react-native-audio-browser 0.2.0-next.1 → 0.2.0-next.10

package/android/src/main/java/com/audiobrowser/player/Player.kt

@@ -168,13 +168,26 @@ class Player(internal val context: Context) {
         mediaSessionCallback.updateMediaSession(
           mediaSession,
           options.capabilities,
-          options.notificationButtons,
+          options.remoteButtonLayout,
           searchAvailable,
+          options.forwardJumpInterval,
+          options.backwardJumpInterval,
         )
       }
     }
   }
 
+  /**
+   * Drops a completed browser registration so [awaitBrowser] waits for the replacement instead of
+   * handing out the disposed browser. A [CompletableDeferred] completes once, so it would otherwise
+   * pin the first browser for the life of the process.
+   */
+  fun forgetBrowserRegistration() {
+    if (browserRegistered.isCompleted) {
+      browserRegistered = CompletableDeferred()
+    }
+  }
+
   /**
    * Suspends until the browser is registered, with a timeout.
    *
@@ -834,8 +847,8 @@ class Player(internal val context: Context) {
    * A restart from a terminal error begins a new load of the same track: fresh retry budgets and
    * unproven playback, so the user's tap yields a visible first-connect retry window instead of a
    * single silent attempt — the same behavior as re-selecting the track (ADR 0004). Hooked off the
-   * player error clearing: every recovery path (retry(), play(), the transport controls'
-   * idle-error recovery) goes through exoPlayer.prepare(), which clears the error.
+   * player error clearing: every recovery path (retry(), play(), the transport controls' idle-error
+   * recovery) goes through exoPlayer.prepare(), which clears the error.
    */
   internal fun resetForNewLoad() {
     resetRetryTimer()
@@ -1215,8 +1228,8 @@ class Player(internal val context: Context) {
     val backwardJumpIntervalChanged =
       previousOptions.backwardJumpInterval != options.backwardJumpInterval
     val capabilitiesChanged = previousOptions.capabilities != options.capabilities
-    val notificationButtonsChanged =
-      previousOptions.notificationButtons != options.notificationButtons
+    val remoteButtonLayoutChanged =
+      !previousOptions.remoteButtonLayout.sameAs(options.remoteButtonLayout)
     val appKilledPlaybackBehaviorChanged =
       previousOptions.appKilledPlaybackBehavior != options.appKilledPlaybackBehavior
 
@@ -1226,7 +1239,7 @@ class Player(internal val context: Context) {
         forwardJumpIntervalChanged ||
         backwardJumpIntervalChanged ||
         capabilitiesChanged ||
-        notificationButtonsChanged ||
+        remoteButtonLayoutChanged ||
         appKilledPlaybackBehaviorChanged
 
     // Apply only changed properties
@@ -1244,13 +1257,22 @@ class Player(internal val context: Context) {
       setProgressUpdateInterval(options.progressUpdateEventInterval)
     }
 
-    if (capabilitiesChanged || notificationButtonsChanged) {
+    // The jump intervals pick the button icons (ICON_SKIP_BACK_15 and friends), so a changed
+    // interval has to rebuild the layout even when capabilities and placement are untouched.
+    if (
+      capabilitiesChanged ||
+        remoteButtonLayoutChanged ||
+        forwardJumpIntervalChanged ||
+        backwardJumpIntervalChanged
+    ) {
       val searchAvailable = browser?.browserManager?.config?.hasSearch ?: false
       mediaSessionCallback.updateMediaSession(
         mediaSession,
         options.capabilities,
-        options.notificationButtons,
+        options.remoteButtonLayout,
         searchAvailable,
+        options.forwardJumpInterval,
+        options.backwardJumpInterval,
       )
     }
 

package/android/src/main/java/com/audiobrowser/player/RetryLoadErrorHandlingPolicy.kt

