feat(auth): add API key settings screen (#156)

* feat(auth): add API key settings screen and config manager

Implements the Android-side UI for API authentication, now that
aw-server-rust#608 landed and embedded config loads from app data dir.

- ConfigManager.kt: reads/writes [auth].api_key in config.toml stored at
  context.filesDir; uses UUID-based key generation; pure string TOML
  manipulation, no extra library dependency
- AuthSettingsActivity.kt: shows current API key, copy-to-clipboard,
  regenerate, and enable/disable toggle; prompts user to restart app
  after changes (server rereads config at startup)
- activity_auth_settings.xml: layout for the settings screen
- AndroidManifest.xml: registers AuthSettingsActivity
- MainActivity.kt: wires the previously-stub settings button to open
  AuthSettingsActivity instead of a Snackbar
- ConfigManagerTest.kt: 11 JVM unit tests covering parse/write logic
  including roundtrips and the [auth]-without-key edge case

Closes #145 (partial — "Open in browser" URL
token passing and server restart API are follow-up work)

* fix(auth): address Greptile review findings

- ConfigManager.writeApiKey: scope api_key detection to [auth] section
  only, preventing cross-section corruption when other TOML sections
  also contain an api_key field
- AuthSettingsActivity: show btnCopy immediately after enable via switch
  or regenerate button (was permanently hidden after toggle)
- AuthSettingsActivity: guard switch.isChecked setter with isUpdatingSwitch
  flag to prevent double-toast when regenerating key
- Layout: replace deprecated Switch with SwitchMaterial
- ConfigManagerTest: add cross-section api_key isolation regression test

* fix(auth): fully scope writeApiKey operations to [auth] section

The previous fix scoped the apiKeyLinePresent check but still ran
replaceFirst on the full file content, which would still clobber an
api_key field in an earlier TOML section. Now: extract the [auth]
section, perform all string operations within it, then substitute the
modified section back into the full content. Test helper mirrors the fix.

* fix(auth): suppress clipboard preview for API key on Android 13+

Set ClipDescription.EXTRA_IS_SENSITIVE so the system does not show a
plaintext preview toast of the API key when copying on Android 13+.

* fix(auth): use atomic write for config.toml via temp-file rename

* fix(ci): fallback versionCode for fork PRs

* fix(ci): upgrade artifact actions to v4

* fix(ci): use modern Android SDK tools path

* fix(ci): skip signed artifacts on fork PRs

* fix(auth): propagate API key write failures

* fix(ci): repair Linux emulator startup

* fix(ci): handle emulator without kvm acceleration

* fix(ci): make E2E screenshot best effort

* fix(auth): insert API key in newline-less auth section

* ci: re-trigger Test job (stuck pending for 14h)

* fix(ci): remove jniLibs dependency from Test job

Unit tests (./gradlew test) run on the JVM and don't require native
.so files. The jniLibs cache restore was failing because the cache was
saved by a ubicloud runner but the Test job runs on a GitHub-hosted
runner (different cache backend). Remove NDK setup and jniLibs cache
restore from the Test job, and drop the needs:[build-rust] dependency
since there are no longer any shared artifacts.

* fix(ci): restore NDK in Test job — required at Gradle config time

* fix(auth): move ConfigManager I/O off UI thread; fix spurious toast

- Add kotlinx-coroutines-android + lifecycle-runtime-ktx deps
- Wrap all ConfigManager calls in lifecycleScope.launch { withContext(Dispatchers.IO) }
  so file reads/writes never block the main thread
- Rename refreshUI() → scheduleRefreshUI() (coroutine launcher) +
  applyAuthToUI(auth) (pure UI update) to make the async boundary explicit
- Fix spurious 'Setting saved' toast: only show when the switch ON branch
  actually wrote a new key; suppress when auth was already enabled

---------

Co-authored-by: TimeToBuildBob <bob@gptme.org>

Author: TimeToBuildBob

.github/workflows/build.yml

@@ -99,16 +99,36 @@ jobs:
         submodules: 'recursive'
 
 
+    - name: Detect Fastlane secrets
+      id: fastlane_secrets
+      env:
+        KEY_FASTLANE_API: ${{ secrets.KEY_FASTLANE_API }}
+      run: |
+        if [ -n "$KEY_FASTLANE_API" ]; then
+          echo "available=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "available=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Require Fastlane secrets outside pull requests
+      if: steps.fastlane_secrets.outputs.available != 'true' && github.event_name != 'pull_request'
+      run: |
+        echo "::error::KEY_FASTLANE_API is required for non-PR builds"
+        exit 1
+
     # Ruby & Fastlane
     # version set by .ruby-version
     - name: Set up Ruby and install fastlane
+      if: steps.fastlane_secrets.outputs.available == 'true'
       uses: ruby/setup-ruby@v1
       with:
         bundler-cache: true
 
