react-native-ensys-camera-x 1.0.7

package/android/src/main/java/com/customcamera/MediaExportFormats.kt

@@ -0,0 +1,201 @@
+package com.customcamera
+
+import android.media.MediaCodecList
+import android.media.MediaMuxer
+import android.os.Build
+import java.util.Locale
+
+/**
+ * The containers the preview editor's "Export By" menu can PRODUCE, and whether this particular
+ * device can actually produce them.
+ *
+ * This is the encode-side counterpart of [ImageFormatSupport], which answers the decode-side
+ * question ("what is this file, and can we render it?"). The two are deliberately separate: a
+ * device can happily *decode* AVIF from API 31 while having no AVIF *encoder* at all, and a
+ * format that cannot be written must never appear in the menu. Everything that decides what the
+ * dropdown shows reads [encodableImageFormats] / [encodableVideoContainers], so an option is
+ * offered only when the export behind it can genuinely be performed.
+ *
+ * Capability is resolved from the platform codec list rather than from an API-level table alone,
+ * because HEIC/AVIF image encoders are hardware features that vary by device at the same API
+ * level. Results are memoised: [MediaCodecList] enumeration is not free and the menu can be
+ * opened repeatedly.
+ */
+object MediaExportFormats {
+
+  // MIME spellings of the platform's dedicated STILL-image encoders. Written as literals rather
+  // than referencing MediaFormat.MIMETYPE_IMAGE_ANDROID_HEIC / MIMETYPE_IMAGE_AVIF so this file
+  // compiles and runs identically regardless of compileSdk (they are API 28 / API 34 constants).
+  const val MIME_IMAGE_HEIC = "image/vnd.android.heic"
+  const val MIME_IMAGE_AVIF = "image/avif"
+
+  /**
+   * Still containers offered by "Export By", in menu order.
+   *
+   * The entries are [ImageFormatSupport.Format] values so the extension, MIME type and display
+   * name keep coming from the single container table — an exported `.webp` is described as
+   * `image/webp` by the cache, the publisher and the thumbnail loader without any of them
+   * learning about exporting.
+   *
+   * GIF and BMP are deliberately absent: Android ships no encoder for either, so they could
+   * never be produced. HEIC is absent because it is the same container as HEIF and offering
+   * both would present the user with one choice twice.
+   */
+  private val IMAGE_FORMAT_ORDER: List<ImageFormatSupport.Format> = listOf(
+    ImageFormatSupport.Format.JPEG,
+    ImageFormatSupport.Format.PNG,
+    ImageFormatSupport.Format.WEBP,
+    ImageFormatSupport.Format.HEIF,
+    ImageFormatSupport.Format.AVIF,
+    ImageFormatSupport.Format.PDF
+  )
+
+  /**
+   * A video container this library can write, together with everything the transcode needs:
+   * the video codec to encode into, the [MediaMuxer] output format that writes the container,
+   * and the audio codecs that container is able to carry.
+   *
+   * [supportsOrientationHint] is why a portrait clip survives the conversion. MP4 and 3GP store
+   * orientation as container metadata, so the frames are re-encoded in their coded orientation
+   * and the source's rotation is re-stamped on the copy (exactly what compression does — see
+   * [VideoRotationTranscoder.compress]). WebM has no such field, so for it the rotation is baked
+   * into the pixels instead; either way the exported clip DISPLAYS at the original's dimensions,
+   * aspect ratio and orientation.
+   *
+   * [audioMimeTypes] is the set the container's muxer accepts. A source track outside it cannot
+   * be carried through — WebM takes only Vorbis/Opus, so an AAC track is dropped rather than
+   * making the whole export fail. Callers are told so they can say it out loud.
