Also, allow instantiating it using a factory: with this we can always decide where to take the config from and how to do it
Do the same for `ElementWellknownStore` so we can store and restore the values for different sources (endpoints) independently
This is an abstraction over an actual unauthenticated `Client` from the SDK that implements `GetUrlResolver`, and is supposed to be short-lived.
With this, we can use the SDK network stack to perform arbitrary GET url operations.
The `AutoCloseable` implementation makes it easier to clean up any leftover local config after using this temporary client.
* Expand the emoji picker to full height when the keyboard is shown
The picker content is rendered with fillMaxSize, so the sheet measures itself to
the full window height. That makes the partially expanded anchor available, and
the modal sheet auto-shows at that anchor, half way down the screen.
The sheet reserves the IME inset through its content window insets, but applies
that padding at its own bottom edge, which is off-screen while it rests half way
down. The band that is both on-screen and above the keyboard is then only about
a tenth of the screen, which is why the matching emoji end up behind it.
Expand the sheet while the keyboard is visible so its bottom edge returns to the
screen edge and the inset it already reserves lands on top of the keyboard.
Modifier.imePadding on the sheet content is not an option: the sheet applies the
insets with windowInsetsPadding, which consumes them, so a nested imePadding
reads zero.
* Cover the keyboard driven sheet expansion with a test
The IME reaction moves into ExpandSheetWhenImeIsVisible so a Robolectric test can
drive it: dispatching window insets to the composition flips
WindowInsets.isImeVisible, and the sheet state is observable from the test. Both
the shown and the hidden case are asserted, which is the patch coverage this
change was missing.
* Do not leave a blank strip below the expanded emoji search
The 10dp of bottom padding on the search bar separates the collapsed
field from the category tabs underneath it. It stayed applied once the
search bar expanded to fill the picker, so the picker stopped 10dp short
of its own bottom edge.
That strip used to sit below the visible part of a half height sheet.
Now that the sheet expands against the keyboard it reads as a gap
between the results and the keyboard, so only pad while collapsed.
* Add default `OAUTH_CLIENT_URL_PATH` alternative
Previously this was `null`, but we want to use `apps/android` instead to identify Element X Android. Element Pro will use a different value, and other custom apps based on EP will use `null` or their own custom value, if they provided one
* Suppress lint check so the pro app can be built
heroes is populated for any room whose name is derived from its members,
not only for direct messages, so a two person room that is not a DM
showed a member's Matrix ID as its subtitle.
Carry isDm on SelectRoomInfo and read the hero only when it is set. The
canonical alias still takes precedence, so nothing changes for a room
that has one.
DefaultFileSave had no test at all and AndroidLocalMediaActions only exercised the
failing path, so neither the uniquifying retry nor the new IOException on a null
insert was ever executed.
FakeMediaStoreContentProvider stands in for the media authority: it records the
display names an insert is attempted with, keeps whatever is copied into it, and can
either collide a name the way MediaStore does past 32 files or refuse to create
anything. Both call sites now go through it for the plain save, the retry and the
rejected insert.
Its name cannot follow the Fake<Interface> convention because it extends the
framework ContentProvider, so it joins the existing exceptions in
KonsistClassNameTest next to FakeFileSystem and FakeKeyStore.
Review feedback: the previous pattern hardcoded http, https and ftp and
guessed at the address grammar. Candidates are now found by scheme and
handed to java.net.URI, which accepts any scheme and rejects an authority
that is not a real IPv6 literal, an unclosed bracket, or array syntax
such as values[0]:1. Also drops the explanatory comments.
Review feedback: the retry itself is short enough to read, and the
platform limit it works around belongs in the commit, not the source.
The contract of the name helper keeps its one-line KDoc.
When the replied to event could not be fetched, the reply preview rendered the
raw SDK error string in critical styling, and tapping it emitted a focus
request that could never succeed, so the user got a dead end dialog.
Render the localised error_message_not_found string in the neutral italic style
already used for redacted and undecryptable replies, and drop the click handler
for that case. The existing key is reused rather than adding a new one; a "you
do not have access" wording was rejected because this state covers any failure
to load the event, not only a permission problem.
MatrixClient had no way to read or write global account data although the
underlying client supports it.
Add getAccountData and setAccountData to the interface and implement them in
RustMatrixClient using the same withContext/runCatchingExceptions idiom as the
neighbouring methods. The content is the raw JSON string the SDK returns and
accepts: event types are open ended, so a typed wrapper belongs to whichever
caller needs one. Scope is limited to global account data; the room level
variant and the change notification APIs can follow when a feature needs them.
A room notification is rebuilt from the one currently on screen: its messaging
style is extracted and the incoming events are appended. Every event was
appended unconditionally, so an event re-delivered while its notification was
still showing was added again, and the notification re-alerted each time.
Skip events whose id is already present in the existing messaging style, and
set onlyAlertOnce when the batch adds nothing new. Smart reply failures are
exempt, because that path deliberately reuses the same synthesised event id to
append the "message not sent" line. Filtering is per event rather than per
message so an image and its caption stay a unit.
This fixes the visible duplication, not the re-delivery that triggers it, and
does not help once the notification has been dismissed.
