Add support for join timestamp to CertificateManager.

PiperOrigin-RevId: 949828133

sharing/certificates/BUILD

@@ -63,6 +63,7 @@ cc_library(
         "//sharing/proto:enums_cc_proto",
         "//sharing/proto:share_cc_proto",
         "//sharing/scheduling",
+        "//third_party/gloop/util/time:protoutil",
         "//util/hash:highway_fingerprint",
         "@com_google_absl//absl/algorithm",
         "@com_google_absl//absl/base:nullability",
@@ -145,6 +146,7 @@ cc_test(
         "//sharing/proto:share_cc_proto",
         "//sharing/scheduling",
         "//sharing/scheduling:test_support",
+        "//third_party/gloop/util/time:protoutil",
         "@com_github_protobuf_matchers//protobuf-matchers",
         "@com_google_absl//absl/functional:any_invocable",
         "@com_google_absl//absl/status",

sharing/certificates/fake_nearby_share_certificate_manager.h

@@ -25,6 +25,7 @@
 #include <vector>
 
 #include "location/nearby/sharing/lib/rpc/sharing_rpc_client.h"
+#include "absl/time/time.h"
 #include "internal/base/file_path.h"
 #include "sharing/certificates/nearby_share_certificate_manager.h"
 #include "sharing/certificates/nearby_share_certificate_manager_impl.h"
@@ -96,6 +97,11 @@ class FakeNearbyShareCertificateManager : public NearbyShareCertificateManager {
   void ForceUploadPrivateCertificates() override {};
   void ClearPublicCertificates(std::function<void(bool)> callback) override;
   void SetVendorId(int32_t vendor_id) override {}
+  void SetJoinBindingTime(absl::Time join_binding_time,
+                          absl::Duration life_time) override {
+    join_binding_time_ = join_binding_time;
+    join_binding_life_time_ = life_time;
+  }
   std::string Dump() const override { return ""; }
 
   // Make protected methods from base class public in this fake class.
@@ -136,6 +142,8 @@ class FakeNearbyShareCertificateManager : public NearbyShareCertificateManager {
   std::vector<GetDecryptedPublicCertificateCall>
       get_decrypted_public_certificate_calls_;
   std::vector<uint8_t> next_salt_;
+  absl::Time join_binding_time_;
+  absl::Duration join_binding_life_time_;
 };
 
 }  // namespace sharing

sharing/certificates/nearby_share_certificate_manager.h

@@ -22,6 +22,7 @@
 #include <string>
 #include <vector>
 
+#include "absl/time/time.h"
 #include "absl/types/span.h"
 #include "internal/base/observer_list.h"
 #include "sharing/certificates/nearby_share_decrypted_public_certificate.h"
@@ -119,6 +120,12 @@ class NearbyShareCertificateManager {
   // Sets the vendor ID to generate certificates for.
   virtual void SetVendorId(int32_t vendor_id) = 0;
 
+  // Sets the timestamp of the join binding rpc. This is used to ensure that the
+  // requested public certificates contain the ids of the binding.
+  // `life_time` determines how long this join_binding_time will be used.
+  virtual void SetJoinBindingTime(absl::Time join_binding_time,
+                                  absl::Duration life_time) = 0;
+
   // Dump certificates ID information for troubleshooting.
   virtual std::string Dump() const = 0;
 

sharing/certificates/nearby_share_certificate_manager_impl.cc

@@ -44,6 +44,7 @@
 #include "absl/synchronization/notification.h"
 #include "absl/time/time.h"
 #include "absl/types/span.h"
+#include "third_party/gloop/util/time/protoutil.h"
 #include "internal/base/file_path.h"
 #include "internal/flags/nearby_flags.h"
 #include "internal/platform/mac_address.h"
@@ -383,6 +384,13 @@ void NearbyShareCertificateManagerImpl::CertificateDownloadContext::
   page_number_++;
   QuerySharedCredentialsWithBindingIdsRequest request;
   request.set_name(absl::StrCat("devices/", device_id_));
+  if (join_time_.has_value()) {
+    absl::StatusOr<google::protobuf::Timestamp> join_time =
+        util_time::EncodeGoogleApiProto(*join_time_);
+    if (join_time.ok()) {
+      *request.mutable_join_binding_time() = *join_time;
+    }
+  }
   if (next_page_token_.has_value()) {
     request.set_page_token(*next_page_token_);
   }
@@ -467,10 +475,15 @@ bool NearbyShareCertificateManagerImpl::DownloadPublicCertificatesInExecutor() {
     return true;
   }
 
+  // Clear join_time if it is expired.
+  if (join_time_.has_value() &&
+      context_->GetClock()->Now() > join_time_discard_time_) {
+    join_time_.reset();
+  }
   bool download_succeeded = false;
   absl::Notification notification;
   auto context = std::make_unique<CertificateDownloadContext>(
-      nearby_identity_client_, std::move(device_id),
+      nearby_identity_client_, std::move(device_id), join_time_,
       [this, &download_succeeded, &notification](
           absl::StatusOr<std::vector<PublicCertificate>> certificates_status) {
         if (!certificates_status.ok()) {
@@ -745,6 +758,12 @@ void NearbyShareCertificateManagerImpl::SetVendorId(int32_t vendor_id) {
   RegeneratePrivateCertificates();
 }
 