+   */
+  enum class VideoContainer(
+    val extension: String,
+    val mimeType: String,
+    val videoMimeType: String,
+    val muxerOutputFormat: Int,
+    val minSdk: Int,
+    val supportsOrientationHint: Boolean,
+    val audioMimeTypes: Set<String>,
+    val alternateExtensions: Set<String> = emptySet()
+  ) {
+    MP4(
+      extension = "mp4",
+      mimeType = "video/mp4",
+      videoMimeType = "video/avc",
+      muxerOutputFormat = MediaMuxer.OutputFormat.MUXER_OUTPUT_MPEG_4,
+      minSdk = Build.VERSION_CODES.BASE,
+      supportsOrientationHint = true,
+      audioMimeTypes = setOf("audio/mp4a-latm", "audio/3gpp", "audio/amr-wb"),
+      alternateExtensions = setOf("m4v")
+    ),
+    WEBM(
+      extension = "webm",
+      mimeType = "video/webm",
+      videoMimeType = "video/x-vnd.on2.vp8",
+      muxerOutputFormat = MediaMuxer.OutputFormat.MUXER_OUTPUT_WEBM,
+      minSdk = Build.VERSION_CODES.BASE,
+      // The WebM writer has no rotation field, so orientation is baked into the pixels instead.
+      supportsOrientationHint = false,
+      audioMimeTypes = setOf("audio/vorbis", "audio/opus")
+    ),
+    THREE_GPP(
+      extension = "3gp",
+      mimeType = "video/3gpp",
+      videoMimeType = "video/avc",
+      // MUXER_OUTPUT_3GPP is API 26; the enum is filtered by minSdk before it is ever used.
+      muxerOutputFormat = MediaMuxer.OutputFormat.MUXER_OUTPUT_3GPP,
+      minSdk = Build.VERSION_CODES.O,
+      supportsOrientationHint = true,
+      audioMimeTypes = setOf("audio/mp4a-latm", "audio/3gpp", "audio/amr-wb"),
+      alternateExtensions = setOf("3gpp")
+    );
+
+    /** Every file extension that names this container, without the leading dot. */
+    val extensions: Set<String> get() = alternateExtensions + extension
+
+    /** The extension with its leading dot, for building file names. */
+    val dottedExtension: String get() = ".$extension"
+
+    /** Whether [audioMimeType] can be muxed into this container as-is (no audio re-encode). */
+    fun carriesAudio(audioMimeType: String?): Boolean =
+      audioMimeType != null && audioMimeTypes.contains(audioMimeType.lowercase(Locale.US))
+  }
+
+  // Encoder availability is a device property, so it is answered once and remembered.
+  private val encoderCache = HashMap<String, Boolean>()
+
+  /**
+   * Whether this device advertises an ENCODER for [mimeType]. Enumerates the regular codec list
+   * rather than calling `findEncoderForFormat`, which additionally matches resolution/frame-rate
+   * constraints — the question here is only "does this codec exist at all", and a format built
+   * for the probe would answer a different, narrower one.
+   */
+  @Synchronized
+  fun hasEncoder(mimeType: String): Boolean = encoderCache.getOrPut(mimeType) {
+    runCatching {
+      MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.any { info ->
+        info.isEncoder && info.supportedTypes.any { it.equals(mimeType, ignoreCase = true) }
+      }
+    }.getOrDefault(false)
+  }
+
+  /**
+   * Whether [format] can be WRITTEN on this device.
+   *
+   * JPEG, PNG and WebP go through `Bitmap.compress`, which every supported API level implements.
+   * HEIF and AVIF need a dedicated still-image encoder plus the HEIF muxer (API 28), so they are
+   * offered only where both exist — which is what keeps the menu honest instead of listing an
+   * option that always fails.
+   */
+  fun canEncodeImage(format: ImageFormatSupport.Format): Boolean = when (format) {
+    ImageFormatSupport.Format.JPEG,
+    ImageFormatSupport.Format.PNG,
+    ImageFormatSupport.Format.WEBP,
+    ImageFormatSupport.Format.PDF -> true
+    ImageFormatSupport.Format.HEIF ->
+      Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && hasEncoder(MIME_IMAGE_HEIC)
+    ImageFormatSupport.Format.AVIF ->
+      // MediaFormat.MIMETYPE_IMAGE_AVIF exists from API 34; below that no encoder can be
+      // addressed even if the hardware has one.
