react-native-ensys-camera-x 1.0.7

package/android/src/main/java/com/customcamera/UploadService.kt

@@ -0,0 +1,909 @@
+package com.customcamera
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.ContentResolver
+import android.content.Context
+import android.content.Intent
+import android.content.SharedPreferences
+import android.content.pm.ServiceInfo
+import android.net.Uri
+import android.os.Build
+import android.os.IBinder
+import android.provider.MediaStore
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.facebook.react.modules.core.DeviceEventManagerModule
+import com.google.gson.Gson
+import okhttp3.MediaType
+import okhttp3.MediaType.Companion.toMediaTypeOrNull
+import okhttp3.MultipartBody
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody
+import okio.BufferedSink
+import java.io.FileNotFoundException
+import java.io.IOException
+import java.net.ConnectException
+import java.net.NoRouteToHostException
+import java.net.UnknownHostException
+import java.util.concurrent.ExecutorService
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicInteger
+import javax.net.ssl.SSLException
+
+class UploadService : Service() {
+
+    private lateinit var executorService: ExecutorService
+    private val client = OkHttpClient.Builder()
+        .connectTimeout(30, TimeUnit.SECONDS)
+        // Read timeout covers the wait between finishing the request body and receiving
+        // the response headers. Endpoints that post-process large uploads (httpbin, for
+        // one, echoes the whole file back in its JSON response) legitimately take more
+        // than 30s for big videos — the old 30s limit turned those into spurious
+        // "timeout" failure notifications. No callTimeout on purpose: an overall cap
+        // would abort long-but-progressing uploads.
+        .readTimeout(120, TimeUnit.SECONDS)
+        .writeTimeout(60, TimeUnit.SECONDS)
+        .build()
+
+    private lateinit var sharedPreferences: SharedPreferences
+    private lateinit var gson: Gson
+
+    // Tracks upload batches that have been accepted but not yet finished. A bare
+    // stopSelf() would tear the service down as soon as ONE batch finishes even if
+    // a second startUpload() call queued another batch behind it on the (single
+    // threaded) executor — killing that batch's upload mid-flight. stopSelf(startId)
+    // combined with this counter ensures the service only stops once every accepted
+    // batch has actually completed.
+    private val activeJobs = AtomicInteger(0)
+
+    // Latest progress notification posted by the batch currently uploading. When a second
+    // batch arrives while one is in flight, onStartCommand must still call startForeground()
+    // (mandatory after every startForegroundService()) — reusing this keeps that call from
+    // stomping the live progress bar back to "Preparing files… (0%)".
+    @Volatile
+    private var lastProgressNotification: Notification? = null
+
+    override fun onCreate() {
+        super.onCreate()
+        executorService = Executors.newSingleThreadExecutor()
+        sharedPreferences = getSharedPreferences("UploadServicePrefs", Context.MODE_PRIVATE)
+        gson = Gson()
+        if (SYSTEM_NOTIFICATIONS_ENABLED) {
+            createNotificationChannel()
+        }
+        recoverUploadStateIfNeeded()
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent == null) {
+            stopIfIdle(startId)
+            return START_NOT_STICKY
+        }
+
+        val action = intent.action
+        if (action == ACTION_START_UPLOAD) {
+            val uris = intent.getStringArrayListExtra(EXTRA_URIS)
+            val uploadUrl = intent.getStringExtra(EXTRA_UPLOAD_URL)
+
+            if (uris.isNullOrEmpty() || uploadUrl.isNullOrBlank()) {
+                stopIfIdle(startId)
+                return START_NOT_STICKY
+            }
+
+            val jobsNowActive = activeJobs.incrementAndGet()
+
+            // Start foreground immediately. If another batch is already mid-upload, reuse
+            // its latest progress notification instead of resetting the bar to 0%.
+            // With system notifications disabled the service was launched via a plain
+            // startService() (see CustomCameraModule.startUpload), so there is no
+            // startForeground() obligation — and none is possible, since startForeground
+            // requires posting a notification.
+            if (SYSTEM_NOTIFICATIONS_ENABLED) {
+                val initialNotification =
+                    (if (jobsNowActive > 1) lastProgressNotification else null)
+                        ?: buildProgressNotification(0, 0, uris.size)
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                    startForeground(
+                        NOTIFICATION_ID,
+                        initialNotification,
+                        ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC
+                    )
+                } else {
+                    startForeground(NOTIFICATION_ID, initialNotification)
+                }
+            }
+
+            // Queue the background upload
+            executorService.execute {
+                performUpload(uris, uploadUrl, startId)
+            }
+        } else if (action == ACTION_GET_NOTIFICATION_HISTORY) {
+            // Handle request for notification history. Callers use a regular startService for
+            // this action, so there is no startForeground() obligation here.
