catalyst-core 0.1.0-canary.4 → 0.1.0-canary.5

package/dist/native/androidProject/app/build.gradle.kts

@@ -15,6 +15,18 @@ val keystorePassword: String? by project.properties  // Changed from keyStorePas
 val keyAlias: String? by project.properties
 val keyPassword: String? by project.properties
 
+fun isAllowBackupEnabled(): Boolean {
+    return try {
+        val propsFile = File("${project.projectDir}/src/main/assets/webview_config.properties")
+        if (!propsFile.exists()) return false
+        val props = Properties()
+        props.load(propsFile.inputStream())
+        props.getProperty("android.security.allowBackup", "false").trim().lowercase() == "true"
+    } catch (e: Exception) {
+        false
+    }
+}
+
 fun isNotificationsEnabled(): Boolean {
     return try {
         if (configPath == null) return false
@@ -56,6 +68,7 @@ android {
         versionName = "1.1"
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         buildConfigField("String", "LOCAL_IP", "\"${getLocalIpAddress()}\"")
+        manifestPlaceholders["allowBackup"] = isAllowBackupEnabled()
     }
 
     // Add signing configuration for app bundle
@@ -148,6 +161,13 @@ android {
         abortOnError = true
     }
 
+    // Configure test options for unit tests
+    testOptions {
+        unitTests {
+            isReturnDefaultValues = true
+        }
+    }
+
     // Conditional source sets based on notifications config
     sourceSets {
         getByName("main") {

package/dist/native/androidProject/app/src/main/AndroidManifest.xml

@@ -12,7 +12,7 @@
         </intent>
     </queries>
     <application
-        android:allowBackup="true"
+        android:allowBackup="${allowBackup}"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
         android:hardwareAccelerated="true"

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/CatalystConstants.kt

@@ -70,7 +70,10 @@ object CatalystConstants {
             "logger",
             "pickFile",
             "openFileWithIntent",
-            "requestHapticFeedback"
+            "requestHapticFeedback",
+            "setScreenSecure",
+            "getScreenSecure",
+            "clearWebData"
         )
     }
 

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/CustomWebview.kt

@@ -15,8 +15,7 @@ import androidx.webkit.WebResourceRequestCompat
 import android.widget.ProgressBar
 import androidx.webkit.WebViewAssetLoader
 import io.yourname.androidproject.WebCacheManager
-import io.yourname.androidproject.isUrlAllowed
-import io.yourname.androidproject.isExternalDomain
+import io.yourname.androidproject.URLWhitelistManager
 import io.yourname.androidproject.matchesCachePattern
 import io.yourname.androidproject.utils.CameraUtils
 import io.yourname.androidproject.utils.NetworkUtils
@@ -100,6 +99,9 @@ class CustomWebView(
             .getProperty("accessControl.enabled", "true")
             .equals("true", ignoreCase = true)
 
+        // Initialize URLWhitelistManager with access control configuration
+        URLWhitelistManager.initialize(accessControlEnabled, allowedUrls)
+
         // Set initial flags based on buildOptimisation
         if (buildOptimisation) {
             isInitialApiCalled = false
@@ -187,6 +189,10 @@ class CustomWebView(
         webView.clearHistory()
     }
 
+    fun clearAllCache() {
+        cacheManager.clearAll()
+    }
+
     fun canGoBack(): Boolean = webView.canGoBack()
 
     fun goBack() {
@@ -480,7 +486,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is allowed
-                    if (accessControlEnabled && !isUrlAllowed(url, allowedUrls)) {
+                    if (!URLWhitelistManager.isUrlAllowed(url)) {
                         if (BuildConfig.DEBUG) {
                             Log.w(TAG, "🙫 SERVICE_WORKER: Request blocked by access control: $url")
                         }
@@ -624,7 +630,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is an external domain
-                    if (url.scheme in listOf("http", "https") && isExternalDomain(urlString, allowedUrls)) {
+                    if (url.scheme in listOf("http", "https") && URLWhitelistManager.isExternalDomain(urlString)) {
                         if (BuildConfig.DEBUG) {
                             Log.d(TAG, "🌍 External domain detected, opening in in-app browser: $urlString")
                         }
@@ -633,7 +639,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is allowed for internal navigation
-                    if (accessControlEnabled && !isUrlAllowed(urlString, allowedUrls)) {
+                    if (!URLWhitelistManager.isUrlAllowed(urlString)) {
                         if (BuildConfig.DEBUG) {
                             Log.w(TAG, "🚫 URL blocked by access control: $urlString")
                         }
@@ -666,21 +672,18 @@ class CustomWebView(
                     Log.d(TAG, "🔄 INTERCEPT: isInitialPageLoaded: $isInitialPageLoaded")
                 }
 