+      Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE && hasEncoder(MIME_IMAGE_AVIF)
+    else -> false
+  }
+
+  /** The encoder MIME type used to write [format], or null when it is not encodable here. */
+  fun stillEncoderMimeType(format: ImageFormatSupport.Format): String? = when (format) {
+    ImageFormatSupport.Format.HEIF -> MIME_IMAGE_HEIC
+    ImageFormatSupport.Format.AVIF -> MIME_IMAGE_AVIF
+    else -> null
+  }
+
+  /** Still containers this device can export to, in menu order. */
+  fun encodableImageFormats(): List<ImageFormatSupport.Format> =
+    IMAGE_FORMAT_ORDER.filter { canEncodeImage(it) }
+
+  /** Whether [container] can be written on this device (API level + a usable video encoder). */
+  fun canEncodeVideo(container: VideoContainer): Boolean =
+    Build.VERSION.SDK_INT >= container.minSdk && hasEncoder(container.videoMimeType)
+
+  /** Video containers this device can export to, in menu order. */
+  fun encodableVideoContainers(): List<VideoContainer> =
+    VideoContainer.entries.filter { canEncodeVideo(it) }
+
+  private val VIDEO_BY_EXTENSION: Map<String, VideoContainer> =
+    VideoContainer.entries.flatMap { container ->
+      container.extensions.map { it to container }
+    }.toMap()
+
+  /**
+   * The video container the extension of [name] (a file name, path or URI) denotes, or null.
+   *
+   * Used by the cache and the publisher to describe an exported clip by its real container
+   * instead of assuming `video/mp4` for every video — the same class of "the name no longer
+   * describes the bytes" bug [ImageFormatSupport] prevents on the stills side.
+   */
+  fun videoContainerFromFileName(name: String?): VideoContainer? {
+    if (name.isNullOrEmpty()) return null
+    val path = name.substringBefore('?').substringBefore('#')
+    val segment = path.substringAfterLast('/', path)
+    val extension = segment.substringAfterLast('.', "").lowercase(Locale.US)
+    if (extension.isEmpty()) return null
+    return VIDEO_BY_EXTENSION[extension]
+  }
+}

package/android/src/main/java/com/customcamera/MediaFileIo.kt

@@ -0,0 +1,310 @@
+package com.customcamera
+
+import android.os.StatFs
+import android.util.Log
+import java.io.File
+import java.io.FileInputStream
+import java.io.FileOutputStream
+import java.io.InputStream
+import java.io.RandomAccessFile
+import java.security.MessageDigest
+
+/**
+ * File plumbing shared by every stage that handles media which can be ARBITRARILY LARGE.
+ *
+ * A still photo is a couple of megabytes, so the historic "copy it with an 8 KiB buffer and
+ * SHA-256 the whole thing" approach was invisible. A recording is not: a few minutes of HD is
+ * hundreds of megabytes and a long take can pass a gigabyte. At that size the same code turns
+ * one capture into several full passes over the file — the recording→preview handoff sits on a
+ * frozen viewfinder for tens of seconds, the send path stalls, and each redundant copy needs
+ * another file's worth of free space, which is how a long recording ends in a write failure or
+ * an out-of-space crash rather than a video.
+ *
+ * Everything here exists to make the per-byte cost of a large clip as close to zero as the
+ * platform allows:
+ *
+ *  - [relocate] renames when it can, so moving a 1 GB clip inside one volume costs no I/O at all
+ *    instead of 1 GB read + 1 GB written + 1 GB of extra space held.
+ *  - [copy] / [copyStream] move bytes in 1 MiB units through the kernel (`transferTo`) instead
+ *    of 8 KiB user-space hops, and NEVER leave a truncated destination behind on failure.
+ *  - [contentSignature] keeps duplicate detection O(1) in file size past a threshold, so hashing
+ *    stops being a multi-second, whole-file read on the capture and send paths.
+ *  - [usableSpaceBytes] lets callers refuse to start work that cannot possibly fit.