+            val history = getNotificationHistory()
+            val resultIntent = Intent(ACTION_GET_NOTIFICATION_HISTORY).apply {
+                putExtra(EXTRA_NOTIFICATION_HISTORY, history)
+            }
+            sendBroadcast(resultIntent)
+            stopIfIdle(startId)
+        } else {
+            stopIfIdle(startId)
+        }
+
+        return START_NOT_STICKY
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onDestroy() {
+        executorService.shutdownNow()
+        super.onDestroy()
+    }
+
+    /** Stops the service via [startId] only if no upload batch is currently in flight. */
+    private fun stopIfIdle(startId: Int) {
+        if (activeJobs.get() <= 0) {
+            stopSelf(startId)
+        }
+    }
+
+    /**
+     * Marks one upload batch as finished. Uses [stopSelf] with the batch's own
+     * [startId] rather than the no-argument overload so a batch that is still
+     * running (queued behind this one on the executor) is never torn down
+     * prematurely — the service only actually stops once every accepted batch
+     * has completed.
+     */
+    private fun completeJob(startId: Int) {
+        if (activeJobs.decrementAndGet() <= 0) {
+            stopSelf(startId)
+        }
+    }
+
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val notificationManager: NotificationManager =
+                getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+            val cfg = notificationConfig
+
+            // Low-importance channel for the ongoing upload-progress bar: shown silently in
+            // the shade with no heads-up or sound, which suits a frequently-updating progress
+            // notification.
+            val progressChannel = NotificationChannel(
+                cfg.progressChannelId,
+                cfg.progressChannelName
+                    ?: Localization.getString("uploadProgressTitle", "Upload Progress"),
+                NotificationManager.IMPORTANCE_LOW
+            ).apply {
+                description = Localization.getString("uploadProgressDescription", "Displays progress of background uploads")
+            }
+            notificationManager.createNotificationChannel(progressChannel)
+
+            // Separate HIGH-importance channel for the terminal success/failure notifications.
+            // A channel's importance is fixed once created, so posting these on the silent
+            // progress channel permanently clamps them to silent — the user would never see a
+            // heads-up (or hear a sound) telling them an upload finished or failed. A dedicated
+            // channel lets the result actually surface.
+            val resultChannel = NotificationChannel(
+                cfg.resultChannelId,
+                cfg.resultChannelName
+                    ?: Localization.getString("uploadStatusTitle", "Upload Status"),
+                NotificationManager.IMPORTANCE_HIGH
+            ).apply {
+                description = Localization.getString("uploadStatusDescription", "Notifies when a background upload completes or fails")
+            }
+            notificationManager.createNotificationChannel(resultChannel)
+        }
+    }
+
+    private fun recoverUploadStateIfNeeded() {
+        val savedState = sharedPreferences.getString("upload_state", null) ?: return
+        try {
+            val uploadState = gson.fromJson<UploadState>(savedState, UploadState::class.java)
+            if (uploadState != null && !uploadState.completed) {
+                // An in-flight state at service creation means the previous process died
+                // mid-upload — that upload no longer exists. Re-posting its progress
+                // notification here (as this used to do) produced a frozen, setOngoing
+                // (unswipeable) "Uploading media" bar that nothing would ever update or
+                // remove, re-appearing on EVERY service start — including plain history
+                // queries. Cancel any leftover bar and record the interruption in history
+                // instead; a new batch posts its own fresh notification right after this.
+                NotificationManagerCompat.from(this).cancel(NOTIFICATION_ID)
+                addToNotificationHistory(
+                    NotificationHistoryItem(
+                        title = Localization.getString("uploadInterruptedTitle", "Upload interrupted"),
+                        message = Localization.getString("uploadInterruptedMessage", "A previous upload stopped before completing (file {0} of {1}).", uploadState.currentFile, uploadState.totalFiles),
+                        timestamp = uploadState.timestamp,
+                        type = "failure"
+                    )
+                )
+            }
+        } catch (e: Exception) {
+            // Corrupt state — fall through and clear it below
+        }
+        clearUploadState()
+    }
+
+    private fun getUriSize(uri: Uri): Long {
+        var size = 0L
+        try {
+            contentResolver.query(uri, arrayOf(MediaStore.Images.Media.SIZE), null, null, null)?.use { cursor ->
+                if (cursor.moveToFirst()) {
+                    val sizeIndex = cursor.getColumnIndex(MediaStore.Images.Media.SIZE)
+                    if (sizeIndex != -1) {
+                        size = cursor.getLong(sizeIndex)
+                    }
+                }
+            }
+        } catch (e: Exception) {
+            // ignore
+        }
+        if (size <= 0L) {
+            try {
+                contentResolver.openAssetFileDescriptor(uri, "r")?.use { afd ->
+                    size = afd.length
+                }
+            } catch (e: Exception) {
+                // ignore
+            }
+        }
+        return size
+    }
+
+    private fun getMimeType(uri: Uri): String {
+        return contentResolver.getType(uri) ?: "image/jpeg"
+    }
+
+    private fun performUpload(uriStrings: List<String>, uploadUrl: String, startId: Int) {
+        val totalFiles = uriStrings.size
+        val uris = uriStrings.map { Uri.parse(it) }
+
+        // Compute sizes
+        val fileSizes = uris.map { getUriSize(it) }
+        val totalBytes = fileSizes.sum()
+
+        // Bytes of every file already fully handled — uploaded OR permanently failed.
