test: exercise native Android flows against pinned upstream HTTPS and OIDC

Add an ephemeral HTTPS proxy and standards-shaped RS256/S256-PKCE test IdP around the unmodified upstream checkout. Require unlocked devices and nonempty, failure-free JUnit evidence. The extended API 35 suite passes all seven cases, including native Blob/file transfer, session recreation, outage recovery, isolated OIDC and back navigation; eight evidence-verifier regressions also pass. API 37 and real-provider/device validation remain release gates.

scripts/integration-server.mjs

@@ -0,0 +1,53 @@
+// Test-only reverse proxy around the unmodified pinned upstream application.
+import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { randomBytes } from 'node:crypto';
+import { once } from 'node:events';
+import { startIdentityProvider } from './oidc-fixture.mjs';
+
+const [upstream, directory] = process.argv.slice(2);
+process.env.PORT = '0';
+process.env.BIND_ADDRESS = '127.0.0.1';
+process.env.DB_PATH = path.join(directory, 'fixture.db');
+process.env.SESSION_SECRET = randomBytes(48).toString('hex');
+process.env.SESSION_SECURE = 'true';
+process.env.DB_ENCRYPTION_KEY = '';
+process.env.NODE_ENV = 'test';
+process.env.LOG_LEVEL = 'warn';
+const tls = { key: fs.readFileSync(path.join(directory, 'key.pem')), cert: fs.readFileSync(path.join(directory, 'cert.pem')) };
+const idp = await startIdentityProvider(tls);
+process.env.OIDC_ISSUER = idp.issuer;
+process.env.OIDC_CLIENT_ID = idp.clientId;
+process.env.OIDC_CLIENT_SECRET = idp.secret;
+const { server } = await import(pathToFileURL(path.join(upstream, 'server/index.js')));
+if (!server.listening) await once(server, 'listening');
+let networkAvailable = true;
+const proxy = https.createServer(tls, (request, response) => {
+  // Fault injection lives only in this loopback fixture, never in upstream/app code.
+  if (request.method === 'POST' && ['/__mobile_test/network/off', '/__mobile_test/network/on'].includes(request.url)) {
+    networkAvailable = request.url.endsWith('/on');
+    response.writeHead(200, { 'Content-Type': 'application/json' });
+    response.end('{}');
+    return;
+  }
+  if (!networkAvailable) { request.socket.destroy(); return; }
+  const backend = http.request({
+    hostname: '127.0.0.1', port: server.address().port,
+    method: request.method, path: request.url,
+    headers: { ...request.headers, 'x-forwarded-proto': 'https', 'x-forwarded-for': '127.0.0.1' },
+  }, incoming => {
+    response.writeHead(incoming.statusCode, incoming.headers);
+    incoming.pipe(response);
+  });
+  backend.on('error', () => { response.writeHead(502); response.end(); });
+  request.pipe(backend);
+});
+proxy.listen(0, '127.0.0.1');
+await once(proxy, 'listening');
+process.env.OIDC_REDIRECT_URI = `https://127.0.0.1:${proxy.address().port}/api/v1/auth/oidc/callback`;
+idp.setRedirect(process.env.OIDC_REDIRECT_URI);
+fs.writeFileSync(path.join(directory, 'ready.json'), JSON.stringify({ port: proxy.address().port, idpPort: idp.port }));
+process.on('SIGTERM', () => { idp.close(); proxy.close(); server.close(); process.exit(0); });

scripts/oidc-fixture.mjs

@@ -0,0 +1,86 @@
+// Standards-shaped loopback test IdP, never shipped in the mobile apps.
+// It validates single-use codes, exact redirect URI, Basic client auth and S256
+// PKCE, and signs real RS256 ID tokens containing the original nonce.
