Fix cloud backup restore and recovery coverage

.envrc.example

@@ -14,6 +14,10 @@ export COVE_KEYSTORE_PASSWORD="your-keystore-password-here"
 export COVE_KEY_ALIAS="upload"
 export COVE_KEY_PASSWORD="your-key-password-here"
 
+# Google Play internal releases: just rela (requires fastlane)
+# grant this service account access to testing releases for org.bitcoinppl.cove
+# export GOOGLE_PLAY_JSON_KEY_PATH="$HOME/.secrets/cove-google-play.json"
+
 # iOS device aliases for: just brall --device main|se
 # export IOS_DEVICE_MAIN="00008120-0006243420214032"
 # export IOS_DEVICE_SE="00008xxx-xxxxxxxxxxxxxxxx"

CONTRIBUTING.md

@@ -48,10 +48,14 @@ Set `ASC_API_KEY_PATH`, `ASC_API_KEY_ID`, and `ASC_API_ISSUER_ID`. The API key m
 ### Android
 
 ```bash
-just build-android-release    # alias: just bar
+just release-android    # alias: just rela
 ```
 
-Then build a signed APK/AAB via Android Studio (Build → Generate Signed Bundle/APK).
+This bumps the Android versionCode, rebuilds the release Android bindings, builds the signed Play bundle, and uploads it to Google Play internal testing.
+
+Set `GOOGLE_PLAY_JSON_KEY_PATH` to a readable Google Play service account JSON file. Install fastlane (`brew install fastlane`). The service account must have access to testing releases for `org.bitcoinppl.cove`.
+
+Use `just upload-google-play` (`just ugp`) when the versionCode was already bumped and the signed bundle already exists.
 
 ## Development Workflow
 

android/app/build.gradle.kts

@@ -33,7 +33,7 @@ android {
         applicationId = "org.bitcoinppl.cove"
         minSdk = 33
         targetSdk = 36
-        versionCode = 39
+        versionCode = 41
         versionName = "1.4.0"
         manifestPlaceholders["keyTeleportAppLinksEnabled"] = "false"
 

android/app/src/main/java/org/bitcoinppl/cove/AppManager.kt

@@ -369,22 +369,74 @@ class AppManager private constructor() : FfiReconcile {
      * clears all cached data and reinitializes
      */
     fun reset() {
+        clearSessionForReset()
+        resetRustProjection()
+    }
+
+    private fun clearSessionForReset() {
         // close managers before clearing them
         clearWalletManager()
         clearKeyTeleportManager()
         corruptedWalletDeletionRetry = null
+    }
 
+    private fun resetRustProjection(): Boolean {
         database = Database()
         needsOnboarding =
             withRustOr(needsOnboarding) {
                 needsOnboarding()
             }
 
         val routerState =
-            withRustOr(null) {
+            withRustOr<AppState?>(null) {
                 state()
+            } ?: return false
+
+        router.reset(routerState.router)
+        return true
+    }
+
+    /**
+     * Reset the app session after a successful full wipe
+     *
+     * Rust publishes the empty database and direct route through reconciliation. This clears
+     * Android-owned presentation state before authentication is released
+     */
+    internal fun resetAfterWipe() {
+        val projectionReset = resetProjectionAfterWipe()
+        if (!projectionReset) {
+            router.reconcileDefaultRouteChanged(
+                Route.NewWallet(NewWalletRoute.Select),
+                emptyList(),
+            )
+        }
+
+        router.isSidebarVisible = false
+        wallets = emptyList()
+        isLoading = false
+        alertState = null
+        sheetState = null
+    }
+
+    private fun resetProjectionAfterWipe(): Boolean {
+        val resetResult =
+            runCatching {
+                clearSessionForReset()
+                resetRustProjection()
             }
-        router.reset(routerState?.router)
+
+        if (resetResult.getOrNull() == true) return true
+
+        resetResult.exceptionOrNull()?.let { error ->
+            Log.e(tag, "failed to reset app session after wipe", error)
+        }
+
+        val projectionResult = runCatching { resetRustProjection() }
+        projectionResult.exceptionOrNull()?.let { error ->
+            Log.e(tag, "failed to reset app projection after wipe", error)
+        }
+
+        return projectionResult.getOrDefault(false)
     }
 
     val currentRoute: Route

android/app/src/main/java/org/bitcoinppl/cove/AuthManager.kt

@@ -56,9 +56,12 @@ sealed interface WipePresentationState {
     data object Idle : WipePresentationState
     data object Running : WipePresentationState
     data class ShutdownBlocked(val attemptId: ShutdownAttemptId) : WipePresentationState
-    data class Failed(val message: String) : WipePresentationState
+    data object Failed : WipePresentationState
 }
 
+internal const val WIPE_FAILURE_TITLE = "Unable to Open Cove"
+internal const val WIPE_FAILURE_MESSAGE = "Please try again."
+
 /**
  * auth manager - manages authentication state
  * ported from iOS AuthManager.swift
@@ -72,8 +75,7 @@ class AuthManager internal constructor(
     private val mainScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
     private val wipeCommand = OwnerScopedCommand<UnlockMode>(mainScope)
 
