dtourolle
352e59498b
The packages now carry the manual, but nothing in the application opened it: the help sheet listed gestures and stopped there. The help sheet gains a Manual button beside Done, and Settings a Manual row under About beside the version. Both go through dr_ui::manual, which finds the installed page through dr_plat::system_data_dirs (the package's share directory on Linux, the executable's directory on Windows), and a development build also in the checkout it was compiled from. A copy with no manual says so on the status line rather than doing nothing. On the desktop the page goes to the system browser. A section is a URL fragment, and xdg-open's generic mode and Windows' FileProtocolHandler both turn a file: URL into a path and drop the fragment, so a section is opened through a one-line redirect page written to the data directory: the opener gets a plain path, which every opener keeps, and the browser follows the redirect to index.html#section itself. The launcher behind the sign-in's open_in_browser is split out so both share it; the https check stays with the sign-in. Android has no path to give a browser: an asset is not a file, a copy in private storage is unreadable to other apps, a file: URI across apps is refused, and a content: URI leaves the browser resolving every picture against the provider. So ManualActivity, a WebView reading file:///android_asset/manual/index.html straight out of the APK, shows it, started by class name with the section as an extra. JavaScript is off, links off the page go to the browser, and the theme is day-night so the page's own light and dark follow the system. A test checks that the manifest, the Java class and dr_ui agree on the name and the extra.
189 lines
10 KiB
XML
189 lines
10 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
DarkRoom Android manifest.
|
|
|
|
Deliberately minimal: this packages the viewer for on-device testing (spike
|
|
S2 needs Adreno and Mali hardware, which no emulator represents). Nothing
|
|
here is a distribution manifest yet. Only network access is declared: file
|
|
access needs no manifest permission because the library grid reads through
|
|
SAF, which grants per-tree at runtime (ARCH §6.9).
|
|
|
|
Minimal is not the same as empty, and the entries below that are not the
|
|
activity are the difference. A manifest is the only place a component can be
|
|
declared: an intent filter is how the system learns this app is worth
|
|
offering for a photograph, and a provider is how it learns the class exists
|
|
at all. Neither can be moved into code (FR-PLAT-AND-6).
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="paris.tourolle.darkroom">
|
|
|
|
<!-- Everything the app does with a server needs this: Login Flow v2, the
|
|
WebDAV listing, thumbnail and image fetches. Without it Android refuses
|
|
socket creation outright, and the failure is invisible — no panic to
|
|
catch, no log line, just a worker thread that stops. Storage is the
|
|
separate case that genuinely needs no permission here, because SAF
|
|
grants per-tree at runtime (ARCH §6.9). -->
|
|
<uses-permission android:name="android.permission.INTERNET" />
|
|
<!-- Read before deciding whether a sync may run: FR-NC-6 gates background
|
|
work on unmetered-and-charging, which means knowing the network type. -->
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
|
|
<!-- Vulkan 1.1 is what wgpu needs; the API 28 floor is where support is
|
|
dependable (NFR-COMPAT-1). Marked required so an unsupported device
|
|
fails at install rather than at first frame. -->
|
|
<uses-feature
|
|
android:name="android.hardware.vulkan.version"
|
|
android:version="0x00401000"
|
|
android:required="true" />
|
|
|
|
<!-- One name covers both icon generations, which is the point of the
|
|
`anydpi-v26` qualifier: @mipmap/ic_launcher resolves to the adaptive
|
|
icon at res/mipmap-anydpi-v26/ic_launcher.xml on API 26 and up, and to
|
|
the density-matched ic_launcher.png below that. Since minSdk is 28 the
|
|
PNGs are only ever reached by tooling, but they cost little and aapt2
|
|
wants a real drawable behind the name. `roundIcon` is deliberately
|
|
absent: it predates adaptive icons and a launcher that reads it would
|
|
also be one that ignores the XML, which no device here is.
|
|
|
|
The adaptive icon has three layers rather than two. The third,
|
|
monochrome, is what lets Android 13's themed-icon setting recolour it
|
|
instead of dropping the app out of the themed set. -->
|
|
<application
|
|
android:label="DarkRoom"
|
|
android:icon="@mipmap/ic_launcher"
|
|
android:hasCode="true"
|
|
android:allowBackup="false"
|
|
android:supportsRtl="true">
|
|
|
|
<!-- NativeActivity rather than a Kotlin Activity: android-activity's
|
|
glue loads libdarkroom.so and calls android_main. `android.app.lib_name`
|
|
is how it learns which library to load, and must match [lib].name.
|
|
|
|
`singleTask` because a second instance of this activity is not
|
|
survivable. The intent filters below mean another app can now
|
|
launch it while it is already running, and under the default
|
|
launch mode that starts a *second* NativeActivity — in the
|
|
caller's task, in this same process, calling android_main again.
|
|
Two Slint backends and two wgpu devices in one process is not a
|
|
degraded experience, it is a failed second launch on top of a
|
|
working first one.
|
|
|
|
What it costs, stated plainly: a share that arrives while DarkRoom
|
|
is already running brings it forward without opening the image.
