Fill OTP fields with SMS codes

.github/workflows/pull_request.yml

@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         api-level: [23, 29]
-        variant: [Debug, Release]
+        variant: [freeDebug, freeRelease, nonFreeRelease]
     steps:
 
     - name: Check if relevant files have changed

.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
       run: ./gradlew dependencies
 
     - name: Build release APK and bundle
-      run: ./gradlew :app:assembleRelease :app:bundleRelease
+      run: ./gradlew :app:assembleFreeRelease :app:bundleFreeRelease
 
     - name: Upload release APK
       uses: actions/upload-artifact@master

CHANGELOG.md

@@ -13,6 +13,7 @@ All notable changes to this project will be documented in this file.
 
 -   TOTP support is reintroduced by popular demand. HOTP continues to be unsupported and heavily discouraged.
 -   Initial support for detecting and filling OTP fields with Autofill
+-   OTP codes can be automatically filled from SMS (requires Android P+ and Google Play Services)
 -   Importing TOTP secrets using QR codes
 -   Navigate into newly created folders and scroll to newly created passwords
 

app/build.gradle

@@ -68,6 +68,15 @@ android {
         buildTypes.release.signingConfig = signingConfigs.release
         buildTypes.debug.signingConfig = signingConfigs.release
     }
+
+    flavorDimensions "free"
+    productFlavors {
+        free {
+            versionNameSuffix "-free"
+        }
+        nonFree {
+        }
+    }
 }
 
 dependencies {
@@ -117,6 +126,8 @@ dependencies {
         debugImplementation deps.third_party.whatthestack
     }
 
+    nonFreeImplementation deps.non_free.google_play_auth_api_phone
+
     // Testing-only dependencies
     androidTestImplementation deps.testing.junit
     androidTestImplementation deps.testing.kotlin_test_junit

app/src/free/java/com/zeapo/pwdstore/autofill/oreo/ui/AutofillSmsActivity.kt

@@ -0,0 +1,28 @@
+/*
+ * Copyright © 2014-2020 The Android Password Store Authors. All Rights Reserved.
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+package com.zeapo.pwdstore.autofill.oreo.ui
+
+import android.content.Context
+import android.content.IntentSender
+import android.os.Build
+import androidx.annotation.RequiresApi
+import androidx.appcompat.app.AppCompatActivity
+import com.zeapo.pwdstore.autofill.oreo.FormOrigin
+
+@RequiresApi(Build.VERSION_CODES.O)
+@Suppress("UNUSED_PARAMETER")
+class AutofillSmsActivity : AppCompatActivity() {
+
+    companion object {
+
+        fun shouldOfferFillFromSms(context: Context): Boolean {
+            return false
+        }
+
+        fun makeFillOtpFromSmsIntentSender(context: Context): IntentSender {
+            throw NotImplementedError("Filling OTPs from SMS requires non-free dependencies")
+        }
+    }
+}

app/src/main/AndroidManifest.xml

@@ -138,6 +138,11 @@
         <activity
             android:name=".autofill.oreo.ui.AutofillSaveActivity"
             android:theme="@style/NoBackgroundTheme" />
+        <activity
+            android:name=".autofill.oreo.ui.AutofillSmsActivity"
+            android:configChanges="orientation"
+            android:theme="@style/DialogLikeTheme"
+            android:windowSoftInputMode="adjustNothing" />
         <activity
             android:name=".autofill.oreo.ui.AutofillPublisherChangedActivity"
             android:configChanges="orientation|keyboardHidden"

app/src/main/java/com/zeapo/pwdstore/autofill/oreo/AutofillHelper.kt

@@ -87,7 +87,7 @@ val AssistStructure.ViewNode.webOrigin: String?
         "$scheme://$domain"
     }
 
