let {
|
||||
try {
|
||||
connectivity?.unregisterNetworkCallback(it)
|
||||
} catch (exception: IllegalArgumentException) { /* Already unregistered. */
|
||||
}
|
||||
}
|
||||
networkCallback = null
|
||||
currentNetwork = null
|
||||
networkKnown = false
|
||||
networkAddresses = null
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Preview and lock-only wallpaper never show identity. A locked keyguard, or no keyguard service, is treated
|
||||
** as locked. The wallpaper-flag check is additive: only an engine bound to the lock screen alone is certain.
|
||||
*******************************************************************************/
|
||||
private fun currentContext(): WallpaperContext {
|
||||
if (isPreview) return WallpaperContext.PREVIEW
|
||||
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE && getWallpaperFlags() == WallpaperManager.FLAG_LOCK) return WallpaperContext.LOCKED
|
||||
return if (keyguard?.isKeyguardLocked == false) WallpaperContext.HOME else WallpaperContext.LOCKED
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Paint the frame for the current context and schedule the single timer that withdraws an aging name.
|
||||
*******************************************************************************/
|
||||
private fun draw() {
|
||||
if (destroyed) return
|
||||
main.removeCallbacks(redraw)
|
||||
val snapshot = WallpaperStatus.store.snapshot
|
||||
val now = SystemClock.elapsedRealtime()
|
||||
val context = currentContext()
|
||||
val frame = WallpaperPresentation.render(
|
||||
snapshot, context, WallpaperPresentation.networkLine(networkKnown, networkAddresses), now
|
||||
) { timeFormat.format(Instant.ofEpochMilli(it)) }
|
||||
paintFrame(frame)
|
||||
if (context == WallpaperContext.HOME && observing) WallpaperPresentation.millisUntilStale(snapshot, now)?.let { main.postDelayed(redraw, it + 50) }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Brand-only frame used on invisibility, screen off and teardown.
|
||||
*******************************************************************************/
|
||||
private fun drawBrandOnly() {
|
||||
if (destroyed) return
|
||||
main.removeCallbacks(redraw)
|
||||
val snapshot = WallpaperStatus.store.snapshot
|
||||
paintFrame(WallpaperPresentation.render(snapshot, WallpaperContext.LOCKED, "", 0L) { "" })
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Draw the header and lines centred in the upper third, shortening any line to fit. Never logs text.
|
||||
*******************************************************************************/
|
||||
private fun paintFrame(frame: WallpaperFrame) {
|
||||
val holder = surfaceHolder
|
||||
if (!holder.surface.isValid) return
|
||||
val canvas: Canvas? = try {
|
||||
holder.lockCanvas()
|
||||
} catch (exception: RuntimeException) {
|
||||
null
|
||||
}
|
||||
if (canvas == null) return
|
||||
try {
|
||||
draw(canvas, frame)
|
||||
} finally {
|
||||
holder.unlockCanvasAndPost(canvas)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Canvas layout kept deliberately plain: solid brand colour, bold header, regular status lines.
|
||||
*******************************************************************************/
|
||||
private fun draw(canvas: Canvas, frame: WallpaperFrame) {
|
||||
val width = canvas.width.toFloat()
|
||||
canvas.drawColor(Color.parseColor(frame.colorHex))
|
||||
paint.color = if (frame.darkText) Color.BLACK else Color.WHITE
|
||||
paint.textAlign = Paint.Align.CENTER
|
||||
val maxWidth = width * 0.9f
|
||||
var y = canvas.height * 0.22f
|
||||
paint.typeface = Typeface.DEFAULT_BOLD
|
||||
paint.textSize = width * 0.07f
|
||||
canvas.drawText(fit(frame.header, maxWidth), width / 2, y, paint)
|
||||
paint.typeface = Typeface.DEFAULT
|
||||
paint.textSize = width * 0.045f
|
||||
frame.lines.forEach { line ->
|
||||
y += paint.textSize * 1.6f
|
||||
canvas.drawText(fit(line, maxWidth), width / 2, y, paint)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Truncate with an ellipsis so long names cannot run off the display.
|
||||
*******************************************************************************/
|
||||
private fun fit(text: String, maxWidth: Float): String {
|
||||
val count = paint.breakText(text, true, maxWidth, null)
|
||||
return if (count >= text.length) text else text.take((count - 1).coerceAtLeast(0)) + "…"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The standard Android live-wallpaper chooser, preselected to this wallpaper. Activation still needs the person's
|
||||
** confirmation there; nothing is applied silently.
|
||||
*******************************************************************************/
|
||||
internal fun wallpaperChooserIntent(context: Context): Intent = Intent(WallpaperManager.ACTION_CHANGE_LIVE_WALLPAPER)
|
||||
.putExtra(WallpaperManager.EXTRA_LIVE_WALLPAPER_COMPONENT, ComponentName(context, QqqStatusWallpaperService::class.java))
|
||||
|
||||
/*******************************************************************************
|
||||
** Open the chooser; false when the device offers none or refuses the request.
|
||||
*******************************************************************************/
|
||||
internal fun openWallpaperChooser(activity: Activity): Boolean = try {
|
||||
activity.startActivity(wallpaperChooserIntent(activity))
|
||||
true
|
||||
} catch (exception: ActivityNotFoundException) {
|
||||
false
|
||||
} catch (exception: SecurityException) {
|
||||
false
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Settings entry that opens the wallpaper chooser. It states exactly what the wallpaper will and will not show.
|
||||
*******************************************************************************/
|
||||
@Composable
|
||||
internal fun WallpaperSetting(activity: Activity) {
|
||||
var unavailable by remember { mutableStateOf(false) }
|
||||
TextButton(onClick = { unavailable = !openWallpaperChooser(activity) }) { Text("Status wallpaper…") }
|
||||
Text(
|
||||
"Optional live wallpaper: company name only on the lock screen; your name and this device's IP on the unlocked home screen. You confirm it in Android.",
|
||||
style = MaterialTheme.typography.bodySmall
|
||||
)
|
||||
if (unavailable) Text("This device has no live wallpaper chooser.")
|
||||
}
|
||||
@@ -4,6 +4,7 @@ package io.qrun.mobile.scanner
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiException
|
||||
import java.io.File
|
||||
@@ -156,7 +157,7 @@ internal class RecordFilesApi(
|
||||
private val compatibility: UiApiCompatibility, onOutcome: (RequestOutcome) -> Unit = {}
|
||||
) : RecordFilesTransport {
|
||||
private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
|
||||
.callTimeout(30, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).build()
|
||||
.callTimeout(30, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()
|
||||
|
||||
@Volatile
|
||||
private var captureContractVerified = false
|
||||
|
||||
@@ -7,18 +7,36 @@ import java.util.UUID
|
||||
/*******************************************************************************
|
||||
** One physical scan remains one event even when its HTTP request is retried.
|
||||
*******************************************************************************/
|
||||
data class ScanEvent(
|
||||
val barcode: String,
|
||||
val symbology: String,
|
||||
internal data class ScanEvent(
|
||||
val capture: ScannerCapture,
|
||||
val scanSource: String,
|
||||
val eventId: String = UUID.randomUUID().toString(),
|
||||
val capturedAt: String = Instant.now().toString()
|
||||
) {
|
||||
constructor(barcode: String, symbology: String, scanSource: String) :
|
||||
this(ScannerCapture.of(barcode, symbology), scanSource)
|
||||
|
||||
val barcode: String get() = capture.barcode
|
||||
val symbology: String get() = capture.symbology
|
||||
|
||||
/*******************************************************************************
|
||||
** A fixed schema prevents arbitrary intent extras becoming process inputs.
|
||||
** A fixed schema prevents arbitrary intent extras becoming process inputs. The optional fidelity
|
||||
** keys are added only for servers verified to accept them; absent values are omitted, never blank.
|
||||
*******************************************************************************/
|
||||
fun values(): Map<String, Any> = mapOf(
|
||||
"barcode" to barcode, "symbology" to symbology, "scanSource" to scanSource,
|
||||
"eventId" to eventId, "capturedAt" to capturedAt
|
||||
)
|
||||
fun values(includeFidelity: Boolean = false): Map<String, Any> {
|
||||
val values = linkedMapOf<String, Any>(
|
||||
"barcode" to barcode, "symbology" to symbology, "scanSource" to scanSource,
|
||||
"eventId" to eventId, "capturedAt" to capturedAt
|
||||
)
|
||||
if (includeFidelity) {
|
||||
capture.aimIdentifier?.let { values["aimIdentifier"] = it }
|
||||
capture.rawDataBase64?.let { values["rawDataBase64"] = it }
|
||||
}
|
||||
return values
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Scan content must not appear in logs; the event identity is an opaque correlation value.
|
||||
*******************************************************************************/
|
||||
override fun toString(): String = "ScanEvent(redacted, source=$scanSource, eventId=$eventId)"
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiVersion
|
||||
|
||||
/*******************************************************************************
|
||||
** The optional aimIdentifier/rawDataBase64 inputs exist from mobile-scanners 1.5.0; older servers
|
||||
** must receive exactly the legacy keys. Derived only from already-verified discovery data.
|
||||
*******************************************************************************/
|
||||
internal object ScanFidelityCapability {
|
||||
private val VERSION = Regex("(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)")
|
||||
|
||||
/*******************************************************************************
|
||||
** Require the single registered mobile-scanners extension at its fixed path with version >=1.5.0,<2.
|
||||
*******************************************************************************/
|
||||
fun supports(version: UiApiVersion?): Boolean {
|
||||
val extension = version?.extensions?.singleOrNull { it.name == "mobile-scanners" } ?: return false
|
||||
if (extension.pathPrefix != "/qbit/mobile-scanners") return false
|
||||
val parts = VERSION.matchEntire(extension.version)?.groupValues ?: return false
|
||||
return parts[1] == "1" && (parts[2].toIntOrNull() ?: return false) >= 5 && parts[3].toIntOrNull() != null
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Discovery data from another server never grants capability to this server's widgets.
|
||||
*******************************************************************************/
|
||||
fun available(server: String, discoveredServer: String, version: UiApiVersion?): Boolean =
|
||||
server == discoveredServer && supports(version)
|
||||
}
|
||||
@@ -1,9 +1,14 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import android.content.BroadcastReceiver
|
||||
import android.content.Context
|
||||
import android.content.Intent
|
||||
import android.content.IntentFilter
|
||||
import android.os.Build
|
||||
import android.os.Bundle
|
||||
import android.graphics.Rect
|
||||
import androidx.core.content.ContextCompat
|
||||
import androidx.activity.ComponentActivity
|
||||
import androidx.activity.compose.setContent
|
||||
import androidx.compose.foundation.layout.Arrangement
|
||||
@@ -74,6 +79,14 @@ class ScannerActivity : ComponentActivity() {
|
||||
private var focused by mutableStateOf(false)
|
||||
private var captureBounds by mutableStateOf<Rect?>(null)
|
||||
private val windowFocusObserver = android.view.ViewTreeObserver.OnWindowFocusChangeListener { focused = it }
|
||||
private var managed by mutableStateOf(ManagedValues())
|
||||
private var watchingManagedConfiguration = false
|
||||
private val restrictionsReceiver = object : BroadcastReceiver() {
|
||||
/*******************************************************************************
|
||||
** Reread administrator restrictions when the system reports a change while this host is visible.
|
||||
*******************************************************************************/
|
||||
override fun onReceive(context: Context, intent: Intent) = refreshManagedConfiguration()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Mark the host resumed so visible scanner ownership and foreground telemetry can be reevaluated.
|
||||
@@ -82,13 +95,44 @@ class ScannerActivity : ComponentActivity() {
|
||||
super.onResume()
|
||||
resumed = true
|
||||
window.decorView.post { if (resumed) focused = window.decorView.hasWindowFocus() }
|
||||
startWatchingManagedConfiguration()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Withdraw foreground eligibility before Android pauses the activity and scanner input.
|
||||
*******************************************************************************/
|
||||
override fun onPause() {
|
||||
resumed = false; super.onPause()
|
||||
resumed = false; stopWatchingManagedConfiguration(); super.onPause()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Reread managed values (also covers changes missed while paused) and apply a changed orientation default.
|
||||
*******************************************************************************/
|
||||
private fun refreshManagedConfiguration() {
|
||||
managed = readManagedValues(this)
|
||||
val preferences = getSharedPreferences("host", MODE_PRIVATE)
|
||||
val target = ManagedConfiguration.orientationToApply(managed.orientation, preferences.getString("managed_orientation_applied", null)) ?: return
|
||||
preferences.edit().putString("managed_orientation_applied", target.name).apply()
|
||||
target.select(this)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Observe restriction changes only while the host is resumed; the system broadcast is not exported to other apps.
|
||||
*******************************************************************************/
|
||||
private fun startWatchingManagedConfiguration() {
|
||||
refreshManagedConfiguration()
|
||||
if (watchingManagedConfiguration) return
|
||||
ContextCompat.registerReceiver(this, restrictionsReceiver, IntentFilter(Intent.ACTION_APPLICATION_RESTRICTIONS_CHANGED), ContextCompat.RECEIVER_NOT_EXPORTED)
|
||||
watchingManagedConfiguration = true
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Stop observing before the activity leaves the foreground.
|
||||
*******************************************************************************/
|
||||
private fun stopWatchingManagedConfiguration() {
|
||||
if (!watchingManagedConfiguration) return
|
||||
unregisterReceiver(restrictionsReceiver)
|
||||
watchingManagedConfiguration = false
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
@@ -121,6 +165,7 @@ class ScannerActivity : ComponentActivity() {
|
||||
override fun onCreate(savedInstanceState: Bundle?) {
|
||||
super.onCreate(savedInstanceState)
|
||||
window.decorView.viewTreeObserver.addOnWindowFocusChangeListener(windowFocusObserver)
|
||||
refreshManagedConfiguration()
|
||||
OrientationPolicy.read(this).apply(this)
|
||||
val preferences = getSharedPreferences("host", MODE_PRIVATE)
|
||||
setContent()
|
||||
@@ -135,7 +180,7 @@ class ScannerActivity : ComponentActivity() {
|
||||
var server by remember { mutableStateOf(preferences.getString("server", null)) }
|
||||
val currentServer = server
|
||||
if (currentServer == null) {
|
||||
ServerForm { value -> preferences.edit().putString("server", value).apply(); server = value }
|
||||
ServerForm(managed.serverUrl) { value -> preferences.edit().putString("server", value).apply(); server = value }
|
||||
} else {
|
||||
key(currentServer)
|
||||
{
|
||||
@@ -217,6 +262,16 @@ class ScannerActivity : ComponentActivity() {
|
||||
withFrameNanos { }
|
||||
renderedScreen = currentScreen
|
||||
}
|
||||
// Display-only wallpaper status: approved name and sign-in state, never the session id. Cleared when this host leaves composition.
