May 10, 2026

Awaken — Wake-on-LAN Controller

Android app to wake and shut down devices on the network — Magic Packet (WOL), remote shutdown via SSH, ICMP ping monitoring, push notifications and a home screen widget.

Android
Kotlin
Firebase
SSH

GitHub ↗ DeepWiki ↗

Problem

Controlling devices on a home or office network from a phone typically requires separate tools: one for WOL, another for SSH, another for monitoring. The goal was a single native app that covered the entire flow — wake, monitor, shut down — with the quality experience of a production app.

Solution

Native Android app in Kotlin that unifies Magic Packet (WOL), remote shutdown via SSH (password or private key), real-time ICMP ping and push notifications for status changes. It integrates with the Android system through Quick Settings Tiles, widgets, launcher shortcuts and Device Controls.

Key Features

WOL over LAN and WAN — Magic Packet with support for directed broadcast and relay
SSH Shutdown — password or SSH key authentication; no third-party dependencies for the protocol
Background monitoring — persistent service with ICMP ping; notifies online/offline even when the app is closed
Quick Settings Tiles — up to 3 configurable tiles in the system notification panel
Home Screen Widget — wake a device without opening the app
Biometrics/PIN — protects destructive actions (shutdown) with device authentication
Trusted Wi-Fi networks — skips authentication on known SSIDs
Export/import configuration — device backup in JSON

Technical Decisions

Firebase Remote Config controls the background monitoring toggle, allowing it to be disabled in production if it causes excessive battery drain without publishing an update. The Google Assistant integration via deep links wakeonlan://action was deliberate: it allows waking devices with voice commands.

Architecture

Awaken · Wake-on-LAN Controller

Android · Kotlin · Firebase · SSH

▶ Pruébalo — arrastra nodos · click para inspeccionar

cada barra = Magic Packet → NIC → power on → ping online

Architecture diagram of Awaken — Wake-on-LAN Controller

Technical Architecture — Aweken

Version: 2.0
Stack: Java + Kotlin · Android 8.0+ · Room + SQLCipher · RxJava 2 + Coroutines
Domain: Wake-on-LAN Controller — device monitoring, remote execution, Android integration

1. Problem Context

Traditional WOL controllers require users to manually open the app to wake devices. A typical use case is:

User is away from home — wants to turn on their PC, but must open the app, search for the device, and tap.
Unknown state — doesn't know if the device is already online, wasting bandwidth.
No notifications — receives no alerts when a device unexpectedly disconnects.

Aweken solves this through:

Deep Android integration — controls in Quick Settings, home screen widget, launcher shortcuts.
Background monitoring — WorkManager tracks devices without draining battery.
Push notifications — real-time alerts when device state changes.
Local-first with encryption — database is encrypted with keys from the device's AndroidKeyStore.

2. System Overview

┌─────────────────────────────────────────────────────┐
│              Android Application (Aweken)           │
│                                                     │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────┐  │
│  │    UI Tier   │  │Logic & Domain│  │Persisten-│  │
│  │              │  │              │  │   cy     │  │
│  ├──────────────┤  ├──────────────┤  └──────────┘  │
│  │ Activities   │  │ View Models  │   Room DB      │
│  │ Fragments    │  │ Use Cases    │   (encrypted)  │
│  │ Adapters     │  │ Repositories │                │
│  └──────────────┘  └──────────────┘   ┌──────────┐ │
│                                        │ SSH, WOL │ │
│                                        │Execution │ │
│                                        └──────────┘ │
└─────────────────────────────────────────────────────┘
          │              │              │
          ▼              ▼              ▼
    ┌──────────┐  ┌──────────┐  ┌──────────┐
    │ Firebase │  │  Android │  │  Local   │
    │Analytics,│  │ System   │  │  Network │
    │Crash.    │  │ Integr.  │  │  (LAN)   │
    │RemoteConf│  │ Q.Setting│  │  + SSH   │
    │          │  │  Widget  │  │  Servers │
    └──────────┘  └──────────┘  └──────────┘

