src/com/android/settings/security/RequestManageCredentials.java

/*
 * Copyright (C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.android.settings.security;

import static android.content.pm.PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX;
import static android.text.TextUtils.SAFE_STRING_FLAG_FIRST_LINE;
import static android.text.TextUtils.SAFE_STRING_FLAG_TRIM;
import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;

import android.app.Activity;
import android.app.admin.DevicePolicyEventLogger;
import android.app.admin.DevicePolicyManager;
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.UserInfo;
import android.content.res.Configuration;
import android.net.Uri;
import android.os.Bundle;
import android.os.Handler;
import android.os.HandlerThread;
import android.os.Process;
import android.os.RemoteException;
import android.os.UserManager;
import android.security.AppUriAuthenticationPolicy;
import android.security.Credentials;
import android.security.KeyChain;
import android.stats.devicepolicy.DevicePolicyEnums;
import android.text.TextUtils;
import android.util.Log;
import android.view.View;
import android.widget.Button;
import android.widget.ImageView;
import android.widget.LinearLayout;
import android.widget.TextView;

import androidx.annotation.NonNull;
import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;
import androidx.recyclerview.widget.LinearLayoutManager;
import androidx.recyclerview.widget.RecyclerView;

import com.android.settings.R;

import com.google.android.material.floatingactionbutton.ExtendedFloatingActionButton;

import java.util.Map;

/**
 * Displays a full screen to the user asking whether the calling app can manage the user's
 * KeyChain credentials. This screen includes the authentication policy highlighting what apps and
 * URLs the calling app can authenticate the user to.
 * <p>
 * Users can allow or deny the calling app. If denied, the calling app may re-request this
 * capability. If allowed, the calling app will become the credential management app and will be
 * able to manage the user's KeyChain credentials. The following APIs can be called to manage
 * KeyChain credentials:
 * {@link DevicePolicyManager#installKeyPair}
 * {@link DevicePolicyManager#removeKeyPair}
 * {@link DevicePolicyManager#generateKeyPair}
 * {@link DevicePolicyManager#setKeyPairCertificate}
 * <p>
 *
 * @see AppUriAuthenticationPolicy
 */
public class RequestManageCredentials extends Activity {

    private static final String TAG = "ManageCredentials";

    private String mCredentialManagerPackage;
    private AppUriAuthenticationPolicy mAuthenticationPolicy;

    private RecyclerView mRecyclerView;
    private LinearLayoutManager mLayoutManager;
    private LinearLayout mButtonPanel;
    private ExtendedFloatingActionButton mExtendedFab;

    private HandlerThread mKeyChainTread;
    private KeyChain.KeyChainConnection mKeyChainConnection;

    private boolean mDisplayingButtonPanel = false;
    private boolean mIsLandscapeMode = false;

    @Override
    public void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        if (!Credentials.ACTION_MANAGE_CREDENTIALS.equals(getIntent().getAction())) {
            Log.e(TAG, "Unable to start activity because intent action is not "
                    + Credentials.ACTION_MANAGE_CREDENTIALS);
            logRequestFailure();
            finishWithResultCancelled();
            return;
        }
        if (isManagedDevice()) {
            Log.e(TAG, "Credential management on managed devices should be done by the Device "
                    + "Policy Controller, not a credential management app");
            logRequestFailure();
            finishWithResultCancelled();
            return;
        }
        mCredentialManagerPackage = getLaunchedFromPackage();
        if (TextUtils.isEmpty(mCredentialManagerPackage)) {
            Log.e(TAG, "Unknown credential manager app");
            logRequestFailure();
            finishWithResultCancelled();
            return;
        }
        DevicePolicyEventLogger
                .createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_NAME)
                .setStrings(mCredentialManagerPackage)
                .write();
        setContentView(R.layout.request_manage_credentials);
        getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
        mIsLandscapeMode = getResources().getConfiguration().orientation
                == Configuration.ORIENTATION_LANDSCAPE;

        mKeyChainTread = new HandlerThread("KeyChainConnection");
        mKeyChainTread.start();
        mKeyChainConnection = getKeyChainConnection(this, mKeyChainTread);

