react-native-audio-browser 0.2.0-next.1 → 0.2.0-next.10

package/android/src/test/java/com/audiobrowser/player/CapabilityControlsTest.kt

@@ -1,8 +1,8 @@
 package com.audiobrowser.player
 
-import com.margelo.nitro.audiobrowser.NotificationButton
-import com.margelo.nitro.audiobrowser.NotificationButtonLayout
 import com.margelo.nitro.audiobrowser.PlayerCapabilities
+import com.margelo.nitro.audiobrowser.RemoteButton
+import com.margelo.nitro.audiobrowser.RemoteButtonLayout
 import com.margelo.nitro.audiobrowser.Variant_Boolean_FavoriteConfig
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
@@ -12,8 +12,7 @@ import org.junit.Test
 /**
  * Truth tables for the pure Capability decision core: [PlayerCapabilities.isEnabled] (one rule for
  * "available by default, only false disables; favorite is opt-in; play/pause is one control") and
- * [deriveNotificationSlots] (the single notification slot derivation that both the button layout
- * and the notification player commands consume).
+ * [deriveButtonSlots] (the single slot derivation every Media3 assembly consumes).
  */
 class CapabilityControlsTest {
 
@@ -43,117 +42,162 @@ class CapabilityControlsTest {
       playbackRate = null,
     )
 
+  private fun layout(
+    back: RemoteButton? = null,
+    forward: RemoteButton? = null,
+    overflow: Array<RemoteButton> = emptyArray(),
+  ) = RemoteButtonLayout(back = back, forward = forward, overflow = overflow)
+
   private fun slots(
     capabilities: PlayerCapabilities,
-    layout: NotificationButtonLayout? = null,
-  ): List<Pair<NotificationButton, NotificationSlot>> =
-    deriveNotificationSlots(capabilities, layout).map { it.button to it.slot }
+    layout: RemoteButtonLayout? = null,
+  ): List<Pair<RemoteButton, ButtonSlot>> =
+    deriveButtonSlots(capabilities, layout).map { it.button to it.slot }
 
   // MARK: isEnabled
 
   @Test
   fun `everything but favorite is enabled by default`() {
     val defaults = capabilities()
-    for (control in Control.entries) {
-      assertEquals("$control", control != Control.FAVORITE, defaults.isEnabled(control))
+    for (control in Capability.entries) {
+      assertEquals("$control", control != Capability.FAVORITE, defaults.isEnabled(control))
     }
   }
 
   @Test
   fun `only an explicit false disables a control`() {
     val caps = capabilities(skipToNext = false, jumpBackward = false)
-    assertFalse(caps.isEnabled(Control.SKIP_TO_NEXT))
-    assertFalse(caps.isEnabled(Control.JUMP_BACKWARD))
-    assertTrue(caps.isEnabled(Control.SKIP_TO_PREVIOUS))
-    assertTrue(caps.isEnabled(Control.JUMP_FORWARD))
+    assertFalse(caps.isEnabled(Capability.SKIP_TO_NEXT))
+    assertFalse(caps.isEnabled(Capability.JUMP_BACKWARD))
+    assertTrue(caps.isEnabled(Capability.SKIP_TO_PREVIOUS))
+    assertTrue(caps.isEnabled(Capability.JUMP_FORWARD))
   }
 
   @Test
   fun `play pause is one control - it survives a single half being disabled`() {
-    assertTrue(capabilities(play = false).isEnabled(Control.PLAY_PAUSE))
-    assertTrue(capabilities(pause = false).isEnabled(Control.PLAY_PAUSE))
-    assertFalse(capabilities(play = false, pause = false).isEnabled(Control.PLAY_PAUSE))
+    assertTrue(capabilities(play = false).isEnabled(Capability.PLAY_PAUSE))
+    assertTrue(capabilities(pause = false).isEnabled(Capability.PLAY_PAUSE))
+    assertFalse(capabilities(play = false, pause = false).isEnabled(Capability.PLAY_PAUSE))
   }
 
   @Test
   fun `favorite is opt-in`() {
-    assertFalse(capabilities().isEnabled(Control.FAVORITE))
-    assertFalse(capabilities(favorite = false).isEnabled(Control.FAVORITE))
-    assertTrue(capabilities(favorite = true).isEnabled(Control.FAVORITE))
+    assertFalse(capabilities().isEnabled(Capability.FAVORITE))
+    assertFalse(capabilities(favorite = false).isEnabled(Capability.FAVORITE))
+    assertTrue(capabilities(favorite = true).isEnabled(Capability.FAVORITE))
   }
 