+        // Failed files advance this too, so the batch bar keeps moving forward through
+        // the remaining files instead of stalling at the failure point.
+        var bytesProcessed = 0L
+        var lastUpdatedProgress = -1
+        var lastUpdatedFile = -1
+        var lastUpdatedTime = 0L
+
+        // Save initial upload state
+        saveUploadState(UploadState(
+            uris = uriStrings,
+            uploadUrl = uploadUrl,
+            totalFiles = totalFiles,
+            currentFile = 0,
+            progress = 0,
+            completed = false,
+            timestamp = System.currentTimeMillis()
+        ))
+
+        fun postProgressNotification(notification: Notification) {
+            if (!SYSTEM_NOTIFICATIONS_ENABLED) return
+            lastProgressNotification = notification
+            try {
+                NotificationManagerCompat.from(this).notify(NOTIFICATION_ID, notification)
+            } catch (e: SecurityException) {
+                // POST_NOTIFICATIONS not granted — the upload continues without visible progress
+            }
+        }
+
+        // Helper to update the progress notification. `force` bypasses the throttle for
+        // state transitions the user must see immediately (file boundaries, retry notices).
+        fun updateProgress(currentProgressBytes: Long, fileIndex: Int, force: Boolean = false) {
+            val totalUploadedBytes = bytesProcessed + currentProgressBytes
+            val percentage = if (totalBytes > 0) {
+                ((totalUploadedBytes * 100) / totalBytes).toInt().coerceIn(0, 100)
+            } else {
+                ((fileIndex * 100) / totalFiles).coerceIn(0, 100)
+            }
+
+            val currentTime = System.currentTimeMillis()
+            // Throttle: post only when something visible changed (percentage or file
+            // counter) AND at least MIN_NOTIFY_INTERVAL_MS has passed. The old condition
+            // ("percentage changed OR 150ms elapsed") posted on EVERY percentage step with
+            // no time floor — a fast upload could enqueue dozens of notify() calls per
+            // second, tripping NotificationManager's per-app rate limit, which silently
+            // sheds the excess (potentially including the terminal success/failure post).
+            val visibleChange = percentage != lastUpdatedProgress || fileIndex != lastUpdatedFile
+            if (!force && !(visibleChange && (currentTime - lastUpdatedTime) >= MIN_NOTIFY_INTERVAL_MS)) {
+                return
+            }
+            lastUpdatedProgress = percentage
+            lastUpdatedFile = fileIndex
+            lastUpdatedTime = currentTime
+
+            postProgressNotification(buildProgressNotification(percentage, fileIndex + 1, totalFiles))
+            emitUploadEvent("progress", percentage, fileIndex + 1, totalFiles)
+
+            // Save progress state
+            saveUploadState(UploadState(
+                uris = uriStrings,
+                uploadUrl = uploadUrl,
+                totalFiles = totalFiles,
+                currentFile = fileIndex + 1,
+                progress = percentage,
+                completed = false,
+                timestamp = System.currentTimeMillis()
+            ))
+        }
+
+        val failures = mutableListOf<String>()
+        var abortedAtFile = -1
+
+        for (i in uris.indices) {
+            if (Thread.currentThread().isInterrupted) return // service is being torn down
+
+            // Flip the notification to "Uploading file X of N (…%)" the moment the file
+            // starts: DNS + TLS setup can take seconds before the first body byte (and
+            // therefore the first progress callback) — the bar should reflect state now,
+            // not once the connection happens to come up.
+            updateProgress(0, i, force = true)
+
+            val failure = uploadFileWithRetry(
+                uri = uris[i],
+                fileSize = fileSizes[i],
+                uploadUrl = uploadUrl,
+                onProgress = { bytesWritten -> updateProgress(bytesWritten, i) },
+                onRetryScheduled = { attempt ->
+                    // A state change the user should see immediately, not a throttled tick.
+                    postProgressNotification(
+                        buildProgressNotification(
+                            lastUpdatedProgress.coerceAtLeast(0), i + 1, totalFiles,
+                            statusText = Localization.getString("uploadRetrying", "Retrying file {0} of {1} (attempt {2} of {3})…", i + 1, totalFiles, attempt + 1, MAX_UPLOAD_ATTEMPTS)
+                        )
+                    )
+                }
+            )
+
+            // Success or permanent failure, this file has been dealt with — advance the
+            // progress base so the bar never runs backwards past it.