-    private var rust: RustAuthManager = RustAuthManager()
-        private set
+    private val rust = RustAuthManager()
     private val isRustClosed = AtomicBoolean(false)
     private val rustGuard =
         RustHandleGuard(
@@ -190,9 +192,7 @@ class AuthManager internal constructor(
     }
 
     internal fun completeMainBiometricAuthentication() {
-        if (isInDecoyMode()) {
-            switchToMainMode()
-        }
+        if (isInDecoyMode() && !switchToMainMode()) return
 
         recordMainCredentialAuthentication()
         unlock()
@@ -258,8 +258,8 @@ class AuthManager internal constructor(
         }
 
     private fun unlockWithMainPin(): UnlockMode {
-        if (Database().globalConfig().isInDecoyMode()) {
-            switchToMainMode()
+        if (Database().globalConfig().isInDecoyMode() && !switchToMainMode()) {
+            return UnlockMode.LOCKED
         }
 
         recordMainCredentialAuthentication()
@@ -318,49 +318,88 @@ class AuthManager internal constructor(
                 }
             }
 
-        result.exceptionOrNull()?.let { error ->
+        val wipeError = result.exceptionOrNull()
+        wipeError?.let { error ->
             val lifecycle = (error as? AppException.WalletLifecycle)?.v1
             if (lifecycle is WalletLifecycleFailure.ShutdownBlocked) {
                 wipePresentationState = WipePresentationState.ShutdownBlocked(lifecycle.attemptId)
             } else {
                 android.util.Log.e(tag, "failed to wipe all data", error)
-                wipePresentationState =
-                    WipePresentationState.Failed(error.message ?: "Unable to remove local data")
+                wipePresentationState = WipePresentationState.Failed
             }
+        }
 
-            return UnlockMode.LOCKED
+        if (wipeError == null) {
+            runCatching { App.resetAfterWipe() }
+                .onFailure { error ->
+                    android.util.Log.e(tag, "failed to reset app projection after wipe", error)
+                }
+
+            runCatching { refreshAuthStateAfterWipe() }
+                .onFailure { error ->
+                    android.util.Log.e(tag, "failed to refresh authentication after wipe", error)
+                }
+
+            unlock()
+            wipePresentationState = WipePresentationState.Idle
         }
 
-        val oldRust = rust
-        rust = RustAuthManager()
-        rustGuard.markOpen()
-        rust.listenForUpdates(this)
-        oldRust.close()
-        unlock()
-        type = AuthType.NONE
-        wipePresentationState = WipePresentationState.Idle
-        App.reset()
+        return if (wipeError == null) {
+            UnlockMode.WIPE
+        } else {
+            UnlockMode.LOCKED
+        }
+    }
 
-        return UnlockMode.WIPE
+    private fun refreshAuthStateAfterWipe() {
+        val nextType = readAuthStateAfterWipe("auth type", AuthType.NONE) { authType() }
+        val nextWipeDataPinEnabled =
+            readAuthStateAfterWipe("wipe PIN state", false) {
+                isWipeDataPinEnabled()
+            }
+        val nextDecoyPinEnabled =
+            readAuthStateAfterWipe("decoy PIN state", false) {
+                isDecoyPinEnabled()
+            }
+
+        type = nextType
+        isWipeDataPinEnabled = nextWipeDataPinEnabled
+        isDecoyPinEnabled = nextDecoyPinEnabled
+        isUsingBiometrics = false
     }
 
+    private fun <T> readAuthStateAfterWipe(
+        name: String,
+        defaultValue: T,
+        read: RustAuthManager.() -> T,
+    ): T =
+        runCatching { withRust(read) }
+            .getOrElse { error ->
+                android.util.Log.e(tag, "failed to refresh $name after wipe; using safe default", error)
+                defaultValue
+            }
+
     private fun recordMainCredentialAuthentication() {
         mainCredentialGeneration += 1
     }
 
     /**
      * switch to main mode from decoy mode
+     *
+     * returns false when the switch failed so callers keep the app locked
+     * instead of unlocking into the decoy projection with the main credential
      */
-    fun switchToMainMode() {
+    fun switchToMainMode(): Boolean =
         try {
             withRust {
                 switchToMainMode()
             }
             resetAppAndSelectWallet()
+            true
         } catch (e: Exception) {
             android.util.Log.e(tag, "failed to switch to main mode", e)
+            false
         }
-    }
 
     override fun reconcile(message: AuthManagerReconcileMessage) {
         logDebug("reconcile: $message")

android/app/src/main/java/org/bitcoinppl/cove/MainActivity.kt

@@ -491,7 +491,10 @@ class MainActivity : FragmentActivity() {
                 return@setContent
             }
 
-            if (bdkMigrationWarning != null) {
+            val app = remember { AppManager.getInstance() }
+            val auth = remember { AuthManager.getInstance() }
+
+            if (bdkMigrationWarning != null && auth.wipePresentationState != WipePresentationState.Running) {
                 AlertDialog(
                     onDismissRequest = { bdkMigrationWarning = null },
                     title = { Text("Encryption Migration Issue") },
@@ -506,8 +509,6 @@ class MainActivity : FragmentActivity() {
                 )
             }
 
-            val app = remember { AppManager.getInstance() }
-            val auth = remember { AuthManager.getInstance() }
             val snackbarHostState = remember { SnackbarHostState() }
             var startupMode by remember {
                 mutableStateOf(resolveStartupMode(app.needsOnboarding))