fix(rcs): Spatula header, Asterism consent fallback, and TS.43 identity

play-services-asterism/core/build.gradle

@@ -22,6 +22,7 @@ android {
 
     sourceSets {
         main.java.srcDirs += 'src/main/kotlin'
+        test.java.srcDirs += 'src/test/kotlin'
     }
 
     compileOptions {
@@ -32,6 +33,10 @@ android {
     kotlinOptions {
         jvmTarget = 1.8
     }
+
+    testOptions {
+        unitTests.returnDefaultValues = true
+    }
 }
 
 apply from: '../../gradle/publish-android.gradle'
@@ -43,4 +48,6 @@ dependencies {
 
     implementation project(':play-services-base-core')
     implementation project(':play-services-constellation-core')
+
+    testImplementation 'junit:junit:4.13.2'
 }

play-services-asterism/core/src/main/kotlin/org/microg/gms/asterism/core/AsterismApiService.kt

@@ -19,12 +19,18 @@ import kotlinx.coroutines.launch
 import org.microg.gms.BaseService
 import org.microg.gms.common.GmsService
 import org.microg.gms.common.PackageUtils
+import org.microg.gms.constellation.core.RpcClient
 
 private const val TAG = "AsterismApiService"
 
 class AsterismApiService : BaseService(TAG, GmsService.ASTERISM) {
     private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
+    override fun onCreate() {
+        super.onCreate()
+        RpcClient.initialize(this)
+    }
+
     override fun handleServiceRequest(
         callback: IGmsCallbacks?,
         request: GetServiceRequest?,

play-services-asterism/core/src/main/kotlin/org/microg/gms/asterism/core/GetAsterismConsentHandler.kt

@@ -16,10 +16,12 @@ import kotlinx.coroutines.withContext
 import org.microg.gms.constellation.core.ConstellationStateStore
 import org.microg.gms.constellation.core.RpcClient
 import org.microg.gms.constellation.core.authManager
+import org.microg.gms.constellation.core.proto.AsterismClient
 import org.microg.gms.constellation.core.proto.Consent
 import org.microg.gms.constellation.core.proto.ConsentVersion
 import org.microg.gms.constellation.core.proto.DeviceID
 import org.microg.gms.constellation.core.proto.GetConsentRequest
+import org.microg.gms.constellation.core.proto.GetConsentResponse
 import org.microg.gms.constellation.core.proto.RequestHeader
 import org.microg.gms.constellation.core.proto.RequestTrigger
 import org.microg.gms.constellation.core.proto.builder.buildRequestContext
@@ -51,14 +53,10 @@ suspend fun handleGetAsterismConsent(
             )
         )
 
-        val gaiaConsent = response.gaia_consents.find {
-            it.asterism_client == request.asterismClient
-        }
-        val (consentValue, consentVersion) = if (gaiaConsent != null) {
-            gaiaConsent.consent to gaiaConsent.consent_version
-        } else {
-            Consent.NO_CONSENT to ConsentVersion.CONSENT_VERSION_UNSPECIFIED
-        }
+        val (consentValue, consentVersion) = resolveAsterismConsent(
+            response,
+            request.asterismClient
+        )
 
         callbacks.onConsentFetched(
             Status.SUCCESS,
@@ -85,6 +83,25 @@ suspend fun handleGetAsterismConsent(
     }
 }
 
+internal fun resolveAsterismConsent(
+    response: GetConsentResponse,
+    asterismClient: AsterismClient
+): Pair<Consent, ConsentVersion> {
+    response.gaia_consents.firstOrNull {
+        it.asterism_client == asterismClient
+    }?.let {
+        return it.consent to it.consent_version
+    }
+
+    if (asterismClient == AsterismClient.RCS) {
+        response.rcs_consent?.takeIf { it.consent != Consent.CONSENT_UNKNOWN }?.let {
+            return it.consent to it.consent_version
+        }
+    }
+
+    return Consent.NO_CONSENT to ConsentVersion.CONSENT_VERSION_UNSPECIFIED
+}
+
 suspend fun handleGetIsPnvrConstellationDevice(
     context: Context,
     callbacks: IAsterismCallbacks

play-services-asterism/core/src/test/kotlin/org/microg/gms/asterism/core/AsterismConsentResolverTest.kt