|
||||
val signedIn = approved && qViewModel.isAuthenticated && !qViewModel.isLogoutRequested
|
||||
val serverHost = remember(server) { runCatching { URI(server).host }.getOrNull() }
|
||||
LaunchedEffect(signedIn, resumed, qViewModel.sessionUserFullName, brand)
|
||||
{
|
||||
WallpaperStatus.store.setBrand(brand.displayName, brand.primaryColor)
|
||||
if (signedIn) WallpaperStatus.store.signedIn(qViewModel.sessionUserFullName, serverHost, resumed)
|
||||
else WallpaperStatus.store.signedOutIfSignedIn()
|
||||
}
|
||||
DisposableEffect(server) { onDispose { WallpaperStatus.store.clear() } }
|
||||
val sessionApi = remember(server, diagnostics) { MobileSessionApi(server, credentials::headers, compatibility, diagnostics::sessionRequest) }
|
||||
val deviceSharing = remember(server, qViewModel.sessionUUID) { DeviceScreenSharing(applicationContext) }
|
||||
val sessions = remember(sessionApi, qViewModel.sessionUUID)
|
||||
@@ -259,6 +314,10 @@ class ScannerActivity : ComponentActivity() {
|
||||
LocalBusinessNavigationEnabled provides approved,
|
||||
LocalDeviceSettings provides {
|
||||
OrientationSetting(this@ScannerActivity)
|
||||
WallpaperSetting(this@ScannerActivity)
|
||||
ManagedServerNotice(server, managed.serverUrl) {
|
||||
qViewModel.qNavigator.requestLeave("Change server and sign out?", "Change server", alwaysConfirm = true) { qViewModel.changeServerAction?.invoke() }
|
||||
}
|
||||
DeviceScreenSharingControl(deviceSharing, sessions) {
|
||||
approved && qViewModel.isAuthenticated && !qViewModel.isLogoutRequested
|
||||
}
|
||||
@@ -281,7 +340,10 @@ class ScannerActivity : ComponentActivity() {
|
||||
},
|
||||
LocalCustomWidgetRenderer provides { parameters, modifier, disabled ->
|
||||
if (parameters.widgetBlock.blockType == "SCANNER") {
|
||||
ScannerWidget(parameters, modifier, disabled)
|
||||
ScannerWidget(
|
||||
parameters, modifier, disabled,
|
||||
fidelityAvailable = { ScanFidelityCapability.available(server, compatibility.server, compatibility.verifiedVersion()) }
|
||||
)
|
||||
true
|
||||
} else if (parameters.widgetBlock.blockType == "RECORD_FILES_CAPTURE") {
|
||||
RecordPhotoWidget(parameters, recordFiles, modifier, disabled)
|
||||
@@ -311,12 +373,13 @@ internal fun normalizeServerUrl(input: String, allowHttp: Boolean): String {
|
||||
** Initial server configuration is editable until the host connects.
|
||||
*******************************************************************************/
|
||||
@Composable
|
||||
private fun ServerForm(onConnect: (String) -> Unit) {
|
||||
var url by remember { mutableStateOf(if (BuildConfig.DEBUG) "http://127.0.0.1:8080/" else "https://") }
|
||||
private fun ServerForm(managedUrl: String?, onConnect: (String) -> Unit) {
|
||||
var url by remember(managedUrl) { mutableStateOf(managedUrl ?: if (BuildConfig.DEBUG) "http://127.0.0.1:8080/" else "https://") }
|
||||
var error by remember { mutableStateOf("") }
|
||||
Column(Modifier.imePadding().verticalScroll(rememberScrollState()).padding(24.dp), verticalArrangement = Arrangement.spacedBy(16.dp))
|
||||
{
|
||||
Text("Connect QQQ Mobile", style = MaterialTheme.typography.headlineMedium)
|
||||
if (managedUrl != null) Text("Your administrator configured this server. Review it, then connect.")
|
||||
OutlinedTextField(url, { url = it }, label = { Text("QQQ server URL") }, singleLine = true)
|
||||
Button(onClick = {
|
||||
try {
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import java.util.Base64
|
||||
|
||||
/*******************************************************************************
|
||||
** One immutable decoded read: the SDK's text and symbology, the SDK's raw bytes already encoded once as
|
||||
** canonical padded Base64, and an AIM identifier only when a qualified driver supplied it explicitly.
|
||||
** Raw bytes are exact SDK output (possibly with SDK framing), not a claim of complete symbol capture.
|
||||
*******************************************************************************/
|
||||
internal data class ScannerCapture(
|
||||
val barcode: String, val symbology: String, val rawDataBase64: String? = null, val aimIdentifier: String? = null
|
||||
) {
|
||||
init {
|
||||
require(aimIdentifier == null || AIM.matches(aimIdentifier)) { "Invalid AIM identifier." }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Scan content is business data and must not reach logs or crash reports.
|
||||
*******************************************************************************/
|
||||
override fun toString(): String = "ScannerCapture(redacted, raw=${if (rawDataBase64 == null) "absent" else "present"}, aim=${if (aimIdentifier == null) "absent" else "present"})"
|
||||
|
||||
/*******************************************************************************
|
||||
** Raw limits live here so every source builds captures under the same transport limits.
|
||||
*******************************************************************************/
|
||||
companion object {
|
||||
const val MAX_RAW_BYTES = 8192
|
||||
private val AIM = Regex("\\][A-Za-z][0-9A-Za-z]")
|
||||
|
||||
/*******************************************************************************
|
||||
** Encode SDK bytes once; the caller's array is never retained. Null, empty or oversize raw data is
|
||||
** omitted rather than truncated, so an optional field is either exact SDK output or absent.
|
||||
*******************************************************************************/
|
||||
fun of(barcode: String, symbology: String, rawData: ByteArray? = null, aimIdentifier: String? = null): ScannerCapture =
|
||||
ScannerCapture(
|
||||
barcode, symbology,
|
||||
if (rawData == null || rawData.isEmpty() || rawData.size > MAX_RAW_BYTES) null else Base64.getEncoder().encodeToString(rawData),
|
||||
aimIdentifier
|
||||
)
|
||||
|
||||
/*******************************************************************************
|
||||
** Manual entry has no scanner evidence, so it carries neither raw bytes nor an AIM identifier.
|
||||
*******************************************************************************/
|
||||
fun manual(barcode: String) = ScannerCapture(barcode, "MANUAL")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.ProcessAcknowledgment
|
||||
|
||||
/*******************************************************************************
|
||||
** The most recent submitted read, kept in memory only so it stays visible while awaiting the next scan.
|
||||
** Manual entry has no symbology; it is never labelled with a guessed one.
|
||||
*******************************************************************************/
|
||||
internal data class LastScan(val eventId: String, val barcode: String, val symbology: String?) {
|
||||
/*******************************************************************************
|
||||
** Scan content is business data and must not reach logs or crash reports.
|
||||
*******************************************************************************/
|
||||
override fun toString(): String = "LastScan(redacted, eventId=$eventId)"
|
||||
|
||||
/*******************************************************************************
|
||||
*******************************************************************************/
|
||||
companion object {
|
||||
/*******************************************************************************
|
||||
** Manual submissions carry no scanner evidence, so their symbology is absent.
|
||||
*******************************************************************************/
|
||||
fun of(event: ScanEvent) = LastScan(event.eventId, event.barcode, if (event.scanSource == "manual") null else event.symbology)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** What the read-only scan display shows: the exact value, its symbology, and where the request stands.
|
||||
*******************************************************************************/
|
||||
internal data class ScanFeedback(val barcode: String, val symbology: String, val details: String, val status: String) {
|
||||
/*******************************************************************************
|
||||
** Scan content is business data and must not reach logs or crash reports.
|
||||
*******************************************************************************/
|
||||
override fun toString(): String = "ScanFeedback(redacted, status=$status)"
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Derives scan feedback from the process's own pending/acknowledgment state; it adds no state machine.
|
||||
*******************************************************************************/
|
||||
internal object ScannerFeedback {
|
||||
const val WAITING = "Waiting for scan"
|
||||
const val STATE_KEY = "scanner.lastScan"
|
||||
|
||||
/*******************************************************************************
|
||||
** The one receipt definition: submission and display must agree on what counts as confirmation.
|
||||
*******************************************************************************/
|
||||
fun acknowledgment(eventId: String) = ProcessAcknowledgment(
|
||||
"acknowledgedEventId", eventId, requiredValues = mapOf("scanSaved" to true), nonEmptyStringFields = setOf("scanId")
|
||||
)
|
||||
const val MANUAL_SYMBOLOGY = "Not applicable (manual entry)"
|
||||
|
||||
/*******************************************************************************
|
||||
** A pending request (including a retryable one) is authoritative because retries resend it unchanged;
|
||||
** otherwise the last submitted read stays visible, whether confirmed, rejected or cancelled.
|
||||
*******************************************************************************/
|
||||
fun derive(
|
||||
last: LastScan?, pendingValues: Map<String, Any?>?, responseValues: Map<String, Any?>, waiting: Boolean, cancelling: Boolean
|
||||
): ScanFeedback? {
|
||||
val pendingId = pendingValues?.get("eventId") as? String
|
||||
val pendingBarcode = pendingValues?.get("barcode") as? String
|
||||
val shown = if (pendingId != null && pendingBarcode != null)
|
||||
LastScan(
|
||||
pendingId, pendingBarcode,
|
||||
if (pendingValues["scanSource"] == "manual") null else pendingValues["symbology"] as? String
|
||||
)
|
||||
else last
|
||||
if (shown == null) return null
|
||||
val status = when {
|
||||
acknowledgment(shown.eventId).matches(responseValues) -> "Confirmed by server"
|
||||
cancelling -> "Cancelling. Scan was not confirmed."
|
||||
pendingId == shown.eventId && waiting -> "Sending scan…"
|
||||
pendingId == shown.eventId -> "Not confirmed. Retry the same request or leave the process; do not assume it was saved."
|
||||
else -> "Not confirmed. Follow the process message before submitting again."
|
||||
}
|
||||
return ScanFeedback(shown.barcode, shown.symbology ?: MANUAL_SYMBOLOGY, describe(shown.barcode), status)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Control characters are invisible in a text field, so report them without altering the value.
|
||||
*******************************************************************************/
|
||||
fun describe(barcode: String): String {
|
||||
val controls = barcode.count { Character.isISOControl(it) }
|
||||
val length = "${barcode.length} ${if (barcode.length == 1) "character" else "characters"}"
|
||||
return if (controls == 0) length else "$length, $controls control ${if (controls == 1) "character" else "characters"}"
|
||||
}
|
||||
}
|
||||
@@ -17,7 +17,7 @@ internal interface ScannerDriver {
|
||||
/*******************************************************************************
|
||||
** Preserve raw barcode data and reject callbacks after ownership, readiness or generation changes.
|
||||
*******************************************************************************/
|
||||
fun scanned(barcode: String, symbology: String)
|
||||
fun scanned(capture: ScannerCapture)
|
||||
|
||||
/*******************************************************************************
|
||||
** Distinguish ordinary empty reads from rejected multi-barcode reads without fabricating a scan.
|
||||
@@ -61,7 +61,7 @@ internal interface ScannerDriver {
|
||||
*******************************************************************************/
|
||||
internal class ScannerInputSession(
|
||||
private val createDriver: () -> ScannerDriver?,
|
||||
private val onScan: (String, String) -> Unit,
|
||||
private val onScan: (ScannerCapture) -> Unit,
|
||||
private val onStatus: (String, Boolean) -> Unit,
|
||||
private val canAcceptInput: () -> Boolean = { true },
|
||||
) {
|
||||
@@ -122,13 +122,13 @@ internal class ScannerInputSession(
|
||||
/*******************************************************************************
|
||||
** Preserve raw barcode data and reject callbacks after ownership, readiness or generation changes.
|
||||
*******************************************************************************/
|
||||
override fun scanned(barcode: String, symbology: String) {
|
||||
override fun scanned(capture: ScannerCapture) {
|
||||
if (!isCurrent() || !accepting || !armed || !canAcceptInput()) return
|
||||
armed = false
|
||||
accepting = false
|
||||
readNotice = null
|
||||
onStatus("Waiting for scan confirmation…", false)
|
||||
onScan(barcode, symbology)
|
||||
onScan(capture)
|
||||
// IDLE may precede data. Stop any read armed in that interval before accepting more input.
|
||||
try {
|
||||
if (driver === current && current.isReadPending()) current.cancelRead()
|
||||
|
||||
@@ -4,6 +4,7 @@ package io.qrun.mobile.scanner
|
||||
import android.content.Context
|
||||
import androidx.compose.foundation.layout.Arrangement
|
||||
import androidx.compose.foundation.layout.Column
|
||||
import androidx.compose.foundation.layout.fillMaxWidth
|
||||
import androidx.compose.foundation.layout.padding
|
||||
import androidx.compose.foundation.text.KeyboardActions
|
||||
import androidx.compose.foundation.text.KeyboardOptions
|
||||
@@ -22,6 +23,7 @@ import androidx.compose.runtime.rememberUpdatedState
|
||||
import androidx.compose.runtime.setValue
|
||||
import androidx.compose.ui.Modifier
|
||||
import androidx.compose.ui.platform.LocalContext
|
||||
import androidx.compose.ui.platform.testTag
|
||||
import androidx.compose.ui.platform.LocalView
|
||||
import androidx.compose.ui.platform.LocalWindowInfo
|
||||
import androidx.compose.ui.platform.LocalFocusManager
|
||||
@@ -32,7 +34,6 @@ import androidx.lifecycle.Lifecycle
|
||||
import androidx.lifecycle.LifecycleEventObserver
|
||||
import androidx.lifecycle.compose.LocalLifecycleOwner
|
||||
import com.kingsrook.qqq.frontend.android.mobileapp.ui.widgets.blocks.WidgetBlockParameters
|
||||
import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.ProcessAcknowledgment
|
||||
import com.kingsrook.qqq.frontend.android.mobileapp.ui.LocalProcessInputAllowed
|
||||
|
||||
/*******************************************************************************
|
||||
@@ -41,7 +42,8 @@ import com.kingsrook.qqq.frontend.android.mobileapp.ui.LocalProcessInputAllowed
|
||||
@Composable
|
||||
internal fun ScannerWidget(
|
||||
parameters: WidgetBlockParameters, modifier: Modifier, disabled: Boolean,
|
||||
driverFactory: (Context) -> ScannerDriver? = ::createScannerDriver
|
||||
driverFactory: (Context) -> ScannerDriver? = ::createScannerDriver,
|
||||
fidelityAvailable: () -> Boolean = { false }
|
||||
) {
|
||||
val context = LocalContext.current
|
||||
val view = LocalView.current
|
||||
@@ -82,7 +84,8 @@ internal fun ScannerWidget(
|
||||
/*******************************************************************************
|
||||
** Each new physical scan has an identity; retries are handled by ProcessViewModel.
|
||||
*******************************************************************************/
|
||||
fun submit(barcode: String, symbology: String, source: String): Boolean {
|
||||
fun submit(capture: ScannerCapture, source: String): Boolean {
|
||||
val barcode = capture.barcode
|
||||
if (process == null) {
|
||||
notice = "This scanner control requires an active process."