@@ -107,7 +107,8 @@ class RetryLoadErrorHandlingPolicy(
    */
   private fun exhaustedBudget(currentTime: Long): String? {
     firstErrorTime?.let { start ->
-      if (currentTime - start >= maxRetryDurationMs) return "max retry duration ($maxRetryDurationMs ms)"
+      if (currentTime - start >= maxRetryDurationMs)
+        return "max retry duration ($maxRetryDurationMs ms)"
     }
     if (!hasPlayed() && isOnline()) {
       firstOnlineErrorTime?.let { start ->

package/android/src/main/java/com/audiobrowser/player/TransformingDataSource.kt

@@ -113,7 +113,8 @@ class TransformingDataSource(private val upstream: DataSource, private val facto
    * installs the `IcyDataSource` that emits in-stream ICY/Shoutcast song metadata via
    * `Player.Listener.onMetadata`. The `DataSource` default returns an empty map, so without this
    * override this transparent wrapper would swallow the ICY headers — playback keeps working but
-   * `onMetadata` never fires (live "now playing" song goes missing).
+   * `onMetadata` never fires (live "now playing" song goes missing). Swallowing them also leaves
+   * the interleaved metadata bytes in the audio stream, where they decode as audible chirping.
    */
   override fun getResponseHeaders(): Map<String, List<String>> {
     return upstream.responseHeaders

package/android/src/main/java/com/audiobrowser/tls/AiaCertChaser.kt

@@ -106,9 +106,13 @@ object AiaCertChaser {
   }
 
   /**
-   * Minimal DER TLV reader over a byte buffer. Does no bounds-checking by design: truncated or
-   * malformed input throws (e.g. [IndexOutOfBoundsException]), which the callers above expect and
-   * turn into "no AIA".
+   * Minimal DER TLV reader over a byte buffer. Malformed input throws [IllegalArgumentException],
+   * which the callers above expect and turn into "no AIA".
+   *
+   * Every read is bounds-checked, and a declared length is rejected unless it is non-negative and
+   * within the buffer. Both matter: the extension bytes come from a server-presented certificate,
+   * so a length that shifts into a negative Int would rewind `pos` and spin [extractCaIssuerUrls]'s
+   * loop forever on the handshake thread rather than failing.
    */
   private class DerReader(private val buf: ByteArray) {
     private var pos = 0
@@ -116,17 +120,28 @@ object AiaCertChaser {
     fun hasNext(): Boolean = pos < buf.size
 
     fun read(): Tlv {
-      val tag = buf[pos++].toInt() and 0xFF
-      var len = buf[pos++].toInt() and 0xFF
+      val tag = readByte()
+      var len = readByte()
       if (len and 0x80 != 0) {
+        // Long form: the low bits give the number of length bytes. Four already covers any
+        // buffer that fits in memory; more would overflow the Int we shift them into. The
+        // indefinite form (0x80, i.e. zero length bytes) is not valid DER.
         val numBytes = len and 0x7F
+        require(numBytes in 1..4) { "unsupported DER length form: $numBytes length bytes" }
         len = 0
-        repeat(numBytes) { len = (len shl 8) or (buf[pos++].toInt() and 0xFF) }
+        repeat(numBytes) { len = (len shl 8) or readByte() }
+        require(len >= 0) { "DER length overflows Int" }
       }
+      require(len <= buf.size - pos) { "DER length $len runs past the end of the buffer" }
       val tlv = Tlv(buf, tag, pos, len)
       pos += len
       return tlv
     }
+
+    private fun readByte(): Int {
+      require(pos < buf.size) { "truncated DER" }
+      return buf[pos++].toInt() and 0xFF
+    }
   }
 
   /** A parsed tag-length-value: the tag and a view of its content bytes. */

package/android/src/main/java/com/audiobrowser/tls/AiaChasingExtendedTrustManager.kt