@@ -0,0 +1,115 @@
+/*
+ * SPDX-FileCopyrightText: 2026 microG Project Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package org.microg.gms.asterism.core
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.microg.gms.constellation.core.proto.AsterismClient
+import org.microg.gms.constellation.core.proto.Consent
+import org.microg.gms.constellation.core.proto.ConsentVersion
+import org.microg.gms.constellation.core.proto.GaiaConsent
+import org.microg.gms.constellation.core.proto.GetConsentResponse
+import org.microg.gms.constellation.core.proto.RcsConsent
+
+class AsterismConsentResolverTest {
+
+    @Test
+    fun matchingGaiaConsentTakesPrecedence() {
+        val response = GetConsentResponse(
+            rcs_consent = RcsConsent(
+                consent = Consent.CONSENTED,
+                consent_version = ConsentVersion.RCS_DEFAULT_ON_OUT_OF_BOX
+            ),
+            gaia_consents = listOf(
+                GaiaConsent(
+                    asterism_client = AsterismClient.RCS,
+                    consent = Consent.NO_CONSENT,
+                    consent_version = ConsentVersion.RCS_CONSENT
+                )
+            )
+        )
+
+        assertEquals(
+            Consent.NO_CONSENT to ConsentVersion.RCS_CONSENT,
+            resolveAsterismConsent(response, AsterismClient.RCS)
+        )
+    }
+
+    @Test
+    fun rcsConsentIsUsedWhenMatchingGaiaConsentIsAbsent() {
+        val response = GetConsentResponse(
+            rcs_consent = RcsConsent(
+                consent = Consent.CONSENTED,
+                consent_version = ConsentVersion.RCS_DEFAULT_ON_OUT_OF_BOX
+            )
+        )
+
+        assertEquals(
+            Consent.CONSENTED to ConsentVersion.RCS_DEFAULT_ON_OUT_OF_BOX,
+            resolveAsterismConsent(response, AsterismClient.RCS)
+        )
+    }
+
+    @Test
+    fun unrelatedGaiaConsentDoesNotMaskRcsConsent() {
+        val response = GetConsentResponse(
+            rcs_consent = RcsConsent(
+                consent = Consent.CONSENTED,
+                consent_version = ConsentVersion.RCS_CONSENT
+            ),
+            gaia_consents = listOf(
+                GaiaConsent(
+                    asterism_client = AsterismClient.CONSTELLATION,
+                    consent = Consent.NO_CONSENT,
+                    consent_version = ConsentVersion.CONSENT_VERSION_UNSPECIFIED
+                )
+            )
+        )
+
+        assertEquals(
+            Consent.CONSENTED to ConsentVersion.RCS_CONSENT,
+            resolveAsterismConsent(response, AsterismClient.RCS)
+        )
+    }
+
+    @Test
+    fun rcsConsentIsNotAppliedToNonRcsClients() {
+        val response = GetConsentResponse(
+            rcs_consent = RcsConsent(
+                consent = Consent.CONSENTED,
+                consent_version = ConsentVersion.RCS_CONSENT
+            )
+        )
+
+        assertEquals(
+            Consent.NO_CONSENT to ConsentVersion.CONSENT_VERSION_UNSPECIFIED,
+            resolveAsterismConsent(response, AsterismClient.CONSTELLATION)
+        )
+    }
+
+    @Test
+    fun noConsentDataFallsBackToNoConsent() {
+        assertEquals(
+            Consent.NO_CONSENT to ConsentVersion.CONSENT_VERSION_UNSPECIFIED,
+            resolveAsterismConsent(GetConsentResponse(), AsterismClient.RCS)
+        )
+    }
+
+    @Test
+    fun unknownRcsConsentIsTreatedAsMissing() {
+        val response = GetConsentResponse(
+            rcs_consent = RcsConsent(
+                consent = Consent.CONSENT_UNKNOWN,
+                consent_version = ConsentVersion.CONSENT_VERSION_UNSPECIFIED
+            )
+        )
+
+        assertEquals(
+            Consent.NO_CONSENT to ConsentVersion.CONSENT_VERSION_UNSPECIFIED,
+            resolveAsterismConsent(response, AsterismClient.RCS)
+        )
+    }
+}

