react-native-audio-browser 0.1.1 → 0.2.0-next.10

package/android/src/main/java/com/audiobrowser/tls/CachingCertificateFetcher.kt

@@ -0,0 +1,265 @@
+package com.audiobrowser.tls
+
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.io.InputStream
+import java.net.InetSocketAddress
+import java.net.Socket
+import java.net.URL
+import java.security.cert.CertificateFactory
+import java.security.cert.X509Certificate
+import java.util.concurrent.ConcurrentHashMap
+import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLContext
+import javax.net.ssl.SSLSocketFactory
+import timber.log.Timber
+
+/**
+ * Fetches and caches issuer certificates from AIA "CA Issuers" URLs. Used by
+ * [AiaChasingTrustManager] to fill in intermediates a server failed to send.
+ *
+ * Runs on the TLS handshake thread, so it uses short timeouts and never throws — a failed or slow
+ * fetch resolves to an empty list (the handshake then fails exactly as it would have without AIA
+ * chasing). Only non-empty results are cached, so the (typically `http`) round-trip happens at most
+ * once per intermediate for the process lifetime while transient failures stay retryable.
+ *
+ * Responses are capped at [MAX_RESPONSE_BYTES]. The URL comes from a server-presented certificate,
+ * so the host, port and path are chosen by whoever we are failing to validate; the read timeout is
+ * per-read and would not stop a slow drip of unbounded length. A certificate is a few kilobytes and
+ * even a PKCS#7 bundle a few dozen, so the cap is far above anything legitimate.
+ *
+ * `http` fetches go over a raw [Socket] rather than `HttpURLConnection`. CA "CA Issuers" URLs are
+ * virtually always plain `http` (the CA/Browser Forum Baseline Requirements mandate it, to avoid a
+ * chicken-and-egg TLS dependency when fetching the cert needed to complete a TLS chain), but
+ * Android blocks cleartext `HttpURLConnection` traffic by default on apps targeting API 28+. A raw
+ * socket is not subject to `NetworkSecurityPolicy`, so the fetch succeeds regardless of the host
+ * app's cleartext setting — safely, because the fetched certificate is still cryptographically
+ * verified to be the real issuer before [AiaChasingTrustManager] trusts it.
+ */
+class CachingCertificateFetcher(
+  private val connectTimeoutMs: Int = 5_000,
+  private val readTimeoutMs: Int = 5_000,
+) {
+  private val cache = ConcurrentHashMap<String, List<X509Certificate>>()
+
+  /**
+   * A plain system-default socket factory for `https` AIA fetches. Without it the fetch would use
+   * the process default — which, once this library's AIA factory is installed there, would recurse
+   * into AIA chasing during the fetch's own handshake.
+   */
+  private val plainSslSocketFactory: SSLSocketFactory by lazy {
+    SSLContext.getInstance("TLS").apply { init(null, null, null) }.socketFactory
+  }
+
+  fun fetch(url: String): List<X509Certificate> {
+    cache[url]?.let {
+      return it
+    }
+    val certs = download(url)?.let { parseCertificates(it) }.orEmpty()
+    if (certs.isNotEmpty()) cache[url] = certs
+    return certs
+  }
+
+  private fun download(url: String, redirectsLeft: Int = MAX_REDIRECTS): ByteArray? =
+    try {
+      require(isSafeUrl(url)) { "AIA URL contains characters that are not valid in a URL" }
+      val parsed = URL(url)
+      when (parsed.protocol) {
+        "http" -> downloadCleartext(parsed, redirectsLeft)
+        "https" -> downloadHttps(parsed)
+        else -> null // restrict to http/https — file:, ftp: etc. are never valid CA-issuer sources
+      }
+    } catch (e: Exception) {
+      Timber.w(e, "AIA CA-issuer fetch failed: %s", url)
+      null
+    }
+
+  /**
+   * `https` AIA fetch over the platform HTTP stack. `https` is never subject to Android's cleartext
+   * policy, so `HttpsURLConnection` is fine here; the plain socket factory keeps the fetch's own
+   * handshake from recursing into AIA chasing.
