fix(android): forward-split auth and EPUB security from PR 108 by RXWatcher · Pull Request #113 · Silo-Server/silo-android

RXWatcher · 2026-07-27T08:13:43Z

Stack

Base: draft PR build(android): forward-split verified supply chain from PR 108 #112 (split/108-a-supply-chain)
Archival integration reference: closed, unmerged PR Integrate the fork: subtitles/PGS, Watch Together, security hardening, player and sync fixes #108; its source branch remains preserved
This is slice B of the approved forward split. Do not merge before its base.

Scope

A coherent auth/origin/cleartext + EPUB-security vertical slice:

exact Silo HTTP-origin parsing and credential scoping across requests, redirects, refresh, and media transports
persistent and temporary credential-generation pinning, including same-server re-login and guest-overlay races
explicit cleartext consent on mobile/TV, enforced at setup, startup, shared Ktor, media, pairing persistence, and every raw-player redirect/follow-up
bounded remote/archive/markup reads, ZIP extraction controls, parsed EPUB sanitization, SVG restrictions, and API-24-compatible paths
WebView resource isolation bound to the exact open content-addressed EPUB directory, plus reader source remounting

Independent security-review corrections

The initial read-only review found five Important issues; this branch closes all five with regressions:

legacy HTTP accounts and pairing/media bypasses now hit the central consent invariant;
startup-loaded persistent credentials use a non-sentinel epoch;
media auth pins the complete AuthScopeSnapshot and rejected guest refreshes cannot expose the saved owner;
EPUB resources are native/JS-bound to one exact cached book;
container/package/chapter markup has strict type-specific limits and section metadata reads only a bounded prefix.

Two follow-up reviews identified and this branch also closes:

absolute skip-auth login/poll/remote-auth candidates are checked by their actual request URL;
malformed lexical http: targets fail closed;
direct Media3 DataSpec requests and every OkHttp redirect/follow-up validate the final cleartext origin before credentials or transport.

Final independent follow-up security review of the final behavior (rebased code commit a07066a1): Critical 0 / Important 0 / Minor 0 — Ready: Yes.

Verification

scripts/check-build-supply-chain.sh
focused auth/origin/cleartext/media/pairing/EPUB regression suites
./gradlew -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8" testDebugUnitTest :androidApp:assembleRelease :androidTvApp:assembleRelease --max-workers=2 --no-daemon
Final post-fix result: BUILD SUCCESSFUL (3m56s; 325 tasks)
git diff --check; clean worktree

Traceability, conflict decisions, original PR108 commit references, and verification history are in docs/notes/2026-07-27-pr108-slice-b-traceability.md.

Summary by CodeRabbit

New Features
- Added cleartext HTTP connection consent prompts for Android and Android TV.
- Improved authentication and redirect handling to prevent credential leakage across origins.
- Added EPUB security protections, including safer sanitization, resource isolation, extraction limits, and private app-assets loading.
- Added reader input and subtitle size limits.
Bug Fixes
- Prevented stale credentials from being reused after server or session changes.
- Improved handling of unauthorized cross-origin media requests.
Tests
- Expanded coverage for consent flows, authentication boundaries, reader security, and content limits.

coderabbitai · 2026-07-27T08:13:50Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: daf98140-198d-4ef2-83dd-14494b35d28e

📥 Commits

Reviewing files that changed from the base of the PR and between 4458e9d and 06a775a.

📒 Files selected for processing (61)