|
||||
return false
|
||||
@@ -96,12 +99,11 @@ internal fun ScannerWidget(
|
||||
return false
|
||||
}
|
||||
notice = "Sending scan…"
|
||||
val event = ScanEvent(barcode, symbology, source)
|
||||
val event = ScanEvent(capture, source)
|
||||
process.widgetState[ScannerFeedback.STATE_KEY] = LastScan.of(event)
|
||||
// Capability is read from cached verified discovery on the UI thread; it never triggers HTTP.
|
||||
process.runStep(
|
||||
event.values(), ProcessAcknowledgment(
|
||||
"acknowledgedEventId", event.eventId,
|
||||
requiredValues = mapOf("scanSaved" to true), nonEmptyStringFields = setOf("scanId")
|
||||
)
|
||||
event.values(includeFidelity = fidelityAvailable()), ScannerFeedback.acknowledgment(event.eventId)
|
||||
)
|
||||
// runStep can reject local metadata/validation before accepting an event.
|
||||
// A synchronous test repository can also finish and acknowledge it immediately.
|
||||
@@ -111,12 +113,12 @@ internal fun ScannerWidget(
|
||||
return accepted
|
||||
}
|
||||
|
||||
val currentSubmit by rememberUpdatedState<(String, String, String) -> Boolean>(::submit)
|
||||
val currentSubmit by rememberUpdatedState<(ScannerCapture, String) -> Boolean>(::submit)
|
||||
val input = remember(context, process, driverFactory)
|
||||
{
|
||||
ScannerInputSession(
|
||||
{ driverFactory(context) },
|
||||
{ barcode, symbology -> currentSubmit(barcode, symbology, HARDWARE_SCAN_SOURCE) },
|
||||
{ capture -> currentSubmit(capture, HARDWARE_SCAN_SOURCE) },
|
||||
{ message, reconnect -> scannerStatus = message; canReconnect = reconnect },
|
||||
canAcceptInput = { currentInputReady() })
|
||||
}
|
||||
@@ -140,6 +142,11 @@ internal fun ScannerWidget(
|
||||
{
|
||||
Text(parameters.widgetBlock.values["title"]?.toString() ?: "Scan a barcode")
|
||||
Text(parameters.widgetBlock.values["instructions"]?.toString() ?: "Press the handheld scan trigger. Wait for server confirmation before scanning again.")
|
||||
val feedback = ScannerFeedback.derive(
|
||||
process?.widgetState?.get(ScannerFeedback.STATE_KEY) as? LastScan, process?.pendingStepValues, parameters.values,
|
||||
process?.waitingOnBackend == true, process?.cancelling == true
|
||||
)
|
||||
ScanFeedbackPanel(feedback)
|
||||
if (parameters.values["scanSaved"] == true && notice.isEmpty()) {
|
||||
Text("${scannerMetaData.acknowledgmentLabel} ${parameters.values["scanId"] ?: ""}")
|
||||
}
|
||||
@@ -156,8 +163,24 @@ internal fun ScannerWidget(
|
||||
)
|
||||
Button(enabled = ready && manual.isNotEmpty(), onClick = {
|
||||
focusManager.clearFocus(); keyboard?.hide()
|
||||
if (submit(manual, "MANUAL", "manual")) manual = ""
|
||||
if (submit(ScannerCapture.manual(manual), "manual")) manual = ""
|
||||
}) { Text(scannerMetaData.submitLabel) }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Shown for every SCANNER widget, including those with manual entry disabled. A read-only field never
|
||||
** requests focus or opens the keyboard, and the value is displayed exactly as received.
|
||||
*******************************************************************************/
|
||||
@Composable
|
||||
internal fun ScanFeedbackPanel(feedback: ScanFeedback?) {
|
||||
OutlinedTextField(
|
||||
feedback?.barcode ?: "", {}, modifier = Modifier.fillMaxWidth().testTag("scanner-barcode"),
|
||||
label = { Text("Barcode") }, readOnly = true, singleLine = true,
|
||||
placeholder = { Text(ScannerFeedback.WAITING) },
|
||||
supportingText = feedback?.let { { Text(it.details) } }
|
||||
)
|
||||
Text("Symbology: ${feedback?.symbology ?: "—"}", Modifier.testTag("scanner-symbology"))
|
||||
Text(feedback?.status ?: ScannerFeedback.WAITING, Modifier.testTag("scanner-status"))
|
||||
}
|
||||
@@ -7,7 +7,6 @@ import androidx.compose.foundation.layout.padding
|
||||
import androidx.compose.material3.MaterialTheme
|
||||
import androidx.compose.material3.Surface
|
||||
import androidx.compose.material3.Text
|
||||
import androidx.compose.material3.TextButton
|
||||
import androidx.compose.runtime.Composable
|
||||
import androidx.compose.ui.Alignment
|
||||
import androidx.compose.ui.Modifier
|
||||
@@ -44,17 +43,15 @@ private fun containsPasswordWidget(value: Any?): Boolean = when (value) {
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Keep the operator informed of active viewing and expose immediate pause/resume control.
|
||||
** Keep the operator informed of active or suspended viewing; this indicator is informational and offers no operator control.
|
||||
*******************************************************************************/
|
||||
@Composable
|
||||
internal fun ScreenViewingIndicator(controller: MobileSessionController) {
|
||||
if (controller.viewing || controller.operatorPaused) Surface(color = MaterialTheme.colorScheme.secondaryContainer)
|
||||
{
|
||||
Row(Modifier.fillMaxWidth().padding(horizontal = 12.dp), verticalAlignment = Alignment.CenterVertically)
|
||||
Row(Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp), verticalAlignment = Alignment.CenterVertically)
|
||||
{
|
||||
Text(if (controller.operatorPaused) "Screen viewing paused" else "Screen being viewed by an administrator", Modifier.weight(1f))
|
||||
TextButton(onClick = { if (controller.operatorPaused) controller.allowViewing() else controller.pauseViewing() })
|
||||
{ Text(if (controller.operatorPaused) "Allow viewing" else "Stop viewing") }
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,193 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
/*******************************************************************************
|
||||
** What this process currently knows about the operator's session. Never persisted: a new process starts UNKNOWN.
|
||||
*******************************************************************************/
|
||||
internal enum class WallpaperSessionState { UNKNOWN, SIGNED_OUT, SIGNED_IN }
|
||||
|
||||
/*******************************************************************************
|
||||
** Immutable display-only snapshot. Holds no credential, token, cookie or session identifier.
|
||||
*******************************************************************************/
|
||||
internal data class WallpaperSnapshot(
|
||||
val state: WallpaperSessionState = WallpaperSessionState.UNKNOWN,
|
||||
val displayName: String? = null,
|
||||
val serverHost: String? = null,
|
||||
val brandName: String = HostBrand().displayName,
|
||||
val brandColor: String = HostBrand().primaryColor,
|
||||
val foreground: Boolean = false,
|
||||
val confirmedAtElapsed: Long = 0L,
|
||||
val confirmedAtWall: Long = 0L,
|
||||
)
|
||||
|
||||
/*******************************************************************************
|
||||
** Observer notified after a snapshot changes; it may be called on any thread.
|
||||
*******************************************************************************/
|
||||
internal fun interface WallpaperStatusListener {
|
||||
/*******************************************************************************
|
||||
** Read the new snapshot from the store; the callback carries no data.
|
||||
*******************************************************************************/
|
||||
fun changed()
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** In-memory publisher of the approved session display name. Identity is dropped on sign-out and clear.
|
||||
*******************************************************************************/
|
||||
internal class WallpaperStatusStore(private val elapsed: () -> Long, private val wall: () -> Long) {
|
||||
private val lock = Any()
|
||||
private val listeners = LinkedHashSet<WallpaperStatusListener>()
|
||||
@Volatile
|
||||
var snapshot = WallpaperSnapshot()
|
||||
private set
|
||||
|
||||
/*******************************************************************************
|
||||
** Register until removed; the wallpaper engine removes itself when it stops being visible or is destroyed.
|
||||
*******************************************************************************/
|
||||
fun addListener(listener: WallpaperStatusListener) = synchronized(lock) { listeners.add(listener) }
|
||||
|
||||
/*******************************************************************************
|
||||
** Stop notifying a listener; safe to call when it was never added.
|
||||
*******************************************************************************/
|
||||
fun removeListener(listener: WallpaperStatusListener) = synchronized(lock) { listeners.remove(listener) }
|
||||
|
||||
/*******************************************************************************
|
||||
** Apply the validated public brand of the selected server; invalid values keep the current brand.
|
||||
*******************************************************************************/
|
||||
fun setBrand(name: String, color: String) {
|
||||
val cleanName = cleanText(name, 80) ?: return
|
||||
if (!BRAND_COLOR.matches(color)) return
|
||||
update { it.copy(brandName = cleanName, brandColor = color.uppercase()) }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Record a signed-in, device-approved session. Each call confirms the session as of now; the caller invokes it
|
||||
** again with foreground=false as the app leaves the screen, which is the last time the server was reachable.
|
||||
*******************************************************************************/
|
||||
fun signedIn(displayName: String?, serverHost: String?, foreground: Boolean) {
|
||||
update {
|
||||
it.copy(
|
||||
state = WallpaperSessionState.SIGNED_IN, displayName = cleanText(displayName, MAX_NAME), serverHost = cleanText(serverHost, 80),
|
||||
foreground = foreground, confirmedAtElapsed = elapsed(), confirmedAtWall = wall()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Drop identity when a signed-in session ends (logout, unauthorized, revocation); leave other states alone so
|
||||
** startup does not claim "signed out" before restoration finishes.
|
||||
*******************************************************************************/
|
||||
fun signedOutIfSignedIn() {
|
||||
if (snapshot.state == WallpaperSessionState.SIGNED_IN) update { it.signedOutCopy() }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Forget everything session-related (activity destroyed, server change): the state becomes UNKNOWN, not signed out.
|
||||
*******************************************************************************/
|
||||
fun clear() = update { it.copy(state = WallpaperSessionState.UNKNOWN, displayName = null, serverHost = null, foreground = false, confirmedAtElapsed = 0L, confirmedAtWall = 0L) }
|
||||
|
||||
private fun WallpaperSnapshot.signedOutCopy() =
|
||||
copy(state = WallpaperSessionState.SIGNED_OUT, displayName = null, serverHost = null, foreground = false, confirmedAtElapsed = 0L, confirmedAtWall = 0L)
|
||||
|
||||
/*******************************************************************************
|
||||
** Swap the snapshot and notify outside the lock so a listener cannot deadlock the publisher.
|
||||
*******************************************************************************/
|
||||
private fun update(change: (WallpaperSnapshot) -> WallpaperSnapshot) {
|
||||
val toNotify = synchronized(lock) {
|
||||
val next = change(snapshot)
|
||||
if (next == snapshot) return
|
||||
snapshot = next
|
||||
listeners.toList()
|
||||
}
|
||||
toNotify.forEach { it.changed() }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Single-line presentation text only: no control characters, bounded length, null when empty.
|
||||
*******************************************************************************/
|
||||
companion object {
|
||||
const val MAX_NAME = 40
|
||||
private val BRAND_COLOR = Regex("#[0-9a-fA-F]{6}")
|
||||
|
||||
/*******************************************************************************
|
||||
** Normalize display text before it can reach a canvas.
|
||||
*******************************************************************************/
|
||||
fun cleanText(raw: String?, max: Int): String? = raw?.filterNot { it.isISOControl() }?.trim()?.take(max)?.takeIf { it.isNotEmpty() }
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Where the wallpaper is being drawn. Identity and IP are shown only for HOME.
|
||||
*******************************************************************************/
|
||||
internal enum class WallpaperContext { PREVIEW, LOCKED, HOME }
|
||||
|
||||
/*******************************************************************************
|
||||
** Text and colours for one frame.
|
||||
*******************************************************************************/
|
||||
internal data class WallpaperFrame(val header: String, val lines: List<String>, val colorHex: String, val darkText: Boolean)
|
||||
|
||||
/*******************************************************************************
|
||||
** Pure rules that decide what the wallpaper may say, so they can be tested without a device.
|
||||
*******************************************************************************/
|
||||
internal object WallpaperPresentation {
|
||||
/** The heartbeat only runs while the app is foreground; beyond this the name is no longer shown. */
|
||||
const val STALE_AFTER_MILLIS = 15 * 60 * 1000L
|
||||
|
||||
/*******************************************************************************
|
||||
** A signed-in session whose app has been in the background past the window is unverified, not signed in.
|
||||
*******************************************************************************/
|
||||
fun isStale(snapshot: WallpaperSnapshot, nowElapsed: Long) =
|
||||
snapshot.state == WallpaperSessionState.SIGNED_IN && !snapshot.foreground && nowElapsed - snapshot.confirmedAtElapsed >= STALE_AFTER_MILLIS
|
||||
|
||||
/*******************************************************************************
|
||||
** Milliseconds until a displayed, not-yet-stale name must be withdrawn, or null when no timer is needed.
|
||||
*******************************************************************************/
|
||||
fun millisUntilStale(snapshot: WallpaperSnapshot, nowElapsed: Long): Long? =
|
||||
if (snapshot.state == WallpaperSessionState.SIGNED_IN && !snapshot.foreground && !isStale(snapshot, nowElapsed))
|
||||
STALE_AFTER_MILLIS - (nowElapsed - snapshot.confirmedAtElapsed) else null
|
||||
|
||||
/*******************************************************************************
|
||||
** Compose the IP line from what the network callback last reported.
|
||||
*******************************************************************************/
|
||||
fun networkLine(known: Boolean, addresses: String?) = when {
|
||||
!known -> "IP: unknown"
|
||||
addresses == null -> "IP: no network address"
|
||||
else -> "IP: $addresses"
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Brand only for PREVIEW and LOCKED. HOME adds session state, the approved display name only while it is fresh,