The forward and share room picker showed only a display name, so several
direct messages or rooms sharing a name were indistinguishable.
Render a secondary line: the canonical alias when the room has one, otherwise
the other person's Matrix ID for a direct message. No model change was needed,
because heroes is populated only for a direct message with exactly one hero,
so heroes.singleOrNull() is the peer.
The ExoPlayer backing voice messages was built without a wake mode, so it
defaulted to C.WAKE_MODE_NONE and held no wake lock. The CPU was free to
suspend once the screen turned off, cutting playback short.
Build it with C.WAKE_MODE_LOCAL instead. The media is a local file, so no
WifiLock is needed, and android.permission.WAKE_LOCK is already in the merged
manifest. The media viewer players are left alone: they already pause on
ON_PAUSE, so a wake lock there would keep the CPU awake for a player the user
has intentionally backgrounded.
The media viewer is edge to edge and the loading progress indicator was the
top-most child of a container that only applied navigation bar padding, so it
was laid out at y=0, behind the status bar and any display cutout.
Give it safeDrawing horizontal and top padding, reusing the idiom already used
by MediaViewerBottomBar in the same file. The inset deliberately does not come
from the scaffold content padding, which collapses to zero when the user taps
to hide the overlay.
Android lint rejects the literal U+2068 and U+2069 characters embedded in the string template with BidiSpoofing, "String contains misleading Unicode bidirectional text", which fails the lint task for the module.
Naming the two code points and building the characters from them produces the same string and leaves no invisible characters in the source.
Opening an image from the timeline replaces it with a full-screen page
reading "error". Two things go wrong. The viewer already holds the item
that was tapped, but building the surrounding media timeline can fail and
the failure overwrites that cached item, so the picture the user asked for
disappears. And the failure page renders the exception message straight
from the SDK, which is developer text with nothing actionable in it.
Emit the failure only when there is nothing cached, so a viewer opened on
a specific event keeps showing that event and stays usable while the rest
of the gallery is unavailable. Where there really is nothing to show, the
page now uses the same alert icon, title and message as the other error
states in this screen, built from strings that already exist.
The trade-off is that the timeline error is no longer surfaced in the
cache case; it is still logged. Swapping it for a snackbar would need a
new surface in the viewer and is left out.
A voice message that arrives without amplitude data — bridged messages and
those sent by clients that omit it — is unusable. The waveform is empty, so
its measured width is zero: the progress overlay never draws, the cursor is
pinned to the left edge, and the touch handler rejects every event because
no x coordinate can fall inside a zero-width range. The message plays, but
there is no way to see where it is or to move it.
Fall back to a flat run of zero amplitudes sized to the canvas when there
is no waveform. Width, progress, cursor and seeking then all work exactly
as they do for a real waveform, and the existing minimum amplitude renders
those zeros as the same flat track a genuinely silent recording already
draws, so no new drawing code is needed.
Nothing changes for a message that has a waveform, and the model still
carries the empty list, which is the honest value. Computing a real
waveform from the audio is a separate piece of work.
With several accounts logged in, sending a message from one of them raises
a notification on every other account that shares the room. The device
notifies its owner about something the owner has just done, and the more
accounts share a room the more copies arrive.
Resolve the set of logged-in user ids once per push batch and drop an event
whose sender is one of the other accounts, using the filtered-out result
the notification pipeline already understands, so it is recorded in push
history rather than turned into a fallback notification.
The receiving session is removed from that set, which keeps the change a
strict no-op for a single account and protects the local echo that the
reply action pushes back through the same path. Filtering happens at the
one point that sees every kind of push, so messages, polls, call invites,
ringing calls and room invites are all covered.
Filtering is unconditional and has no setting; multiple accounts sit
behind an experimental flag that is off by default, so nothing changes for
a stock build.
A fediverse handle such as `@name@server.tld` contains a substring that
`Linkify.EMAIL_ADDRESSES` recognises as a valid address, so the timeline
renders `name@server.tld` as a tappable `mailto:` link. Tapping it opens a
mail composer addressed to an account that does not accept mail.
Drop a newly added `mailto:` span when the character immediately before it
is `@`. This mirrors what Android already does for web URLs, where
`Linkify.sUrlMatchFilter` rejects a match preceded by `@` — which is why
the handle currently produces exactly one stray mailto span and no partial
link is left behind once it is removed.
Author-supplied links are unaffected: spans that were already present
before linkification are excluded from the check and restored as before. A
genuine address written directly after an `@` — "mail me @support@element.io"
— is no longer linkified, which is the same trade-off Android already makes
for web URLs.
A redaction push whose redacts field the SDK could not map was reported as
an unknown error. The result processor only suppresses filtered-out and
redacted events; every other exception becomes a visible "you have N
notifications" fallback and also raises the battery optimisation banner.
So a deleted message could produce a notification about itself, which is
the opposite of what a redaction means, plus an unrelated banner.
The branch now throws EventFilteredOut, which the processor already drops
silently, and logs at warning level so the SDK gap still shows up in push
history.