        AppUriAuthenticationPolicy policy =
                getIntent().getParcelableExtra(KeyChain.EXTRA_AUTHENTICATION_POLICY);
        if (!isValidAuthenticationPolicy(policy)) {
            Log.e(TAG, "Invalid authentication policy");
            logRequestFailure();
            finishWithResultCancelled();
            return;
        }
        mAuthenticationPolicy = policy;
        DevicePolicyEventLogger
                .createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_POLICY)
                .setStrings(getNumberOfAuthenticationPolicyApps(mAuthenticationPolicy),
                        getNumberOfAuthenticationPolicyUris(mAuthenticationPolicy))
                .write();

        if (mIsLandscapeMode) {
            loadHeader();
        }
        loadRecyclerView();
        loadButtons();
        loadExtendedFloatingActionButton();
        addOnScrollListener();
    }

    @Override
    protected void onDestroy() {
        super.onDestroy();
        if (mKeyChainConnection != null) {
            mKeyChainConnection.close();
            mKeyChainConnection = null;
            mKeyChainTread.quitSafely();
        }
    }

    private boolean isValidAuthenticationPolicy(AppUriAuthenticationPolicy policy) {
        if (policy == null || policy.getAppAndUriMappings().isEmpty()) {
            return false;
        }
        try {
            // Check whether any of the aliases in the policy already exist
            for (String alias : policy.getAliases()) {
                if (mKeyChainConnection.getService().requestPrivateKey(alias) != null) {
                    return false;
                }
            }
        } catch (RemoteException e) {
            Log.e(TAG, "Invalid authentication policy", e);
            return false;
        }
        return true;
    }

    private boolean isManagedDevice() {
        DevicePolicyManager dpm = getSystemService(DevicePolicyManager.class);

        return dpm.getDeviceOwnerUser() != null
                || dpm.getProfileOwner() != null
                || hasManagedProfile();
    }

    private boolean hasManagedProfile() {
        UserManager um = getSystemService(UserManager.class);
        for (final UserInfo userInfo : um.getProfiles(getUserId())) {
            if (userInfo.isManagedProfile()) {
                return true;
            }
        }
        return false;
    }

    private void loadRecyclerView() {
        mLayoutManager = new LinearLayoutManager(this);
        mRecyclerView = findViewById(R.id.apps_list);
        mRecyclerView.setLayoutManager(mLayoutManager);

        CredentialManagementAppAdapter recyclerViewAdapter = new CredentialManagementAppAdapter(
                this, mCredentialManagerPackage, mAuthenticationPolicy.getAppAndUriMappings(),
                /* include header= */ !mIsLandscapeMode, /* include expander= */ false);
        mRecyclerView.setAdapter(recyclerViewAdapter);
    }

    private void loadButtons() {
        mButtonPanel = findViewById(R.id.button_panel);
        Button dontAllowButton = findViewById(R.id.dont_allow_button);
        dontAllowButton.setFilterTouchesWhenObscured(true);
        Button allowButton = findViewById(R.id.allow_button);
        allowButton.setFilterTouchesWhenObscured(true);

        dontAllowButton.setOnClickListener(b -> {
            DevicePolicyEventLogger
                    .createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_DENIED)
                    .write();
            finishWithResultCancelled();
        });
        allowButton.setOnClickListener(b -> setOrUpdateCredentialManagementAppAndFinish());
    }

    private void loadExtendedFloatingActionButton() {
        mExtendedFab = findViewById(R.id.extended_fab);
        mExtendedFab.setOnClickListener(v -> {
            final int position = mIsLandscapeMode
                    ? mAuthenticationPolicy.getAppAndUriMappings().size() - 1
                    : mAuthenticationPolicy.getAppAndUriMappings().size();
            mRecyclerView.scrollToPosition(position);
            mExtendedFab.hide();
            showButtonPanel();
        });
    }

    private void loadHeader() {
        final ImageView mAppIconView = findViewById(R.id.credential_management_app_icon);
        final TextView mTitleView = findViewById(R.id.credential_management_app_title);
        try {
            ApplicationInfo applicationInfo =
                    getPackageManager().getApplicationInfo(mCredentialManagerPackage, 0);
            mAppIconView.setImageDrawable(getPackageManager().getApplicationIcon(applicationInfo));
            mTitleView.setText(TextUtils.expandTemplate(
                    getText(R.string.request_manage_credentials_title),
                    applicationInfo.loadSafeLabel(
                            getPackageManager(),
                            DEFAULT_MAX_LABEL_SIZE_PX,
                            SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_FIRST_LINE
                    )));
        } catch (PackageManager.NameNotFoundException e) {
            mAppIconView.setImageDrawable(null);
            mTitleView.setText(TextUtils.expandTemplate(
                    getText(R.string.request_manage_credentials_title),
                    mCredentialManagerPackage));
        }
    }

    private void setOrUpdateCredentialManagementAppAndFinish() {
        try {
            mKeyChainConnection.getService().setCredentialManagementApp(
                    mCredentialManagerPackage, mAuthenticationPolicy);
            DevicePolicyEventLogger
                    .createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_ACCEPTED)
                    .write();
            setResult(RESULT_OK);
        } catch (RemoteException e) {
            Log.e(TAG, "Unable to set credential manager app", e);
            logRequestFailure();
        }
        finish();
    }

    @VisibleForTesting
    KeyChain.KeyChainConnection getKeyChainConnection(Context context, HandlerThread thread) {
        final Handler handler = new Handler(thread.getLooper());
        try {
            KeyChain.KeyChainConnection connection = KeyChain.bindAsUser(
                    context, handler, Process.myUserHandle());
            return connection;
        } catch (InterruptedException e) {
            throw new RuntimeException("Faile to bind to KeyChain", e);
        }
    }

    private void addOnScrollListener() {
        mRecyclerView.addOnScrollListener(new RecyclerView.OnScrollListener() {
            @Override
            public void onScrolled(@NonNull RecyclerView recyclerView, int dx, int dy) {
                super.onScrolled(recyclerView, dx, dy);
                if (!mDisplayingButtonPanel) {
                    // On down scroll, hide text in floating action button by setting
                    // extended to false.
                    if (dy > 0 && mExtendedFab.getVisibility() == View.VISIBLE) {
                        mExtendedFab.shrink();
                    }
                    if (isRecyclerScrollable()) {
                        mExtendedFab.show();
                        hideButtonPanel();
                    } else {
                        mExtendedFab.hide();
                        showButtonPanel();
                    }
                }
            }
        });
    }

    private void showButtonPanel() {
        // Add padding to remove overlap between recycler view and button panel.
        int padding_in_px = (int) (60 * getResources().getDisplayMetrics().density + 0.5f);
        mRecyclerView.setPadding(0, 0, 0, padding_in_px);
        mButtonPanel.setVisibility(View.VISIBLE);
        mDisplayingButtonPanel = true;
    }

    private void hideButtonPanel() {
        mRecyclerView.setPadding(0, 0, 0, 0);
        mButtonPanel.setVisibility(View.GONE);
    }

    private boolean isRecyclerScrollable() {
        if (mLayoutManager == null || mRecyclerView.getAdapter() == null) {
            return false;
        }
        return mLayoutManager.findLastCompletelyVisibleItemPosition()
                < mRecyclerView.getAdapter().getItemCount() - 1;
    }

    private void finishWithResultCancelled() {
        setResult(RESULT_CANCELED);
        finish();
    }

    private void logRequestFailure() {
        DevicePolicyEventLogger
                .createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_FAILED)
                .write();
    }

    private String getNumberOfAuthenticationPolicyUris(AppUriAuthenticationPolicy policy) {
        int numberOfUris = 0;
        for (Map.Entry<String, Map<Uri, String>> appsToUris :
                policy.getAppAndUriMappings().entrySet()) {
            numberOfUris += appsToUris.getValue().size();
        }
        return String.valueOf(numberOfUris);
    }

    private String getNumberOfAuthenticationPolicyApps(AppUriAuthenticationPolicy policy) {
        return String.valueOf(policy.getAppAndUriMappings().size());
    }

}