|
||||
** the server host, and the IP. The wording never claims the server just verified a background session.
|
||||
*******************************************************************************/
|
||||
fun render(snapshot: WallpaperSnapshot, context: WallpaperContext, networkLine: String, nowElapsed: Long, formatTime: (Long) -> String): WallpaperFrame {
|
||||
val dark = useBlackOnPrimary(snapshot.brandColor)
|
||||
if (context != WallpaperContext.HOME) return WallpaperFrame(snapshot.brandName, emptyList(), snapshot.brandColor, dark)
|
||||
val lines = mutableListOf<String>()
|
||||
when (snapshot.state) {
|
||||
WallpaperSessionState.UNKNOWN -> lines += "Session: not available"
|
||||
WallpaperSessionState.SIGNED_OUT -> lines += "Signed out"
|
||||
WallpaperSessionState.SIGNED_IN -> if (isStale(snapshot, nowElapsed)) {
|
||||
lines += "Session unverified"
|
||||
lines += "Last confirmed ${formatTime(snapshot.confirmedAtWall)}"
|
||||
} else {
|
||||
lines += snapshot.displayName?.let { "Signed in: $it" } ?: "Signed in"
|
||||
if (!snapshot.foreground) lines += "Last confirmed ${formatTime(snapshot.confirmedAtWall)} (app in background)"
|
||||
snapshot.serverHost?.let { lines += "Server: $it" }
|
||||
}
|
||||
}
|
||||
lines += networkLine
|
||||
return WallpaperFrame(snapshot.brandName, lines, snapshot.brandColor, dark)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Summarize the default network's link addresses for display: interface label plus up to two usable addresses,
|
||||
** IPv4 first. Loopback and IPv6 link-local addresses are omitted; scope suffixes are stripped. Null when none remain.
|
||||
*******************************************************************************/
|
||||
internal fun formatNetworkAddresses(interfaceName: String?, addresses: List<String>): String? {
|
||||
val usable = addresses.map { it.substringBefore('%') }
|
||||
.filter { it.isNotBlank() && !it.startsWith("fe80", ignoreCase = true) && it != "::1" && !it.startsWith("127.") }
|
||||
.distinct()
|
||||
if (usable.isEmpty()) return null
|
||||
val label = interfaceName?.filter { it.isLetterOrDigit() || it == '.' || it == '_' || it == '-' }?.take(16)?.takeIf { it.isNotEmpty() }
|
||||
return (label?.let { "$it " } ?: "") + usable.sortedBy { it.contains(':') }.take(2).joinToString(", ")
|
||||
}
|
||||
@@ -8,6 +8,7 @@ import com.symbol.emdk.EMDKManager
|
||||
import com.symbol.emdk.EMDKResults
|
||||
import com.symbol.emdk.barcode.BarcodeManager
|
||||
import com.symbol.emdk.barcode.Scanner
|
||||
import com.symbol.emdk.barcode.ScannerConfig
|
||||
import com.symbol.emdk.barcode.StatusData
|
||||
|
||||
/*******************************************************************************
|
||||
@@ -29,27 +30,62 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
|
||||
private var closed = false
|
||||
private var opening = false
|
||||
private var ownsClaim = false
|
||||
|
||||
/*******************************************************************************
|
||||
** The scanner's output format as this driver has proven it. Text is accepted only in AIM (prefix present and
|
||||
** confirmed by read-back) or PLAIN (unchanged or restored, confirmed by read-back); PENDING and FAILED are
|
||||
** indeterminate, so any decode, and any readiness signal, is withheld.
|
||||
*******************************************************************************/
|
||||
private enum class Profile { PENDING, AIM, PLAIN, FAILED }
|
||||
|
||||
// Application-owned, temporary: AIM is set only after applying codeIdType=AIM and reading the same value back.
|
||||
// The original value is restored (and read back) before the scanner is released.
|
||||
@Volatile private var profile = Profile.PENDING
|
||||
private var idleSeenBeforeProfile = false
|
||||
private var originalCodeIdType: ScannerConfig.CodeIdType? = null
|
||||
private var codeIdTypeChanged = false
|
||||
private val dataListener = Scanner.DataListener { collection ->
|
||||
// Copy SDK-owned data now; the collection must not be read after this callback returns. AIM is read only
|
||||
// under the confirmed profile, by AimOutputProfile; without it the text is user payload and stays untouched.
|
||||
// This runs on an SDK thread, possibly while the open sequence is still configuring: an unresolved or failed
|
||||
// format drops the decode instead of guessing. The hardware read completes and the next IDLE re-arms it.
|
||||
val mode = profile
|
||||
if (mode != Profile.AIM && mode != Profile.PLAIN) return@DataListener
|
||||
val scans = collection?.scanData
|
||||
var capture: ScannerCapture? = null
|
||||
var multiple = false
|
||||
if (collection?.result == com.symbol.emdk.barcode.ScannerResults.SUCCESS && !scans.isNullOrEmpty()) {
|
||||
if (scans.size != 1) multiple = true
|
||||
else {
|
||||
val scan = scans.single()
|
||||
val barcode = scan?.data
|
||||
val label = scan?.labelType?.toString() ?: "UNKNOWN"
|
||||
if (!barcode.isNullOrEmpty()) {
|
||||
if (mode == Profile.PLAIN) capture = ScannerCapture.of(barcode, label, scan.rawData)
|
||||
else {
|
||||
// A missing or inconsistent prefix under the confirmed profile drops the read; it is never guessed.
|
||||
// Raw bytes stay exactly what the SDK returned, whether or not they carry the same prefix.
|
||||
val split = AimOutputProfile.split(barcode, label)
|
||||
if (split != null) capture = ScannerCapture.of(split.payload, label, scan.rawData, split.aimIdentifier)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
val delivered = capture
|
||||
main.post {
|
||||
if (!closed) {
|
||||
val scans = collection?.scanData
|
||||
if (collection?.result != com.symbol.emdk.barcode.ScannerResults.SUCCESS || scans.isNullOrEmpty())
|
||||
listener?.noData(false)
|
||||
else if (scans.size != 1) listener?.noData(true)
|
||||
else {
|
||||
val scan = scans.single()
|
||||
val barcode = scan?.data
|
||||
if (barcode.isNullOrEmpty()) listener?.noData(false)
|
||||
else listener?.scanned(barcode, scan.labelType?.toString() ?: "UNKNOWN")
|
||||
}
|
||||
if (delivered != null) listener?.scanned(delivered) else listener?.noData(multiple)
|
||||
}
|
||||
}
|
||||
}
|
||||
private val statusListener = Scanner.StatusListener { status ->
|
||||
main.post {
|
||||
if (!closed) {
|
||||
if (status.state == StatusData.ScannerStates.IDLE) listener?.idle()
|
||||
else if (status.state == StatusData.ScannerStates.ERROR) listener?.failed()
|
||||
if (status.state == StatusData.ScannerStates.IDLE) {
|
||||
// Readiness arms a read. It is withheld until the output format is proven, then replayed once.
|
||||
if (profile == Profile.AIM || profile == Profile.PLAIN) listener?.idle()
|
||||
else if (profile == Profile.PENDING) idleSeenBeforeProfile = true
|
||||
} else if (status.state == StatusData.ScannerStates.ERROR) listener?.failed()
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -91,7 +127,15 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
|
||||
device.addStatusListener(statusListener)
|
||||
device.triggerType = Scanner.TriggerType.HARD
|
||||
device.enable()
|
||||
if (!applyAimProfile(device)) {
|
||||
profile = Profile.FAILED
|
||||
this@ZebraScannerDriver.listener?.failed()
|
||||
} else if (idleSeenBeforeProfile) {
|
||||
idleSeenBeforeProfile = false
|
||||
this@ZebraScannerDriver.listener?.idle()
|
||||
}
|
||||
} catch (exception: Exception) {
|
||||
profile = Profile.FAILED
|
||||
this@ZebraScannerDriver.listener?.failed()
|
||||
}
|
||||
}
|
||||
@@ -151,31 +195,100 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
|
||||
scanner = null
|
||||
manager = null
|
||||
var failure: Exception? = null
|
||||
var releaseFailure: Exception? = null
|
||||
|
||||
/*******************************************************************************
|
||||
** Attempt every resource release even when an earlier cleanup fails, then propagate the recorded failure.
|
||||
** Only a failed device or manager release means ownership is unknown; other failures are still reported.
|
||||
*******************************************************************************/
|
||||
fun attempt(action: () -> Unit) {
|
||||
fun attempt(isRelease: Boolean = false, action: () -> Unit) {
|
||||
try {
|
||||
action()
|
||||
} catch (exception: Exception) {
|
||||
failure = exception
|
||||
if (isRelease) releaseFailure = exception
|
||||
}
|
||||
}
|
||||
if (device != null) {
|
||||
attempt { device.removeDataListener(dataListener) }
|
||||
attempt { device.removeStatusListener(statusListener) }
|
||||
attempt { if (device.isReadPending) device.cancelRead() }
|
||||
attempt { device.release() }
|
||||
attempt { check(restoreCodeIdType(device)) { "Scanner output profile restoration could not be verified" } }
|
||||
attempt(isRelease = true) { device.release() }
|
||||
}
|
||||
if (owner != null) {
|
||||
attempt { owner.release(EMDKManager.FEATURE_TYPE.BARCODE) }
|
||||
attempt { owner.release() }
|
||||
attempt(isRelease = true) { owner.release(EMDKManager.FEATURE_TYPE.BARCODE) }
|
||||
attempt(isRelease = true) { owner.release() }
|
||||
}
|
||||
if (!opening && failure == null) releaseClaim()
|
||||
// A confirmed device and manager release frees the application-wide claim even when restoring the scanner's
|
||||
// output format failed; an unconfirmed release keeps it, and a pending asynchronous bind still resolves it later.
|
||||
if (!opening && releaseFailure == null) releaseClaim()
|
||||
failure?.let { throw it }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Ask the enabled scanner to prefix each decode with its AIM identifier and prove the resulting format by
|
||||
** reading it back, whatever the setter reported. A setter that threw is not trusted either way: the read-back
|
||||
** decides. AIM confirmed -> AIM; unchanged or restored-and-verified -> PLAIN; anything else -> false (the caller
|
||||
** fails the open), because prefixed text would then be indistinguishable from user data. An unsupported setting
|
||||
** changes nothing and leaves AIM absent (PLAIN). Reading the original value may throw; the caller fails the open.
|
||||
*******************************************************************************/
|
||||
private fun applyAimProfile(device: Scanner): Boolean {
|
||||
val config = device.config
|
||||
if (!config.isParamSupported("config.scanParams.codeIdType")) {
|
||||
profile = Profile.PLAIN
|
||||
return true
|
||||
}
|
||||
val original = config.scanParams.codeIdType
|
||||
originalCodeIdType = original
|
||||
codeIdTypeChanged = true
|
||||
config.scanParams.codeIdType = ScannerConfig.CodeIdType.AIM
|
||||
try {
|
||||
device.config = config
|
||||
} catch (exception: Exception) {
|
||||
android.util.Log.w("Scanner", "AIM output profile could not be applied")
|
||||
}
|
||||
val effective = try {
|
||||
device.config.scanParams.codeIdType
|
||||
} catch (exception: Exception) {
|
||||
null
|
||||
}
|
||||
return when (classifyAimReadback(original, ScannerConfig.CodeIdType.AIM, effective)) {
|
||||
AimReadback.CONFIRMED -> {
|
||||
// Nothing to undo when the scanner already reported AIM before this driver touched it.
|
||||
codeIdTypeChanged = original != ScannerConfig.CodeIdType.AIM
|
||||
profile = Profile.AIM
|
||||
true
|
||||
}
|
||||
AimReadback.UNCHANGED -> {
|
||||
codeIdTypeChanged = false
|
||||
profile = Profile.PLAIN
|
||||
true
|
||||
}
|
||||
AimReadback.INDETERMINATE -> restoreCodeIdType(device).also { if (it) profile = Profile.PLAIN }
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Put back the value read before this driver changed it and prove it by reading it back; setter success alone is
|
||||
** not proof. The profile is FAILED until proven, so no decode is trusted while the format is indeterminate.
|
||||
*******************************************************************************/
|
||||
private fun restoreCodeIdType(device: Scanner): Boolean {
|
||||
val original = originalCodeIdType
|
||||
if (!codeIdTypeChanged || original == null) return true
|
||||
profile = Profile.FAILED
|
||||
val verified = try {
|
||||
val config = device.config
|
||||
config.scanParams.codeIdType = original
|
||||
device.config = config
|
||||
device.config.scanParams.codeIdType == original
|
||||
} catch (exception: Exception) {
|
||||
false
|
||||
}
|
||||
if (verified) codeIdTypeChanged = false
|
||||
return verified
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Relinquish only this driver's manager claim after asynchronous opening and cleanup are resolved.
|
||||
*******************************************************************************/
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<resources>
|
||||
<string name="status_wallpaper_label">QQQ status wallpaper</string>
|
||||
<string name="status_wallpaper_description">Company name on the lock screen. On the unlocked home screen it also shows the signed-in display name and the device IP address.</string>
|
||||
<string name="restriction_server_url_title">QQQ server URL</string>
|
||||
<string name="restriction_server_url_description">HTTPS origin only, for example https://qqq.example.com/. No credentials, path, query or fragment. A different connected server is never switched silently.</string>
|
||||
<string name="restriction_orientation_title">Screen orientation</string>
|
||||
<string name="restriction_orientation_description">Applied when this value changes; the operator may change it locally afterwards.</string>
|
||||
<string-array name="restriction_orientation_entries">
|
||||
<item>System default</item>
|
||||
<item>Portrait</item>
|
||||
<item>Landscape</item>
|
||||
<item>Reverse portrait</item>
|
||||
<item>Reverse landscape</item>
|
||||
</string-array>
|
||||
<string-array name="restriction_orientation_values">
|
||||
<item>SYSTEM</item>
|
||||
<item>PORTRAIT</item>
|
||||
<item>LANDSCAPE</item>
|
||||
<item>REVERSE_PORTRAIT</item>
|
||||
<item>REVERSE_LANDSCAPE</item>
|
||||
</string-array>
|
||||
</resources>
|
||||
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
|
||||
<restriction android:key="qqq_server_url" android:title="@string/restriction_server_url_title"
|
||||
android:description="@string/restriction_server_url_description" android:restrictionType="string" />
|
||||
<restriction android:key="qqq_orientation" android:title="@string/restriction_orientation_title"
|
||||
android:description="@string/restriction_orientation_description" android:restrictionType="choice"
|
||||
android:entries="@array/restriction_orientation_entries" android:entryValues="@array/restriction_orientation_values" />
|
||||
</restrictions>
|
||||
@@ -0,0 +1,3 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<wallpaper xmlns:android="http://schemas.android.com/apk/res/android"
|
||||
android:thumbnail="@drawable/ic_scanner" android:description="@string/status_wallpaper_description" />
|
||||
@@ -139,7 +139,7 @@ class ScannerOverlayTest {
|
||||
**
|
||||
*******************************************************************************/
|
||||
fun emit(value: String) {
|
||||
pending = false; listener.scanned(value, "QRCODE"); listener.idle()
|
||||
pending = false; listener.scanned(ScannerCapture.of(value, "QRCODE")); listener.idle()
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** The confirmed AIM output profile removes only a consistent three-character prefix.
