@onekeyfe/react-native-jpush 6.7.0-alpha.436 → 6.7.0-alpha.444

package/README.md

@@ -19,10 +19,17 @@ yarn workspace @onekeyfe/react-native-jpush typecheck
 yarn workspace @onekeyfe/react-native-jpush lint
 yarn workspace @onekeyfe/react-native-jpush test
 
-# Native iOS & Android E2E protocol verification (uses non-production demo key 1f2027d3cfb1b51dac664c42)
+# Resolve JUnit dependencies and run the core/FCM module suites
+(cd example/react-native/android && ./gradlew :onekeyfe_react-native-jpush:testDebugUnitTest :onekey-jpush-fcm:testDebugUnitTest)
+
+# macOS: native host build/protocol regressions (loopback servers and isolated RN/Android shims)
 python3 native-modules/react-native-jpush/scripts/verify_clean_sdk.py
 ```
 
+Java and Objective-C host fixtures live in `tests/android` and `tests/ios`; Python only builds, runs and checks artifacts. Android host tests use real JUnit 4.13.2 from the Gradle dependency cache. The FCM Gradle suite uses Robolectric and real Firebase message/task types, with mocked external token requests. These checks do not establish physical-device or cloud delivery.
+
+The external Jiguang sandbox register/login test is explicitly skipped by default. Set `JPUSH_LIVE_TESTS=1` when running either Android test entry to enable it; then all network/protocol/assertion failures fail the test. CI runs both host suites plus Gradle FCM tests. A manual `native-tests` workflow can enable the same cloud check with `jpush_live_cloud`.
+
 ## Android Google / FCM source transport
 
 The optional Android source library in `android/fcm` replaces the opaque Jiguang FCM plugin. It delegates the Google transport to the official Firebase Messaging SDK and forwards tokens and messages into this package's JCore/JPush pipeline. Link it alongside the project's autolinked JPush module (the alias below matches app-monorepo):
@@ -37,4 +44,14 @@ project(':onekey-jpush-fcm').projectDir = new File(project(':jpush-react-native'
 googleImplementation project(':onekey-jpush-fcm')
 ```
 
-The host retains its existing `google-services.json` and Google Services Gradle plugin. Firebase auto-init stays disabled; JPush initialization requests the token after authorization. Cloud acceptance requires the matching Firebase credentials configured in the Jiguang sender. For Firebase-managed background notification payloads, use `cn.jpush.android.intent.NOTIFICATION_OPENED` as the click action so the private JPush activity receives `JMessageExtra`.
+The host retains its existing `google-services.json` and Google Services Gradle plugin. Firebase auto-init stays disabled; JPush initialization requests the token after authorization. Granting authorization after a previously unauthorized init also requests registration without reconnecting. Cloud acceptance requires the matching Firebase credentials configured in the Jiguang sender.
+
+### Client enforcement of stopped/authorization controls
+
+Vendor payloads do not need to change. `FcmMessagingService.handleIntent` checks `stopPush()` and collection authorization before calling the pinned Firebase Messaging 25.0.1 receive handler. This covers Firebase's automatic background display of notification/combined payloads as well as data-only delivery. Authorized messages retain Firebase's normal dispatch and deduplication; callback-level guards remain. Blocked events are discarded and are not replayed on resume or authorization grant. Keep the receive-entry integration tests when upgrading Firebase because this override uses its internal public receive hook.
+
+The optional Google module disables Firebase notification delegation and removes the unguarded fallback service. A private startup provider clears any existing Google Play services notification delegate on Android 10+ after an upgrade, without requesting a token or changing consent. Other delegates are preserved. The provider runs before JS initialization, including when push is stopped or consent is absent. Existing delegation is revoked when the updated app first starts; code in a never-started update cannot revoke an already-installed delegate. Direct-boot reception before user unlock is not enabled.
+
+For vendor background notification/combined payloads, Firebase still owns display after the gate allows delivery. Their click action must remain `cn.jpush.android.intent.NOTIFICATION_OPENED` so the private JPush activity receives `JMessageExtra`. Data-only payloads continue through the native arrival/custom-message pipeline.
+
+Device acceptance must cover background notification-only, combined and data-only payloads: normal authorized delivery, no display/callback after stop or authorization withdrawal, normal delivery after resume/regrant, and an upgrade from existing Play services delegation. Robolectric tests run Firebase's real Intent receive/display code with only its transport acknowledgement mocked; they do not establish vendor cloud or physical-device acceptance.

package/android/build.gradle

@@ -107,6 +107,7 @@ android {
   testOptions {
     unitTests.returnDefaultValues = true
     unitTests.all {
+      inputs.property("jpushLiveTests", System.getenv("JPUSH_LIVE_TESTS") ?: "0")
       testLogging {
         events "passed", "skipped", "failed", "standardOut", "standardError"
         outputs.upToDateWhen { false }

package/android/fcm/build.gradle

@@ -14,6 +14,10 @@ android {
     sourceCompatibility JavaVersion.VERSION_1_8
     targetCompatibility JavaVersion.VERSION_1_8
   }
+
+  testOptions {
+    unitTests.includeAndroidResources = true
+  }
 }
 
 def coreProject = rootProject.subprojects.find {
@@ -26,4 +30,7 @@ if (coreProject == null) {
 dependencies {
   implementation project(coreProject.path)
   implementation 'com.google.firebase:firebase-messaging:25.0.1'
+  testImplementation 'junit:junit:4.13.2'
+  testImplementation 'org.robolectric:robolectric:4.17'
+  testImplementation 'org.mockito:mockito-core:5.20.0'
 }

package/android/fcm/src/main/AndroidManifest.xml

@@ -1,6 +1,15 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+  xmlns:tools="http://schemas.android.com/tools">
   <application>
     <meta-data android:name="firebase_messaging_auto_init_enabled" android:value="false" />
+    <meta-data android:name="firebase_messaging_notification_delegation_enabled" android:value="false" />
+    <provider
+      android:name="com.onekey.jpush.fcm.FcmInitProvider"
+      android:authorities="${applicationId}.onekey.fcm.init"
+      android:exported="false" />
+    <service
+      android:name="com.google.firebase.messaging.FirebaseMessagingService"
+      tools:node="remove" />
     <service android:name="com.onekey.jpush.fcm.FcmMessagingService" android:exported="false">
       <intent-filter>
         <action android:name="com.google.firebase.MESSAGING_EVENT" />

package/android/fcm/src/main/java/com/onekey/jpush/fcm/FcmInitProvider.java

@@ -0,0 +1,25 @@
+package com.onekey.jpush.fcm;
+
+import android.app.NotificationManager;
+import android.content.Context;
+import android.os.Build;
+import cn.jiguang.plugins.push.common.JLogger;
+import cn.jpush.android.service.InitProvider;
+
+public final class FcmInitProvider extends InitProvider {
+    @Override
+    public boolean onCreate() {
+        super.onCreate();
+        Context context = getContext();
+        if (context != null && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            NotificationManager notifications = context.getSystemService(NotificationManager.class);
+            // Firebase caches delegation initialization across upgrades, so manifest opt-out alone
+            // does not revoke an existing Play services delegate.
+            if (notifications != null && "com.google.android.gms".equals(notifications.getNotificationDelegate())) {
+                notifications.setNotificationDelegate(null);
+                JLogger.i("FCM notification delegation disabled");
+            }
+        }
+        return true;
+    }
+}

package/android/fcm/src/main/java/com/onekey/jpush/fcm/FcmMessagingService.java

@@ -1,9 +1,10 @@
 package com.onekey.jpush.fcm;
 