+ */
+internal object MediaFileIo {
+  private const val TAG = "MediaFileIo"
+
+  /**
+   * 1 MiB. Copying 1 GB with the old 8 KiB buffer is ~131,000 read/write syscall pairs; at 1 MiB
+   * it is ~1,000. The buffer itself is short-lived and dwarfed by the bitmaps the app already
+   * allocates, so there is no memory trade-off worth making here.
+   */
+  const val COPY_BUFFER_BYTES: Int = 1 shl 20
+
+  /**
+   * Files at or below this size are hashed in FULL, exactly as before — every photo, every
+   * document, every short clip. Duplicate detection for them is unchanged.
+   *
+   * Above it, hashing the whole file is the single most expensive thing in the capture pipeline
+   * and it is pure overhead: the signature is only ever used to notice that the same bytes are
+   * being stored twice, and [contentSignature]'s bounded form answers that question just as well
+   * for a video. 16 MiB reads in well under a frame's worth of time on any device this library
+   * supports.
+   */
+  private const val FULL_HASH_MAX_BYTES: Long = 16L * 1024L * 1024L
+
+  /** Bytes sampled at each of the three probe points of a large file's signature. */
+  private const val SIGNATURE_WINDOW_BYTES: Int = 2 * 1024 * 1024
+
+  /** Head-room kept free by default when a relocation has to write a second copy. */
+  const val DEFAULT_SPACE_MARGIN_BYTES: Long = 32L * 1024L * 1024L
+
+  /** How a [relocate] / [duplicate] request actually resolved. */
+  enum class Outcome {
+    /** Directory entry moved. No bytes read or written, no free space consumed. */
+    RENAMED,
+
+    /** Bytes were streamed to the destination (and, for [relocate], the source unlinked). */
+    COPIED,
+
+    /** The destination volume cannot hold another copy. The source is untouched. */
+    INSUFFICIENT_SPACE,
+
+    /** The operation failed. The source is untouched and no partial destination remains. */
+    FAILED;
+
+    val succeeded: Boolean get() = this == RENAMED || this == COPIED
+  }
+
+  /**
+   * Move [source] to [dest], preferring a rename.
+   *
+   * A rename is a directory-entry update: it does not read or write a single byte of content and
+   * needs NO free space, so relocating a large recording within one volume becomes instant and
+   * works even on a nearly full device. Renames only work within one filesystem, so the
+   * cross-volume case (internal cache → external app files dir) falls back to [copy] plus
+   * unlinking the source — still a genuine move as far as the caller and the disk are concerned.
+   *
+   * The free-space check is deliberately applied ONLY on the copy path, and only after the rename
+   * has been tried. Checking up front would refuse a 2 GB clip that a rename could have relocated
+   * on a device with 1 GB free — exactly the case this class exists to make work.
+   *
+   * [source] is never touched unless the relocation completed, so a caller cannot mistake a
+   * failure for a success and lose the only copy.
+   */
+  fun relocate(
+    source: File,
+    dest: File,
+    spaceMarginBytes: Long = DEFAULT_SPACE_MARGIN_BYTES
+  ): Outcome {
+    if (!source.exists()) return Outcome.FAILED
+    if (source.absolutePath == dest.absolutePath) return Outcome.RENAMED
+
+    dest.parentFile?.mkdirs()
+    // A stale destination makes renameTo fail on some filesystems, and nothing here appends to
+    // one, so clear it first.
+    if (dest.exists()) runCatching { dest.delete() }
+
+    if (runCatching { source.renameTo(dest) }.getOrDefault(false)) return Outcome.RENAMED
+
+    val required = source.length() + spaceMarginBytes
+    val parent = dest.parentFile
+    if (parent != null && !hasRoomFor(parent, required)) {
+      Log.w(TAG, "No room to copy ${source.name} (${source.length()} bytes) to ${parent.path}")
+      return Outcome.INSUFFICIENT_SPACE
+    }
+
+    if (!copy(source, dest)) return Outcome.FAILED
+    // The bytes are safely at the destination; failing to unlink the source only wastes cache
+    // space (the orphan sweep collects it later), so it is not part of the success contract.