|
||||
*******************************************************************************/
|
||||
class AimOutputProfileTest {
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun splitsConsistentPrefixAndKeepsPayloadExact() {
|
||||
assertEquals(AimOutputProfile.Split("]C0", "001234"), AimOutputProfile.split("]C0001234", "LABEL-TYPE-CODE128"))
|
||||
assertEquals(AimOutputProfile.Split("]Q1", "001234567890"), AimOutputProfile.split("]Q1001234567890", "QRCODE"))
|
||||
assertEquals(AimOutputProfile.Split("]E0", "5901234123457"), AimOutputProfile.split("]E05901234123457", "LABEL-TYPE-EAN13"))
|
||||
assertEquals(AimOutputProfile.Split("]E4", "12345670"), AimOutputProfile.split("]E412345670", "EAN8"))
|
||||
assertEquals(AimOutputProfile.Split("]d1", " A "), AimOutputProfile.split("]d1 A ", "DATAMATRIX"))
|
||||
assertEquals(AimOutputProfile.Split("]X0", "x"), AimOutputProfile.split("]X0x", "LABEL-TYPE-SOMETHING-ELSE"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Only the first three characters are removed, even when the user payload looks like an identifier.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun payloadBeginningWithAnIdentifierIsNotStrippedTwice() {
|
||||
assertEquals(AimOutputProfile.Split("]C0", "]C0123"), AimOutputProfile.split("]C0]C0123", "CODE128"))
|
||||
assertEquals(AimOutputProfile.Split("]C0", "]Q1abc"), AimOutputProfile.split("]C0]Q1abc", "CODE128"))
|
||||
assertEquals(AimOutputProfile.Split("]Q1", "]"), AimOutputProfile.split("]Q1]", "QRCODE"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun malformedOrInconsistentPrefixIsNotTrusted() {
|
||||
for (text in listOf("", "]", "]C", "]C0", "C0001234", "[C0001234", "]00001234", "]C-001234", "]éC0123", " ]C0123", "001234")) {
|
||||
assertNull(text, AimOutputProfile.split(text, "CODE128"))
|
||||
}
|
||||
// A well-formed prefix that belongs to another symbology family means the label or prefix is not what was configured.
|
||||
assertNull(AimOutputProfile.split("]Q1001234", "CODE128"))
|
||||
assertNull(AimOutputProfile.split("]E0001234567890", "LABEL-TYPE-CODE128"))
|
||||
assertNull(AimOutputProfile.split("]C0001234", "QRCODE"))
|
||||
assertNull(AimOutputProfile.split("]C0001234", "EAN13"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The capture constructor accepts exactly what the parser produces.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun parsedIdentifierIsAValidCaptureIdentifier() {
|
||||
val split = AimOutputProfile.split("]z0Hello", "AZTEC")!!
|
||||
val capture = ScannerCapture.of(split.payload, "AZTEC", "]z0Hello".toByteArray(), split.aimIdentifier)
|
||||
assertEquals("Hello", capture.barcode)
|
||||
assertEquals("]z0", capture.aimIdentifier)
|
||||
assertEquals(java.util.Base64.getEncoder().encodeToString("]z0Hello".toByteArray()), capture.rawDataBase64)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** The driver may accept scanner text only in a format proven by read-back; everything else must fail closed.
|
||||
*******************************************************************************/
|
||||
class AimReadbackTest {
|
||||
private val aim = "AIM"
|
||||
private val original = "NONE"
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun reportedAimIsConfirmedEvenIfTheSetterThrew() {
|
||||
assertEquals(AimReadback.CONFIRMED, classifyAimReadback(original, aim, aim))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun aScannerAlreadyReportingAimIsConfirmedNotUnchanged() {
|
||||
assertEquals(AimReadback.CONFIRMED, classifyAimReadback(aim, aim, aim))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun exactlyTheOriginalValueIsUnchanged() {
|
||||
assertEquals(AimReadback.UNCHANGED, classifyAimReadback(original, aim, original))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun anUnreadableOrForeignValueIsIndeterminate() {
|
||||
assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(original, aim, null))
|
||||
assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(original, aim, "SYMBOL"))
|
||||
assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(aim, aim, null))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** Managed configuration is a bootstrap only: HTTPS origins and exact known orientation names, never silently defaulted.
|
||||
*******************************************************************************/
|
||||
class ManagedConfigurationTest {
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun noRestrictionsLeavesEverythingUnmanaged() {
|
||||
assertEquals(ManagedValues(), ManagedConfiguration.parse(null, null))
|
||||
assertEquals(ManagedValues(), ManagedConfiguration.parse("", " "))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun acceptsOnlyANormalizedHttpsOrigin() {
|
||||
assertEquals("https://qqq.example.com/", ManagedConfiguration.parse(" https://QQQ.example.com ", null).serverUrl)
|
||||
assertEquals("https://qqq.example.com:8443/", ManagedConfiguration.parse("https://qqq.example.com:8443/", null).serverUrl)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun rejectsHttpCredentialsPathsQueriesAndGarbageWithoutRecordingTheValue() {
|
||||
listOf(
|
||||
"http://qqq.example.com", "http://127.0.0.1:8080/", "https://user:pw@qqq.example.com", "https://qqq.example.com/app",
|
||||
"https://qqq.example.com/?t=1", "https://qqq.example.com/#f", "ftp://qqq.example.com", "not a url", "https://", "https://" + "a".repeat(2100)
|
||||
).forEach { value ->
|
||||
val parsed = ManagedConfiguration.parse(value, null)
|
||||
assertNull(value, parsed.serverUrl)
|
||||
assertEquals(listOf(MANAGED_SERVER_URL), parsed.rejectedKeys)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun orientationAcceptsEveryExistingNameExactly() {
|
||||
OrientationPolicy.entries.forEach { assertEquals(it, ManagedConfiguration.parse(null, it.name).orientation) }
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun unknownOrientationIsRejectedNotDefaultedToPortrait() {
|
||||
listOf("portrait", "Landscape", "AUTO", "SENSOR", "90", "REVERSE-PORTRAIT").forEach { value ->
|
||||
val parsed = ManagedConfiguration.parse(null, value)
|
||||
assertNull(value, parsed.orientation)
|
||||
assertEquals(listOf(MANAGED_ORIENTATION), parsed.rejectedKeys)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun aBadValueDoesNotBlockTheGoodOne() {
|
||||
val parsed = ManagedConfiguration.parse("http://bad.example.com", "LANDSCAPE")
|
||||
assertNull(parsed.serverUrl)
|
||||
assertEquals(OrientationPolicy.LANDSCAPE, parsed.orientation)
|
||||
assertEquals(listOf(MANAGED_SERVER_URL), parsed.rejectedKeys)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun serverIsNeverSwitchedSilently() {
|
||||
val managed = "https://managed.example.com/"
|
||||
assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction("https://other.example.com/", null))
|
||||
assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction(null, null))
|
||||
assertEquals(ManagedServerAction.PREFILL, ManagedConfiguration.serverAction(null, managed))
|
||||
assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction(managed, managed))
|
||||
assertEquals(ManagedServerAction.OFFER_CHANGE, ManagedConfiguration.serverAction("https://other.example.com/", managed))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun orientationIsAppliedOnlyWhenTheManagedValueChanges() {
|
||||
assertNull(ManagedConfiguration.orientationToApply(null, null))
|
||||
assertNull(ManagedConfiguration.orientationToApply(null, "LANDSCAPE"))
|
||||
assertEquals(OrientationPolicy.LANDSCAPE, ManagedConfiguration.orientationToApply(OrientationPolicy.LANDSCAPE, null))
|
||||
assertNull(ManagedConfiguration.orientationToApply(OrientationPolicy.LANDSCAPE, "LANDSCAPE"))
|
||||
assertEquals(OrientationPolicy.SYSTEM, ManagedConfiguration.orientationToApply(OrientationPolicy.SYSTEM, "LANDSCAPE"))
|
||||
}
|
||||
}
|
||||
@@ -328,7 +328,16 @@ class MobileSessionTest {
|
||||
val screen = server.takeRequest()
|
||||
assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/screen", screen.path)
|
||||
assertEquals(4, JSONObject(screen.body.readUtf8()).getLong("sequence"))
|
||||
assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/end", server.takeRequest().path)
|
||||
val end = server.takeRequest()
|
||||
assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/end", end.path)
|
||||
// Cookie-bearing native POSTs must present the exact origin of the URL used, like a browser.
|
||||
val expectedOrigin = origin.trimEnd('/')
|
||||
listOf(heartbeat, screen, end).forEach { request ->
|
||||
assertEquals("POST", request.method)
|
||||
assertEquals("sessionUUID=synthetic-session", request.getHeader("Cookie"))
|
||||
assertEquals(expectedOrigin, request.getHeader("Origin"))
|
||||
assertEquals(1, request.headers.values("Origin").size)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -109,7 +109,15 @@ class RecordFilesApiTest {
|
||||
val finalize = server.takeRequest()
|
||||
assertEquals(intent.requestId, finalize.getHeader("Idempotency-Key"))
|
||||
assertEquals(0L, finalize.bodySize)
|
||||
assertEquals("GET", server.takeRequest().method)
|
||||
val status = server.takeRequest()
|
||||
assertEquals("GET", status.method)
|
||||
// Every native record-file request (including the cookie-bearing mutations) presents its own exact origin.
|
||||
val expectedOrigin = origin.trimEnd('/')
|
||||
listOf(descriptor, capabilities, first, second, chunk, finalize, status).forEach {
|
||||
assertEquals(expectedOrigin, it.getHeader("Origin"))
|
||||
assertEquals(1, it.headers.values("Origin").size)
|
||||
}
|
||||
listOf(capabilities, first, second, chunk, finalize, status).forEach { assertEquals("sessionUUID=synthetic-session", it.getHeader("Cookie")) }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,14 +1,31 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiExtension
|
||||
import com.kingsrook.qqq.frontend.android.core.controllers.UiApiVersion
|
||||
import java.util.Base64
|
||||
import org.junit.Assert.assertArrayEquals
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertFalse
|
||||
import org.junit.Assert.assertNotEquals
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Assert.assertThrows
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** Retrying a submission must not turn it into a second captured scan.
|
||||
*******************************************************************************/
|
||||
class ScanEventTest {
|
||||
private val legacyKeys = setOf("barcode", "symbology", "scanSource", "eventId", "capturedAt")
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun version(scanners: String?, path: String = "/qbit/mobile-scanners") = UiApiVersion(
|
||||
"1.8.0", extensions = listOfNotNull(scanners?.let { UiApiExtension("mobile-scanners", it, path) })
|
||||
)
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@@ -19,4 +36,126 @@ class ScanEventTest {
|
||||
assertEquals("001234", event.values()["barcode"])
|
||||
assertNotEquals(event.eventId, ScanEvent("001234", "LABEL-TYPE-CODE128", "scanner").eventId)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun oldServerGetsExactlyTheLegacyFiveKeysEvenWhenFidelityIsCaptured() {
|
||||
val event = ScanEvent(ScannerCapture.of("A", "QRCODE", byteArrayOf(1, 2), "]Q1"), "zebra-emdk")
|
||||
assertEquals(legacyKeys, event.values().keys)
|
||||
assertEquals(legacyKeys, event.values(includeFidelity = false).keys)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun fidelityValuesAreFlatStringsAndMissingKeysAreOmitted() {
|
||||
val raw = byteArrayOf(0x1d, 0x41)
|
||||
val full = ScanEvent(ScannerCapture.of("A", "QRCODE", raw, "]Q1"), "zebra-emdk").values(true)
|
||||
assertEquals("]Q1", full["aimIdentifier"])
|
||||
assertEquals(Base64.getEncoder().encodeToString(raw), full["rawDataBase64"])
|
||||
val rawOnly = ScanEvent(ScannerCapture.of("A", "QRCODE", raw), "zebra-emdk").values(true)
|
||||
assertEquals(legacyKeys + "rawDataBase64", rawOnly.keys)
|
||||
assertEquals(legacyKeys, ScanEvent(ScannerCapture.manual("A"), "manual").values(true).keys)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun retryPayloadIsUnchangedAcrossRepeatedValueBuilding() {
|
||||
val source = byteArrayOf(0, 1, 2)
|
||||
val event = ScanEvent(ScannerCapture.of("A", "QRCODE", source, "]Q1"), "zebra-emdk")
|
||||
val first = event.values(true)
|
||||
source[0] = 9
|
||||
assertEquals(first, event.values(true))
|
||||
assertEquals(first, event.copy().values(true))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun captureCopiesInputAndAllByteValuesRoundTrip() {
|
||||
val all = ByteArray(256) { it.toByte() }
|
||||
val capture = ScannerCapture.of("A", "QRCODE", all)
|
||||
all.fill(0)
|
||||
val expected = ByteArray(256) { it.toByte() }
|
||||
assertArrayEquals(expected, Base64.getDecoder().decode(capture.rawDataBase64))
|
||||
assertEquals(capture, ScannerCapture.of("A", "QRCODE", expected))
|
||||
assertEquals(capture.hashCode(), ScannerCapture.of("A", "QRCODE", expected).hashCode())
|
||||
assertNotEquals(capture, ScannerCapture.of("A", "QRCODE", expected, "]Q1"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun rawLengthLimitsOmitInsteadOfTruncating() {
|
||||
assertNull(ScannerCapture.of("A", "Q", null).rawDataBase64)
|
||||
assertNull(ScannerCapture.of("A", "Q", ByteArray(0)).rawDataBase64)
|
||||
assertNull(ScannerCapture.of("A", "Q", ByteArray(8193)).rawDataBase64)
|
||||
val max = ScannerCapture.of("A", "Q", ByteArray(8192) { 1 })
|
||||
assertEquals(10924, max.rawDataBase64!!.length)
|
||||
assertEquals("AA==", ScannerCapture.of("A", "Q", ByteArray(1)).rawDataBase64)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun aimMustBeOriginalWellFormedIdentifier() {
|
||||
listOf("]Q1", "]c0", "]A0", "]z9").forEach { assertEquals(it, ScannerCapture.of("A", "Q", null, it).aimIdentifier) }
|
||||
listOf("", "Q1", "]Q", "]Q11", "]11", "]Q!", "]Q1 ", "]Qé").forEach {
|
||||
assertThrows(IllegalArgumentException::class.java) { ScannerCapture.of("A", "Q", null, it) }
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun stringFormsNeverLeakScanContent() {
|
||||
val event = ScanEvent(ScannerCapture.of("SECRET-BARCODE", "QRCODE", "SECRET-RAW".toByteArray(), "]Q1"), "zebra-emdk")
|
||||
listOf(event.toString(), event.capture.toString()).forEach {
|
||||
assertFalse(it, it.contains("SECRET"))
|
||||
assertFalse(it, it.contains(Base64.getEncoder().encodeToString("SECRET-RAW".toByteArray())))
|
||||
assertFalse(it, it.contains("]Q1"))
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun capabilityRequiresMobileScanners15WithinMajor1AtRegisteredPath() {
|
||||
assertTrue(ScanFidelityCapability.supports(version("1.5.0")))
|
||||
assertTrue(ScanFidelityCapability.supports(version("1.12.3")))
|
||||
listOf("1.4.9", "1.1.0", "2.0.0", "2.5.0", "1.5", "1.5.0-rc1", "01.5.0", "1.5.0.1", "", "1.99999999999.0").forEach {
|
||||
assertFalse(it, ScanFidelityCapability.supports(version(it)))
|
||||
}
|
||||
assertFalse(ScanFidelityCapability.supports(version("1.5.0", "/qbit/other")))
|
||||
assertFalse(ScanFidelityCapability.supports(version(null)))
|
||||
assertFalse(ScanFidelityCapability.supports(null))
|
||||
val duplicate = UiApiVersion(
|
||||
"1.8.0", extensions = listOf(
|
||||
UiApiExtension("mobile-scanners", "1.5.0", "/qbit/mobile-scanners"),
|
||||
UiApiExtension("mobile-scanners", "1.5.0", "/qbit/mobile-scanners")
|
||||
)
|
||||
)
|
||||
assertFalse(ScanFidelityCapability.supports(duplicate))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun capabilityIsScopedToTheServerThatWasDiscovered() {
|
||||
val v = version("1.5.0")
|
||||
assertTrue(ScanFidelityCapability.available("https://a/", "https://a/", v))
|
||||
assertFalse(ScanFidelityCapability.available("https://b/", "https://a/", v))
|
||||
assertFalse(ScanFidelityCapability.available("https://a/", "https://a/", null))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertFalse
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** The visible scan must survive acknowledgment and retry unchanged, never invent a symbology, and
