Merge pull request #616 from appdevforall/feat/K2GO-442-play-compliance

K2GO-442 feat: Google Play build compliance (OTA self-updater off, All-files-access optional)

Author: luisguzman-adfa

controller/app/build.gradle

@@ -134,6 +134,15 @@ android {
             isDefault = true
             buildConfigField "boolean", "ANALYTICS_ENABLED", "${hasGoogleServices}"
         }
+        // Google Play build (K2GO-398). Same as standard (Firebase OK, crash reporting default on) but
+        // with the in-app OTA self-updater OFF: Google Play forbids an app updating itself outside Play,
+        // and Play delivers updates. REQUEST_INSTALL_PACKAGES (used only by the OTA updater) is removed in
+        // src/play/AndroidManifest.xml. applicationId is unchanged: this is the same app via the Play channel.
+        play {
+            dimension "distribution"
+            buildConfigField "boolean", "ANALYTICS_ENABLED", "${hasGoogleServices}"
+            buildConfigField "boolean", "OTA_ENABLED", "false"
+        }
         // F-Droid / fully-free build. No Firebase dependency is declared for it (see dependencies), so
         // the AAR cannot link. Analytics is off; crash reporting defaults OFF (opt-in), which fulfils the
         // F-Droid default that K2GO-401 deferred to this recipe.
@@ -146,6 +155,14 @@ android {
         }
     }
 
+    // K2GO-398: "standard" and "play" both ship Firebase Analytics, so they share the one Firebase
+    // bridge (the only class that references the non-free AAR) from src/withFirebase instead of
+    // duplicating it. "fdroid" keeps its own no-op twin in src/fdroid and links no Firebase.
+    sourceSets {
+        standard.java.srcDirs += 'src/withFirebase/java'
+        play.java.srcDirs += 'src/withFirebase/java'
+    }
+
     packagingOptions {
         jniLibs {
             useLegacyPackaging true
@@ -233,7 +250,8 @@ android {
             def shortAbi = abi == null ? "universal" : abi.replace("arm64-", "").replace("armeabi-", "")
             // K2GO-402: two flavors can share versionName+abi+buildType. Disambiguate the fdroid APK
             // with a "-fdroid" marker; keep the standard build's filename unchanged (CI expects it).
-            def flavorMark = variant.flavorName == "fdroid" ? "-fdroid" : ""
+            def flavorMark = variant.flavorName == "fdroid" ? "-fdroid"
+                    : variant.flavorName == "play" ? "-play" : ""
             output.outputFileName = "K2Go-${variant.versionName}${flavorMark}-${shortAbi}-${variant.buildType.name}.apk"
         }
     }
@@ -303,6 +321,10 @@ dependencies {
     // standardImplementation ONLY: the fdroid flavor must not link this non-free AAR (F-Droid).
     standardImplementation platform('com.google.firebase:firebase-bom:33.7.0')
     standardImplementation 'com.google.firebase:firebase-analytics'
+    // K2GO-398: the Play flavor carries the same Firebase as standard (Play allows it; the Data Safety
+    // form must still declare it). firebase-bom aligns versions; firebase-analytics exposes the Java API.
+    playImplementation platform('com.google.firebase:firebase-bom:33.7.0')
+    playImplementation 'com.google.firebase:firebase-analytics'
 
     // Local Module: Our C++ engine (Termux)
     implementation project(':termux-core')

controller/app/src/main/java/org/appdevforall/k2go/permissions/StoragePermission.java

@@ -44,6 +44,41 @@ public static boolean isGranted(Context ctx) {
                 == PackageManager.PERMISSION_GRANTED;
     }
 
+    // K2GO-442: isRequired() is a process constant (the manifest declaration and this device's SDK level
+    // do not change at runtime), so memoize it: the wizard calls it on several onboarding paths and each
+    // uncached call is a PackageManager IPC. This caches an immutable fact, not coordination state.
+    private static volatile Boolean requiredMemo;
+
+    /**
+     * K2GO-442: true when this build DECLARES the broad-storage permission for the current OS version,
+     * so the grant is actually reachable. The Play flavor removes MANAGE_EXTERNAL_STORAGE, so on R+ this
+     * returns false there and callers must treat storage as optional: never gate onboarding on a
+     * permission the user can never grant. standard/fdroid still declare it, so it stays required for them.
+     * Self-correcting (reads the manifest), so no flavor flag is needed. Memoized (see requiredMemo).
+     */
+    public static boolean isRequired(Context ctx) {
+        Boolean cached = requiredMemo;
+        if (cached != null) return cached;
+        String perm = Build.VERSION.SDK_INT >= Build.VERSION_CODES.R
+                ? Manifest.permission.MANAGE_EXTERNAL_STORAGE
+                : Manifest.permission.WRITE_EXTERNAL_STORAGE;
+        try {
+            String[] declared = ctx.getPackageManager()
+                    .getPackageInfo(ctx.getPackageName(), PackageManager.GET_PERMISSIONS)
+                    .requestedPermissions;
+            boolean required = false;
+            if (declared != null) {
+                for (String p : declared) {
+                    if (perm.equals(p)) { required = true; break; }
+                }
+            }
+            requiredMemo = required;   // cache only a definitive answer
+            return required;
+        } catch (PackageManager.NameNotFoundException e) {
+            return true;   // our own package always resolves; fail safe, do not cache a transient miss
+        }
+    }
+
     /**
      * Trigger the correct grant flow for this OS version. No-op if the permission is already held.
      * Use this from a surface that already offers its own "open app settings" escape hatch (e.g. the

