Implement SECV video encryption

Author: Wavesonics

app/src/main/kotlin/com/darkrockstudios/app/securecamera/camera/CameraState.kt

@@ -14,7 +14,11 @@ import androidx.lifecycle.LifecycleOwner
 import androidx.lifecycle.coroutineScope
 import com.darkrockstudios.app.securecamera.obfuscation.FacialDetection
 import com.darkrockstudios.app.securecamera.preferences.AppSettingsDataSource
+import com.darkrockstudios.app.securecamera.security.schemes.EncryptionScheme
+import com.darkrockstudios.app.securecamera.security.streaming.SecvFileFormat
+import com.darkrockstudios.app.securecamera.security.streaming.VideoEncryptionHelper
 import kotlinx.coroutines.*
+import kotlinx.coroutines.flow.collectLatest
 import org.koin.core.component.KoinComponent
 import org.koin.core.component.inject
 import timber.log.Timber
@@ -43,8 +47,10 @@ class CameraState internal constructor(
 	private val clock: Clock by inject()
 	private val facialDetection: FacialDetection by inject()
 	private val preferences: AppSettingsDataSource by inject()
+	private val encryptionScheme: EncryptionScheme by inject()
 
 	private var faceAnalyzer: FacialDetectionAnalyzer? = null
+	private var videoEncryptionHelper: VideoEncryptionHelper? = null
 	private val cameraExecutor: ExecutorService = Executors.newSingleThreadExecutor()
 	private val analysisExecutor: ExecutorService = Executors.newSingleThreadExecutor()
 	private val analysisScope: CoroutineScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
@@ -92,11 +98,66 @@ class CameraState internal constructor(
 	var recordingDurationMs by mutableLongStateOf(0L)
 		private set
 
+	var isEncryptingVideo by mutableStateOf(false)
+		private set
+
+	var encryptionProgress by mutableFloatStateOf(0f)
+		private set
+
 	private var activeRecording: Recording? = null
 	private var videoCapture: VideoCapture<Recorder>? = null
+	private var pendingTempFile: File? = null
+	private var pendingOutputFile: File? = null
 
 	init {
 		observePreferences()
+		initializeEncryptionHelper()
+	}
+
+	private fun initializeEncryptionHelper() {
+		val streamingScheme = encryptionScheme.getStreamingCapability()
+		if (streamingScheme != null) {
+			videoEncryptionHelper = VideoEncryptionHelper(streamingScheme)
+			observeEncryptionProgress()
+		} else {
+			Timber.w("Streaming encryption not available")
+		}
+	}
+
+	private fun observeEncryptionProgress() {
+		lifecycleOwner.lifecycle.coroutineScope.launch {
+			videoEncryptionHelper?.encryptionProgress?.collectLatest { progress ->
+				when (progress) {
+					is VideoEncryptionHelper.EncryptionProgress.Idle -> {
+						isEncryptingVideo = false
+						encryptionProgress = 0f
+					}
+
+					is VideoEncryptionHelper.EncryptionProgress.Starting -> {
+						isEncryptingVideo = true
+						encryptionProgress = 0f
+					}
+
+					is VideoEncryptionHelper.EncryptionProgress.InProgress -> {
+						isEncryptingVideo = true
+						encryptionProgress = progress.progress
+					}
+
+					is VideoEncryptionHelper.EncryptionProgress.Completed -> {
+						isEncryptingVideo = false
+						encryptionProgress = 0f
+						videoEncryptionHelper?.resetProgress()
+					}
+
+					is VideoEncryptionHelper.EncryptionProgress.Error -> {
+						isEncryptingVideo = false
+						encryptionProgress = 0f
+						Timber.e("Encryption error: ${progress.message}")
+						videoEncryptionHelper?.resetProgress()
+					}
+				}
+			}
+		}
 	}
 
 	private fun observePreferences() {
@@ -247,8 +308,13 @@ class CameraState internal constructor(
 	}
 
 	/**
-	 * Start video recording. Returns the output file path.
-	 * The video will be saved to the app's internal files directory.
+	 * Start video recording. Returns the final encrypted output file path (.secv).
+	 * The video will be saved to the app's internal files directory after encryption.
+	 *
+	 * Recording flow:
+	 * 1. CameraX writes to a temporary .mp4 file
+	 * 2. On recording complete, the temp file is encrypted to .secv format
+	 * 3. The temp file is securely deleted after encryption
 	 */
 	@SuppressLint("MissingPermission")
 	fun startRecording(context: Context): File? {
@@ -257,12 +323,12 @@ class CameraState internal constructor(
 			return null
 		}
 
-		if (isRecording) {
-			Timber.w("Recording already in progress")
+		if (isRecording || isEncryptingVideo) {
+			Timber.w("Recording or encryption already in progress")
 			return null
 		}
 
-		// Create output file in app's internal storage
+		// Create output directories
 		val videosDir = File(context.filesDir, "videos")
 		if (!videosDir.exists()) {
 			videosDir.mkdirs()
@@ -272,9 +338,16 @@ class CameraState internal constructor(
 			"yyyyMMdd_HHmmss",
 			java.util.Locale.US
 		).format(System.currentTimeMillis())
-		val outputFile = File(videosDir, "video_$timestamp.mp4")
 