+            bytesProcessed += fileSizes[i]
+
+            if (failure != null) {
+                failures.add(failure.message)
+                if (failure.abortBatch) {
+                    // Endpoint-level failure (DNS, refused connection, TLS): every
+                    // remaining file would fail identically — stop now and report
+                    // instead of burning a full retry cycle per file.
+                    abortedAtFile = i
+                    break
+                }
+            }
+        }
+
+        val attemptedFiles = if (abortedAtFile >= 0) abortedAtFile + 1 else totalFiles
+        val uploadedCount = attemptedFiles - failures.size
+
+        // Remove the ongoing (silent, low-importance) progress notification, then post the
+        // terminal result on the dedicated HIGH-importance channel under its OWN id so it
+        // surfaces as a fresh heads-up. It is left in the shade (no auto-cancel timer) until
+        // the user taps or swipes it away. stopForeground() is service-wide, so drop the
+        // foreground state only when NO other batch is still uploading — otherwise the call
+        // would rip away the queued batch's live progress notification mid-flight.
+        // (No-op when system notifications are disabled: the service never went foreground.)
+        if (SYSTEM_NOTIFICATIONS_ENABLED && activeJobs.get() <= 1) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+                stopForeground(STOP_FOREGROUND_REMOVE)
+            } else {
+                @Suppress("DEPRECATION")
+                stopForeground(true)
+            }
+            lastProgressNotification = null
+        }
+
+        val resultNotification: Notification
+        val historyItem: NotificationHistoryItem
+        if (failures.isEmpty()) {
+            resultNotification = buildSuccessNotification(totalFiles)
+            historyItem = NotificationHistoryItem(
+                title = Localization.getString("uploadCompletedTitle", "Upload completed"),
+                message = Localization.getString("uploadCompletedMessage", "Successfully uploaded {0} file(s).", totalFiles),
+                timestamp = System.currentTimeMillis(),
+                type = "success"
+            )
+        } else {
+            // Report exactly what happened — counts plus the first real error (e.g.
+            // "Server returned error code: 503") — never a sanitized stand-in.
+            val message = if (totalFiles > 1) {
+                Localization.getString("uploadFailedMessage", "Uploaded {0} of {1} file(s) — {2} failed. {3}", uploadedCount, totalFiles, totalFiles - uploadedCount, failures.first())
+            } else {
+                failures.first()
+            }
+            resultNotification = buildFailureNotification(message)
+            historyItem = NotificationHistoryItem(
+                title = Localization.getString("uploadFailedTitle", "Upload failed"),
+                message = message,
+                timestamp = System.currentTimeMillis(),
+                type = "failure"
+            )
+        }
+
+        if (SYSTEM_NOTIFICATIONS_ENABLED) {
+            try {
+                NotificationManagerCompat.from(this).notify(RESULT_NOTIFICATION_ID, resultNotification)
+            } catch (se: SecurityException) {
+                // Ignore
+            }
+        }
+        emitUploadEvent(
+            if (failures.isEmpty()) "success" else "failure",
+            100,
+            attemptedFiles,
+            totalFiles,
+            message = historyItem.message
+        )
+
+        // Terminal state for BOTH outcomes: nothing is in flight anymore, so mark the
+        // persisted state completed. The old code saved completed=false after a failure
+        // (and never cleared it), which made every later service start resurrect a stale
+        // frozen progress notification for this long-dead batch.
+        saveUploadState(UploadState(
+            uris = uriStrings,
+            uploadUrl = uploadUrl,
+            totalFiles = totalFiles,
+            currentFile = attemptedFiles,
+            progress = if (totalBytes > 0) ((bytesProcessed * 100) / totalBytes).toInt().coerceIn(0, 100) else 100,
+            completed = true,
+            timestamp = System.currentTimeMillis()
+        ))
+
+        addToNotificationHistory(historyItem)
+
+        completeJob(startId)
+    }
+
+    /** Terminal outcome of one file's upload attempts. */
+    private class UploadFailure(val message: String, val abortBatch: Boolean)
+
+    /**
+     * Uploads a single file, retrying transient failures with capped exponential backoff.
+     *
+     * This is the root-cause fix for batch uploads dying with "Server returned error
+     * code: 503": a batch fires one POST per file back-to-back the instant the previous
+     * response lands, and burst-limited endpoints (httpbin.org included) shed those
+     * immediate follow-up requests with 503 Service Unavailable. The HTTP spec defines
+     * 503 as a TRANSIENT condition to be retried after a delay (with an optional
+     * Retry-After hint) — but the old code had no retry at all and treated the first
+     * 503 as fatal for the entire batch. A single upload is one request and rarely
+     * trips the limiter, which is why only multi-file uploads failed.
