Fix video and photo rotation in landscape

- Improve metadata manager

Author: Wavesonics

app/src/main/kotlin/com/darkrockstudios/app/securecamera/auth/PinVerificationViewModel.kt

@@ -7,7 +7,6 @@ import com.darkrockstudios.app.securecamera.BaseViewModel
 import com.darkrockstudios.app.securecamera.R
 import com.darkrockstudios.app.securecamera.encryption.VideoEncryptionService
 import com.darkrockstudios.app.securecamera.gallery.vibrateDevice
-import com.darkrockstudios.app.securecamera.metadata.MetadataManager
 import com.darkrockstudios.app.securecamera.metadata.MetadataMigrationManager
 import com.darkrockstudios.app.securecamera.navigation.Introduction
 import com.darkrockstudios.app.securecamera.preferences.AppSettingsDataSource
@@ -30,7 +29,6 @@ class PinVerificationViewModel(
 	private val verifyPinUseCase: VerifyPinUseCase,
 	private val pinSizeUseCase: PinSizeUseCase,
 	private val appSettingsDataSource: AppSettingsDataSource,
-	private val metadataManager: MetadataManager,
 	private val metadataMigrationManager: MetadataMigrationManager,
 ) : BaseViewModel<PinVerificationUiState>() {
 
@@ -127,8 +125,6 @@ class PinVerificationViewModel(
 			val isValid = verifyPinUseCase.verifyPin(pin)
 
 			if (isValid) {
-				metadataManager.loadIndex()
-
 				if (metadataMigrationManager.needsMigration()) {
 					runDataMigration()
 				}

app/src/main/kotlin/com/darkrockstudios/app/securecamera/camera/CameraControls.kt

@@ -111,7 +111,7 @@ fun CameraControls(
 				cameraController.stopRecording()
 				vibrateDevice(context)
 			} else {
-				val outputFile = cameraController.startRecording(context)
+				val outputFile = cameraController.startRecording(context, cameraRotation.toInt())
 				if (outputFile != null) {
 					Timber.i("Recording to: ${outputFile.absolutePath}")
 					vibrateDevice(context)

app/src/main/kotlin/com/darkrockstudios/app/securecamera/camera/CameraState.kt

@@ -3,6 +3,7 @@ package com.darkrockstudios.app.securecamera.camera
 import android.annotation.SuppressLint
 import android.content.Context
 import android.graphics.RectF
+import android.view.Surface
 import androidx.camera.core.*
 import androidx.camera.lifecycle.ProcessCameraProvider
 import androidx.camera.video.*
@@ -260,9 +261,12 @@ class CameraState internal constructor(
 	 * 2. On recording complete, the temp file is encrypted to .secv format
 	 * 3. The temp file is securely deleted after encryption
 	 * 4. Metadata entry is added to the encrypted sidecar
+	 *
+	 * @param context The application context
+	 * @param deviceRotation The current device rotation in degrees (0, 90, 180, 270) from accelerometer
 	 */
 	@SuppressLint("MissingPermission")
-	fun startRecording(context: Context): File? {
+	fun startRecording(context: Context, deviceRotation: Int = 0): File? {
 		val videoCapture = this.videoCapture ?: run {
 			Timber.e("VideoCapture not initialized")
 			return null
@@ -273,6 +277,14 @@ class CameraState internal constructor(
 			return null
 		}
 
+		val surfaceRotation = when (deviceRotation) {
+			90 -> Surface.ROTATION_90
+			180 -> Surface.ROTATION_180
+			270 -> Surface.ROTATION_270
+			else -> Surface.ROTATION_0
+		}
+		videoCapture.targetRotation = surfaceRotation
+
 		// Create output directories
 		val videosDir = File(context.filesDir, "videos")
 		if (!videosDir.exists()) {

app/src/main/kotlin/com/darkrockstudios/app/securecamera/metadata/MediaMetadataEntry.kt

@@ -148,6 +148,18 @@ data class MediaMetadataEntry(
 			return buffer.array()
 		}
 
+		/**
+		 * Creates an "empty" entry for pre-allocated slots.
+		 * The entry will have STATUS_EMPTY and all other fields zeroed.
+		 */
+		fun emptyEntryBytes(): ByteArray {
+			val buffer = ByteBuffer.allocate(SecmFileFormat.ENTRY_PLAINTEXT_SIZE)
+			buffer.order(ByteOrder.LITTLE_ENDIAN)
+			buffer.put(SecmFileFormat.STATUS_EMPTY)
+			// Rest is already zero-filled
+			return buffer.array()
+		}
+
 		/**
 		 * Extracts just the status byte from an entry's plaintext.
 		 */

app/src/main/kotlin/com/darkrockstudios/app/securecamera/metadata/MetadataManager.kt

