Add SSH key authentication for SFTP connections

app/proguard-rules.pro

@@ -34,6 +34,11 @@
 -keep class com.hierynomus.ntlm.** { *; }
 -keep class com.hierynomus.security.** { *; }
 
+# Bouncy Castle registers JCA implementations by class name. SFTP uses an
+# app-specific provider name so Android's stripped platform BC is untouched.
+-keep class org.bouncycastle.jcajce.provider.** { *; }
+-keep class org.bouncycastle.jce.provider.** { *; }
+
 # mbassador creates the default handler invocation through Class.getConstructor().
 -keepclassmembers,allowobfuscation class net.engio.mbassy.dispatch.ReflectiveHandlerInvocation {
     public <init>(net.engio.mbassy.subscription.SubscriptionContext);

app/src/main/java/dev/anilbeesetti/nextplayer/NextPlayerApplication.kt

@@ -6,11 +6,15 @@ import coil3.PlatformContext
 import coil3.SingletonImageLoader
 import dagger.hilt.android.HiltAndroidApp
 import dev.anilbeesetti.nextplayer.core.common.di.ApplicationScope
+import dev.anilbeesetti.nextplayer.core.common.Logger
+import dev.anilbeesetti.nextplayer.core.data.repository.NetworkConnectionRepository
 import dev.anilbeesetti.nextplayer.core.data.repository.PreferencesRepository
+import dev.anilbeesetti.nextplayer.core.media.network.keys.SshKeyStore
 import dev.anilbeesetti.nextplayer.crash.CrashActivity
 import dev.anilbeesetti.nextplayer.crash.GlobalExceptionHandler
 import javax.inject.Inject
 import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
 
 @HiltAndroidApp
 class NextPlayerApplication : Application(), SingletonImageLoader.Factory {
@@ -21,14 +25,31 @@ class NextPlayerApplication : Application(), SingletonImageLoader.Factory {
     @Inject
     lateinit var imageLoader: ImageLoader
 
+    @Inject
+    lateinit var networkConnectionRepository: NetworkConnectionRepository
+
+    @Inject
+    lateinit var sshKeyStore: SshKeyStore
+
     @Inject
     @ApplicationScope
     lateinit var applicationScope: CoroutineScope
 
     override fun onCreate() {
         super.onCreate()
         Thread.setDefaultUncaughtExceptionHandler(GlobalExceptionHandler(applicationContext, CrashActivity::class.java))
+        applicationScope.launch {
+            runCatching {
+                initializeSshKeyStore(networkConnectionRepository, sshKeyStore)
+            }.onFailure { error ->
+                Logger.logError(TAG, "Couldn't reconcile SSH keys: ${error.message}")
+            }
+        }
     }
 
     override fun newImageLoader(context: PlatformContext): ImageLoader = imageLoader
+
+    private companion object {
+        const val TAG = "NextPlayerApplication"
+    }
 }

app/src/main/java/dev/anilbeesetti/nextplayer/SshKeyStoreInitializer.kt

@@ -0,0 +1,29 @@
+package dev.anilbeesetti.nextplayer
+
+import dev.anilbeesetti.nextplayer.core.data.repository.NetworkConnectionRepository
+import dev.anilbeesetti.nextplayer.core.media.network.keys.SshKeyStore
+import dev.anilbeesetti.nextplayer.core.model.NetworkAuthentication
+import dev.anilbeesetti.nextplayer.core.model.NetworkProtocol
+import kotlinx.coroutines.flow.first
+
+internal suspend fun initializeSshKeyStore(
+    repository: NetworkConnectionRepository,
+    sshKeyStore: SshKeyStore,
+) {
+    val referencedFileNames = try {
+        repository.getConnections().first()
+            .asSequence()
+            .filter { connection ->
+                connection.protocol == NetworkProtocol.SFTP &&
+                    connection.authentication == NetworkAuthentication.SSH_KEY
+            }
+            .mapNotNull { connection ->
+                connection.privateKeyFileName.trim()
+                    .takeIf(SshKeyStore::isValidFileName)
+            }
+            .toSet()
+    } catch (_: Throwable) {
+        null
+    }
+    sshKeyStore.initialize(referencedFileNames)
+}