+    runCatching { source.delete() }
+    return Outcome.COPIED
+  }
+
+  /**
+   * Copy [source] to [dest], keeping the source. Unlike [relocate] this ALWAYS writes a second
+   * copy, so the free-space check is unconditional.
+   */
+  fun duplicate(
+    source: File,
+    dest: File,
+    spaceMarginBytes: Long = DEFAULT_SPACE_MARGIN_BYTES
+  ): Outcome {
+    if (!source.exists()) return Outcome.FAILED
+
+    dest.parentFile?.mkdirs()
+    val parent = dest.parentFile
+    if (parent != null && !hasRoomFor(parent, source.length() + spaceMarginBytes)) {
+      Log.w(TAG, "No room to copy ${source.name} (${source.length()} bytes) to ${parent.path}")
+      return Outcome.INSUFFICIENT_SPACE
+    }
+    return if (copy(source, dest)) Outcome.COPIED else Outcome.FAILED
+  }
+
+  /**
+   * Copy [source] to [dest] via the kernel, returning false on failure.
+   *
+   * `FileChannel.transferTo` hands the copy to the kernel, which moves the data without bouncing
+   * it through a user-space buffer at all. It is allowed to transfer less than requested, so the
+   * loop continues until the whole file has moved, and it can legitimately refuse to progress on
+   * some filesystems — that case finishes the job with an ordinary buffered read/write loop
+   * rather than abandoning a half-written file.
+   *
+   * On ANY failure the partial destination is deleted. That matters more than the speed: the old
+   * code left whatever bytes it had managed to write in place, so a copy interrupted by a full
+   * disk produced a truncated video file that every later stage (metadata read, thumbnail decode,
+   * playback, upload) treated as real and failed on.
+   */
+  fun copy(source: File, dest: File): Boolean {
+    dest.parentFile?.mkdirs()
+    return try {
+      FileInputStream(source).use { input ->
+        FileOutputStream(dest).use { output ->
+          val inChannel = input.channel
+          val outChannel = output.channel
+          val size = inChannel.size()
+          var position = 0L
+          var stalled = false
+          while (position < size) {
+            val transferred = inChannel.transferTo(position, size - position, outChannel)
+            if (transferred <= 0L) {
+              stalled = true
+              break
+            }
+            position += transferred
+          }
+          if (stalled) {
+            // FileInputStream/FileOutputStream share their position with their channel, so
+            // resuming the streams from `position` continues exactly where transferTo stopped.
+            inChannel.position(position)
+            outChannel.position(position)
+            val buffer = ByteArray(COPY_BUFFER_BYTES)
+            while (true) {
+              val read = input.read(buffer)
+              if (read < 0) break
+              output.write(buffer, 0, read)
+            }
+          }
+        }
+      }
+      true
+    } catch (t: Throwable) {
+      Log.e(TAG, "Copy failed: ${source.absolutePath} -> ${dest.absolutePath}", t)
+      runCatching { dest.delete() }
+      false
+    }
+  }
+
+  /**
+   * Stream [input] into [dest] with the large buffer, deleting a partial [dest] and rethrowing if
+   * the write fails.
+   *
+   * Rethrowing is deliberate: callers distinguish "the media could not be stored" from "the media
+   * was stored" by whether this threw, and a truncated file left on disk would make an
+   * out-of-space failure look like a successful capture.
+   */
+  fun copyStream(input: InputStream, dest: File): Long {
+    dest.parentFile?.mkdirs()
+    return try {
+      FileOutputStream(dest).use { output -> input.copyTo(output, COPY_BUFFER_BYTES) }
+    } catch (t: Throwable) {
+      runCatching { dest.delete() }
+      throw t
+    }
+  }
+
+  /**
+   * A stable content signature used for duplicate detection.
