PONGo_android/CHANGELOG.md

# Changelog — PON Go (Android)

All notable changes to this app. The **★ Port to iOS** section in each entry calls
out changes that affect shared REST behaviour / security / device-safety and most
likely have an equivalent in the sibling iOS app (`../mcms_ios`) — the two share the
same MCMS field paths and request semantics (see `docs/MCMS_API.md`).

---

## [Unreleased] — Security hardening & code-review fixes (2026-05-31)

Outcome of a full code review. No `versionCode` bump yet — bump before release.
Release build now uses R8; **run `./gradlew :app:assembleDebug` and a `release`
build to verify** (the dev machine for this change had no Android SDK).

### Security

- **Removed untrusted-TLS support entirely.** Deleted `ServerTrustPolicy.AllowSelfSignedForHost`
  and its all-accepting `X509TrustManager` (it accepted *any* certificate for the
  configured host — a full MITM hole on a tool that can reset gear and push firmware).
  Removed the "Allow self-signed certificate" toggle from Settings. Only system-CA
  trust remains, plus the still-available `ServerTrustPolicy.PinPublicKeySha256` for
  pinning a known box's key. *(`core/Networking.kt`, `core/ApiConfiguration.kt`, `ui/AuthScreens.kt`)*
- **Enforced HTTPS.** `normalizedBaseUrl` now defaults a missing scheme to `https`,
  rejects any non-`https` URL, and rejects embedded credentials. Added
  `res/xml/network_security_config.xml` (cleartext forbidden, system CAs only — blocks
  the user-installed-CA MITM vector) + `usesCleartextTraffic="false"`. *(`core/ApiConfiguration.kt`, `AndroidManifest.xml`)*
- **Hardened stored credentials.** Passwords are no longer persisted at rest:
  "Remember me" stores the **email only**; the password field is never pre-filled and
  is kept out of the saved-instance `Bundle` (plain `remember`, not `rememberSaveable`).
  Credentials are cleared on sign-out and when "Remember me" is unchecked; any legacy
  stored password is purged. `allowBackup="false"`. *(`ui/AppState.kt`, `ui/AuthScreens.kt`, `AndroidManifest.xml`)*
- **CSRF cookie lookup** now resolves the host via OkHttp's parser (matching the cookie
  jar) so the `X-CSRFToken` lookup can't silently miss on host-normalisation edge cases.
- Unexpected (non-`ApiError`) throwables no longer leak raw library text to the UI. *(`ui/Types.kt`)*

### Correctness

- **Per-endpoint API versioning.** Endpoint paths are now fixed at `v1`/`v3` per
  `docs/MCMS_API.md` §4 instead of one global `apiVersion` (which was wrong for *every*
  config: lists/states need `v3`, single-doc/login/logs need `v1` — no single value
  worked). Removed the global `apiVersion` config field, the `version` override plumbing,
  and the API-version Settings input. Versions for undocumented endpoints (controllers,
  `olts/configs`, reset, `ponmgr/version`) are inferred and marked `// inferred`. *(`core/McmsEndpoint.kt`, `core/ApiClient.kt`)*
- **`"warning"` status treated as success.** The `{status,data}` unwrap now accepts
  `warning` as well as `success` (a `warning` means the write committed; only a schema
  mismatch is reported) — previously a committed firmware/config write was reported as
  failed. *(`core/ApiClient.kt`)*
- **Pagination fails loud, not silent.** `getAll` now throws instead of returning a
  truncated fleet when a full page yields no usable cursor (e.g. a projection drops
  `_id`). *(`core/ApiClient.kt`)*
- **`Response` no longer leaks on coroutine cancellation** (resume-with-onCancellation
  closes a dropped response — prevents connection-pool exhaustion on navigate-away). *(`core/ApiClient.kt`)*
- **Firmware compatibility now fails closed.** `FirmwareFile.isCompatible` returns
  compatible only when vendor + equipment id are known and the file positively matches
  (was: unknown/missing metadata ⇒ "compatible"). Staging a non-compatible image now
  requires an explicit extra acknowledgment in the dialog. Mis-flashing can brick an ONU. *(`core/Firmware.kt`, `ui/OnuScreens.kt`)*
- **JSON parse is tolerant.** A non-JSON 2xx body yields a typed `ApiError.Decoding`
  instead of crashing. A required non-empty `User-Agent` header is now sent (§3.1). *(`core/ApiClient.kt`)*

### Concurrency / lifecycle

- **Network I/O off the main thread** (`Dispatchers.IO`) — fixes ANR/jank on large
  fleets; the `onAuthExpired` Compose-state write stays on the main thread. *(`core/ApiClient.kt`)*
- **Stale-result generation guards** in every screen `load()`/`reload()`: a slow earlier
  load can no longer overwrite newer data, and `CancellationException` is rethrown (a
  cancelled load is no longer shown as an error). Fixes the ONU-detail tab-switch race. *(`ui/*Screens.kt`)*
- **`AppState` hosted in a `ViewModel`** so rotation / dark-mode no longer rebuilds the
  connection and bounces the user to login. *(`MainActivity.kt`)*
- Thread-safe `SessionCookieJar` (synchronised; OkHttp calls it from background threads). *(`core/Networking.kt`)*
- Re-entry guard on `reset()`/`upgrade()`; list-screen "Retry" buttons wired up; the
  dashboard keeps its last-good data when a background refresh fails. *(`ui/*Screens.kt`)*

### Build / Android

- Release build enables R8 `isMinifyEnabled` + `isShrinkResources` with correct
  kotlinx.serialization keep rules (so config (de)serialization survives shrinking). *(`app/build.gradle.kts`, `app/proguard-rules.pro`)*
- Dropped the unused `navigation-compose` dependency. Added the missing `.gitignore`. *(`app/build.gradle.kts`, `.gitignore`)*

### ★ Port to iOS (`mcms_ios`)

These touch shared REST/security/safety behaviour and very likely have an iOS analogue —
review and port:

1. **Per-endpoint v1/v3 versioning** — if iOS uses a single global API version it has the
   same "no value works for everything" defect. Pin versions per endpoint per `docs/MCMS_API.md` §4.
2. **`"warning"` = success** in the `{status,data}` unwrap — a committed write must not be
   reported as a failure.
3. **Firmware `isCompatible` fail-closed** (+ extra acknowledgment for a non-compatible
   image) — this is a device-brick safety fix, not cosmetic.
4. **Remove the self-signed "escape hatch."** HANDOFF notes the Android trust-all path
   "matches the iOS self-signed escape hatch," so iOS almost certainly has the same MITM
   hole. Remove it; rely on ATS + system trust, or pin the leaf key for a known box.
5. **Credential hardening** — store email only (never the password) in the Keychain;
   clear on sign-out / when remember-me is off; don't pre-fill the password field.
6. **Reject `http://` at config time** even though iOS ATS blocks cleartext at the
   transport layer — fail early with a clear message rather than a confusing transport error.
7. **Pagination fail-fast** when a full page has no cursor, rather than silently truncating.
8. **Send a non-empty `User-Agent`** (an empty UA is rejected by MCMS, §3.1).

iOS-specific equivalents worth a glance but not 1:1 ports: cancel-safe request teardown
(don't leak the response on task cancellation), and not surfacing stale results when a
newer load is in flight.