K2GO-395 feat(networkpolicy): metered-data cost-consent gate + proactive alert - #558
Draft
luisguzman-adfa wants to merge 4 commits into
Draft
K2GO-395 feat(networkpolicy): metered-data cost-consent gate + proactive alert#558luisguzman-adfa wants to merge 4 commits into
luisguzman-adfa wants to merge 4 commits into
Conversation
…ive alert Add a defensive gate that asks for consent before starting a heavy download on a metered network, plus a process-wide observer that warns on switching to metered data and clears the session consent on leaving metered. The rule keys on the active default network NET_CAPABILITY_NOT_METERED, not on transport -- grounded in device evidence (ADR-395): a cellular IMS PDN reports NOT_METERED while the internet APN does not, and a phone hotspot can arrive metered on the client. Pure-JVM domain with unit tests; data reads the one ConnectivityManager source; presentation is a stateless gate (BrandDialog) plus the observer started from IIABApplication. Reference wiring: the ZIM confirm commit point (ZimConfirmFragment), not the ~2s provisioner drain. Other seams (Books, Kolibri, rootfs install, DownloadManager) and the l10n migration are follow-ups per ADR-395. Strings parked in strings_untranslated.xml pending 33-locale translation.
…DR-395 Add exact file:line commit points for the Books/Kolibri/Maps/install/DownloadManager seams, a one-line wrap recipe per seam, and the POST_NOTIFICATIONS deployment note, so the remaining wiring is copy-paste for the next implementer.
Move the 8 network-cost consent strings out of strings_untranslated.xml into values*/strings_networkpolicy.xml with all 33 locale values (machine-generated, pending human review), per the l10n policy. strings_untranslated.xml is clear again. ADR-395 updated: l10n done pending review.
…uestions The two-pass review found that gating only the UI commit point is not fully defensive: the wishlist is a durable queue drained by an ungated background pass, so banked items (incl. the wizard-bank path) download on any network without consent, and wrapping startZimDownload() also discards the cart when offline. ADR sec.10 records these open design questions to resolve before wiring the rest.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not merge — reference branch. Open design decision in ADR-395 sec.10
(banked items drain ungated on metered). Handed off for pickup, not for merge.
What
Adds a defensive network cost-consent mechanism: a gate that asks before starting
a heavy download on a metered network, and a process-wide observer that warns when
the device switches to metered data. Keys on the active default network's
NET_CAPABILITY_NOT_METERED (not transport).
New feature package
networkpolicy(domain/data/presentation): pure-JVM domainwith unit tests, an Android classifier (the single ConnectivityManager reader), a
stateless gate (BrandDialog consent), and an observer started from IIABApplication.
Wired at the ZIM confirm seam. Strings translated to all 33 locales
(machine-generated, pending human review). Design + device evidence: ADR-395.
Why
Data is a real cost for target users; the app must not silently spend a metered
plan. Distinct from K2GO-4 (download resilience) -- this is cost consent.
Verification
as metered, Wi-Fi as unmetered, a phone hotspot as metered; the proactive alert
fires on switching to data.
Follow-ups (per ADR-395)
pinpointed with file:line in ADR sec.4.