+   */
+  private fun downloadHttps(url: URL): ByteArray? {
+    val connection = url.openConnection() as? HttpsURLConnection ?: return null
+    connection.connectTimeout = connectTimeoutMs
+    connection.readTimeout = readTimeoutMs
+    connection.sslSocketFactory = plainSslSocketFactory
+    return connection.inputStream.use { readCapped(it) }
+  }
+
+  /**
+   * `http` AIA fetch over a raw socket — see the class doc for why this bypasses
+   * `HttpURLConnection`.
+   */
+  private fun downloadCleartext(url: URL, redirectsLeft: Int): ByteArray? {
+    val host = url.host
+    val port = if (url.port != -1) url.port else 80
+    val path = url.file.ifEmpty { "/" } // URL.file is path + query
+    val raw =
+      Socket().use { socket ->
+        socket.connect(InetSocketAddress(host, port), connectTimeoutMs)
+        socket.soTimeout = readTimeoutMs
+        // HTTP/1.0 + `Connection: close` so the server closes after the body and we can read to EOF
+        // without parsing Content-Length.
+        val request =
+          "GET $path HTTP/1.0\r\n" +
+            "Host: $host\r\n" +
+            "Connection: close\r\n" +
+            "User-Agent: react-native-audio-browser\r\n" +
+            "Accept: */*\r\n\r\n"
+        socket.getOutputStream().apply {
+          write(request.toByteArray(Charsets.ISO_8859_1))
+          flush()
+        }
+        socket.getInputStream().use { readCapped(it) }
+      } ?: return null
+    val response = parseHttpResponse(raw) ?: return null
+    return when {
+      response.status in 200..299 -> response.body
+      response.status in 300..399 && response.location != null && redirectsLeft > 0 ->
+        // Follow CA-issuer redirects (rare). A redirect to `https` falls through to the https path.
+        download(URL(url, response.location).toString(), redirectsLeft - 1)
+      else -> null
+    }
+  }
+
+  companion object {
+    private const val MAX_REDIRECTS = 5
+
+    /**
+     * Whether [url] is free of characters that have no business in a URL.
+     *
+     * The cleartext fetch writes the path into a request line on a raw socket, and the URL is an
+     * IA5String copied verbatim out of a certificate a hostile server presented. `java.net.URL`
+     * preserves control characters — `URL("http://host:6379/\r\nSET foo bar")` parses to that host
+     * and port with the CRLF intact in `file` — so without this check a certificate could inject
+     * request lines of its own, to any host and port the device can reach. Space is excluded too:
+     * it would split the request line's target from its HTTP version.
+     */
+    fun isSafeUrl(url: String): Boolean = url.none { it.code <= 0x20 || it.code == 0x7F }
+
+    /** Ceiling on a single AIA response body. */
+    const val MAX_RESPONSE_BYTES = 1 shl 20 // 1 MiB
+
+    /** Ceiling on the wall-clock time spent reading one AIA response. */
+    const val MAX_RESPONSE_MILLIS = 10_000L
+
+    /**
+     * Reads [input] to EOF, or returns null once it exceeds [limit] bytes or [budgetMs] of
+     * wall-clock time. Null rather than a truncated buffer: a cut-off certificate is not parseable
+     * anyway, and "too big" or "too slow" is a failed fetch, which the caller already knows how to
+     * treat as "no AIA".
+     *
+     * The byte cap alone would not bound the time. The socket's timeout is per-read, so a server
+     * returning one byte just inside it resets the clock on every iteration and holds the handshake
+     * thread for as long as it likes — a slow-drip stall in place of the unbounded buffer. Both
+     * limits are needed, and the deadline is checked against [nowNanos] (injectable so a test need
+     * not actually wait).
+     */
+    fun readCapped(
+      input: InputStream,
+      limit: Int = MAX_RESPONSE_BYTES,
+      budgetMs: Long = MAX_RESPONSE_MILLIS,
+      nowNanos: () -> Long = System::nanoTime,
