android-compat: Room, WorkManager, location, sensors, services and Keystore

.github/codeql/codeql-config.yml

@@ -31,3 +31,10 @@ paths-ignore:
   # against the JVM, and writing the casts out would change the bytecode shape
   # (the DUP2 of a compound array store) that the comparison is there to cover.
   - 'vm/tests/src/test/resources/com/codename1/tools/translator/JsNumericDifferentialApp.java'
+  # The AES of the compatibility tests' headless Codename One implementation,
+  # a test double that hands the IV the code under test chose straight to the
+  # JDK. Those IVs are random (com.codename1.security.SecureRandom, filled by
+  # the JDK's SecureRandom.nextBytes here, or the tests' own nextBytes), but
+  # CodeQL treats a `new byte[n]` filled in another method as a static IV and
+  # reports this sink for each of them.
+  - 'maven/compat-testing/src/main/java/com/codename1/compat/testing/HeadlessAes.java'

CodenameOne/src/com/codename1/location/Location.java

@@ -131,7 +131,8 @@ public float getAccuracy() {
     }
 
     public void setAccuracy(float accuracy) {
-        if (Float.isNaN(accuracy)) {
+        // A NaN reading means the platform has none; keep the previous value.
+        if (!Float.isNaN(accuracy)) {
             this.accuracy = accuracy;
         }
     }

NOTICE

@@ -177,6 +177,25 @@ NETStandard.Library.Ref is distributed under the MIT license:
   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
   SOFTWARE.
+
+================================================================================
+Android Open Source Project: SensorManager math
+================================================================================
+
+maven/android-compat/src/main/java/android/hardware/SensorMath.java is rewritten
+from the static methods of android.hardware.SensorManager in the Android Open
+Source Project (https://source.android.com), so that rotation matrices,
+orientation angles and altitude computed by Android applications on the
+Codename One compatibility runtime match the platform's. It retains the
+original copyright notice:
+
+  Copyright (C) 2008 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License"); you may not
+  use this file except in compliance with the License. You may obtain a copy of
+  the License at http://www.apache.org/licenses/LICENSE-2.0
+
+================================================================================
 GroupLayout
 ================================================================================
 

docs/developer-guide/Android-Interop.asciidoc

@@ -165,6 +165,23 @@ view class the Codename One Android runtime implements (android2cn1:E0201)`.
 * XML: `getResources().getXml()` returns a pull parser over the compiled
   resource, and `Xml.newPullParser()` and `Xml.newSerializer()` read and write
   XML text.
+* Room: entities, DAOs, type converters, `@Embedded`, `@Upsert`, `@RawQuery`,
+  `LiveData` queries and migrations. The build generates the `_Impl` classes
+  that the Room annotation processor would, so nothing is found by reflection.
+* WorkManager: one-time and periodic work, chains whose outputs merge into the
+  next worker's input, unique work, retries with a growing delay and `LiveData` status
+  queries. Pending work is saved and resumes on the next run.
+* Location and sensors: `LocationManager` with its listeners, last known and
+  current location, and `SensorManager` with the accelerometer, gyroscope,
+  magnetometer, gravity, rotation vector and orientation, including
+  `getRotationMatrix()` and `getOrientation()`.
+* Services declared in the manifest: started and bound services,
+  `IntentService`, and `startForeground()`, which runs as a Codename One
+  `ForegroundService`. Notifications and channels posted through
+  `NotificationManager` and `NotificationCompat` are shown as local
+  notifications.
+* The `AndroidKeyStore` with AES keys from `KeyGenerator` and
+  `KeyGenParameterSpec`, used through `Cipher` in GCM or CBC mode.
 
