android: notify users before device key expiry

android/src/main/java/com/tailscale/ipn/App.kt

@@ -63,6 +63,8 @@ class App : UninitializedApp(), libtailscale.AppContext, ViewModelStoreOwner {
 
   companion object {
     const val FILE_CHANNEL_ID = "tailscale-files"
+    const val KEY_EXPIRY_CHANNEL_ID = "tailscale-key-expiry"
+    const val KEY_EXPIRY_NOTIFICATION_ID = 3
     // Key to store the SAF URI in EncryptedSharedPreferences.
     private val PREF_KEY_SAF_URI = "saf_directory_uri"
     private const val TAG = "App"
@@ -132,6 +134,12 @@ class App : UninitializedApp(), libtailscale.AppContext, ViewModelStoreOwner {
         getString(R.string.health_channel_description),
         NotificationManagerCompat.IMPORTANCE_HIGH,
     )
+    createNotificationChannel(
+        KEY_EXPIRY_CHANNEL_ID,
+        getString(R.string.key_expiry_channel_name),
+        getString(R.string.key_expiry_channel_description),
+        NotificationManagerCompat.IMPORTANCE_DEFAULT,
+    )
   }
 
   override fun onTerminate() {
@@ -214,6 +222,25 @@ class App : UninitializedApp(), libtailscale.AppContext, ViewModelStoreOwner {
             }
       }
     }
+    applicationScope.launch {
+      combine(Notifier.netmap, MDMSettings.keyExpirationNotice.flow) { netmap, keyExpirationNotice
+            ->
+            Triple(
+                netmap?.SelfNode?.KeyExpiry,
+                netmap?.SelfNode?.keyDoesNotExpire,
+                keyExpirationNotice.value,
+            )
+          }
+          .distinctUntilChanged()
+          .collect {
+            val self = Notifier.netmap.value?.SelfNode
+            if (self == null) {
+              KeyExpiryNotificationScheduler.cancel(this@App)
+            } else {
+              KeyExpiryNotificationScheduler.schedule(this@App, self)
+            }
+          }
+    }
     TSLog.init(this)
     FeatureFlags.initialize(mapOf("enable_new_search" to true))
   }

android/src/main/java/com/tailscale/ipn/KeyExpiryNotificationScheduler.kt

@@ -0,0 +1,90 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+package com.tailscale.ipn
+
+import android.content.Context
+import androidx.core.app.NotificationManagerCompat
+import androidx.work.Data
+import androidx.work.ExistingWorkPolicy
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.WorkManager
+import com.tailscale.ipn.mdm.MDMSettings
+import com.tailscale.ipn.ui.model.Tailcfg
+import com.tailscale.ipn.ui.util.TimeUtil
+import java.time.Duration
+import java.time.Instant
+import java.util.concurrent.TimeUnit
+
+object KeyExpiryNotificationScheduler {
+  private const val WORK_NAME = "key-expiry-notification"
+
+  private const val PREFS_NAME = "key-expiry-notification"
+  private const val PREF_CURRENT_EXPIRY = "current-expiry"
+
+  const val INPUT_EXPECTED_EXPIRY = "expected-expiry"
+
+  fun schedule(context: Context, node: Tailcfg.Node) {
+    if (node.keyDoesNotExpire) {
+      cancel(context)
+      return
+    }
+
+    val expiryString = node.KeyExpiry ?: ""
+    val expiry = runCatching { Instant.parse(expiryString) }.getOrNull()
+
+    if (expiry == null) {
+      cancel(context)
+      return
+    }
+
+    NotificationManagerCompat.from(context).cancel(App.KEY_EXPIRY_NOTIFICATION_ID)
+
+    val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+    prefs.edit().putString(PREF_CURRENT_EXPIRY, expiryString).apply()
+
+    val workManager = WorkManager.getInstance(context)
+
+    if (!Instant.now().isBefore(expiry)) {
+      workManager.cancelUniqueWork(WORK_NAME)
+      return
+    }
+
+    val expiryNotificationWindowMDM = MDMSettings.keyExpirationNotice.flow.value.value
+    val window = expiryNotificationWindowMDM?.let { TimeUtil.duration(it) } ?: Duration.ofHours(24)
+
+    val warningAt = expiry.minus(window)
+    val delayMillis = Duration.between(Instant.now(), warningAt).toMillis().coerceAtLeast(0)
+
+    val input = Data.Builder().putString(INPUT_EXPECTED_EXPIRY, expiryString).build()
+
+    val request =
+        OneTimeWorkRequestBuilder<KeyExpiryNotificationWorker>()
+            .setInputData(input)
+            .setInitialDelay(delayMillis, TimeUnit.MILLISECONDS)
+            .build()
+
+    workManager.enqueueUniqueWork(
+        WORK_NAME,
+        ExistingWorkPolicy.REPLACE,
+        request,
+    )
+  }
+
+  fun cancel(context: Context) {
+    context
+        .getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+        .edit()
+        .remove(PREF_CURRENT_EXPIRY)
+        .apply()
+
+    WorkManager.getInstance(context).cancelUniqueWork(WORK_NAME)
+
+    NotificationManagerCompat.from(context).cancel(App.KEY_EXPIRY_NOTIFICATION_ID)
+  }
+
+  fun isCurrentExpiry(context: Context, expiry: String): Boolean {
+    return context
+        .getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+        .getString(PREF_CURRENT_EXPIRY, null) == expiry
+  }
+}