+     *
+     * Nothing is masked: a server that keeps failing still surfaces its real status
+     * code in the failure notification once [MAX_UPLOAD_ATTEMPTS] is exhausted, and
+     * permanent errors (unreadable file, non-transient 4xx) fail immediately.
+     *
+     * @return null on success, or an [UploadFailure] carrying the final error message
+     *   and whether the whole batch should stop (endpoint-level failures).
+     */
+    private fun uploadFileWithRetry(
+        uri: Uri,
+        fileSize: Long,
+        uploadUrl: String,
+        onProgress: (bytesWritten: Long) -> Unit,
+        onRetryScheduled: (attempt: Int) -> Unit
+    ): UploadFailure? {
+        val mimeType = getMimeType(uri)
+        val fileName = uri.lastPathSegment ?: "media_${System.currentTimeMillis()}"
+
+        // A file that can't be opened at all (deleted / permission revoked) is a
+        // permanent failure — fail fast instead of burning retry cycles on it.
+        try {
+            contentResolver.openInputStream(uri)?.close()
+                ?: return UploadFailure(Localization.getString("uploadErrorCouldNotOpenStream", "Could not open the file to upload"), abortBatch = false)
+        } catch (e: Exception) {
+            return UploadFailure(
+                Localization.getString("uploadErrorCouldNotOpenFile", "Could not open file: {0}", e.localizedMessage ?: uri.toString()),
+                abortBatch = false
+            )
+        }
+
+        var lastErrorMessage = Localization.getString("errorUnknown", "An error occurred")
+        var lastWasEndpointUnreachable = false
+
+        for (attempt in 1..MAX_UPLOAD_ATTEMPTS) {
+            var retryDelayMs = -1L
+
+            try {
+                // Replayable body: a FRESH input stream is opened on every write, so this
+                // attempt — and OkHttp's own stale-pooled-connection recovery — always
+                // sends the complete file, never a previously drained stream.
+                val progressBody = ProgressRequestBody(
+                    contentType = mimeType.toMediaTypeOrNull(),
+                    contentResolver = contentResolver,
+                    uri = uri,
+                    declaredLength = fileSize
+                ) { bytesWritten, _ ->
+                    onProgress(bytesWritten)
+                }
+
+                val requestBody = MultipartBody.Builder()
+                    .setType(MultipartBody.FORM)
+                    .addFormDataPart("file", fileName, progressBody)
+                    .build()
+
+                val request = Request.Builder()
+                    .url(uploadUrl)
+                    .post(requestBody)
+                    .build()
+
+                client.newCall(request).execute().use { response ->
+                    if (response.isSuccessful) return null
+
+                    lastErrorMessage = Localization.getString("uploadErrorServerCode", "Server returned error code: {0}", response.code)
+                    lastWasEndpointUnreachable = false
+                    if (isTransientHttpCode(response.code) && attempt < MAX_UPLOAD_ATTEMPTS) {
+                        // Prefer the server's own Retry-After hint (503/429 commonly carry
+                        // one) over the local backoff curve, within sane bounds.
+                        retryDelayMs = response.header("Retry-After")?.trim()?.toLongOrNull()
+                            ?.times(1000L)
+                            ?.coerceIn(BASE_RETRY_DELAY_MS, MAX_RETRY_AFTER_MS)
+                            ?: backoffDelayMs(attempt)
+                    }
+                }
+            } catch (e: FileNotFoundException) {
+                // The file vanished between attempts — permanent, never retried.
+                return UploadFailure(
+                    Localization.getString("couldNotReadFile", "Could not read file: {0}", e.localizedMessage ?: uri.toString()),
+                    abortBatch = false
+                )
+            } catch (e: IOException) {
+                // Transport-level failure (timeout, reset, dead pooled connection) —
+                // transient by nature; retried on a fresh connection with a full body.
+                e.printStackTrace()
+                lastErrorMessage = Localization.getString("uploadErrorNetwork", "Network error: {0}", e.localizedMessage ?: e.javaClass.simpleName)
+                lastWasEndpointUnreachable = isEndpointUnreachable(e)
+                if (attempt < MAX_UPLOAD_ATTEMPTS) {
+                    retryDelayMs = backoffDelayMs(attempt)
+                }
+            } catch (e: Exception) {
+                // Non-I/O failures are programming errors, never transient — don't retry.