-                if (accessControlEnabled) {
-                    if (!isUrlAllowed(url, allowedUrls)) {
-                        if (BuildConfig.DEBUG) {
-                            Log.w(TAG, "🚫 STEP_1_FAIL: Network request blocked by access control: $url")
-                            Log.w(TAG, "🚫 STEP_1_FAIL: Allowed URLs: $allowedUrls")
-                        }
-                        // Return an empty response to block the request
-                        return WebResourceResponse("text/plain", "utf-8", null)
-                    } else {
-                        if (BuildConfig.DEBUG) {
-                            Log.d(TAG, "✅ STEP_1_PASS: URL allowed by access control: $url")
-                        }
+                if (!URLWhitelistManager.isUrlAllowed(url)) {
+                    if (BuildConfig.DEBUG) {
+                        Log.w(TAG, "🚫 STEP_1_FAIL: Network request blocked by access control: $url")
                     }
+                    // Return an empty response to block the request
+                    return WebResourceResponse("text/plain", "utf-8", null)
                 } else if (BuildConfig.DEBUG) {
-                    Log.d(TAG, "⚙️ STEP_1_SKIP: Access control disabled, allowing URL: $url")
+                    if (URLWhitelistManager.isAccessControlEnabled()) {
+                        Log.d(TAG, "✅ STEP_1_PASS: URL allowed by access control: $url")
+                    } else {
+                        Log.d(TAG, "⚙️ STEP_1_SKIP: Access control disabled, allowing URL: $url")
+                    }
                 }
 
                 // TODO: Add HTML file workflow - index.html not available yet

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/MainActivity.kt

@@ -141,6 +141,25 @@ class MainActivity : AppCompatActivity(), CoroutineScope by MainScope() {
     // Public method for NativeBridge to get current safe area insets
     fun getCurrentSafeAreaInsets(): SafeAreaInsets = latestSafeAreaInsets
 
+    fun clearWebCache() {
+        customWebView.clearAllCache()
+    }
+
+    fun setScreenSecure(enable: Boolean) {
+        if (enable) {
+            window.setFlags(
+                WindowManager.LayoutParams.FLAG_SECURE,
+                WindowManager.LayoutParams.FLAG_SECURE
+            )
+        } else {
+            window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        }
+    }
+
+    fun isScreenSecure(): Boolean {
+        return (window.attributes.flags and WindowManager.LayoutParams.FLAG_SECURE) != 0
+    }
+
     /**
      * Notify WebView when safe area insets are updated
      * Called when deferred inset calculation completes

