fix(sync): refuse a release notice older than the stored one

app_release.json is signed, but a mirror can still serve an older
signed copy, and that replaced the stored notice, hiding a newer
release from Home. saveAppReleaseNotice now compares the stored
version code inside the same DataStore edit as the write and keeps the
stored notice when it is for a later release. An equal code still
replaces it, so a release can be republished. refreshAppReleaseNotice
returns whether the notice was kept; its callers ignore the result.

AppReleaseNoticeRepositoryTest gains a rollback test, which fails with
the check removed. The existing "a current build shows none" test was
wrong for this behavior: it served a current-build notice after a newer
one and expected the newer one to vanish, which is the rollback this
change refuses. It now serves the current-build notice first on an
empty store and keeps all three of its assertions.

Author: SysAdminDoc

CHANGELOG.md

@@ -4,6 +4,7 @@ All notable changes to CallShield will be documented in this file.
 
 ## Unreleased
 
+- The update notice on Home can't be swapped back to an older release anymore. A mirror serving an older signed notice used to replace the newer one, which could hide an update.
 - Regex rules shaped like a long run of optional digits, or a repeated group that ends in an optional part, are now turned down when you add them, since they could hold up call screening. One saved earlier in such a shape no longer runs.
 - Turning the phone while Not spam waits out its Undo, or while Report is still going out, no longer loses the message that follows. Report's Undo for the block stays too.
 - A number you block, unblock or report while the spam database is updating keeps that change when the update finishes. A change made just before the update wrote its rows could be put back the way it was.

README.md

@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/SysAdminDoc/CallShield/releases/latest"><img src="https://img.shields.io/github/v/release/SysAdminDoc/CallShield?style=flat-square&color=a6e3a1" alt="Release"></a>
   <img src="https://img.shields.io/badge/Spam%20Numbers-51%2C403-f38ba8?style=flat-square" alt="51,403 Numbers">
-  <img src="https://img.shields.io/badge/JVM%20unit%20tests-2046-94e2d5?style=flat-square" alt="2046 JVM unit tests">
+  <img src="https://img.shields.io/badge/JVM%20unit%20tests-2047-94e2d5?style=flat-square" alt="2047 JVM unit tests">
   <img src="https://img.shields.io/badge/Android-10%2B-89b4fa?style=flat-square" alt="Android 10+">
   <img src="https://img.shields.io/badge/License-MIT-cba6f7?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/API%20Keys-None-fab387?style=flat-square" alt="No required API keys">
@@ -592,12 +592,12 @@ RELEASE_KEY_PASSWORD=...
 ## Testing
 
 ```bash
-./gradlew testDebugUnitTest   # 2046 tests
+./gradlew testDebugUnitTest   # 2047 tests
 ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.sysadmindoc.callshield.platform.TargetSdkBehaviorSmokeTest
 ./gradlew verifyPipelineTests # Cloudflare Worker (node) + data-pipeline and translation checks (python)
 ```
 
-The suite is **2046 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
+The suite is **2047 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
 
 Two GitHub workflows run without building the app. **Validation** runs the Worker and
 pipeline suites on every push except report-only ones (`run-pipeline-tests.ps1 -CorrectnessOnly`),
@@ -634,7 +634,7 @@ language in [issue #7](https://github.com/SysAdminDoc/CallShield/issues/7).
 | Community API | Cloudflare Workers |
 | URL Safety | Local spam-domain data, with optional PhishTank and OpenPhish |
 | Verification | Local Gradle, lint, and release-artifact checks |
-| Tests | 2046 JVM unit tests (JUnit) |
+| Tests | 2047 JVM unit tests (JUnit) |
 | Strings | 1792 string resources and 49 plural groups (translation-ready) |
 | Accessibility | 100+ content descriptions, 48dp touch targets |
 | Min SDK | 29 (Android 10) |

app/src/main/java/com/sysadmindoc/callshield/data/repository/SettingsRepository.kt