 === AndroidX
 
@@ -321,11 +338,13 @@ the gallery and automated tests cover a subset of those behaviors.
   elements. Code that depends on serialization making a snapshot, creator-side
   validation, or restoring state after process death needs an explicit storage
   or copy implementation.
-* SQLite uses one Codename One database connection. A competing thread's
-  operations can throw `SQLiteDatabaseLockedException` while a transaction is
-  open; Android's connection-pool waiting behavior isn't implemented.
-  Serialize database work through one worker when sharing a database across
-  tasks. Full Android SQLite concurrency parity is outside this release's scope.
+* SQLite uses one Codename One database connection. While one thread's
+  transaction is open, another thread's statements wait for it to end, as on
+  Android, and throw `SQLiteDatabaseLockedException` after ten seconds. On the
+  main thread the wait is two seconds, because the UI is frozen while it
+  waits and the other thread may be waiting for the main thread itself.
+  Threads don't read concurrently: one thread's long transaction holds up every
+  other thread's queries.
 * Switching only a locale's script, such as `zh-Hans` to `zh-Hant` with the
   same region, updates resource selection but doesn't notify or recreate
   existing activities. Already-inflated text and layouts can retain the old
@@ -373,9 +392,32 @@ the gallery and automated tests cover a subset of those behaviors.
 * Gradle recompiles all Java sources in an imported Android project after a
   source edit, because relocation rewrites the compiler output. Unchanged
   builds still use Gradle's up-to-date checks.
-* Content providers, services, broadcast intents from the system and
-  notifications through `NotificationManager` aren't available; use the
-  corresponding Codename One APIs through native interfaces or directly.
+* Content providers and broadcast intents from the system aren't available;
+  use the corresponding Codename One APIs through native interfaces or
+  directly.
+* `AndroidKeyStore` keys aren't hardware backed or non-extractable. Their
+  material is kept in Codename One's `SecureStorage` without a prompt: the
+  keychain on iOS, and a key of the platform's own keystore on Android. A
+  port without a secure store keeps the material in the application's private
+  storage, which a rooted device or a backup can read.
+  `setUserAuthenticationRequired()` isn't enforced; for a key the user must
+  unlock, use `SecureStorage` with a reason, which prompts for biometrics.
+  GCM supports only 128-bit tags.
+* Room rejects `@Relation`, `suspend` DAO methods, `Flow`, RxJava and Paging
+  return types, `@AutoMigration`, `@DatabaseView` and full-text tables at
+  build time, naming the member. `createFromAsset()` fails when the database
+  is built.
+* A `ListenableWorker` subclass returns a `java.util.concurrent.Future`
+  rather than Guava's `ListenableFuture`; `Worker` subclasses are unaffected.
+  A network constraint is treated as met, and charging, idle, battery and
+  storage constraints are checked only where Codename One's `BackgroundWork`
+  supports them. Work saved by an earlier run resumes once the application
+  calls `WorkManager.getInstance()`.
+* A manifest that asks for location access gets the iOS location usage
+  descriptions, and with `ACCESS_BACKGROUND_LOCATION` or
+  `FOREGROUND_SERVICE_LOCATION` the `location` background mode, added to
+  `codenameone_settings.properties` when the project doesn't set them. Edit
+  the added text to change what the iOS permission prompt says.
 * `ViewModelProvider` creates view models without reflection: the build
   registers every public, concrete `ViewModel` class whose public constructor
   takes nothing, an `Application`, a `SavedStateHandle`, or an `Application`

maven/android-compat/spotbugs-exclude.xml

@@ -362,4 +362,13 @@
         <Method name="setNavigationIcon"/>
         <Bug pattern="UR_UNINIT_READ_CALLED_FROM_SUPER_CONSTRUCTOR"/>
     </Match>
+    <!--
+        The support-library configuration publishes its settings as public
+        final fields, as AndroidX does; the framework helper reads only the
+        ones this runtime acts on.
+    -->
+    <Match>
+        <Class name="androidx.sqlite.db.SupportSQLiteOpenHelper$Configuration"/>
+        <Bug pattern="URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD"/>
+    </Match>
 </FindBugsFilter>