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/NativeBridge.kt

@@ -1029,6 +1029,110 @@ class NativeBridge(
         }
     }
 
+    @JavascriptInterface
+    fun setScreenSecure(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                val enable = try {
+                    org.json.JSONObject(params ?: "{}").optBoolean("enable", true)
+                } catch (e: Exception) {
+                    true
+                }
+                mainActivity.setScreenSecure(enable)
+                BridgeUtils.notifyWeb(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_SET,
+                    """{"secure": $enable, "success": true}"""
+                )
+            } catch (e: Exception) {
+                // Use notifyWebJson to prevent JSON injection from e.message
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "setScreenSecure failed")
+                    }
+                )
+            }
+        }
+    }
+
+    @JavascriptInterface
+    fun getScreenSecure(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                val isSecure = mainActivity.isScreenSecure()
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_STATUS,
+                    org.json.JSONObject().apply {
+                        put("secure", isSecure)
+                        put("success", true)
+                    }
+                )
+            } catch (e: Exception) {
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "getScreenSecure failed")
+                    }
+                )
+            }
+        }
+    }
+
+    @JavascriptInterface
+    fun clearWebData(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                webView.clearCache(true)
+                webView.clearHistory()
+                android.webkit.WebStorage.getInstance().deleteAllData()
+                mainActivity.clearWebCache()
+                // CookieManager.removeAllCookies is async — fire success only from its callback
+                android.webkit.CookieManager.getInstance().removeAllCookies { cookiesRemoved ->
+                    android.webkit.CookieManager.getInstance().flush()
+                    mainActivity.runOnUiThread {
+                        try {
+                            // Use notifyWebJson to prevent JSON injection; cookiesRemoved is a
+                            // Boolean so string interpolation is safe, but keep consistent pattern
+                            BridgeUtils.notifyWebJson(
+                                webView,
+                                BridgeUtils.WebEvents.ON_WEB_DATA_CLEARED,
+                                org.json.JSONObject().apply {
+                                    put("success", true)
+                                    put("cookiesRemoved", cookiesRemoved)
+                                }
+                            )
+                        } catch (e: Exception) {
+                            BridgeUtils.notifyWebJson(
+                                webView,
+                                BridgeUtils.WebEvents.ON_WEB_DATA_CLEAR_ERROR,
+                                org.json.JSONObject().apply {
+                                    put("success", false)
+                                    put("error", e.message ?: "clearWebData cookie flush failed")
+                                }
+                            )
+                        }
+                    }
+                }
+            } catch (e: Exception) {
+                // Use notifyWebJson to prevent JSON injection from e.message
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_WEB_DATA_CLEAR_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "clearWebData failed")
+                    }
+                )
+            }
+        }
+    }
+
     @JavascriptInterface
     fun getSafeArea(data: String? = null) {
         BridgeUtils.safeExecute(webView, BridgeUtils.WebEvents.ON_SAFE_AREA_INSETS_UPDATED, "get safe area") {