+                e.printStackTrace()
+                return UploadFailure(e.localizedMessage ?: Localization.getString("errorUnknown", "An error occurred"), abortBatch = false)
+            }
+
+            if (retryDelayMs < 0) break // permanent failure or attempts exhausted
+
+            onRetryScheduled(attempt)
+            try {
+                Thread.sleep(retryDelayMs)
+            } catch (ie: InterruptedException) {
+                Thread.currentThread().interrupt() // service tearing down — stop retrying
+                break
+            }
+        }
+
+        return UploadFailure(lastErrorMessage, abortBatch = lastWasEndpointUnreachable)
+    }
+
+    /** 408/429/5xx are transient per the HTTP spec; other 4xx are permanent client errors. */
+    private fun isTransientHttpCode(code: Int): Boolean =
+        code == 408 || code == 429 || code in 500..599
+
+    /**
+     * Failures every remaining file in the batch would hit identically (DNS resolution,
+     * refused connection, TLS handshake) — continuing the batch would only repeat the
+     * same retry cycle once per file.
+     */
+    private fun isEndpointUnreachable(e: IOException): Boolean =
+        e is UnknownHostException || e is ConnectException ||
+            e is NoRouteToHostException || e is SSLException
+
+    /** 1s, 2s, 4s… capped exponential backoff between attempts. */
+    private fun backoffDelayMs(attempt: Int): Long =
+        (BASE_RETRY_DELAY_MS shl (attempt - 1)).coerceAtMost(MAX_RETRY_DELAY_MS)
+
+    /**
+     * PendingIntent that reopens the host app when a notification is tapped. There is
+     * no navigation stack for this library to target (it doesn't own the app's routing),
+     * so the most useful universal behavior is bringing the app itself to the foreground;
+     * host apps that want to route further can inspect their own launch state for that.
+     * Returns null (leaving the notification tap a no-op) if the OS can't resolve a
+     * launch intent for this package.
+     */
+    private fun contentPendingIntent(): PendingIntent? {
+        val launchIntent = packageManager.getLaunchIntentForPackage(packageName) ?: return null
+        launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+        return PendingIntent.getActivity(
+            this,
+            NOTIFICATION_ID,
+            launchIntent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
+        )
+    }
+
+    private fun saveUploadState(state: UploadState) {
+        try {
+            val json = gson.toJson(state)
+            sharedPreferences.edit().putString("upload_state", json).apply()
+        } catch (e: Exception) {
+            // Failed to save state
+        }
+    }
+
+    private fun clearUploadState() {
+        sharedPreferences.edit().remove("upload_state").apply()
+    }
+
+    private fun addToNotificationHistory(item: NotificationHistoryItem) {
+        try {
+            val historyJson = sharedPreferences.getString("notification_history", null)
+            val history = if (!historyJson.isNullOrEmpty()) {
+                val array = gson.fromJson(historyJson, Array<NotificationHistoryItem>::class.java)
+                array?.toMutableList() ?: mutableListOf()
+            } else {
+                mutableListOf()
+            }
+
+            history.add(0, item) // Add to beginning to show most recent first
+            if (history.size > 50) { // Limit history to 50 items
+                history.subList(50, history.size).clear()
+            }
+
+            val updatedJson = gson.toJson(history)
+            sharedPreferences.edit().putString("notification_history", updatedJson).apply()
+        } catch (e: Exception) {
+            // Failed to update history
+        }
+    }
+
+    private fun getNotificationHistory(): String {
+        return sharedPreferences.getString("notification_history", "[]") ?: "[]"
+    }
+
+    private fun clearNotificationHistory() {
+        sharedPreferences.edit().remove("notification_history").apply()
+    }
+
+    @androidx.annotation.Keep
+    data class UploadState(
+        val uris: List<String>,
+        val uploadUrl: String,
+        val totalFiles: Int,
+        val currentFile: Int,
+        val progress: Int,
+        val completed: Boolean,
+        val timestamp: Long
+    )
+
+    @androidx.annotation.Keep
+    data class NotificationHistoryItem(
+        val title: String,
+        val message: String,
+        val timestamp: Long,
+        val type: String // "success", "failure", "progress"
+    )
+
+    /**
+     * White-label notification settings loaded from the shared camera config;
+     * defaults reproduce the stock channels/icon exactly.
+     */
+    private val notificationConfig: CameraConfig.NotificationConfig by lazy {
+        CameraTheme.loadConfig(this).notifications
+    }
+
+    /**
+     * Small status icon: a host-app drawable when configured (and resolvable),
+     * otherwise the built-in ic_stat_upload. Must be a plain monochrome vector —
+     * adaptive/launcher icons are silently dropped by the system.