+    ): ByteArray? {
+      val deadline = nowNanos() + budgetMs * 1_000_000
+      val out = ByteArrayOutputStream()
+      val chunk = ByteArray(8 * 1024)
+      while (true) {
+        val read = input.read(chunk)
+        if (read < 0) return out.toByteArray()
+        if (out.size() + read > limit) return null
+        out.write(chunk, 0, read)
+        // Subtraction, not `>`: overflow-safe across nanoTime's arbitrary origin.
+        if (nowNanos() - deadline >= 0) return null
+      }
+    }
+
+    /**
+     * Parses every certificate from the bytes a CA-Issuers URL serves — a single DER certificate
+     * (e.g. Let's Encrypt), a PEM file, or a PKCS#7 "certs-only" bundle. Empty if the bytes are not
+     * parseable certificates.
+     */
+    fun parseCertificates(bytes: ByteArray): List<X509Certificate> =
+      try {
+        CertificateFactory.getInstance("X.509")
+          .generateCertificates(ByteArrayInputStream(bytes))
+          .filterIsInstance<X509Certificate>()
+      } catch (e: Exception) {
+        emptyList()
+      }
+
+    /** Status code, `Location` header (if any), and decoded body of a raw HTTP response. */
+    data class HttpResponse(val status: Int, val location: String?, val body: ByteArray)
+
+    /**
+     * Splits a raw HTTP/1.0 response into its status code, `Location` header, and body, decoding a
+     * `Transfer-Encoding: chunked` body if present. Returns null if the bytes are not a
+     * recognisable HTTP response.
+     */
+    fun parseHttpResponse(raw: ByteArray): HttpResponse? {
+      val headerEnd = indexOfCrlfCrlf(raw)
+      if (headerEnd < 0) return null
+      val lines = String(raw, 0, headerEnd, Charsets.ISO_8859_1).split("\r\n")
+      // Status line: "HTTP/1.1 200 OK" — the code is the second token.
+      val status = lines.firstOrNull()?.split(' ')?.getOrNull(1)?.toIntOrNull() ?: return null
+      var location: String? = null
+      var chunked = false
+      for (i in 1 until lines.size) {
+        val colon = lines[i].indexOf(':')
+        if (colon < 0) continue
+        val name = lines[i].substring(0, colon).trim().lowercase()
+        val value = lines[i].substring(colon + 1).trim()
+        when (name) {
+          "location" -> location = value
+          "transfer-encoding" -> if (value.lowercase().contains("chunked")) chunked = true
+        }
+      }
+      val body = raw.copyOfRange(headerEnd + 4, raw.size)
+      return HttpResponse(status, location, if (chunked) dechunk(body) else body)
+    }
+
+    private fun dechunk(body: ByteArray): ByteArray {
+      val out = ByteArrayOutputStream()
+      var pos = 0
+      while (pos < body.size) {
+        val eol = indexOfCrlf(body, pos)
+        if (eol < 0) break
+        // chunk-size line may carry a `;chunk-extension` suffix; the size is hex before the `;`.
+        val size =
+          String(body, pos, eol - pos, Charsets.ISO_8859_1)
+            .substringBefore(';')
+            .trim()
+            .toIntOrNull(16) ?: break
+        if (size == 0) break // last chunk
+        val dataStart = eol + 2
+        if (dataStart + size > body.size) break
+        out.write(body, dataStart, size)
+        pos = dataStart + size + 2 // skip the chunk data and its trailing CRLF
+      }
+      return out.toByteArray()
+    }
+
+    private fun indexOfCrlfCrlf(bytes: ByteArray): Int {
+      var i = 0
+      while (i + 3 < bytes.size) {
+        if (bytes[i] == CR && bytes[i + 1] == LF && bytes[i + 2] == CR && bytes[i + 3] == LF)
+          return i
+        i++
+      }
+      return -1
+    }
+
+    private fun indexOfCrlf(bytes: ByteArray, from: Int): Int {
+      var i = from
+      while (i + 1 < bytes.size) {
+        if (bytes[i] == CR && bytes[i + 1] == LF) return i
+        i++
+      }
+      return -1
+    }
+
+    private const val CR = '\r'.code.toByte()
+    private const val LF = '\n'.code.toByte()
+  }
+}