-  // MARK: deriveNotificationSlots — capability defaults
+  // MARK: deriveButtonSlots — capability defaults
 
   @Test
-  fun `default layout puts skip on the primary slots, jump on the secondary, favorite in overflow`() {
+  fun `default layout puts skip on the primary positions, jump and favorite in overflow`() {
     val derived = slots(capabilities(favorite = true))
     assertEquals(
       listOf(
-        NotificationButton.SKIP_TO_PREVIOUS to NotificationSlot.BACK,
-        NotificationButton.SKIP_TO_NEXT to NotificationSlot.FORWARD,
-        NotificationButton.JUMP_BACKWARD to NotificationSlot.BACK_SECONDARY,
-        NotificationButton.JUMP_FORWARD to NotificationSlot.FORWARD_SECONDARY,
-        NotificationButton.FAVORITE to NotificationSlot.OVERFLOW,
+        RemoteButton.SKIP_TO_PREVIOUS to ButtonSlot.BACK,
+        RemoteButton.SKIP_TO_NEXT to ButtonSlot.FORWARD,
+        RemoteButton.JUMP_BACKWARD to ButtonSlot.OVERFLOW,
+        RemoteButton.JUMP_FORWARD to ButtonSlot.OVERFLOW,
+        RemoteButton.FAVORITE to ButtonSlot.OVERFLOW,
       ),
       derived,
     )
   }
 
   @Test
-  fun `jump falls back to the primary slot when skip is disabled`() {
+  fun `jump falls back to a primary position when skip is disabled`() {
     val derived = slots(capabilities(skipToPrevious = false, skipToNext = false))
     assertEquals(
       listOf(
-        NotificationButton.JUMP_BACKWARD to NotificationSlot.BACK,
-        NotificationButton.JUMP_FORWARD to NotificationSlot.FORWARD,
+        RemoteButton.JUMP_BACKWARD to ButtonSlot.BACK,
+        RemoteButton.JUMP_FORWARD to ButtonSlot.FORWARD,
       ),
       derived,
     )
   }
 
   @Test
-  fun `a fully disabled side leaves its slot empty`() {
+  fun `a fully disabled side leaves its position empty`() {
     val derived =
       slots(capabilities(skipToPrevious = false, jumpBackward = false, jumpForward = false))
-    assertEquals(listOf(NotificationButton.SKIP_TO_NEXT to NotificationSlot.FORWARD), derived)
+    assertEquals(listOf(RemoteButton.SKIP_TO_NEXT to ButtonSlot.FORWARD), derived)
   }
 
-  // MARK: deriveNotificationSlots — explicit layout
+  // MARK: deriveButtonSlots — explicit layout
 
   @Test
-  fun `explicit layout maps every slot and keeps overflow order`() {
-    val layout =
-      NotificationButtonLayout(
-        back = NotificationButton.JUMP_BACKWARD,
-        forward = NotificationButton.JUMP_FORWARD,
-        backSecondary = null,
-        forwardSecondary = null,
-        overflow = arrayOf(NotificationButton.SKIP_TO_PREVIOUS, NotificationButton.SKIP_TO_NEXT),
+  fun `an explicit layout maps every field and keeps overflow order`() {
+    val derived =
+      slots(
+        capabilities(),
+        layout(
+          back = RemoteButton.JUMP_BACKWARD,
+          forward = RemoteButton.JUMP_FORWARD,
+          overflow = arrayOf(RemoteButton.SKIP_TO_PREVIOUS, RemoteButton.SKIP_TO_NEXT),
+        ),
       )
-    val derived = slots(capabilities(), layout)
     assertEquals(
       listOf(
-        NotificationButton.JUMP_BACKWARD to NotificationSlot.BACK,
-        NotificationButton.JUMP_FORWARD to NotificationSlot.FORWARD,
-        NotificationButton.SKIP_TO_PREVIOUS to NotificationSlot.OVERFLOW,
-        NotificationButton.SKIP_TO_NEXT to NotificationSlot.OVERFLOW,
+        RemoteButton.JUMP_BACKWARD to ButtonSlot.BACK,
+        RemoteButton.JUMP_FORWARD to ButtonSlot.FORWARD,
+        RemoteButton.SKIP_TO_PREVIOUS to ButtonSlot.OVERFLOW,
+        RemoteButton.SKIP_TO_NEXT to ButtonSlot.OVERFLOW,
       ),
       derived,
     )
   }
 