+import https from 'node:https';
+import { createHash, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
+import { once } from 'node:events';
+
+export async function startIdentityProvider(tls) {
+  const clientId = 'mobile-test-client';
+  const secret = randomBytes(32).toString('hex');
+  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const key = { ...publicKey.export({ format: 'jwk' }), kid: 'fixture-key', alg: 'RS256', use: 'sig' };
+  const codes = new Map();
+  const access = new Set();
+  const authenticatesClient = header => {
+    if (!/^Basic /i.test(header || '')) return false;
+    const decoded = Buffer.from(header.slice(6), 'base64').toString('utf8');
+    const separator = decoded.indexOf(':');
+    const formDecode = value => decodeURIComponent(value.replace(/\+/g, ' '));
+    try {
+      return separator >= 0 && formDecode(decoded.slice(0, separator)) === clientId &&
+        formDecode(decoded.slice(separator + 1)) === secret;
+    } catch { return false; }
+  };
+  let issuer;
+  let redirect;
+  const profile = { sub: 'mobile-oidc-subject', preferred_username: 'mobile-oidc', name: 'Mobile OIDC Test',
+    email: 'mobile-test@example.invalid', email_verified: true };
+  const json = (response, status, data) => {
+    response.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    response.end(JSON.stringify(data));
+  };
+  const idp = https.createServer(tls, async (request, response) => {
+    const url = new URL(request.url, issuer);
+    if (url.pathname === '/.well-known/openid-configuration') {
+      return json(response, 200, { issuer, authorization_endpoint: issuer + '/authorize',
+        token_endpoint: issuer + '/token', userinfo_endpoint: issuer + '/userinfo', jwks_uri: issuer + '/jwks',
+        response_types_supported: ['code'], subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: ['RS256'], token_endpoint_auth_methods_supported: ['client_secret_basic'],
+        code_challenge_methods_supported: ['S256'] });
+    }
+    if (url.pathname === '/jwks') return json(response, 200, { keys: [key] });
+    if (url.pathname === '/authorize') {
+      const parameters = url.searchParams;
+      if (parameters.get('client_id') !== clientId || parameters.get('redirect_uri') !== redirect ||
+          parameters.get('code_challenge_method') !== 'S256' || !parameters.get('state') || !parameters.get('nonce')) {
+        return json(response, 400, { error: 'invalid_request' });
+      }
+      const code = randomBytes(24).toString('hex');
+      codes.set(code, { challenge: parameters.get('code_challenge'), nonce: parameters.get('nonce'), expires: Date.now() + 60_000 });
+      const callback = new URL(redirect);
+      callback.searchParams.set('code', code); callback.searchParams.set('state', parameters.get('state'));
+      response.writeHead(302, { Location: callback.href, 'Cache-Control': 'no-store' }); response.end(); return;
+    }
+    if (url.pathname === '/token' && request.method === 'POST') {
+      let body = '';
+      for await (const chunk of request) { body += chunk; if (body.length > 8192) return json(response, 413, {}); }
+      const parameters = new URLSearchParams(body);
+      const code = parameters.get('code'); const grant = codes.get(code); codes.delete(code);
+      if (!grant || grant.expires < Date.now() || parameters.get('grant_type') !== 'authorization_code' ||
+          parameters.get('redirect_uri') !== redirect || !authenticatesClient(request.headers.authorization) ||
+          createHash('sha256').update(parameters.get('code_verifier') || '').digest('base64url') !== grant.challenge) {
+        console.error('Test IdP grant rejected:', JSON.stringify({
+          knownCode: !!grant, expired: !!grant && grant.expires < Date.now(),
+          redirectMatches: parameters.get('redirect_uri') === redirect,
+          clientMatches: authenticatesClient(request.headers.authorization),
+          pkceMatches: !!grant && createHash('sha256').update(parameters.get('code_verifier') || '').digest('base64url') === grant.challenge,
+        }));
+        return json(response, 400, { error: 'invalid_grant' });
+      }
+      const header = Buffer.from(JSON.stringify({ alg: 'RS256', kid: key.kid, typ: 'JWT' })).toString('base64url');
+      const payload = Buffer.from(JSON.stringify({ iss: issuer, aud: clientId, sub: profile.sub, nonce: grant.nonce,
+        iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 60 })).toString('base64url');
+      const token = randomBytes(24).toString('hex'); access.add(token);
+      const signature = sign('RSA-SHA256', Buffer.from(header + '.' + payload), privateKey).toString('base64url');
+      return json(response, 200, { access_token: token, token_type: 'Bearer', expires_in: 60, id_token: header + '.' + payload + '.' + signature });
+    }
+    if (url.pathname === '/userinfo' && access.has(request.headers.authorization?.replace(/^Bearer /, ''))) {
+      return json(response, 200, profile);
+    }
+    json(response, 404, { error: 'not_found' });
+  });
+  idp.listen(0, '127.0.0.1'); await once(idp, 'listening');
+  issuer = 'https://127.0.0.1:' + idp.address().port;
+  return { issuer, clientId, secret, port: idp.address().port, setRedirect(value) { redirect = value; }, close() { idp.close(); } };
+}

scripts/test-integration.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Real upstream HTTPS/reverse-proxy tests; optionally drive the Android emulator.
