// ─────────────────────────────────────────────────────────────────────────────
// :client-tls-android — the FRAMEWORK half of ClientTLS (plan A11).
//
// The ONE key home is AndroidKeyStore: a `.p12` is PARSED via the pure :client-tls
// half (KeyStore("PKCS12"), import-parse only), then the private key is imported
// NON-EXPORTABLE into AndroidKeyStore. Tink AEAD (AndroidKeystore master key)
// encrypts ONLY the cert-chain + metadata blob at rest — never the private key,
// never the .p12, never the passphrase. A re-reading X509KeyManager presents the
// AndroidKeyStore key/chain PER handshake so a mid-run import/rotation is used on
// the NEXT handshake with no relaunch (R4); rotation calls connectionPool.evictAll()
// on the shared OkHttpClient so pooled/resumed connections drop the old identity.
//
// Instrumented tests use the real AndroidKeyStore provider (NOT Robolectric — plan
// §7), so they only COMPILE here (no emulator) and RUN during device QA.
//
// AGP 9 has BUILT-IN Kotlin — apply ONLY com.android.library (adding kotlin.android
// errors). This module must NOT depend on :transport-okhttp; the :app wiring (A15)
// bridges IdentityRepository → :transport-okhttp's ClientIdentityProvider seam.
// ─────────────────────────────────────────────────────────────────────────────

plugins {
    id("com.android.library")
}

android {
    namespace = "wang.yaojia.webterm.tlsandroid"
    compileSdk = 36
    defaultConfig {
        minSdk = 29
        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
    }
    testOptions {
        unitTests {
            // The device-enroll orchestration commit logs via android.util.Log — let the JVM unit
            // tests stub it (return 0) instead of throwing "not mocked". The security-critical paths
            // (commit sequencing, error handling) run on the JVM with a software key double.
            isReturnDefaultValues = true
        }
    }
}

kotlin {
    jvmToolchain(17)
}

// JVM (local) unit tests use JUnit 5 (matching the pure modules); AGP's testDebug/ReleaseUnitTest
// tasks are `Test` tasks, so opt them into the JUnit Platform.
tasks.withType<Test>().configureEach {
    useJUnitPlatform()
}

dependencies {
    // Pure half: Pkcs12Parse (parse+validate), ClientKeyManagerLogic (alias truth table),
    // CertificateSummary(Reader). `api` so :app sees the shared ParsedClientIdentity/summary types.
    // (No :wire-protocol dep — nothing in src/main references wang.yaojia.webterm.wire*.)
    api(project(":client-tls"))
    // B4 device-enroll: the pure CSR encoder + login/enroll/renew client + HttpTransport seam live in
    // :api-client (JVM-unit-tested); the framework HardwareBackedKey/DeviceEnroller drive them.
    implementation(project(":api-client"))
    implementation(libs.tink.android)
    implementation(libs.okhttp)
    // Mutex serializes the two-store rotation commit (single-commit invariant, A11).
    implementation(libs.kotlinx.coroutines.core)

    // Instrumented (androidTest) — compile here, run on a device (real AndroidKeyStore).
    androidTestImplementation(libs.androidx.test.ext.junit)
    androidTestImplementation(libs.androidx.test.core)
    androidTestImplementation(libs.androidx.test.runner)
    androidTestImplementation(libs.kotlinx.coroutines.core) // runBlocking for suspend mutators

    // Local JVM unit tests (src/test) — the DeviceEnroller enroll/commit orchestration driven with a
    // software P-256 key double + the shared FakeHttpTransport (no emulator, no AndroidKeyStore).
    testImplementation(project(":test-support"))
    testImplementation(libs.bundles.unit.test)
    testRuntimeOnly(libs.junit.platform.launcher)
}