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/URLWhitelistManager.kt

@@ -0,0 +1,231 @@
+package io.yourname.androidproject
+
+import android.util.Log
+
+/**
+ * Manager for URL whitelisting and access control
+ * Provides centralized URL validation with pattern matching support
+ *
+ * Pattern matching rules:
+ * - *text* or text (no wildcard) -> checks if URL contains "text"
+ * - text* -> checks if URL starts with "text"
+ * - *text -> checks if URL ends with "text"
+ *
+ * URL processing:
+ * - Query parameters and hash fragments are stripped before matching
+ * - Matching is case-insensitive
+ * - Ports are kept as-is (user must include port in pattern if URL has explicit port)
+ */
+object URLWhitelistManager {
+
+    private const val TAG = "URLWhitelistManager"
+
+    /**
+     * Data class to hold categorized URL patterns for efficient matching
+     */
+    private data class CategorizedPatterns(
+        val contains: List<String>,
+        val prefix: List<String>,
+        val suffix: List<String>
+    )
+
+    @Volatile
+    private var accessControlEnabled: Boolean = false
+
+    @Volatile
+    private var patterns: CategorizedPatterns? = null
+
+    /**
+     * Initialize the whitelist manager with configuration
+     * Should be called once during app initialization
+     */
+    @Synchronized
+    fun initialize(enabled: Boolean, allowedUrls: List<String>) {
+        this.accessControlEnabled = enabled
+        this.patterns = categorizePatterns(allowedUrls)
+
+        try {
+            if (BuildConfig.DEBUG) {
+                Log.d(TAG, "URLWhitelistManager initialized")
+                Log.d(TAG, "Access Control Enabled: $enabled")
+                Log.d(TAG, "Allowed URLs: $allowedUrls")
+                patterns?.let {
+                    Log.d(TAG, "Categorized - Contains: ${it.contains}")
+                    Log.d(TAG, "Categorized - Prefix: ${it.prefix}")
+                    Log.d(TAG, "Categorized - Suffix: ${it.suffix}")
+                }
+            }
+        } catch (e: RuntimeException) {
+            // Log not available in unit tests - silently ignore
+        }
+    }
+
+    /**
+     * Check if access control is enabled
+     */
+    fun isAccessControlEnabled(): Boolean {
+        return accessControlEnabled
+    }
+
+    /**
+     * Check if a URL is allowed according to the whitelist patterns
+     * If access control is disabled, all URLs are allowed
+     */
+    fun isUrlAllowed(url: String): Boolean {
+        // If access control is disabled, allow everything
+        if (!accessControlEnabled) {
+            return true
+        }
+
+        // Always allow framework server URLs (localhost with /framework- pattern)
+        // These are internal infrastructure URLs used for large file handling
+        val frameworkUrlPattern = Regex("^https?://(?:localhost|127\\.0\\.0\\.1)(?::\\d+)?/framework-[a-zA-Z0-9_-]+", RegexOption.IGNORE_CASE)
+        if (frameworkUrlPattern.containsMatchIn(url)) {
+            return true
+        }
+
+        val patterns = this.patterns ?: return false
+
+        // If all pattern lists are empty, block everything
+        if (patterns.contains.isEmpty() && patterns.prefix.isEmpty() && patterns.suffix.isEmpty()) {
+            return false
+        }
+
+        val cleanUrl = cleanUrl(url)
+
+        // Check contains patterns
+        if (patterns.contains.any { cleanUrl.contains(it) }) {
+            try {
+                if (BuildConfig.DEBUG) {
+                    Log.d(TAG, "✅ URL allowed (contains match): $url")
+                }
+            } catch (e: RuntimeException) { /* Ignore in tests */ }
+            return true
+        }
+
+        // Check prefix patterns
+        if (patterns.prefix.any { cleanUrl.startsWith(it) }) {
+            try {
+                if (BuildConfig.DEBUG) {
+                    Log.d(TAG, "✅ URL allowed (prefix match): $url")
+                }
+            } catch (e: RuntimeException) { /* Ignore in tests */ }
+            return true
+        }
+
+        // Check suffix patterns
+        if (patterns.suffix.any { cleanUrl.endsWith(it) }) {
+            try {
+                if (BuildConfig.DEBUG) {
+                    Log.d(TAG, "✅ URL allowed (suffix match): $url")
+                }
+            } catch (e: RuntimeException) { /* Ignore in tests */ }
+            return true
+        }
+
+        try {
+            if (BuildConfig.DEBUG) {
+                Log.w(TAG, "🚫 URL blocked by access control: $url")
+                Log.w(TAG, "🚫 Clean URL: $cleanUrl")
+            }
+        } catch (e: RuntimeException) { /* Ignore in tests */ }
+
+        return false
+    }
+
+    /**
+     * Check if a URL is from an external domain (not in whitelist)
+     * If access control is disabled, nothing is considered external
+     */
+    fun isExternalDomain(url: String): Boolean {
+        // If access control is disabled, nothing is external
+        if (!accessControlEnabled) {
+            return false
+        }
+
+        // Simply the inverse of isUrlAllowed
+        return !isUrlAllowed(url)
+    }
+
+    /**
+     * Clean URL by removing query parameters and hash, then lowercase for case-insensitive matching
+     * Also decodes URL-encoded characters to prevent bypass attempts
+     */
+    private fun cleanUrl(url: String): String {
+        // Decode URL-encoded characters first to prevent bypass (e.g., %3F for ?, %23 for #)
+        val decoded = try {
+            java.net.URLDecoder.decode(url, "UTF-8")
+        } catch (e: Exception) {
+            // If decode fails, use original URL
+            url
+        }
+
+        var cleanUrl = decoded
+
+        // Remove hash fragment (# and everything after)
+        val hashIndex = cleanUrl.indexOf('#')
+        if (hashIndex != -1) {
+            cleanUrl = cleanUrl.substring(0, hashIndex)
+        }
+
+        // Remove query parameters (? and everything after)
+        val queryIndex = cleanUrl.indexOf('?')
+        if (queryIndex != -1) {
+            cleanUrl = cleanUrl.substring(0, queryIndex)
+        }
+
+        return cleanUrl.lowercase()
+    }
+
+    /**
+     * Categorize patterns into contains, prefix, and suffix for efficient matching
+     */
+    private fun categorizePatterns(allowedUrls: List<String>): CategorizedPatterns {
+        val contains = mutableListOf<String>()
+        val prefix = mutableListOf<String>()
+        val suffix = mutableListOf<String>()
+
+        allowedUrls.forEach { pattern ->
+            if (pattern.isEmpty()) return@forEach
+
+            val startsWithWildcard = pattern.startsWith('*')
+            val endsWithWildcard = pattern.endsWith('*')
+
+            when {
+                startsWithWildcard && endsWithWildcard -> {
+                    // *text* -> contains check
+                    if (pattern.length <= 2) return@forEach // Pattern is just * or ** - ignore
+                    val extracted = pattern.substring(1, pattern.length - 1).lowercase()
+                    if (extracted.isNotEmpty()) {
+                        contains.add(extracted)
+                    }
+                }
+                endsWithWildcard -> {
+                    // text* -> prefix check
+                    if (pattern.length <= 1) return@forEach // Pattern is just * - ignore
+                    val extracted = pattern.substring(0, pattern.length - 1).lowercase()
+                    if (extracted.isNotEmpty()) {
+                        prefix.add(extracted)
+                    }
+                }
+                startsWithWildcard -> {
+                    // *text -> suffix check
+                    if (pattern.length <= 1) return@forEach // Pattern is just * - ignore
+                    val extracted = pattern.substring(1).lowercase()
+                    if (extracted.isNotEmpty()) {
+                        suffix.add(extracted)
+                    }
+                }
+                else -> {
+                    // No wildcard -> treat as contains check
+                    val extracted = pattern.lowercase()
+                    if (extracted.isNotEmpty()) {
+                        contains.add(extracted)
+                    }
+                }
+            }
+        }
+
+        return CategorizedPatterns(contains, prefix, suffix)
+    }
+}