+import android.content.Intent;
 import android.os.Bundle;
+import cn.jiguang.api.JCoreManager;
 import cn.jiguang.core.JCoreStorage;
 import cn.jiguang.plugins.push.common.JLogger;
-import cn.jpush.android.api.JPushInterface;
 import cn.jpush.android.api.JThirdPlatFormInterface;
 import cn.jpush.android.local.ActionHelper;
 import com.google.firebase.messaging.FirebaseMessagingService;
@@ -12,12 +13,23 @@ import java.util.Map;
 import org.json.JSONObject;
 
 public final class FcmMessagingService extends FirebaseMessagingService {
+    @Override
+    public void handleIntent(Intent intent) {
+        // Firebase may display background notifications before onMessageReceived is called.
+        if (JCoreStorage.isPushStopped(this) || !JCoreStorage.isCollectionAuth(this)) {
+            JLogger.i("FCM receive blocked by push or authorization state");
+            return;
+        }
+        super.handleIntent(intent);
+    }
+
     @Override
     public void onNewToken(String token) {
         if (JCoreStorage.isPushStopped(this) || !JCoreStorage.isCollectionAuth(this)) {
             return;
         }
-        JPushInterface.init(getApplicationContext());
+        // Initialize the transport without fetching and submitting this token a second time.
+        JCoreManager.init(getApplicationContext());
         FcmPushManager.acceptToken(getApplicationContext(), token);
     }
 