play-services-constellation/core/build.gradle

@@ -57,6 +57,7 @@ dependencies {
     api project(':play-services-constellation')
 
     implementation project(':play-services-base-core')
+    implementation project(':play-services-api')
     implementation project(':play-services-iid')
     implementation project(':play-services-auth-base')
 

play-services-constellation/core/src/main/kotlin/org/microg/gms/constellation/core/ConstellationApiService.kt

@@ -28,6 +28,11 @@ private const val TAG = "C11NApiService"
 class ConstellationApiService : BaseService(TAG, GmsService.CONSTELLATION) {
     private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
+    override fun onCreate() {
+        super.onCreate()
+        RpcClient.initialize(this)
+    }
+
     override fun handleServiceRequest(
         callback: IGmsCallbacks?,
         request: GetServiceRequest?,

play-services-constellation/core/src/main/kotlin/org/microg/gms/constellation/core/RpcClient.kt

@@ -1,13 +1,35 @@
 package org.microg.gms.constellation.core
 
+import android.content.Context
+import android.util.Log
 import com.squareup.wire.GrpcClient
 import okhttp3.OkHttpClient
+import okhttp3.Request
 import org.microg.gms.common.Constants
 import org.microg.gms.constellation.core.proto.PhoneDeviceVerificationClient
 import org.microg.gms.constellation.core.proto.PhoneNumberClient
 import java.util.concurrent.TimeUnit
 
+private const val TAG = "ConstellationRpcClient"
+
+internal fun addSpatulaHeader(request: Request, spatulaHeader: String?): Request {
+    if (spatulaHeader.isNullOrBlank()) return request
+    return request.newBuilder().header("X-Goog-Spatula", spatulaHeader).build()
+}
+
 object RpcClient {
+    @Volatile
+    private var spatulaHeaderProvider: SpatulaHeaderProvider? = null
+
+    fun initialize(context: Context) {
+        if (spatulaHeaderProvider != null) return
+        synchronized(this) {
+            if (spatulaHeaderProvider == null) {
+                spatulaHeaderProvider = AppCertSpatulaHeaderProvider(context.applicationContext)
+            }
+        }
+    }
+
     private val client: OkHttpClient = OkHttpClient.Builder()
         .readTimeout(60, TimeUnit.SECONDS)
         .addInterceptor { chain ->
@@ -16,7 +38,13 @@ object RpcClient {
                 .header("X-Goog-Api-Key", "AIzaSyAP-gfH3qvi6vgHZbSYwQ_XHqV_mXHhzIk")
                 .header("X-Android-Package", Constants.GMS_PACKAGE_NAME)
                 .header("X-Android-Cert", Constants.GMS_PACKAGE_SIGNATURE_SHA1.uppercase())
-            chain.proceed(builder.build())
+            val spatulaHeader = try {
+                spatulaHeaderProvider?.getSpatulaHeader(Constants.GMS_PACKAGE_NAME)
+            } catch (e: Exception) {
+                Log.w(TAG, "Unable to obtain X-Goog-Spatula", e)
+                null
+            }
+            chain.proceed(addSpatulaHeader(builder.build(), spatulaHeader))
         }
         .build()
 

play-services-constellation/core/src/main/kotlin/org/microg/gms/constellation/core/SpatulaHeaderProvider.kt