+
+Keys and CA trust exist only in a private temporary directory and the .integration
+APK. Production and ordinary debug builds never include this trust configuration.
+"""
+import argparse
+import http.cookiejar
+import json
+import os
+from pathlib import Path
+import secrets
+import shutil
+import ssl
+import subprocess
+import tempfile
+import time
+import urllib.error
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+REVISION = "10bfef7686ed7303b4c74c7fcc55a5eb16356c9d"
+
+
+def run(upstream, android):
+    revision = subprocess.check_output(["git", "-C", str(upstream), "rev-parse", "HEAD"], text=True).strip()
+    assert revision == REVISION, f"Expected pinned upstream {REVISION}, got {revision}"
+    base_temp = Path("/tmp/opencode") if Path("/tmp/opencode").exists() else Path(tempfile.gettempdir())
+    with tempfile.TemporaryDirectory(prefix="yuvomi-https-", dir=base_temp) as temporary:
+        directory = Path(temporary)
+        subprocess.run([
+            "openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
+            "-keyout", str(directory / "key.pem"), "-out", str(directory / "cert.pem"),
+            "-subj", "/CN=Yuvomi temporary test CA",
+            "-addext", "subjectAltName=IP:127.0.0.1,IP:10.0.2.2,DNS:localhost",
+        ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        with (directory / "server.log").open("w") as log:
+            process = subprocess.Popen(["node", str(ROOT / "scripts/integration-server.mjs"), str(upstream), temporary],
+                                       cwd=upstream, stdout=log, stderr=log,
+                                       env={**os.environ, "NODE_EXTRA_CA_CERTS": str(directory / "cert.pem")})
+            try:
+                for _ in range(200):
+                    if (directory / "ready.json").exists():
+                        break
+                    if process.poll() is not None:
+                        raise RuntimeError((directory / "server.log").read_text())
+                    time.sleep(0.1)
+                ready = json.loads((directory / "ready.json").read_text())
+                port = ready["port"]
+                base = f"https://127.0.0.1:{port}"
+                context = ssl.create_default_context(cafile=str(directory / "cert.pem"))
+                cookies = http.cookiejar.CookieJar()
+                client = urllib.request.build_opener(urllib.request.HTTPSHandler(context=context),
+                                                     urllib.request.HTTPCookieProcessor(cookies))
+
+                def request(route, payload=None, headers=None):
+                    body = None if payload is None else json.dumps(payload).encode()
+                    req = urllib.request.Request(base + route, body, headers={
+                        "Accept": "application/json", "Content-Type": "application/json", **(headers or {})})
+                    try:
+                        with client.open(req, timeout=15) as response:
+                            return response.status, response.read(), response.headers
+                    except urllib.error.HTTPError as error:
+                        return error.code, error.read(), error.headers
+
+                # A certificate unknown to the system MUST be rejected.