@@ -332,24 +332,63 @@ class MetadataManager(
 	}
 
 	/**
-	 * Allocates a new slot at the end of the file.
+	 * Allocates a new slot by growing the file in chunks.
+	 *
+	 * @return The first newly allocated slot (for immediate use)
 	 */
 	private suspend fun allocateNewSlot(): Int {
-		val newSlot = capacity
-		capacity++
+		val currentCapacity = capacity
+		val firstNewSlot = currentCapacity
+
+		// Calculate growth: double current capacity, bounded by min/max
+		val growthAmount = when {
+			currentCapacity == 0 -> MIN_GROWTH_SLOTS
+			currentCapacity < MAX_GROWTH_SLOTS -> currentCapacity.coerceAtLeast(MIN_GROWTH_SLOTS)
+			else -> MAX_GROWTH_SLOTS
+		}
+
+		val newCapacity = currentCapacity + growthAmount
 
-		// Update header capacity
 		withContext(Dispatchers.IO) {
-			indexFile?.let { raf ->
-				raf.seek(SecmFileFormat.HEADER_OFFSET_CAPACITY.toLong())
-				val buffer = ByteBuffer.allocate(4)
-				buffer.order(ByteOrder.LITTLE_ENDIAN)
-				buffer.putInt(capacity)
-				raf.write(buffer.array())
+			val raf = indexFile ?: error("Index file not open")
+			val keyBytes = encryptionScheme.getDerivedKey()
+
+			// Write empty encrypted entries for all new slots
+			for (slot in currentCapacity until newCapacity) {
+				val plaintext = MediaMetadataEntry.emptyEntryBytes()
+				val encrypted = encryptEntry(plaintext, keyBytes)
+				raf.seek(SecmFileFormat.entryOffset(slot))
+				raf.write(encrypted)
 			}
+
+			// Update header capacity
+			raf.seek(SecmFileFormat.HEADER_OFFSET_CAPACITY.toLong())
+			val buffer = ByteBuffer.allocate(4)
+			buffer.order(ByteOrder.LITTLE_ENDIAN)
+			buffer.putInt(newCapacity)
+			raf.write(buffer.array())
+
+			obfuscateIndexTimestamp()
 		}
 
-		return newSlot
+		// Add all new slots except the first one to free list
+		for (slot in (firstNewSlot + 1) until newCapacity) {
+			freeSlots.add(slot)
+		}
+
+		capacity = newCapacity
+
+		Timber.d("Grew metadata capacity from $currentCapacity to $newCapacity (+$growthAmount slots)")
+
+		return firstNewSlot
+	}
+
+	companion object {
+		/** Minimum number of slots to allocate at once */
+		private const val MIN_GROWTH_SLOTS = 64
+
+		/** Maximum number of slots to add in a single growth operation */
+		private const val MAX_GROWTH_SLOTS = 512
 	}
 
 	/**

app/src/main/kotlin/com/darkrockstudios/app/securecamera/usecases/CreatePinUseCase.kt

@@ -1,6 +1,7 @@
 package com.darkrockstudios.app.securecamera.usecases
 
 import com.darkrockstudios.app.securecamera.auth.AuthorizationRepository
+import com.darkrockstudios.app.securecamera.metadata.MetadataManager
 import com.darkrockstudios.app.securecamera.preferences.AppSettingsDataSource
 import com.darkrockstudios.app.securecamera.security.SchemeConfig
 import com.darkrockstudios.app.securecamera.security.pin.PinRepository
@@ -11,14 +12,16 @@ class CreatePinUseCase(
     private val encryptionScheme: EncryptionScheme,
     private val pinRepository: PinRepository,
     private val preferencesDataSource: AppSettingsDataSource,
-    private val authorizePinUseCase: AuthorizePinUseCase
+    private val authorizePinUseCase: AuthorizePinUseCase,
+    private val metadataManager: MetadataManager,
 ) {
 	suspend fun createPin(pin: String, schemeConfig: SchemeConfig): Boolean {
 		pinRepository.setAppPin(pin, schemeConfig)
 		val hashedPin = authorizePinUseCase.authorizePin(pin)
 		return if (hashedPin != null) {
 			authorizationRepository.createKey(pin, hashedPin)
 			encryptionScheme.deriveAndCacheKey(pin, hashedPin)
+			metadataManager.loadIndex()
 			preferencesDataSource.setIntroCompleted(true)
 			true
 		} else {

app/src/main/kotlin/com/darkrockstudios/app/securecamera/usecases/VerifyPinUseCase.kt