@@ -0,0 +1,109 @@
+package com.audiobrowser.tls
+
+import java.net.Socket
+import java.security.cert.CertificateException
+import java.security.cert.X509Certificate
+import javax.net.ssl.SSLEngine
+import javax.net.ssl.X509ExtendedTrustManager
+import javax.net.ssl.X509TrustManager
+
+/**
+ * The [AiaChasingTrustManager] behaviour, as an [X509ExtendedTrustManager].
+ *
+ * The socket- and engine-aware overloads are the ones the platform actually calls, and they are not
+ * optional. Android's default trust manager is a `RootTrustManager`, which extends
+ * [X509ExtendedTrustManager] and whose two-argument `checkServerTrusted` throws unconditionally
+ * once the app declares any `<domain-config>` in its network security config:
+ * > Domain specific configurations require that hostname aware
+ * > checkServerTrusted(X509Certificate[], String, String) is used
+ *
+ * Wrapping it in a plain [X509TrustManager] hides those overloads, so conscrypt falls through to
+ * the two-argument form and *every* HTTPS connection in the process fails — and, because the
+ * wrapper treats a [CertificateException] as its cue to chase AIA, fails slowly. The socket
+ * overload is also where endpoint identification happens for a raw `SSLSocket` configured with
+ * `endpointIdentificationAlgorithm = "HTTPS"`; skipping it skips hostname verification.
+ *
+ * [X509ExtendedTrustManager] is API 24+, hence the split from [AiaChasingTrustManager] — see
+ * [AiaTls.trustManager], which picks by SDK level. Per-domain network security configs are
+ * themselves API 24+, so the plain variant on 23 loses nothing.
+ *
+ * @param delegate the wrapped trust manager, normally the platform default.
+ * @param fetch resolves a CA-Issuers URL to its candidate certificates.
+ */
+class AiaChasingExtendedTrustManager(
+  private val delegate: X509TrustManager,
+  private val fetch: (url: String) -> List<X509Certificate>,
+) : X509ExtendedTrustManager() {
+
+  /** The delegate's own extended overloads, when it has them. */
+  private val extended = delegate as? X509ExtendedTrustManager
+
+  override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+    withAiaRetry(chain) { delegate.checkServerTrusted(it, authType) }
+
+  override fun checkServerTrusted(
+    chain: Array<X509Certificate>,
+    authType: String,
+    socket: Socket?,
+  ) =
+    withAiaRetry(chain) {
+      // A delegate without the extended overloads cannot be hostname-aware in the first place,
+      // so falling back to its two-argument form loses nothing it could have offered.
+      extended?.checkServerTrusted(it, authType, socket)
+        ?: delegate.checkServerTrusted(it, authType)
+    }
+
+  override fun checkServerTrusted(
+    chain: Array<X509Certificate>,
+    authType: String,
+    engine: SSLEngine?,
+  ) =
+    withAiaRetry(chain) {
+      extended?.checkServerTrusted(it, authType, engine)
+        ?: delegate.checkServerTrusted(it, authType)
+    }
+
+  // Client certificates are the app's own; there is nothing to chase.
+
+  override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) =
+    delegate.checkClientTrusted(chain, authType)
+
+  override fun checkClientTrusted(
+    chain: Array<X509Certificate>,
+    authType: String,
+    socket: Socket?,
+  ) {
+    extended?.checkClientTrusted(chain, authType, socket)
+      ?: delegate.checkClientTrusted(chain, authType)
+  }
+
+  override fun checkClientTrusted(
+    chain: Array<X509Certificate>,
+    authType: String,
+    engine: SSLEngine?,
+  ) {
+    extended?.checkClientTrusted(chain, authType, engine)
+      ?: delegate.checkClientTrusted(chain, authType)
+  }
+
+  override fun getAcceptedIssuers(): Array<X509Certificate> = delegate.acceptedIssuers
+
+  /**
+   * Runs [check], and on rejection retries it once against the AIA-completed chain. The completed
+   * chain goes through the same [check], so trust is never weakened: whatever the delegate would
+   * have refused, it still refuses.
+   */
+  private inline fun withAiaRetry(
+    chain: Array<X509Certificate>,
+    check: (Array<X509Certificate>) -> Unit,
+  ) {
+    try {
+      check(chain)
+    } catch (original: CertificateException) {
+      val completed = AiaCertChaser.completeChain(chain.toList(), fetch = fetch)
+      // Nothing could be added — the original failure stands (don't re-check an unchanged chain).
+      if (completed.size == chain.size) throw original
+      check(completed.toTypedArray())
+    }
+  }
+}

