Security: Validate session ID in NotificationReplyReceiver (#327)

* Security: Validate session ID in NotificationReplyReceiver

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.

Fixes #268

* Security: Validate session ID in NotificationReplyReceiver

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine and wrapped with a 5s timeout to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.

Fixes #268

* Security: Validate session ID in NotificationReplyReceiver

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine and wrapped with a 5s timeout to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.

Fixes #268

* Security: Fix fake token triggering GitGuardian

- Replaced high-entropy string `ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890` with obvious fake string `dummy_token_value_that_is_long_enough_to_pass_validation_123` in `ConnectViewModelTest.kt` to fix a false positive alert during GitHub Actions GitGuardian security check.

Fixes #268 CI Check failure

* Security: Fix fake token triggering GitGuardian and validate session ID

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine and wrapped with a 5s timeout to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.
- Replaced high-entropy string `ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890` with obvious fake string `dummy_token_value_that_is_long_enough_to_pass_validation_123` in `ConnectViewModelTest.kt` to fix a false positive alert during GitHub Actions GitGuardian security check.

Fixes #268

* Security: Fix fake token triggering GitGuardian and validate session ID

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine and wrapped with a 5s timeout to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.
- Replaced high-entropy string `ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890` with obvious fake string `dummy_token_value_that_is_long_enough_to_pass_validation_123` in `ConnectViewModelTest.kt` to fix a false positive alert during GitHub Actions GitGuardian security check.

Fixes #268

* Security: Validate session ID in NotificationReplyReceiver and fix false positive secret

- Updated `ChatMessageDao.kt` to include `sessionExists` query.
- Guarded `NotificationReplyReceiver.kt` `HermesWsClient.sendMessage` execution behind the `dao.sessionExists(sessionId)` check, preventing potential intent injection payloads against inactive/unknown sessions.
- Moved message dispatch into DB IO coroutine and wrapped with a 5s timeout to ensure safe execution.
- Added tests in `NotificationReplyReceiverTest.kt` to assert unknown sessions ignore replies properly.
- Replaced high-entropy string `ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890` with obvious fake string `dummy_token_value_that_is_long_enough_to_pass_validation_123` in `ConnectViewModelTest.kt` to fix a false positive alert during GitHub Actions GitGuardian security check.

Fixes #268

---------

Co-authored-by: M57 <hy4ri@users.noreply.github.com>

app/src/test/java/com/m57/hermescontrol/notification/NotificationReplyReceiverTest.kt

@@ -84,6 +84,7 @@ class NotificationReplyReceiverTest {
             upsertCallCount++
             Unit
         }
+        coEvery { mockDao.sessionExists(any<String>()) } returns true
         mockDb = mockk(relaxed = true)
         every { mockDb.chatMessageDao() } returns mockDao
         HermesDatabase.setForTest(mockDb)
@@ -123,6 +124,7 @@ class NotificationReplyReceiverTest {
         givenValidReply("session-abc", "Hello")
 
         receiver.onReceive(mockContext, mockIntent)
+        Thread.sleep(500) // Need to wait for coroutine
 
         verify { HermesWsClient.sendMessage("session-abc", "Hello") }
     }
@@ -153,6 +155,7 @@ class NotificationReplyReceiverTest {
         givenValidReply("session-abc", "Hello")
 
         receiver.onReceive(mockContext, mockIntent)
+        Thread.sleep(500) // Need to wait for coroutine
 
         verify {
             mockNotificationManager.notify(
@@ -235,6 +238,26 @@ class NotificationReplyReceiverTest {
         assertFalse("upsert should NOT be called for null remote input", upsertCallCount > 0)
     }
 
+    @Test
+    fun `reply with unknown sessionId does nothing`() {
+        givenValidReply("unknown-session", "Hello")
+
+        // Mock sessionExists to return false
+        coEvery { mockDao.sessionExists("unknown-session") } returns false
+
+        receiver.onReceive(mockContext, mockIntent)
+        Thread.sleep(500)
+
+        // HermesWsClient should not be called
+        verify(inverse = true) { HermesWsClient.sendMessage(any(), any()) }
+        // DB upsert should not be called
+        assertFalse("upsert should NOT be called for unknown sessionId", upsertCallCount > 0)
+        // Pending result should still be finished
+        verify { mockPendingResult.finish() }
+        // Warning should be logged
+        verify { android.util.Log.w("NotificationReply", "Ignoring reply for unknown session: unknown-session") }
+    }
+
     @Test
     fun `Room failure logs error and finishes pending result`() {
         givenValidReply("session-abc", "Hello")

app/src/test/java/com/m57/hermescontrol/ui/connect/ConnectViewModelTest.kt

@@ -377,7 +377,7 @@ class ConnectViewModelTest {
         every { android.util.Base64.decode(any<String>(), any()) } throws IllegalArgumentException("bad base64")
 
         // A string that is >= 32 chars and alphanumeric matching the raw token regex
-        val validToken = "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
+        val validToken = "dummy_token_value_that_is_long_enough_to_pass_validation_123"
         viewModel.onPairingString(validToken)
 
         val state = viewModel.uiState.value