|
||||
** claim success only on the same receipt the process requires.
|
||||
*******************************************************************************/
|
||||
class ScannerFeedbackTest {
|
||||
private val event = ScanEvent(ScannerCapture.of("00123\u001d45", "LABEL-TYPE-CODE128"), "zebra-emdk")
|
||||
private val receipt = mapOf("acknowledgedEventId" to event.eventId, "scanSaved" to true, "scanId" to "7")
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
private fun derive(last: LastScan?, pending: Map<String, Any?>?, response: Map<String, Any?>, waiting: Boolean = false, cancelling: Boolean = false) =
|
||||
ScannerFeedback.derive(last, pending, response, waiting, cancelling)
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun nothingScannedYieldsNoFeedbackSoThePanelShowsWaiting() {
|
||||
assertNull(derive(null, null, emptyMap()))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun lastCaptureStaysVisibleAfterFullReceiptClearsPendingState() {
|
||||
val feedback = derive(LastScan.of(event), null, receipt)!!
|
||||
assertEquals("00123\u001d45", feedback.barcode)
|
||||
assertEquals("LABEL-TYPE-CODE128", feedback.symbology)
|
||||
assertEquals("Confirmed by server", feedback.status)
|
||||
assertEquals("8 characters, 1 control character", feedback.details)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The event id alone is not a receipt: scanSaved=true and a non-blank scanId are also required.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun incompleteReceiptsAreNeverReportedAsConfirmed() {
|
||||
val partial = listOf(
|
||||
mapOf("acknowledgedEventId" to event.eventId),
|
||||
receipt + ("scanSaved" to false),
|
||||
receipt + ("scanId" to " "),
|
||||
receipt - "scanId",
|
||||
)
|
||||
for (response in partial) assertEquals(
|
||||
"Not confirmed. Follow the process message before submitting again.", derive(LastScan.of(event), null, response)!!.status
|
||||
)
|
||||
assertEquals(
|
||||
"Not confirmed. Retry the same request or leave the process; do not assume it was saved.",
|
||||
derive(null, event.values(), partial[1])!!.status
|
||||
)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun retryShowsTheSameValueAndTypeFromThePendingRequest() {
|
||||
val pending = event.values()
|
||||
val sending = derive(null, pending, emptyMap(), waiting = true)!!
|
||||
val failed = derive(null, pending, emptyMap())!!
|
||||
assertEquals("Sending scan…", sending.status)
|
||||
assertTrue(failed.status.startsWith("Not confirmed. Retry the same request"))
|
||||
for (feedback in listOf(sending, failed)) {
|
||||
assertEquals(event.barcode, feedback.barcode)
|
||||
assertEquals(event.symbology, feedback.symbology)
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun nextCaptureReplacesAnEarlierConfirmedOne() {
|
||||
val next = ScanEvent(ScannerCapture.of("999", "QRCODE"), "zebra-emdk")
|
||||
val feedback = derive(LastScan.of(event), next.values(), receipt, waiting = true)!!
|
||||
assertEquals("999", feedback.barcode)
|
||||
assertEquals("QRCODE", feedback.symbology)
|
||||
assertEquals("Sending scan…", feedback.status)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun cancellationIsNotReportedAsConfirmation() {
|
||||
assertEquals("Cancelling. Scan was not confirmed.", derive(LastScan.of(event), event.values(), emptyMap(), cancelling = true)!!.status)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun manualEntryNeverReceivesAGuessedSymbology() {
|
||||
val manual = ScanEvent(ScannerCapture.manual("00042"), "manual")
|
||||
assertNull(LastScan.of(manual).symbology)
|
||||
assertEquals(ScannerFeedback.MANUAL_SYMBOLOGY, derive(LastScan.of(manual), null, emptyMap())!!.symbology)
|
||||
val pending = derive(null, manual.values(), emptyMap())!!
|
||||
assertEquals(ScannerFeedback.MANUAL_SYMBOLOGY, pending.symbology)
|
||||
assertEquals("00042", pending.barcode)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun scanContentIsRedactedFromToString() {
|
||||
assertFalse(LastScan.of(event).toString().contains("00123"))
|
||||
assertFalse(derive(LastScan.of(event), null, receipt)!!.toString().contains("00123"))
|
||||
}
|
||||
}
|
||||
@@ -65,8 +65,8 @@ class ScannerInputSessionTest {
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
fun scan(value: String = "001234567890") {
|
||||
pending = false; listener.scanned(value, "QRCODE")
|
||||
fun scan(value: String = "001234567890", raw: ByteArray? = null) {
|
||||
pending = false; listener.scanned(ScannerCapture.of(value, "QRCODE", raw))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -76,10 +76,11 @@ class ScannerInputSessionTest {
|
||||
private class Fixture {
|
||||
val devices = mutableListOf<Device>()
|
||||
val scans = mutableListOf<Pair<String, String>>()
|
||||
val captures = mutableListOf<ScannerCapture>()
|
||||
val statuses = mutableListOf<String>()
|
||||
val session = ScannerInputSession(
|
||||
{ Device().also { devices.add(it) } },
|
||||
{ value, type -> scans.add(value to type) }, { message, _ -> statuses.add(message) })
|
||||
{ capture -> captures.add(capture); scans.add(capture.barcode to capture.symbology) }, { message, _ -> statuses.add(message) })
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
@@ -97,7 +98,7 @@ class ScannerInputSessionTest {
|
||||
@Test
|
||||
fun missingHardwareKeepsManualFallback() {
|
||||
val statuses = mutableListOf<String>()
|
||||
val session = ScannerInputSession({ null }, { _, _ -> error("Unexpected scan") }, { message, _ -> statuses.add(message) })
|
||||
val session = ScannerInputSession({ null }, { error("Unexpected scan") },{ message, _ -> statuses.add(message) })
|
||||
session.setAccepting(true)
|
||||
session.setActive(true)
|
||||
assertTrue(statuses.single().contains("manually"))
|
||||
@@ -111,7 +112,7 @@ class ScannerInputSessionTest {
|
||||
val device = Device()
|
||||
var allowed = true
|
||||
val scans = mutableListOf<String>()
|
||||
val session = ScannerInputSession({ device }, { value, _ -> scans.add(value) }, { _, _ -> }, { allowed })
|
||||
val session = ScannerInputSession({ device }, { capture -> scans.add(capture.barcode) }, { _, _ -> }, { allowed })
|
||||
session.setAccepting(true)
|
||||
session.setActive(true)
|
||||
device.idle()
|
||||
@@ -135,7 +136,7 @@ class ScannerInputSessionTest {
|
||||
fun hiddenSurfaceNeverArmsEvenWhenOldReadinessFlagIsTrue() {
|
||||
val device = Device()
|
||||
var allowed = false
|
||||
val session = ScannerInputSession({ device }, { _, _ -> error("Unexpected scan") }, { _, _ -> }, { allowed })
|
||||
val session = ScannerInputSession({ device }, { error("Unexpected scan") }, { _, _ -> }, { allowed })
|
||||
session.setAccepting(true)
|
||||
session.setActive(true)
|
||||
device.idle()
|
||||
@@ -176,6 +177,27 @@ class ScannerInputSessionTest {
|
||||
assertEquals(2, device.reads)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun rawBytesReachTheSinkUnchangedAndStaleOwnersDeliverNothing() {
|
||||
val fixture = Fixture()
|
||||
val first = fixture.start()
|
||||
first.idle()
|
||||
val raw = ByteArray(256) { it.toByte() }
|
||||
fixture.session.setActive(false)
|
||||
fixture.session.setActive(true)
|
||||
first.scan("stale", raw)
|
||||
assertTrue(fixture.captures.isEmpty())
|
||||
val second = fixture.devices.last()
|
||||
second.idle()
|
||||
second.scan("current", raw)
|
||||
assertEquals("current", fixture.captures.single().barcode)
|
||||
assertEquals(java.util.Base64.getEncoder().encodeToString(raw), fixture.captures.single().rawDataBase64)
|
||||
assertTrue(fixture.captures.single().aimIdentifier == null)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@@ -188,7 +210,7 @@ class ScannerInputSessionTest {
|
||||
device.idle()
|
||||
assertEquals(2, device.reads)
|
||||
// Deliver the first read's data while the second read is pending.
|
||||
device.listener.scanned("001234567890", "QRCODE")
|
||||
device.listener.scanned(ScannerCapture.of("001234567890", "QRCODE"))
|
||||
assertEquals(1, device.cancels)
|
||||
assertEquals(1, fixture.scans.size)
|
||||
device.idle()
|
||||
@@ -261,7 +283,7 @@ class ScannerInputSessionTest {
|
||||
device.idle()
|
||||
device.pending = false
|
||||
device.idle()
|
||||
device.listener.scanned("001234567890", "QRCODE")
|
||||
device.listener.scanned(ScannerCapture.of("001234567890", "QRCODE"))
|
||||
device.listener.noData(false)
|
||||
device.idle()
|
||||
assertEquals(1, device.cancels)
|
||||
|
||||
@@ -0,0 +1,189 @@
|
||||
/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
|
||||
package io.qrun.mobile.scanner
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertFalse
|
||||
import org.junit.Assert.assertNull
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Test
|
||||
|
||||
/*******************************************************************************
|
||||
** The wallpaper may show identity and IP only on the unlocked home screen, only while fresh, and never keeps either
|
||||
** after the session ends.
|
||||
*******************************************************************************/
|
||||
class WallpaperStatusTest {
|
||||
private var elapsed = 1_000L
|
||||
private var wall = 1_700_000_000_000L
|
||||
private val store = WallpaperStatusStore({ elapsed }, { wall })
|
||||
private val ip = "IP: wlan0 10.0.0.5"
|
||||
|
||||
private fun render(context: WallpaperContext, now: Long = elapsed) =
|
||||
WallpaperPresentation.render(store.snapshot, context, ip, now) { "HH:mm" }
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun newProcessIsUnknownAndShowsNoIdentity() {
|
||||
assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
|
||||
assertEquals(listOf("Session: not available", ip), render(WallpaperContext.HOME).lines)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun previewAndLockedShowBrandOnlyEvenWhenSignedIn() {
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
|
||||
listOf(WallpaperContext.PREVIEW, WallpaperContext.LOCKED).forEach {
|
||||
val frame = render(it)
|
||||
assertEquals(HostBrand().displayName, frame.header)
|
||||
assertTrue(frame.lines.isEmpty())
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun homeShowsNameServerAndIpWhileForeground() {
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
|
||||
assertEquals(listOf("Signed in: Ada Lovelace", "Server: qqq.example.com", ip), render(WallpaperContext.HOME).lines)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun backgroundSessionIsLabelledLastConfirmedNotLive() {
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = false)
|
||||
val lines = render(WallpaperContext.HOME, elapsed + 60_000).lines
|
||||
assertTrue(lines.contains("Signed in: Ada Lovelace"))
|
||||
assertTrue(lines.contains("Last confirmed HH:mm (app in background)"))
|
||||
assertFalse(lines.any { it.contains("verified", ignoreCase = true) && !it.contains("unverified", ignoreCase = true) })
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun nameIsWithdrawnAfterTheStaleWindow() {
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = false)
|
||||
val justBefore = elapsed + WallpaperPresentation.STALE_AFTER_MILLIS - 1
|
||||
val atWindow = elapsed + WallpaperPresentation.STALE_AFTER_MILLIS
|
||||
assertTrue(render(WallpaperContext.HOME, justBefore).lines.contains("Signed in: Ada Lovelace"))
|
||||
assertEquals(1L, WallpaperPresentation.millisUntilStale(store.snapshot, justBefore))
|
||||
val stale = render(WallpaperContext.HOME, atWindow).lines
|
||||
assertEquals(listOf("Session unverified", "Last confirmed HH:mm", ip), stale)
|
||||
assertNull(WallpaperPresentation.millisUntilStale(store.snapshot, atWindow))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun foregroundSessionNeverGoesStaleOrNeedsATimer() {
|
||||
store.signedIn("Ada Lovelace", null, foreground = true)
|
||||
assertFalse(WallpaperPresentation.isStale(store.snapshot, elapsed + 10 * WallpaperPresentation.STALE_AFTER_MILLIS))
|
||||
assertNull(WallpaperPresentation.millisUntilStale(store.snapshot, elapsed))
|
||||
assertEquals(listOf("Signed in: Ada Lovelace", ip), render(WallpaperContext.HOME).lines)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun signOutDropsNameAndServerButClearReturnsToUnknown() {
|
||||
store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
|
||||
store.signedOutIfSignedIn()
|
||||
assertEquals(WallpaperSessionState.SIGNED_OUT, store.snapshot.state)
|
||||
assertNull(store.snapshot.displayName)
|
||||
assertNull(store.snapshot.serverHost)
|
||||
assertEquals(listOf("Signed out", ip), render(WallpaperContext.HOME).lines)
|
||||
store.signedIn("Grace Hopper", "qqq.example.com", foreground = true)
|
||||
store.clear()
|
||||
assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
|
||||
assertNull(store.snapshot.displayName)
|
||||
assertFalse(render(WallpaperContext.HOME).lines.any { it.contains("Grace") })
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun startupDoesNotClaimSignedOutBeforeAnySession() {
|
||||
store.signedOutIfSignedIn()
|
||||
assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun displayTextIsSingleLineAndBounded() {
|
||||
store.signedIn("Ada\nLovelace\u0007 ${"x".repeat(100)}", "host", foreground = true)
|
||||
val name = store.snapshot.displayName!!