+                try:
+                    urllib.request.urlopen(base + "/api/v1/version", timeout=5)
+                    raise AssertionError("Untrusted certificate was accepted")
+                except urllib.error.URLError as error:
+                    assert isinstance(error.reason, ssl.SSLCertVerificationError)
+                print("PASS: untrusted TLS certificate rejected")
+                status, body, _ = request("/api/v1/version")
+                metadata = json.loads(body)
+                assert status == 200 and isinstance(metadata["app_name"], str)
+                assert metadata["setup_required"] is True and "version" not in metadata
+                assert isinstance(metadata["password_reset_enabled"], bool)
+                status, body, _ = request("/api/v1/auth/oidc/config")
+                assert status == 200 and json.loads(body)["enabled"] is True
+                print("PASS: actual upstream compatibility metadata over HTTPS reverse proxy")
+                password = secrets.token_urlsafe(24)
+                assert request("/api/v1/auth/setup", {"username": "mobiletest", "display_name": "Mobile Test", "password": password})[0] == 201
+                status, body, headers = request("/api/v1/auth/login", {"username": "mobiletest", "password": password})
+                assert status == 200
+                session = [cookie for cookie in cookies if cookie.name == "yuvomi.sid"][0]
+                assert session.secure and session.has_nonstandard_attr("HttpOnly")
+                assert "SameSite=Lax" in " ".join(headers.get_all("Set-Cookie"))
+                csrf = json.loads(body)["csrfToken"]
+                assert request("/api/v1/auth/me")[0] == 200
+                assert json.loads(request("/api/v1/version")[1])["version"] == "2.78.0"
+                assert request("/api/v1/auth/logout", {})[0] == 403
+                assert request("/api/v1/auth/logout", {}, {"X-CSRF-Token": csrf})[0] == 200
+                assert request("/api/v1/auth/me")[0] == 401
+                print("PASS: login, Secure/HttpOnly/SameSite cookies, persistence, CSRF rejection and logout/revocation")
+                assert request("/api/v1/auth/oidc/start")[0] == 200
+                status, body, _ = request("/api/v1/auth/me")
+                identity = json.loads(body)
+                assert status == 200 and identity.get("user", {}).get("username") == "mobile-oidc", (
+                    f"OIDC session rejected (HTTP {status}); " + "\n".join(
+                        (directory / "server.log").read_text().splitlines()[-20:]))
+                assert request("/api/v1/auth/logout", {}, {"X-CSRF-Token": identity["csrfToken"]})[0] == 200
+                print("PASS: upstream OIDC discovery, RS256/nonce validation, S256 PKCE exchange and test-IdP session")
+                if android:
+                    resources = directory / "res"
+                    (resources / "xml").mkdir(parents=True)
+                    (resources / "raw").mkdir()
+                    shutil.copyfile(directory / "cert.pem", resources / "raw/integration_ca.pem")
+                    (resources / "xml/network_security_config.xml").write_text('''<network-security-config>
+<base-config cleartextTrafficPermitted="false"><trust-anchors>
+<certificates src="system"/><certificates src="@raw/integration_ca"/>
+</trust-anchors></base-config></network-security-config>''')
+                    env = {**os.environ, "YUVOMI_TEST_RES": str(resources),
+                           "YUVOMI_TEST_URL": base, "YUVOMI_TEST_PASSWORD": password}
+                    sdk = Path(env.get("ANDROID_HOME", env.get("ANDROID_SDK_ROOT", "")))
+                    adb = sdk / "platform-tools/adb"
+                    user_state = subprocess.check_output(
+                        [str(adb), "shell", "am", "get-started-user-state", "0"], text=True).strip()
+                    if user_state != "RUNNING_UNLOCKED":
+                        raise RuntimeError(f"Unlock the emulator before testing (user state: {user_state}).")