     # Needed for `fastlane update_version`
     - uses: adnsio/setup-age-action@v1.2.0
+      if: steps.fastlane_secrets.outputs.available == 'true'
     - name: Load Fastlane secrets
+      if: steps.fastlane_secrets.outputs.available == 'true'
       env:
         KEY_FASTLANE_API: ${{ secrets.KEY_FASTLANE_API }}
       run: |
@@ -121,12 +141,18 @@ jobs:
     # Retry this, in case there are concurrent jobs, which may lead to the error:
     #   "Google Api Error: Invalid request - This Edit has been deleted."
     - name: Update versionCode
+      if: steps.fastlane_secrets.outputs.available == 'true'
       uses: Wandalen/wretry.action@master
       with:
         command: bundle exec fastlane update_version
         attempt_limit: 3
         attempt_delay: 20000
 
+    - name: Use checked-in versionCode fallback
+      if: steps.fastlane_secrets.outputs.available != 'true'
+      run: |
+        echo "KEY_FASTLANE_API unavailable for pull_request build; using checked-in versionCode."
+
     - name: Output versionCode
       id: versionCode
       run: |
@@ -136,6 +162,9 @@ jobs:
     name: Build ${{ matrix.type }}
     runs-on: ubicloud-standard-4
     needs: [build-rust, get-versionCode]
+    # Fork PRs cannot access signing secrets; build/test coverage still runs in
+    # build-rust, test, and test-e2e.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     strategy:
       fail-fast: true
       matrix:
@@ -222,15 +251,14 @@ jobs:
         make dist/aw-android.${{ matrix.type }}
 
     - name: Upload
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
-        name: aw-android
+        name: aw-android-${{ matrix.type }}
         path: dist/aw-android*.${{ matrix.type }}
 
   test:
     name: Test
     runs-on: ubuntu-22.04
-    needs: [build-rust]
     env:
       SUPPLY_TRACK: production   # used by fastlane to determine track to publish to
 
@@ -239,40 +267,20 @@ jobs:
       with:
         submodules: 'recursive'
 
-    - name: Set RELEASE
-      run: |
-        echo "RELEASE=${{ startsWith(github.ref_name, 'v') }}" >> $GITHUB_ENV
-
     - name: Set up JDK
       uses: actions/setup-java@v1
       with:
         java-version: ${{ env.JAVA_VERSION }}
 
-    # Android SDK & NDK
+    # Android SDK & NDK (NDK required at Gradle configuration time even for JVM unit tests)
     - name: Set up Android SDK
       uses: android-actions/setup-android@v2
     - name: Set up Android NDK
       run: |
         sdkmanager "ndk;${{ env.NDK_VERSION }}"
         ANDROID_NDK_HOME="$ANDROID_SDK_ROOT/ndk/${{ env.NDK_VERSION }}"
-        ls $ANDROID_NDK_HOME
         echo "ANDROID_NDK_HOME=$ANDROID_NDK_HOME" >> $GITHUB_ENV
 
-
-    # Restores jniLibs from cache
-    # `actions/cache/restore` only restores, without saving back in a post-hook
-    - uses: actions/cache/restore@v3
-      id: cache-jniLibs
-      env:
-        cache-name: jniLibs
-      with:
-        path: mobile/src/main/jniLibs/
-        key: ${{ env.cache-name }}-release-${{ env.RELEASE }}-ndk-${{ env.NDK_VERSION }}-${{ hashFiles('.git/modules/aw-server-rust/HEAD') }}
-        fail-on-cache-miss: true
-    - name: Check that jniLibs present
-      run: |
-        test -e mobile/src/main/jniLibs/x86_64/libaw_server.so
-
     # Test
     - name: Test
       run: |
@@ -328,15 +336,18 @@ jobs:
       if: runner.os == 'macOS'
       run: brew install intel-haxm
 
+    - name: Set up Android SDK
+      uses: android-actions/setup-android@v2
+
     # # # Below code is majorly from https://github.com/actions/runner-images/issues/6152#issuecomment-1243718140
     - name: Create Android emulator
       run: |
         # Install AVD files
-        echo "y" | $ANDROID_HOME/tools/bin/sdkmanager --install 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
-        echo "y" | $ANDROID_HOME/tools/bin/sdkmanager --licenses
+        echo "y" | sdkmanager --install 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
+        echo "y" | sdkmanager --licenses
 