Relates to https://github.com/element-hq/element-x-android/issues/5766
With a hardware keyboard attached, Enter inserted a newline and the only
way to send was to reach for the send button, which is the opposite of
what every desktop chat client does.
MarkdownEditText gains an optional Enter listener and consumes Enter when
it comes from a physical keyboard without Shift. Shift+Enter keeps
inserting a newline, and a key event from the on-screen keyboard is
identified by its VIRTUAL_KEYBOARD device id and left alone, so nothing
changes for touch users. The key release is consumed as well, so no
newline leaks out on key repeat.
TextComposer passes its existing send lambda through, guarded by the same
canSendTextMessage check the send button already uses, so Enter cannot
send an empty message.
Relates to https://github.com/element-hq/element-x-android/issues/860
The compression config computed a target bitrate purely from the output
resolution and frame rate, ignoring the bitrate already extracted from the
source. A clip that is small because it was efficiently encoded, rather
than because it is short, was therefore re-encoded upwards: the upload got
slower and the resulting file was larger than the original.
The target is now clamped to the source bitrate when that is known.
METADATA_KEY_BITRATE is the container total, video plus audio, so it is a
safe upper bound for the video track alone. An unknown or zero bitrate
still falls back to the calculated value.
Relates to https://github.com/element-hq/element-x-android/issues/4191
Patterns.WEB_URL, which LinkifyCompat uses to find links, has no
production for a bracketed IPv6 authority, so a URL such as
http://[2001:db8::1]:8008/path was never turned into a link. Worse, the
phone number matcher claimed the digit runs inside the address, leaving a
tel: link over part of it.
LinkifyHelper now runs its own pass for those URLs. It requires both a
scheme and the brackets, so array syntax like values[0]:1 is not matched,
and it runs after LinkifyCompat.addLinks, which strips any span set before
it, but before the pre-existing spans are restored, so real anchors and
pill spans keep their precedence. Any span Linkify left inside the address
is evicted, and the same trailing punctuation trimming as the other links
is applied.
Relates to https://github.com/element-hq/element-x-android/issues/2614
A room list preview is one paragraph, and its direction is resolved from
the first strong character. A sender whose display name is Arabic or
Hebrew therefore flipped the whole line: the message body moved to the
wrong side of the name and the separating colon jumped to the front.
The sender's display name is now wrapped in Unicode isolate characters
before it is used as a prefix, so its own direction cannot escape it. Both
places that interpolate the name are covered: the prefix path and the
emote path, which bypasses it.
prefixWith itself is deliberately left alone, since the pinned messages
banner shares it and only ever passes localised nouns. The "You" prefix is
localised rather than user-provided and is not isolated.
Relates to https://github.com/element-hq/element-x-android/issues/3338
The composer emits Start whenever the voice message state is Idle, and the
state only leaves Idle once the recorder has produced its first audio
buffer. A second tap inside that window started a second recording, which
overwrote the output file, re-initialised the encoder while the first one
was still encoding, and orphaned the first job together with its
AudioReader.
The orphan kept the microphone open and kept emitting Recording for the
rest of the session, so Stop and Delete appeared to do nothing until the
room was left and re-entered, and re-initialising the encoder under an
active encode could crash natively.
DefaultVoiceRecorder.startRecord now runs under the mutex it already owns
and returns early when a recording job exists, so the second start is a
no-op: no file, no encoder re-init and no second AudioReader.
Relates to https://github.com/element-hq/element-x-android/issues/5780
A distributor such as ntfy or DAVx5 lists every registration it holds, but
Element registered each one with no message for the distributor, so an
account added from a second session was indistinguishable from the first.
RegisterUnifiedPushUseCase.execute now takes the session id and passes it
as messageForDistributor, which the connector has accepted since 3.x. The
value is the raw Matrix ID, which is not personal data by the project's
own logging rules, and no new string resource is needed.
UnifiedPushProvider already has the MatrixClient in hand at the only call
site, so the PushProvider interface is unchanged and nothing outside the
module moves.
Relates to https://github.com/element-hq/element-x-android/issues/6426
MediaStore de-duplicates the display name of a new file itself, but its
uniquifier gives up after 32 collisions and throws IllegalStateException.
Saving then failed with "Sorry, an error occurred" and wrote nothing, and
because image.png is the name most screenshots arrive with, a user who
saves media regularly could reach a state where that name never saved
again without deleting files from Downloads by hand.
A new saveWithUniqueFileName helper in androidutils retries the insert
once with a suffixed name when the platform reports it cannot build a
unique one; a second failure propagates so genuine errors still surface.
withFileNameSuffix builds that name by inserting the suffix before the
extension, and handles names without one.
Both call sites are fixed: AndroidLocalMediaActions and DefaultFileSave
carried byte-identical logic and therefore the identical defect. While in
AndroidLocalMediaActions, a null output uri from ContentResolver.insert
now throws instead of reporting success without writing anything.
The pre-Android-Q path is untouched: it overwrites rather than
uniquifying, so it never reaches this limit.
Relates to https://github.com/element-hq/element-x-android/issues/6371
Jorge Martín
ganfra
ganfra
bmarty
Jenna Vassar
hayyaksi
Benoit Marty
Benoit Marty