3. Technology Stack

Layer	Technology	Justification
Runtime	Java 8 / Kotlin	Interoperability; Kotlin for modern logic
Framework UI	AndroidX · Data Binding	Maintainable, reactive; automatic view binding
Navigation	AndroidX Navigation	Type-safe fragment graph; automatic backstack handling
Persistence	Room + SQLCipher	Type-safe SQL; local storage encryption
Async	RxJava 2 + Kotlin Coroutines	Observables for data streams; async/await for simple
Injection	Hilt (Dagger 2)	Declarative IoC; less boilerplate than pure Dagger
Networking	Retrofit 2 + OkHttp	REST client; reusable interceptors
WOL	Custom library (ping module)	Magic Packet via DatagramSocket; no external deps
SSH	sshj + Bouncy Castle	Password or SSH key authentication
Background Tasks	WorkManager	Guaranteed execution; respects Android 12+ restrictions
Connectivity	ICMP Ping (custom)	Real latency; more precise than DNS queries
Web View	AndroidX WebView	Display ToS, privacy policy
Biometric	AndroidX Biometric	Fingerprint / face unlock for action protection
Updates	Android Play Update Library	Flexible update flow; in-app prompt without restart
Reviews	Android Play In-App Review	Contextual rating prompt; non-intrusive
Testing	JUnit 4 + Mockito	Unit tests for repositories and use cases
CI/CD	Jenkins + Gradle	Multi-stage: tests, build, archive, Play Store publish
Firebase	Crashlytics, Analytics, RC	Crash reporting; feature flags; optional
Localization	Plurals + Strings resources	EN (default), DE, ES

4. Modules — Responsibilities

4.1 Module `app` — Main Application

Contains all business logic, UI, and lifecycle management.

