Reorganize private methods, fix nullable fields, add CredentialsManager tests

Author: utkrishtsahu

auth0/src/main/java/com/auth0/android/authentication/MfaApiClient.kt

@@ -140,139 +140,6 @@ public class MfaApiClient @VisibleForTesting(otherwise = VisibleForTesting.PRIVA
         return request
     }
 
-    /**
-     * Creates a JSON adapter that filters and deduplicates authenticators based on allowed factor types.
-     *
-     * This processing is performed internally by the SDK after receiving the API response.
-     * The client only specifies which factor types are allowed; all filtering and deduplication
-     * logic is handled transparently by the SDK.
-     *
-     * **Filtering:**
-     * Authenticators are filtered by their effective type:
-     * - OOB authenticators: matched by their channel ("sms" or "email")
-     * - Other authenticators: matched by their type ("otp", "recovery-code", etc.)
-     *
-     * **Deduplication:**
-     * Multiple enrollments of the same phone number or email are consolidated:
-     * - Active authenticators are preferred over inactive ones
-     * - Among authenticators with the same status, the most recently created is kept
-     *
-     * @param factorsAllowed List of factor types to include (e.g., ["sms", "email", "otp"])
-     * @return A JsonAdapter that produces a filtered and deduplicated list of authenticators
-     */
-    private fun createFilteringAuthenticatorsAdapter(factorsAllowed: List<String>): JsonAdapter<List<Authenticator>> {
-        val baseAdapter = GsonAdapter.forListOf(Authenticator::class.java, gson)
-        return object : JsonAdapter<List<Authenticator>> {
-            override fun fromJson(reader: Reader, metadata: Map<String, Any>): List<Authenticator> {
-                val allAuthenticators = baseAdapter.fromJson(reader, metadata)
-                
-                val filtered = allAuthenticators.filter { authenticator ->
-                    matchesFactorType(authenticator, factorsAllowed)
-                }
-                
-                return deduplicateAuthenticators(filtered)
-            }
-        }
-    }
-
-    /**
-     * Checks if an authenticator matches any of the allowed factor types.
-     *
-     * The matching logic handles various factor type aliases:
-     * - "sms" or "phone": matches OOB authenticators with SMS channel
-     * - "email": matches OOB authenticators with email channel
-     * - "otp" or "totp": matches time-based one-time password authenticators
-     * - "oob": matches any out-of-band authenticator regardless of channel
-     * - "recovery-code": matches recovery code authenticators
-     * - "push-notification": matches push notification authenticators
-     *
-     * @param authenticator The authenticator to check
-     * @param factorsAllowed List of allowed factor types
-     * @return true if the authenticator matches any allowed factor type
-     */
-    private fun matchesFactorType(authenticator: Authenticator, factorsAllowed: List<String>): Boolean {
-        val effectiveType = getEffectiveType(authenticator)
-        
-        return factorsAllowed.any { factor ->
-            val normalizedFactor = factor.lowercase(java.util.Locale.ROOT)
-            when (normalizedFactor) {
-                "sms", "phone" -> effectiveType == "sms" || effectiveType == "phone"
-                "email" -> effectiveType == "email"
-                "otp", "totp" -> effectiveType == "otp" || effectiveType == "totp"