package/android/src/main/java/com/audiobrowser/util/ArtworkContentProvider.kt

@@ -0,0 +1,161 @@
+package com.audiobrowser.util
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.database.Cursor
+import android.graphics.Bitmap
+import android.net.Uri
+import android.os.ParcelFileDescriptor
+import com.audiobrowser.browser.ResolvedArtwork
+import java.io.File
+import java.io.IOException
+import java.util.concurrent.Semaphore
+import java.util.concurrent.TimeUnit
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import timber.log.Timber
+
+/**
+ * Exported, token-gated provider serving browse artwork to Android Auto / AAOS (which run in a
+ * different uid and cannot read a non-exported provider; Media3 issues no URI grant — verified). It
+ * NEVER fetches a caller-supplied URL: the content URI carries an opaque token, looked up in
+ * [com.audiobrowser.browser.BrowseArtworkRegistry]; an unknown token returns null. So it cannot be
+ * used as a fetch proxy / SSRF vector. http(s)-only on the registered finalUrl is defense-in-depth.
+ *
+ * Serve design: a real on-disk file via [ParcelFileDescriptor.open] — seekable, no pipe, no writer
+ * coroutine. The file is keyed by SHA-256 token so identical URLs always reuse the same file.
+ *
+ * Bug fixes over the previous pipe/coroutine design: B (FD leak): eliminated — no coroutine
+ * launched from deps.scope; no writer that could fail to close the write-end of a pipe when the
+ * scope is already cancelled. C (wedge DoS): eliminated — the Semaphore permit is released in a
+ * try/finally BEFORE the file is opened for the caller; no blocking write to a pipe while holding
+ * the permit. D (per-request re-encode): eliminated — on-disk file IS the cache; re-requests are a
+ * cheap file open (fast path, zero decode, zero network). E (non-seekable pipe): eliminated —
+ * ParcelFileDescriptor.open returns a regular file FD; statSize is valid; the car's image loader
+ * can seek.
+ */
+class ArtworkContentProvider : ContentProvider() {
+
+  // java.util.concurrent.Semaphore — works on binder threads without a coroutine scope.
+  private val gate = Semaphore(MAX_CONCURRENT)
+
+  override fun onCreate(): Boolean = true
+
+  override fun getType(uri: Uri): String = "image/png"
+
+  override fun openFile(uri: Uri, mode: String): ParcelFileDescriptor? {
+    val token = ArtworkUris.parseToken(uri) ?: return null
+    val deps = CoilArtworkLoaderHolder.get() ?: return null
+    val art: ResolvedArtwork = deps.registry.lookup(token) ?: return null
+    val scheme = Uri.parse(art.finalUrl).scheme?.lowercase()
+    if (scheme != "http" && scheme != "https") return null
+
+    val artworkDir = File(context!!.cacheDir, ARTWORK_SUBDIR)
+    val file = File(artworkDir, "$token.png")
+
+    // Fast path: file already cached on disk — no permit, no decode, no network.
+    if (file.exists() && file.length() > 0) {
+      return try {
+        ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY)
+      } catch (e: Throwable) {
+        Timber.w(e, "Artwork fast-path open failed for token=$token")
+        null
+      }
+    }
+
+    // Produce path (cache miss): bound concurrency, block on binder thread (UAMP pattern).
+    if (!gate.tryAcquire(1, GATE_TIMEOUT_SECONDS, TimeUnit.SECONDS)) {
+      Timber.w("Artwork gate timeout for token=$token — returning null")
+      return null
+    }
+    try {
+      // Re-check after acquiring — a concurrent producer may have written the file.
+      if (file.exists() && file.length() > 0) {
+        val fd =
+          try {
+            ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY)
+          } catch (e: Throwable) {
+            Timber.w(e, "Artwork cache file vanished before re-check open; producing")
+            null
+          }
+        if (fd != null) return fd
+        // else: file was pruned/deleted concurrently — fall through to produce
+      }
+
+      artworkDir.mkdirs()
+      val tmp = File.createTempFile(token, ".png.tmp", artworkDir)
+
+      val bitmap: Bitmap =
+        try {
+          runBlocking {
+            withTimeout(LOAD_TIMEOUT_MS) {
+              deps.loader.load(art.finalUrl, art.headers, deps.artworkSizeHint(), art.isSvg)
+            }
+          }
+        } catch (e: Throwable) {
+          Timber.w(e, "Artwork load failed for token=$token")
+          tmp.delete()
+          return null
+        }
+
+      try {
+        val ok =
+          tmp.outputStream().use { out -> bitmap.compress(Bitmap.CompressFormat.PNG, 100, out) }
+        if (!ok) throw IOException("PNG encode failed for token=$token")
+        if (!tmp.renameTo(file)) {
+          Timber.w("Artwork rename failed for token=$token")
+          tmp.delete()
+          return null
+        }
+        pruneCache(artworkDir)
+      } catch (e: Throwable) {
+        Timber.w(e, "Artwork write failed for token=$token")
+        tmp.delete()
+        return null
+      }
+
+      return try {
+        ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY)
+      } catch (e: Throwable) {
+        Timber.w(e, "Artwork final open failed for token=$token")
+        null
+      }
+    } finally {
+      gate.release()
+    }
+  }
+
+  override fun query(
+    uri: Uri,
+    p: Array<String>?,
+    s: String?,
+    a: Array<String>?,
+    o: String?,
+  ): Cursor? = null
+
+  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+  override fun update(uri: Uri, v: ContentValues?, s: String?, a: Array<String>?): Int = 0
+
+  override fun delete(uri: Uri, s: String?, a: Array<String>?): Int = 0
+
+  companion object {
+    private const val MAX_CONCURRENT = 6
+    private const val GATE_TIMEOUT_SECONDS = 5L
+    private const val LOAD_TIMEOUT_MS = 8_000L
+    internal const val ARTWORK_SUBDIR = "audiobrowser-artwork"
+    const val MAX_CACHE_FILES = 512
+    /** Overridable in tests only. Production code must not change this. */
+    @JvmField internal var maxCacheFilesOverride: Int? = null
+  }
+
+  private fun pruneCache(dir: File) {
+    val limit = maxCacheFilesOverride ?: MAX_CACHE_FILES
+    val files = dir.listFiles { f -> f.isFile && f.name.endsWith(".png") } ?: return
+    if (files.size <= limit) return
+    files
+      .sortedBy { it.lastModified() }
+      .take(files.size - limit)
+      .forEach { runCatching { it.delete() } }
+  }
+}