-data class Credentials(val username: String?, val password: String, val otp: String?) {
+data class Credentials(val username: String?, val password: String?, val otp: String?) {
     companion object {
         fun fromStoreEntry(
             context: Context,
@@ -141,6 +141,13 @@ fun makeGenerateAndFillRemoteView(context: Context, formOrigin: FormOrigin): Rem
     return makeRemoteView(context, title, summary, iconRes)
 }
 
+fun makeFillOtpFromSmsRemoteView(context: Context, formOrigin: FormOrigin): RemoteViews {
+    val title = formOrigin.getPrettyIdentifier(context, untrusted = true)
+    val summary = context.getString(R.string.oreo_autofill_fill_otp_from_sms)
+    val iconRes = R.drawable.ic_autofill_sms
+    return makeRemoteView(context, title, summary, iconRes)
+}
+
 fun makePlaceholderRemoteView(context: Context): RemoteViews {
     return makeRemoteView(context, "PLACEHOLDER", "PLACEHOLDER", R.mipmap.ic_launcher)
 }

app/src/main/java/com/zeapo/pwdstore/autofill/oreo/AutofillScenario.kt

@@ -14,7 +14,7 @@ import androidx.annotation.RequiresApi
 import com.github.ajalt.timberkt.e
 
 enum class AutofillAction {
-    Match, Search, Generate
+    Match, Search, Generate, FillOtpFromSms
 }
 
 /**
@@ -112,8 +112,13 @@ sealed class AutofillScenario<out T : Any> {
             AutofillAction.Match -> passwordFieldsToFillOnMatch + listOfNotNull(otp)
             AutofillAction.Search -> passwordFieldsToFillOnSearch + listOfNotNull(otp)
             AutofillAction.Generate -> passwordFieldsToFillOnGenerate
+            AutofillAction.FillOtpFromSms -> listOfNotNull(otp)
         }
         return when {
+            action == AutofillAction.FillOtpFromSms -> {
+                // When filling from an SMS, we cannot get any data other than the OTP itself.
+                credentialFieldsToFill
+            }
             credentialFieldsToFill.isNotEmpty() -> {
                 // If the current action would fill into any password field, we also fill into the
                 // username field if possible.

app/src/main/java/com/zeapo/pwdstore/autofill/oreo/Form.kt

@@ -25,6 +25,7 @@ import com.zeapo.pwdstore.autofill.oreo.ui.AutofillDecryptActivity
 import com.zeapo.pwdstore.autofill.oreo.ui.AutofillFilterView
 import com.zeapo.pwdstore.autofill.oreo.ui.AutofillPublisherChangedActivity
 import com.zeapo.pwdstore.autofill.oreo.ui.AutofillSaveActivity
+import com.zeapo.pwdstore.autofill.oreo.ui.AutofillSmsActivity
 import java.io.File
 
 /**
@@ -285,6 +286,14 @@ class FillableForm private constructor(
         return makePlaceholderDataset(remoteView, intentSender, AutofillAction.Generate)
     }
 
+    private fun makeFillOtpFromSmsDataset(context: Context): Dataset? {
+        if (scenario.fieldsToFillOn(AutofillAction.FillOtpFromSms).isEmpty()) return null
+        if (!AutofillSmsActivity.shouldOfferFillFromSms(context)) return null
+        val remoteView = makeFillOtpFromSmsRemoteView(context, formOrigin)
+        val intentSender = AutofillSmsActivity.makeFillOtpFromSmsIntentSender(context)
+        return makePlaceholderDataset(remoteView, intentSender, AutofillAction.FillOtpFromSms)
+    }
+
     private fun makePublisherChangedDataset(
         context: Context,
         publisherChangedException: AutofillPublisherChangedException
@@ -341,6 +350,10 @@ class FillableForm private constructor(
                 hasDataset = true
                 addDataset(it)
             }
+            makeFillOtpFromSmsDataset(context)?.let {
+                hasDataset = true
+                addDataset(it)
+            }
             if (!hasDataset) return null
             makeSaveInfo()?.let { setSaveInfo(it) }
             setClientState(clientState)