package/android/fcm/src/test/java/com/onekey/jpush/fcm/FcmAdapterTest.java

@@ -0,0 +1,684 @@
+package com.onekey.jpush.fcm;
+
+import static org.junit.Assert.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+import android.app.ActivityManager;
+import android.app.KeyguardManager;
+import android.app.Notification;
+import android.app.NotificationManager;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.ActivityInfo;
+import android.content.pm.ApplicationInfo;
+import android.content.pm.ResolveInfo;
+import android.os.Bundle;
+import android.os.Looper;
+import android.os.Process;
+import cn.jiguang.api.JCoreManager;
+import cn.jiguang.api.utils.JCollectionAuth;
+import cn.jiguang.core.JCoreCrypto;
+import cn.jiguang.core.JCoreStorage;
+import cn.jiguang.core.JCoreTcpEngine;
+import cn.jiguang.core.JCoreWireCodec;
+import cn.jiguang.plugins.push.common.JLogger;
+import cn.jpush.android.api.CustomMessage;
+import cn.jpush.android.api.JPushInterface;
+import cn.jpush.android.api.JThirdPlatFormInterface;
+import cn.jpush.android.api.NotificationMessage;
+import cn.jpush.android.local.ActionHelper;
+import cn.jpush.android.service.JNotifyActivity;
+import cn.jpush.android.service.JPushMessageReceiver;
+import com.google.android.gms.common.GoogleApiAvailabilityLight;
+import com.google.android.gms.tasks.TaskCompletionSource;
+import com.google.android.gms.tasks.Tasks;
+import com.google.firebase.FirebaseApp;
+import com.google.firebase.FirebaseOptions;
+import com.google.firebase.messaging.FirebaseMessaging;
+import com.google.firebase.messaging.FirebaseMessagingService;
+import com.google.firebase.messaging.RemoteMessage;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockedStatic;
+import org.robolectric.Robolectric;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.RuntimeEnvironment;
+import org.robolectric.Shadows;
+import org.robolectric.annotation.Config;
+import org.robolectric.annotation.LooperMode;
+import org.robolectric.util.ReflectionHelpers;
+
+@RunWith(RobolectricTestRunner.class)
+@Config(sdk = 28, manifest = Config.NONE)
+@LooperMode(LooperMode.Mode.PAUSED)
+public class FcmAdapterTest {
+    private Context context;
+    private FcmMessagingService service;
+    private NotificationManager notifications;
+    private Object firebaseRpc;
+    private final List<NotificationMessage> arrived = new ArrayList<>();
+    private final List<NotificationMessage> opened = new ArrayList<>();
+    private final List<CustomMessage> custom = new ArrayList<>();
+
+    @Before
+    public void setUp() throws Exception {
+        context = RuntimeEnvironment.getApplication();
+        ReflectionHelpers.setStaticField(JCoreStorage.class, "sAppContext", null);
+        ReflectionHelpers.<Map<String, Object>>getStaticField(JCoreStorage.class, "MEMORY_FALLBACK").clear();
+        JCoreStorage.setAppContext(context);
+        JCoreStorage.setCollectionAuth(context, true);
+        JCoreStorage.setPushStopped(context, false);
+        ReflectionHelpers.setStaticField(JThirdPlatFormInterface.class, "fcmPlugin", null);
+        ReflectionHelpers.setStaticField(JThirdPlatFormInterface.class, "fcmRegistered", false);
+        ReflectionHelpers.<java.util.Queue<String>>getStaticField(FirebaseMessagingService.class, "recentlyReceivedMessageIds").clear();
+        JLogger.setLoggerEnable(true);
+        JLogger.clearRecentLogs();
+        notifications = (NotificationManager) context.getSystemService(Context.NOTIFICATION_SERVICE);
+        notifications.cancelAll();
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND);
+        ActionHelper.getInstance().clearRegisteredReceivers();
+        ActionHelper.getInstance().registerReceiver(new JPushMessageReceiver() {
+            @Override public void onNotifyMessageArrived(Context c, NotificationMessage message) { arrived.add(message); }
+            @Override public void onNotifyMessageOpened(Context c, NotificationMessage message) { opened.add(message); }
+            @Override public void onMessage(Context c, CustomMessage message) { custom.add(message); }
+        });
+        service = Robolectric.buildService(FcmMessagingService.class).create().get();
+        // Isolate only the SDK's transport acknowledgement; run its real receive/display code.
+        firebaseRpc = mock(Class.forName("com.google.android.gms.cloudmessaging.Rpc"));
+        ReflectionHelpers.setField(service, "rpc", firebaseRpc);
+    }
+
+    @After
+    public void tearDown() {
+        ActionHelper.getInstance().clearRegisteredReceivers();
+        notifications.cancelAll();
+    }
+
+    @Test
+    public void coreDiscoversSourceAdapterOnceAndRebindsTheCurrentToken() {
+        FirebaseMessaging provider = mock(FirebaseMessaging.class);
+        when(provider.getToken()).thenReturn(Tasks.forResult("current_secret_token"));
+        GoogleApiAvailabilityLight availability = mock(GoogleApiAvailabilityLight.class);
+        when(availability.isGooglePlayServicesAvailable(context)).thenReturn(0);
+        ActionHelper dispatcher = mock(ActionHelper.class);
+        JCoreTcpEngine engine = synchronousEngine();
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<FirebaseApp> app = mockStatic(FirebaseApp.class);
+             MockedStatic<GoogleApiAvailabilityLight> google = mockStatic(GoogleApiAvailabilityLight.class);
+             MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class);
+             MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+            google.when(GoogleApiAvailabilityLight::getInstance).thenReturn(availability);
+            helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+            tcp.when(JCoreTcpEngine::getInstance).thenReturn(engine);
+            JThirdPlatFormInterface.initializeFcm(context);
+            JThirdPlatFormInterface.initializeFcm(context);
+            Shadows.shadowOf(Looper.getMainLooper()).idle();
+            app.verify(() -> FirebaseApp.initializeApp(context), times(2));
+            verify(provider, times(2)).getToken();
+            ArgumentCaptor<Bundle> actions = ArgumentCaptor.forClass(Bundle.class);
+            verify(dispatcher, times(2)).doAction(eq(context), eq("third_action"), actions.capture());
+            for (Bundle action : actions.getAllValues()) {
+                assertEquals("current_secret_token", action.getString("token"));
+                assertEquals((byte) 8, action.getByte("platform"));
+            }
+            assertLogsExclude("current_secret_token");
+        }
+    }
+
+    @Test
+    public void missingFirebaseConfigurationDoesNotEscapeCoreInitialization() {
+        GoogleApiAvailabilityLight availability = mock(GoogleApiAvailabilityLight.class);
+        when(availability.isGooglePlayServicesAvailable(context)).thenReturn(0);
+        JCoreTcpEngine engine = synchronousEngine();
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<FirebaseApp> app = mockStatic(FirebaseApp.class);
+             MockedStatic<GoogleApiAvailabilityLight> google = mockStatic(GoogleApiAvailabilityLight.class);
+             MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenThrow(new IllegalStateException("private_configuration_details"));
+            google.when(GoogleApiAvailabilityLight::getInstance).thenReturn(availability);
+            tcp.when(JCoreTcpEngine::getInstance).thenReturn(engine);
+            JThirdPlatFormInterface.initializeFcm(context);
+            assertTrue(JLogger.getRecentLogs().toString().contains("FCM registration unavailable"));
+            assertLogsExclude("private_configuration_details");
+        }
+    }
+
+    @Test
+    public void authorizationGrantedAfterSkippedInitRequestsTokenWithoutReconnect() {
+        JCoreStorage.setCollectionAuth(context, false);
+        JCoreStorage.setConnected(context, true);
+        FirebaseMessaging provider = mock(FirebaseMessaging.class);
+        when(provider.getToken()).thenReturn(Tasks.forResult("consented_secret_token"));
+        GoogleApiAvailabilityLight availability = mock(GoogleApiAvailabilityLight.class);
+        when(availability.isGooglePlayServicesAvailable(context)).thenReturn(0);
+        ActionHelper dispatcher = mock(ActionHelper.class);
+        JCoreTcpEngine engine = synchronousEngine();
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<FirebaseApp> app = mockStatic(FirebaseApp.class);
+             MockedStatic<GoogleApiAvailabilityLight> google = mockStatic(GoogleApiAvailabilityLight.class);
+             MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class);
+             MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class);
+             MockedStatic<JCoreManager> core = mockStatic(JCoreManager.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+            google.when(GoogleApiAvailabilityLight::getInstance).thenReturn(availability);
+            helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+            tcp.when(JCoreTcpEngine::getInstance).thenReturn(engine);
+            JPushInterface.init(context);
+            verifyNoInteractions(provider);
+            JCollectionAuth.setAuth(context, true);
+            JCollectionAuth.setAuth(context, true);
+            Shadows.shadowOf(Looper.getMainLooper()).idle();
+            verify(provider).getToken();
+            assertEquals("consented_secret_token", tokenAction(dispatcher).getString("token"));
+            assertTrue(JCoreStorage.isConnected(context));
+            core.verify(() -> JCoreManager.init(context));
+            assertLogsExclude("consented_secret_token");
+        }
+    }
+
+    @Test
+    public void grantingAuthorizationWhileStoppedDoesNotRequestRegistration() {
+        JCoreStorage.setCollectionAuth(context, false);
+        JCoreStorage.setPushStopped(context, true);
+        try (MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class)) {
+            JCollectionAuth.setAuth(context, true);
+            assertTrue(JCollectionAuth.isAuth(context));
+            tcp.verifyNoInteractions();
+        }
+    }
+
+    @Test
+    public void revokedAuthorizationCancelsQueuedFcmRegistration() {
+        JCoreStorage.setCollectionAuth(context, false);
+        JCoreTcpEngine engine = mock(JCoreTcpEngine.class);
+        try (MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class);
+             MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class)) {
+            tcp.when(JCoreTcpEngine::getInstance).thenReturn(engine);
+            JCollectionAuth.setAuth(context, true);
+            ArgumentCaptor<Runnable> work = ArgumentCaptor.forClass(Runnable.class);
+            verify(engine).executeAsync(work.capture());
+            JCollectionAuth.setAuth(context, false);
+            work.getValue().run();
+            firebase.verifyNoInteractions();
+            assertFalse(JCollectionAuth.isAuth(context));
+        }
+    }
+
+    @Test
+    public void tokenSuccessDispatchesPlatformEightWithoutPersistingBeforeAck() {
+        JCoreStorage.saveThirdToken(context, (byte) 8, "previous_acknowledged_token");
+        FirebaseMessaging provider = mock(FirebaseMessaging.class);
+        TaskCompletionSource<String> request = new TaskCompletionSource<>();
+        when(provider.getToken()).thenReturn(request.getTask());
+        ActionHelper dispatcher = mock(ActionHelper.class);
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+            helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+            assertEquals("previous_acknowledged_token", new FcmPushManager().getToken(context));
+            verifyNoInteractions(dispatcher);
+            request.setResult("rotated_secret_token");
+            Shadows.shadowOf(Looper.getMainLooper()).idle();