package/android/src/main/java/com/audiobrowser/util/ArtworkUris.kt

@@ -0,0 +1,28 @@
+package com.audiobrowser.util
+
+import android.net.Uri
+import java.security.MessageDigest
+
+/** Builds and parses the opaque `content://<pkg>.audiobrowser.artwork/art/<token>` URIs. */
+object ArtworkUris {
+  const val AUTHORITY_SUFFIX = "audiobrowser.artwork"
+  private const val PATH = "art"
+
+  fun authorityFor(packageName: String): String = "$packageName.$AUTHORITY_SUFFIX"
+
+  /** Stable, opaque token for a resolved artwork URL (SHA-256 hex). */
+  fun tokenFor(url: String): String {
+    val digest = MessageDigest.getInstance("SHA-256").digest(url.toByteArray(Charsets.UTF_8))
+    return digest.joinToString("") { "%02x".format(it) }
+  }
+
+  fun contentUri(authority: String, token: String): String = "content://$authority/$PATH/$token"
+
+  /** The `<token>` for a `…/art/<token>` content URI, or null if the shape is wrong. */
+  fun parseToken(uri: Uri): String? {
+    if (uri.scheme != "content") return null
+    val segments = uri.pathSegments
+    if (segments.size != 2 || segments[0] != PATH) return null
+    return segments[1].takeIf { it.isNotEmpty() }
+  }
+}

package/android/src/main/java/com/audiobrowser/util/ArtworkVariant.kt

@@ -0,0 +1,24 @@
+package com.audiobrowser.util
+
+import com.margelo.nitro.audiobrowser.Variant_String_ArtworkVariants
+
+/**
+ * Reading `Track.artwork`, which is either one URL or a URL per appearance.
+ *
+ * Android Auto is dark-only, so there is nothing here to choose: a pair always resolves to its dark
+ * URL, which is also what a single-URL track would have shipped. The per-appearance half of the
+ * feature is iOS/CarPlay only — see `ios/Extension/Variant+Artwork.swift`, where both URLs are kept
+ * so a `UIImageAsset` can swap them without a re-fetch.
+ */
+val Variant_String_ArtworkVariants.url: String
+  get() = match(first = { it }, second = { it.dark })
+
+/**
+ * Wraps a plain URL as the single-URL side of the union.
+ *
+ * For the places that build a `Track` from something that only ever has one image — restored
+ * persistence, a `MediaMetadata` handed back by the platform. Restoring collapses a pair to its
+ * dark URL, which costs nothing here: Android Auto would have rendered that one anyway.
+ */
+fun artworkOf(url: String?): Variant_String_ArtworkVariants? =
+  url?.let { Variant_String_ArtworkVariants.First(it) }

package/android/src/main/java/com/audiobrowser/util/BrowserPathHelper.kt

@@ -32,6 +32,12 @@ object BrowserPathHelper {
   /** Offline error placeholder media ID */
   const val OFFLINE_PATH = "/__offline"
 
+  /** Generic browse error placeholder media ID */
+  const val ERROR_PATH = "/__error"
+
+  /** Browse Gate placeholder media ID (subscription/login/region block) */
+  const val GATE_PATH = "/__gate"
+
   // Query parameter name for contextual track identifiers
   private const val CONTEXTUAL_TRACK_PARAM = "__trackId"
 
