feat: Credential Manager password rows in the system credential picker (v2.11.0)

@@ -0,0 +1,69 @@1+package com.peachpasswords.credentials2+3+import com.peachpasswords.shared.extractDomain4+import com.peachpasswords.vault.VaultEntry5+6+data class PasswordCredentialCandidate(7+    val entryId: String,8+    val title: String,9+    val username: String,10+    val lastUsedAt: Long?,11+)12+13+/**14+ * Content-based matching for Credential Manager password rows — the same15+ * stance as autofill (AutofillResponseBuilder): registrable-domain matching16+ * for web callers, app-link-domain / app-title matching for native callers.17+ * No caller-trust gate (removed queue #3); the caller package itself is the18+ * framework-authenticated identity.19+ */20+object PasswordCredentialPlanner {21+22+    fun candidates(23+        entries: List<VaultEntry>,24+        domains: Set<String>,25+        appTitle: String?,26+        allowedUserIds: Set<String>? = null,27+    ): List<PasswordCredentialCandidate> {28+        val eligible = entries.filter { it.fillable() }29+        val byDomain = if (domains.isEmpty()) {30+            emptyList()31+        } else {32+            eligible.filter { entry -> domains.any { entry.matchesDomain(it) } }33+        }34+        val byTitle = if (appTitle.isNullOrBlank()) {35+            emptyList()36+        } else {37+            eligible.filter { it.title.trim().equals(appTitle, ignoreCase = true) }38+        }39+        return (byDomain + byTitle)40+            .distinctBy { it.id }41+            .mapNotNull { entry ->42+                val username = entry.username ?: entry.email ?: return@mapNotNull null43+                if (!allowedUserIds.isNullOrEmpty() && username !in allowedUserIds) {44+                    return@mapNotNull null45+                }46+                PasswordCredentialCandidate(47+                    entryId = entry.id,48+                    title = entry.title,49+                    username = username,50+                    lastUsedAt = entry.lastUsedAt,51+                )52+            }53+            .sortedWith(54+                compareByDescending<PasswordCredentialCandidate> { it.lastUsedAt ?: Long.MIN_VALUE }55+                    .thenBy { it.username.lowercase() },56+            )57+    }58+59+    /** Entries that can actually back a password credential row. */60+    private fun VaultEntry.fillable(): Boolean =61+        deletedAt == null && !password.isNullOrBlank()62+63+    private fun VaultEntry.matchesDomain(domain: String): Boolean =64+        sequenceOf(url)65+            .plus(additionalUrls.orEmpty().asSequence())66+            .filterNotNull()67+            .mapNotNull { extractDomain(it) }68+            .any { it == domain }69+}

@@ -0,0 +1,130 @@1+package com.peachpasswords.credentials2+3+import android.app.PendingIntent4+import android.content.Context5+import android.content.Intent6+import android.os.Build7+import android.os.Bundle8+import androidx.credentials.GetCredentialResponse9+import androidx.credentials.PasswordCredential10+import androidx.credentials.exceptions.GetCredentialUnsupportedException11+import androidx.credentials.provider.PendingIntentHandler12+import androidx.fragment.app.FragmentActivity13+import androidx.lifecycle.lifecycleScope14+import com.peachpasswords.BuildConfig15+import com.peachpasswords.autofill.appLabel16+import com.peachpasswords.autofill.appLinkDomains17+import com.peachpasswords.passkeys.PasskeyCallerOrigin18+import com.peachpasswords.shared.extractDomain19+import com.peachpasswords.ui.components.QaFlags20+import com.peachpasswords.ui.components.SecureWindowPolicy21+import com.peachpasswords.vault.VaultRepository22+import dagger.hilt.android.AndroidEntryPoint23+import javax.inject.Inject24+import kotlinx.coroutines.launch25+26+/**27+ * Completes a Credential Manager password selection. The vault was already28+ * unlocked when the row was offered (the provider never emits rows while29+ * locked), and the tap is the release boundary — the same posture as autofill30+ * (PEACH-AND-01-002 risk acceptance).31+ *32+ * Defense in depth: the framework-verified caller is re-checked against the33+ * entry before release, so a stale or replayed pending intent cannot pull a34+ * credential for a different caller. Fails closed on any doubt.35+ */36+@AndroidEntryPoint37+class PasswordCredentialSelectionActivity : FragmentActivity() {38+    @Inject lateinit var vault: VaultRepository39+    private var debugSecureLease = false40+41+    override fun onCreate(savedInstanceState: Bundle?) {42+        super.onCreate(savedInstanceState)43+        // This window briefly holds credential material on screen. Block44+        // screenshots / recents exactly like the passkey selection surface.45+        if (!BuildConfig.DEBUG) {46+            SecureWindowPolicy.setUserSecure(window, true)47+        } else if (!qaSecureCaptureBypass()) {48+            SecureWindowPolicy.acquire(window)49+            debugSecureLease = true50+        }51+        lifecycleScope.launch { completeSelection() }52+    }53+54+    override fun onDestroy() {55+        if (debugSecureLease) {56+            SecureWindowPolicy.release(window)57+            debugSecureLease = false58+        }59+        super.onDestroy()60+    }61+62+    private fun qaSecureCaptureBypass(): Boolean =63+        BuildConfig.DEBUG && (64+            intent.getBooleanExtra(QaFlags.EXTRA_DISABLE_SECURE_CAPTURE, false) ||65+                QaFlags.disableSecureCaptureForQa66+            )67+68+    private suspend fun completeSelection() {69+        val result = Intent()70+        val entryId = intent.getStringExtra(EXTRA_ENTRY_ID)71+        val entry = entryId?.let(vault::getEntry)72+        val providerRequest = runCatching {73+            PendingIntentHandler.retrieveProviderGetCredentialRequest(intent)74+        }.getOrNull()75+        val callerMatches = providerRequest?.callingAppInfo?.let { info ->76+            if (entry == null) {77+                false78+            } else {79+                val allowlist = PasskeyCallerOrigin.privilegedAllowlist(this)80+                val webOrigin = runCatching { info.getOrigin(allowlist) }.getOrNull()81+                if (!webOrigin.isNullOrBlank()) {82+                    val domain = extractDomain(webOrigin)83+                    domain != null && PasswordCredentialPlanner84+                        .candidates(listOf(entry), setOf(domain), null)85+                        .isNotEmpty()86+                } else {87+                    PasswordCredentialPlanner.candidates(88+                        listOf(entry),89+                        appLinkDomains(this, info.packageName).toSet(),90+                        appLabel(this, info.packageName),91+                    ).isNotEmpty()92+                }93+            }94+        } ?: false95+        val username = entry?.username ?: entry?.email96+        val password = entry?.password97+        if (entry == null || entry.deletedAt != null || !callerMatches ||98+            username.isNullOrBlank() || password.isNullOrEmpty()99+        ) {100+            PendingIntentHandler.setGetCredentialException(101+                result,102+                GetCredentialUnsupportedException("Peach cannot fill this login."),103+            )104+        } else {105+            runCatching { vault.updateEntry(entry.copy(lastUsedAt = System.currentTimeMillis())) }106+            PendingIntentHandler.setGetCredentialResponse(107+                result,108+                GetCredentialResponse(PasswordCredential(username, password)),109+            )110+        }111+        setResult(RESULT_OK, result)112+        finish()113+    }114+115+    companion object {116+        private const val EXTRA_ENTRY_ID = "com.peachpasswords.credentials.EXTRA_ENTRY_ID"117+118+        fun pendingIntent(context: Context, entryId: String): PendingIntent {119+            val intent = Intent(context, PasswordCredentialSelectionActivity::class.java)120+                .putExtra(EXTRA_ENTRY_ID, entryId)121+            val mutableFlag = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) PendingIntent.FLAG_MUTABLE else 0122+            return PendingIntent.getActivity(123+                context,124+                "cm-password:$entryId".hashCode(),125+                intent,126+                PendingIntent.FLAG_UPDATE_CURRENT or mutableFlag,127+            )128+        }129+    }130+}