         # Create emulator
-        $ANDROID_HOME/tools/bin/avdmanager create avd -n $MATRIX_AVD -d pixel --package 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
+        avdmanager create avd -n $MATRIX_AVD -d pixel --package 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
         $ANDROID_HOME/emulator/emulator -list-avds
         if false; then
         emulator_config=~/.android/avd/$MATRIX_AVD.avd/config.ini
@@ -369,14 +380,19 @@ jobs:
       run: |
         echo "Starting emulator and waiting for boot to complete...."
         ls -la $ANDROID_HOME/emulator
-        $ANDROID_HOME/tools/emulator --accel-check  # check for hardware acceleration
-        nohup $ANDROID_HOME/tools/emulator -avd $MATRIX_AVD -gpu host -no-audio -no-boot-anim -camera-back none -camera-front none -qemu -m 2048 2>&1 &
+        emulator_args=(-avd "$MATRIX_AVD" -gpu swiftshader_indirect -no-window -no-audio -no-boot-anim -camera-back none -camera-front none)
+        if $ANDROID_HOME/emulator/emulator -accel-check; then
+          echo "Hardware acceleration available."
+        else
+          echo "Hardware acceleration unavailable; using software acceleration."
+          emulator_args+=(-accel off)
+        fi
+        nohup $ANDROID_HOME/emulator/emulator "${emulator_args[@]}" -qemu -m 2048 2>&1 &
         $ANDROID_HOME/platform-tools/adb wait-for-device shell 'while [[ -z $(getprop sys.boot_completed | tr -d '\r') ]]; do echo "wait..."; sleep 1; done; input keyevent 82'
         echo "Emulator has finished booting"
         $ANDROID_HOME/platform-tools/adb devices
         sleep 30
         mkdir -p screenshots
-        screencapture screenshots/screenshot-$SUFFIX.jpg
         $ANDROID_HOME/platform-tools/adb exec-out screencap -p > screenshots/emulator-$SUFFIX.png
 
     # # # Have to re-setup everything since we need to run emulator for faster performance on masOS ? Other os'es emulator will not startup ?
@@ -422,8 +438,6 @@ jobs:
         java-version: ${{ env.JAVA_VERSION }}
 
     # Android SDK & NDK
-    - name: Set up Android SDK
-      uses: android-actions/setup-android@v2
     - name: Set up Android NDK
       run: |
         sdkmanager "ndk;${{ env.NDK_VERSION }}"
@@ -449,15 +463,15 @@ jobs:
       env:
         SUFFIX: ${{ matrix.android_avd }}-eAPI-${{ matrix.android_emu_version }}
       run: |
-        adb shell monkey -p net.activitywatch.android.debug 1
+        adb shell monkey -p net.activitywatch.android.debug 1 || echo "App launch failed; capturing current emulator screen."
         sleep 10
-        screencapture screenshots/pscreenshot-$SUFFIX.jpg
-        $ANDROID_HOME/platform-tools/adb exec-out screencap -p > screenshots/pemulator-$SUFFIX.png
+        mkdir -p screenshots
+        $ANDROID_HOME/platform-tools/adb exec-out screencap -p > screenshots/pemulator-$SUFFIX.png || echo "Screenshot capture failed."
         ls -alh screenshots/
 
     - name: Upload logcat
       if: ${{ success() || steps.test.conclusion == 'failure'}}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: logcat
         # mobile\build\outputs\connected_android_test_additional_output\debugAndroidTest\connected\Pixel_XL_API_32(AVD) - 12\ScreenshotTest_saveDeviceScreenBitmap.png
@@ -473,7 +487,7 @@ jobs:
     #     path: ./*.mov # out.mov
 
     - name: Upload screenshots
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: ${{ success() || steps.test.conclusion == 'failure'}}
       with:
         name: screenshots
@@ -500,10 +514,11 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Download APK & AAB
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
-        name: aw-android
+        pattern: aw-android-*
         path: dist
+        merge-multiple: true
 
     - name: Display structure of downloaded files
       working-directory: dist
@@ -556,10 +571,11 @@ jobs:
 
     # Will download all artifacts to path
     - name: Download release APK & AAB
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
-        name: aw-android
+        pattern: aw-android-*
         path: dist
+        merge-multiple: true
 
     - name: Display structure of downloaded files
       working-directory: dist
@@ -581,4 +597,3 @@ jobs:
           dist/*.apk
           dist/*.aab
         # body_path: dist/release_notes/release_notes.md
-

mobile/build.gradle

@@ -78,6 +78,8 @@ dependencies {
     implementation 'androidx.constraintlayout:constraintlayout:2.1.4'
     implementation 'androidx.recyclerview:recyclerview:1.2.1'
     implementation 'androidx.lifecycle:lifecycle-extensions:2.2.0'
+    implementation 'androidx.lifecycle:lifecycle-runtime-ktx:2.6.2'
+    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3'
     implementation 'androidx.annotation:annotation:1.5.0'
 
     implementation 'com.google.android.material:material:1.7.0'

mobile/src/main/AndroidManifest.xml

@@ -48,6 +48,12 @@
             android:theme="@style/AppTheme.NoActionBar"
             android:exported="true"/>
 
+        <activity
+            android:name=".AuthSettingsActivity"
+            android:screenOrientation="portrait"
+            android:configChanges="orientation"
+            android:exported="false"/>
+
         <receiver
                 android:name=".watcher.AlarmReceiver"
                 android:enabled="true"