@@ -152,4 +158,22 @@ object BrowserPathHelper {
     val normalizedPath = path.trimStart('/')
     return "$normalizedBase$normalizedPath"
   }
+
+  /**
+   * True if [segment] appears in [path] as a complete path segment — bounded on the left by the
+   * string start or `/`, and on the right by the string end or one of `/`, `?`, `#`.
+   */
+  fun containsSegment(path: String, segment: String): Boolean {
+    if (segment.isEmpty()) return false
+    var from = 0
+    while (true) {
+      val idx = path.indexOf(segment, from)
+      if (idx < 0) return false
+      val beforeOk = idx == 0 || path[idx - 1] == '/'
+      val end = idx + segment.length
+      val afterOk = end == path.length || path[end] == '/' || path[end] == '?' || path[end] == '#'
+      if (beforeOk && afterOk) return true
+      from = idx + 1
+    }
+  }
 }

package/android/src/main/java/com/audiobrowser/util/CoilArtworkLoader.kt

@@ -0,0 +1,49 @@
+package com.audiobrowser.util
+
+import android.content.Context
+import android.graphics.Bitmap
+import coil3.ImageLoader
+import coil3.network.NetworkHeaders
+import coil3.network.httpHeaders
+import coil3.request.ImageRequest
+import coil3.request.allowHardware
+import coil3.svg.SvgDecoder
+import coil3.toBitmap
+
+/**
+ * Shared "resolved source → Bitmap" core. Used by both [CoilBitmapLoader] (now-playing) and
+ * [ArtworkContentProvider] (browse). Adds `.size()` so raster decodes are downsampled to the hint
+ * (the prior loadBitmap path decoded at full resolution). SVG is forced via [isSvg], carried from
+ * build time rather than re-derived from a possibly-suffixless transformed URL.
+ */
+class CoilArtworkLoader(
+  private val context: Context,
+  private val imageLoader: ImageLoader,
+  private val defaultSizePixels: Int = 512,
+) {
+  suspend fun load(
+    finalUrl: String,
+    headers: Map<String, String>?,
+    sizeHintPixels: Int?,
+    isSvg: Boolean,
+  ): Bitmap {
+    val builder =
+      ImageRequest.Builder(context)
+        .data(finalUrl)
+        .size(sizeHintPixels ?: defaultSizePixels)
+        .allowHardware(false) // required for Media3 notification compatibility
+
+    if (!headers.isNullOrEmpty()) {
+      val net = NetworkHeaders.Builder()
+      headers.forEach { (k, v) -> net.add(k, v) }
+      builder.httpHeaders(net.build())
+    }
+    if (isSvg) {
+      builder.decoderFactory { result, options, _ -> SvgDecoder(result.source, options) }
+    }
+
+    val result = imageLoader.execute(builder.build())
+    return result.image?.toBitmap()
+      ?: throw IllegalStateException("Failed to decode artwork from $finalUrl")
+  }
+}

package/android/src/main/java/com/audiobrowser/util/CoilArtworkLoaderHolder.kt

@@ -0,0 +1,36 @@
+package com.audiobrowser.util
+
+import com.audiobrowser.browser.BrowseArtworkRegistry
+import kotlinx.coroutines.CoroutineScope
+
+/** Dependencies the exported [ArtworkContentProvider] needs, published by the media Service. */
+data class ArtworkProviderDeps(
+  val loader: CoilArtworkLoader,
+  val registry: BrowseArtworkRegistry,
+  val scope: CoroutineScope,
+  val artworkSizeHint: () -> Int? = { null },
+)
+
+/**
+ * Process-wide handoff between the media Service (which builds the deps) and the ContentProvider
+ * (which the OS may instantiate before the Service exists). `@Volatile` publishes the reference
+ * safely across the binder/main threads.
+ */
+object CoilArtworkLoaderHolder {
+  @Volatile private var deps: ArtworkProviderDeps? = null
+
+  fun set(deps: ArtworkProviderDeps) {
+    this.deps = deps
+  }
+
+  fun get(): ArtworkProviderDeps? = deps
+
+  /**
+   * Clears only if [deps] is still the current one — prevents a stale Service from blanking a
+   * newer.
+   */
+  @Synchronized
+  fun clearIf(deps: ArtworkProviderDeps) {
+    if (this.deps === deps) this.deps = null
+  }
+}