Merge conflict resolved

pmathew92 · pmathew92 · commit 275c78550121 · 2025-11-29T20:46:45.000+05:30
diff --git a/.version b/.version
@@ -1 +1 @@
-3.10.0
+3.11.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Change Log
 
+## [3.11.0](https://github.com/auth0/Auth0.Android/tree/3.11.0) (2025-11-24)
+[Full Changelog](https://github.com/auth0/Auth0.Android/compare/3.10.0...3.11.0)
+
+**Added**
+- feat: Added option to pass AuthenticationAPIClient to SecureCredentialsManager class  [\#879](https://github.com/auth0/Auth0.Android/pull/879) ([pmathew92](https://github.com/pmathew92))
+- feat: add configurable biometric authentication policies for SecureCredentialsManager [\#867](https://github.com/auth0/Auth0.Android/pull/867) ([subhankarmaiti](https://github.com/subhankarmaiti))
+
+**Fixed**
+- fix: Fixes the IV overwrite when trying to encrypt multiple credentials  [\#882](https://github.com/auth0/Auth0.Android/pull/882) ([pmathew92](https://github.com/pmathew92))
+
 ## [3.10.0](https://github.com/auth0/Auth0.Android/tree/3.10.0) (2025-09-12)
 [Full Changelog](https://github.com/auth0/Auth0.Android/compare/3.9.1...3.10.0)
 
diff --git a/README.md b/README.md
@@ -52,7 +52,7 @@ To install Auth0.Android with [Gradle](https://gradle.org/), simply add the foll
 
 ```gradle
 dependencies {
-    implementation 'com.auth0.android:auth0:3.10.0'
+    implementation 'com.auth0.android:auth0:3.11.0'
 }
 ```
 
diff --git a/auth0/src/main/java/com/auth0/android/authentication/storage/BaseCredentialsManager.kt b/auth0/src/main/java/com/auth0/android/authentication/storage/BaseCredentialsManager.kt
@@ -170,15 +170,12 @@ public abstract class BaseCredentialsManager internal constructor(
         if (requiredScope == null) {
             return false
         }
-        val storedScopeList = storedScope.orEmpty().split(" ").toMutableList()
-
-        if (ignoreOpenid) storedScopeList.remove("openid")
-
-        val stored = storedScopeList.toTypedArray()
-        Arrays.sort(stored)
-        val required = requiredScope.split(" ").toTypedArray()
-        Arrays.sort(required)
-        return !stored.contentEquals(required)
+        val storedScopes = storedScope.orEmpty().split(" ").filter { it.isNotEmpty() }.toMutableSet()
+        if (ignoreOpenid) {
+            storedScopes.remove("openid")
+        }
+        val requiredScopes = requiredScope.split(" ").filter { it.isNotEmpty() }.toSet()
+        return storedScopes != requiredScopes
     }
 
     /**
@@ -217,4 +214,4 @@ public abstract class BaseCredentialsManager internal constructor(
         // Use audience if scope is null else use a combination of audience and scope
         return if (scope == null) audience else "$audience::$scope"
     }
-}
+}
diff --git a/auth0/src/main/java/com/auth0/android/authentication/storage/CredentialsManager.kt b/auth0/src/main/java/com/auth0/android/authentication/storage/CredentialsManager.kt
@@ -721,7 +721,6 @@ public class CredentialsManager @VisibleForTesting(otherwise = VisibleForTesting
     override fun clearApiCredentials(audience: String, scope: String?) {
         val key = getAPICredentialsKey(audience, scope)
         storage.remove(key)
-        Log.d(TAG, "API Credentials for $audience were just removed from the storage")
     }
 
     /**
diff --git a/auth0/src/main/java/com/auth0/android/authentication/storage/CryptoUtil.java b/auth0/src/main/java/com/auth0/android/authentication/storage/CryptoUtil.java
@@ -64,6 +64,12 @@ class CryptoUtil {
     private static final int AES_KEY_SIZE = 256;
     private static final int RSA_KEY_SIZE = 2048;
 