android-shared/build.gradle.kts
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/di/PlayerModule.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/io/LimitedStreams.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/network/CleartextConsentStore.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/pairing/PairingAuthPort.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/player/AuthenticatedDataSourceFactory.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/player/MediaAuthInterceptor.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/player/MediaAuthSession.kt
android-shared/src/androidMain/kotlin/org/siloserver/silo/common/player/PlayerOkHttpClient.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/io/LimitedStreamsTest.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/network/CleartextConsentStoreTest.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/pairing/RegistryPairingAuthPortTest.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/player/AuthenticatedDataSourceFactoryTest.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/player/MediaAuthInterceptorTest.kt
android-shared/src/androidUnitTest/kotlin/org/siloserver/silo/common/player/MediaAuthSessionTest.kt
androidApp/build.gradle.kts
androidApp/gradle.lockfile
androidApp/src/androidMain/assets/reader/reflow/paginator.js
androidApp/src/androidMain/assets/reader/reflow/reader.html
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/MainActivity.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/di/AndroidModule.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/auth/ServerSetupScreen.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/auth/ServerSetupViewModel.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/EpubBook.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/ReaderFileCache.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubHtmlSanitizer.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubReflowSource.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubResourcePathHandler.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/ReflowWebView.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/ReflowableReader.kt
androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/ReflowableSource.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/auth/ServerSetupPersistenceTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/EpubBookTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/ReaderEngineHostSourceTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/ReaderFileCacheTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/ReaderFileResolverTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/ReflowWebViewEpubResourceTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubHtmlSanitizerTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubReflowSourceTest.kt
androidApp/src/androidUnitTest/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/EpubResourcePathHandlerTest.kt
androidTvApp/src/androidMain/kotlin/org/siloserver/silo/tv/MainTvActivity.kt
androidTvApp/src/androidMain/kotlin/org/siloserver/silo/tv/di/AndroidTvModule.kt
androidTvApp/src/androidMain/kotlin/org/siloserver/silo/tv/ui/screens/auth/TvServerSetupScreen.kt
androidTvApp/src/androidMain/kotlin/org/siloserver/silo/tv/ui/screens/auth/TvServerSetupViewModel.kt
androidTvApp/src/androidUnitTest/kotlin/org/siloserver/silo/tv/ui/screens/auth/TvServerSetupPersistenceTest.kt
baselineprofile/gradle.lockfile
docs/notes/2026-07-27-pr108-slice-b-traceability.md
docs/superpowers/plans/2026-07-27-pr108-slice-b-auth-epub.md
gradle/libs.versions.toml
gradle/verification-metadata.xml
shared/src/androidMain/kotlin/org/siloserver/silo/network/EncryptedTokenManagerImpl.kt
shared/src/androidUnitTest/kotlin/org/siloserver/silo/network/EncryptedTokenManagerScopeGenerationTest.kt
shared/src/commonMain/kotlin/org/siloserver/silo/di/NetworkModule.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/AuthInterceptorImpl.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/AuthScopeSnapshot.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/CleartextOriginConsent.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/HttpOriginPolicy.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/SiloHttpClientImpl.kt
shared/src/commonMain/kotlin/org/siloserver/silo/network/TokenManager.kt
shared/src/commonTest/kotlin/org/siloserver/silo/network/HttpOriginPolicyTest.kt
shared/src/commonTest/kotlin/org/siloserver/silo/network/SiloAuthPluginPinTest.kt

📝 Walkthrough

Walkthrough

The PR adds cleartext-origin consent across Android, TV, pairing, and media authentication; introduces scope-aware credential refresh safeguards; enforces bounded reader and EPUB extraction; and isolates sanitized EPUB content through a restricted WebView asset pipeline.

Changes

Authentication and cleartext consent

Layer / File(s)	Summary
Origin approval and setup confirmation `shared/src/commonMain/kotlin/org/siloserver/silo/network/`, `android-shared/src/androidMain/kotlin/org/siloserver/silo/common/network/`, `androidApp/.../auth/`, `androidTvApp/.../auth/`	HTTP origins are normalized and persisted as digests; Android and TV setup flows stage HTTP connections for confirmation before persistence or navigation.
Scoped authentication and refresh `shared/src/commonMain/kotlin/org/siloserver/silo/network/*`, `shared/src/androidMain/kotlin/org/siloserver/silo/network/EncryptedTokenManagerImpl.kt`	Credential snapshots track identity and credential epochs, while refresh, retry, save, and invalidation operations remain bound to the captured server scope.
Media transport policy `android-shared/src/androidMain/kotlin/org/siloserver/silo/common/player/*`	Media requests enforce cleartext approval, scope credentials to matching origins, strip credentials on cross-origin redirects, and limit subtitle normalization to 32 MiB.
Reader input and EPUB extraction limits `android-shared/src/androidMain/kotlin/org/siloserver/silo/common/io/LimitedStreams.kt`, `androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/*`	Bounded stream utilities enforce reader cache, chapter, archive entry, total extraction, and compression-ratio limits with cleanup on failures.
Sanitized EPUB WebView resources `androidApp/src/androidMain/kotlin/org/siloserver/silo/android/ui/screens/reader/reflow/`, `androidApp/src/androidMain/assets/reader/reflow/`	Jsoup sanitization, private app-assets URLs, CSP, path validation, symlink rejection, and shell navigation restrictions are added for reflow content.
Build and verification support `gradle/`, `androidApp/`, `baselineprofile/`, `docs/`	Jsoup, AndroidX WebKit, test dependencies, lock entries, verification hashes, and Slice B traceability documents are added.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SetupViewModel
  participant CleartextConsentStore
  participant MediaAuthSession
  participant PlayerOkHttpClient
  participant EPUBWebView
  SetupViewModel->>CleartextConsentStore: check or approve HTTP origin
  CleartextConsentStore-->>SetupViewModel: approval state
  SetupViewModel->>MediaAuthSession: create session with consent
  MediaAuthSession->>PlayerOkHttpClient: authorize approved transport
  PlayerOkHttpClient->>EPUBWebView: serve scoped EPUB resources

