Fix security vulnerabilities and bugs

[chamika]

Addresses security findings and functional bugs found during a code scan. All 291 unit tests pass.

Security

• Access token leaked to logcat — the stream URL (logged in DashTuneMusicService) and album-art remote URLs (logged in AlbumArtContentProvider) embed the Jellyfin access token as an api_key query param. Release builds don't strip logs (isMinifyEnabled = false), so the token was recoverable via logcat. Now logs track ids / URL paths only.
• Exported media session granted privileged commands to any caller — onConnect unconditionally added LOGIN_COMMAND and SYNC_COMMAND to every controller. Since the service is exported="true", any installed app could trigger login/sync. These two commands are now restricted to our own package; repeat/shuffle stay available to all controllers (needed by system UI).
• Thread-unsafe ContentProvider state — AlbumArtContentProvider.uriMap was a plain map mutated from many binder/coroutine threads while clearCache iterated it (CME / lost entries). Switched to ConcurrentHashMap and added a canonical-path containment check as defense-in-depth against traversal.
• allowBackup disabled — prevents cached library metadata / SharedPreferences from being included in device/cloud backups.

Bugs

• QuickConnect code corrupted / could crash — the code was stored as an Int, which dropped leading zeros (user shown/typing the wrong code → auth fails) and could throw StringIndexOutOfBoundsException in formatting. Now carried as a String end-to-end with length-safe formatting.
• Uncaught QuickConnect failures — init/polling is now wrapped in try/catch and the auth response is null-safe, instead of !! crashing the coroutine on a transient error or missing field.
• Possible crash in onSetMediaItems — the non-audiobook single-item path could pass index -1 to MediaItemsWithStartPosition. Added coerceAtLeast(0) (matching the audiobook branch).
• Authenticator.getAuthToken returned the wrong token — it read the (intentionally empty) account password instead of the token. Now returns the real token via peekAuthToken(TOKEN_TYPE).
• ContentProvider latch waiters — threads waiting on an in-progress download now check file.exists() after the await instead of opening a possibly-missing file.

Notes

• Cleartext traffic (usesCleartextTraffic="true") was intentionally left enabled. Self-hosted Jellyfin servers are commonly reached over plain HTTP on a LAN; disabling cleartext would break that core use case. The risk (credentials/token interception on http:// servers) is a deliberate product tradeoff worth a follow-up (e.g. a network-security-config scoped to trusted hosts, or an HTTPS-preferred warning at sign-in).

Testing

• ./gradlew :automotive:testDebugUnitTest — 291 passed.
• AuthenticatorTest updated to the corrected token-retrieval behavior.

🤖 Generated with Claude Code

[chamika]

Closing as #30 addresses the same issues