app/src/main/res/drawable/ic_autofill_sms.xml

@@ -0,0 +1,10 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:tint="?attr/colorControlNormal"
+    android:viewportWidth="24"
+    android:viewportHeight="24">
+    <path
+        android:fillColor="@android:color/white"
+        android:pathData="M20,2L4,2c-1.1,0 -1.99,0.9 -1.99,2L2,22l4,-4h14c1.1,0 2,-0.9 2,-2L22,4c0,-1.1 -0.9,-2 -2,-2zM9,11L7,11L7,9h2v2zM13,11h-2L11,9h2v2zM17,11h-2L15,9h2v2z" />
+</vector>

app/src/main/res/layout/activity_oreo_autofill_sms.xml

@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright © 2014-2020 The Android Password Store Authors. All Rights Reserved.
+  ~ SPDX-License-Identifier: GPL-3.0-only
+  -->
+
+<androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="wrap_content"
+    android:layout_height="wrap_content"
+    android:paddingHorizontal="10dp"
+    tools:context="com.zeapo.pwdstore.autofill.oreo.ui.AutofillFilterView">
+
+    <ImageView
+        android:id="@+id/cover"
+        android:layout_width="0dp"
+        android:layout_height="50dp"
+        android:contentDescription="@string/app_name"
+        android:src="@drawable/ic_launcher_foreground"
+        app:layout_constraintBottom_toTopOf="@id/text"
+        app:layout_constraintEnd_toEndOf="parent"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintTop_toTopOf="parent"
+        android:layout_margin="10dp"
+        app:layout_constraintVertical_bias="0.0" />
+
+    <TextView
+        android:id="@+id/text"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="@string/oreo_autofill_waiting_for_sms"
+        android:layout_margin="10dp"
+        app:layout_constraintEnd_toEndOf="parent"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintTop_toBottomOf="@id/cover" />
+
+    <ProgressBar
+        android:id="@+id/progress"
+        style="@style/Widget.MaterialComponents.ProgressIndicator.Circular.Indeterminate"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:layout_margin="10dp"
+        app:layout_constraintBottom_toTopOf="@id/cancelButton"
+        app:layout_constraintEnd_toEndOf="parent"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintTop_toBottomOf="@id/text" />
+
+    <Button
+        android:id="@+id/cancelButton"
+        style="@style/Widget.MaterialComponents.Button.TextButton"
+        android:layout_margin="10dp"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="@string/dialog_cancel"
+        android:textColor="?attr/colorSecondary"
+        app:layout_constraintBottom_toBottomOf="parent"
+        app:layout_constraintEnd_toEndOf="parent"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintTop_toBottomOf="@id/progress" />
+
+</androidx.constraintlayout.widget.ConstraintLayout>

app/src/main/res/values/strings.xml

@@ -253,6 +253,8 @@
     <string name="oreo_autofill_save_app_not_supported">This app is currently not supported</string>
     <string name="oreo_autofill_save_passwords_dont_match">Passwords don\'t match</string>
     <string name="oreo_autofill_generate_password">Generate password…</string>
+    <string name="oreo_autofill_fill_otp_from_sms">Extract code from SMS…</string>
+    <string name="oreo_autofill_waiting_for_sms">Waiting for SMS…</string>
     <string name="oreo_autofill_max_matches_reached">Maximum number of matches (%1$d) reached; clear matches before adding new ones.</string>
     <string name="oreo_autofill_warning_publisher_header">This app\'s publisher has changed since you first associated a Password Store entry with it:</string>
     <string name="oreo_autofill_warning_publisher_footer"><b>The currently installed app may be trying to steal your credentials by pretending to be a trusted app.</b>\n\nTry to uninstall and reinstall the app from a trusted source, such as the Play Store, Amazon Appstore, F-Droid, or your phone manufacturer\'s store.</string>