added android client

android/app/src/main/java/io/narl/protonstream/native/KeystoreSecretStore.kt

@@ -0,0 +1,68 @@
+package io.narl.protonstream.native
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import java.security.KeyStore
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+import uniffi.pstr_android.AndroidSecretStore
+
+/** Encrypts share fragments and passwords before they reach app preferences. */
+class KeystoreSecretStore(context: Context) : AndroidSecretStore {
+    private val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
+    private val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+
+    override fun set(key: String, value: String) {
+        val cipher = Cipher.getInstance(TRANSFORMATION)
+        cipher.init(Cipher.ENCRYPT_MODE, encryptionKey())
+        val encrypted = cipher.doFinal(value.toByteArray(Charsets.UTF_8))
+        val payload = cipher.iv + encrypted
+        check(preferences.edit().putString(key, Base64.encodeToString(payload, Base64.NO_WRAP)).commit())
+    }
+
+    override fun get(key: String): String? {
+        val encoded = preferences.getString(key, null) ?: return null
+        val payload = Base64.decode(encoded, Base64.NO_WRAP)
+        require(payload.size > IV_SIZE) { "Invalid encrypted credential" }
+        val cipher = Cipher.getInstance(TRANSFORMATION)
+        cipher.init(
+            Cipher.DECRYPT_MODE,
+            encryptionKey(),
+            GCMParameterSpec(TAG_BITS, payload.copyOfRange(0, IV_SIZE)),
+        )
+        return cipher.doFinal(payload.copyOfRange(IV_SIZE, payload.size)).toString(Charsets.UTF_8)
+    }
+
+    override fun delete(key: String) {
+        check(preferences.edit().remove(key).commit())
+    }
+
+    private fun encryptionKey(): SecretKey {
+        (keyStore.getKey(KEY_ALIAS, null) as? SecretKey)?.let { return it }
+        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore").run {
+            init(
+                KeyGenParameterSpec.Builder(
+                    KEY_ALIAS,
+                    KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+                )
+                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                    .setKeySize(256)
+                    .build(),
+            )
+            generateKey()
+        }
+    }
+
+    private companion object {
+        const val PREFERENCES = "proton_stream_secrets"
+        const val KEY_ALIAS = "proton-stream-share-secrets-v1"
+        const val TRANSFORMATION = "AES/GCM/NoPadding"
+        const val IV_SIZE = 12
+        const val TAG_BITS = 128
+    }
+}

android/app/src/main/java/io/narl/protonstream/native/NativeRuntime.kt

@@ -0,0 +1,40 @@
+package io.narl.protonstream.native
+
+import android.content.Context
+import java.io.File
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import uniffi.pstr_android.AndroidEngine
+import uniffi.pstr_android.AndroidPaths
+
+/** Process-wide owner of the Rust engine; records and decrypted media remain app-private. */
+object NativeRuntime {
+    private lateinit var appContext: Context
+    @Volatile private var instance: AndroidEngine? = null
+
+    fun initialize(context: Context) {
+        System.loadLibrary("pstr_android")
+        initTls(context)
+        appContext = context.applicationContext
+    }
+
+    /** Initializes Android's certificate verifier before Proton networking. */
+    private external fun initTls(context: Context)
+
+    suspend fun engine(): AndroidEngine = withContext(Dispatchers.IO) {
+        instance ?: synchronized(this@NativeRuntime) {
+            instance ?: createEngine().also { instance = it }
+        }
+    }
+
+    private fun createEngine(): AndroidEngine {
+        check(::appContext.isInitialized) { "NativeRuntime is not initialized" }
+        val config = File(appContext.noBackupFilesDir, "config")
+        val data = File(appContext.filesDir, "data")
+        val cache = File(appContext.cacheDir, "stream")
+        return AndroidEngine(
+            AndroidPaths(config.absolutePath, data.absolutePath, cache.absolutePath),
+            KeystoreSecretStore(appContext),
+        )
+    }
+}