Fix the certificate pairing issue when the visibility is set to everyone

PiperOrigin-RevId: 617873950

sharing/certificates/nearby_share_certificate_manager_impl.cc

@@ -470,6 +470,17 @@ void NearbyShareCertificateManagerImpl::OnStop() {
 std::optional<NearbySharePrivateCertificate>
 NearbyShareCertificateManagerImpl::GetValidPrivateCertificate(
     DeviceVisibility visibility) const {
+  if (visibility == DeviceVisibility::DEVICE_VISIBILITY_UNSPECIFIED ||
+      visibility == DeviceVisibility::DEVICE_VISIBILITY_HIDDEN) {
+    return std::nullopt;
+  }
+
+  // If the user already signed in, setup contacts certificate for everyone
+  // mode to show correct user icon on remote device.
+  if (visibility == DeviceVisibility::DEVICE_VISIBILITY_EVERYONE) {
+    visibility = DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS;
+  }
+
   std::optional<std::vector<NearbySharePrivateCertificate>> certs =
       *certificate_storage_->GetPrivateCertificates();
   for (auto& cert : *certs) {

sharing/certificates/nearby_share_certificate_manager_impl_test.cc

@@ -465,6 +465,12 @@ class NearbyShareCertificateManagerImplTest
 
 TEST_F(NearbyShareCertificateManagerImplTest,
        EncryptPrivateCertificateMetadataKey) {
+  // No certificates exist for hidden or unspecified visibility.
+  EXPECT_FALSE(cert_manager_->EncryptPrivateCertificateMetadataKey(
+      DeviceVisibility::DEVICE_VISIBILITY_HIDDEN));
+  EXPECT_FALSE(cert_manager_->EncryptPrivateCertificateMetadataKey(
+      DeviceVisibility::DEVICE_VISIBILITY_UNSPECIFIED));
+
   // No valid certificates exist.
   cert_store_->ReplacePrivateCertificates({});
   EXPECT_FALSE(cert_manager_->EncryptPrivateCertificateMetadataKey(
@@ -500,6 +506,21 @@ TEST_F(NearbyShareCertificateManagerImplTest,
   EXPECT_NE(cert_store_->GetPrivateCertificates()->at(0).ToCertificateData(),
             private_certificate.ToCertificateData());
 
+  // Set up valid all-contacts visibility certificate. Then test with everyone
+  // visibility.
+  cert_store_->ReplacePrivateCertificates({private_certificate});
+  FastForward(GetNearbyShareTestNotBefore() +
+              kNearbyShareCertificateValidityPeriod * 0.5 - Now());
+
+  std::optional<NearbyShareEncryptedMetadataKey> encrypted_metadata_key_everyone
+      =
+      cert_manager_->EncryptPrivateCertificateMetadataKey(
+          DeviceVisibility::DEVICE_VISIBILITY_EVERYONE);
+  EXPECT_EQ(GetNearbyShareTestEncryptedMetadataKey().encrypted_key(),
+            encrypted_metadata_key_everyone->encrypted_key());
+  EXPECT_EQ(GetNearbyShareTestEncryptedMetadataKey().salt(),
+            encrypted_metadata_key_everyone->salt());
+
   // No valid certificates exist.
   FastForward(kNearbyShareCertificateValidityPeriod);
   EXPECT_FALSE(cert_manager_->EncryptPrivateCertificateMetadataKey(
@@ -523,10 +544,32 @@ TEST_F(NearbyShareCertificateManagerImplTest, SignWithPrivateCertificate) {
           DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS,
           GetNearbyShareTestPayloadToSign())));
 
+  // Set up valid all-contacts visibility certificate. Then test with everyone
+  // visibility.
+  cert_store_->ReplacePrivateCertificates({private_certificate});
+  FastForward(GetNearbyShareTestNotBefore() +
+              kNearbyShareCertificateValidityPeriod * 0.5 - Now());
+
+  // Perform sign/verify round trip.
+  EXPECT_TRUE(GetNearbyShareTestDecryptedPublicCertificate().VerifySignature(
+      GetNearbyShareTestPayloadToSign(),
+      *cert_manager_->SignWithPrivateCertificate(
+          DeviceVisibility::DEVICE_VISIBILITY_EVERYONE,
+          GetNearbyShareTestPayloadToSign())));
+
   // No selected-contact visibility certificate in storage.
   EXPECT_FALSE(cert_manager_->SignWithPrivateCertificate(
       DeviceVisibility::DEVICE_VISIBILITY_SELECTED_CONTACTS,
       GetNearbyShareTestPayloadToSign()));
+
+  // No certificates exist for hidden or unspecified visibility.
+  EXPECT_FALSE(cert_manager_->SignWithPrivateCertificate(
+      DeviceVisibility::DEVICE_VISIBILITY_HIDDEN,
+      GetNearbyShareTestPayloadToSign()));
+
+  EXPECT_FALSE(cert_manager_->SignWithPrivateCertificate(
+      DeviceVisibility::DEVICE_VISIBILITY_UNSPECIFIED,
+      GetNearbyShareTestPayloadToSign()));
 }
 