+            Bundle token = tokenAction(dispatcher);
+            assertEquals("rotated_secret_token", token.getString("token"));
+            assertEquals((byte) 8, token.getByte("platform"));
+            assertEquals("previous_acknowledged_token", JCoreStorage.getThirdToken(context, (byte) 8));
+            assertLogsExclude("rotated_secret_token");
+        }
+    }
+
+    @Test
+    public void failedTokenRequestDoesNotBindOrLogRawError() {
+        FirebaseMessaging provider = mock(FirebaseMessaging.class);
+        when(provider.getToken()).thenReturn(Tasks.forException(new IOException("secret_provider_error")));
+        ActionHelper dispatcher = mock(ActionHelper.class);
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+            helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+            new FcmPushManager().getToken(context);
+            Shadows.shadowOf(Looper.getMainLooper()).idle();
+            verifyNoInteractions(dispatcher);
+            assertTrue(JLogger.getRecentLogs().toString().contains("IOException"));
+            assertLogsExclude("secret_provider_error");
+        }
+    }
+
+    @Test
+    public void tokenCallbackRechecksStopAndAuthorizationAfterRequest() {
+        for (boolean stopped : new boolean[]{true, false}) {
+            JCoreStorage.setPushStopped(context, false);
+            JCoreStorage.setCollectionAuth(context, true);
+            FirebaseMessaging provider = mock(FirebaseMessaging.class);
+            TaskCompletionSource<String> request = new TaskCompletionSource<>();
+            when(provider.getToken()).thenReturn(request.getTask());
+            ActionHelper dispatcher = mock(ActionHelper.class);
+            try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+                 MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class)) {
+                firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+                helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+                new FcmPushManager().getToken(context);
+                JCoreStorage.setPushStopped(context, stopped);
+                JCoreStorage.setCollectionAuth(context, stopped);
+                request.setResult("late_secret_token");
+                Shadows.shadowOf(Looper.getMainLooper()).idle();
+                verifyNoInteractions(dispatcher);
+            }
+        }
+    }
+
+    @Test
+    public void newTokenInitializesCoreAndForwardsRotation() {
+        JCoreStorage.setConnected(context, true);
+        FirebaseMessaging provider = mock(FirebaseMessaging.class);
+        when(provider.getToken()).thenReturn(Tasks.forResult("new_secret_token"));
+        GoogleApiAvailabilityLight availability = mock(GoogleApiAvailabilityLight.class);
+        when(availability.isGooglePlayServicesAvailable(context)).thenReturn(0);
+        JCoreTcpEngine engine = synchronousEngine();
+        try (MockedStatic<JCoreManager> core = mockStatic(JCoreManager.class);
+             MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class);
+             MockedStatic<FirebaseApp> app = mockStatic(FirebaseApp.class);
+             MockedStatic<GoogleApiAvailabilityLight> google = mockStatic(GoogleApiAvailabilityLight.class);
+             MockedStatic<JCoreTcpEngine> tcp = mockStatic(JCoreTcpEngine.class)) {
+            firebase.when(FirebaseMessaging::getInstance).thenReturn(provider);
+            google.when(GoogleApiAvailabilityLight::getInstance).thenReturn(availability);
+            tcp.when(JCoreTcpEngine::getInstance).thenReturn(engine);
+            service.handleIntent(new Intent("com.google.firebase.messaging.NEW_TOKEN").putExtra("token", "new_secret_token"));
+            Shadows.shadowOf(Looper.getMainLooper()).idle();
+            core.verify(() -> JCoreManager.init(context));
+            ArgumentCaptor<byte[]> body = ArgumentCaptor.forClass(byte[].class);
+            verify(engine).enqueueOrSendRequest(eq(context), eq(JCoreWireCodec.CMD_THIRD_TOKEN),
+                eq(JCoreWireCodec.VER_THIRD_TOKEN), anyLong(), body.capture(), anyLong(), eq(3),
+                any(JCoreTcpEngine.RequestCallback.class));
+            assertArrayEquals(JCoreWireCodec.buildThirdTokenPayload("new_secret_token", (byte) 8, false), body.getValue());
+            verifyNoInteractions(provider);
+            assertLogsExclude("new_secret_token");
+        }
+    }
+
+    @Test
+    public void stoppedOrUnauthorizedNewTokenDoesNotInitializeCore() {
+        try (MockedStatic<JCoreManager> core = mockStatic(JCoreManager.class)) {
+            JCoreStorage.setPushStopped(context, true);
+            service.onNewToken("ignored");
+            JCoreStorage.setPushStopped(context, false);
+            JCoreStorage.setCollectionAuth(context, false);
+            service.onNewToken("ignored");
+            core.verifyNoInteractions();
+        }
+    }
+
+    @Test
+    public void emptyTokensAreIgnored() {
+        ActionHelper dispatcher = mock(ActionHelper.class);
+        try (MockedStatic<ActionHelper> helper = mockStatic(ActionHelper.class)) {
+            helper.when(ActionHelper::getInstance).thenReturn(dispatcher);
+            FcmPushManager.acceptToken(context, null);
+            FcmPushManager.acceptToken(context, "");
+            verifyNoInteractions(dispatcher);
+        }
+    }
+
+    @Test
+    public void googlePlayAvailabilityAndNotificationDelegation() {
+        GoogleApiAvailabilityLight availability = mock(GoogleApiAvailabilityLight.class);
+        when(availability.isGooglePlayServicesAvailable(context)).thenReturn(0, 9);
+        try (MockedStatic<GoogleApiAvailabilityLight> google = mockStatic(GoogleApiAvailabilityLight.class);
+             MockedStatic<JPushInterface> core = mockStatic(JPushInterface.class)) {
+            google.when(GoogleApiAvailabilityLight::getInstance).thenReturn(availability);
+            FcmPushManager manager = new FcmPushManager();
+            assertTrue(manager.isSupport(context));
+            assertFalse(manager.isSupport(context));
+            assertFalse(manager.isSupport(null));
+            manager.clearNotification(context, 123);
+            manager.clearAllNotification(context);
+            core.verify(() -> JPushInterface.clearNotificationById(context, 123));
+            core.verify(() -> JPushInterface.clearAllNotifications(context));
+        }
+    }
+
+    @Test
+    public void firebaseInitializationAndApplicationMetadata() {
+        FirebaseApp app = mock(FirebaseApp.class);
+        FirebaseOptions options = new FirebaseOptions.Builder()
+            .setApplicationId("1:123456:android:synthetic").setApiKey("synthetic_api_key").build();
+        when(app.getOptions()).thenReturn(options);
+        try (MockedStatic<FirebaseApp> firebase = mockStatic(FirebaseApp.class)) {
+            firebase.when(FirebaseApp::getInstance).thenReturn(app);
+            FcmPushManager manager = new FcmPushManager();
+            manager.init(context);
+            manager.register(context, new Bundle());
+            firebase.verify(() -> FirebaseApp.initializeApp(context), times(2));
+            assertEquals(options.getApplicationId(), manager.getAppId(context));
+            assertEquals(options.getApiKey(), manager.getAppkey(context));
+            assertEquals((byte) 8, manager.getRomType(context));
+            assertFalse(manager.isNeedClearToken(context));
+        }
+    }
+
+    @Test
+    public void firebaseNotificationFieldsFillMetadataAndTapOpensOnce() {
+        Bundle payload = metadata("{\"_jmsgid_\":\"fcm_notification\",\"n_extras\":{\"route\":\"synthetic_route\"}}");
+        payload.putString("gcm.n.e", "1");
+        payload.putString("gcm.n.title", "private_title");
+        payload.putString("gcm.n.body", "private_body");
+        service.onMessageReceived(new RemoteMessage(payload));
+        assertEquals(1, arrived.size());
+        assertEquals("private_title", arrived.get(0).notificationTitle);
+        assertEquals("private_body", arrived.get(0).notificationContent);
+        assertEquals(8, arrived.get(0).platform);
+        List<Notification> posted = Shadows.shadowOf(notifications).getAllNotifications();
+        assertEquals(1, posted.size());
+        assertEquals("private_title", posted.get(0).extras.getString(Notification.EXTRA_TITLE));
+        Intent tap = Shadows.shadowOf(posted.get(0).contentIntent).getSavedIntent();
+        assertEquals(JNotifyActivity.class.getName(), tap.getComponent().getClassName());
+        Robolectric.buildActivity(JNotifyActivity.class, tap).create();
+        assertEquals(1, opened.size());
+        assertEquals("fcm_notification", opened.get(0).msgId);
+        assertTrue(opened.get(0).notificationExtras.contains("synthetic_route"));
+        assertLogsExclude("private_title", "private_body", "synthetic_route");
+    }
+
+    @Test
+    public void postedDataOnlyTapIsIgnoredAfterStopOrAuthorizationWithdrawal() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        ActivityInfo host = new ActivityInfo();
+        host.packageName = context.getPackageName();
+        host.name = context.getPackageName() + ".MainActivity";
+        host.applicationInfo = new ApplicationInfo(context.getApplicationInfo());
+        ResolveInfo resolvedHost = new ResolveInfo();
+        resolvedHost.activityInfo = host;
+        Intent launcher = new Intent(Intent.ACTION_MAIN).addCategory(Intent.CATEGORY_LAUNCHER).setPackage(context.getPackageName());
+        Shadows.shadowOf(context.getPackageManager()).addResolveInfoForIntent(launcher, resolvedHost);
+        for (boolean stopped : new boolean[]{true, false}) {
+            JCoreStorage.setPushStopped(context, false);
+            JCoreStorage.setCollectionAuth(context, true);
+            service.handleIntent(firebaseReceiveIntent("deferred_tap_" + stopped, false));
+            List<Notification> posted = Shadows.shadowOf(notifications).getAllNotifications();
+            assertEquals(1, posted.size());
+            Intent tap = Shadows.shadowOf(posted.get(0).contentIntent).getSavedIntent();
+            JCoreStorage.setPushStopped(context, stopped);
+            JCoreStorage.setCollectionAuth(context, stopped);
+            Robolectric.buildActivity(JNotifyActivity.class, tap).create();
+            assertTrue(opened.isEmpty());
+            assertNull(Shadows.shadowOf(RuntimeEnvironment.getApplication()).getNextStartedActivity());
+            notifications.cancelAll();
+        }
+    }
+
+    @Test
+    public void compressedMetadataRetainsItsOwnTitleAndExtras() {
+        Bundle payload = metadata(compress("{\"msg_id\":\"zipped\",\"override_msg_id\":\"\",\"n_title\":\"metadata_title\",\"n_content\":\"metadata_body\",\"n_extras\":{\"route\":\"private_route\"}}"));
+        payload.putString("gcm.n.e", "1");
+        payload.putString("gcm.n.title", "fallback_title");
+        payload.putString("gcm.n.body", "fallback_body");
+        service.onMessageReceived(new RemoteMessage(payload));
+        assertEquals(1, arrived.size());
+        assertEquals("zipped", arrived.get(0).msgId);
+        assertEquals("metadata_title", arrived.get(0).notificationTitle);
+        assertTrue(arrived.get(0).notificationExtras.contains("private_route"));
+    }
+
+    @Test
+    public void standardFirebaseDataUsesTransportIdAndPreservesExtras() {
+        Bundle payload = new Bundle();
+        payload.putString("google.message_id", "transport_id");
+        payload.putString("n_title", "Synthetic notification");
+        payload.putString("n_content", "Synthetic body");
+        payload.putString("route", "synthetic_route");
+        service.onMessageReceived(new RemoteMessage(payload));
+        assertEquals(1, arrived.size());