-                "oob" -> authenticator.authenticatorType == "oob" || authenticator.type == "oob"
-                "recovery-code" -> effectiveType == "recovery-code"
-                "push-notification" -> effectiveType == "push-notification"
-                else -> effectiveType == normalizedFactor || 
-                        authenticator.authenticatorType?.lowercase(java.util.Locale.ROOT) == normalizedFactor ||
-                        authenticator.type.lowercase(java.util.Locale.ROOT) == normalizedFactor
-            }
-        }
-    }
-
-    /**
-     * Resolves the effective type of an authenticator for filtering purposes.
-     *
-     * OOB (out-of-band) authenticators use their channel ("sms" or "email") as the
-     * effective type, since users typically filter by delivery method rather than
-     * the generic "oob" type. Other authenticators use their authenticatorType directly.
-     *
-     * @param authenticator The authenticator to get the type for
-     * @return The effective type string used for filtering
-     */
-    private fun getEffectiveType(authenticator: Authenticator): String {
-        return when (authenticator.authenticatorType) {
-            "oob" -> authenticator.oobChannel ?: "oob"
-            else -> authenticator.authenticatorType ?: authenticator.type
-        }
-    }
-
-    /**
-     * Removes duplicate authenticators to return only the most relevant enrollment per identity.
-     *
-     * Users may have multiple enrollments for the same phone number or email address
-     * (e.g., from re-enrolling after failed attempts). This method consolidates them
-     * to present a clean list:
-     *
-     * **Grouping strategy:**
-     * - SMS/Email (OOB): grouped by channel + name (e.g., all "+1234567890" SMS entries)
-     * - TOTP: each authenticator is unique (different authenticator apps)
-     * - Recovery code: only one per user
-     *
-     * **Selection criteria (in order of priority):**
-     * 1. Active authenticators are preferred over inactive ones
-     * 2. Among same status, the most recently created is selected
-     *
-     * @param authenticators The list of authenticators to deduplicate
-     * @return A deduplicated list with one authenticator per unique identity
-     */
-    private fun deduplicateAuthenticators(authenticators: List<Authenticator>): List<Authenticator> {
-        val grouped = authenticators.groupBy { authenticator ->
-            when (authenticator.authenticatorType) {
-                "oob" -> {
-                    val channel = authenticator.oobChannel ?: "unknown"
-                    val name = authenticator.name ?: authenticator.id
-                    "$channel:$name"
-                }
-                "otp" -> {
-                    authenticator.id
-                }
-                "recovery-code" -> {
-                    "recovery-code"
-                }
-                else -> {
-                    authenticator.id
-                }
-            }
-        }
-
-        return grouped.values.map { group ->
-            group.sortedWith(
-                compareByDescending<Authenticator> { it.active }
-                    .thenByDescending { it.createdAt ?: "" }
-            ).first()
-        }
-    }
-
     /**
      * Enrolls a new MFA factor for the user.
      *
@@ -402,6 +269,86 @@ public class MfaApiClient @VisibleForTesting(otherwise = VisibleForTesting.PRIVA
         }
     }
 
