Sdks 5075

[rodrigoareis]

JIRA Ticket

SDKS-5075 — OATH platform divergences between iOS and Android

Description

Aligns the Android OATH module (mfa/oath) with the iOS SDK for two confirmed platform divergences from the ticket.

Changes

1. Blank-secret validation on OathCredential (OathCredential.kt)

• Added require(secret.isNotBlank()) as the first check in the existing init validation block, alongside the digits/period/counter checks — matching iOS's OathCredential.validate() which rejects empty secrets.
• Previously Android allowed constructing a credential with an empty/whitespace secret (e.g. directly, or from a URI with secret=), producing a credential that could never generate codes.
• Message contains no secret value (privacy). All construction paths are covered: direct constructor, fromUri() (propagates as IllegalArgumentException through OathUriParser, distinct from InvalidUriException), fromJson(), and legacy migration (per-mechanism try/catch in auth-migration logs and skips, rather than failing the whole migration).

2. OathType serialized as lowercase (OathTypeSerializer in OathCredential.kt)

• serialize now emits "totp"/"hotp" (lowercase) instead of "TOTP"/"HOTP", matching iOS's OathType raw values (case totp = "totp").
• Backward compatible on read: deserialize is unchanged — OathType.fromString() lowercases input before matching, so JSON persisted by earlier SDK versions with uppercase values still deserializes correctly. A dedicated backward-compat test locks this in.

Testing

• New tests: blank/whitespace secret rejection (constructor), blank-secret-via-URI (IllegalArgumentException), legacy-uppercase JSON backward compat, new lowercase wire format round-trip.
• :mfa:oath unit tests: 73 tests, 0 failures (OathCredentialTest now 21, OathUriParserTest now 22).
• :mfa:auth-migration unit tests: 47 tests, 0 failures (downstream due diligence for the constructor change).
• :mfa:oath:assembleDebug + assembleRelease: pass (full AAR packaging).

Review notes

• Both changes are wire-format-adjacent but read-compatible: old persisted data keeps working; only the written format changes going forward.
• Follow-up (separate ticket, iOS repo): iOS's OathConfiguration.encryptionEnabled flag is unused by its own storage layer and could be deprecated.

Note

It does not include CHANGELOG entry to avoid merge conflict for the upcoming release. It will be added later after a rebase.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6f3979ac-d119-4500-899b-75f5ed5ebb57

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[spetrov]

Please, update CHANGELOG.md.
Other than that changes look good to me! 👍🏻