react-native-audio-browser 0.2.0-next.10 → 0.2.0-next.11

package/android/src/test/java/com/audiobrowser/browser/BrowserManagerTest.kt

@@ -1,19 +1,32 @@
 package com.audiobrowser.browser
 
+import com.audiobrowser.TestFixtures.imageRowItem
+import com.audiobrowser.TestFixtures.resolvedTrack
+import com.audiobrowser.TestFixtures.staticRoute
+import com.audiobrowser.TestFixtures.track
+import com.audiobrowser.util.BrowserPathHelper
 import kotlinx.coroutines.runBlocking
-import org.junit.Assert.*
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.robolectric.RobolectricTestRunner
 
-// TODO: Most tests disabled — BrowserConfig API changed (routes is now Array<NativeRouteEntry>).
-// When revived, add expandQueueFromContextualUrl glue tests: found id → its
-// SectionScope section as the queue; vanished id → null (single-track
-// fallback). The section logic and the caller fallback are covered
-// (SectionScopeTest, TrackSelectorTests); the wiring between them is not.
-// Tests that used BrowserSource/BrowserList need to be rewritten.
-
+/**
+ * Navigation and queue-expansion glue.
+ *
+ * [BrowserManager.expandQueueFromContextualUrl] is the seam between the page a listener tapped in
+ * and the queue that starts playing. Its two halves are covered on their own — the section logic in
+ * [SectionScopeTest], the caller's single-track fallback in the player tests — but the wiring
+ * between them is what decides whether tapping row 3 of a page resumes the right station, and only
+ * these tests exercise it.
+ *
+ * Routes serve `browseStatic`, the one browse arm that needs neither the JNI bridge nor HTTP.
+ * Robolectric is required for `android.net.Uri` (contextual-URL parsing) and
+ * `android.util.LruCache` (the content cache).
+ */
 @RunWith(RobolectricTestRunner::class)
 class BrowserManagerTest {
 
@@ -24,6 +37,22 @@ class BrowserManagerTest {
     browserManager = BrowserManager()
   }
 
+  /** Configures a single static route at [path] serving [children] as its page. */
+  private fun servePage(
+    path: String,
+    vararg children: com.margelo.nitro.audiobrowser.Track,
+    singleTrack: Boolean = false,
+  ) {
+    browserManager.config =
+      BrowserConfig(
+        routes =
+          arrayOf(staticRoute(path, resolvedTrack(url = path, children = arrayOf(*children)))),
+        singleTrack = singleTrack,
+      )
+  }
+
+  private fun contextual(path: String, trackId: String) = BrowserPathHelper.build(path, trackId)
+
   @Test
   fun `getPath returns default path initially`() {
     assertEquals("/", browserManager.getPath())
@@ -64,4 +93,134 @@ class BrowserManagerTest {
       } catch (_: ContentNotFoundException) {}
     }
   }
+
+  @Test
+  fun `navigate serves a static route and gives playable children contextual urls`() = runBlocking {
+    servePage("/library", track(src = "a", title = "A"), track(src = "b", title = "B"))
+
+    val resolved = browserManager.navigate("/library")
+
+    assertEquals(listOf("A", "B"), resolved.children?.map { it.title })
+    // The tap target: a child's url is rewritten to point back at this page plus its own id.
+    assertEquals(
+      listOf(contextual("/library", "a"), contextual("/library", "b")),
+      resolved.children?.map { it.url },
+    )
+    assertEquals("/library", browserManager.getPath())
+  }
+
+  // MARK: - expandQueueFromContextualUrl
+
+  @Test
+  fun `expandQueueFromContextualUrl scopes the queue to the tapped section`() = runBlocking {
+    servePage(
+      "/home",
+      track(src = "a", groupTitle = "Recent"),
+      track(src = "b", groupTitle = "Recent"),
+      track(src = "c", groupTitle = "Popular"),
+      track(src = "d", groupTitle = "Popular"),
+    )
+
+    val expanded = browserManager.expandQueueFromContextualUrl(contextual("/home", "c"))
+
+    // "Popular" only — a page aggregating sections must not leak next/previous across them.
+    val (queue, index) = requireNotNull(expanded)
+    assertEquals(listOf("c", "d"), queue.map { it.src })
+    assertEquals(0, index)
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl indexes the tapped track within its section`() = runBlocking {
+    servePage(
+      "/home",
+      track(src = "a", groupTitle = "Recent"),
+      track(src = "b", groupTitle = "Popular"),
+      track(src = "c", groupTitle = "Popular"),
+    )
+
+    val (queue, index) =
+      requireNotNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "c")))
+
+    assertEquals(listOf("b", "c"), queue.map { it.src })
+    assertEquals(1, index)
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl returns null when the id has vanished from the page`() =
+    runBlocking {
+      // The stored url points at a track the page no longer lists — the page changed under a
+      // resumed session. Queueing the current list would resume the wrong station, so expansion
+      // aborts and the caller falls back to the stored single track.
+      servePage("/home", track(src = "a"), track(src = "b"))
+
+      assertNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "gone")))
+    }
+
+  @Test
+  fun `expandQueueFromContextualUrl returns null for a non-contextual url`() = runBlocking {
+    servePage("/home", track(src = "a"))
+
+    assertNull(browserManager.expandQueueFromContextualUrl("/home"))
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl returns null when the page has no children`() = runBlocking {
+    browserManager.config =
+      BrowserConfig(routes = arrayOf(staticRoute("/home", resolvedTrack(url = "/home"))))
+
+    assertNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "a")))
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl expands an image row into its items`() = runBlocking {
+    servePage(
+      "/home",
+      track(
+        title = "Most Played",
+        src = null,
+        imageRow = arrayOf(imageRowItem("r1"), imageRowItem("r2")),
+      ),
+      track(src = "a"),
+    )
+
+    val (queue, index) =
+      requireNotNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "r2")))
+
+    // A tile tap queues its row, not the list rows beside it.
+    assertEquals(listOf("r1", "r2"), queue.map { it.src })
+    assertEquals(1, index)
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl drops unplayable siblings`() = runBlocking {
+    servePage(
+      "/home",
+      track(src = "a", groupTitle = "Mixed"),
+      // A browsable row sitting inside the same section — no src, so not queueable.
+      track(src = null, groupTitle = "Mixed").copy(url = "/sub"),
+      track(src = "b", groupTitle = "Mixed"),
+    )
+
+    val (queue, index) =
+      requireNotNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "b")))
+
+    assertEquals(listOf("a", "b"), queue.map { it.src })
+    assertEquals(1, index)
+  }
+
+  @Test
+  fun `expandQueueFromContextualUrl honours singleTrack`() = runBlocking {
+    servePage(
+      "/home",
+      track(src = "a", groupTitle = "Recent"),
+      track(src = "b", groupTitle = "Recent"),
+      singleTrack = true,
+    )
+
+    val (queue, index) =
+      requireNotNull(browserManager.expandQueueFromContextualUrl(contextual("/home", "b")))
+
+    assertEquals(listOf("b"), queue.map { it.src })
+    assertEquals(0, index)
+  }
 }