   @Test
-  fun `explicit layout entries are dropped when their capability is disabled`() {
-    val layout =
-      NotificationButtonLayout(
-        back = NotificationButton.SKIP_TO_PREVIOUS,
-        forward = NotificationButton.SKIP_TO_NEXT,
-        backSecondary = null,
-        forwardSecondary = null,
-        overflow = arrayOf(NotificationButton.FAVORITE),
+  fun `a null field leaves that position empty`() {
+    val derived = slots(capabilities(), layout(back = null, forward = RemoteButton.SKIP_TO_NEXT))
+    assertEquals(listOf(RemoteButton.SKIP_TO_NEXT to ButtonSlot.FORWARD), derived)
+  }
+
+  @Test
+  fun `a layout is never merged with the capability defaults`() {
+    // Nitro collapses an omitted and a null enum field to the same Kotlin null, so a per-field
+    // merge is not expressible: an empty position must stay empty rather than falling back to the
+    // capability default. Every capability here is enabled, so a merge would add skip and jump.
+    val derived =
+      slots(capabilities(favorite = true), layout(overflow = arrayOf(RemoteButton.FAVORITE)))
+    assertEquals(listOf(RemoteButton.FAVORITE to ButtonSlot.OVERFLOW), derived)
+  }
+
+  @Test
+  fun `a disabled entry drops out without promoting anything into its position`() {
+    // favorite unset (= disabled), skipToPrevious explicitly off. skip-to-next must stay on
+    // FORWARD rather than sliding into the vacated BACK position.
+    val derived =
+      slots(
+        capabilities(skipToPrevious = false),
+        layout(
+          back = RemoteButton.SKIP_TO_PREVIOUS,
+          forward = RemoteButton.SKIP_TO_NEXT,
+          overflow = arrayOf(RemoteButton.FAVORITE),
+        ),
       )
-    // favorite unset (= disabled), skipToPrevious explicitly off
-    val derived = slots(capabilities(skipToPrevious = false), layout)
-    assertEquals(listOf(NotificationButton.SKIP_TO_NEXT to NotificationSlot.FORWARD), derived)
+    assertEquals(listOf(RemoteButton.SKIP_TO_NEXT to ButtonSlot.FORWARD), derived)
+  }
+
+  // MARK: sameAs
+
+  @Test
+  fun `sameAs compares overflow by content, not by array identity`() {
+    val a = layout(back = RemoteButton.JUMP_BACKWARD, overflow = arrayOf(RemoteButton.FAVORITE))
+    val b = layout(back = RemoteButton.JUMP_BACKWARD, overflow = arrayOf(RemoteButton.FAVORITE))
+    // Distinct Array instances — data-class `==` would call these different and republish the
+    // layout to Android Auto on every unrelated options update.
+    assertTrue(a.sameAs(b))
+    assertFalse(a.sameAs(layout(back = RemoteButton.JUMP_BACKWARD)))
+    assertFalse(
+      a.sameAs(layout(back = RemoteButton.JUMP_FORWARD, overflow = arrayOf(RemoteButton.FAVORITE)))
+    )
+  }
+
+  @Test
+  fun `sameAs treats null as its own layout`() {
+    assertTrue(null.sameAs(null))
+    assertFalse(layout(back = RemoteButton.SKIP_TO_NEXT).sameAs(null))
+    assertFalse(null.sameAs(layout(back = RemoteButton.SKIP_TO_NEXT)))
   }
 }

package/android/src/test/java/com/audiobrowser/player/MediaSessionSlotMappingTest.kt