app/
├── src/main/java/com/ymid/wakeonlan/
│   ├── AwekenApplication.kt          # Entry point, Firebase init
│   │
│   ├── ui/                           # Presentation layer
│   │   ├── main/                     # Main screen (device list)
│   │   ├── device-detail/            # Details and per-device actions
│   │   ├── scan/                     # Network discovery
│   │   ├── settings/                 # Global configuration
│   │   ├── history/                  # Activity log (wake/shutdown events)
│   │   └── adapters/                 # RecyclerView adapters
│   │
│   ├── persistence/                  # Data access layer
│   │   ├── database/                 # Room Database definition
│   │   ├── dao/                      # Data Access Objects
│   │   ├── models/                   # Entity classes (Device, Group, HistoryEvent)
│   │   └── repositories/             # Abstraction layer above DAOs
│   │
│   ├── domain/                       # Business logic (use cases)
│   │   ├── usecase/                  # Wake device, monitor, etc.
│   │   ├── model/                    # Domain entities (Device, Alert, etc.)
│   │   └── repository/               # Repository interfaces
│   │
│   ├── wol/                          # Wake-on-LAN logic
│   │   ├── WolClient.kt              # Send Magic Packet
│   │   ├── PacketBuilder.kt          # Construct UDP packet
│   │   └── WolResult.kt              # Result type (success/failure)
│   │
│   ├── shutdown/                     # SSH remote shutdown
│   │   ├── SshClient.kt              # SSH connection pooling
│   │   ├── SshExecutor.kt            # Command execution
│   │   ├── CredentialProvider.kt     # Auth: password or key-based
│   │   └── SshException.kt           # SSH errors
│   │
│   ├── monitoring/                   # Background device monitoring
│   │   ├── DeviceMonitorWorker.kt    # WorkManager task
│   │   ├── PingService.kt            # ICMP ping via ping module
│   │   ├── NotificationManager.kt    # Push notifications
│   │   └── MonitoringScheduler.kt    # Scheduling & config
│   │
│   ├── security/                     # Biometric & encryption
│   │   ├── BiometricManager.kt       # Fingerprint/face auth
│   │   ├── EncryptionUtil.kt         # SQLCipher integration
│   │   └── KeyStoreManager.kt        # AndroidKeyStore access
│   │
│   ├── quicksettings/                # Quick Settings Tiles
│   │   └── WolTileService.kt         # Up to 3 configurable tiles
│   │
│   ├── quickaccess/                  # Device Controls (Quick Access)
│   │   ├── DeviceControlsProvider.kt # StatefulDeviceControl registration
│   │   └── DeviceControlActionReceiver.kt
│   │
│   ├── widget/                       # Home screen widget
│   │   ├── WolWidget.kt              # Widget provider
│   │   └── WidgetUpdateWorker.kt     # Background widget updates
│   │
│   ├── shortcuts/                    # Dynamic launcher shortcuts
│   │   └── ShortcutManager.kt        # Wake/Shutdown shortcuts per device
│   │
│   ├── appactions/                   # Google App Actions / Deep Links
│   │   └── WolDeepLinkHandler.kt     # wakeonlan:// URI scheme
│   │
│   ├── receivers/                    # Broadcast receivers
│   │   ├── BootCompletedReceiver.kt  # Restore state on reboot
│   │   └── ConnectivityReceiver.kt   # Network changes
│   │
│   ├── update/                       # In-app updates (Play Store)
│   │   └── UpdateManager.kt          # Flexible update flow
│   │
│   ├── rating/                       # In-app reviews (Play Store)
│   │   └── ReviewManager.kt          # Contextual review prompt
│   │
│   ├── crash/                        # Firebase Crashlytics
│   │   └── CrashReporter.kt          # Custom crash handling
│   │
│   └── config/                       # App configuration
│       ├── Constants.kt              # Global constants
│       ├── BuildConfig integration   # API keys, endpoints
│       └── AppModule.kt              # Hilt configuration
│
└── src/test/java/                    # JUnit + Mockito tests

Key Patterns:

MVVM + Repository: each screen is a Fragment with its ViewModel + Repository
LiveData + Flow: observables for reactive UI updates
Use Cases: decoupled business logic from UI
Dependency Injection (Hilt): automatic dependency injection

4.2 Module `ping` — ICMP Library

Low-level AAR library for sending ICMP Echo Requests (pings) and measuring latency.

ping/
├── src/main/java/com/ymid/ping/
│   ├── IcmpPinger.java              # Main API
│   ├── PingResult.java              # Result with latency/TTL
│   ├── PingException.java           # Error handling
│   └── native/
│       └── libping.so               # JNI wrapper (optional)
│
└── src/test/java/                   # Tests for ping precision

Responsibility: provides a Java/Kotlin wrapper over ICMP functionality.

5. User Flows — Architecture

5.1 Wake a Device (Wake-on-LAN)

┌─────────────────────────────────────────┐
│ User taps "Wake" in app / widget        │
└──────────────┬──────────────────────────┘
               │
               ▼
        ┌─────────────────┐
        │ BiometricCheck? │ ← If enabled
        └────────┬────────┘
                 │
    ┌────────────┴────────────┐
    │ Authenticated?          │
    └────────────┬────────────┘
                 │ yes
                 ▼
        ┌─────────────────────────────┐
        │ GetDeviceFromRepository     │
        │ (MAC, Network Info)         │
        └────────────┬────────────────┘
                     │
                     ▼
         ┌────────────────────────┐
         │ WolClient.wakeDevice() │
         │ - Broadcast Magic PKT  │
         │ - Subnet or WAN relay  │
         └────────────┬───────────┘
                      │
          ┌───────────┴──────────┐
          │ Success?             │
          └───────────┬──────────┘
                      │ yes
                      ▼
         ┌──────────────────────────┐
         │ LogHistoryEvent          │
         │ (WAKE action, timestamp) │
         └──────────────┬───────────┘
                        │
                        ▼
         ┌────────────────────────┐
         │ UpdateUI (Toast/Snack) │
         │ "Device waking..."     │
         └────────────────────────┘

