From f1c5c2816c5076d92468b7fd14d00e0049080c97 Mon Sep 17 00:00:00 2001
From: M57 <41645758+Hy4ri@users.noreply.github.com>
Date: Thu, 13 Aug 2026 17:33:55 +0300
Subject: [PATCH] =?UTF-8?q?fix(release):=20keep=20security-crypto/Tink=20c?=
 =?UTF-8?q?lasses=20=E2=80=94=20release=20APK=20could=20not=20read=20store?=
 =?UTF-8?q?d=20auth=20token=20(#899)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

R8 obfuscates androidx.security.crypto + com.google.crypto.tink, which
resolve primitives via reflection. Only -dontwarn existed, so release
builds silently read an empty token: every API call 401'd and the app
showed 'Session expired' (debug builds were unaffected — no minification).

Verified on device: release APK before → 401 on WS ticket mint; after →
existing token read and session connects with no re-login.

Co-authored-by: M57 <hy4ri@users.noreply.github.com>
---
 app/proguard-rules.pro | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
index ef7b9226..10d382b8 100644
--- a/app/proguard-rules.pro
+++ b/app/proguard-rules.pro
@@ -35,6 +35,11 @@
 }
 
 # ── AndroidX Security Crypto ─────────────────────────────────────────────
+# EncryptedSharedPreferences / MasterKey resolve primitives via Tink's
+# reflection-based Registry. Without -keep, R8 obfuscates those classes and
+# token reads silently fail (401 on every API call, "Session expired").
+-keep class androidx.security.crypto.** { *; }
+-keep class com.google.crypto.tink.** { *; }
 -dontwarn androidx.security.crypto.**
 
 # ── Tink / Error Prone ───────────────────────────────────────────────────