+    private static final byte FORMAT_MARKER = 0x01;
+
+    private static final int GCM_TAG_LENGTH = 16;
+    private static final int MIN_DATA_LENGTH = 1;
+    private static final int FORMAT_HEADER_LENGTH = 2;
+
     private final String OLD_KEY_ALIAS;
     private final String OLD_KEY_IV_ALIAS;
     private final String KEY_ALIAS;
@@ -156,7 +162,9 @@ KeyStore.PrivateKeyEntry getRSAKeyEntry() throws CryptoException, IncompatibleDe
             generator.generateKeyPair();
 
             return getKeyEntryCompat(keyStore, KEY_ALIAS);
-        } catch (CertificateException | InvalidAlgorithmParameterException | NoSuchProviderException | NoSuchAlgorithmException | KeyStoreException | ProviderException e) {
+        } catch (CertificateException | InvalidAlgorithmParameterException |
+                 NoSuchProviderException | NoSuchAlgorithmException | KeyStoreException |
+                 ProviderException e) {
             /*
              * This exceptions are safe to be ignored:
              *
@@ -240,7 +248,8 @@ private void deleteRSAKeys() {
             keyStore.deleteEntry(KEY_ALIAS);
             keyStore.deleteEntry(OLD_KEY_ALIAS);
             Log.d(TAG, "Deleting the existing RSA key pair from the KeyStore.");
-        } catch (KeyStoreException | CertificateException | IOException | NoSuchAlgorithmException e) {
+        } catch (KeyStoreException | CertificateException | IOException |
+                 NoSuchAlgorithmException e) {
             Log.e(TAG, "Failed to remove the RSA KeyEntry from the Android KeyStore.", e);
         }
     }
@@ -403,7 +412,7 @@ byte[] getAESKey() throws IncompatibleDeviceException, CryptoException {
 
 
     /**
-     * Encrypts the given input bytes using a symmetric key (AES).
+     * Decrypts the given input bytes using a symmetric key (AES).
      * The AES key is stored protected by an asymmetric key pair (RSA).
      *
      * @param encryptedInput the input bytes to decrypt. There's no limit in size.
@@ -415,18 +424,15 @@ public byte[] decrypt(byte[] encryptedInput) throws CryptoException, Incompatibl
         try {
             SecretKey key = new SecretKeySpec(getAESKey(), ALGORITHM_AES);
             Cipher cipher = Cipher.getInstance(AES_TRANSFORMATION);
-            String encodedIV = storage.retrieveString(KEY_IV_ALIAS);
-            if (TextUtils.isEmpty(encodedIV)) {
-                encodedIV = storage.retrieveString(OLD_KEY_IV_ALIAS);
-                if (TextUtils.isEmpty(encodedIV)) {
-                    //AES key was JUST generated. If anything existed before, should be encrypted again first.
-                    throw new CryptoException("The encryption keys changed recently. You need to re-encrypt something first.", null);
-                }
+
+            // Detect format and decrypt accordingly to maintain backward compatibility
+            if (isNewFormat(encryptedInput)) {
+                return decryptNewFormat(encryptedInput, cipher, key);
+            } else {
+                return decryptLegacyFormat(encryptedInput, cipher, key);
             }
-            byte[] iv = Base64.decode(encodedIV, Base64.DEFAULT);
-            cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));
-            return cipher.doFinal(encryptedInput);
-        } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException | InvalidAlgorithmParameterException e) {
+        } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException |
+                 InvalidAlgorithmParameterException e) {
             /*
              * This exceptions are safe to be ignored:
              *
@@ -456,12 +462,115 @@ public byte[] decrypt(byte[] encryptedInput) throws CryptoException, Incompatibl
         }
     }
 