package/android/src/test/java/com/audiobrowser/tls/AiaCertChaserTest.kt

@@ -7,6 +7,7 @@ import java.security.cert.PKIXParameters
 import java.security.cert.TrustAnchor
 import java.security.cert.X509Certificate
 import java.util.Date
+import javax.security.auth.x500.X500Principal
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
 import org.junit.Test
@@ -15,12 +16,51 @@ import org.mockito.Mockito.`when`
 
 class AiaCertChaserTest {
 
-  /** A certificate whose AIA extension value is exactly [extensionValue]. */
+  /**
+   * A certificate whose AIA extension value is exactly [extensionValue].
+   *
+   * Subject and issuer are stubbed to distinct principals on purpose: an unstubbed mock answers
+   * null to both, which `completeChain` would read as a self-signed root and stop on before
+   * fetching anything.
+   */
   private fun certWithAia(extensionValue: ByteArray): X509Certificate =
     mock(X509Certificate::class.java).also {
       `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(extensionValue)
+      `when`(it.subjectX500Principal).thenReturn(X500Principal("CN=leaf"))
+      `when`(it.issuerX500Principal).thenReturn(X500Principal("CN=issuer"))
     }
 
+  /** A DER tag-length-value, with the length in whichever form fits. */
+  private fun der(tag: Int, content: ByteArray): ByteArray {
+    val length =
+      when (val n = content.size) {
+        in 0..0x7F -> byteArrayOf(n.toByte())
+        in 0x80..0xFF -> byteArrayOf(0x81.toByte(), n.toByte())
+        in 0x100..0xFFFF -> byteArrayOf(0x82.toByte(), (n shr 8).toByte(), n.toByte())
+        else -> byteArrayOf(0x83.toByte(), (n shr 16).toByte(), (n shr 8).toByte(), n.toByte())
+      }
+    return byteArrayOf(tag.toByte()) + length + content
+  }
+
+  /** A well-formed AIA extension value listing [urls] as caIssuers locations. */
+  private fun aiaExtension(urls: List<String>): ByteArray {
+    val caIssuersOid = byteArrayOf(0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02)
+    val descriptions =
+      urls.fold(ByteArray(0)) { acc, url ->
+        acc + der(0x30, der(0x06, caIssuersOid) + der(0x86, url.toByteArray(Charsets.US_ASCII)))
+      }
+    return der(0x04, der(0x30, descriptions))
+  }
+
+  @Test
+  fun `the AIA fixture builder round-trips through the parser`() {
+    // Guards the two tests below: if this builder were malformed they would pass by parsing
+    // nothing at all, rather than by the cap doing its job.
+    val urls = listOf("http://ca1.example/i.crt", "http://ca2.example/i.crt")
+
+    assertEquals(urls, AiaCertChaser.extractCaIssuerUrls(certWithAia(aiaExtension(urls))))
+  }
+
   @Test(timeout = 5_000)
   fun `a negative long-form length does not hang the parser`() {
     // OCTET STRING { SEQUENCE { tag 0x00, long-form length 0xFFFFFFFA = -6 } }.
@@ -73,7 +113,7 @@ class AiaCertChaserTest {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     // Fetcher knows only the R13 URL (the leaf's AIA pointer); empty for the root URL.
-    val fetch = { url: String ->
+    val fetch = { url: String, _: Long ->
       if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
     }
 