5.2 Background Monitoring

┌─────────────────────────────────────────┐
│ WorkManager: DeviceMonitorWorker        │
│ (Runs every N minutes)                  │
└──────────────┬──────────────────────────┘
               │
               ▼
        ┌─────────────────────┐
        │ GetAllDevices from  │
        │ Repository          │
        └────────────┬────────┘
                     │
                     ▼
        ┌──────────────────────────┐
        │ For each device:         │
        │ PingService.ping()       │
        └────────────┬─────────────┘
                     │
         ┌───────────┴──────────────┐
         │                          │
         ▼ Ping OK                  ▼ Ping FAIL
    ┌────────────┐           ┌──────────────┐
    │ status=ON  │           │ status=OFF   │
    └─────┬──────┘           └───────┬──────┘
          │                          │
          ▼                          ▼
    ┌──────────────────┐      ┌──────────────────┐
    │ Status changed?  │      │ Status changed?  │
    │ (was OFF)        │      │ (was ON)         │
    └────────┬─────────┘      └────────┬─────────┘
             │ yes                     │ yes
             ▼                         ▼
    ┌──────────────────────┐  ┌──────────────────────┐
    │ Update DB            │  │ Update DB            │
    │ SendNotification     │  │ SendNotification     │
    │ "Device is online"   │  │ "Device went offline"│
    └──────────────────────┘  └──────────────────────┘

5.3 Shutdown via SSH

┌─────────────────────────────────────────┐
│ User taps "Shutdown" in app             │
└──────────────┬──────────────────────────┘
               │
               ▼
        ┌─────────────────┐
        │ BiometricCheck? │
        └────────────┬────────────┘
                     │
                     ▼
    ┌────────────────────────────────┐
    │ GetSSHCredential from Repo      │
    │ (password or private key)       │
    └────────────┬───────────────────┘
                 │
                 ▼
      ┌──────────────────────────┐
      │ SshClient.execute()      │
      │ Command: "sudo shutdown" │
      │ or "shutdown.exe /s"     │
      │ (Windows/Linux specific) │
      └────────────┬─────────────┘
                   │
       ┌───────────┴───────────┐
       │ Success?              │
       └───────────┬───────────┘
                   │ yes
                   ▼
      ┌────────────────────────┐
      │ LogHistoryEvent        │
      │ (SHUTDOWN action)      │
      └────────────┬───────────┘
                   │
                   ▼
      ┌────────────────────────┐
      │ UpdateUI (Toast/Snack) │
      │ "Shutdown initiated"   │
      └────────────────────────┘

6. Persistence — Room + SQLCipher

6.1 Encrypted Database

@Database(
    entities = [Device::class, DeviceGroup::class, HistoryEvent::class, ...],
    version = 1,
    autoMigrations = []  // Use explicit Migrations
)
@TypeConverters(value = [Converters::class])
abstract class AwekenDatabase : RoomDatabase() {
    
    companion object {
        fun buildDatabase(context: Context): AwekenDatabase {
            val passphrase = EncryptionUtil.generatePassphrase(context)
            return Room.databaseBuilder(context, AwekenDatabase::class.java, "aweken.db")
                .openHelperFactory(SupportFactory(passphrase))  // SQLCipher integration
                .build()
        }
    }
}

Security:

Key generated from AndroidKeyStore (not hardcoded)
Database encrypted at rest
SQLCipher uses AES-256-CBC cipher

6.2 Main Entities

Entity	Description
`Device`	MAC, IP, hostname, SSH port, OS type, status
`DeviceGroup`	Device grouping/organization
`HistoryEvent`	Activity log (wake, shutdown, timestamp)
`SshCredential`	SSH credentials per device
`NetworkConfig`	WOL proxy, LAN broadcast, WAN relay settings
`MonitorAlert`	Alert configuration per device

7. Android Integration — Details

7.1 Quick Settings Tiles

class WolTileService1 : TileService() {
    override fun onClick() {
        if (isLocked) {
            unlockAndRun { wakeSelectedDevice() }
        } else {
            wakeSelectedDevice()
        }
    }
}

Up to 3 configurable tiles, one per favorite device.

