fix(android): reject self-provider picker roots

ADAPTER_ARCHITECTURE.md

@@ -300,10 +300,63 @@ staging files under the sync engine lock, while keeping user originals.
 These are source and deterministic-test guarantees, not claims that a published
 installer already includes the behavior.
 
+Deferred Android provider recovery uses the supplied session under the account
+removal lease before credentials are persisted. A sync pair retains its SAF
+grant until its pending local transactions and retirement have completed.
+Provider reconciliation runs outside the sync engine lock. Before retiring an
+account or removing a pair, the engine reacquires its lock and verifies that the
+selected pair snapshots have not changed; unrelated account state is preserved.
+
+Legacy self-provider trees owned by a different account recover through their
+original provider URI and retained tree permission. Only a root matching the
+removing account may receive its supplied recovery session or a local authority
+rewrite. An unavailable original provider leaves recovery pending.
+
 Android queued uploads retain their rows while saved credentials require recovery.
 Malformed preference values, damaged ciphertext, and invalid decoded credential
 records pause timed retries when no usable or temporarily inaccessible fallback
 remains. Temporary keystore failures continue retrying, including for inactive
 accounts. Unsupported credential versions require an upgrade. These policies are
 covered by deterministic Android unit tests; they do not establish device or
 release validation.
+
+When the removal session is bound to the local provider's account, pending owned
+recovery tokens are discovered from that account's root, including directories
+moved outside the old sync subtree. The scan retains its depth, count, ownership,
+content-authentication, and cancellation bounds. Cross-account or external
+provider recovery stays within the original tree grant.
+
+Expanded retirement discovery indexes only the selected tree's transactions and
+legacy transactions not proven to belong elsewhere. Seeing another tree's token
+in the same account or directory never authorizes its reconciliation.
+
+## Recovery authentication and retirement
+
+Android self-provider recovery bypasses unversioned offline content and cached
+fallback reads. It requires a network listing before accepting generation-matched
+virtual content or opening an ETag-bound range source. Account-wide recovery-token
+discovery rejects multiple observed locations for an owned token without retiring
+its ownership record; unrelated tokens remain outside the selected recovery scope.
+
+Recovery through another local account's legacy provider tree tries that account's
+lease without waiting and verifies its exact active session. The lease spans
+content authentication and reconciliation. It retains the original tree URI,
+grant and discovery scope while using authoritative provider reads. Busy,
+unavailable or unverified cross-profile accounts keep recovery pending. Ordinary
+external providers retain their existing grant behavior.
+
+Relocated recovery can be attributed by either an authenticated stage or an
+authenticated backup. Backup-only delete transactions do not require a stage;
+both the recorded document identity and content identity are still required,
+and multiple observed locations remain ambiguous.
+Path-changing stage IDs require the original stage name and matching recorded
+content. Renamed backup IDs require matching recorded content even when the name
+contains the recovery token. Unverified token-bearing candidates preserve the
+ownership row without authorizing a rename or deletion.
+
+Self-provider SAF recovery retains the exact ETag of a successfully completed
+content verification and uses it for the later delete or rename precondition.
+Failed or cancelled verification invalidates prior proof; a concurrent replacement
+cannot contribute its newer ETag to the mutation. Directory recovery without an
+authenticated aggregate generation remains pending and preserves its content.
+Ordinary external-provider access retains its original platform contract.

