Implements a full app lock (issue #1313) gating Aurora Store behind the
device biometric or, where unavailable, the screen-lock credential
(PIN/pattern/password) so it also works on TVs and older phones.
- AppLockManager: process-scoped, in-memory lock state so a cold start is
always locked, with a short background grace timeout to avoid
re-prompting during the install dialog or the biometric sheet itself.
- AppLockAuthenticator: BiometricPrompt wrapper using
BIOMETRIC_STRONG | DEVICE_CREDENTIAL on API 30+ and
setDeviceCredentialAllowed on older releases, plus an enrollment check.
- ComposeActivity (now a FragmentActivity) gates content via a three-state
machine (AUTHENTICATING/LOCKED/UNLOCKED); the authenticating state shows
a blank surface behind the prompt so dismissing it never flashes the
lock card. Re-locks on return past the timeout and sets FLAG_SECURE
while locked.
- Toggle lives on a dedicated Security preference screen, reached from
Settings like the other preference entries.
Address #1386
The Shizuku branch of getPreferredInstaller() already fell back to the
session installer, but the guard hasShizukuPerm() called
Shizuku.checkSelfPermission(), which throws when the binder is not alive
(Shizuku disabled). The exception escaped before the fallback could run,
so installs failed instead of falling back.
- Guard hasShizukuPerm() on Shizuku.pingBinder() and swallow failures so
it returns false (instead of throwing) when Shizuku is unavailable,
letting the existing fallback run. This also fixes canInstallSilently().
- Detect when any chosen installer resolves to the default and optionally
inform the user via a toast, gated by notifyOnFallback so cancel/remove
callers stay silent while real install paths surface it.
- Check free space before downloading (only the not-yet-fetched bytes) and, on
Android O+, use StorageManager.getAllocatableBytes/allocateBytes so the system
can evict its cache; fail fast with a clear message instead of dying mid-write.
SessionInstaller sets a SessionParams size hint so staging can reserve space
too.
- Verify each APK at most once: files already verified during the download pass
are skipped in the final verification gate. Prefer SHA-256 and log SHA-1
fallback.
- An expired download URL (403/410) now clears the stored file lists and retries,
re-purchasing fresh URLs instead of repeatedly failing on the dead one.
- Cancel promptly mid-file rather than only between files, and cancel copyTo's
progress timer in a finally to avoid leaking the timer thread.
- Download.canInstall now requires a real .apk on disk; DownloadStatus
finished/running are Sets.
A download row previously stopped at COMPLETED and never reflected whether the
app actually installed. Add INSTALLING/INSTALLED states driven by a central
installer-event observer in DownloadHelper:
- COMPLETED -> INSTALLING on the installer's first progress event
- -> INSTALLED on success (row kept so the APK can still be exported)
- a failed install reverts INSTALLING -> COMPLETED so it can be re-installed
without re-downloading
Consumers that branched on COMPLETED are updated (App Details state, MicroG
status mapping, Downloads list icon). downloadStatus is stored as TEXT so no
schema migration is needed.
Fold Aurora Store's self-update back into the existing update pipeline
instead of a dedicated sheet/viewmodel/helper. The feed entry is mapped
to a regular App and added to the update list, reusing the standard
download + install path; it is never auto-installed silently.
- Add a dedicated "Self-update" section in the Updates tab with the
app-details navigation disabled (it's served from the Aurora OSS feed).
- Gate eligibility via PackageUtil.isSelfUpdateSupported(): vanilla/preload
flavors, not debug, not F-Droid (huawei excluded by flavor).
- Add a build-aware Settings toggle as the opt-out, removing the row
immediately when disabled.
- Exempt nightly self-updates from deleteInvalidUpdates (static version
code) and drop any stale self-update row when none is offered, so a
phantom update doesn't linger after a self-install.
Share a sort/filter sheet between InstalledScreen and BlacklistScreen via
new commons module (SortFilterState + SortFilterSheet + applyFilter/applySort
on InstalledAppMeta), persisted per-screen. InstalledScreen renders a new
InstalledAppListItem that surfaces size, last-update, and installer instead
of Play-listing extras. Blacklisted rows now desaturate their icons.
- New SourceFiltersScreen with All toggle + add/remove of specific
installer package names. Backed by PREFERENCE_FILTER_INSTALLERS
(Set<String>); PREFERENCE_FILTER_AURORA_ONLY preserved as the All
switch for backward compat.
- UpdateWorker reads installer via getInstallSourceInfo (R+) / falls
back to deprecated getInstallerPackageName below.
- UpdatesPreferenceScreen: "Filter F-Droid apps" moved to Advanced;
"Filter apps from other sources" becomes a navigation row to the
new sub-screen with a state summary.
Replace the 1-24h slider with a SingleChoiceDialog listing 7 presets
(3h, 6h, 12h, 24h, 3d, 7d, 15d). Storage stays as an Int hour count
under the same preference key, so old values keep working; off-preset
values display as the nearest preset but are only overwritten when the
user picks something new.
- Group updates into main / approval-required / incompatible / ignored
- New ignored_update table (v8) with per-version skip support
- isIncompatible flag on pristine system apps for HyperOS / GrapheneOS (v7)
- requiresOwnershipTransfer() runtime check on Android 14+
- Rename AppMenuSheet -> AppUpdateSheet; drop MinimalApp, nav carries Update
- Trim AppUpdateItem (no changelog dropdown / long-click)
- Fix DownloadHelper.downloadsList recomposition flicker (stable StateFlow)
- ExportWorker is now download-only
Drops the legacy AuroraTheme styles, custom attrs and now-unused
styles_widget/styles_text overlays. Updates the dark/light themes,
strings, arrays, dimens and colors to match what the Compose screens
consume. Adds ic_logo_alt and tweaks the launcher/logo drawables.
Trims gradle dependencies tied to the removed Fragment/Epoxy stack.
Deletes res/layout/*, res/menu/*, the mobile_navigation graph,
preference_*.xml screens, and the fade in/out anims plus the
material-switch color selector. The Compose screens own all of
this rendering now.