+    /**
+     * Checks if the encrypted input uses the new format with bundled IV.
+     * New format structure: [FORMAT_MARKER][IV_LENGTH][IV][ENCRYPTED_DATA]
+     *
+     * @param encryptedInput the encrypted data to check
+     * @return true if new format, false if legacy format
+     */
+    @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
+    boolean isNewFormat(byte[] encryptedInput) {
+
+        // Boundary check
+        if (encryptedInput == null || encryptedInput.length < 2) {
+            return false;
+        }
+
+        if (encryptedInput[0] != FORMAT_MARKER) {
+            return false;
+        }
+
+        // Check IV length is valid for AES-GCM (12 or 16 bytes)
+        // AES is a 128 block size cipher ,which is 16 bytes
+        // AES in GCM mode the recommended IV length is 12 bytes.
+        // This 12-byte IV is then combined with a 4-byte internal counter to form the full 16-byte
+        // input block for the underlying AES block cipher in counter mode (CTR), which GCM utilizes.
+        // Thus checking for a 12 or 16 byte length
+        int ivLength = encryptedInput[1] & 0xFF;
+        if (ivLength != 12 && ivLength != 16) {
+            return false;
+        }
+
+        // Verify minimum total length
+        // Need: marker(1) + length(1) + IV(12-16) + GCM tag(16) + data(1+)
+        int minLength = FORMAT_HEADER_LENGTH + ivLength + GCM_TAG_LENGTH + MIN_DATA_LENGTH;
+        return encryptedInput.length >= minLength;
+    }
+
+    /**
+     * Decrypts data in the new format (IV bundled with encrypted data).
+     *
+     * @param encryptedInput the encrypted input in new format
+     * @param cipher         the cipher instance
+     * @param key            the secret key
+     * @return the decrypted data
+     * @throws InvalidKeyException                if the key is invalid
+     * @throws InvalidAlgorithmParameterException if the IV is invalid
+     * @throws IllegalBlockSizeException          if the block size is invalid
+     * @throws BadPaddingException                if padding is incorrect
+     */
+    @VisibleForTesting
+    private byte[] decryptNewFormat(byte[] encryptedInput, Cipher cipher, SecretKey key)
+            throws InvalidKeyException, InvalidAlgorithmParameterException,
+            IllegalBlockSizeException, BadPaddingException {
+
+        // Read IV length (byte 1)
+        int ivLength = encryptedInput[1] & 0xFF;
+
+        // Extract IV (bytes 2 to 2+ivLength)
+        byte[] iv = new byte[ivLength];
+        System.arraycopy(encryptedInput, 2, iv, 0, ivLength);
+
+        int encryptedDataOffset = 2 + ivLength;
+        int encryptedDataLength = encryptedInput.length - encryptedDataOffset;
+
+        cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));
+        return cipher.doFinal(encryptedInput, encryptedDataOffset, encryptedDataLength);
+    }
+
+    /**
+     * Decrypts data in the legacy format (IV stored separately in storage).
+     * This maintains backward compatibility with credentials encrypted before the fix.
+     *
+     * @param encryptedInput the encrypted input in legacy format
+     * @param cipher         the cipher instance
+     * @param key            the secret key
+     * @return the decrypted data
+     * @throws InvalidKeyException                if the key is invalid
+     * @throws InvalidAlgorithmParameterException if the IV is invalid
+     * @throws IllegalBlockSizeException          if the block size is invalid