@@ -0,0 +1,109 @@1+package com.peachpasswords.credentials2+3+import com.peachpasswords.vault.VaultEntry4+import org.junit.Assert.assertEquals5+import org.junit.Assert.assertTrue6+import org.junit.Test7+8+class PasswordCredentialPlannerTest {9+    private fun entry(10+        title: String,11+        url: String?,12+        username: String? = "[email protected]",13+        password: String? = "correct-horse-battery",14+        lastUsedAt: Long? = null,15+    ) = VaultEntry(16+        id = title,17+        title = title,18+        url = url,19+        username = username,20+        password = password,21+        createdAt = 0,22+        modifiedAt = 0,23+        lastUsedAt = lastUsedAt,24+    )25+26+    @Test fun web_caller_matches_entry_on_same_registrable_domain() {27+        val peach = entry("Peach", "https://peachpasswords.com/login")28+        val mail = entry("Fastmail", "https://fastmail.com")29+        val hits = PasswordCredentialPlanner.candidates(listOf(mail, peach), setOf("peachpasswords.com"), null)30+        assertEquals(listOf("Peach"), hits.map { it.title })31+    }32+33+    @Test fun subdomain_entry_matches_registrable_caller_domain() {34+        val peach = entry("Peach", "https://app.peachpasswords.com")35+        val hits = PasswordCredentialPlanner.candidates(listOf(peach), setOf("peachpasswords.com"), null)36+        assertEquals(1, hits.size)37+    }38+39+    @Test fun no_false_positive_on_substring_lookalike() {40+        val gh = entry("GitHub", "https://github.com/login")41+        val hits = PasswordCredentialPlanner.candidates(listOf(gh), setOf("notgithub.com"), null)42+        assertTrue("github.com must not match notgithub.com", hits.isEmpty())43+    }44+45+    @Test fun additional_urls_match_registrable_domain() {46+        val peach = entry("Peach", "https://peachpasswords.com")47+            .copy(additionalUrls = listOf("https://accounts.peachpasswords.co.uk/login"))48+        val hits = PasswordCredentialPlanner.candidates(listOf(peach), setOf("peachpasswords.co.uk"), null)49+        assertEquals(1, hits.size)50+    }51+52+    @Test fun native_caller_matches_by_app_title() {53+        val netflix = entry("Netflix", null)54+        val hits = PasswordCredentialPlanner.candidates(listOf(netflix), emptySet(), "Netflix")55+        assertEquals(listOf("Netflix"), hits.map { it.title })56+    }57+58+    @Test fun entries_without_password_are_never_offered() {59+        val notes = entry("Notes", "https://example.com", password = null)60+        val blank = entry("Blank", "https://example.com", password = "  ")61+        val hits = PasswordCredentialPlanner.candidates(listOf(notes, blank), setOf("example.com"), null)62+        assertTrue(hits.isEmpty())63+    }64+65+    @Test fun deleted_entries_are_never_offered() {66+        val gone = entry("Gone", "https://example.com").copy(deletedAt = 1L)67+        val hits = PasswordCredentialPlanner.candidates(listOf(gone), setOf("example.com"), null)68+        assertTrue(hits.isEmpty())69+    }70+71+    @Test fun entries_without_any_username_are_skipped() {72+        // Credential Manager requires an id; an entry with neither username nor73+        // email cannot produce a PasswordCredential.74+        val nameless = entry("Nameless", "https://example.com", username = null)75+        val hits = PasswordCredentialPlanner.candidates(listOf(nameless), setOf("example.com"), null)76+        assertTrue(hits.isEmpty())77+    }78+79+    @Test fun email_is_used_when_username_is_missing() {80+        val emailOnly = entry("Mail", "https://example.com", username = null)81+            .copy(email = "[email protected]")82+        val hits = PasswordCredentialPlanner.candidates(listOf(emailOnly), setOf("example.com"), null)83+        assertEquals(listOf("[email protected]"), hits.map { it.username })84+    }85+86+    @Test fun allowed_user_ids_filter_restricts_rows() {87+        val a = entry("A", "https://example.com", username = "alice")88+        val b = entry("B", "https://example.com", username = "bob")89+        val hits = PasswordCredentialPlanner.candidates(90+            listOf(a, b), setOf("example.com"), null, allowedUserIds = setOf("bob"),91+        )92+        assertEquals(listOf("bob"), hits.map { it.username })93+    }94+95+    @Test fun most_recently_used_ranks_first() {96+        val old = entry("Old", "https://example.com", username = "old", lastUsedAt = 100L)97+        val fresh = entry("Fresh", "https://example.com", username = "fresh", lastUsedAt = 200L)98+        val hits = PasswordCredentialPlanner.candidates(listOf(old, fresh), setOf("example.com"), null)99+        assertEquals(listOf("fresh", "old"), hits.map { it.username })100+    }101+102+    @Test fun domain_and_title_matches_deduplicate_to_one_row() {103+        val peach = entry("Peach", "https://peachpasswords.com")104+        val hits = PasswordCredentialPlanner.candidates(105+            listOf(peach), setOf("peachpasswords.com"), "Peach",106+        )107+        assertEquals(1, hits.size)108+    }109+}