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/Utils.kt

@@ -2,43 +2,6 @@ package io.yourname.androidproject
 
 import android.net.Uri
 
-fun isUrlAllowed(url: String, allowedUrls: List<String>): Boolean {
-    // TODO: temp
-    return true
-    // Always allow framework server URLs (localhost with /framework- pattern)
-    // These are internal infrastructure URLs used for large file handling
-    // Use strict regex to prevent bypass attacks
-    val frameworkUrlPattern = Regex("^https?://(?:localhost|127\\.0\\.0\\.1)(?::\\d+)?/framework-[a-zA-Z0-9_-]+", RegexOption.IGNORE_CASE)
-    if (frameworkUrlPattern.containsMatchIn(url)) {
-        return true
-    }
-
-    if (allowedUrls.isEmpty()) return false
-
-    val parsedUrl = Uri.parse(url) ?: return false
-    val urlHost = "${parsedUrl.scheme}://${parsedUrl.host}${if (parsedUrl.port != -1) ":${parsedUrl.port}" else ""}"
-
-    return allowedUrls.any { pattern ->
-        when {
-            pattern.contains("*") -> {
-                val regex = pattern
-                    .replace(".", "\\.")
-                    .replace("*", ".*")
-                    .toRegex(RegexOption.IGNORE_CASE)
-                regex.matches(url) || regex.matches(urlHost)
-            }
-            else -> {
-                val patternUri = Uri.parse(pattern)
-                val patternHost = "${patternUri.scheme}://${patternUri.host}${if (patternUri.port != -1) ":${patternUri.port}" else ""}"
-                
-                // Exact match or pattern without port matches URL with any port
-                urlHost.equals(patternHost, ignoreCase = true) || 
-                (patternUri.port == -1 && urlHost.startsWith("${patternUri.scheme}://${patternUri.host}", ignoreCase = true))
-            }
-        }
-    }
-}
-
 /**
  * Checks if a URL matches any of the cache patterns
  * Handles query parameters, hashes, and version strings
@@ -92,38 +55,4 @@ fun matchesCachePattern(url: String, cachePatterns: List<String>): Boolean {
         // If parsing fails, return false
         return false
     }
-}
-
-fun isExternalDomain(url: String, allowedUrls: List<String>): Boolean {
-    if (allowedUrls.isEmpty()) return true
-
-    val parsedUrl = Uri.parse(url)
-    val urlHost = parsedUrl.host ?: return true
-    val urlScheme = parsedUrl.scheme ?: return true
-    val urlPort = parsedUrl.port
-
-    return !allowedUrls.any { pattern ->
-        if (pattern.startsWith("*.")) {
-            val domain = pattern.substring(2)
-            urlHost.equals(domain, ignoreCase = true) || urlHost.endsWith(".$domain", ignoreCase = true)
-        } else {
-            val patternUri = Uri.parse(pattern)
-            val patternHost = patternUri?.host ?: return@any false
-            val patternScheme = patternUri?.scheme ?: return@any false
-            val patternPort = patternUri?.port ?: -1
-
-            val schemeMatches = urlScheme.equals(patternScheme, ignoreCase = true)
-            val hostMatches = if (patternHost.startsWith("*.")) {
-                val domain = patternHost.substring(2)
-                urlHost.equals(domain, ignoreCase = true) || urlHost.endsWith(".$domain", ignoreCase = true)
-            } else {
-                urlHost.equals(patternHost, ignoreCase = true)
-            }
-            val portMatches = patternPort == -1 || urlPort == patternPort ||
-                (urlPort == -1 && ((patternPort == 443 && patternScheme.equals("https", ignoreCase = true)) ||
-                                  (patternPort == 80 && patternScheme.equals("http", ignoreCase = true))))
-
-            schemeMatches && hostMatches && portMatches
-        }
-    }
 }

