From fa4d2a499116075c2e95a749e8b3c5a71b7961a7 Mon Sep 17 00:00:00 2001
From: edde746 <86283021+edde746@users.noreply.github.com>
Date: Mon, 27 Jul 2026 19:02:17 +0200
Subject: [PATCH] test(android): scan every fixed endpoint source for
 certificate drift

The scan omitted six files the config itself cites, so jsdelivr.net,
api.github.com and image.tmdb.org were listed as system-only while no scanned
source referenced them; changing those hosts would have fallen through to the
base config and its user certificate authorities undetected.

Also assert the reverse direction, so a domain no scanned source produces
fails instead of silently losing its guard.
---
 .../android/network_security_config_test.dart | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/test/android/network_security_config_test.dart b/test/android/network_security_config_test.dart
index b00a29d4..9f4aaaa3 100644
--- a/test/android/network_security_config_test.dart
+++ b/test/android/network_security_config_test.dart
@@ -24,6 +24,12 @@ const _fixedEndpointSourcePaths = <String>[
   'lib/services/trackers/mal/mal_constants.dart',
   'lib/services/trackers/anilist/anilist_constants.dart',
   'lib/services/trackers/simkl/simkl_constants.dart',
+  'lib/services/trackers/oauth_proxy_client.dart',
+  'lib/services/trackers/anime_lists_mapping_store.dart',
+  'lib/services/trackers/fribb_mapping_store.dart',
+  'lib/services/catalog/seerr_catalog_source.dart',
+  'lib/services/discord_rpc_service.dart',
+  'lib/services/update_service.dart',
   'lib/watch_together/services/watch_together_relay_endpoint.dart',
   'lib/main.dart',
 ];
@@ -91,5 +97,19 @@ void main() {
     }
 
     expect(discoveredHosts, isNotEmpty, reason: 'The fixed-endpoint source scan must discover HTTPS literals');
+
+    // The other direction: a listed domain that no scanned source produces means
+    // the scan lost sight of the file that owns it, and a host change there would
+    // silently fall through to base-config and its user certificate authorities.
+    final unobservedDomains = _expectedDomains
+        .where((domain) => !discoveredHosts.any((host) => host == domain || host.endsWith('.$domain')))
+        .toList();
+    expect(
+      unobservedDomains,
+      isEmpty,
+      reason:
+          'No scanned source in _fixedEndpointSourcePaths references these domains, so drift in them '
+          'cannot be detected. Add the owning file to the scan or drop the domain from $_configPath.',
+    );
   });
 }