+        assertEquals("transport_id", arrived.get(0).msgId);
+        assertTrue(arrived.get(0).notificationExtras.contains("synthetic_route"));
+    }
+
+    @Test
+    public void customDataDoesNotDisplayANotification() {
+        service.onMessageReceived(new RemoteMessage(metadata("{\"msg_id\":\"custom_id\",\"message\":\"private_custom_body\",\"content_type\":\"text\",\"extras\":{\"route\":\"private_custom_route\"}}")));
+        assertEquals(1, custom.size());
+        assertEquals("custom_id", custom.get(0).messageId);
+        assertEquals("private_custom_body", custom.get(0).message);
+        assertEquals("text", custom.get(0).contentType);
+        assertTrue(arrived.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+        assertLogsExclude("private_custom_body", "private_custom_route");
+    }
+
+    @Test
+    public void malformedAndOversizedPayloadsDoNotReachCallbacks() {
+        service.onMessageReceived(new RemoteMessage(metadata("{broken")));
+        service.onMessageReceived(new RemoteMessage(metadata("{\"jg_c\":\"not-gzip\"}")));
+        StringBuilder oversized = new StringBuilder();
+        for (int i = 0; i < 70000; i++) oversized.append('x');
+        service.onMessageReceived(new RemoteMessage(metadata(compress(oversized.toString()))));
+        assertTrue(arrived.isEmpty());
+        assertTrue(custom.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void stoppedAndUnauthorizedNotificationsAreIgnored() {
+        String body = "{\"msg_id\":\"blocked\",\"n_content\":\"synthetic\"}";
+        JCoreStorage.setPushStopped(context, true);
+        service.onMessageReceived(new RemoteMessage(metadata(body)));
+        JCoreStorage.setPushStopped(context, false);
+        JCoreStorage.setCollectionAuth(context, false);
+        service.onMessageReceived(new RemoteMessage(metadata(body)));
+        JCoreStorage.setCollectionAuth(context, true);
+        assertTrue(arrived.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void foregroundDisplayDisabledSuppressesNotificationAndArrival() {
+        service.onMessageReceived(foregroundSuppressedMessage());
+        assertTrue(arrived.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void backgroundDataOnlyMessageStillDisplaysAndDispatchesArrival() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        RemoteMessage message = foregroundSuppressedMessage();
+        assertNull(message.getNotification());
+        service.onMessageReceived(message);
+        assertEquals(1, arrived.size());
+        assertEquals("foreground_suppressed", arrived.get(0).msgId);
+        assertEquals(1, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void foregroundDisplayDecisionUsesCurrentProcessStateForEachMessage() {
+        service.onMessageReceived(foregroundSuppressedMessage());
+        assertTrue(arrived.isEmpty());
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        service.onMessageReceived(foregroundSuppressedMessage());
+        assertEquals(1, arrived.size());
+        notifications.cancelAll();
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND);
+        service.onMessageReceived(foregroundSuppressedMessage());
+        assertEquals(1, arrived.size());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void lockedScreenDoesNotSuppressDataOnlyNotification() {
+        KeyguardManager keyguard = (KeyguardManager) context.getSystemService(Context.KEYGUARD_SERVICE);
+        Shadows.shadowOf(keyguard).setKeyguardLocked(true);
+        service.onMessageReceived(foregroundSuppressedMessage());
+        assertEquals(1, arrived.size());
+        assertEquals(1, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void stoppedBackgroundCombinedIntentCannotUseFirebaseAutomaticDisplay() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        JCoreStorage.setPushStopped(context, true);
+        service.handleIntent(firebaseReceiveIntent("stopped_combined", true));
+        assertTrue(arrived.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+        verifyNoInteractions(firebaseRpc);
+        assertLogsExclude("private_title", "private_body");
+    }
+
+    @Test
+    public void unauthorizedBackgroundNotificationIntentCannotUseFirebaseAutomaticDisplay() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        JCoreStorage.setCollectionAuth(context, false);
+        Intent notificationOnly = firebaseReceiveIntent("unauthorized_notification", true);
+        notificationOnly.removeExtra("JMessageExtra");
+        service.handleIntent(notificationOnly);
+        assertTrue(arrived.isEmpty());
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+        verifyNoInteractions(firebaseRpc);
+        assertLogsExclude("private_title", "private_body");
+    }
+
+    @Test
+    public void authorizedBackgroundCombinedIntentKeepsFirebaseDisplayAndDeduplication() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        Intent receive = firebaseReceiveIntent("allowed_combined", true);
+        service.handleIntent(receive);
+        service.handleIntent(new Intent(receive));
+        assertEquals(1, Shadows.shadowOf(notifications).getAllNotifications().size());
+        assertTrue(arrived.isEmpty());
+        assertEquals(2, mockingDetails(firebaseRpc).getInvocations().size());
+    }
+
+    @Test
+    public void authorizedBackgroundDataOnlyIntentUsesNativeDisplayAndFirebaseDeduplication() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        Intent receive = firebaseReceiveIntent("allowed_data", false);
+        service.handleIntent(receive);
+        service.handleIntent(new Intent(receive));
+        assertEquals(1, arrived.size());
+        assertEquals("allowed_data", arrived.get(0).msgId);
+        assertEquals(1, Shadows.shadowOf(notifications).getAllNotifications().size());
+    }
+
+    @Test
+    public void receiveGateRechecksStateAfterStopWithdrawalAndRegrant() {
+        setProcessImportance(ActivityManager.RunningAppProcessInfo.IMPORTANCE_SERVICE);
+        JCoreStorage.setPushStopped(context, true);
+        service.handleIntent(firebaseReceiveIntent("stopped", true));
+        JCoreStorage.setPushStopped(context, false);
+        JCoreStorage.setCollectionAuth(context, false);
+        service.handleIntent(firebaseReceiveIntent("withdrawn", true));
+        assertEquals(0, Shadows.shadowOf(notifications).getAllNotifications().size());
+        JCoreStorage.setCollectionAuth(context, true);
+        service.handleIntent(firebaseReceiveIntent("regranted", true));
+        assertEquals(1, Shadows.shadowOf(notifications).getAllNotifications().size());
+        assertEquals(1, mockingDetails(firebaseRpc).getInvocations().size());
+    }
+
+    @Test
+    @Config(sdk = 34)
+    public void startupRevokesOldPlayServicesDelegateWithoutTokenOrConsent() {
+        JCoreStorage.setPushStopped(context, true);
+        JCoreStorage.setCollectionAuth(context, false);
+        notifications.setNotificationDelegate("com.google.android.gms");
+        try (MockedStatic<FirebaseMessaging> firebase = mockStatic(FirebaseMessaging.class)) {
+            Robolectric.buildContentProvider(FcmInitProvider.class).create();
+            assertNull(notifications.getNotificationDelegate());
+            assertFalse(JCollectionAuth.isAuth(context));
+            assertTrue(JCoreStorage.isPushStopped(context));
+            firebase.verifyNoInteractions();
+        }
+    }
+
+    @Test
+    @Config(sdk = 34)
+    public void startupPreservesOtherNotificationDelegates() {
+        notifications.setNotificationDelegate("other.notification.delegate");
+        Robolectric.buildContentProvider(FcmInitProvider.class).create();
+        assertEquals("other.notification.delegate", notifications.getNotificationDelegate());
+    }
+
+    @Test
+    public void automaticFirebaseTapLaunchesHostAndKeepsCompressedMetadata() {
+        ActivityInfo activity = new ActivityInfo();
+        activity.packageName = context.getPackageName();
+        activity.name = context.getPackageName() + ".MainActivity";
+        activity.applicationInfo = new ApplicationInfo(context.getApplicationInfo());
+        ResolveInfo resolve = new ResolveInfo();
+        resolve.activityInfo = activity;
+        Intent launcher = new Intent(Intent.ACTION_MAIN).addCategory(Intent.CATEGORY_LAUNCHER).setPackage(context.getPackageName());
+        Shadows.shadowOf(context.getPackageManager()).addResolveInfoForIntent(launcher, resolve);
+        Intent tap = new Intent(JPushInterface.ACTION_NOTIFICATION_OPENED)
+            .putExtra("JMessageExtra", compress("{\"msg_id\":\"cold_tap\",\"n_extras\":{\"route\":\"synthetic_route\"}}"));
+        Robolectric.buildActivity(JNotifyActivity.class, tap).create();
+        assertEquals(1, opened.size());
+        assertEquals("cold_tap", opened.get(0).msgId);
+        Intent launched = Shadows.shadowOf(RuntimeEnvironment.getApplication()).getNextStartedActivity();
+        assertNotNull(launched);
+        assertEquals(activity.name, launched.getComponent().getClassName());
+        assertTrue(opened.get(0).notificationExtras.contains("synthetic_route"));
+    }
+
+    private static Bundle metadata(String json) {
+        Bundle payload = new Bundle();
+        payload.putString("JMessageExtra", json);
+        return payload;
+    }
+
+    private static RemoteMessage foregroundSuppressedMessage() {
+        return new RemoteMessage(metadata("{\"msg_id\":\"foreground_suppressed\",\"n_content\":\"synthetic\",\"n_foreground\":\"0\"}"));
+    }
+
+    private static Intent firebaseReceiveIntent(String id, boolean notification) {
+        Intent receive = new Intent("com.google.android.c2dm.intent.RECEIVE")
+            .putExtra("google.message_id", id)
+            .putExtras(metadata("{\"msg_id\":\"" + id + "\",\"n_content\":\"private_body\",\"n_foreground\":\"0\"}"));
+        if (notification) {
+            receive.putExtra("gcm.n.e", "1");
+            receive.putExtra("gcm.n.title", "private_title");
+            receive.putExtra("gcm.n.body", "private_body");
+            receive.putExtra("gcm.n.icon", "android");
+        }
+        return receive;
+    }
+
+    private void setProcessImportance(int importance) {
+        ActivityManager.RunningAppProcessInfo process = new ActivityManager.RunningAppProcessInfo();
+        process.pid = Process.myPid();
+        process.importance = importance;
+        ActivityManager manager = (ActivityManager) context.getSystemService(Context.ACTIVITY_SERVICE);
+        Shadows.shadowOf(manager).setProcesses(Collections.singletonList(process));
+    }
+
+    private static String compress(String json) {
+        return "{\"jg_c\":\"" + JCoreCrypto.base64Encode(JCoreCrypto.gzipCompress(json.getBytes(StandardCharsets.UTF_8))) + "\"}";
+    }
+
+    private Bundle tokenAction(ActionHelper dispatcher) {
+        ArgumentCaptor<Bundle> action = ArgumentCaptor.forClass(Bundle.class);
+        verify(dispatcher).doAction(eq(context), eq("third_action"), action.capture());
+        assertEquals(JThirdPlatFormInterface.ACTION_REGISTER_TOKEN, action.getValue().getString("third_key_action"));
+        return action.getValue();
+    }
+
+    private static JCoreTcpEngine synchronousEngine() {
+        JCoreTcpEngine engine = mock(JCoreTcpEngine.class);
+        doAnswer(call -> {
+            call.<Runnable>getArgument(0).run();
+            return null;
+        }).when(engine).executeAsync(any(Runnable.class));
+        return engine;
+    }
+
+    private static void assertLogsExclude(String... values) {
+        String logs = JLogger.getRecentLogs().toString();
+        for (String value : values) assertFalse("Sensitive payload appeared in native logger", logs.contains(value));
+    }
+}