@@ -276,13 +276,22 @@ class SettingsRepository(
                 notice.takeIf { it.shouldShow(installedCode, prefs[SpamRepository.KEY_RELEASE_NOTICE_DISMISSED] ?: 0) }
             }.distinctUntilChanged()
 
-    suspend fun saveAppReleaseNotice(notice: AppReleaseNotice) {
+    /**
+     * Keeps [notice] unless the stored one is for a later release, so a mirror
+     * serving an older signed file can't hide a newer release. Returns whether
+     * it was kept.
+     */
+    suspend fun saveAppReleaseNotice(notice: AppReleaseNotice): Boolean {
+        var kept = false
         dataStore.edit {
+            if ((it[SpamRepository.KEY_RELEASE_NOTICE_CODE] ?: 0) > notice.versionCode) return@edit
             it[SpamRepository.KEY_RELEASE_NOTICE_CODE] = notice.versionCode
             it[SpamRepository.KEY_RELEASE_NOTICE_NAME] = notice.versionName
             it[SpamRepository.KEY_RELEASE_NOTICE_URL] = notice.releaseUrl
             it[SpamRepository.KEY_RELEASE_NOTICE_SHA256] = notice.apkSha256
+            kept = true
         }
+        return kept
     }
 
     suspend fun dismissAppReleaseNotice(versionCode: Int) {

app/src/main/java/com/sysadmindoc/callshield/data/repository/SyncRepository.kt

@@ -293,13 +293,13 @@ class SyncRepository(
 
     /**
      * Fetches the signed release notice and keeps it for Home. A missing,
-     * unsigned or refused file changes nothing, so the last good notice stays.
+     * unsigned or refused file changes nothing, so the last good notice stays,
+     * and so does a stored notice for a later release than the one served.
      */
     suspend fun refreshAppReleaseNotice(): Boolean =
         withContext(Dispatchers.IO) {
             val notice = remote.fetchAppReleaseNotice().getOrNull() ?: return@withContext false
             settingsRepository.saveAppReleaseNotice(notice)
-            true
         }
 
     private val bundledListCatalog: ParsedListCatalog? by lazy {

app/src/test/java/com/sysadmindoc/callshield/data/AppReleaseNoticeRepositoryTest.kt

@@ -67,17 +67,35 @@ class AppReleaseNoticeRepositoryTest {
     fun `a refused or missing file keeps the last good notice, and a current build shows none`() =
         runBlocking {
             val repo = fixture.repository
+            served = Result.success(notice(BuildConfig.VERSION_CODE))
+            repo.refreshAppReleaseNotice()
+            assertNull(repo.appReleaseNotice.first())
+
             val newer = notice(BuildConfig.VERSION_CODE + 1)
             served = Result.success(newer)
             repo.refreshAppReleaseNotice()
 
             served = Result.failure(IOException("signature doesn't verify"))
             assertFalse(repo.refreshAppReleaseNotice())
             assertEquals(newer, repo.appReleaseNotice.first())
+        }
 
-            served = Result.success(notice(BuildConfig.VERSION_CODE))
-            repo.refreshAppReleaseNotice()
-            assertNull(repo.appReleaseNotice.first())
+    @Test
+    fun `an older notice than the stored one is refused, and the same release can be republished`() =
+        runBlocking {
+            val repo = fixture.repository
+            val newer = notice(BuildConfig.VERSION_CODE + 2)
+            served = Result.success(newer)
+            assertTrue(repo.refreshAppReleaseNotice())
+
+            served = Result.success(notice(BuildConfig.VERSION_CODE + 1))
+            assertFalse(repo.refreshAppReleaseNotice())
+            assertEquals(newer, repo.appReleaseNotice.first())
+
+            val republished = newer.copy(apkSha256 = "cd".repeat(32))
+            served = Result.success(republished)
+            assertTrue(repo.refreshAppReleaseNotice())
+            assertEquals(republished, repo.appReleaseNotice.first())
         }
 
     private fun notice(code: Int) =