AutofillOrigin.kt

1package com.peachpasswords.autofill23import android.content.Context4import android.content.pm.verify.domain.DomainVerificationManager5import android.content.pm.verify.domain.DomainVerificationUserState6import android.os.Build7import com.peachpasswords.shared.extractDomain8import com.peachpasswords.passkeys.PasskeyCallerOrigin9import com.peachpasswords.vault.VaultEntry1011/**12 * Origin resolution for autofill matching.13 *14 * The caller package comes from the framework-owned activity component. A raw15 * ViewNode.webDomain is only accepted when that package is a signed browser in16 * the same allowlist used by passkeys; otherwise the request fails closed.17 */1819/**20 * Populate [ParsedStructure.originDomains] from the authenticated origin.21 * Verified browsers match on the page domain; native apps match on their22 * verified app-link domains. Unverified web claims produce no origin matches.23 *24 * An app's display label is never an origin: it is user-visible presentation a25 * developer chooses freely, so any sideloaded app can claim the label of a26 * vault entry (PAI-2026-001). Native apps without verified app-link domains27 * therefore get no automatic rows and reach the vault through the picker's28 * explicit search.29 */30internal fun resolveAutofillOrigin(context: Context, parsed: ParsedStructure): ParsedStructure {31    if (parsed.webDomain != null) {32        return applyWebOriginVerification(33            parsed,34            PasskeyCallerOrigin.isVerifiedBrowser(context, parsed.packageName),35        )36    }37    return parsed.copy(originDomains = appLinkDomains(context, parsed.packageName))38}3940/** Preserve an unverified web claim as a deny decision instead of reinterpreting it as native. */41internal fun applyWebOriginVerification(42    parsed: ParsedStructure,43    verifiedBrowser: Boolean,44): ParsedStructure {45    val webDomain = parsed.webDomain ?: return parsed46    return if (verifiedBrowser) {47        parsed.copy(48            originDomains = listOfNotNull(extractDomain(webDomain)),49            credentialReleaseAllowed = true,50        )51    } else {52        parsed.copy(53            webDomain = null,54            originDomains = emptyList(),55            credentialReleaseAllowed = false,56        )57    }58}5960/** A native app's verified app-link domains (Android's cached Digital Asset Links verdict). */61internal fun appLinkDomains(context: Context, packageName: String?): List<String> {62    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S || packageName.isNullOrBlank()) {63        return emptyList()64    }65    return runCatching {66        val state = context.getSystemService(DomainVerificationManager::class.java)67            ?.getDomainVerificationUserState(packageName)68        state?.hostToStateMap.orEmpty()69            .filterValues { it == DomainVerificationUserState.DOMAIN_STATE_VERIFIED }70            .keys71            .mapNotNull { extractDomain(it.removePrefix("*.")) }72            .distinct()73            .sorted()74    }.getOrDefault(emptyList())75}7677/**78 * Domains to offer to "remember" when the user manually picks [entry] for this79 * origin (Android counterpart of the browser's remember-this-site toast).80 * Mirrors the browser trigger: only offer when the entry already carries at81 * least one known domain and none of them cover this origin. Empty = no offer.82 */83internal fun rememberOfferDomains(entry: VaultEntry, parsed: ParsedStructure): List<String> {84    val existing = sequenceOf(entry.url)85        .plus(entry.additionalUrls.orEmpty().asSequence())86        .filterNotNull()87        .mapNotNull(::extractDomain)88        .toSet()89    if (existing.isEmpty() || parsed.originDomains.isEmpty()) return emptyList()90    return parsed.originDomains.filter { it !in existing }91}