controller/app/src/main/java/org/appdevforall/k2go/redesign/WizardActivity.java

@@ -127,6 +127,12 @@ protected void onCreate(Bundle b) {
         findViewById(R.id.perm_storage).setOnClickListener(v -> requestStorage());
         findViewById(R.id.perm_battery).setOnClickListener(v -> requestBattery());
 
+        // K2GO-442: hide the storage row when the build does not declare the broad-storage permission
+        // (the Play flavor), so the user is never shown a toggle they can never satisfy.
+        if (!org.appdevforall.k2go.permissions.StoragePermission.isRequired(this)) {
+            findViewById(R.id.perm_storage).setVisibility(android.view.View.GONE);
+        }
+
         // set-up-library choices
         findViewById(R.id.setup_download).setOnClickListener(v -> {
             // ADFA-4982: do NOT mark setup complete here — only a real install does (startWizardInstall).
@@ -297,10 +303,16 @@ private void setStatus(TextView t, boolean granted) {
         t.setTextColor(ContextCompat.getColor(this, granted ? R.color.k2go_leaf : R.color.k2go_teal));
     }
     private boolean allPermsGranted() {
-        boolean ok = hasStorage() && hasBattery();
+        boolean ok = storageSatisfied() && hasBattery();
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) ok = ok && hasNotif();
         return ok;
     }
+    // K2GO-442: the Play build removes All-files-access, so the grant is unreachable there. Treat storage
+    // as satisfied when the build does not declare the permission, so onboarding is never a dead-end (the
+    // row is hidden too). standard/fdroid still declare it, so it stays a hard requirement for them.
+    private boolean storageSatisfied() {
+        return !org.appdevforall.k2go.permissions.StoragePermission.isRequired(this) || hasStorage();
+    }
     private boolean hasNotif() {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU)
             return NotificationManagerCompat.from(this).areNotificationsEnabled();

controller/app/src/play/AndroidManifest.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <!-- K2GO-398: the Google Play build drops the OTA self-updater permission. Google Play forbids an
+         app updating itself outside Play and delivers updates itself, so the in-app updater is compiled
+         out here (BuildConfig.OTA_ENABLED=false) and REQUEST_INSTALL_PACKAGES, which only the updater
+         uses, is removed from the merged manifest so Play review never sees it. -->
+    <uses-permission
+        android:name="android.permission.REQUEST_INSTALL_PACKAGES"
+        tools:node="remove" />
+
+    <!-- K2GO-442: the Play build drops All-files-access (MANAGE_EXTERNAL_STORAGE), which Google Play
+         scrutinizes heavily. The running box works without it (the rootfs is internal); onboarding no
+         longer hard-requires it (StoragePermission.isRequired is false when it is not declared, so the
+         wizard hides the row and does not gate on it). Storage-dependent extras (the /sdcard bind,
+         backup/restore to shared storage) degrade gracefully when it is absent. -->
+    <uses-permission
+        android:name="android.permission.MANAGE_EXTERNAL_STORAGE"
+        tools:node="remove" />
+
+    <application>
+        <!-- K2GO-398 / K2GO-402: same Firebase privacy hardening as the standard flavor (this flavor also
+             ships Firebase). Disable Advertising ID / SSAID collection and ad personalization (K2Go may
+             serve minors; operational analytics only). These keys stay in the Google-ful flavors, not in
+             main, so the fdroid build carries no stray Google reference. -->
+        <meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />
+        <meta-data android:name="google_analytics_ssaid_collection_enabled" android:value="false" />
+        <meta-data android:name="google_analytics_default_allow_ad_personalization_signals" android:value="false" />
+    </application>
+</manifest>