|
||||
assertTrue(name.length <= WallpaperStatusStore.MAX_NAME)
|
||||
assertTrue(name.none { it.isISOControl() })
|
||||
store.signedIn(" ", "host", foreground = true)
|
||||
assertNull(store.snapshot.displayName)
|
||||
assertEquals(listOf("Signed in", "Server: host", ip), render(WallpaperContext.HOME).lines)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun brandIsValidatedAndFallsBackToTheDefault() {
|
||||
store.setBrand("Acme Corp", "#aa5500")
|
||||
assertEquals("Acme Corp", store.snapshot.brandName)
|
||||
assertEquals("#AA5500", store.snapshot.brandColor)
|
||||
store.setBrand("Bad", "red")
|
||||
store.setBrand("", "#000000")
|
||||
assertEquals("Acme Corp", store.snapshot.brandName)
|
||||
assertEquals("#AA5500", store.snapshot.brandColor)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun listenersAreNotifiedUntilRemovedAndOnlyOnRealChange() {
|
||||
var calls = 0
|
||||
val listener = WallpaperStatusListener { calls++ }
|
||||
store.addListener(listener)
|
||||
store.signedIn("Ada", null, foreground = true)
|
||||
elapsed += 1
|
||||
store.signedIn("Ada", null, foreground = true)
|
||||
store.clear()
|
||||
assertEquals(3, calls)
|
||||
store.clear()
|
||||
assertEquals(3, calls)
|
||||
store.removeListener(listener)
|
||||
store.signedIn("Ada", null, foreground = true)
|
||||
assertEquals(3, calls)
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun networkLineDistinguishesUnknownFromNoAddress() {
|
||||
assertEquals("IP: unknown", WallpaperPresentation.networkLine(false, null))
|
||||
assertEquals("IP: no network address", WallpaperPresentation.networkLine(true, null))
|
||||
assertEquals("IP: wlan0 10.0.0.5", WallpaperPresentation.networkLine(true, "wlan0 10.0.0.5"))
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
**
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
fun addressFormattingOmitsLoopbackAndLinkLocalAndPrefersIpv4() {
|
||||
assertEquals("wlan0 10.0.0.5, 2001:db8::1", formatNetworkAddresses("wlan0", listOf("fe80::1%wlan0", "2001:db8::1%wlan0", "10.0.0.5", "127.0.0.1", "::1")))
|
||||
assertEquals("10.0.0.5", formatNetworkAddresses(null, listOf("10.0.0.5")))
|
||||
assertEquals("tun0x 10.8.0.2", formatNetworkAddresses("tun0 \n<x>", listOf("10.8.0.2")))
|
||||
assertNull(formatNetworkAddresses("wlan0", listOf("fe80::1%wlan0", "127.0.0.1")))
|
||||
assertNull(formatNetworkAddresses("wlan0", emptyList()))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,216 @@
|
||||
// Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0
|
||||
// Opt-in real Authentik native acceptance on ONE physical Zebra TC22 using only the disposable E2E package.
|
||||
// See docs/REAL-AUTHENTIK-ACCEPTANCE.md. Never touches the normal scanner package or its data, reverse tcp:8080, any
|
||||
// reverse mapping it did not add, or any trust store; never prints the serial, config, cookies or URLs with queries.
|
||||
import { spawn } from 'node:child_process';
|
||||
import { access, readFile } from 'node:fs/promises';
|
||||
import { dirname, join, relative, resolve, isAbsolute } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
export const E2E_PACKAGE = 'io.qrun.mobile.scanner.e2e';
|
||||
export const TEST_PACKAGE = `${E2E_PACKAGE}.test`;
|
||||
export const TEST_CLASS = 'io.qrun.mobile.scanner.RealAuthentikAcceptanceTest';
|
||||
export const REVERSE_PORTS = ['18443', '19443'];
|
||||
export const QQQ_ORIGIN = 'https://localhost:18443';
|
||||
const INSTRUMENT_MS = 40 * 60_000;
|
||||
|
||||
/** Operator-facing text for the fixed stage names the instrumentation emits; nothing dynamic is ever printed. */
|
||||
export const STAGES = {
|
||||
'login-screen-verified': 'Browser login offered, no password fallback.',
|
||||
'browser-A-requested': 'Opening external browser for operator A.',
|
||||
'browser-A-operator-enter-credentials': 'ACTION: in the browser sign in as scanner-a (type the credentials yourself).',
|
||||
'callback-exchange-A-complete': 'Callback and QQQ exchange completed for A.',
|
||||
'device-pending-A': 'Device is pending approval (expected).',
|
||||
'operator-A-verified': 'Principal A verified, session ACTIVE.',
|
||||
'company-signout-requested': 'Company sign-out requested.',
|
||||
'company-signout-operator-confirm-if-asked': 'ACTION: confirm provider logout in the browser if it asks.',
|
||||
'company-signout-verified': 'Company sign-out reported complete.',
|
||||
'operator-A-qqq-session-ended': 'QQQ session for A ended.',
|
||||
'browser-B-requested': 'Opening external browser for operator B.',
|
||||
'browser-B-operator-enter-credentials': 'ACTION: the provider must ask for credentials; sign in as scanner-b.',
|
||||
'callback-exchange-B-complete': 'Callback and QQQ exchange completed for B.',
|
||||
'operator-B-verified': 'Principal B verified, distinct session ACTIVE.',
|
||||
};
|
||||
|
||||
/*******************************************************************************
|
||||
** Admit only the exact fixture descriptor, before any adb call. Values are never echoed in errors.
|
||||
*******************************************************************************/
|
||||
export function validateConfig(config) {
|
||||
const text = (value, max) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\r\n\u0000]/.test(value);
|
||||
if (config?.fixtureType !== 'real-authentik-android' || config.qqqOrigin !== QQQ_ORIGIN) throw new Error('Config must describe the real-authentik-android fixture on its exact HTTPS origin.');
|
||||
if (!text(config.adminCookie, 4096)) throw new Error('Config needs the administrator session cookie header value.');
|
||||
const a = config.operators?.A?.display, b = config.operators?.B?.display;
|
||||
if (!text(a, 200) || !text(b, 200) || a === b) throw new Error('Config needs distinct display names for operators A and B.');
|
||||
for (const key of ['A', 'B']) {
|
||||
const actor = config.operators[key].actor;
|
||||
if (actor !== undefined && !text(actor, 200)) throw new Error('Operator actor values must be short single-line text.');
|
||||
}
|
||||
if (config.sessionActorField !== undefined && !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(config.sessionActorField)) throw new Error('sessionActorField must be a column name.');
|
||||
return config;
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The config holds a live administrator session, so it must never sit inside a repository checkout.
|
||||
*******************************************************************************/
|
||||
export function configOutsideRepository(configPath, repository) {
|
||||
const relativePath = relative(resolve(repository), resolve(configPath));
|
||||
return relativePath.startsWith('..') || isAbsolute(relativePath);
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Only the physical Zebra TC22 is a valid target; an emulator or any other device is refused.
|
||||
*******************************************************************************/
|
||||
export function validateTarget(serial, properties) {
|
||||
if (!serial || !/^[A-Za-z0-9._:-]+$/.test(serial) || serial.startsWith('emulator-')) throw new Error('ANDROID_SERIAL must name the physical TC22 (emulators are prohibited).');
|
||||
if (properties.qemu === '1' || !/^zebra/i.test(properties.manufacturer ?? '') || !/^TC22/i.test(properties.model ?? '')) throw new Error('The selected device is not the physical Zebra TC22.');
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Disposable packages are never replaced or reused; the normal package is not consulted.
|
||||
*******************************************************************************/
|
||||
export function refuseExistingDisposablePackages(installedLines) {
|
||||
const installed = new Set(installedLines.map(line => line.trim()));
|
||||
for (const pkg of [E2E_PACKAGE, TEST_PACKAGE]) {
|
||||
if (installed.has(`package:${pkg}`)) throw new Error(`${pkg} already exists. Remove it deliberately before this run; it will not be replaced.`);
|
||||
}
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Parse `adb reverse --list` into "tcp:A tcp:B" mappings (the device-name column is ignored).
|
||||
*******************************************************************************/
|
||||
export function parseReverseList(output) {
|
||||
return output.split(/\r?\n/).map(line => line.trim().split(/\s+/)).filter(parts => parts.length >= 3).map(parts => `${parts[parts.length - 2]} ${parts[parts.length - 1]}`);
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Decide which of the two fixture ports to add. A pre-existing identical mapping is left in place and not owned;
|
||||
** a differing one is refused rather than changed. Any other mapping (including 8080) is never considered.
|
||||
*******************************************************************************/
|
||||
export function planReverse(existing) {
|
||||
const add = [];
|
||||
for (const port of REVERSE_PORTS) {
|
||||
const mappings = existing.filter(mapping => mapping.startsWith(`tcp:${port} `));
|
||||
if (mappings.length === 0) add.push(port);
|
||||
else if (mappings.some(mapping => mapping !== `tcp:${port} tcp:${port}`)) throw new Error(`Existing reverse mapping for ${port} differs; refusing to change it.`);
|
||||
}
|
||||
return add;
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Classify one instrumentation output line: a fixed stage, the final verdict, a safe failure sentence, or nothing.
|
||||
** Anything URL-like or query-like is dropped, so no callback, token or credential can be printed.
|
||||
*******************************************************************************/
|
||||
export function classifyLine(line) {
|
||||
const stage = /^INSTRUMENTATION_STATUS: qqqStage=([A-Za-z0-9-]+)$/.exec(line);
|
||||
if (stage) return { stage: stage[1], text: STAGES[stage[1]] ?? `Stage ${stage[1]}` };
|
||||
if (/^(OK \(\d+ tests?\)|FAILURES!!!|Tests run:.*)$/.test(line)) return { verdict: line };
|
||||
const assertion = /AssertionError: ([^\r\n]{1,160})/.exec(line);
|
||||
if (assertion && !/[?&=]|https?:/i.test(assertion[1])) return { failure: assertion[1] };
|
||||
return {};
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** The instrumentation command line the launcher runs; fixed, with no value from the config.
|
||||
*******************************************************************************/
|
||||
export function instrumentArguments() {
|
||||
return ['shell', 'am', 'instrument', '-w', '-r', '-e', 'realAuthentik', 'true', '-e', 'class', TEST_CLASS, `${TEST_PACKAGE}/androidx.test.runner.AndroidJUnitRunner`];
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Run adb for the selected device without a shell; never echo its output.
|
||||
*******************************************************************************/
|
||||
function adb(adbPath, serial, argv, { input, timeout = 120_000, onLine } = {}) {
|
||||
return new Promise((done, reject) => {
|
||||
const child = spawn(adbPath, ['-s', serial, ...argv], { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
|
||||
let out = '', pending = '';
|
||||
const timer = setTimeout(() => { child.kill(); reject(new Error('adb operation timed out')); }, timeout);
|
||||
child.stdout.on('data', chunk => {
|
||||
out += chunk;
|
||||
if (onLine) { pending += chunk; const lines = pending.split(/\r?\n/); pending = lines.pop(); lines.forEach(onLine); }
|
||||
});
|
||||
child.stderr.on('data', () => {});
|
||||
child.on('error', () => { clearTimeout(timer); reject(new Error('adb could not start')); });
|
||||
child.on('close', code => { clearTimeout(timer); code === 0 ? done(out) : reject(new Error(`adb exited ${code}`)); });
|
||||
child.stdin.end(input ?? '');
|
||||
});
