Part of #324 (strangler-migrate debug logging to AppLog).
Sequencing: PARALLEL with the other migration areas, after the Seam ticket merges
(needs AppLog.d(tag, msg, throwable)). Touches only data/security + data/local, so no
collision with sibling areas.
Scope (files)
app/src/main/kotlin/org/libremail/data/security/DatabaseKeyCipher.kt — 4 raw Log.d(..., e).
app/src/main/kotlin/org/libremail/data/local/DatabaseEncryption.kt — 1 raw Log.d.
app/src/main/kotlin/org/libremail/data/local/AccountDataMigrator.kt — 1 raw Log.d.
Migrate these call sites (all -> AppLog; drop import android.util.Log)
DatabaseKeyCipher.kt (each is Log.d(TAG, msg, e) -> AppLog.d(TAG, msg, e)):
:46 "replacing invalidated auth-bound key before sealing"
:63 "auth-bound database key invalidated"
:67 "auth-bound key outside its auth window; not invalidated"
:72 "auth-bound key validity probe failed; treating as valid"
:184Log.d(TAG, "moved account tables into the account database: $present") -> AppLog.d(TAG, same). $present is a set of table names (e.g. [accounts, account_settings]),
not PII — safe to keep.
Behavior note (important)
These are Log.d, which the release ProGuard rule strips from Logcat. Via AppLog.d the
message still lands in the buffer in release builds (the buffer.record line is not an
argument to Log.d, so -assumenosideeffects doesn't remove it) — which is exactly the
desired outcome: key-invalidation / DB-conversion breadcrumbs now reach a debug report even in
release, while nothing extra is printed to Logcat.
New breadcrumbs (DB migrate / convert / key-invalidation)
DatabaseEncryption.migrate start: AppLog.i(TAG, "converting local cache database (targetEncrypted=${targetPassphrase.isNotEmpty()})"),
keeping the existing "local cache database converted" as the completion line.
The 4 DatabaseKeyCipher sites already sit at the key-invalidation decision points; keeping
them at AppLog.d(..., e) gives the auth-bound-key breadcrumbs the design calls for.
PII
None. Keystore exceptions, table-name sets, and boolean flags only. Never log the passphrase,
key material, or any account address/host.
Test expectation
DatabaseKeyCipher is DEVICE-ONLY (auth-bound Keystore keys can't run in JVM tests) — its
migration is behavior-preserving and compile-verified; the breadcrumb-reaches-buffer
guarantee is already unit-tested at the AppLog.d(throwable) level in the Seam ticket. Do not
fabricate a JVM test that only re-tests AppLog.
DatabaseEncryption / AccountDataMigrator open a real SQLCipher DB (native lib) so their
conversion path is exercised by the existing instrumented DB tests — extend one to install
a RingLogBuffer and assert the "converting…"/"converted"/"moved account tables" breadcrumb is
captured and contains no PII.
Per repo DoD the change ships with the instrumented assertion above (JVM where feasible) and
must run green in the E2E gate.
Parallelism: parallel with auth/lock, connectivity/send, sync-engine, stragglers — after Seam.
Part of #324 (strangler-migrate debug logging to AppLog).
**Sequencing: PARALLEL** with the other migration areas, **after the Seam ticket merges**
(needs `AppLog.d(tag, msg, throwable)`). Touches only `data/security` + `data/local`, so no
collision with sibling areas.
## Scope (files)
- `app/src/main/kotlin/org/libremail/data/security/DatabaseKeyCipher.kt` — 4 raw `Log.d(..., e)`.
- `app/src/main/kotlin/org/libremail/data/local/DatabaseEncryption.kt` — 1 raw `Log.d`.
- `app/src/main/kotlin/org/libremail/data/local/AccountDataMigrator.kt` — 1 raw `Log.d`.
## Migrate these call sites (all -> `AppLog`; drop `import android.util.Log`)
`DatabaseKeyCipher.kt` (each is `Log.d(TAG, msg, e)` -> `AppLog.d(TAG, msg, e)`):
- `:46` "replacing invalidated auth-bound key before sealing"
- `:63` "auth-bound database key invalidated"
- `:67` "auth-bound key outside its auth window; not invalidated"
- `:72` "auth-bound key validity probe failed; treating as valid"
`DatabaseEncryption.kt`:
- `:91` `Log.d(TAG, "local cache database converted")` -> `AppLog.d(TAG, same)`.
`AccountDataMigrator.kt`:
- `:184` `Log.d(TAG, "moved account tables into the account database: $present")` ->
`AppLog.d(TAG, same)`. `$present` is a **set of table names** (e.g. `[accounts, account_settings]`),
not PII — safe to keep.