+    // ========== Private Helper Methods ==========
+
+    /**
+     * Creates a JSON adapter that filters authenticators based on allowed factor types.
+     *
+     * This processing is performed internally by the SDK after receiving the API response.
+     * The client only specifies which factor types are allowed; all filtering logic is handled
+     * transparently by the SDK.
+     *
+     * **Filtering:**
+     * Authenticators are filtered by their effective type:
+     * - OOB authenticators: matched by their channel ("sms" or "email")
+     * - Other authenticators: matched by their type ("otp", "recovery-code", etc.)
+     *
+     * @param factorsAllowed List of factor types to include (e.g., ["sms", "email", "otp"])
+     * @return A JsonAdapter that produces a filtered list of authenticators
+     */
+    private fun createFilteringAuthenticatorsAdapter(factorsAllowed: List<String>): JsonAdapter<List<Authenticator>> {
+        val baseAdapter = GsonAdapter.forListOf(Authenticator::class.java, gson)
+        return object : JsonAdapter<List<Authenticator>> {
+            override fun fromJson(reader: Reader, metadata: Map<String, Any>): List<Authenticator> {
+                val allAuthenticators = baseAdapter.fromJson(reader, metadata)
+                
+                return allAuthenticators.filter { authenticator ->
+                    matchesFactorType(authenticator, factorsAllowed)
+                }
+            }
+        }
+    }
+
+    /**
+     * Checks if an authenticator matches any of the allowed factor types.
+     *
+     * The matching logic handles various factor type aliases:
+     * - "sms" or "phone": matches OOB authenticators with SMS channel
+     * - "email": matches OOB authenticators with email channel
+     * - "otp" or "totp": matches time-based one-time password authenticators
+     * - "oob": matches any out-of-band authenticator regardless of channel
+     * - "recovery-code": matches recovery code authenticators
+     * - "push-notification": matches push notification authenticators
+     *
+     * @param authenticator The authenticator to check
+     * @param factorsAllowed List of allowed factor types
+     * @return true if the authenticator matches any allowed factor type
+     */
+    private fun matchesFactorType(authenticator: Authenticator, factorsAllowed: List<String>): Boolean {
+        val effectiveType = getEffectiveType(authenticator)
+        
+        return factorsAllowed.any { factor ->
+            val normalizedFactor = factor.lowercase(java.util.Locale.ROOT)
+            when (normalizedFactor) {
+                "sms", "phone" -> effectiveType == "sms" || effectiveType == "phone"
+                "email" -> effectiveType == "email"
+                "otp", "totp" -> effectiveType == "otp" || effectiveType == "totp"
+                "oob" -> authenticator.authenticatorType == "oob" || authenticator.type == "oob"
+                "recovery-code" -> effectiveType == "recovery-code"
+                "push-notification" -> effectiveType == "push-notification"
+                else -> effectiveType == normalizedFactor || 
+                        authenticator.authenticatorType?.lowercase(java.util.Locale.ROOT) == normalizedFactor ||
+                        authenticator.type.lowercase(java.util.Locale.ROOT) == normalizedFactor
+            }
+        }
+    }
+
+    /**
+     * Resolves the effective type of an authenticator for filtering purposes.
+     *
+     * OOB (out-of-band) authenticators use their channel ("sms" or "email") as the
+     * effective type, since users typically filter by delivery method rather than
+     * the generic "oob" type. Other authenticators use their authenticatorType directly.
+     *
+     * @param authenticator The authenticator to get the type for
+     * @return The effective type string used for filtering
+     */
+    private fun getEffectiveType(authenticator: Authenticator): String {
+        return when (authenticator.authenticatorType) {
+            "oob" -> authenticator.oobChannel ?: "oob"
+            else -> authenticator.authenticatorType ?: authenticator.type
+        }
+    }
 