android/src/main/java/com/tailscale/ipn/KeyExpiryNotificationWorker.kt

@@ -0,0 +1,74 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+package com.tailscale.ipn
+
+import android.Manifest
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import androidx.core.app.ActivityCompat
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.work.CoroutineWorker
+import androidx.work.WorkerParameters
+import java.time.Instant
+
+class KeyExpiryNotificationWorker(
+    appContext: Context,
+    workerParams: WorkerParameters,
+) : CoroutineWorker(appContext, workerParams) {
+  override suspend fun doWork(): Result {
+    val expectedExpiry =
+        inputData.getString(KeyExpiryNotificationScheduler.INPUT_EXPECTED_EXPIRY)
+            ?: return Result.success()
+
+    if (!KeyExpiryNotificationScheduler.isCurrentExpiry(applicationContext, expectedExpiry)) {
+      return Result.success()
+    }
+
+    val expiry =
+        runCatching { Instant.parse(expectedExpiry) }.getOrNull() ?: return Result.success()
+
+    if (!Instant.now().isBefore(expiry)) {
+      return Result.success()
+    }
+
+    if (
+        ActivityCompat.checkSelfPermission(
+            applicationContext,
+            Manifest.permission.POST_NOTIFICATIONS,
+        ) != PackageManager.PERMISSION_GRANTED
+    ) {
+      return Result.success()
+    }
+
+    val intent =
+        Intent(applicationContext, MainActivity::class.java).apply {
+          flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK
+        }
+
+    val pendingIntent =
+        PendingIntent.getActivity(
+            applicationContext,
+            0,
+            intent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+
+    val notification =
+        NotificationCompat.Builder(applicationContext, App.KEY_EXPIRY_CHANNEL_ID)
+            .setSmallIcon(R.drawable.ic_notification)
+            .setContentTitle(applicationContext.getString(R.string.key_expiry_notification_title))
+            .setContentText(applicationContext.getString(R.string.key_expiry_notification_body))
+            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+            .setAutoCancel(true)
+            .setContentIntent(pendingIntent)
+            .build()
+
+    NotificationManagerCompat.from(applicationContext)
+        .notify(App.KEY_EXPIRY_NOTIFICATION_ID, notification)
+
+    return Result.success()
+  }
+}

android/src/main/res/values/strings.xml

@@ -73,6 +73,8 @@
     <string name="deviceKeyNeverExpires">Device key does not expire</string>
     <string name="deviceKeyExpires">Device key expires %s</string>
     <string name="deviceKeyExpired">Device key expired %s</string>
+    <string name="key_expiry_notification_title">Tailscale sign-in expires soon</string>
+    <string name="key_expiry_notification_body">Reauthenticate to keep this device connected to your tailnet.</string>
     <string name="machine_auth_required">Admin approval required</string>
     <string name="machine_auth_explainer">This device must be approved by an administrator before it can connect to the tailnet.</string>
     <string name="open_admin_console">Open admin console</string>
@@ -303,6 +305,8 @@
     <string name="notifications_delivered_when_a_file_is_received_using_taildrop">Notifications delivered when a file is received using Taildrop.</string>
     <string name="health_channel_name">Errors and warnings</string>
     <string name="health_channel_description">This notification category is used to deliver important status notifications and should be left enabled. For instance, it is used to notify you about errors or warnings that affect Internet connectivity.</string>
+    <string name="key_expiry_channel_name">Key expiry</string>
+    <string name="key_expiry_channel_description">Notifications when your Tailscale device key is about to expire.</string>
     <string name="copy_ip_address">Copy IP Address</string>
     <string name="ping">Ping</string>
     <string name="relayed_connection">Relayed connection (%1$s)</string>