@@ -0,0 +1,91 @@
+/*
+ * SPDX-FileCopyrightText: 2026 microG Project Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package org.microg.gms.constellation.core
+
+import android.content.ComponentName
+import android.content.Context
+import android.content.Intent
+import android.content.ServiceConnection
+import android.os.IBinder
+import android.os.SystemClock
+import android.util.Log
+import com.google.android.gms.auth.appcert.IAppCertService
+import java.util.concurrent.LinkedBlockingQueue
+import java.util.concurrent.TimeUnit
+
+internal const val APP_CERT_SERVICE_ACTION = "com.google.android.gms.auth.be.appcert.AppCertService"
+private const val TAG = "SpatulaHeaderProvider"
+private const val BIND_TIMEOUT_SECONDS = 60L
+private const val CACHE_TTL_MS = 30L * 60L * 1000L
+
+internal interface SpatulaHeaderProvider {
+    fun getSpatulaHeader(packageName: String): String?
+}
+
+// Bind AppCertService instead of depending on play-services-core.
+internal class AppCertSpatulaHeaderProvider(
+    private val context: Context
+) : SpatulaHeaderProvider {
+    @Volatile
+    private var cachedHeader: String? = null
+
+    @Volatile
+    private var cachedAtElapsedMs: Long = 0L
+
+    private val lock = Any()
+
+    override fun getSpatulaHeader(packageName: String): String? {
+        val cached = cachedHeader
+        if (!cached.isNullOrBlank() && !isCacheExpired()) {
+            return cached
+        }
+        synchronized(lock) {
+            val lockedCache = cachedHeader
+            if (!lockedCache.isNullOrBlank() && !isCacheExpired()) {
+                return lockedCache
+            }
+            val header = fetchFromAppCertService(packageName)
+            if (!header.isNullOrBlank()) {
+                cachedHeader = header
+                cachedAtElapsedMs = SystemClock.elapsedRealtime()
+            }
+            return header
+        }
+    }
+
+    private fun isCacheExpired(): Boolean {
+        return SystemClock.elapsedRealtime() - cachedAtElapsedMs >= CACHE_TTL_MS
+    }
+
+    private fun fetchFromAppCertService(packageName: String): String? {
+        val serviceQueue = LinkedBlockingQueue<IAppCertService>(1)
+        val connection = object : ServiceConnection {
+            override fun onServiceConnected(name: ComponentName?, service: IBinder?) {
+                service?.let { serviceQueue.offer(IAppCertService.Stub.asInterface(it)) }
+            }
+
+            override fun onServiceDisconnected(name: ComponentName?) = Unit
+        }
+        val intent = Intent(APP_CERT_SERVICE_ACTION).setPackage(context.packageName)
+        val bound = try {
+            context.bindService(intent, connection, Context.BIND_AUTO_CREATE)
+        } catch (e: Exception) {
+            Log.w(TAG, "Unable to bind AppCertService", e)
+            false
+        }
+        if (!bound) return null
+
+        return try {
+            val service = serviceQueue.poll(BIND_TIMEOUT_SECONDS, TimeUnit.SECONDS) ?: return null
+            service.getSpatulaHeader(packageName)
+        } catch (e: Exception) {
+            Log.w(TAG, "AppCertService.getSpatulaHeader failed", e)
+            null
+        } finally {
+            runCatching { context.unbindService(connection) }
+        }
+    }
+}

play-services-constellation/core/src/main/kotlin/org/microg/gms/constellation/core/verification/Ts43Verifier.kt

@@ -298,7 +298,7 @@ private fun buildOdsaRequestPayload(
                 requestType = Ts43ChallengeResponseError.RequestType.TS43_REQUEST_TYPE_AUTH_API
             )
 
-        val akaResponse = eapAkaService.performSimAkaAuth(eapRelayPacket, imsi, mccMnc)
+        val akaResponse = eapAkaService.performSimAkaAuth(eapRelayPacket, eapId)
             ?: return null
 
         val postBody = JSONObject().put("eap-relay-packet", akaResponse).toString()