-		val fileOutputOptions = FileOutputOptions.Builder(outputFile).build()
+		// Temp file for CameraX recording (unencrypted)
+		val tempFile = File(videosDir, "temp_$timestamp.mp4")
+		// Final encrypted output file
+		val outputFile = File(videosDir, "video_$timestamp.${SecvFileFormat.FILE_EXTENSION}")
+
+		pendingTempFile = tempFile
+		pendingOutputFile = outputFile
+
+		val fileOutputOptions = FileOutputOptions.Builder(tempFile).build()
 
 		activeRecording = videoCapture.output
 			.prepareRecording(context, fileOutputOptions)
@@ -293,21 +366,55 @@ class CameraState internal constructor(
 
 					is VideoRecordEvent.Finalize -> {
 						isRecording = false
+						activeRecording = null
+
 						if (event.hasError()) {
 							Timber.e("Recording error: ${event.error}, cause: ${event.cause?.message}")
-							// Delete the failed file
-							outputFile.delete()
+							// Delete the failed temp file
+							tempFile.delete()
+							pendingTempFile = null
+							pendingOutputFile = null
 						} else {
-							Timber.i("Video saved to: ${event.outputResults.outputUri}")
+							Timber.i("Recording complete, starting encryption...")
+							// Start encryption in background
+							lifecycleOwner.lifecycle.coroutineScope.launch {
+								encryptRecordedVideo(tempFile, outputFile)
+							}
 						}
-						activeRecording = null
 					}
 				}
 			}
 
 		return outputFile
 	}
 
+	/**
+	 * Encrypts the recorded video from temp file to final encrypted file.
+	 */
+	private suspend fun encryptRecordedVideo(tempFile: File, outputFile: File) {
+		val helper = videoEncryptionHelper
+		if (helper == null) {
+			Timber.e("Video encryption helper not available")
+			// Fall back to keeping the unencrypted file (rename to .mp4)
+			val fallbackFile = File(outputFile.parent, outputFile.nameWithoutExtension + ".mp4")
+			tempFile.renameTo(fallbackFile)
+			return
+		}
+
+		val success = helper.encryptVideoFile(tempFile, outputFile)
+		if (success) {
+			Timber.i("Video encrypted successfully: ${outputFile.absolutePath}")
+		} else {
+			Timber.e("Video encryption failed")
+			// Keep the temp file as fallback (rename to .mp4)
+			val fallbackFile = File(outputFile.parent, outputFile.nameWithoutExtension + ".mp4")
+			tempFile.renameTo(fallbackFile)
+		}
+
+		pendingTempFile = null
+		pendingOutputFile = null
+	}
+
 	/**
 	 * Stop the current video recording.
 	 */
@@ -437,6 +544,16 @@ class CameraState internal constructor(
 		if (isRecording) {
 			stopRecording()
 		}
+
+		// Clean up any pending temp files
+		pendingTempFile?.let { file ->
+			if (file.exists()) {
+				file.delete()
+			}
+		}
+		pendingTempFile = null
+		pendingOutputFile = null
+
 		faceAnalyzer = null
 		imageAnalysis?.clearAnalyzer()
 		analysisScope.cancel()

app/src/main/kotlin/com/darkrockstudios/app/securecamera/camera/SecureImageRepository.kt

@@ -6,15 +6,22 @@ import android.graphics.Bitmap.CompressFormat
 import android.graphics.BitmapFactory
 import android.media.MediaMetadataRetriever
 import android.util.Size
+import androidx.core.graphics.scale
 import com.ashampoo.kim.Kim
 import com.ashampoo.kim.common.convertToPhotoMetadata
 import com.ashampoo.kim.model.GpsCoordinates
 import com.ashampoo.kim.model.MetadataUpdate
 import com.ashampoo.kim.model.TiffOrientation
 import com.darkrockstudios.app.securecamera.security.schemes.EncryptionScheme
+import com.darkrockstudios.app.securecamera.security.streaming.SecvFileFormat
+import com.darkrockstudios.app.securecamera.security.streaming.StreamingDecryptor
+import com.darkrockstudios.app.securecamera.security.streaming.StreamingEncryptionScheme
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
 import timber.log.Timber
 import java.io.ByteArrayOutputStream
 import java.io.File
+import java.io.FileOutputStream
 import java.text.SimpleDateFormat
 import java.util.*
 import kotlin.time.toJavaInstant
@@ -334,14 +341,27 @@ class SecureImageRepository(
 
 	fun getVideosDirectory(): File = File(appContext.filesDir, VIDEOS_DIR)
 
+	/**
+	 * Returns the streaming encryption scheme for video decryption.
+	 */
+	fun getStreamingEncryptionScheme(): StreamingEncryptionScheme? {
+		return encryptionScheme.getStreamingCapability()
+	}
+
 	fun getVideos(): List<VideoDef> {
 		val dir = getVideosDirectory()
 		if (!dir.exists()) {
 			return emptyList()
 		}
 