app/src/test/java/dev/anilbeesetti/nextplayer/SshKeyStoreInitializerTest.kt

@@ -0,0 +1,88 @@
+package dev.anilbeesetti.nextplayer
+
+import android.net.Uri
+import dev.anilbeesetti.nextplayer.core.data.repository.NetworkConnectionRepository
+import dev.anilbeesetti.nextplayer.core.media.network.keys.SshKeyStore
+import dev.anilbeesetti.nextplayer.core.media.network.keys.StagedSshKey
+import dev.anilbeesetti.nextplayer.core.model.NetworkAuthentication
+import dev.anilbeesetti.nextplayer.core.model.NetworkConnection
+import dev.anilbeesetti.nextplayer.core.model.NetworkProtocol
+import java.io.File
+import java.io.IOException
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.flow
+import kotlinx.coroutines.flow.flowOf
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class SshKeyStoreInitializerTest {
+
+    @Test
+    fun `startup passes only valid SFTP key-auth references to store`() = runBlocking {
+        val repository = FakeRepository(
+            flowOf(
+                listOf(
+                    connection("feed.key"),
+                    connection("feed.key"),
+                    connection(" dead-beef.key "),
+                    connection(""),
+                    connection("../invalid.key"),
+                    connection("cafe.key", protocol = NetworkProtocol.SMB),
+                    connection("beef.key", authentication = NetworkAuthentication.PASSWORD),
+                ),
+            ),
+        )
+        val store = FakeSshKeyStore()
+
+        initializeSshKeyStore(repository, store)
+
+        assertEquals(setOf("feed.key", "dead-beef.key"), store.referencedFileNames)
+    }
+
+    @Test
+    fun `database enumeration failure initializes store without cleanup set`() = runBlocking {
+        val repository = FakeRepository(
+            flow { throw IOException("database unavailable") },
+        )
+        val store = FakeSshKeyStore()
+
+        initializeSshKeyStore(repository, store)
+
+        assertEquals(null, store.referencedFileNames)
+    }
+
+    private fun connection(
+        fileName: String,
+        protocol: NetworkProtocol = NetworkProtocol.SFTP,
+        authentication: NetworkAuthentication = NetworkAuthentication.SSH_KEY,
+    ) = NetworkConnection(
+        name = fileName,
+        protocol = protocol,
+        host = "host",
+        authentication = authentication,
+        privateKeyFileName = fileName,
+    )
+}
+
+private class FakeRepository(
+    private val connections: Flow<List<NetworkConnection>>,
+) : NetworkConnectionRepository {
+    override fun getConnections(): Flow<List<NetworkConnection>> = connections
+    override suspend fun getConnection(id: Long): NetworkConnection? = error("Not used")
+    override suspend fun upsert(connection: NetworkConnection): Long = error("Not used")
+    override suspend fun delete(id: Long) = error("Not used")
+}
+
+private class FakeSshKeyStore : SshKeyStore {
+    var referencedFileNames: Set<String>? = emptySet()
+
+    override suspend fun initialize(referencedFileNames: Set<String>?) {
+        this.referencedFileNames = referencedFileNames
+    }
+
+    override suspend fun stage(uri: Uri): StagedSshKey = error("Not used")
+    override fun resolve(fileName: String): File = error("Not used")
+    override suspend fun commit(fileName: String): String = error("Not used")
+    override suspend fun delete(fileName: String) = error("Not used")
+}

core/data/build.gradle.kts

@@ -45,6 +45,7 @@ dependencies {
     kspAndroidTest(libs.hilt.compiler)
 
     testImplementation(libs.junit4)
+    testImplementation(libs.kotlinx.coroutines.test)
     androidTestImplementation(libs.androidx.test.ext)
     androidTestImplementation(libs.androidx.test.espresso.core)
 }

core/data/src/main/java/dev/anilbeesetti/nextplayer/core/data/repository/LocalNetworkConnectionRepository.kt

@@ -2,6 +2,7 @@ package dev.anilbeesetti.nextplayer.core.data.repository
 
 import dev.anilbeesetti.nextplayer.core.database.dao.NetworkConnectionDao
 import dev.anilbeesetti.nextplayer.core.database.entities.NetworkConnectionEntity
+import dev.anilbeesetti.nextplayer.core.model.NetworkAuthentication
 import dev.anilbeesetti.nextplayer.core.model.NetworkConnection
 import dev.anilbeesetti.nextplayer.core.model.NetworkProtocol
 import javax.inject.Inject
@@ -35,6 +36,11 @@ class LocalNetworkConnectionRepository @Inject constructor(
         username = username,
         password = password,
         useHttps = useHttps,
+        authentication = runCatching { NetworkAuthentication.valueOf(authentication) }
+            .getOrDefault(NetworkAuthentication.PASSWORD),
+        privateKeyFileName = privateKeyFileName,
+        privateKeyPassphrase = privateKeyPassphrase,
+        hostKeyFingerprint = hostKeyFingerprint,
     )
 