 TEST_F(NearbyShareCertificateManagerImplTest,
@@ -544,10 +587,31 @@ TEST_F(NearbyShareCertificateManagerImplTest,
                 DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS,
                 GetNearbyShareTestPayloadToSign()));
 
+  // Set up valid all-contacts visibility certificate. Then test with everyone
+  // visibility.
+  cert_store_->ReplacePrivateCertificates({private_certificate});
+  FastForward(GetNearbyShareTestNotBefore() +
+              kNearbyShareCertificateValidityPeriod * 0.5 - Now());
+
+  EXPECT_EQ(private_certificate.HashAuthenticationToken(
+                GetNearbyShareTestPayloadToSign()),
+            cert_manager_->HashAuthenticationTokenWithPrivateCertificate(
+                DeviceVisibility::DEVICE_VISIBILITY_EVERYONE,
+                GetNearbyShareTestPayloadToSign()));
+
   // No selected-contact visibility certificate in storage.
   EXPECT_FALSE(cert_manager_->HashAuthenticationTokenWithPrivateCertificate(
       DeviceVisibility::DEVICE_VISIBILITY_SELECTED_CONTACTS,
       GetNearbyShareTestPayloadToSign()));
+
+  // No certificates exist for hidden or unspecified visibility.
+  EXPECT_FALSE(cert_manager_->HashAuthenticationTokenWithPrivateCertificate(
+      DeviceVisibility::DEVICE_VISIBILITY_HIDDEN,
+      GetNearbyShareTestPayloadToSign()));
+
+  EXPECT_FALSE(cert_manager_->HashAuthenticationTokenWithPrivateCertificate(
+      DeviceVisibility::DEVICE_VISIBILITY_UNSPECIFIED,
+      GetNearbyShareTestPayloadToSign()));
 }
 
 TEST_F(NearbyShareCertificateManagerImplTest,

sharing/nearby_sharing_service_impl.cc

@@ -1571,13 +1571,7 @@ NearbySharingServiceImpl::CreateEndpointInfo(
   std::vector<uint8_t> encrypted_key;
 
   if (account_manager_.GetCurrentAccount().has_value()) {
-    // If the user already signed in, setup contacts certificate for everyone
-    // mode to show correct user icon on remote device.
     DeviceVisibility visibility = settings_->GetVisibility();
-    if (visibility == proto::DEVICE_VISIBILITY_EVERYONE) {
-      // Make sure using all contacts certificate for everyone mode
-      visibility = proto::DEVICE_VISIBILITY_ALL_CONTACTS;
-    }
 
     std::optional<NearbyShareEncryptedMetadataKey> encrypted_metadata_key =
         certificate_manager_->EncryptPrivateCertificateMetadataKey(visibility);

sharing/paired_key_verification_runner.cc

@@ -331,9 +331,12 @@ void PairedKeyVerificationRunner::SendCertificateInfo() {
 }
 
 void PairedKeyVerificationRunner::SendPairedKeyEncryptionFrame() {
+  // This matches the behavior of CertificateManagerImpl.getFileNameByVisibility
+  // in Android. Sender always return all contacts visibility certificates.
   std::optional<std::vector<uint8_t>> signature =
       certificate_manager_->SignWithPrivateCertificate(
-          GetSignningVisibility(), PadPrefix(local_prefix_, raw_token_));
+          DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS,
+          PadPrefix(local_prefix_, raw_token_));
   if (!signature.has_value() || signature->empty()) {
     signature = GenerateRandomBytes(kNearbyShareNumBytesRandomSignature);
   }
@@ -359,7 +362,8 @@ void PairedKeyVerificationRunner::SendPairedKeyEncryptionFrame() {
         << "Attempts to sign authentication token with a previous private key.";
     std::optional<std::vector<uint8_t>> optional_signature =
         certificate_manager_->SignWithPrivateCertificate(
-            GetSignningVisibility(), PadPrefix(local_prefix_, raw_token_));
+            DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS,
+            PadPrefix(local_prefix_, raw_token_));
 
     if (optional_signature.has_value()) {
       encryption_frame->set_optional_signed_data(optional_signature->data(),
@@ -490,11 +494,5 @@ bool PairedKeyVerificationRunner::RelaxRestrictToContactsIfNeeded() const {
           kRelaxAfterSetVisibilityTimeout);
 }
 
-DeviceVisibility PairedKeyVerificationRunner::GetSignningVisibility() const {
-  // This matches the behavior of CertificateManagerImpl.getFileNameByVisibility
-  // in Android.
-  return DeviceVisibility::DEVICE_VISIBILITY_ALL_CONTACTS;
-}
-
 }  // namespace sharing
 }  // namespace nearby

sharing/paired_key_verification_runner.h

@@ -99,8 +99,6 @@ class PairedKeyVerificationRunner
   void SendCertificateInfo();
   bool RelaxRestrictToContactsIfNeeded() const;
 
-  proto::DeviceVisibility GetSignningVisibility() const;
-
   nearby::Clock* const clock_;
   nearby::DeviceInfo& device_info_;
   NearbyShareSettings* nearby_share_settings_;