package/android/fcm/src/test/java/com/onekey/jpush/fcm/FcmManifestTest.java

@@ -0,0 +1,54 @@
+package com.onekey.jpush.fcm;
+
+import static org.junit.Assert.*;
+
+import android.content.Context;
+import android.content.pm.PackageInfo;
+import android.content.pm.PackageManager;
+import android.content.pm.ProviderInfo;
+import android.content.pm.ServiceInfo;
+import android.content.Intent;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.RuntimeEnvironment;
+import org.robolectric.annotation.Config;
+
+@RunWith(RobolectricTestRunner.class)
+@Config(sdk = 34)
+public class FcmManifestTest {
+    @Test
+    public void mergedManifestRoutesOnlyToGuardedServiceAndDisablesDelegation() throws Exception {
+        Context context = RuntimeEnvironment.getApplication();
+        PackageManager packages = context.getPackageManager();
+        PackageInfo info = packages.getPackageInfo(context.getPackageName(),
+            PackageManager.GET_META_DATA | PackageManager.GET_PROVIDERS | PackageManager.GET_SERVICES);
+        assertTrue(info.applicationInfo.metaData.containsKey("firebase_messaging_notification_delegation_enabled"));
+        assertFalse(info.applicationInfo.metaData.getBoolean("firebase_messaging_notification_delegation_enabled"));
+        assertTrue(info.applicationInfo.metaData.containsKey("firebase_messaging_auto_init_enabled"));
+        assertFalse(info.applicationInfo.metaData.getBoolean("firebase_messaging_auto_init_enabled"));
+        boolean initializerFound = false;
+        for (ProviderInfo provider : info.providers) {
+            if (FcmInitProvider.class.getName().equals(provider.name)) {
+                initializerFound = true;
+                assertFalse(provider.exported);
+            }
+        }
+        assertTrue("The startup delegate cleanup must be installed", initializerFound);
+        boolean guardedServiceFound = false;
+        for (ServiceInfo service : info.services) {
+            assertNotEquals("Unguarded Firebase fallback must not be installed",
+                "com.google.firebase.messaging.FirebaseMessagingService", service.name);
+            if (FcmMessagingService.class.getName().equals(service.name)) {
+                guardedServiceFound = true;
+                assertFalse(service.exported);
+                assertFalse(service.directBootAware);
+            }
+        }
+        assertTrue("The guarded receive service must be installed", guardedServiceFound);
+        android.content.pm.ResolveInfo handler = packages.resolveService(
+            new Intent("com.google.firebase.MESSAGING_EVENT").setPackage(context.getPackageName()), 0);
+        assertNotNull(handler);
+        assertEquals(FcmMessagingService.class.getName(), handler.serviceInfo.name);
+    }
+}

package/android/src/main/java/cn/jiguang/api/utils/JCollectionAuth.java

@@ -2,10 +2,15 @@ package cn.jiguang.api.utils;
 
 import android.content.Context;
 import cn.jiguang.core.JCoreStorage;
+import cn.jpush.android.api.JThirdPlatFormInterface;
 
 public class JCollectionAuth {
-    public static void setAuth(Context context, boolean auth) {
+    public static synchronized void setAuth(Context context, boolean auth) {
+        boolean wasAuthorized = JCoreStorage.isCollectionAuth(context);
         JCoreStorage.setCollectionAuth(context, auth);
+        if (auth && !wasAuthorized) {
+            JThirdPlatFormInterface.initializeFcm(context);
+        }
     }
 
     public static boolean isAuth(Context context) {

package/android/src/main/java/cn/jpush/android/local/ActionHelper.java

@@ -1,6 +1,8 @@
 package cn.jpush.android.local;
 
 import android.app.Activity;
+import android.app.ActivityManager;
+import android.app.KeyguardManager;
 import android.app.Notification;
 import android.app.NotificationChannel;
 import android.app.NotificationManager;
@@ -154,7 +156,7 @@ public class ActionHelper {
                     custom.platform = 8;
                     dispatchCustomMessageEvent(context, custom);
                 } else {
-                    if ("0".equals(message.displayForeground)) {
+                    if ("0".equals(message.displayForeground) && isApplicationForeground(context)) {
                         return;
                     }
                     postSystemNotification(context, message);
@@ -172,6 +174,16 @@ public class ActionHelper {
         }
     }
 