+     */
+    private fun smallIconRes(): Int {
+        val name = notificationConfig.smallIconResourceName ?: return R.drawable.ic_stat_upload
+        val resolved = resources.getIdentifier(name, "drawable", packageName)
+        return if (resolved != 0) resolved else R.drawable.ic_stat_upload
+    }
+
+    private fun NotificationCompat.Builder.applyAccentColor(): NotificationCompat.Builder {
+        notificationConfig.accentColor?.let { setColor(it) }
+        return this
+    }
+
+    private fun buildProgressNotification(
+        progress: Int,
+        fileIndex: Int,
+        totalFiles: Int,
+        statusText: String? = null
+    ): Notification {
+        val contentText = statusText ?: if (fileIndex > 0) {
+            Localization.getString("uploadingFileProgress", "Uploading file {0} of {1} ({2}%)", fileIndex, totalFiles, progress)
+        } else {
+            Localization.getString("preparingFilesProgress", "Preparing files... ({0}%)", progress)
+        }
+
+        return NotificationCompat.Builder(this, notificationConfig.progressChannelId)
+            .setContentTitle(Localization.getString("uploadingMediaTitle", "Uploading media"))
+            .setContentText(contentText)
+            .setSmallIcon(smallIconRes())
+            .applyAccentColor()
+            .setOngoing(true)
+            .setProgress(100, progress, false)
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+            // Show the foreground-service notification IMMEDIATELY. Since Android 12 the system
+            // otherwise defers a foreground-service notification by up to ~10 seconds to avoid
+            // spamming for short tasks — so an upload that finishes quickly would post, run and
+            // complete without its notification ever becoming visible. This is the main reason
+            // "no notification shows up" during uploads.
+            .setForegroundServiceBehavior(NotificationCompat.FOREGROUND_SERVICE_IMMEDIATE)
+            .setContentIntent(contentPendingIntent())
+            .build()
+    }
+
+    private fun buildSuccessNotification(totalFiles: Int): Notification {
+        return NotificationCompat.Builder(this, notificationConfig.resultChannelId)
+            .setContentTitle(Localization.getString("uploadCompletedTitle", "Upload completed"))
+            .setContentText(Localization.getString("uploadCompletedMessage", "Successfully uploaded {0} file(s).", totalFiles))
+            .setSmallIcon(smallIconRes())
+            .applyAccentColor()
+            .setOngoing(false) // Let the user swipe it away
+            .setAutoCancel(true) // Dismiss on tap
+            .setProgress(0, 0, false) // Hide progress bar
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .setContentIntent(contentPendingIntent())
+            .build()
+    }
+
+    private fun buildFailureNotification(errorMessage: String): Notification {
+        return NotificationCompat.Builder(this, notificationConfig.resultChannelId)
+            .setContentTitle(Localization.getString("uploadFailedTitle", "Upload failed"))
+            .setContentText(errorMessage)
+            // Batch failure messages ("Uploaded 2 of 5 file(s) — 3 failed. Server returned
+            // error code: 503") don't fit one collapsed line; let the shade expand them.
+            .setStyle(NotificationCompat.BigTextStyle().bigText(errorMessage))
+            .setSmallIcon(smallIconRes())
+            .applyAccentColor()
+            .setOngoing(false) // Let the user swipe it away
+            .setAutoCancel(true) // Dismiss on tap
+            .setProgress(0, 0, false) // Hide progress bar
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .setContentIntent(contentPendingIntent())
+            .build()
+    }
+
+    /**
+     * Emits an in-app upload progress event to React Native ("onUploadProgress").
+     * This is the replacement surface for the (currently disabled) system
+     * notifications: the example app renders a slim progress banner from these.
+     * Payload: { status: "progress"|"success"|"failure", progress: 0-100,
+     * currentFile, totalFiles, message? }.
+     *
+     * Emission is best-effort: the service may outlive the React context (app
+     * backgrounded/killed) — uploads must never fail because the UI went away.
+     */
+    private fun emitUploadEvent(
+        status: String,
+        progress: Int,
+        currentFile: Int,
+        totalFiles: Int,
+        message: String? = null
+    ) {
+        val context = reactContext ?: return
+        if (!context.hasActiveReactInstance()) return
+        try {
+            val payload: WritableMap = Arguments.createMap().apply {
+                putString("status", status)
+                putInt("progress", progress)
+                putInt("currentFile", currentFile)
+                putInt("totalFiles", totalFiles)
+                message?.let { putString("message", it) }
+            }
+            context
+                .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+                .emit("onUploadProgress", payload)
+        } catch (e: Exception) {
+            // Bridge torn down mid-upload — keep uploading silently.
+        }
+    }
+
+    companion object {
+        // ── System-notification kill switch ─────────────────────────────────────
+        // false = the entire system-notification surface (channels, foreground
+        // promotion, progress + result notify() calls) is skipped and upload
+        // progress is reported to the app via "onUploadProgress" events instead.
+        // The notification implementation below is intentionally left fully
+        // intact. To RE-ENABLE system notifications: flip this to true AND
+        // restore the POST_NOTIFICATIONS <uses-permission> in the library
+        // AndroidManifest.xml (currently commented out) — the permission
+        // requests in CustomCameraModule.startUpload / CustomCameraActivity
+        // .requiredPermissions and the startForegroundService launch path are
+        // gated on this same flag and come back automatically.