@@ -0,0 +1,45 @@
+package com.audiobrowser.player
+
+import androidx.media3.session.CommandButton
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Guards the slot preference lists handed to Media3.
+ *
+ * The invariant that matters is the OVERFLOW fallback: every flattening keeps a button only if it
+ * won SLOT_BACK, won SLOT_FORWARD, or names SLOT_OVERFLOW. A slot that stops naming OVERFLOW
+ * silently deletes its button from the notification and the car the moment its primary position is
+ * unavailable, so the loop below asserts the property for every slot rather than only today's
+ * three.
+ */
+class MediaSessionSlotMappingTest {
+
+  @Test
+  fun `primary slots are preferred with an overflow fallback`() {
+    assertArrayEquals(
+      intArrayOf(CommandButton.SLOT_BACK, CommandButton.SLOT_OVERFLOW),
+      media3SlotsFor(ButtonSlot.BACK),
+    )
+    assertArrayEquals(
+      intArrayOf(CommandButton.SLOT_FORWARD, CommandButton.SLOT_OVERFLOW),
+      media3SlotsFor(ButtonSlot.FORWARD),
+    )
+  }
+
+  @Test
+  fun `overflow does not repeat itself`() {
+    assertArrayEquals(intArrayOf(CommandButton.SLOT_OVERFLOW), media3SlotsFor(ButtonSlot.OVERFLOW))
+  }
+
+  @Test
+  fun `every slot names OVERFLOW so nothing can be dropped`() {
+    for (slot in ButtonSlot.entries) {
+      assertTrue(
+        "$slot must name SLOT_OVERFLOW or its button is dropped from the notification and the car",
+        media3SlotsFor(slot).contains(CommandButton.SLOT_OVERFLOW),
+      )
+    }
+  }
+}

package/android/src/test/java/com/audiobrowser/player/PlaybackErrorClassifierTest.kt

@@ -132,8 +132,8 @@ class PlaybackErrorClassifierTest {
 
   /**
    * Load errors are raw IOExceptions from the transport layer; the policy only retries network
-   * ones, so the advisory classification is UNREACHABLE unless the device is offline or the
-   * server actually answered.
+   * ones, so the advisory classification is UNREACHABLE unless the device is offline or the server
+   * actually answered.
    */
   @Test
   fun `retrying transport failure is unreachable`() {
@@ -158,8 +158,7 @@ class PlaybackErrorClassifierTest {
   /** The HTTP status is dug out of the cause chain and mapped through the shared status table. */
   @Test
   fun `retrying HTTP failure carries the status`() {
-    val error =
-      PlaybackErrorClassifier.retryingLoadError(httpException(503), online = true)
+    val error = PlaybackErrorClassifier.retryingLoadError(httpException(503), online = true)
     assertEquals(PlaybackErrorKind.SERVER_ERROR, error.kind)
     assertEquals(503.0, error.statusCode!!, 0.0)
     assertEquals(true, error.retrying)

package/android/src/test/java/com/audiobrowser/player/RetryLoadErrorHandlingPolicyTest.kt

@@ -201,9 +201,9 @@ class RetryLoadErrorHandlingPolicyBudgetTest {
   }
 
   /**
-   * Offline failures must not burn the first-connect budget (a station tapped in a tunnel parks
-   * for connectivity); the budget's clock starts at the first error observed online, so a dead
-   * station still gets a fast verdict after restoration.
+   * Offline failures must not burn the first-connect budget (a station tapped in a tunnel parks for
+   * connectivity); the budget's clock starts at the first error observed online, so a dead station
+   * still gets a fast verdict after restoration.
    */
   @Test
   fun `offline time does not burn the first-connect budget`() {

package/android/src/test/java/com/audiobrowser/tls/AiaCertChaserTest.kt

@@ -10,9 +10,55 @@ import java.util.Date
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
 import org.junit.Test
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.`when`
 
 class AiaCertChaserTest {
 
+  /** A certificate whose AIA extension value is exactly [extensionValue]. */
+  private fun certWithAia(extensionValue: ByteArray): X509Certificate =
+    mock(X509Certificate::class.java).also {
+      `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(extensionValue)
+    }
+
+  @Test(timeout = 5_000)
+  fun `a negative long-form length does not hang the parser`() {
+    // OCTET STRING { SEQUENCE { tag 0x00, long-form length 0xFFFFFFFA = -6 } }.
+    // The length's four bytes shift into a negative Int, so `pos += len` rewinds the
+    // reader by exactly the six bytes it just consumed: the tag is not a SEQUENCE, the
+    // loop `continue`s, and the reader is back where it started with more input to read.
+    val aia =
+      byteArrayOf(
+        0x04,
+        0x08,
+        0x30,
+        0x06,
+        0x00,
+        0x84.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFA.toByte(),
+      )
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `a length running past the buffer is treated as no AIA`() {
+    // SEQUENCE claiming 0x7F content bytes inside a 2-byte buffer.
+    val aia = byteArrayOf(0x04, 0x04, 0x30, 0x02, 0x30, 0x7F)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `truncated DER is treated as no AIA`() {
+    val aia = byteArrayOf(0x04, 0x08, 0x30)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
   @Test
   fun `extracts CA Issuers URL from real leaf certificate AIA extension`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")

