From 4eccc329532cea133091a25f309ad4c7bb64d9d5 Mon Sep 17 00:00:00 2001
From: Soonoh <soonoh.jung@gmail.com>
Date: Mon, 15 Jun 2026 05:05:19 +0900
Subject: [PATCH] fix(android): keep the API bearer token out of device backups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The voice companion stores its Doorkeeper bearer token — which grants full
mobile-API access to the user's Collavre account — in the collavre_voice
Preferences DataStore. That file is app-private but plaintext, and the manifest
shipped with allowBackup="true" (the default), so Android Auto Backup and
adb backup could exfiltrate the token in cleartext (CWE-312, OWASP
MASVS-STORAGE-2).

Set allowBackup="false" to block Auto Backup / adb backup on all versions, and
add dataExtractionRules excluding the file/sharedpref/database domains so a
device-to-device transfer on Android 12+ (governed separately from allowBackup)
also can't copy the token.
---
 .../app/src/main/AndroidManifest.xml          |  3 ++-
 .../main/res/xml/data_extraction_rules.xml    | 22 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 tools/android-app/app/src/main/res/xml/data_extraction_rules.xml

diff --git a/tools/android-app/app/src/main/AndroidManifest.xml b/tools/android-app/app/src/main/AndroidManifest.xml
index fdbacc61c..defbd2f44 100644
--- a/tools/android-app/app/src/main/AndroidManifest.xml
+++ b/tools/android-app/app/src/main/AndroidManifest.xml
@@ -21,7 +21,8 @@
 
     <application
         android:name=".VoiceApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:icon="@drawable/ic_launcher"
         android:label="@string/app_name"
         android:networkSecurityConfig="@xml/network_security_config"
diff --git a/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml b/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 000000000..f3f64a9d1
--- /dev/null
+++ b/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The companion stores a Doorkeeper bearer token (full mobile-API access to the
+  user's Collavre account) in the `collavre_voice` Preferences DataStore. That
+  file is app-private but plaintext, so it must never leave the device via a
+  backup channel. allowBackup="false" already blocks Auto Backup and adb backup;
+  on Android 12+ dataExtractionRules governs cloud-backup and device-transfer
+  SEPARATELY, so we exclude the file domain (where the datastore lives) from
+  BOTH — otherwise a device-to-device migration would copy the token in cleartext.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="file" />
+        <exclude domain="sharedpref" />
+        <exclude domain="database" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="file" />
+        <exclude domain="sharedpref" />
+        <exclude domain="database" />
+    </device-transfer>
+</data-extraction-rules>