+   *
+   * Small files (≤ [FULL_HASH_MAX_BYTES]) are hashed in full — identical semantics to the plain
+   * SHA-256 this replaces. Larger files are described by their exact length plus three 2 MiB
+   * windows (head, middle, tail), which is bounded work regardless of whether the clip is 30 MB
+   * or 3 GB.
+   *
+   * This is a de-duplication key, not a security primitive: two DIFFERENT videos that share an
+   * identical length AND identical head, middle and tail windows would collide, which cannot
+   * happen for independently encoded clips. What it buys is that recording a long video no longer
+   * spends multiple seconds (and a full extra read pass, twice — once when caching and once when
+   * publishing) computing a hash that is only ever compared for equality.
+   *
+   * Returns "" when the file cannot be read, matching the previous behaviour: callers treat an
+   * empty signature as "unknown", which simply skips duplicate detection.
+   */
+  fun contentSignature(file: File): String {
+    return try {
+      val length = file.length()
+      val digest = MessageDigest.getInstance("SHA-256")
+
+      if (length <= FULL_HASH_MAX_BYTES) {
+        FileInputStream(file).use { input ->
+          val buffer = ByteArray(COPY_BUFFER_BYTES)
+          while (true) {
+            val read = input.read(buffer)
+            if (read < 0) break
+            digest.update(buffer, 0, read)
+          }
+        }
+      } else {
+        // Fold the length in first so two clips that happen to share a sampled window are still
+        // separated by their size, and so the sampled form can never collide with the full-hash
+        // form of a different file.
+        digest.update(length.toString().toByteArray(Charsets.US_ASCII))
+        RandomAccessFile(file, "r").use { raf ->
+          val window = ByteArray(SIGNATURE_WINDOW_BYTES)
+          val offsets = longArrayOf(
+            0L,
+            (length / 2) - (SIGNATURE_WINDOW_BYTES / 2),
+            length - SIGNATURE_WINDOW_BYTES
+          )
+          for (offset in offsets) {
+            raf.seek(offset.coerceAtLeast(0L))
+            raf.readFully(window)
+            digest.update(window)
+          }
+        }
+      }
+
+      digest.digest().joinToString("") { "%02x".format(it) }
+    } catch (t: Throwable) {
+      Log.w(TAG, "Failed to compute content signature for ${file.name}", t)
+      ""
+    }
+  }
+
+  /**
+   * Bytes still writable on the volume that holds [dir].
+   *
+   * Returns [Long.MAX_VALUE] when the platform will not answer, so an unknown figure never blocks
+   * a capture the device could actually have completed.
+   */
+  fun usableSpaceBytes(dir: File): Long {
+    runCatching {
+      val stat = StatFs(dir.absolutePath)
+      val available = stat.availableBlocksLong * stat.blockSizeLong
+      if (available > 0L) return available
+    }
+    return runCatching { dir.usableSpace }.getOrNull()?.takeIf { it > 0L } ?: Long.MAX_VALUE
+  }
+
+  /** True when [dir]'s volume has room for [requiredBytes] plus a small working margin. */
+  fun hasRoomFor(dir: File, requiredBytes: Long): Boolean =
+    usableSpaceBytes(dir) >= requiredBytes
+
+  /**
+   * Format [bytes] for a figure that is REDRAWN CONTINUOUSLY — the live size of a recording in
+   * flight, updated once a second.
+   *
+   * Fixed at megabytes on purpose. An adaptive formatter (B → KB → MB) is the right call for a
+   * static label, but a ticking one would change unit under the user in the first seconds of every
+   * recording (`820 KB` → `1.0 MB`), and each unit change resizes the centred pill it sits in. One
+   * unit, one decimal, all the way up to a gigabyte.
+   */
+  fun formatMegabytes(bytes: Long): String {
+    val mb = bytes.coerceAtLeast(0L) / (1024.0 * 1024.0)
+    return if (mb >= 1024.0) {
+      Localization.formatUnit("fileSizeGb", "{0} GB", "%.2f", mb / 1024.0)
+    } else {
+      Localization.formatUnit("fileSizeMb", "{0} MB", "%.1f", mb)
+    }
+  }
+}