+                    subprocess.run([str(adb), "reverse", f"tcp:{port}", f"tcp:{port}"], check=True)
+                    subprocess.run([str(adb), "reverse", f"tcp:{ready['idpPort']}", f"tcp:{ready['idpPort']}"], check=True)
+                    try:
+                        # The ephemeral password is passed through the local test runner only,
+                        # never written into a source file or printed by this harness.
+                        result = subprocess.run(["bash", str(ROOT / "android/gradlew"), "-p", str(ROOT / "android"),
+                            "-Pintegration", "connectedIntegrationAndroidTest"], env=env, check=False)
+                        if result.returncode:
+                            raise RuntimeError("Android integration tests failed. Inspect the Gradle test report.")
+                        output = Path(env.get("YUVOMI_BUILD_DIR", ROOT / "android"))
+                        reports = output / "app/outputs/androidTest-results/connected/integration"
+                        if "YUVOMI_BUILD_DIR" not in env:
+                            reports = ROOT / "android/app/build/outputs/androidTest-results/connected/integration"
+                        subprocess.run(["python3", str(ROOT / "scripts/verify-test-results.py"),
+                                        str(reports), "--minimum", "7"], check=True)
+                    finally:
+                        subprocess.run([str(adb), "reverse", "--remove", f"tcp:{port}"], check=False)
+                        subprocess.run([str(adb), "reverse", "--remove", f"tcp:{ready['idpPort']}"], check=False)
+            finally:
+                process.terminate()
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.wait()
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("upstream", type=Path)
+    parser.add_argument("--android", action="store_true")
+    arguments = parser.parse_args()
+    run(arguments.upstream.resolve(), arguments.android)

scripts/test-verifier.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Regression tests for fail-closed JUnit evidence verification."""
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+VERIFIER = Path(__file__).with_name("verify-test-results.py")
+
+
+class EvidenceVerifierTests(unittest.TestCase):
+    def verify(self, xml=None, minimum=1):
+        with tempfile.TemporaryDirectory(prefix="yuvomi-evidence-") as temporary:
+            if xml is not None:
+                (Path(temporary) / "TEST-fixture.xml").write_text(xml)
+            return subprocess.run(
+                [sys.executable, str(VERIFIER), temporary, "--minimum", str(minimum)],
+                capture_output=True, text=True,
+            ).returncode
+
+    def test_missing_reports_fail(self):
+        self.assertNotEqual(self.verify(), 0)
+
+    def test_empty_reports_fail(self):
+        self.assertNotEqual(self.verify("<testsuite/>"), 0)
+
+    def test_malformed_reports_fail(self):
+        self.assertNotEqual(self.verify("<testsuite>"), 0)
+
+    def test_failed_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><failure/></testcase></testsuite>"), 0)
+
+    def test_errored_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><error/></testcase></testsuite>"), 0)
+
+    def test_skipped_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><skipped/></testcase></testsuite>"), 0)
+
+    def test_insufficient_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase/></testsuite>", minimum=2), 0)
+
+    def test_passing_cases_succeed(self):
+        self.assertEqual(self.verify("<testsuite><testcase/></testsuite>"), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

scripts/verify-test-results.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Require real, nonempty JUnit results; a build tool's zero exit is insufficient."""
+import argparse
+from pathlib import Path
+import xml.etree.ElementTree as ET
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("directory", type=Path)
+parser.add_argument("--minimum", type=int, required=True)
+arguments = parser.parse_args()
+cases = []
+for path in arguments.directory.rglob("TEST*.xml"):
+    cases.extend(ET.parse(path).getroot().iter("testcase"))
+failed = sum(case.find("failure") is not None or case.find("error") is not None for case in cases)
+skipped = sum(case.find("skipped") is not None for case in cases)
+print(f"JUnit evidence: {len(cases)} tests, {failed} failures/errors, {skipped} skipped")
+if len(cases) < arguments.minimum or failed or skipped:
+    raise SystemExit("Incomplete or failing test evidence; do not report this run as passing.")