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/WebCacheManager.kt

@@ -178,6 +178,18 @@ class WebCacheManager(private val context: Context, private val properties: java
             }
         }
 
+    fun clearAll() {
+        try {
+            memoryCache.evictAll()
+            cacheDir.listFiles()?.forEach { it.delete() }
+            if (BuildConfig.DEBUG) {
+                Log.d(TAG, "clearAll: memory cache and disk cache wiped")
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "clearAll failed: ${e.message}")
+        }
+    }
+
     suspend fun cleanup() {
         withContext(Dispatchers.IO) {
             try {

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/utils/BridgeUtils.kt

@@ -75,6 +75,13 @@ object BridgeUtils {
         NETWORK_STATUS_CHANGED("NETWORK_STATUS_CHANGED"),
         // Safe area events
         ON_SAFE_AREA_INSETS_UPDATED("ON_SAFE_AREA_INSETS_UPDATED"),
+
+        // Security events
+        ON_SCREEN_SECURE_SET("ON_SCREEN_SECURE_SET"),
+        ON_SCREEN_SECURE_STATUS("ON_SCREEN_SECURE_STATUS"),
+        ON_SCREEN_SECURE_ERROR("ON_SCREEN_SECURE_ERROR"),
+        ON_WEB_DATA_CLEARED("ON_WEB_DATA_CLEARED"),
+        ON_WEB_DATA_CLEAR_ERROR("ON_WEB_DATA_CLEAR_ERROR"),
     }
     
     /**

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/utils/DownloadUtils.kt

@@ -10,6 +10,7 @@ import java.io.IOException
 import java.net.URL
 import android.os.Handler
 import android.os.Looper
+import io.yourname.androidproject.URLWhitelistManager
 
 /**
  * Download utilities for native bridge operations  
@@ -80,13 +81,13 @@ object DownloadUtils {
             }
 
             // Whitelist validation for remote URLs
-            if (accessControlEnabled && allowedUrls.isNotEmpty() && !io.yourname.androidproject.isUrlAllowed(fileUrl, allowedUrls)) {
+            if (!URLWhitelistManager.isUrlAllowed(fileUrl)) {
                 val errorMessage = "Unable to process request. URL violates whitelisting protocols"
                 BridgeUtils.logError(TAG, "File URL blocked by access control: $fileUrl")
                 throw SecurityException(errorMessage)
-            } else if (accessControlEnabled && allowedUrls.isNotEmpty()) {
+            } else if (URLWhitelistManager.isAccessControlEnabled()) {
                 BridgeUtils.logDebug(TAG, "✅ File URL passed whitelist check: $fileUrl")
-            } else if (!accessControlEnabled) {
+            } else {
                 BridgeUtils.logDebug(TAG, "⚙️ Access control disabled; skipping whitelist checks for download")
             }