## Behavior note (important)
These are `Log.d`, which the release ProGuard rule strips **from Logcat**. Via `AppLog.d` the
message still lands in the **buffer** in release builds (the `buffer.record` line is not an
argument to `Log.d`, so `-assumenosideeffects` doesn't remove it) — which is exactly the
desired outcome: key-invalidation / DB-conversion breadcrumbs now reach a debug report even in
release, while nothing extra is printed to Logcat.
## New breadcrumbs (DB migrate / convert / key-invalidation)
- `DatabaseEncryption.migrate` start: `AppLog.i(TAG, "converting local cache database (targetEncrypted=${targetPassphrase.isNotEmpty()})")`,
keeping the existing "local cache database converted" as the completion line.
- The 4 `DatabaseKeyCipher` sites already sit at the key-invalidation decision points; keeping
them at `AppLog.d(..., e)` gives the auth-bound-key breadcrumbs the design calls for.
## PII
None. Keystore exceptions, table-name sets, and boolean flags only. Never log the passphrase,
key material, or any account address/host.
## Test expectation
- `DatabaseKeyCipher` is **DEVICE-ONLY** (auth-bound Keystore keys can't run in JVM tests) — its
migration is behavior-preserving and compile-verified; the *breadcrumb-reaches-buffer*
guarantee is already unit-tested at the `AppLog.d(throwable)` level in the Seam ticket. Do not
fabricate a JVM test that only re-tests `AppLog`.
- `DatabaseEncryption` / `AccountDataMigrator` open a real SQLCipher DB (native lib) so their
conversion path is exercised by the existing **instrumented** DB tests — extend one to install
a `RingLogBuffer` and assert the "converting…"/"converted"/"moved account tables" breadcrumb is
captured and contains no PII.
- Per repo DoD the change ships with the instrumented assertion above (JVM where feasible) and
must run green in the E2E gate.
**Parallelism:** parallel with auth/lock, connectivity/send, sync-engine, stragglers — after Seam.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #324 (strangler-migrate debug logging to AppLog).
Sequencing: PARALLEL with the other migration areas, after the Seam ticket merges
(needs
AppLog.d(tag, msg, throwable)). Touches onlydata/security+data/local, so nocollision with sibling areas.
Scope (files)
app/src/main/kotlin/org/libremail/data/security/DatabaseKeyCipher.kt— 4 rawLog.d(..., e).app/src/main/kotlin/org/libremail/data/local/DatabaseEncryption.kt— 1 rawLog.d.app/src/main/kotlin/org/libremail/data/local/AccountDataMigrator.kt— 1 rawLog.d.Migrate these call sites (all ->
AppLog; dropimport android.util.Log)DatabaseKeyCipher.kt(each isLog.d(TAG, msg, e)->AppLog.d(TAG, msg, e))::46"replacing invalidated auth-bound key before sealing":63"auth-bound database key invalidated":67"auth-bound key outside its auth window; not invalidated":72"auth-bound key validity probe failed; treating as valid"DatabaseEncryption.kt::91Log.d(TAG, "local cache database converted")->AppLog.d(TAG, same).AccountDataMigrator.kt::184Log.d(TAG, "moved account tables into the account database: $present")->AppLog.d(TAG, same).$presentis a set of table names (e.g.[accounts, account_settings]),not PII — safe to keep.
Behavior note (important)
These are
Log.d, which the release ProGuard rule strips from Logcat. ViaAppLog.dthemessage still lands in the buffer in release builds (the
buffer.recordline is not anargument to
Log.d, so-assumenosideeffectsdoesn't remove it) — which is exactly thedesired outcome: key-invalidation / DB-conversion breadcrumbs now reach a debug report even in
release, while nothing extra is printed to Logcat.
New breadcrumbs (DB migrate / convert / key-invalidation)
DatabaseEncryption.migratestart:AppLog.i(TAG, "converting local cache database (targetEncrypted=${targetPassphrase.isNotEmpty()})"),keeping the existing "local cache database converted" as the completion line.
DatabaseKeyCiphersites already sit at the key-invalidation decision points; keepingthem at
AppLog.d(..., e)gives the auth-bound-key breadcrumbs the design calls for.PII
None. Keystore exceptions, table-name sets, and boolean flags only. Never log the passphrase,
key material, or any account address/host.
Test expectation
DatabaseKeyCipheris DEVICE-ONLY (auth-bound Keystore keys can't run in JVM tests) — itsmigration is behavior-preserving and compile-verified; the breadcrumb-reaches-buffer
guarantee is already unit-tested at the
AppLog.d(throwable)level in the Seam ticket. Do notfabricate a JVM test that only re-tests
AppLog.DatabaseEncryption/AccountDataMigratoropen a real SQLCipher DB (native lib) so theirconversion path is exercised by the existing instrumented DB tests — extend one to install
a
RingLogBufferand assert the "converting…"/"converted"/"moved account tables" breadcrumb iscaptured and contains no PII.
must run green in the E2E gate.
Parallelism: parallel with auth/lock, connectivity/send, sync-engine, stragglers — after Seam.