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
** Orchestrate one run. Cleanup removes only what this run added: the config file, the two disposable packages
|
||||
** and the reverse mappings it created. The operator's trust store is never touched.
|
||||
*******************************************************************************/
|
||||
async function main(args, environment) {
|
||||
const option = name => { const index = args.indexOf(name); return index < 0 ? undefined : args[index + 1]; };
|
||||
const repository = resolve(option('--repo') ?? join(dirname(fileURLToPath(import.meta.url)), '../..'));
|
||||
const serial = environment.ANDROID_SERIAL;
|
||||
const sdk = environment.ANDROID_HOME ?? environment.ANDROID_SDK_ROOT;
|
||||
const adbPath = sdk ? join(sdk, 'platform-tools', process.platform === 'win32' ? 'adb.exe' : 'adb') : 'adb';
|
||||
const say = text => console.log(String(text).replaceAll(serial ?? '\u0000', '<DEVICE>'));
|
||||
|
||||
if (!args.includes('--confirm-temporary-ca-installed')) throw new Error('Install the temporary test CA through Android settings, then pass --confirm-temporary-ca-installed.');
|
||||
const configPath = option('--config') ?? (() => { throw new Error('--config <owner-private json> is required.'); })();
|
||||
if (!configOutsideRepository(configPath, repository)) throw new Error('Keep the config outside the repository checkout.');
|
||||
const configText = await readFile(configPath, 'utf8');
|
||||
let config;
|
||||
try { config = JSON.parse(configText); } catch { throw new Error('Config is not valid JSON.'); }
|
||||
validateConfig(config);
|
||||
const apks = [
|
||||
join(repository, 'scanner-host/build/outputs/apk/e2e/scanner-host-e2e.apk'),
|
||||
join(repository, 'scanner-host/build/outputs/apk/androidTest/e2e/scanner-host-e2e-androidTest.apk'),
|
||||
];
|
||||
for (const apk of apks) await access(apk).catch(() => { throw new Error('Build :scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest first.'); });
|
||||
|
||||
if (!serial || !/^[A-Za-z0-9._:-]+$/.test(serial) || serial.startsWith('emulator-')) throw new Error('ANDROID_SERIAL must name the physical TC22 (emulators are prohibited).');
|
||||
const property = async name => (await adb(adbPath, serial, ['shell', 'getprop', name])).trim();
|
||||
validateTarget(serial, { qemu: await property('ro.kernel.qemu'), manufacturer: await property('ro.product.manufacturer'), model: await property('ro.product.model') });
|
||||
say(`Device: physical TC22, Android ${await property('ro.build.version.release')}`);
|
||||
|
||||
const installed = (await adb(adbPath, serial, ['shell', 'pm', 'list', 'packages', '-u'])).split(/\r?\n/);
|
||||
refuseExistingDisposablePackages(installed);
|
||||
say('Disposable packages are absent; the normal scanner app is neither read nor changed.');
|
||||
|
||||
const reverseList = async () => parseReverseList(await adb(adbPath, serial, ['reverse', '--list']));
|
||||
const before = await reverseList();
|
||||
const owned = planReverse(before);
|
||||
const installedHere = [];
|
||||
let configPushed = false;
|
||||
try {
|
||||
for (const port of owned) await adb(adbPath, serial, ['reverse', '--no-rebind', `tcp:${port}`, `tcp:${port}`]);
|
||||
say(`Reverse mappings added by this run: ${owned.length ? owned.join(', ') : 'none (already present, left in place)'}.`);
|
||||
for (const [apk, pkg] of [[apks[0], E2E_PACKAGE], [apks[1], TEST_PACKAGE]]) {
|
||||
await adb(adbPath, serial, ['install', '--no-streaming', apk], { timeout: 300_000 });
|
||||
installedHere.push(pkg);
|
||||
}
|
||||
await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'mkdir', '-p', 'files']);
|
||||
await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'sh', '-c', "'cat > files/real-auth.json'"], { input: configText });
|
||||
configPushed = true;
|
||||
|
||||
say('Starting. Keep the TC22 unlocked and awake; follow the ACTION lines.');
|
||||
let verdict = '', failure = '';
|
||||
await adb(adbPath, serial, instrumentArguments(), {
|
||||
timeout: INSTRUMENT_MS,
|
||||
onLine: line => {
|
||||
const result = classifyLine(line);
|
||||
if (result.stage) say(result.text);
|
||||
else if (result.verdict) verdict = result.verdict;
|
||||
else if (result.failure && !failure) failure = result.failure;
|
||||
},
|
||||
});
|
||||
if (!/^OK \(/.test(verdict)) throw new Error(`Acceptance did not pass${failure ? `: ${failure}` : '.'}`);
|
||||
say(`PASS: ${verdict}`);
|
||||
} finally {
|
||||
if (configPushed) await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'rm', '-f', 'files/real-auth.json']).catch(() => say('WARNING: could not remove the pushed config; uninstalling the package removes it.'));
|
||||
for (const pkg of [...installedHere].reverse()) await adb(adbPath, serial, ['uninstall', pkg]).catch(() => say(`WARNING: could not uninstall ${pkg}.`));
|
||||
for (const port of owned) await adb(adbPath, serial, ['reverse', '--remove', `tcp:${port}`]).catch(() => say(`WARNING: could not remove reverse ${port}.`));
|
||||
const after = await reverseList().catch(() => null);
|
||||
if (after && JSON.stringify([...after].sort()) !== JSON.stringify([...before].sort())) say('WARNING: reverse mappings differ from the starting set; review manually.');
|
||||
say('Reminder: remove the temporary test CA through Android settings when finished.');
|
||||
}
|
||||
}
|
||||
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
main(process.argv.slice(2), process.env).catch(error => {
|
||||
console.error(`FAILED: ${String(error.message).replaceAll(process.env.ANDROID_SERIAL ?? '\u0000', '<DEVICE>')}`);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
// Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0
|
||||
import assert from 'node:assert/strict';
|
||||
import test from 'node:test';
|
||||
import {
|
||||
classifyLine, configOutsideRepository, instrumentArguments, parseReverseList, planReverse, refuseExistingDisposablePackages,
|
||||
validateConfig, validateTarget,
|
||||
} from './real-authentik-android.mjs';
|
||||
|
||||
const config = () => ({
|
||||
fixtureType: 'real-authentik-android', qqqOrigin: 'https://localhost:18443', adminCookie: 'synthetic-cookie-value',
|
||||
operators: { A: { display: 'Operator A' }, B: { display: 'Operator B' } },
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** A wrong origin, fixture type or identical operators must stop the run before any adb call.
|
||||
*******************************************************************************/
|
||||
test('config is admitted only for the exact fixture origin with distinct operators', () => {
|
||||
assert.doesNotThrow(() => validateConfig(config()));
|
||||
for (const bad of [
|
||||
{ ...config(), qqqOrigin: 'https://localhost:18443/' }, { ...config(), qqqOrigin: 'http://localhost:18443' },
|
||||
{ ...config(), qqqOrigin: 'https://127.0.0.1:18443' }, { ...config(), fixtureType: 'echo-ui-e2e' }, { ...config(), adminCookie: '' },
|
||||
{ ...config(), adminCookie: 'a\nb' }, { ...config(), operators: { A: { display: 'Same' }, B: { display: 'Same' } } },
|
||||
{ ...config(), sessionActorField: 'a; DROP' },
|
||||
]) assert.throws(() => validateConfig(bad));
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** Errors must not echo the secret they reject.
|
||||
*******************************************************************************/
|
||||
test('a rejected config never leaks the cookie into the error', () => {
|
||||
const bad = { ...config(), adminCookie: 'secret-cookie\nvalue' };
|
||||
assert.throws(() => validateConfig(bad), error => !error.message.includes('secret-cookie'));
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** The config holds a live administrator session; a checkout path must be refused.
|
||||
*******************************************************************************/
|
||||
test('config inside the repository is refused, outside is allowed', () => {
|
||||
assert.equal(configOutsideRepository('/work/repo/scripts/config.json', '/work/repo'), false);
|
||||
assert.equal(configOutsideRepository('/work/repo/config.json', '/work/repo'), false);
|
||||
assert.equal(configOutsideRepository('/work/private/config.json', '/work/repo'), true);
|
||||
assert.equal(configOutsideRepository('/work/repository-other/config.json', '/work/repo'), true);
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** Only the physical Zebra TC22 may be targeted.
|
||||
*******************************************************************************/
|
||||
test('emulators and other devices are refused as targets', () => {
|
||||
assert.doesNotThrow(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Zebra Technologies', model: 'TC22' }));
|
||||
assert.throws(() => validateTarget('emulator-5554', { qemu: '1', manufacturer: 'Google', model: 'sdk' }));
|
||||
assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '1', manufacturer: 'Zebra', model: 'TC22' }));
|
||||
assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Samsung', model: 'TC22' }));
|
||||
assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Zebra', model: 'TC27' }));
|
||||
assert.throws(() => validateTarget('bad serial; rm', { qemu: '', manufacturer: 'Zebra', model: 'TC22' }));
|
||||
assert.throws(() => validateTarget(undefined, { qemu: '', manufacturer: 'Zebra', model: 'TC22' }));
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** An existing disposable package could hold another run's state; it is never replaced.
|
||||
*******************************************************************************/
|
||||
test('existing disposable packages are refused and the normal package is irrelevant', () => {
|
||||
assert.doesNotThrow(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner', 'package:com.android.chrome']));
|
||||
assert.throws(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner.e2e']));
|
||||
assert.throws(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner.e2e.test']));
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** Only 18443 and 19443 may ever be added; 8080 and every other mapping are invisible to the plan.
|
||||
*******************************************************************************/
|
||||
test('reverse plan adds only missing fixture ports and never considers other mappings', () => {
|
||||
const existing = parseReverseList('host-1 tcp:8080 tcp:57832\nhost-1 tcp:18081 tcp:18081\n');
|
||||
assert.deepEqual(planReverse(existing), ['18443', '19443']);
|
||||
assert.deepEqual(planReverse(parseReverseList('host-1 tcp:18443 tcp:18443\n')), ['19443']);
|
||||
assert.deepEqual(planReverse(parseReverseList('host-1 tcp:18443 tcp:18443\nhost-1 tcp:19443 tcp:19443\n')), []);
|
||||
assert.throws(() => planReverse(parseReverseList('host-1 tcp:19443 tcp:9999\n')));
|
||||
assert.ok(planReverse([]).every(port => ['18443', '19443'].includes(port)));
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** Output handling must map fixed stages and drop anything carrying a URL or query.
|
||||
*******************************************************************************/
|
||||
test('instrumentation output exposes only fixed stages, the verdict and a safe failure', () => {
|
||||
assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: qqqStage=operator-A-verified'), { stage: 'operator-A-verified', text: 'Principal A verified, session ACTIVE.' });
|
||||
assert.deepEqual(classifyLine('OK (1 test)'), { verdict: 'OK (1 test)' });
|
||||
assert.deepEqual(classifyLine('java.lang.AssertionError: Native sign-in did not complete'), { failure: 'Native sign-in did not complete' });
|
||||
assert.deepEqual(classifyLine('java.lang.AssertionError: bad https://host/cb?code=abc'), {});
|
||||
assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: stack=https://localhost:19443/x?code=secret'), {});
|
||||
assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: qqqStage=bad stage'), {});
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
** The launched class is fixed, opts in explicitly and carries nothing from the config.
|
||||
*******************************************************************************/
|
||||
test('instrumentation targets only the opt-in class in the disposable test package', () => {
|
||||
const joined = instrumentArguments().join(' ');
|
||||
assert.match(joined, /-e realAuthentik true/);
|
||||
assert.match(joined, /io\.qrun\.mobile\.scanner\.e2e\.test\/androidx\.test\.runner\.AndroidJUnitRunner$/);
|
||||
assert.equal(joined.includes('cookie'), false);
|
||||
});
|
||||
@@ -30,9 +30,9 @@ export function validateEchoFixtureDescriptor(fixture) {
|
||||
*******************************************************************************/
|
||||
export function validateEchoFixtureContract(version, branding) {
|
||||
const extension = Array.isArray(version?.extensions) ? version.extensions.find(value => value.name === 'mobile-scanners') : null;
|
||||
if (version?.apiVersion !== '1.10.0' || extension?.version !== '1.4.0' || extension.pathPrefix !== '/qbit/mobile-scanners' ||
|
||||
if (version?.apiVersion !== '1.10.0' || !['1.4.0', '1.5.0'].includes(extension?.version) || extension.pathPrefix !== '/qbit/mobile-scanners' ||
|
||||
branding?.displayName !== 'Echo UI E2E — simulated printing') {
|
||||
throw new Error('Echo requires the simulated Echo fixture with core UI API1.10 and mobile-scanners1.4.');
|
||||
throw new Error('Echo requires the simulated Echo fixture with core UI API1.10 and mobile-scanners1.4 or 1.5.');
|
||||
}
|
||||
}
|
||||
|
||||
@@ -335,8 +335,9 @@ export async function runScannerE2e(options = {}) {
|
||||
await adbRun('shell', 'run-as', packageName, 'mkdir', '-p', 'shared_prefs');
|
||||
await run(adb, [...adbPrefix, 'shell', 'run-as', packageName, 'sh', '-c', "'cat > shared_prefs/host.xml'"],
|
||||
'<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><boolean name="locationReportingEnabled" value="false" /><boolean name="locationPermissionRequested" value="true" /></map>');
|
||||
} else if ((phase.name ?? phase.mode) === 'session-monitor' && packageName === 'io.qrun.mobile.scanner.e2e') {
|
||||
} else if ((phase.name ?? phase.mode) === 'session-monitor') {
|
||||
// Preserve this scenario's real denied-location telemetry assertion without an OS dialog.
|
||||
// Package selection already limits this to the disposable e2e or physical qa application.
|
||||
await adbRun('shell', 'pm', 'revoke', packageName, 'android.permission.ACCESS_FINE_LOCATION');
|
||||
await adbRun('shell', 'pm', 'revoke', packageName, 'android.permission.ACCESS_COARSE_LOCATION');
|
||||
await adbRun('shell', 'run-as', packageName, 'mkdir', '-p', 'shared_prefs');
|
||||
@@ -360,7 +361,7 @@ export async function runScannerE2e(options = {}) {
|
||||
}
|
||||
reports.push({ scenario: phase.name ?? phase.mode, ...proxy.verify(!phase.expectedError, Boolean(phase.requireCancel), Boolean(phase.requireSession), Boolean(phase.requirePhotos)) });
|
||||
if (echo) {
|
||||
const expectedStages = ['echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-run-closed'];
|
||||
const expectedStages = ['echo-copies-defaulted', 'echo-document-selected', 'echo-stale-document-cleared', 'echo-copies-selected', 'echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-copies-persisted', 'echo-run-closed'];
|
||||
if (expectedStages.some(stage => !stages.has(stage))) throw new Error('Echo did not complete every setup/queue/recreation/cancellation stage.');
|
||||
await writeFile(join(echoEvidence, 'echo-proof.json'), JSON.stringify({ status: 'PASSED', fixtureType: 'echo-ui-e2e', simulatedPrinting: true,
|
||||
artifacts: echoArtifacts, completedStages: expectedStages, acceptedScans: 2, ...reports.at(-1), physicalScannerQualified: false, physicalPrintingQualified: false }, null, 2));
|
||||
|
||||
@@ -37,6 +37,7 @@ test('Echo artifacts and error text contain no selected serial', () => {
|
||||
test('explicit simulated Echo descriptor is accepted', () => {
|
||||
assert.equal(validateEchoFixtureDescriptor(fixture).port, '49152');
|
||||
validateEchoFixtureContract(version, branding);
|
||||
validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.5.0' }] }, branding);
|
||||
});
|
||||
|
||||
/*******************************************************************************
|
||||
@@ -75,6 +76,10 @@ test('wrong-purpose or incomplete credentials are refused', () => {
|
||||
test('contract and simulated branding must match the prepared cohort', () => {
|
||||
assert.throws(() => validateEchoFixtureContract({ ...version, apiVersion: '1.9.0' }, branding));
|
||||
assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.3.0' }] }, branding));
|
||||
for (const unsupported of ['1.6.0', '1.5.1', '1.4.1', '2.0.0', '1.10.0', '1.5']) {
|
||||
assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: unsupported }] }, branding));
|
||||
}
|
||||
assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.5.0', pathPrefix: '/other' }] }, branding));
|
||||
assert.throws(() => validateEchoFixtureContract(version, { displayName: 'QQQ Mobile' }));
|
||||
});
|
||||
|
||||
|
||||
Reference in new issue
Block a user