package/android/src/main/java/com/audiobrowser/tls/AiaTls.kt

@@ -1,5 +1,6 @@
 package com.audiobrowser.tls
 
+import android.os.Build
 import java.security.KeyStore
 import javax.net.ssl.SSLContext
 import javax.net.ssl.SSLSocketFactory
@@ -27,10 +28,23 @@ object AiaTls {
   fun socketFactory(): SSLSocketFactory =
     SSLContext.getInstance("TLS").apply { init(null, arrayOf(trustManager()), null) }.socketFactory
 
-  /** An [X509TrustManager] wrapping the platform default with AIA intermediate chasing. */
+  /**
+   * An [X509TrustManager] wrapping the platform default with AIA intermediate chasing.
+   *
+   * On API 24+ this is an [X509ExtendedTrustManager]. That is not cosmetic: the platform's default
+   * trust manager rejects the two-argument `checkServerTrusted` outright once the app declares any
+   * `<domain-config>`, so a plain wrapper would break every HTTPS connection in the process. See
+   * [AiaChasingExtendedTrustManager].
+   */
   fun trustManager(): X509TrustManager {
     val fetcher = CachingCertificateFetcher()
-    return AiaChasingTrustManager(systemTrustManager()) { fetcher.fetch(it) }
+    val fetch = { url: String -> fetcher.fetch(url) }
+    val system = systemTrustManager()
+    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+      AiaChasingExtendedTrustManager(system, fetch)
+    } else {
+      AiaChasingTrustManager(system, fetch)
+    }
   }
 
   private fun systemTrustManager(): X509TrustManager {

package/android/src/main/java/com/audiobrowser/tls/CachingCertificateFetcher.kt

@@ -2,6 +2,7 @@ package com.audiobrowser.tls
 
 import java.io.ByteArrayInputStream
 import java.io.ByteArrayOutputStream
+import java.io.InputStream
 import java.net.InetSocketAddress
 import java.net.Socket
 import java.net.URL
@@ -22,6 +23,11 @@ import timber.log.Timber
  * chasing). Only non-empty results are cached, so the (typically `http`) round-trip happens at most
  * once per intermediate for the process lifetime while transient failures stay retryable.
  *
+ * Responses are capped at [MAX_RESPONSE_BYTES]. The URL comes from a server-presented certificate,
+ * so the host, port and path are chosen by whoever we are failing to validate; the read timeout is
+ * per-read and would not stop a slow drip of unbounded length. A certificate is a few kilobytes and
+ * even a PKCS#7 bundle a few dozen, so the cap is far above anything legitimate.
+ *
  * `http` fetches go over a raw [Socket] rather than `HttpURLConnection`. CA "CA Issuers" URLs are
  * virtually always plain `http` (the CA/Browser Forum Baseline Requirements mandate it, to avoid a
  * chicken-and-egg TLS dependency when fetching the cert needed to complete a TLS chain), but
@@ -56,6 +62,7 @@ class CachingCertificateFetcher(
 
   private fun download(url: String, redirectsLeft: Int = MAX_REDIRECTS): ByteArray? =
     try {
+      require(isSafeUrl(url)) { "AIA URL contains characters that are not valid in a URL" }
       val parsed = URL(url)
       when (parsed.protocol) {
         "http" -> downloadCleartext(parsed, redirectsLeft)
@@ -77,7 +84,7 @@ class CachingCertificateFetcher(
     connection.connectTimeout = connectTimeoutMs
     connection.readTimeout = readTimeoutMs
     connection.sslSocketFactory = plainSslSocketFactory
-    return connection.inputStream.use { it.readBytes() }
+    return connection.inputStream.use { readCapped(it) }
   }
 