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountCredentialController.kt

@@ -26,13 +26,13 @@ internal class AndroidAccountCredentialController(
     private val clearPreviewAccount: (String) -> Unit,
     private val notifyDocumentRootsChanged: () -> Unit,
     private val resumeQueuedUploads: suspend (String) -> Unit,
-    private val prepareAccountRemoval: suspend (NextcloudSession) -> Unit,
     private val removeQueuedUploads: suspend (NextcloudSession) -> Unit,
     private val retryQueuedUploadsCleanup: suspend (NextcloudSession, String, String?, String?, String?) -> Unit,
     private val retryQueuedUploadsCleanupWithoutCredentials: suspend (String, String, String?, String?, String?) -> Unit,
     private val activatePersistedAccount: suspend (NextcloudSession) -> Unit,
 ) {
     private val appContext = context.applicationContext
+    private val accountRemovalLeases = AndroidAccountRemovalLeaseCoordinator(appContext)
     private val handoffCleanup = AndroidExternalFileHandoffCleanup(appContext, preferences, ::commitPreferences)
     private val accountRemovalCleanupJournal = AndroidAccountRemovalCleanupJournal(
         preferences = preferences,
@@ -160,11 +160,10 @@ internal class AndroidAccountCredentialController(
             val session = current.sessions[accountId]
                 ?: return@withLock removeUnavailableAccount(accountId, current)
             val pendingCleanup = pendingAndroidAccountRemovalCleanup(session)
-            withAndroidAccountRemovalLease(NextcloudDocumentIds.accountKey(session)) {
+            accountRemovalLeases.withLease(session) {
                 val active = current.registry.activeAccountId == accountId
                 removeAndroidAccountCredentialData(
                     active = active,
-                    prepareAccountRemoval = { prepareAccountRemoval(session) },
                     removeQueuedUploads = { removeQueuedUploads(session) },
                     clearActiveAccount = { clearSession(current, pendingCleanup) },
                     rollbackActiveRemoval = {
@@ -195,11 +194,11 @@ internal class AndroidAccountCredentialController(
         val unavailableSession = NextcloudSession(target.record.serverUrl, target.record.loginName, appPassword = "")
         val accountIdentity = NextcloudDocumentIds.accountKey(unavailableSession)
         val pendingCleanup = pendingAndroidAccountRemovalCleanup(unavailableSession)
-        withAndroidAccountRemovalLease(accountIdentity) {
+        accountRemovalLeases.withUnavailableLease(unavailableSession) {
             removeUnavailableAndroidAccountCredentialData(
                 accountIdentity = accountIdentity,
                 active = target.wasActive,
-                prepareAccountRemoval = { prepareAccountRemoval(unavailableSession) },
+                prepareAccountRemoval = {},
                 removeAccountOwnedWorkWithoutCredentials = { identity ->
                     retryQueuedUploadsCleanupWithoutCredentials(
                         pendingCleanup.accountStorageKey,
@@ -233,11 +232,9 @@ internal class AndroidAccountCredentialController(
         check(current.activeSession == expectedSession) {
             "The account changed before its remote session could be revoked."
         }
-        val accountIdentity = NextcloudDocumentIds.accountKey(expectedSession)
         val pendingCleanup = pendingAndroidAccountRemovalCleanup(expectedSession)
-        revokeAndroidSessionWithAccountLease(
-            accountIdentity = accountIdentity,
-            preflight = { prepareAccountRemoval(expectedSession) },
+        accountRemovalLeases.revoke(
+            session = expectedSession,
             revoke = revokeRemoteSession,
             removeLocalAccount = {
                 removeAndroidAccountCredentialData(
@@ -271,12 +268,10 @@ internal class AndroidAccountCredentialController(
                 if (session == null) {
                     clearSession(read.state)
                 } else {
-                    val accountIdentity = NextcloudDocumentIds.accountKey(session)
                     val pendingCleanup = pendingAndroidAccountRemovalCleanup(session)
-                    withAndroidAccountRemovalLease(accountIdentity) {
+                    accountRemovalLeases.withLease(session) {
                         removeAndroidAccountCredentialData(
                             active = true,
-                            prepareAccountRemoval = { prepareAccountRemoval(session) },
                             removeQueuedUploads = { removeQueuedUploads(session) },
                             clearActiveAccount = { clearSession(read.state, pendingCleanup) },
                             rollbackActiveRemoval = {
@@ -336,21 +331,27 @@ internal class AndroidAccountCredentialController(
     }
     private suspend fun clearUnregisteredIndependentCredentialSlots(suspectEncrypted: String?) =
         clearUnregisteredAndroidAccountCredentialSlots(
-            preferences, sessionCipher, accountRemovalCleanupJournal, suspectEncrypted,
-            prepareAccountRemoval, removeQueuedUploads, ::commitPreferences, ::recordAccountRemovalCleanupFailure,
-            ::clearInvalidStore)
+            preferences = preferences,
+            sessionCipher = sessionCipher,
+            cleanupJournal = accountRemovalCleanupJournal,
+            suspectEncrypted = suspectEncrypted,
+            prepareAccountRemoval = { session -> prepareAndroidAccountRemoval(appContext, session) },
+            revalidateAccountRemoval = { session -> preflightAndroidAccountRemoval(appContext, session) },
+            removeAccountOwnedState = removeQueuedUploads,
+            commitPreferences = ::commitPreferences,
+            recordCleanupFailure = ::recordAccountRemovalCleanupFailure,
+            clearInvalidStore = ::clearInvalidStore,
+        )
 