package/android/src/test/java/com/audiobrowser/tls/AiaChasingTrustManagerTest.kt

@@ -1,7 +1,10 @@
 package com.audiobrowser.tls
 
+import java.net.Socket
 import java.security.cert.CertificateException
 import java.security.cert.X509Certificate
+import javax.net.ssl.SSLEngine
+import javax.net.ssl.X509ExtendedTrustManager
 import javax.net.ssl.X509TrustManager
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
@@ -70,4 +73,114 @@ class AiaChasingTrustManagerTest {
     assertEquals(0, fetches)
     assertEquals(listOf(1), delegate.checkedChainSizes)
   }
+
+  // -- the API 24+ variant, which is what the platform actually calls into --
+
+  /**
+   * Stands in for Android's `RootTrustManager` under a per-domain network security config: the
+   * hostname-aware overloads work, and the two-argument one refuses to answer at all.
+   */
+  private class FakeDomainConfigDelegate(private val trustsChainOfSize: Int) :
+    X509ExtendedTrustManager() {
+    val hostnameAwareChecks = mutableListOf<Int>()
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException(
+        "Domain specific configurations require that hostname aware " +
+          "checkServerTrusted(X509Certificate[], String, String) is used"
+      )
+
+    override fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      socket: Socket?,
+    ) {
+      hostnameAwareChecks.add(chain.size)
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+    }
+
+    override fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      engine: SSLEngine?,
+    ) = checkServerTrusted(chain, authType, null as Socket?)
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun checkClientTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      socket: Socket?,
+    ) = Unit
+
+    override fun checkClientTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      engine: SSLEngine?,
+    ) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `forwards to the hostname-aware overload the platform requires`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) {
+        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // The socket overload must reach the delegate's socket overload. Routing it through the
+    // two-argument form instead would throw the domain-config refusal, which is what a plain
+    // X509TrustManager wrapper causes for every connection in the process.
+    tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
+
+  @Test
+  fun `the engine overload is hostname-aware too`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 1)
+
+    AiaChasingExtendedTrustManager(delegate) { emptyList() }
+      .checkServerTrusted(arrayOf(leaf), "RSA", null as SSLEngine?)
+
+    assertEquals(listOf(1), delegate.hostnameAwareChecks)
+  }
+
+  @Test
+  fun `a delegate without extended overloads still works`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = FakeDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) {
+        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+
+    assertEquals(listOf(1, 2), delegate.checkedChainSizes)
+  }
+
+  @Test
+  fun `the extended variant does not weaken trust`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // Trusts nothing, whatever the chain.
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = -1)
+    val tm = AiaChasingExtendedTrustManager(delegate) { listOf(r13) }
+
+    assertThrows(CertificateException::class.java) {
+      tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+    }
+
+    // The completed chain was offered to the delegate and refused, rather than assumed good.
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
 }

package/android/src/test/java/com/audiobrowser/tls/CachingCertificateFetcherTest.kt