@@ -90,8 +130,8 @@ class AiaCertChaserTest {
 
     // A PKCS#7-style bundle where the genuine issuer is not first must still be selected.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
       }
 
     assertEquals(listOf(leaf, r13), completed)
@@ -103,7 +143,7 @@ class AiaCertChaserTest {
     var fetches = 0
 
     val completed =
-      AiaCertChaser.completeChain(listOf(root)) {
+      AiaCertChaser.completeChain(listOf(root)) { _, _ ->
         fetches++
         emptyList()
       }
@@ -112,11 +152,115 @@ class AiaCertChaserTest {
     assertEquals(0, fetches)
   }
 
+  @Test
+  fun `completeChain stops at a chain that already reaches a trust anchor`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    val fetched = mutableListOf<String>()
+
+    // R13's own AIA points at the ISRG root, so without knowing the anchors this walks one hop
+    // too far and pays for a second blocking fetch on the ordinary rescue path.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { url, _ ->
+        fetched.add(url)
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else listOf(root)
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(listOf("http://r13.i.lencr.org/"), fetched)
+  }
+
+  @Test
+  fun `completeChain fetches nothing when the presented chain is already anchored`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    var fetches = 0
+
+    // The shape of every non-path failure — expiry, hostname mismatch, CT — where the server
+    // sent a complete chain and validation failed for some other reason.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf, r13),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { _, _ ->
+        fetches++
+        emptyList()
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(0, fetches)
+  }
+
+  @Test
+  fun `completeChain tries only a few of a certificate's CA-Issuers URLs`() {
+    // The extension is authored by the server that just failed validation, and nothing limits
+    // how many URLs it lists. Each one costs a blocking connect on the handshake thread, so
+    // hundreds of them are a denial of service whatever each individual fetch costs.
+    val manyUrls = (1..500).map { "http://ca$it.example/issuer.crt" }
+    val cert = certWithAia(aiaExtension(manyUrls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(AiaCertChaser.MAX_URLS_PER_CERT, fetched.size)
+  }
+
+  @Test
+  fun `duplicate CA-Issuers URLs do not consume the URL cap`() {
+    // 500 copies of one dead URL followed by a distinct one: the cap must buy distinct hosts,
+    // not three visits to the same dead one.
+    val urls = List(500) { "http://ca.example/issuer.crt" } + "http://ca-b.example/issuer.crt"
+    val cert = certWithAia(aiaExtension(urls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(listOf("http://ca.example/issuer.crt", "http://ca-b.example/issuer.crt"), fetched)
+  }
+
+  @Test
+  fun `completeChain stops fetching once its wall-clock budget is spent`() {
+    val cert = certWithAia(aiaExtension((1..500).map { "http://ca$it.example/issuer.crt" }))
+    var fetches = 0
+    var nanos = 0L
+    val deadlines = mutableListOf<Long>()
+
+    // Each fetch "takes" 8s against a 20s budget, so the walk must stop after a handful even
+    // though the URL cap alone would have allowed more.
+    AiaCertChaser.completeChain(
+      listOf(cert),
+      maxUrlsPerCert = 500,
+      budgetMs = 20_000,
+      nowNanos = { nanos },
+    ) { _, deadline ->
+      fetches++
+      deadlines.add(deadline)
+      nanos += 8_000_000_000
+      emptyList()
+    }
+
+    assertEquals(3, fetches)
+    // Every fetch is handed the same walk-wide deadline, so it can clip its own I/O to it —
+    // the budget bounds the fetches themselves, not just how many of them start.
+    assertEquals(listOf(20_000_000_000L, 20_000_000_000L, 20_000_000_000L), deadlines)
+  }
+
   @Test
   fun `completeChain stops when the issuer cannot be fetched`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
 
-    val completed = AiaCertChaser.completeChain(listOf(leaf)) { emptyList() }
+    val completed = AiaCertChaser.completeChain(listOf(leaf)) { _, _ -> emptyList() }
 
     assertEquals(listOf(leaf), completed)
   }
@@ -134,8 +278,8 @@ class AiaCertChaserTest {
 
     // After AIA chasing splices in R13, the chain validates to the trusted root.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
     validatePath(completed, root, date) // must not throw
   }