+        const val SYSTEM_NOTIFICATIONS_ENABLED = false
+
+        // React context handle for in-app progress events, set by
+        // CustomCameraModule.startUpload before the service starts (same pattern
+        // as GlobalAudioPlayer.reactContext). The service itself has no React
+        // instance; a stale/null context simply means no events are emitted.
+        @Volatile
+        var reactContext: ReactApplicationContext? = null
+
+        const val CHANNEL_ID = "UploadServiceChannel"
+        // Dedicated HIGH-importance channel + id for the terminal success/failure notice, kept
+        // separate from the silent, low-importance progress notification so it can heads-up.
+        const val RESULT_CHANNEL_ID = "UploadResultChannel"
+        const val NOTIFICATION_ID = 90812
+        const val RESULT_NOTIFICATION_ID = 90813
+        const val ACTION_START_UPLOAD = "com.customcamera.action.START_UPLOAD"
+        const val EXTRA_URIS = "com.customcamera.extra.URIS"
+        const val EXTRA_UPLOAD_URL = "com.customcamera.extra.UPLOAD_URL"
+
+        // Action to get notification history
+        const val ACTION_GET_NOTIFICATION_HISTORY = "com.customcamera.action.GET_NOTIFICATION_HISTORY"
+        const val EXTRA_NOTIFICATION_HISTORY = "com.customcamera.extra.NOTIFICATION_HISTORY"
+
+        // ── Transient-failure retry policy ──────────────────────────────────────
+        // 4 attempts = 1 initial + 3 retries with waits of 1s/2s/4s (or the server's
+        // Retry-After, capped). Worst case adds ~7s per file before the REAL error is
+        // reported — long enough to ride out burst throttling (the multi-file 503),
+        // short enough that a genuinely down server still fails visibly and promptly.
+        private const val MAX_UPLOAD_ATTEMPTS = 4
+        private const val BASE_RETRY_DELAY_MS = 1000L
+        private const val MAX_RETRY_DELAY_MS = 8000L
+        private const val MAX_RETRY_AFTER_MS = 15000L
+
+        // NotificationManager rate-limits enqueues per package and SILENTLY sheds the
+        // excess — which can include the terminal success/failure post. Progress updates
+        // are therefore spaced at least this far apart (≤5 posts/second).
+        private const val MIN_NOTIFY_INTERVAL_MS = 200L
+    }
+}
+
+/**
+ * Streams a content [uri] into the request body while reporting write progress.
+ *
+ * The body is REPLAYABLE: [writeTo] opens a fresh stream from the resolver on every
+ * call instead of capturing one pre-opened InputStream. OkHttp legitimately invokes
+ * writeTo() more than once — e.g. when it transparently retries after picking a stale
+ * pooled connection (possible only from a batch's second request onwards) — and
+ * [UploadService]'s transient-error retries re-send the same body too. The previous
+ * single-InputStream design made every such replay transmit an already-drained,
+ * closed stream: a truncated request a server can only reject.
+ */
+class ProgressRequestBody(
+    private val contentType: MediaType?,
+    private val contentResolver: ContentResolver,
+    private val uri: Uri,
+    private val declaredLength: Long,
+    private val onProgress: (bytesWritten: Long, totalBytes: Long) -> Unit
+) : RequestBody() {
+
+    override fun contentType(): MediaType? = contentType
+
+    // -1 (unknown) makes OkHttp fall back to chunked transfer encoding. Declaring 0 for
+    // a file whose size couldn't be resolved would promise "Content-Length: 0" and make
+    // OkHttp abort the call the moment the first real byte is written.
+    override fun contentLength(): Long = if (declaredLength > 0) declaredLength else -1L
+
+    override fun writeTo(sink: BufferedSink) {
+        val input = contentResolver.openInputStream(uri)
+            ?: throw IOException("Could not open input stream for URI: $uri")
+        // 16 KB transfer buffer: fewer read/write iterations and fewer onProgress
+        // callbacks per file at no memory cost, improving upload throughput and CPU use
+        // on low-end devices. The consumer already throttles notification/state updates,
+        // so cadence to JS/notifications is unchanged.
+        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+        var bytesWritten = 0L
+        input.use { stream ->
+            var read: Int
+            while (stream.read(buffer).also { read = it } != -1) {
+                sink.write(buffer, 0, read)
+                bytesWritten += read
+                onProgress(bytesWritten, declaredLength)
+            }
+        }
+    }
+
+    companion object {
+        // 16 KB — the standard sweet spot for streamed I/O throughput.
+        private const val DEFAULT_BUFFER_SIZE = 16 * 1024
+    }
+}