@@ -2,6 +2,7 @@ package com.darkrockstudios.app.securecamera.usecases
 
 import com.darkrockstudios.app.securecamera.auth.AuthorizationRepository
 import com.darkrockstudios.app.securecamera.camera.SecureImageRepository
+import com.darkrockstudios.app.securecamera.metadata.MetadataManager
 import com.darkrockstudios.app.securecamera.security.pin.PinRepository
 import com.darkrockstudios.app.securecamera.security.schemes.EncryptionScheme
 
@@ -11,6 +12,7 @@ class VerifyPinUseCase(
     private val pinRepository: PinRepository,
     private val encryptionScheme: EncryptionScheme,
     private val authorizePinUseCase: AuthorizePinUseCase,
+    private val metadataManager: MetadataManager,
 ) {
 	suspend fun verifyPin(pin: String): Boolean {
 		if (pinRepository.hasPoisonPillPin() && pinRepository.verifyPoisonPillPin(pin)) {
@@ -22,6 +24,7 @@ class VerifyPinUseCase(
 		val hashedPin = authorizePinUseCase.authorizePin(pin)
 		return if (hashedPin != null) {
 			encryptionScheme.deriveAndCacheKey(pin, hashedPin)
+			metadataManager.loadIndex()
 			true
 		} else {
             authRepository.incrementFailedAttempts()

app/src/test/kotlin/com/darkrockstudios/app/securecamera/imagemanager/SecureImageRepositoryTest.kt

@@ -6,7 +6,9 @@ import android.graphics.BitmapFactory
 import com.ashampoo.kim.model.GpsCoordinates
 import com.darkrockstudios.app.securecamera.auth.AuthorizationRepository
 import com.darkrockstudios.app.securecamera.camera.*
+import com.darkrockstudios.app.securecamera.metadata.MetadataManager
 import com.darkrockstudios.app.securecamera.preferences.HashedPin
+import com.darkrockstudios.app.securecamera.security.FileTimestampObfuscator
 import com.darkrockstudios.app.securecamera.security.pin.PinRepository
 import com.darkrockstudios.app.securecamera.security.schemes.EncryptionScheme
 import io.mockk.*
@@ -34,6 +36,8 @@ class SecureImageRepositoryTest {
 	private lateinit var secureImageRepository: SecureImageRepository
 	private lateinit var thumbnailCache: ThumbnailCache
 	private lateinit var encryptionScheme: EncryptionScheme
+	private lateinit var metadataManager: MetadataManager
+	private lateinit var fileTimestampObfuscator: FileTimestampObfuscator
 
 	@Before
 	fun setup() {
@@ -42,6 +46,8 @@ class SecureImageRepositoryTest {
 		authorizationRepository = mockk(relaxed = true)
 		thumbnailCache = mockk(relaxed = true)
 		encryptionScheme = mockk()
+		metadataManager = mockk(relaxed = true)
+		fileTimestampObfuscator = mockk(relaxed = true)
 
 		// Mock the filesDir and cacheDir
 		val filesDir = tempFolder.newFolder("files")
@@ -98,6 +104,8 @@ class SecureImageRepositoryTest {
 			appContext = context,
 			thumbnailCache = thumbnailCache,
 			encryptionScheme = encryptionScheme,
+			metadataManager = metadataManager,
+			fileTimestampObfuscator = fileTimestampObfuscator,
 		)
 	}
 
@@ -176,7 +184,7 @@ class SecureImageRepositoryTest {
 	}
 
 	@Test
-	fun `deleteImage should remove the photo file and thumbnail`() {
+	fun `deleteImage should remove the photo file and thumbnail`() = runTest {
 		// Given
 		val galleryDir = secureImageRepository.getGalleryDirectory()
 		galleryDir.mkdirs()
@@ -199,7 +207,7 @@ class SecureImageRepositoryTest {
 	}
 
 	@Test
-	fun `deleteImage should return false when photo does not exist`() {
+	fun `deleteImage should return false when photo does not exist`() = runTest {
 		// Given
 		val galleryDir = secureImageRepository.getGalleryDirectory()
 		galleryDir.mkdirs()
@@ -442,7 +450,7 @@ class SecureImageRepositoryTest {
 	}
 
 	@Test
-	fun `deleteAllImages should delete all photos`() {
+	fun `deleteAllImages should delete all photos`() = runTest {
 		// Given
 		val galleryDir = secureImageRepository.getGalleryDirectory()
 		galleryDir.mkdirs()