7.2 Device Controls (Quick Access)

class DeviceControlsProvider : DeviceControlsProviderService() {
    override fun createBuildersForAllAvailableDevices(): Flow<DeviceControlBuilder> {
        return devicesRepository.getAllDevices()
            .map { device ->
                DeviceControl.StatefulDeviceControl.Builder(
                    device.id,
                    "Wake ${device.name}",
                    device.status.toDeviceControlStatus()
                )
            }
    }
}

Integration with Android 11+ "Quick Controls" panel.

7.3 Home Screen Widget

2x2 widget: tap to wake
Shows current state (online/offline + latency)
Updates every 5 min via WorkManager

7.4 Dynamic Shortcuts

val shortcuts = listOf(
    ShortcutInfo.Builder(context, "wake_device_1")
        .setShortLabel("Wake Device 1")
        .setIcon(Icon.createWithResource(context, R.drawable.ic_wake))
        .setIntent(Intent(context, MainActivity::class.java).apply {
            action = "com.ymid.wakeonlan.WAKE"
            putExtra("device_id", device.id)
        })
        .build()
)
ShortcutManager.getInstance(context).dynamicShortcuts = shortcuts

Quick shortcuts when long-pressing app icon.

7.5 Google App Actions / Deep Links

<intent-filter android:label="@string/title_wake_device">
    <action android:name="android.intent.action.VIEW" />
    <category android:name="android.intent.category.DEFAULT" />
    <category android:name="android.intent.category.BROWSABLE" />
    <data android:scheme="wakeonlan" android:host="device" />
</intent-filter>

Supports wakeonlan://device?id=<device_id>&action=wake

7.6 BootCompletedReceiver

Restores shortcuts and resumes monitoring after device reboot.

8. Resilience Patterns

8.1 Retries with Backoff

suspend fun wakeDeviceWithRetry(device: Device): Result {
    return retry(
        times = 3,
        initialDelayMillis = 500,
        maxDelayMillis = 2000,
        backoff = { delay -> delay * 2 }
    ) {
        wolClient.wake(device)
    }
}

8.2 Timeouts

withTimeoutOrNull(5000) {  // 5 seconds
    pingService.ping(device.ipAddress)
}

8.3 Device Cache

Device queries are cached in memory for 30 seconds, reducing frequent database reads.

9. Key Design Decisions

9.1 Room + SQLCipher over SharedPreferences

Decision: Encrypted SQL database.
Why: SharedPreferences is insecure for sensitive data (SSH credentials). Room + SQLCipher is the Android standard for protected storage.

9.2 WorkManager for monitoring, not foreground service

Decision: Background job scheduling via WorkManager.
Why: Respects Android 12+ restrictions; battery-efficient; system can pause/resume based on battery policies without killing the app.

9.3 Hilt for dependency injection

Decision: Dagger 2 via Hilt.
Why: Less boilerplate than pure Dagger; native integration with Android components (Activities, Fragments, Services).

9.4 RxJava 2 + Coroutines (both)

Decision: Coexistence of paradigms.
Why: RxJava 2 for complex streams (debounce, throttle); Coroutines for simple async. Interoperability via rxKotlin and flow.asObservable().

9.5 Native ICMP Ping instead of DNS reverse lookup

Decision: ping module with real ICMP.
Why: Precise latency; DNS-independent; faster (ICMP is Layer 3 vs Layer 7).