|
|
The Intent goes to `onNewIntent`, and android-activity's event
|
|
stream has no variant for it (MainEvent in 0.6 stops at Destroy),
|
|
so nothing native ever sees it. Reading it would mean a Java
|
|
Activity subclass forwarding it across JNI — the same shape of
|
|
change FR-PLAT-AND-5 declined for onTrimMemory, and for the same
|
|
reason. Launched from cold, which is the ordinary case for "open
|
|
this photograph", the Intent is on getIntent() and is read. -->
|
|
<activity
|
|
android:name="android.app.NativeActivity"
|
|
android:exported="true"
|
|
android:launchMode="singleTask"
|
|
android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|density|uiMode"
|
|
android:windowSoftInputMode="adjustResize">
|
|
|
|
<meta-data
|
|
android:name="android.app.lib_name"
|
|
android:value="darkroom" />
|
|
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.MAIN" />
|
|
<category android:name="android.intent.category.LAUNCHER" />
|
|
</intent-filter>
|
|
|
|
<!-- FR-PLAT-AND-6, inbound. The traceability tool reads .rs,
|
|
.slint, .wgsl and .yaml, so this is a reference and not a
|
|
tag; the tag that counts is on the test in lib.rs that
|
|
asserts these declarations are still here.
|
|
|
|
Opening a photograph from a gallery, a file manager or a
|
|
download. `android_main` reads the launch Intent through
|
|
`Intents.receive` and the named images become the browsing
|
|
list, exactly as paths on the desktop command line do.
|
|
|
|
`image/*` and not a wider match, even though it misses raws:
|
|
a provider that does not recognise `.CR3` reports it as
|
|
`application/octet-stream`, and claiming that type would put
|
|
DarkRoom in the chooser for every unidentified binary on the
|
|
device — an APK, a database, a partial download. Being absent
|
|
from one gallery's menu is a smaller failure than being
|
|
present in all of them. DNG, which providers do know as
|
|
`image/x-adobe-dng`, matches here already.
|
|
|
|
BROWSABLE is what lets a browser's finished download and a
|
|
link hand the file over; without it those routes silently do
|
|
not list the app. -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:mimeType="image/*" />
|
|
</intent-filter>
|
|
|
|
<!-- The share sheet, one photograph or a selection of them.
|
|
SEND_MULTIPLE is declared because the sheet offers this app
|
|
for a multi-selection only if it says it accepts one, and a
|
|
culling tool that can be sent a single frame and not a burst
|
|
is the wrong way round.
|
|
|
|
ACTION_EDIT is deliberately not here. It is a promise to write
|
|
the result back to the URI it was handed, and nothing in this
|
|
app does: an edit lands in a sidecar beside the original
|
|
(FR-CAT-8). Registering for it would put DarkRoom in the "edit
|
|
with" menu and lose the user's work every time. -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.SEND" />
|
|
<action android:name="android.intent.action.SEND_MULTIPLE" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<data android:mimeType="image/*" />
|
|
</intent-filter>
|
|
</activity>
|
|
|
|
<!-- The manual (dr_ui::manual): a WebView over the copy the APK
|
|
carries in assets/manual. See ManualActivity.java for why it is
|
|
not the browser.
|
|
|
|
Not exported: nothing outside this app has a reason to start it,
|
|
and dr_ui starts it by class name, which needs no intent filter.
|
|
Its own task entry is not wanted either — it is a page over the
|
|
app, and Back returns to the photograph it was opened from.
|
|
configChanges so a rotation reflows the page rather than
|
|
reloading it at the top. -->
|
|
<activity
|
|
android:name="paris.tourolle.darkroom.ManualActivity"
|
|
android:exported="false"
|
|
android:label="DarkRoom manual"
|
|
android:theme="@style/ManualTheme"
|
|
android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|uiMode" />
|
|
|
|
<!-- FR-PLAT-AND-6, outbound. Android has refused file:// URIs
|
|
between apps since API 24 — handing one out raises
|
|
FileUriExposedException in *this* process — so an exported JPEG
|
|
reaches the share sheet as a content:// URI or not at all.
|
|
|
|
Not AndroidX's FileProvider: that is a Maven artefact, and this
|
|
build has no Gradle and no dependency resolver (docker/android/
|
|
README.md). ExportProvider does the same hundred lines against one
|
|
fixed root.
|
|
|
|
`exported="false"` with `grantUriPermissions="true"` is the whole
|
|
security model, and the two halves are not redundant. Exported
|
|
false means no app may address the provider on its own account;
|
|
the grant flag means a URI this app puts in an Intent carries a
|
|
read permission for that one file, for the lifetime of the
|
|
receiving task. Without the grant flag the share sheet opens and
|
|
every target fails with SecurityException; with `exported="true"`
|
|
instead, every app on the device could read the app's private
|
|
directory. The authority must equal ExportProvider.AUTHORITY — a
|
|
mismatch is a SecurityException in somebody else's app, so a test
|
|
in lib.rs compares the two strings. -->
|
|
<provider
|
|
android:name="paris.tourolle.darkroom.ExportProvider"
|
|
android:authorities="paris.tourolle.darkroom.exports"
|
|
android:exported="false"
|
|
android:grantUriPermissions="true" />
|
|
</application>
|
|
</manifest>
|