+     * @throws BadPaddingException                if padding is incorrect
+     * @throws CryptoException                    if the IV cannot be found in storage
+     */
+    @VisibleForTesting
+    private byte[] decryptLegacyFormat(byte[] encryptedInput, Cipher cipher, SecretKey key)
+            throws InvalidKeyException, InvalidAlgorithmParameterException,
+            IllegalBlockSizeException, BadPaddingException, CryptoException {
+        // Retrieve IV from storage (legacy behavior)
+        String encodedIV = storage.retrieveString(KEY_IV_ALIAS);
+        if (TextUtils.isEmpty(encodedIV)) {
+            encodedIV = storage.retrieveString(OLD_KEY_IV_ALIAS);
+            if (TextUtils.isEmpty(encodedIV)) {
+                throw new CryptoException("The encryption keys changed recently. You need to re-encrypt something first.", null);
+            }
+        }
+
+        byte[] iv = Base64.decode(encodedIV, Base64.DEFAULT);
+        cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));
+        return cipher.doFinal(encryptedInput);
+    }
+
     /**
      * Encrypts the given input bytes using a symmetric key (AES).
      * The AES key is stored protected by an asymmetric key pair (RSA).
+     * <p>
+     * The encrypted output uses a new format that bundles the IV with the encrypted data
+     * to prevent IV collision issues when multiple credentials are stored.
+     * Format: [FORMAT_MARKER(1)][IV_LENGTH(1)][IV(12-16)][ENCRYPTED_DATA(variable)]
      *
      * @param decryptedInput the input bytes to encrypt. There's no limit in size.
-     * @return the encrypted output bytes
+     * @return the encrypted output bytes with bundled IV
      * @throws CryptoException             if the RSA Key pair was deemed invalid and got deleted. Operation can be retried.
      * @throws IncompatibleDeviceException in the event the device can't understand the cryptographic settings required
      */
@@ -471,10 +580,17 @@ public byte[] encrypt(byte[] decryptedInput) throws CryptoException, Incompatibl
             Cipher cipher = Cipher.getInstance(AES_TRANSFORMATION);
             cipher.init(Cipher.ENCRYPT_MODE, key);
             byte[] encrypted = cipher.doFinal(decryptedInput);
-            byte[] encodedIV = Base64.encode(cipher.getIV(), Base64.DEFAULT);
-            //Save IV for Decrypt stage
-            storage.store(KEY_IV_ALIAS, new String(encodedIV, StandardCharsets.UTF_8));
-            return encrypted;
+            byte[] iv = cipher.getIV();
+
+            // NEW FORMAT: Bundle IV with encrypted data to prevent collision issues
+            // Format: [FORMAT_MARKER][IV_LENGTH][IV][ENCRYPTED_DATA]
+            byte[] output = new byte[1 + 1 + iv.length + encrypted.length];
+            output[0] = FORMAT_MARKER;
+            output[1] = (byte) iv.length;
+            System.arraycopy(iv, 0, output, 2, iv.length);
+            System.arraycopy(encrypted, 0, output, 2 + iv.length, encrypted.length);
+
+            return output;
         } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException e) {
             /*
              * This exceptions are safe to be ignored:
diff --git a/auth0/src/main/java/com/auth0/android/authentication/storage/SecureCredentialsManager.kt b/auth0/src/main/java/com/auth0/android/authentication/storage/SecureCredentialsManager.kt
@@ -164,6 +164,7 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
         DefaultLocalAuthenticationManagerFactory()
     )
 
