Svorka/PONGo_android
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
PONGo_android/README.md
Jon Vanvik 41098831ae Security hardening + code-review fixes 
Outcome of a full multi-agent code review. Touches TLS, credential storage,
API versioning, networking correctness, concurrency/lifecycle, and the release
build. See CHANGELOG.md for the full list and the items to port to the iOS app.

Security
- Remove untrusted-TLS support: delete ServerTrustPolicy.AllowSelfSignedForHost
  and its trust-all X509TrustManager; drop the self-signed Settings toggle.
- Enforce HTTPS in normalizedBaseUrl (reject http + embedded credentials);
  add network_security_config (no cleartext, system CAs only) + allowBackup=false.
- Never persist passwords at rest: remember-me stores email only; no password
  pre-fill; clear creds on sign-out / when remember-me is off.
- Match CSRF host lookup to OkHttp's host parsing; stop leaking raw exception text.

Correctness
- Fix API versioning: hardcode v1/v3 per endpoint (docs Sec.4) instead of one
  broken global apiVersion; remove the version plumbing + Settings field.
- Treat "warning" status as success (committed write); fail-fast on a missing
  pagination cursor; close Response on cancellation; tolerant JSON parse; User-Agent.
- Firmware isCompatible fails closed + extra acknowledgment for a non-compatible image.

Concurrency / lifecycle
- Run network I/O on Dispatchers.IO; stale-result generation guards + rethrow
  CancellationException in all loads; host AppState in a ViewModel (survive config
  change); thread-safe cookie jar; reset/upgrade re-entry guard; wire list Retry.

Build
- Enable R8 minify+shrink with kotlinx.serialization keep rules; drop unused
  navigation-compose; add the missing .gitignore.

NOTE: built/verified by static review only (no Android SDK on the dev machine) —
run :app:assembleDebug and a release build before shipping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-31 17:37:48 +02:00

2.8 KiB
Raw Blame History

PON Go — Android

Native Android app for Ciena MCMS 6.2 PON Manager basics on the go — dashboard, ONU and OLT browsing/diagnostics, firmware updates, resets. Kotlin + Jetpack Compose + OkHttp. Sibling of the iOS app (../mcms_ios); the REST behaviour and field paths are identical and documented in docs/MCMS_API.md.

Status: complete and building. ./gradlew :app:assembleDebug → BUILD SUCCESSFUL, runs in the emulator. Package no.svorka.mcms, app name PON Go.

Build & run

  1. Open the folder in Android Studio → let it sync → Run on a device/emulator that can reach your MCMS host.
  2. Or CLI: ./gradlew :app:assembleDebug (needs local.properties with sdk.dir=…, and a JDK 17+ — Android Studio's bundled JBR works).

Verified toolchain on the dev machine: AGP 8.11.0, Kotlin 2.0.21, Gradle 8.13, compileSdk 36, minSdk 26, JBR 21.

What it does (feature parity with iOS)

  • Login / Settings — HTTPS-only URL normalisation (/api auto-appended, http rejected), test-connection probe, remember-me (email only — passwords are never stored, Android Keystore), sign out.
  • Dashboard — ONU/OLT/controller counts; total OLT traffic; a Health section (abnormal-Rx ONUs, laser-off OLTs) that drills into the affected devices; ONU-state breakdown; Detailed stats (opt-in Rx scan) and Auto-refresh 30 s toggles.
  • ONUs — searchable list; detail with Overview (status, firmware + update picker, optical/FEC, UNI ports, traffic), CPE (DHCPv4/v6 leases), Logs, Config (raw JSON). Reset + firmware behind hardened, acknowledge-to-enable, red confirmations.
  • OLTs — list with up/down summary; detail with status/uptime, PON traffic, environment, uplink (LLDP), registration buckets (→ ONU detail), reset.

Layout

app/src/main/java/no/svorka/mcms/
  MainActivity.kt          root: state-based nav + bottom bar
  core/                    networking / models / repositories (≈ iOS core)
    Json, ApiConfiguration, ApiError, ApiQuery, McmsEndpoint, Util,
    Models, AuthModels, Firmware, Networking, ApiClient, Repositories,
    McmsConnection, KeychainStore
  ui/                      Jetpack Compose
    Theme, Types, Components, AppState,
    AuthScreens (Login+Settings), DashboardScreen (+drill-downs),
    OnuScreens (list+detail+firmware+reset), OltScreens (list+detail)
app/src/main/res/          adaptive launcher icon, strings (app_name), colors
docs/MCMS_API.md           the MCMS REST field guide (single source of truth)

See HANDOFF.md for architecture notes, the build/verify loop, the API gotchas, and what's deliberately trimmed vs iOS. Recent security/correctness changes — and which of them to bring over to the iOS app — are in CHANGELOG.md.