+		// Include both encrypted (.secv) and legacy unencrypted (.mp4) videos
 		return dir.listFiles()
-			?.filter { it.isFile && it.name.endsWith(".mp4") }
+			?.filter { file ->
+				file.isFile && (
+						file.name.endsWith(".${SecvFileFormat.FILE_EXTENSION}") ||
+								file.name.endsWith(".mp4")
+						) && !file.name.startsWith("temp_") // Exclude temp files
+			}
 			?.map { file ->
 				val name = file.name
 				val format = name.substringAfterLast('.', "mp4")
@@ -373,7 +393,7 @@ class SecureImageRepository(
 			return null
 		}
 
-		val format = videoName.substringAfterLast('.', "mp4")
+		val format = videoName.substringAfterLast('.', SecvFileFormat.FILE_EXTENSION)
 		return VideoDef(
 			videoName = videoName,
 			videoFormat = format,
@@ -383,7 +403,7 @@ class SecureImageRepository(
 
 	/**
 	 * Reads a thumbnail for a video by extracting a frame.
-	 * For now, videos are not encrypted, so we read directly from the file.
+	 * For encrypted videos, temporarily decrypts enough data to extract a frame.
 	 */
 	suspend fun readVideoThumbnail(video: VideoDef): Bitmap? {
 		thumbnailCache.getThumbnail(video)?.let { return it }
@@ -399,16 +419,17 @@ class SecureImageRepository(
 			null
 		} else {
 			// Extract a frame from the video
-			extractVideoFrame(video.videoFile)?.let { frameBitmap ->
+			val frameBitmap = if (video.isEncrypted) {
+				extractEncryptedVideoFrame(video)
+			} else {
+				extractVideoFrame(video.videoFile)
+			}
+
+			frameBitmap?.let { bitmap ->
 				// Scale down for thumbnail
-				val scaledBitmap = Bitmap.createScaledBitmap(
-					frameBitmap,
-					frameBitmap.width / 4,
-					frameBitmap.height / 4,
-					true
-				)
-				if (scaledBitmap != frameBitmap) {
-					frameBitmap.recycle()
+				val scaledBitmap = bitmap.scale(bitmap.width / 4, bitmap.height / 4)
+				if (scaledBitmap != bitmap) {
+					bitmap.recycle()
 				}
 
 				// Compress and encrypt the thumbnail
@@ -432,6 +453,53 @@ class SecureImageRepository(
 		return thumbnailBitmap
 	}
 
+	/**
+	 * Extracts a video frame from an encrypted video file.
+	 * Temporarily decrypts the video content to extract a frame.
+	 */
+	private suspend fun extractEncryptedVideoFrame(video: VideoDef): Bitmap? {
+		val streamingScheme = encryptionScheme.getStreamingCapability() ?: run {
+			Timber.e("Streaming encryption not available for thumbnail extraction")
+			return null
+		}
+
+		var decryptor: StreamingDecryptor? = null
+		var tempFile: File? = null
+
+		return try {
+			decryptor = streamingScheme.createStreamingDecryptor(video.videoFile)
+
+			// Create a temporary file with decrypted video content
+			// We need enough data for MediaMetadataRetriever to extract a frame
+			// Typically the first few MB are sufficient
+			val bytesToRead = minOf(decryptor.totalSize, THUMBNAIL_EXTRACTION_BYTES)
+			val buffer = ByteArray(bytesToRead.toInt())
+			val bytesRead = decryptor.read(0, buffer, 0, buffer.size)
+
+			if (bytesRead <= 0) {
+				Timber.w("Could not read video data for thumbnail")
+				return null
+			}
+
+			// Write to a temp file for MediaMetadataRetriever
+			tempFile = File(appContext.cacheDir, "thumb_temp_${video.videoName}.mp4")
+			withContext(Dispatchers.IO) {
+				FileOutputStream(tempFile).use { fos ->
+					fos.write(buffer, 0, bytesRead)
+				}
+			}
+
+			// Extract frame from temp file
+			extractVideoFrame(tempFile)
+		} catch (e: Exception) {
+			Timber.e(e, "Failed to extract encrypted video frame")
+			null
+		} finally {
+			decryptor?.close()
+			tempFile?.delete()
+		}
+	}
+
 	private fun extractVideoFrame(videoFile: File): Bitmap? {
 		return try {
 			MediaMetadataRetriever().use { retriever ->
@@ -637,6 +705,9 @@ class SecureImageRepository(
 		const val THUMBNAILS_DIR = ".thumbnails"
 		const val MAX_DECOY_PHOTOS = 10
 
+		// Amount of video data to decrypt for thumbnail extraction (5MB should be enough for moov atom)
+		private const val THUMBNAIL_EXTRACTION_BYTES = 5L * 1024 * 1024
+
         internal fun generateCopyName(dir: File, originalName: String): String {
             val base = originalName.substringBeforeLast(".")
             val ext = originalName.substringAfterLast('.', "jpg")