10. Folder Structure

WakeOnLanV2/
├── app/
│   ├── build.gradle                 # Deps, plugins, signingConfig
│   ├── google-services.json         # Firebase (optional)
│   └── src/
│       ├── main/
│       │   ├── AndroidManifest.xml
│       │   ├── java/com/ymid/wakeonlan/
│       │   │   ├── ui/              # Screens (MVVM)
│       │   │   ├── domain/          # Use cases
│       │   │   ├── persistence/     # Room DAOs & entities
│       │   │   ├── wol/             # Magic Packet logic
│       │   │   ├── shutdown/        # SSH logic
│       │   │   ├── monitoring/      # Background tasks
│       │   │   ├── security/        # Biometric & encryption
│       │   │   ├── widgets/         # UI components
│       │   │   ├── config/          # Hilt modules
│       │   │   └── AwekenApplication.kt
│       │   ├── res/
│       │   │   ├── layout/          # XML layouts
│       │   │   ├── drawable/        # Icons & shapes
│       │   │   ├── values/          # Strings, colors, styles
│       │   │   ├── values-de/       # German strings
│       │   │   ├── values-es/       # Spanish strings
│       │   │   └── xml/             # Widget & backup schema
│       │   └── assets/
│       ├── test/                    # JUnit 4 tests
│       └── androidTest/             # Instrumented tests
│
├── ping/
│   ├── build.gradle
│   └── src/main/java/com/ymid/ping/
│       ├── IcmpPinger.java
│       └── PingResult.java
│
├── build.gradle                     # Root build config
├── settings.gradle                  # Module setup
├── gradle.properties                # Build properties
├── Jenkinsfile                      # CI/CD pipeline
└── README.md

Document maintained alongside code — if architecture changes, update this description.

Internal API Reference — Aweken

Version: 2.0
Scope: Public module interfaces, Intent handlers, Kotlin extensions, Room DAOs

Conventions

All types return Result<T> (sealed class) or Flow<T> for async
Persistence methods return Flow (LiveData observables)
Action methods (WOL, SSH) return Result (success/failure)
Exceptions captured locally — never propagate to caller
UUIDs expressed as java.util.UUID (not String)
Timestamps in UTC, Long (milliseconds since epoch)

1. Domain Layer — Use Cases

1.1 WakeDeviceUseCase

Responsibility: wake a device.

class WakeDeviceUseCase(
    private val wolClient: WolClient,
    private val deviceRepository: DeviceRepository,
    private val historyRepository: HistoryRepository
) {
    suspend operator fun invoke(deviceId: UUID): Result<Unit> = runCatching {
        val device = deviceRepository.getDevice(deviceId).first()
        wolClient.wake(device)
        historyRepository.addEvent(
            HistoryEvent(
                deviceId = deviceId,
                action = "WAKE",
                status = "SUCCESS",
                timestamp = System.currentTimeMillis()
            )
        )
    }
}

Errors:

DeviceNotFoundException — device not found
WolException — error sending packet

Usage:

val result = wakeDeviceUseCase(deviceId)
result.onSuccess {
    Toast.makeText(context, "Device waking...", Toast.LENGTH_SHORT).show()
}
result.onFailure { error ->
    Toast.makeText(context, "Wake failed: ${error.message}", Toast.LENGTH_LONG).show()
}

1.2 ShutdownDeviceUseCase

Responsibility: shut down a device via SSH.

class ShutdownDeviceUseCase(
    private val sshExecutor: SshExecutor,
    private val deviceRepository: DeviceRepository,
    private val historyRepository: HistoryRepository
) {
    suspend operator fun invoke(
        deviceId: UUID,
        timeout: Long = 5000L
    ): Result<Unit> = runCatching {
        val device = deviceRepository.getDevice(deviceId).first()
        val credential = deviceRepository.getSshCredential(deviceId).first()
        
        sshExecutor.execute(
            host = device.ipAddress,
            port = device.sshPort ?: 22,
            credential = credential,
            command = when (device.osType) {
                OsType.WINDOWS -> "shutdown /s /t 60"
                OsType.LINUX -> "sudo shutdown -h +1"
            },
            timeout = timeout
        )
        
        historyRepository.addEvent(
            HistoryEvent(
                deviceId = deviceId,
                action = "SHUTDOWN",
                status = "SUCCESS",
                timestamp = System.currentTimeMillis()
            )
        )
    }
}