     private suspend fun clearRecoveredInvalidStore(
         current: AndroidAccountCredentialState,
         suspectEncrypted: String,
     ) {
         val activeSession = current.activeSession
         if (activeSession != null) {
-            val accountIdentity = NextcloudDocumentIds.accountKey(activeSession)
             val pendingCleanup = pendingAndroidAccountRemovalCleanup(activeSession)
-            withAndroidAccountRemovalLease(accountIdentity) {
+            accountRemovalLeases.withLease(activeSession) {
                 removeRecoveredAndroidAccountCredentialData(
-                    prepareAccountRemoval = { prepareAccountRemoval(activeSession) },
                     removeQueuedUploads = { removeQueuedUploads(activeSession) },
                     clearRecoveredAccount = {
                         persistRecoveredInvalidStoreAfterClear(current, suspectEncrypted, pendingCleanup)
@@ -700,7 +701,7 @@ internal class AndroidAccountCredentialController(
 
     private suspend fun retryPendingAccountRemovalCleanup(session: NextcloudSession) =
         retryAndroidCleanupBeforeActivation(session, accountRemovalCleanupJournal,
-            { readCredentialFreeRegistry()?.accounts }, prepareAccountRemoval,
+            { readCredentialFreeRegistry()?.accounts }, { revalidateAndroidAccountRemoval(appContext, it) },
             retryQueuedUploadsCleanup, ::recordAccountRemovalCleanupFailure)
     private fun commitPreferences(editor: SharedPreferences.Editor) = ANDROID_ACCOUNT_CREDENTIAL_STORE_GUARD.serialize {
         try {
@@ -713,7 +714,6 @@ internal class AndroidAccountCredentialController(
             throw failure
         }
     }
-
     private fun encryptState(state: AndroidAccountCredentialState): String = try {
         sessionCipher.encrypt(encodeAndroidAccountCredentialState(state))
     } catch (failure: Exception) {
@@ -723,7 +723,6 @@ internal class AndroidAccountCredentialController(
         )
         throw failure
     }
-
     private fun encryptCredentialSlot(session: NextcloudSession): String = try {
         sessionCipher.encrypt(encodeAndroidPersistedSession(session))
     } catch (failure: Exception) {
@@ -785,5 +784,4 @@ internal class AndroidAccountCredentialController(
         component = SupportDiagnosticComponent.Cache,
         failure = failure,
     )
-
 }

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountFileListing.kt

@@ -22,7 +22,7 @@ internal suspend fun loadAndroidAccountFileListing(
     val read: suspend () -> NextcloudFileListing = {
         readAndroidAccountFileListing(cache, NextcloudDocumentIds.accountKey(session), path, request)
     }
-    return if (accountLeaseHeld) read() else withRetainedAndroidAccountFileRead(session, resolveSession, guard, read)
+    return if (accountLeaseHeld) read() else withRetainedAndroidAccountFileRead(session, resolveSession, guard, read = read)
 }
 
 private suspend fun readAndroidAccountFileListing(
@@ -55,3 +55,26 @@ internal fun requireAndroidDocumentDirectory(
     if (reference.isRoot) return
     require(findDocument(reference.path).isDirectory) { "The selected parent is not a folder." }
 }
+
+internal fun NextcloudFileListing.filesForProviderRecovery(requireNetwork: Boolean): List<NextcloudFile> {
+    check(!requireNetwork || source == NextcloudFileListingSource.Network) {
+        "Folder recovery requires a confirmed server listing."
+    }
+    return files
+}
+
+internal suspend fun loadAndroidProviderChildren(
+    recoveryAuthorized: Boolean,
+    read: suspend () -> List<NextcloudFile>,
+    cached: () -> List<NextcloudFile>,
+    storedDirectory: () -> Boolean,
+): List<NextcloudFile> = try {
+    read()
+} catch (cancelled: kotlinx.coroutines.CancellationException) {
+    throw cancelled
+} catch (failure: Exception) {
+    if (recoveryAuthorized) throw failure
+    val children = cached()
+    if (children.isNotEmpty() || storedDirectory()) children
+    else throw java.io.FileNotFoundException("Could not load this Nextcloud folder.").also { it.initCause(failure) }
+}