+
     /**
      * Saves the given credentials in the Storage.
      *
@@ -227,11 +228,6 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
                 e
             )
         } catch (e: CryptoException) {
-            /*
-             * If the keys were invalidated in the call above a good new pair is going to be available
-             * to use on the next call. We clear any existing credentials so #hasValidCredentials returns
-             * a true value. Retrying this operation will succeed.
-             */
             clearApiCredentials(audience, scope)
             throw CredentialsManagerException(
                 CredentialsManagerException.Code.CRYPTO_EXCEPTION,
@@ -336,12 +332,10 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
 
     public override val userProfile: UserProfile?
         get() {
-            val credentials: Credentials? = getExistingCredentials()
-            // Handle null credentials gracefully
-            if (credentials == null) {
-                return null
-            }
-            return credentials.user
+            return runCatching {
+                val credentials: Credentials = getExistingCredentials()
+                return credentials.user
+            }.getOrNull()
         }
 
     /**
@@ -709,20 +703,6 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
         continueGetCredentials(scope, minTtl, parameters, headers, forceRefresh, callback)
     }
 
-    private val localAuthenticationResultCallback =
-        { scope: String?, minTtl: Int, parameters: Map<String, String>, headers: Map<String, String>, forceRefresh: Boolean, callback: Callback<Credentials, CredentialsManagerException> ->
-            object : Callback<Boolean, CredentialsManagerException> {
-                override fun onSuccess(result: Boolean) {
-                    continueGetCredentials(
-                        scope, minTtl, parameters, headers, forceRefresh, callback
-                    )
-                }
-
-                override fun onFailure(error: CredentialsManagerException) {
-                    callback.onFailure(error)
-                }
-            }
-        }
 
     /**
      * Retrieves API credentials from storage and automatically renews them using the refresh token if the access
@@ -748,6 +728,11 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
 
         if (fragmentActivity != null && localAuthenticationOptions != null && localAuthenticationManagerFactory != null) {
 
+            if (isBiometricSessionValid()) {
+                continueGetApiCredentials(audience, scope, minTtl, parameters, headers, callback)
+                return
+            }
+
             fragmentActivity.get()?.let { fragmentActivity ->
                 startBiometricAuthentication(
                     fragmentActivity,
@@ -783,7 +768,6 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
     override fun clearApiCredentials(audience: String, scope: String?) {
         val key = getAPICredentialsKey(audience, scope)
         storage.remove(key)
-        Log.d(TAG, "API Credentials for $audience were just removed from the storage")
     }
 
     /**
@@ -982,6 +966,7 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
         serialExecutor.execute {
             val encryptedEncodedJson = storage.retrieveString(getAPICredentialsKey(audience, scope))
             //Check if existing api credentials are present and valid
+
             encryptedEncodedJson?.let { encryptedEncoded ->
                 val encrypted = Base64.decode(encryptedEncoded, Base64.DEFAULT)
                 val json: String = try {
@@ -1111,6 +1096,7 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
                 CredentialsManagerException.Code.INCOMPATIBLE_DEVICE, e
             )
         } catch (e: CryptoException) {
+            clearCredentials()
             throw CredentialsManagerException(
                 CredentialsManagerException.Code.CRYPTO_EXCEPTION, e
             )
@@ -1212,6 +1198,7 @@ public class SecureCredentialsManager @VisibleForTesting(otherwise = VisibleForT
     internal fun isBiometricSessionValid(): Boolean {
         val lastAuth = lastBiometricAuthTime.get()
         if (lastAuth == NO_SESSION) return false // No session exists
+
         val policy = localAuthenticationOptions?.policy ?: BiometricPolicy.Always
         return when (policy) {
 
diff --git a/auth0/src/test/java/com/auth0/android/authentication/storage/CryptoUtilTest.java b/auth0/src/test/java/com/auth0/android/authentication/storage/CryptoUtilTest.java

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ To install Auth0.Android with [Gradle](https://gradle.org/), simply add the foll`
`52`	`52`
`53`	`53`	```gradle
`54`	`54`	`dependencies {`
`55`		`- implementation 'com.auth0.android:auth0:3.10.0'`
	`55`	`+ implementation 'com.auth0.android:auth0:3.11.0'`
`56`	`56`	`}`
`57`	`57`	```
`58`	`58`
Original file line number	Diff line number	Diff line change
`@@ -721,7 +721,6 @@ public class CredentialsManager @VisibleForTesting(otherwise = VisibleForTesting`
`721`	`721`	`override fun clearApiCredentials(audience: String, scope: String?) {`
`722`	`722`	`val key = getAPICredentialsKey(audience, scope)`
`723`	`723`	`storage.remove(key)`
`724`		`- Log.d(TAG, "API Credentials for $audience were just removed from the storage")`
`725`	`724`	`}`
`726`	`725`
`727`	`726`	`/**`