     private fun NetworkConnection.toEntity() = NetworkConnectionEntity(
@@ -47,5 +53,9 @@ class LocalNetworkConnectionRepository @Inject constructor(
         username = username,
         password = password,
         useHttps = useHttps,
+        authentication = authentication.name,
+        privateKeyFileName = privateKeyFileName,
+        privateKeyPassphrase = privateKeyPassphrase,
+        hostKeyFingerprint = hostKeyFingerprint,
     )
 }

core/data/src/test/java/dev/anilbeesetti/nextplayer/core/data/repository/LocalNetworkConnectionRepositoryTest.kt

@@ -0,0 +1,77 @@
+package dev.anilbeesetti.nextplayer.core.data.repository
+
+import dev.anilbeesetti.nextplayer.core.database.dao.NetworkConnectionDao
+import dev.anilbeesetti.nextplayer.core.database.entities.NetworkConnectionEntity
+import dev.anilbeesetti.nextplayer.core.model.NetworkAuthentication
+import dev.anilbeesetti.nextplayer.core.model.NetworkConnection
+import dev.anilbeesetti.nextplayer.core.model.NetworkProtocol
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.test.runTest
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class LocalNetworkConnectionRepositoryTest {
+    private val dao = FakeNetworkConnectionDao()
+    private val repository = LocalNetworkConnectionRepository(dao)
+
+    @Test
+    fun `upsert and get connection preserves authentication settings`() = runTest {
+        val connection = NetworkConnection(
+            name = "SFTP",
+            protocol = NetworkProtocol.SFTP,
+            host = "10.0.2.2",
+            username = "alice",
+            authentication = NetworkAuthentication.SSH_KEY,
+            privateKeyFileName = "123.key",
+            privateKeyPassphrase = "passphrase",
+            hostKeyFingerprint = "SHA256:abc",
+        )
+
+        assertEquals(1L, repository.upsert(connection))
+        assertEquals(connection.copy(id = 1), repository.getConnection(1))
+    }
+
+    @Test
+    fun `unknown stored authentication falls back to password`() = runTest {
+        dao.seed(
+            NetworkConnectionEntity(
+                id = 7,
+                name = "Legacy",
+                protocol = NetworkProtocol.SFTP.name,
+                host = "10.0.2.2",
+                port = 22,
+                authentication = "UNKNOWN",
+            ),
+        )
+
+        assertEquals(
+            NetworkAuthentication.PASSWORD,
+            repository.getConnection(7)?.authentication,
+        )
+    }
+
+    private class FakeNetworkConnectionDao : NetworkConnectionDao {
+        private val connections = MutableStateFlow<List<NetworkConnectionEntity>>(emptyList())
+
+        fun seed(connection: NetworkConnectionEntity) {
+            connections.value = connections.value + connection
+        }
+
+        override suspend fun upsert(connection: NetworkConnectionEntity): Long {
+            val id = connection.id.takeIf { it != 0L } ?: 1L
+            val savedConnection = connection.copy(id = id)
+            connections.value = connections.value.filterNot { it.id == id } + savedConnection
+            return id
+        }
+
+        override fun getAll(): Flow<List<NetworkConnectionEntity>> = connections
+
+        override suspend fun getById(id: Long): NetworkConnectionEntity? =
+            connections.value.firstOrNull { it.id == id }
+
+        override suspend fun deleteById(id: Long) {
+            connections.value = connections.value.filterNot { it.id == id }
+        }
+    }
+}

core/database/build.gradle.kts

@@ -10,6 +10,10 @@ android {
     namespace = "dev.anilbeesetti.nextplayer.core.database"
     compileSdk = libs.versions.android.compileSdk.get().toInt()
 
+    sourceSets {
+        getByName("androidTest").assets.srcDir("$projectDir/schemas")
+    }
+
     defaultConfig {
         minSdk = libs.versions.android.minSdk.get().toInt()
     }
@@ -48,5 +52,6 @@ dependencies {
     testImplementation(libs.junit4)
     androidTestImplementation(libs.androidx.test.ext)
     androidTestImplementation(libs.androidx.test.espresso.core)
+    androidTestImplementation(libs.androidx.room.testing)
     androidTestImplementation(libs.kotlinx.coroutines.test)
 }