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountFileRead.kt

@@ -1,6 +1,7 @@
 package dev.obiente.nextcloudnative
 
 import android.util.Base64
+import dev.obiente.nextcloudnative.app.NextcloudFile
 import dev.obiente.nextcloudnative.app.NextcloudFileRangeSession
 import dev.obiente.nextcloudnative.app.NextcloudSession
 import java.io.FileNotFoundException
@@ -14,9 +15,13 @@ internal suspend fun <Result> withRetainedAndroidAccountFileRead(
     expectedSession: NextcloudSession,
     resolveSession: suspend () -> NextcloudSession?,
     guard: AndroidAccountOperationGuard = ANDROID_ACCOUNT_OPERATION_GUARD,
+    accountLeaseHeld: Boolean = false,
     read: suspend () -> Result,
 ): Result = withContext(Dispatchers.IO) {
-    guard.withExactAccountSession(
+    if (accountLeaseHeld) {
+        check(resolveSession() == expectedSession) { "The account changed before the file read could finish." }
+        read()
+    } else guard.withExactAccountSession(
         expectedSession = expectedSession,
         resolveSession = resolveSession,
         unavailable = { error("The account changed before the file read could finish.") },
@@ -85,7 +90,12 @@ internal class AndroidFileRangeSessionCoordinator {
         val current = synchronized(monitor) { registrations[accountIdentity]?.toList().orEmpty() }
         current.forEach(Registration::cancel)
         current.forEach { registration -> registration.awaitDrained() }
-        synchronized(monitor) { registrations.remove(accountIdentity) }
+        synchronized(monitor) {
+            registrations[accountIdentity]?.let { remaining ->
+                remaining.removeAll(current.toSet())
+                if (remaining.isEmpty()) registrations.remove(accountIdentity)
+            }
+        }
     }
 
     private fun unregister(accountIdentity: String, registration: Registration) = synchronized(monitor) {
@@ -135,11 +145,13 @@ internal fun openTrackedAndroidFileRangeSession(
     activity: AndroidFileRangeSessionActivity,
     guard: AndroidAccountOperationGuard = ANDROID_ACCOUNT_OPERATION_GUARD,
     coordinator: AndroidFileRangeSessionCoordinator = ANDROID_FILE_RANGE_SESSION_COORDINATOR,
+    accountLeaseHeld: Boolean = false,
     openSource: () -> NextcloudFileRangeSession,
 ): NextcloudFileRangeSession {
-    val lease = guard.acquireBlocking(NextcloudDocumentIds.accountKey(expectedSession))
+    val lease = if (accountLeaseHeld) null else guard.acquireBlocking(NextcloudDocumentIds.accountKey(expectedSession))
     return try {
-        if (resolveSession() != expectedSession) {
+        // Recovery binds a supplied session before it exists in credential storage.
+        if (!accountLeaseHeld && resolveSession() != expectedSession) {
             throw FileNotFoundException("The account changed before the file range session could start.")
         }
         val source = openSource()
@@ -151,11 +163,47 @@ internal fun openTrackedAndroidFileRangeSession(
         activity.close()
         throw failure
     } finally {
-        lease.close()
+        lease?.close()
     }
 }
 
 internal fun androidFileRangeAuthorization(session: NextcloudSession): String = Base64.encodeToString(
     "${session.loginName}:${session.appPassword}".toByteArray(StandardCharsets.UTF_8),
     Base64.NO_WRAP,
 )
+
+internal fun AndroidNextcloudServices.openDocumentProviderFileRangeSession(
+    session: NextcloudSession,
+    userId: String,
+    path: String,
+    size: Long,
+    expectedEtag: String,
+    accountLeaseHeld: Boolean,
+): NextcloudFileRangeSession = if (accountLeaseHeld) {
+    openFileRangeSessionWhileAccountLeaseHeld(session, userId, path, size, expectedEtag)
+} else {
+    openFileRangeSession(session, userId, path, size, expectedEtag)
+}
+
+internal class AndroidFileRangeUnsupportedException(message: String) : Exception(message)
+
+internal suspend fun probeSeekableExternalHandoffGeneration(
+    file: NextcloudFile,
+    verifyEmptyGeneration: suspend () -> Unit,
+    openRangeSession: (size: Long, etag: String) -> NextcloudFileRangeSession,
+): Boolean {
+    val size = file.size ?: return false
+    val etag = file.etag?.takeIf(String::isNotBlank) ?: return false
+    if (size == 0L) {
+        verifyEmptyGeneration()
+        return true
+    }
+    val rangeSession = openRangeSession(size, etag)
+    return try {
+        rangeSession.read(0L, 1).size == 1
+    } catch (_: AndroidFileRangeUnsupportedException) {
+        false
+    } finally {
+        rangeSession.close()
+    }
+}