   /**
@@ -104,8 +111,8 @@ class CachingCertificateFetcher(
           write(request.toByteArray(Charsets.ISO_8859_1))
           flush()
         }
-        socket.getInputStream().use { it.readBytes() }
-      }
+        socket.getInputStream().use { readCapped(it) }
+      } ?: return null
     val response = parseHttpResponse(raw) ?: return null
     return when {
       response.status in 200..299 -> response.body
@@ -119,6 +126,55 @@ class CachingCertificateFetcher(
   companion object {
     private const val MAX_REDIRECTS = 5
 
+    /**
+     * Whether [url] is free of characters that have no business in a URL.
+     *
+     * The cleartext fetch writes the path into a request line on a raw socket, and the URL is an
+     * IA5String copied verbatim out of a certificate a hostile server presented. `java.net.URL`
+     * preserves control characters — `URL("http://host:6379/\r\nSET foo bar")` parses to that host
+     * and port with the CRLF intact in `file` — so without this check a certificate could inject
+     * request lines of its own, to any host and port the device can reach. Space is excluded too:
+     * it would split the request line's target from its HTTP version.
+     */
+    fun isSafeUrl(url: String): Boolean = url.none { it.code <= 0x20 || it.code == 0x7F }
+
+    /** Ceiling on a single AIA response body. */
+    const val MAX_RESPONSE_BYTES = 1 shl 20 // 1 MiB
+
+    /** Ceiling on the wall-clock time spent reading one AIA response. */
+    const val MAX_RESPONSE_MILLIS = 10_000L
+
+    /**
+     * Reads [input] to EOF, or returns null once it exceeds [limit] bytes or [budgetMs] of
+     * wall-clock time. Null rather than a truncated buffer: a cut-off certificate is not parseable
+     * anyway, and "too big" or "too slow" is a failed fetch, which the caller already knows how to
+     * treat as "no AIA".
+     *
+     * The byte cap alone would not bound the time. The socket's timeout is per-read, so a server
+     * returning one byte just inside it resets the clock on every iteration and holds the handshake
+     * thread for as long as it likes — a slow-drip stall in place of the unbounded buffer. Both
+     * limits are needed, and the deadline is checked against [nowNanos] (injectable so a test need
+     * not actually wait).
+     */
+    fun readCapped(
+      input: InputStream,
+      limit: Int = MAX_RESPONSE_BYTES,
+      budgetMs: Long = MAX_RESPONSE_MILLIS,
+      nowNanos: () -> Long = System::nanoTime,
+    ): ByteArray? {
+      val deadline = nowNanos() + budgetMs * 1_000_000
+      val out = ByteArrayOutputStream()
+      val chunk = ByteArray(8 * 1024)
+      while (true) {
+        val read = input.read(chunk)
+        if (read < 0) return out.toByteArray()
+        if (out.size() + read > limit) return null
+        out.write(chunk, 0, read)
+        // Subtraction, not `>`: overflow-safe across nanoTime's arbitrary origin.
+        if (nowNanos() - deadline >= 0) return null
+      }
+    }
+
     /**
      * Parses every certificate from the bytes a CA-Issuers URL serves — a single DER certificate
      * (e.g. Let's Encrypt), a PEM file, or a PKCS#7 "certs-only" bundle. Empty if the bytes are not