+void NearbyShareCertificateManagerImpl::SetJoinBindingTime(
+    absl::Time join_binding_time, absl::Duration life_time) {
+  join_time_ = join_binding_time;
+  join_time_discard_time_ = context_->GetClock()->Now() + life_time;
+}
+
 std::string NearbyShareCertificateManagerImpl::Dump() const {
   std::stringstream sstream;
   sstream << "Public Certificates" << std::endl;

sharing/certificates/nearby_share_certificate_manager_impl.h

@@ -92,6 +92,8 @@ class NearbyShareCertificateManagerImpl
   void ForceUploadPrivateCertificates() override;
   void ClearPublicCertificates(std::function<void(bool)> callback) override;
   void SetVendorId(int32_t vendor_id) override;
+  void SetJoinBindingTime(absl::Time join_binding_time,
+                          absl::Duration life_time) override;
   std::string Dump() const override;
 
  private:
@@ -104,12 +106,14 @@ class NearbyShareCertificateManagerImpl
         nearby::sharing::api::IdentityRpcClient* absl_nonnull
             nearby_identity_client,
         std::string device_id,
+        std::optional<absl::Time> join_time,
         absl::AnyInvocable<void(absl::StatusOr<std::vector<
                                     nearby::sharing::proto::PublicCertificate>>
                                     certificates_status) &&>
             download_callback)
         : nearby_identity_client_(nearby_identity_client),
           device_id_(std::move(device_id)),
+          join_time_(join_time),
           download_callback_(std::move(download_callback)) {}
 
     // Fetches the next page of certificates by calling Identity API
@@ -123,7 +127,8 @@ class NearbyShareCertificateManagerImpl
    private:
     nearby::sharing::api::IdentityRpcClient* absl_nonnull const
         nearby_identity_client_;
-    std::string device_id_;
+    const std::string device_id_;
+    const std::optional<absl::Time> join_time_;
     std::optional<std::string> next_page_token_;
     int page_number_ = 1;
     std::vector<nearby::sharing::proto::PublicCertificate> certificates_;
@@ -219,6 +224,11 @@ class NearbyShareCertificateManagerImpl
       account_info_update_scheduler_;
 
   std::unique_ptr<TaskRunner> executor_;
+  // Set to the transaction timestamp of the last successful pairing if
+  // available.  This is returned from the phone in the BindingResponse message.
+  std::optional<absl::Time> join_time_;
+  // The time when the join_time_ will be discarded.
+  absl::Time join_time_discard_time_;
 };
 
 }  // namespace nearby::sharing

sharing/certificates/nearby_share_certificate_manager_impl_test.cc

@@ -39,6 +39,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/time/time.h"
 #include "absl/types/span.h"
+#include "third_party/gloop/util/time/protoutil.h"
 #include "internal/flags/nearby_flags.h"
 #include "internal/platform/mac_address.h"
 #include "sharing/certificates/constants.h"
@@ -78,6 +79,7 @@ using ::google::nearby::identity::v1::
     QuerySharedCredentialsWithBindingIdsResponse;
 using ::nearby::sharing::proto::DeviceVisibility;
 using ::nearby::sharing::proto::PublicCertificate;
+using ::protobuf_matchers::EqualsProto;
 using ::testing::Not;
 using ::testing::ReturnRef;
 using ::testing::UnorderedElementsAreArray;
@@ -797,6 +799,42 @@ TEST_F(NearbyShareCertificateManagerImplTest,
       /*num_pages=*/2, DownloadPublicCertificatesResult::kHttpError));
 }
 
+TEST_F(NearbyShareCertificateManagerImplTest,
+       QuerySharedCredentialsWithBindingIdsWithJoinTime) {
+  NearbyFlags::GetInstance().OverrideBoolFlagValue(
+      config_package_nearby::nearby_sharing_feature::kEnableBackup, true);
+  Initialize();
+  cert_manager_->SetJoinBindingTime(absl::FromUnixSeconds(123456789),
+                                    absl::Seconds(30));
+  ASSERT_NO_FATAL_FAILURE(QuerySharedCredentialsWithBindingIdsFlow(
+      /*num_pages=*/2, DownloadPublicCertificatesResult::kSuccess));
+  std::vector<QuerySharedCredentialsWithBindingIdsRequest> requests =
+      identity_client_.query_shared_credentials_with_binding_ids_requests();
+  for (const auto& request : requests) {
+    ASSERT_OK_AND_ASSIGN(
+        auto expected_time,
+        util_time::EncodeGoogleApiProto(absl::FromUnixSeconds(123456789)));
+    EXPECT_THAT(request.join_binding_time(), EqualsProto(expected_time));
+  }
+}
+
+TEST_F(NearbyShareCertificateManagerImplTest,
+       QuerySharedCredentialsWithBindingIdsWithJoinTimeExpiration) {
+  NearbyFlags::GetInstance().OverrideBoolFlagValue(
+      config_package_nearby::nearby_sharing_feature::kEnableBackup, true);
+  Initialize();
+  cert_manager_->SetJoinBindingTime(absl::FromUnixSeconds(123456789),
+                                    absl::Seconds(30));
+  FastForward(absl::Seconds(31));
+  ASSERT_NO_FATAL_FAILURE(QuerySharedCredentialsWithBindingIdsFlow(
+      /*num_pages=*/2, DownloadPublicCertificatesResult::kSuccess));
+  std::vector<QuerySharedCredentialsWithBindingIdsRequest> requests =
+      identity_client_.query_shared_credentials_with_binding_ids_requests();
+  for (const auto& request : requests) {
+    EXPECT_FALSE(request.has_join_binding_time());
+  }
+}
+
 TEST_F(NearbyShareCertificateManagerImplTest, ClearPublicCertificates) {
   Initialize();
   cert_manager_->ClearPublicCertificates([&](bool result) {});