+    private boolean isApplicationForeground(Context context) {
+        KeyguardManager keyguard = (KeyguardManager) context.getSystemService(Context.KEYGUARD_SERVICE);
+        if (keyguard != null && keyguard.isKeyguardLocked()) {
+            return false;
+        }
+        ActivityManager.RunningAppProcessInfo process = new ActivityManager.RunningAppProcessInfo();
+        ActivityManager.getMyMemoryState(process);
+        return process.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND;
+    }
+
     public void doSingleAction(Context context, String action, Object data) {
     }
 
@@ -220,6 +232,10 @@ public class ActionHelper {
             }
             if (msg instanceof NotificationMessage) {
                 NotificationMessage notificationMessage = (NotificationMessage) msg;
+                if (notificationMessage.platform == 8
+                    && (JCoreStorage.isPushStopped(context) || !JCoreStorage.isCollectionAuth(context))) {
+                    return;
+                }
                 dispatchNotificationEvent(context, "notify_opened", notificationMessage);
                 broadcastNotificationOpened(context, notificationMessage);
                 if (fcmClick || notificationMessage.platform == 8) {

package/android/src/test/java/com/margelo/nitro/reactnativejpush/JPushCloudHandshakeTest.java

@@ -0,0 +1,110 @@
+package com.margelo.nitro.reactnativejpush;
+
+import static org.junit.Assert.*;
+import cn.jiguang.core.JCoreCrypto;
+import cn.jiguang.core.JCoreWireCodec;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Set;
+import org.junit.Assume;
+import org.junit.Test;
+
+public class JPushCloudHandshakeTest {
+    @Test
+    public void liveCloudHandshake() throws Exception {
+        boolean enabled = "1".equals(System.getenv("JPUSH_LIVE_TESTS"));
+        if (!enabled) {
+            System.out.println("SKIPPED live Jiguang handshake: set JPUSH_LIVE_TESTS=1 to enable");
+        }
+        Assume.assumeTrue("External cloud handshake requires JPUSH_LIVE_TESTS=1", enabled);
+        String sisJson;
+        try (DatagramSocket udp = new DatagramSocket()) {
+            String request = JCoreWireCodec.buildSisRequestJson(
+                1, ReactNativeJpushProtocolTest.DEMO_TEST_APP_KEY, 0L, "",
+                Collections.<String>emptyList(), 1
+            );
+            byte[] packet = JCoreWireCodec.encodeUdpSisPacket(request, JCoreCrypto.nextPositiveSeed24());
+            udp.setSoTimeout(2500);
+            udp.send(new DatagramPacket(packet, packet.length, InetAddress.getByName("s.jpush.cn"), 19000));
+            DatagramPacket response = new DatagramPacket(new byte[4096], 4096);
+            udp.receive(response);
+            sisJson = JCoreWireCodec.decodeUdpSisPacket(Arrays.copyOf(response.getData(), response.getLength()));
+        }
+        assertTrue("SIS response must contain endpoints", sisJson.contains("\"ips\""));
+        Set<String> endpoints = JCoreWireCodec.extractJsonStringArray(sisJson, "ips");
+        assertFalse("SIS endpoints must not be empty", endpoints.isEmpty());
+        String endpoint = endpoints.iterator().next();
+        int colon = endpoint.lastIndexOf(':');
+        try (Socket tcp = new Socket()) {
+            tcp.connect(new InetSocketAddress(endpoint.substring(0, colon), Integer.parseInt(endpoint.substring(colon + 1))), 3000);
+            tcp.setSoTimeout(5000);
+            performHandshake(tcp.getInputStream(), tcp.getOutputStream());
+        }
+        System.out.println("Live Jiguang register/login handshake passed");
+    }
+
+    // Shared by the opt-in cloud test and deterministic failure-propagation regressions.
+    static void performHandshake(InputStream in, OutputStream out) throws Exception {
+        int seed = JCoreCrypto.nextRegisterSeed();
+        JCoreWireCodec.setLastRegisterSeed(seed);
+        byte[] regBody = JCoreWireCodec.buildRegisterPayload(
+            ReactNativeJpushProtocolTest.DEMO_TEST_APP_KEY,
+            "developer-default",
+            ReactNativeJpushProtocolTest.DEMO_TEST_PACKAGE_NAME,
+            "msgbench_auto_001"
+        );
+        byte[] regFrame = JCoreWireCodec.encodeFrame(
+            JCoreWireCodec.CMD_REGISTER,
+            JCoreWireCodec.VER_REGISTER,
+            101L,
+            seed,
+            0L,
+            regBody
+        );
+        out.write(regFrame);
+        out.flush();
+
+        JCoreWireCodec.DecodedFrame regRespFrame = JCoreWireCodec.readFrameFromStream(in, 0L);
+        assertNotNull("Missing register response", regRespFrame);
+        assertEquals("Register command", JCoreWireCodec.CMD_REGISTER, regRespFrame.command);
+        assertEquals("Register status", 0, regRespFrame.statusCode);
+        JCoreWireCodec.RegisterResponse regResp = JCoreWireCodec.parseRegisterResponse(regRespFrame);
+        assertNotNull(regResp);
+        assertEquals(0L, (long) regResp.statusCode);
+        assertTrue(regResp.uid > 0L);
+        assertTrue(regResp.registrationId != null && !regResp.registrationId.isEmpty());
+
+        byte[] loginBody = JCoreWireCodec.buildLoginPayload(
+            regResp.password,
+            ReactNativeJpushProtocolTest.DEMO_TEST_APP_KEY,
+            regResp.deviceId,
+            "CN"
+        );
+        byte[] loginFrame = JCoreWireCodec.encodeFrame(
+            JCoreWireCodec.CMD_LOGIN,
+            JCoreWireCodec.VER_LOGIN,
+            102L,
+            0,
+            regResp.uid,
+            loginBody
+        );
+        out.write(loginFrame);
+        out.flush();
+
+        JCoreWireCodec.DecodedFrame loginRespFrame = JCoreWireCodec.readFrameFromStream(in, regResp.uid);
+        assertNotNull("Missing login response", loginRespFrame);
+        assertEquals("Login command", JCoreWireCodec.CMD_LOGIN, loginRespFrame.command);
+        assertEquals("Login status", 0, loginRespFrame.statusCode);
+        JCoreWireCodec.LoginResponse loginResp = JCoreWireCodec.parseLoginResponse(loginRespFrame);
+        assertNotNull(loginResp);
+        assertEquals(0L, (long) loginResp.statusCode);
+        assertTrue(loginResp.sessionId != 0);
+    }
+}

package/android/src/test/java/com/margelo/nitro/reactnativejpush/JPushHandshakeFailureTest.java