package/android/src/main/java/com/audiobrowser/util/ArtworkVariant.kt

@@ -5,11 +5,10 @@ import com.margelo.nitro.audiobrowser.Variant_String_ArtworkVariants
 /**
  * Reading `Track.artwork`, which is either one URL or a URL per appearance.
  *
- * Android Auto is dark-only, so there is nothing here to choose: a pair always
- * resolves to its dark URL, which is also what a single-URL track would have
- * shipped. The per-appearance half of the feature is iOS/CarPlay only — see
- * `ios/Extension/Variant+Artwork.swift`, where both URLs are kept so a
- * `UIImageAsset` can swap them without a re-fetch.
+ * Android Auto is dark-only, so there is nothing here to choose: a pair always resolves to its dark
+ * URL, which is also what a single-URL track would have shipped. The per-appearance half of the
+ * feature is iOS/CarPlay only — see `ios/Extension/Variant+Artwork.swift`, where both URLs are kept
+ * so a `UIImageAsset` can swap them without a re-fetch.
  */
 val Variant_String_ArtworkVariants.url: String
   get() = match(first = { it }, second = { it.dark })
@@ -17,10 +16,9 @@ val Variant_String_ArtworkVariants.url: String
 /**
  * Wraps a plain URL as the single-URL side of the union.
  *
- * For the places that build a `Track` from something that only ever has one
- * image — restored persistence, a `MediaMetadata` handed back by the platform.
- * Restoring collapses a pair to its dark URL, which costs nothing here: Android
- * Auto would have rendered that one anyway.
+ * For the places that build a `Track` from something that only ever has one image — restored
+ * persistence, a `MediaMetadata` handed back by the platform. Restoring collapses a pair to its
+ * dark URL, which costs nothing here: Android Auto would have rendered that one anyway.
  */
 fun artworkOf(url: String?): Variant_String_ArtworkVariants? =
   url?.let { Variant_String_ArtworkVariants.First(it) }

package/android/src/main/java/com/audiobrowser/util/TrackFactory.kt

@@ -26,12 +26,12 @@ object TrackFactory {
   }
 
   /**
-   * Android Auto has no image-row rendering; its closest equivalent is a grid of artwork
-   * tiles. A track carrying `imageRow` expands into its items as grid-styled rows (the
-   * per-item content-style hint — hosts that ignore it fall back to list rows) grouped under
-   * the row's title, followed by the row itself as a browsable "view all" link when it has a
-   * `url` (a url-less row is a pure preview and contributes only its items). Tracks without
-   * an `imageRow` pass through unchanged.
+   * Android Auto has no image-row rendering; its closest equivalent is a grid of artwork tiles. A
+   * track carrying `imageRow` expands into its items as grid-styled rows (the per-item
+   * content-style hint — hosts that ignore it fall back to list rows) grouped under the row's
+   * title, followed by the row itself as a browsable "view all" link when it has a `url` (a
+   * url-less row is a pure preview and contributes only its items). Tracks without an `imageRow`
+   * pass through unchanged.
    */
   fun expandImageRows(tracks: List<Track>): List<Track> =
     tracks.flatMap { track ->
@@ -95,7 +95,8 @@ object TrackFactory {
     val scheme = rawUrl?.let { Uri.parse(it).scheme?.lowercase() }
     val builder = metadataBuilder(track)
     if (rawUrl != null && (scheme == "http" || scheme == "https")) {
-      val isSvg = SvgArtworkRenderer.isSvgUrl(rawUrl) || SvgArtworkRenderer.isSvgUrl(track.artwork?.url)
+      val isSvg =
+        SvgArtworkRenderer.isSvgUrl(rawUrl) || SvgArtworkRenderer.isSvgUrl(track.artwork?.url)
       val token = ArtworkUris.tokenFor(rawUrl)
       registry.register(token, ResolvedArtwork(rawUrl, track.artworkSource?.headers, isSvg))
       builder.setArtworkUri(ArtworkUris.contentUri(authority, token).toUri())

