Android Security

// android_security.kt
// Mendemonstrasikan konsep keamanan Android: EncryptedSharedPreferences,
// EncryptedFile, network security config, dan ProGuard/R8 rules. Disimulasikan
// tanpa Android SDK — hanya memetakan kontrak ke struktur data ringkas.

import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec
import javax.crypto.spec.SecretKeySpec
import java.security.SecureRandom
import java.util.Base64

// Mensimulasikan EncryptedSharedPreferences: AES-GCM 256-bit
class EncryptedPrefs(private val masterKey: SecretKey) {
    private val store = mutableMapOf<String, ByteArray>()  // ciphertext per value
    private val ivStore = mutableMapOf<String, ByteArray>()

    fun putString(key: String, value: String) {
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        val iv = ByteArray(12).also { SecureRandom().nextBytes(it) }
        cipher.init(Cipher.ENCRYPT_MODE, masterKey, GCMParameterSpec(128, iv))
        val encrypted = cipher.doFinal(value.toByteArray())
        store[key] = encrypted
        ivStore[key] = iv
    }

    fun getString(key: String, default: String? = null): String? {
        val encrypted = store[key] ?: return default
        val iv = ivStore[key] ?: return default
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.DECRYPT_MODE, masterKey, GCMParameterSpec(128, iv))
        return String(cipher.doFinal(encrypted))
    }

    fun dumpCiphertext(): Map<String, String> =
        store.mapValues { Base64.getEncoder().encodeToString(it.value) }

    fun dumpSizes(): Map<String, Int> = store.mapValues { it.value.size }
}

// Mensimulasikan network security config: cleartext traffic policy
object NetworkSecurityConfig {
    fun isCleartextAllowed(host: String): Boolean {
        val allowlist = setOf("localhost", "10.0.2.2")  // dev emulator
        return host in allowlist
    }
    fun isCertificatePinningEnabled(host: String): Boolean =
        host.endsWith("example.com") || host.endsWith("android.com")
}

// Mensimulasikan ProGuard/R8 obfuscation
class ProguardRules {
    private val keepRules = mutableListOf<String>()
    fun keep(rule: String) { keepRules.add(rule) }
    fun report(): List<String> = keepRules.toList()
}

fun main() {
    // Generate master key (256-bit AES)
    val keyGen = KeyGenerator.getInstance("AES").apply { init(256) }
    val masterKey: SecretKey = keyGen.generateKey()

    val prefs = EncryptedPrefs(masterKey)
    println("=== EncryptedSharedPreferences ===")
    prefs.putString("auth_token", "Bearer YOUR_API_TOKEN_12345")
    prefs.putString("user_id", "user-budi-2026")
    println("Ciphertext byte length per key: ${prefs.dumpSizes()}")
    println("Dekripsi auth_token: ${prefs.getString("auth_token")}")
    println("Dekripsi user_id:    ${prefs.getString("user_id")}")

    println("\n=== Network security config ===")
    listOf("api.example.com", "localhost", "evil.example.org").forEach { host ->
        println("  $host: cleartext=${NetworkSecurityConfig.isCleartextAllowed(host)} pinning=${NetworkSecurityConfig.isCertificatePinningEnabled(host)}")
    }

    println("\n=== ProGuard/R8 keep rules ===")
    val rules = ProguardRules()
    rules.keep("-keep class com.example.tugasapp.** { *; }")
    rules.keep("-keepclassmembers class * { @androidx.room.* <methods>; }")
    rules.keep("-keep class kotlinx.serialization.** { *; }")
    rules.report().forEach { println("  $it") }
}

=== EncryptedSharedPreferences ===
Ciphertext byte length per key: {auth_token=43, user_id=30}
Dekripsi auth_token: Bearer YOUR_API_TOKEN_12345
Dekripsi user_id:    user-budi-2026

=== Network security config ===
  api.example.com: cleartext=false pinning=true
  localhost: cleartext=true pinning=false
  evil.example.org: cleartext=false pinning=false

=== ProGuard/R8 keep rules ===
  -keep class com.example.tugasapp.** { *; }
  -keepclassmembers class * { @androidx.room.* <methods>; }
  -keep class kotlinx.serialization.** { *; }