@@ -1,5 +1,7 @@
 package com.audiobrowser.tls
 
+import java.io.ByteArrayInputStream
+import java.io.InputStream
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
@@ -72,4 +74,85 @@ class CachingCertificateFetcherTest {
       CachingCertificateFetcher.parseHttpResponse("garbage without a header break".toByteArray())
     )
   }
+
+  // -- response cap (the AIA URL, so the host serving it, comes from the presented cert) --
+
+  // -- URL validation (the AIA URL is attacker-supplied text from the presented cert) --
+
+  @Test
+  fun `accepts the URL form CAs actually serve`() {
+    assertTrue(CachingCertificateFetcher.isSafeUrl("http://r13.i.lencr.org/"))
+    assertTrue(CachingCertificateFetcher.isSafeUrl("http://ca.example:8080/issuer.crt?v=2"))
+  }
+
+  @Test
+  fun `rejects a URL carrying CRLF, which would inject request lines`() {
+    // java.net.URL keeps the CRLF in `file`, and the cleartext fetch writes `file` straight
+    // into "GET $path HTTP/1.0\r\n" on a raw socket.
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://127.0.0.1:6379/\r\nSET foo bar\r\n"))
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://ca.example/a\nX-Injected: 1"))
+  }
+
+  @Test
+  fun `rejects a URL carrying a space, which would split the request line`() {
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://ca.example/a b"))
+  }
+
+  @Test
+  fun `reads a response that fits within the cap`() {
+    val body = ByteArray(64) { it.toByte() }
+
+    assertArrayEquals(
+      body,
+      CachingCertificateFetcher.readCapped(ByteArrayInputStream(body), limit = 128),
+    )
+  }
+
+  @Test
+  fun `returns null for a response that exceeds the cap`() {
+    val body = ByteArray(129)
+
+    assertNull(CachingCertificateFetcher.readCapped(ByteArrayInputStream(body), limit = 128))
+  }
+
+  @Test
+  fun `a stream that never ends does not read without bound`() {
+    // Endless: read() always fills the buffer and never signals EOF, the shape a slow-drip
+    // server takes — the per-read timeout never fires because every read succeeds.
+    val endless =
+      object : InputStream() {
+        override fun read() = 0
+
+        override fun read(b: ByteArray, off: Int, len: Int): Int = len
+      }
+
+    assertNull(CachingCertificateFetcher.readCapped(endless, limit = 1 shl 16))
+  }
+
+  @Test
+  fun `a slow drip is cut off by the deadline, not left to exhaust the byte cap`() {
+    // One byte per read, each one landing just inside the socket's read timeout: the byte cap
+    // alone would let this run for a million reads. The clock advances 1s per read, so the
+    // 10s budget must end it after ~10 — far short of the 1 MiB cap.
+    var reads = 0
+    val drip =
+      object : InputStream() {
+        override fun read() = 0
+
+        override fun read(b: ByteArray, off: Int, len: Int): Int {
+          reads++
+          return 1
+        }
+      }
+    var nanos = 0L
+
+    val result =
+      CachingCertificateFetcher.readCapped(drip, budgetMs = 10_000) {
+        nanos += 1_000_000_000
+        nanos
+      }
+
+    assertNull(result)
+    assertTrue("gave up after $reads reads", reads < 20)
+  }
 }

package/ios/Browser/BrowserManager.swift

@@ -64,9 +64,6 @@ final class BrowserManager {
   private let router = SimpleRouter()
   private let httpClient = HttpClient()
 
-  // LRU cache for individual tracks - keyed by both url and src for O(1) lookup
-  private let trackCache = LRUCache<String, Track>(maxSize: 3000)
-
   // LRU cache for resolved content - keyed by path
   private let contentCache = LRUCache<String, ResolvedTrack>(maxSize: 20)
 
@@ -223,22 +220,6 @@ final class BrowserManager {
     return resolvedTrack.copying(children: hydratedChildren)
   }
 
-  // MARK: - Track Cache
-
-  /// Cache a track by both url and src for O(1) lookup from either key.
-  private func cacheTrack(_ track: Track) {
-    if let url = track.url {
-      trackCache.set(url, value: track)
-    }
-    if let src = track.src {
-      trackCache.set(src, value: track)
-    }
-  }
-
-  private func cacheChildren(_ resolvedTrack: ResolvedTrack) {
-    resolvedTrack.children?.forEach { cacheTrack($0) }
-  }
-
   // MARK: - Navigation
 
   /// Main navigation method - updates path and resolves content.
@@ -276,9 +257,6 @@ final class BrowserManager {
     // Cache the resolved content for future navigation
     contentCache.set(normalizedPath, value: resolvedTrack)
 
-    // Cache children for track lookups
-    cacheChildren(resolvedTrack)
-
     return hydrateChildren(resolvedTrack)
   }
 
@@ -682,9 +660,6 @@ final class BrowserManager {
     lastSearchQuery = query
     lastSearchResults = hydratedResults
 
-    // Cache individual tracks
-    hydratedResults.forEach { cacheTrack($0) }
-
     return makeSearchResult(query: query, results: hydratedResults)
   }
 
@@ -770,9 +745,9 @@ final class BrowserManager {
     // silently queueing the changed list would resume the wrong station.
     let sectionTracks: [Track]
     switch SectionScope.section(of: children, containing: trackId) {
-    case .imageRow(let items):
+    case let .imageRow(items):
       sectionTracks = items.map { $0.toTrack() }
-    case .run(let tracks):
+    case let .run(tracks):
       sectionTracks = tracks
     case nil:
       return nil

package/ios/Browser/SearchDrillIn.swift

@@ -20,7 +20,7 @@ enum SearchDrillIn {
   /// yields nothing. Returns nil when nothing is playable.
   static func playable<Item: PlayableSearchItem>(
     from children: [Item],
-    resolveChildren: sending (String) async throws -> [Item]
+    resolveChildren: sending (String) async throws -> [Item],
   ) async throws -> [Item]? {
     guard !children.isEmpty else { return nil }