package/android/src/test/java/com/audiobrowser/ServiceBindingTest.kt

@@ -0,0 +1,87 @@
+package com.audiobrowser
+
+import android.content.ComponentName
+import android.content.Intent
+import android.content.ServiceConnection
+import android.os.IBinder
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import org.robolectric.Shadows.shadowOf
+
+// Robolectric: bindService/unbindService only exist under the framework, and ShadowApplication
+// records both sides — which is precisely the leak being guarded against.
+@RunWith(RobolectricTestRunner::class)
+class ServiceBindingTest {
+
+  private val app = RuntimeEnvironment.getApplication()
+  private val intent = Intent(app, Service::class.java)
+
+  private val connection =
+    object : ServiceConnection {
+      override fun onServiceConnected(name: ComponentName?, service: IBinder?) = Unit
+
+      override fun onServiceDisconnected(name: ComponentName?) = Unit
+    }
+
+  /** Both the auto-bind at construction and setup's bind reach the same object. */
+  @Test
+  fun bindingTwiceTakesOnlyOneBinding() {
+    val binding = ServiceBinding(app)
+
+    assertTrue(binding.bind(intent, connection))
+    assertTrue(binding.bind(intent, connection))
+
+    assertEquals(1, shadowOf(app).boundServiceConnections.size)
+
+    binding.unbind(connection)
+
+    assertTrue(shadowOf(app).boundServiceConnections.isEmpty())
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+
+  /** dispose() must not throw, and Android throws when unbinding a connection it never had. */
+  @Test
+  fun unbindWithoutBindIsANoOp() {
+    val binding = ServiceBinding(app)
+
+    binding.unbind(connection)
+
+    assertFalse(binding.isBound)
+    assertTrue(shadowOf(app).unboundServiceConnections.isEmpty())
+  }
+
+  /**
+   * Android registers the connection before it asks the ActivityManager, so a false return still
+   * leaves a binding to release. Treating false as "nothing bound" strands it permanently — the
+   * leak this class exists to prevent.
+   */
+  @Test
+  fun failedBindStillHoldsAConnectionToRelease() {
+    val binding = ServiceBinding(app)
+    shadowOf(app).declareActionUnbindable("unbindable")
+
+    assertFalse(binding.bind(Intent("unbindable"), connection))
+
+    assertTrue(binding.isBound)
+
+    binding.unbind(connection)
+
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+
+  @Test
+  fun unbindIsIdempotent() {
+    val binding = ServiceBinding(app)
+    binding.bind(intent, connection)
+
+    binding.unbind(connection)
+    binding.unbind(connection)
+
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+}

package/android/src/test/java/com/audiobrowser/TestFixtures.kt

@@ -1,7 +1,6 @@
 package com.audiobrowser
 
 import com.audiobrowser.util.artworkOf
-
 import com.margelo.nitro.audiobrowser.ArtworkRequestConfig
 import com.margelo.nitro.audiobrowser.ImageQueryParams
 import com.margelo.nitro.audiobrowser.ImageRowItem

package/android/src/test/java/com/audiobrowser/browser/JsonArtworkTest.kt

@@ -10,7 +10,8 @@ class JsonArtworkTest {
 
   @Test
   fun `decodes a single url`() {
-    val track = json.decodeFromString<JsonTrack>("""{"title":"X","artwork":"https://e.example/a.png"}""")
+    val track =
+      json.decodeFromString<JsonTrack>("""{"title":"X","artwork":"https://e.example/a.png"}""")
     assertEquals(
       Variant_String_ArtworkVariants.First("https://e.example/a.png"),
       track.toNitro().artwork,

package/android/src/test/java/com/audiobrowser/browser/SectionScopeTest.kt

@@ -59,8 +59,7 @@ class SectionScopeTest {
     val row = track(title = "Most Played", src = null, imageRow = items)
     val children = listOf(row, track(src = "a"))
 
-    val section =
-      SectionScope.section(children, "s2") as SectionScope.Section.ImageRow
+    val section = SectionScope.section(children, "s2") as SectionScope.Section.ImageRow
     assertEquals(listOf("s1", "s2"), section.items.map { it.src })
   }
 
@@ -76,8 +75,7 @@ class SectionScopeTest {
     val row = track(title = "Row", src = null, imageRow = arrayOf(imageRowItem("dup")))
     val children = listOf(row, track(src = "dup"), track(src = "b"))
 
-    val section =
-      SectionScope.section(children, "dup") as SectionScope.Section.ImageRow
+    val section = SectionScope.section(children, "dup") as SectionScope.Section.ImageRow
     assertEquals(listOf("dup"), section.items.map { it.src })
   }