Possibly related PRs

Silo-Server/silo-android#63: Both changes modify pairing persistence and the RegistryPairingAuthPort contract.
Silo-Server/silo-android#67: Both changes modify authenticated media header and refresh behavior.

Suggested reviewers: quick104

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch split/108-b-auth-epub

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

(cherry picked from commit 85890c6)

(cherry picked from commit 4af0f4d) (cherry picked from commit 5db84af)

(cherry picked from commit 517cc32) (cherry picked from commit 14b41b7)

(cherry picked from commit 63cdcad) (cherry picked from commit 5a040e0)

(cherry picked from commit 941dee8) (cherry picked from commit fd545fa)

(cherry picked from commit 475a7ba) (cherry picked from commit eda4a4a)

RXWatcher mentioned this pull request Jul 27, 2026

Integrate the fork: subtitles/PGS, Watch Together, security hardening, player and sync fixes #108

Closed

RXWatcher force-pushed the split/108-b-auth-epub branch from 7f45f69 to a07066a Compare July 27, 2026 08:25

RXWatcher added 17 commits July 27, 2026 10:39

fix(network): centralize authenticated origin policy

4248364

fix(network): keep credentials on the silo origin

e8c030f

fix(auth): require consent before cleartext login

ccb8462

fix(reader): sanitize epub with parsed allowlist

07eb795

(cherry picked from commit 85890c6)

fix(reader): validate svg paint references

cb1d8a8

(cherry picked from commit 4af0f4d) (cherry picked from commit 5db84af)

fix(reader): bound remote and archive content

003a7c7

(cherry picked from commit 517cc32) (cherry picked from commit 14b41b7)

fix(reader): isolate epub resources in webview

7acfebb

(cherry picked from commit 63cdcad) (cherry picked from commit 5a040e0)

fix(reader): remount webview when source changes

8887716

(cherry picked from commit 941dee8) (cherry picked from commit fd545fa)

fix(android): keep hardened epub paths compatible with API 24

aa7b837

(cherry picked from commit 475a7ba) (cherry picked from commit eda4a4a)

build(android): resolve slice B dependency state

4e1c6be

docs(android): map PR 108 security split

25a0acb

fix(android): close auth and EPUB review gaps

aee8aa8

docs(android): record security review corrections

51d6276

fix(android): gate final cleartext credential destinations

e097ddd

fix(android): gate cleartext media redirects

90971b4

docs(android): restack slice B traceability

24b20aa

docs(android): advance slice B base trace

06a775a

RXWatcher force-pushed the split/108-b-auth-epub branch from 1ace4ea to 06a775a Compare July 27, 2026 08:39

RXWatcher mentioned this pull request Jul 27, 2026

fix(android): scope Room storage and outbox state (PR 108 slice C) #114

Merged

Base automatically changed from split/108-a-supply-chain to main July 27, 2026 16:35

RXWatcher marked this pull request as ready for review July 27, 2026 16:37

RXWatcher merged commit 8152189 into main Jul 27, 2026
2 checks passed

RXWatcher deleted the split/108-b-auth-epub branch July 27, 2026 16:37

coderabbitai Bot mentioned this pull request Jul 28, 2026

feat(onboarding): add invite claim and server-driven feature tour #125

Merged

This was referenced Aug 6, 2026

fix(tv,phone): focus ownership, return focus, and voice search #168

Merged

fix(auth): refresh an expiring token before spending it, not after the 401 #205

Merged

Quick104 mentioned this pull request Aug 16, 2026

Prevent cleartext media rejection from crashing the Android process #233

Open

Navigation Menu

Uh oh!

fix(android): forward-split auth and EPUB security from PR 108 - #113

fix(android): forward-split auth and EPUB security from PR 108#113
RXWatcher merged 17 commits into
mainfrom
split/108-b-auth-epub

RXWatcher commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

RXWatcher commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Stack

Scope

Independent security-review corrections

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

RXWatcher commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading