Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8882a30e authored by Chaohui Wang's avatar Chaohui Wang Committed by Automerger Merge Worker
Browse files

Merge "Create AppOpsPermissionController" into 24D1-dev am: dcefab81 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/27374628



Change-Id: I4dce0efe55372010d9cd91316f7583161cdf506f
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 551d50fb dcefab81

packages/SettingsLib/SpaPrivileged/src/com/android/settingslib/spaprivileged/model/app/AppOpsPermissionController.kt

0 → 100644
+62 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2024 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.settingslib.spaprivileged.model.app



import android.app.AppOpsManager

import android.content.Context

import android.content.pm.ApplicationInfo

import android.util.Log

import kotlinx.coroutines.Dispatchers

import kotlinx.coroutines.flow.Flow

import kotlinx.coroutines.flow.conflate

import kotlinx.coroutines.flow.flowOn

import kotlinx.coroutines.flow.map

import kotlinx.coroutines.flow.onEach



interface IAppOpsPermissionController {

    val isAllowedFlow: Flow<Boolean>

    fun setAllowed(allowed: Boolean)

}



class AppOpsPermissionController(

    context: Context,

    private val app: ApplicationInfo,

    appOps: AppOps,

    private val permission: String,

    private val packageManagers: IPackageManagers = PackageManagers,

    private val appOpsController: IAppOpsController = AppOpsController(context, app, appOps),

) : IAppOpsPermissionController {

    override val isAllowedFlow: Flow<Boolean> = appOpsController.modeFlow.map { mode ->

        when (mode) {

            AppOpsManager.MODE_ALLOWED -> true



            AppOpsManager.MODE_DEFAULT -> {

                with(packageManagers) { app.hasGrantPermission(permission) }

            }



            else -> false

        }

    }.conflate().onEach { Log.d(TAG, "isAllowed: $it") }.flowOn(Dispatchers.Default)



    override fun setAllowed(allowed: Boolean) {

        appOpsController.setAllowed(allowed)

    }



    private companion object {

        private const val TAG = "AppOpsPermissionControl"

    }

}

packages/SettingsLib/SpaPrivileged/src/com/android/settingslib/spaprivileged/template/app/AppOpPermissionAppList.kt

+21 −44
Original line number Diff line number Diff line
@@ -20,13 +20,14 @@ import android.app.AppOpsManager 
import android.content.Context

import android.content.pm.ApplicationInfo

import androidx.compose.runtime.Composable

import androidx.compose.runtime.getValue

import androidx.lifecycle.compose.collectAsStateWithLifecycle

import com.android.settingslib.spa.framework.util.asyncMapItem

import com.android.settingslib.spa.framework.util.filterItem

import com.android.settingslib.spaprivileged.model.app.AppOps

import com.android.settingslib.spaprivileged.model.app.AppOpsController

import com.android.settingslib.spaprivileged.model.app.AppOpsPermissionController

import com.android.settingslib.spaprivileged.model.app.AppRecord

import com.android.settingslib.spaprivileged.model.app.IAppOpsController

import com.android.settingslib.spaprivileged.model.app.IAppOpsPermissionController

import com.android.settingslib.spaprivileged.model.app.IPackageManagers

import com.android.settingslib.spaprivileged.model.app.PackageManagers

import kotlinx.coroutines.flow.Flow
@@ -37,7 +38,7 @@ data class AppOpPermissionRecord( 
    override val app: ApplicationInfo,

    val hasRequestBroaderPermission: Boolean,

    val hasRequestPermission: Boolean,

    var appOpsController: IAppOpsController,

    var appOpsPermissionController: IAppOpsPermissionController,

) : AppRecord



abstract class AppOpPermissionListModel(
@@ -70,8 +71,8 @@ abstract class AppOpPermissionListModel( 
    private val notChangeablePackages =

        setOf("android", "com.android.systemui", context.packageName)



    private fun createAppOpsController(app: ApplicationInfo) =

        AppOpsController(context, app, appOps)

    private fun createAppOpsPermissionController(app: ApplicationInfo) =

        AppOpsPermissionController(context, app, appOps, permission)



    private fun createRecord(

        app: ApplicationInfo,
@@ -84,7 +85,7 @@ abstract class AppOpPermissionListModel( 
                    app.hasRequestPermission(it)

                } ?: false,

                hasRequestPermission = hasRequestPermission,

                appOpsController = createAppOpsController(app),

                appOpsPermissionController = createAppOpsPermissionController(app),

            )

        }
@@ -117,51 +118,27 @@ abstract class AppOpPermissionListModel( 
    override fun filter(userIdFlow: Flow<Int>, recordListFlow: Flow<List<AppOpPermissionRecord>>) =

        recordListFlow.filterItem(::isChangeable)



    @Composable

    override fun isAllowed(record: AppOpPermissionRecord): () -> Boolean? =

        isAllowed(

            record = record,

            appOpsController = record.appOpsController,

            permission = permission,

            packageManagers = packageManagers,

        )



    override fun isChangeable(record: AppOpPermissionRecord) =

        record.hasRequestPermission &&

            !record.hasRequestBroaderPermission &&

            record.app.packageName !in notChangeablePackages



    override fun setAllowed(record: AppOpPermissionRecord, newAllowed: Boolean) {

        record.appOpsController.setAllowed(newAllowed)

    }

}



    /**

     * Defining the default behavior as permissible as long as the package requested this permission

     * (This means pre-M gets approval during install time; M apps gets approval during runtime).

     */

    @Composable

internal fun isAllowed(

    record: AppOpPermissionRecord,

    appOpsController: IAppOpsController,

    permission: String,

    packageManagers: IPackageManagers = PackageManagers,

): () -> Boolean? {

    override fun isAllowed(record: AppOpPermissionRecord): () -> Boolean? {

        if (record.hasRequestBroaderPermission) {

            // Broader permission trumps the specific permission.

            return { true }

        }



    val mode = appOpsController.modeFlow.collectAsStateWithLifecycle(initialValue = null)

    return {

        when (mode.value) {

            null -> null

            AppOpsManager.MODE_ALLOWED -> true

            AppOpsManager.MODE_DEFAULT -> {

                with(packageManagers) { record.app.hasGrantPermission(permission) }

        val isAllowed by record.appOpsPermissionController.isAllowedFlow

            .collectAsStateWithLifecycle(initialValue = null)

        return { isAllowed }

    }



            else -> false

        }

    override fun isChangeable(record: AppOpPermissionRecord) =

        record.hasRequestPermission &&

            !record.hasRequestBroaderPermission &&

            record.app.packageName !in notChangeablePackages



    override fun setAllowed(record: AppOpPermissionRecord, newAllowed: Boolean) {

        record.appOpsPermissionController.setAllowed(newAllowed)

    }

}

packages/SettingsLib/SpaPrivileged/tests/src/com/android/settingslib/spaprivileged/model/app/AppOpsPermissionControllerTest.kt

0 → 100644
+167 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2024 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.settingslib.spaprivileged.model.app



import android.app.AppOpsManager

import android.content.Context

import android.content.pm.ApplicationInfo

import android.content.pm.PackageManager

import androidx.test.core.app.ApplicationProvider

import androidx.test.ext.junit.runners.AndroidJUnit4

import com.android.settingslib.spa.testutils.firstWithTimeoutOrNull

import com.android.settingslib.spaprivileged.framework.common.appOpsManager

import com.google.common.truth.Truth.assertThat

import kotlinx.coroutines.flow.flowOf

import kotlinx.coroutines.runBlocking

import org.junit.Test

import org.junit.runner.RunWith

import org.mockito.kotlin.doReturn

import org.mockito.kotlin.mock

import org.mockito.kotlin.spy

import org.mockito.kotlin.stub

import org.mockito.kotlin.verify



@RunWith(AndroidJUnit4::class)

class AppOpsPermissionControllerTest {



    private val appOpsManager = mock<AppOpsManager>()

    private val packageManager = mock<PackageManager>()

    private val packageManagers = mock<IPackageManagers>()

    private val appOpsController = mock<IAppOpsController>()



    private val context: Context = spy(ApplicationProvider.getApplicationContext()) {

        on { appOpsManager } doReturn appOpsManager

        on { packageManager } doReturn packageManager

    }



    @Test

    fun isAllowedFlow_appOpsAllowed_returnTrue() = runBlocking {

        appOpsController.stub {

            on { modeFlow } doReturn flowOf(AppOpsManager.MODE_ALLOWED)

        }

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP),

            permission = PERMISSION,

            appOpsController = appOpsController,

        )



        val isAllowed = controller.isAllowedFlow.firstWithTimeoutOrNull()



        assertThat(isAllowed).isTrue()

    }



    @Test

    fun isAllowedFlow_appOpsDefaultAndPermissionGranted_returnTrue() = runBlocking {

        appOpsController.stub {

            on { modeFlow } doReturn flowOf(AppOpsManager.MODE_DEFAULT)

        }

        packageManagers.stub {

            on { APP.hasGrantPermission(PERMISSION) } doReturn true

        }

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP),

            permission = PERMISSION,

            packageManagers = packageManagers,

            appOpsController = appOpsController,

        )



        val isAllowed = controller.isAllowedFlow.firstWithTimeoutOrNull()



        assertThat(isAllowed).isTrue()

    }



    @Test

    fun isAllowedFlow_appOpsDefaultAndPermissionNotGranted_returnFalse() = runBlocking {

        appOpsController.stub {

            on { modeFlow } doReturn flowOf(AppOpsManager.MODE_DEFAULT)

        }

        packageManagers.stub {

            on { APP.hasGrantPermission(PERMISSION) } doReturn false

        }

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP),

            permission = PERMISSION,

            packageManagers = packageManagers,

            appOpsController = appOpsController,

        )



        val isAllowed = controller.isAllowedFlow.firstWithTimeoutOrNull()



        assertThat(isAllowed).isFalse()

    }



    @Test

    fun isAllowedFlow_appOpsError_returnFalse() = runBlocking {

        appOpsController.stub {

            on { modeFlow } doReturn flowOf(AppOpsManager.MODE_ERRORED)

        }

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP),

            permission = PERMISSION,

            appOpsController = appOpsController,

        )



        val isAllowed = controller.isAllowedFlow.firstWithTimeoutOrNull()



        assertThat(isAllowed).isFalse()

    }



    @Test

    fun setAllowed_notSetModeByUid() {

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP, setModeByUid = false),

            permission = PERMISSION,

        )



        controller.setAllowed(true)



        verify(appOpsManager).setMode(OP, APP.uid, APP.packageName, AppOpsManager.MODE_ALLOWED)

    }



    @Test

    fun setAllowed_setModeByUid() {

        val controller = AppOpsPermissionController(

            context = context,

            app = APP,

            appOps = AppOps(op = OP, setModeByUid = true),

            permission = PERMISSION,

        )



        controller.setAllowed(true)



        verify(appOpsManager).setUidMode(OP, APP.uid, AppOpsManager.MODE_ALLOWED)

    }



    private companion object {

        const val OP = 1

        const val PERMISSION = "Permission"

        val APP = ApplicationInfo().apply {

            packageName = "package.name"

            uid = 123

        }

    }

}

packages/SettingsLib/SpaPrivileged/tests/src/com/android/settingslib/spaprivileged/template/app/AppOpPermissionAppListTest.kt

+14 −48
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ import androidx.test.ext.junit.runners.AndroidJUnit4 
import com.android.settingslib.spa.testutils.firstWithTimeoutOrNull

import com.android.settingslib.spaprivileged.framework.common.appOpsManager

import com.android.settingslib.spaprivileged.model.app.AppOps

import com.android.settingslib.spaprivileged.model.app.IAppOpsController

import com.android.settingslib.spaprivileged.model.app.IAppOpsPermissionController

import com.android.settingslib.spaprivileged.model.app.IPackageManagers

import com.android.settingslib.spaprivileged.test.R

import com.google.common.truth.Truth.assertThat
@@ -119,7 +119,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = false,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val recordListFlow = listModel.filter(flowOf(USER_ID), flowOf(listOf(record)))
@@ -135,7 +135,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_ALLOWED),

                appOpsPermissionController = FakeAppOpsPermissionController(true),

            )



        val isAllowed = getIsAllowed(record)
@@ -143,38 +143,6 @@ class AppOpPermissionAppListTest { 
        assertThat(isAllowed).isTrue()

    }



    @Test

    fun isAllowed_defaultAndHasGrantPermission() {

        with(packageManagers) { whenever(APP.hasGrantPermission(PERMISSION)).thenReturn(true) }

        val record =

            AppOpPermissionRecord(

                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

            )



        val isAllowed = getIsAllowed(record)



        assertThat(isAllowed).isTrue()

    }



    @Test

    fun isAllowed_defaultAndNotGrantPermission() {

        with(packageManagers) { whenever(APP.hasGrantPermission(PERMISSION)).thenReturn(false) }

        val record =

            AppOpPermissionRecord(

                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

            )



        val isAllowed = getIsAllowed(record)



        assertThat(isAllowed).isFalse()

    }



    @Test

    fun isAllowed_broaderPermissionTrumps() {

        listModel.broaderPermission = BROADER_PERMISSION
@@ -187,7 +155,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = true,

                hasRequestPermission = false,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_ERRORED),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isAllowed = getIsAllowed(record)
@@ -202,7 +170,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_ERRORED),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isAllowed = getIsAllowed(record)
@@ -217,7 +185,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = false,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isChangeable = listModel.isChangeable(record)
@@ -232,7 +200,7 @@ class AppOpPermissionAppListTest { 
                app = NOT_CHANGEABLE_APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isChangeable = listModel.isChangeable(record)
@@ -247,7 +215,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isChangeable = listModel.isChangeable(record)
@@ -263,7 +231,7 @@ class AppOpPermissionAppListTest { 
                app = APP,

                hasRequestBroaderPermission = true,

                hasRequestPermission = true,

                appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT),

                appOpsPermissionController = FakeAppOpsPermissionController(false),

            )



        val isChangeable = listModel.isChangeable(record)
@@ -273,18 +241,18 @@ class AppOpPermissionAppListTest { 


    @Test

    fun setAllowed() {

        val appOpsController = FakeAppOpsController(fakeMode = AppOpsManager.MODE_DEFAULT)

        val appOpsPermissionController = FakeAppOpsPermissionController(false)

        val record =

            AppOpPermissionRecord(

                app = APP,

                hasRequestBroaderPermission = false,

                hasRequestPermission = true,

                appOpsController = appOpsController,

                appOpsPermissionController = appOpsPermissionController,

            )



        listModel.setAllowed(record = record, newAllowed = true)



        assertThat(appOpsController.setAllowedCalledWith).isTrue()

        assertThat(appOpsPermissionController.setAllowedCalledWith).isTrue()

    }



    private fun getIsAllowed(record: AppOpPermissionRecord): Boolean? {
@@ -314,14 +282,12 @@ class AppOpPermissionAppListTest { 
    }

}



private class FakeAppOpsController(private val fakeMode: Int) : IAppOpsController {

private class FakeAppOpsPermissionController(allowed: Boolean) : IAppOpsPermissionController {

    var setAllowedCalledWith: Boolean? = null



    override val modeFlow = flowOf(fakeMode)

    override val isAllowedFlow = flowOf(allowed)



    override fun setAllowed(allowed: Boolean) {

        setAllowedCalledWith = allowed

    }



    override fun getMode() = fakeMode

}