     /**
      * Helper function for OOB enrollment (SMS, email, push).

auth0/src/main/java/com/auth0/android/result/EnrollmentChallenge.kt

@@ -34,9 +34,9 @@ public sealed class EnrollmentChallenge {
 
 public data class MfaEnrollmentChallenge(
     @SerializedName("id")
-    override val id: String?,
+    override val id: String,
     @SerializedName("auth_session")
-    override val authSession: String?
+    override val authSession: String
 ) : EnrollmentChallenge()
 
 /**

auth0/src/test/java/com/auth0/android/authentication/MfaExceptionTest.kt

@@ -1,6 +1,10 @@
 package com.auth0.android.authentication
 
 import com.auth0.android.authentication.MfaException.*
+import com.auth0.android.authentication.storage.CredentialsManagerException
+import com.auth0.android.result.MfaFactor
+import com.auth0.android.result.MfaRequiredErrorPayload
+import com.auth0.android.result.MfaRequirements
 import org.hamcrest.MatcherAssert.assertThat
 import org.hamcrest.Matchers.*
 import org.junit.Test
@@ -299,4 +303,110 @@ public class MfaExceptionTest {
         assertThat(verifyException.message, containsString("custom_error_code"))
     }
 
+    // ========== CredentialsManagerException MFA Tests ==========
+
+    @Test
+    public fun shouldCredentialsManagerExceptionHaveNullMfaPayloadByDefault(): Unit {
+        val exception = CredentialsManagerException.RENEW_FAILED
+
+        assertThat(exception.mfaRequiredErrorPayload, `is`(nullValue()))
+        assertThat(exception.mfaToken, `is`(nullValue()))
+    }
+
+    @Test
+    public fun shouldCredentialsManagerExceptionMfaRequiredHaveCorrectMessage(): Unit {
+        val exception = CredentialsManagerException.MFA_REQUIRED
+
+        assertThat(exception.message, containsString("Multi-factor authentication is required"))
+    }
+
+    @Test
+    public fun shouldCredentialsManagerExceptionMfaTokenReturnCorrectValue(): Unit {
+        // Create an MFA payload with a token
+        val mfaPayload = MfaRequiredErrorPayload(
+            error = "mfa_required",
+            errorDescription = "Multifactor authentication required",
+            mfaToken = "test_mfa_token_123",
+            mfaRequirements = null
+        )
+
+        // Use reflection to create exception with payload since constructor is internal
+        val exceptionClass = CredentialsManagerException::class.java
+        val constructor = exceptionClass.getDeclaredConstructor(
+            CredentialsManagerException.Code::class.java,
+            String::class.java,
+            Throwable::class.java,
+            MfaRequiredErrorPayload::class.java
+        )
+        constructor.isAccessible = true
+        
+        val codeClass = Class.forName("com.auth0.android.authentication.storage.CredentialsManagerException\$Code")
+        val mfaRequiredCode = codeClass.getDeclaredField("MFA_REQUIRED").get(null)
+        
+        val exception = constructor.newInstance(
+            mfaRequiredCode,
+            "MFA required",
+            null,
+            mfaPayload
+        ) as CredentialsManagerException
+
+        assertThat(exception.mfaRequiredErrorPayload, `is`(notNullValue()))
+        assertThat(exception.mfaToken, `is`("test_mfa_token_123"))
+        assertThat(exception.mfaRequiredErrorPayload?.mfaToken, `is`("test_mfa_token_123"))
+    }
+
+    @Test
+    public fun shouldCredentialsManagerExceptionMfaPayloadContainRequirements(): Unit {
+        // Create MFA requirements with challenge
+        val challengeFactors = listOf(MfaFactor(type = "otp"), MfaFactor(type = "sms"))
+        val requirements = MfaRequirements(challenge = challengeFactors, enroll = null)
+        val mfaPayload = MfaRequiredErrorPayload(
+            error = "mfa_required",
+            errorDescription = "Multifactor authentication required",
+            mfaToken = "token_with_requirements",
+            mfaRequirements = requirements
+        )
+
+        // Use reflection to create exception with payload
+        val exceptionClass = CredentialsManagerException::class.java
+        val constructor = exceptionClass.getDeclaredConstructor(
+            CredentialsManagerException.Code::class.java,
+            String::class.java,
+            Throwable::class.java,
+            MfaRequiredErrorPayload::class.java
+        )
+        constructor.isAccessible = true
+        
+        val codeClass = Class.forName("com.auth0.android.authentication.storage.CredentialsManagerException\$Code")
+        val mfaRequiredCode = codeClass.getDeclaredField("MFA_REQUIRED").get(null)
+        
+        val exception = constructor.newInstance(
+            mfaRequiredCode,
+            "MFA required",
+            null,
+            mfaPayload
+        ) as CredentialsManagerException
+
+        assertThat(exception.mfaRequiredErrorPayload, `is`(notNullValue()))
+        assertThat(exception.mfaRequiredErrorPayload?.mfaRequirements, `is`(notNullValue()))
+        assertThat(exception.mfaRequiredErrorPayload?.mfaRequirements?.challenge?.map { it.type }, `is`(listOf("otp", "sms")))
+    }
+
+    @Test
+    public fun shouldCredentialsManagerExceptionEqualityIgnoreMfaPayload(): Unit {
+        // Two MFA_REQUIRED exceptions should be equal regardless of payload
+        val exception1 = CredentialsManagerException.MFA_REQUIRED
+        val exception2 = CredentialsManagerException.MFA_REQUIRED
+
+        assertThat(exception1, `is`(exception2))
+        assertThat(exception1.hashCode(), `is`(exception2.hashCode()))
+    }
+
+    @Test
+    public fun shouldCredentialsManagerExceptionStaticInstancesBeDistinct(): Unit {
+        assertThat(CredentialsManagerException.MFA_REQUIRED, `is`(not(CredentialsManagerException.RENEW_FAILED)))
+        assertThat(CredentialsManagerException.MFA_REQUIRED, `is`(not(CredentialsManagerException.NO_CREDENTIALS)))
+        assertThat(CredentialsManagerException.MFA_REQUIRED, `is`(not(CredentialsManagerException.API_ERROR)))
+    }
+
 }