@@ -0,0 +1,73 @@
+package com.margelo.nitro.reactnativejpush;
+
+import static org.junit.Assert.*;
+import cn.jiguang.core.JCoreWireCodec;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.function.Supplier;
+import org.junit.Test;
+
+public class JPushHandshakeFailureTest {
+    @Test
+    public void networkFailureIsNotConvertedToSuccess() {
+        InputStream broken = new InputStream() {
+            @Override public int read() throws IOException {
+                throw new IOException("Synthetic connection loss");
+            }
+        };
+        assertThrows(IOException.class, () -> JPushCloudHandshakeTest.performHandshake(broken, new ByteArrayOutputStream()));
+    }
+
+    @Test
+    public void missingResponseAssertionIsNotSwallowed() {
+        assertThrows(AssertionError.class, () -> JPushCloudHandshakeTest.performHandshake(
+            new ByteArrayInputStream(new byte[0]), new ByteArrayOutputStream()
+        ));
+    }
+
+    @Test
+    public void rejectedRegistrationFailsTheHandshake() {
+        AssertionError failure = assertThrows(AssertionError.class, () -> JPushCloudHandshakeTest.performHandshake(
+            lazyReply(() -> JCoreWireCodec.encodeResponseFrame(
+                JCoreWireCodec.CMD_REGISTER, JCoreWireCodec.VER_REGISTER, 101L,
+                (int) JCoreWireCodec.getLastRegisterSeed(), 42L, 1009, new byte[0]
+            )), new ByteArrayOutputStream()
+        ));
+        assertTrue(failure.getMessage().contains("Register status"));
+    }
+
+    @Test
+    public void rejectedLoginFailsTheHandshake() {
+        AssertionError failure = assertThrows(AssertionError.class, () -> JPushCloudHandshakeTest.performHandshake(
+            lazyReply(() -> {
+                byte[] registration = JCoreWireCodec.encodeResponseFrame(
+                    JCoreWireCodec.CMD_REGISTER, JCoreWireCodec.VER_REGISTER, 101L,
+                    (int) JCoreWireCodec.getLastRegisterSeed(), 42L, 0,
+                    JCoreWireCodec.buildRegisterResponsePayload(42L, "synthetic_password", "synthetic_registration", "synthetic_device")
+                );
+                byte[] login = JCoreWireCodec.encodeResponseFrame(
+                    JCoreWireCodec.CMD_LOGIN, JCoreWireCodec.VER_LOGIN, 102L, 0, 42L, 1005, new byte[0]
+                );
+                byte[] replies = new byte[registration.length + login.length];
+                System.arraycopy(registration, 0, replies, 0, registration.length);
+                System.arraycopy(login, 0, replies, registration.length, login.length);
+                return replies;
+            }), new ByteArrayOutputStream()
+        ));
+        assertTrue(failure.getMessage().contains("Login status"));
+    }
+
+    private static InputStream lazyReply(Supplier<byte[]> response) {
+        return new InputStream() {
+            private ByteArrayInputStream input;
+            private ByteArrayInputStream input() {
+                if (input == null) input = new ByteArrayInputStream(response.get());
+                return input;
+            }
+            @Override public int read() { return input().read(); }
+            @Override public int read(byte[] bytes, int offset, int length) { return input().read(bytes, offset, length); }
+        };
+    }
+}

package/android/src/test/java/com/margelo/nitro/reactnativejpush/ReactNativeJpushProtocolTest.java

@@ -200,114 +200,6 @@ public class ReactNativeJpushProtocolTest {
         assertTrue(propPayload.length > 2);
     }
 
-    @Test
-    public void testLiveJiguangCloudHandshakeWhenNetworkReachable() throws Exception {
-        String sisJson = "";
-        DatagramSocket udp = null;
-        try {
-            String reqJson = JCoreWireCodec.buildSisRequestJson(
-                1,
-                DEMO_TEST_APP_KEY,
-                0L,
-                "",
-                Collections.<String>emptyList(),
-                1
-            );
-            byte[] reqPkt = JCoreWireCodec.encodeUdpSisPacket(reqJson, JCoreCrypto.nextPositiveSeed24());
-            udp = new DatagramSocket();
-            udp.setSoTimeout(2500);
-            InetAddress addr = InetAddress.getByName("s.jpush.cn");
-            udp.send(new DatagramPacket(reqPkt, reqPkt.length, addr, 19000));
-            byte[] buf = new byte[4096];
-            DatagramPacket respPkt = new DatagramPacket(buf, buf.length);
-            udp.receive(respPkt);
-            byte[] received = Arrays.copyOf(respPkt.getData(), respPkt.getLength());
-            sisJson = JCoreWireCodec.decodeUdpSisPacket(received);
-        } catch (Throwable networkUnavailable) {
-            // Skip live cloud assertions when running in an offline or firewall-restricted CI container.
-            return;
-        } finally {
-            if (udp != null) {
-                udp.close();
-            }
-        }
-
-        assertTrue(sisJson.contains("\"ips\""));
-        Set<String> ips = JCoreWireCodec.extractJsonStringArray(sisJson, "ips");
-        assertTrue(!ips.isEmpty());
-
-        String firstIpPort = ips.iterator().next();
-        int colon = firstIpPort.lastIndexOf(':');
-        String host = firstIpPort.substring(0, colon);
-        int port = Integer.parseInt(firstIpPort.substring(colon + 1));
-
-        Socket tcp = new Socket();
-        try {
-            tcp.connect(new InetSocketAddress(host, port), 3000);
-            tcp.setSoTimeout(5000);
-            InputStream in = tcp.getInputStream();
-            OutputStream out = tcp.getOutputStream();
-
-            int seed = JCoreCrypto.nextRegisterSeed();
-            JCoreWireCodec.setLastRegisterSeed(seed);
-            byte[] regBody = JCoreWireCodec.buildRegisterPayload(
-                DEMO_TEST_APP_KEY,
-                "developer-default",
-                DEMO_TEST_PACKAGE_NAME,
-                "msgbench_auto_001"
-            );
-            byte[] regFrame = JCoreWireCodec.encodeFrame(
-                JCoreWireCodec.CMD_REGISTER,
-                JCoreWireCodec.VER_REGISTER,
-                101L,
-                seed,
-                0L,
-                regBody
-            );
-            out.write(regFrame);
-            out.flush();
-
-            JCoreWireCodec.DecodedFrame regRespFrame = JCoreWireCodec.readFrameFromStream(in, 0L);
-            assertNotNull(regRespFrame);
-            JCoreWireCodec.RegisterResponse regResp = JCoreWireCodec.parseRegisterResponse(regRespFrame);
-            assertNotNull(regResp);
-            assertEquals(0L, (long) regResp.statusCode);
-            assertTrue(regResp.uid > 0L);
-            assertTrue(regResp.registrationId != null && !regResp.registrationId.isEmpty());
-
-            byte[] loginBody = JCoreWireCodec.buildLoginPayload(
-                regResp.password,
-                DEMO_TEST_APP_KEY,
-                regResp.deviceId,
-                "CN"
-            );
-            byte[] loginFrame = JCoreWireCodec.encodeFrame(
-                JCoreWireCodec.CMD_LOGIN,
-                JCoreWireCodec.VER_LOGIN,
-                102L,
-                0,
-                regResp.uid,
-                loginBody
-            );
-            out.write(loginFrame);
-            out.flush();
-
-            JCoreWireCodec.DecodedFrame loginRespFrame = JCoreWireCodec.readFrameFromStream(in, regResp.uid);
-            assertNotNull(loginRespFrame);
-            JCoreWireCodec.LoginResponse loginResp = JCoreWireCodec.parseLoginResponse(loginRespFrame);
-            assertNotNull(loginResp);
-            assertEquals(0L, (long) loginResp.statusCode);
-            assertTrue(loginResp.sessionId != 0);
-        } catch (Throwable tcpUnavailable) {
-            // Ignore transient external network drop after UDP SIS succeeds.
-        } finally {
-            try {
-                tcp.close();
-            } catch (Throwable ignored) {
-            }
-        }
-    }
-
     @Test
     public void testEmptyRegistrationBeforeHandshakeMultiRuntimeEventsAndManifestExportedFalse() throws Exception {
         // 1. Fresh state before TCP Register (cmd=0) must return "" for getRegistrationID (no fake 1a0018970a...)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-jpush",
-  "version": "6.7.0-alpha.436",
+  "version": "6.7.0-alpha.444",
   "description": "Clean-room JPush and JCore React Native Nitro module for OneKey",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -94,7 +94,7 @@
     "typescript": "^5.9.2"
   },
   "peerDependencies": {
-    "@onekeyfe/react-native-native-logger": "6.7.0-alpha.436",
+    "@onekeyfe/react-native-native-logger": "6.7.0-alpha.444",
     "react": "*",
     "react-native": "*",
     "react-native-nitro-modules": "0.37.0"