Parameters:

deviceId: UUID — target device
timeout: Long — timeout in ms (default 5000)

Errors:

SshException — connection refused, invalid credentials
CommandTimeoutException — command did not respond in time

1.3 MonitorDevicesUseCase

Responsibility: monitor device state in background.

class MonitorDevicesUseCase(
    private val pingService: PingService,
    private val deviceRepository: DeviceRepository,
    private val notificationManager: NotificationManager
) {
    suspend operator fun invoke(): Flow<MonitoringResult> = flow {
        deviceRepository.getAllDevices().collect { devices ->
            devices.forEach { device ->
                val pingResult = withTimeoutOrNull(3000) {
                    pingService.ping(device.ipAddress)
                }
                
                val isOnline = pingResult != null && pingResult.isReachable
                val wasOnline = device.lastKnownStatus == DeviceStatus.ONLINE
                
                if (isOnline != wasOnline) {
                    // State changed
                    deviceRepository.updateDeviceStatus(
                        deviceId = device.id,
                        status = if (isOnline) DeviceStatus.ONLINE else DeviceStatus.OFFLINE,
                        latency = pingResult?.latency ?: 0L
                    )
                    
                    if (isOnline && !wasOnline) {
                        notificationManager.showNotification(
                            title = "Device Online",
                            body = "${device.name} is now online"
                        )
                    } else if (!isOnline && wasOnline) {
                        notificationManager.showNotification(
                            title = "Device Offline",
                            body = "${device.name} went offline"
                        )
                    }
                }
                
                emit(MonitoringResult(device.id, isOnline))
            }
        }
    }
}

2. Persistence Layer — Repositories & DAOs

2.1 DeviceRepository

Interface:

interface DeviceRepository {
    // Queries
    fun getAllDevices(): Flow<List<Device>>
    fun getDevice(id: UUID): Flow<Device>
    fun getDevicesByGroup(groupId: UUID): Flow<List<Device>>
    
    // Mutations
    suspend fun insertDevice(device: Device): UUID
    suspend fun updateDevice(device: Device)
    suspend fun deleteDevice(id: UUID)
    suspend fun updateDeviceStatus(id: UUID, status: DeviceStatus, latency: Long)
    
    // SSH Credentials
    suspend fun saveSshCredential(credential: SshCredential)
    fun getSshCredential(deviceId: UUID): Flow<SshCredential?>
    suspend fun deleteSshCredential(deviceId: UUID)
}

Implementation:

class DeviceRepositoryImpl(
    private val deviceDao: DeviceDao,
    private val sshCredentialDao: SshCredentialDao,
    private val dispatcher: CoroutineDispatcher = Dispatchers.IO
) : DeviceRepository {
    
    override fun getAllDevices(): Flow<List<Device>> = 
        deviceDao.getAllDevices().flowOn(dispatcher)
    
    override suspend fun insertDevice(device: Device): UUID = 
        withContext(dispatcher) {
            deviceDao.insert(device)
        }
    
    // ... more methods
}

2.2 HistoryRepository

Interface:

interface HistoryRepository {
    fun getHistoryForDevice(deviceId: UUID): Flow<List<HistoryEvent>>
    fun getAllHistory(): Flow<List<HistoryEvent>>
    suspend fun addEvent(event: HistoryEvent)
    suspend fun deleteOldEvents(olderThan: Long)  // timestamp
}

2.3 Room DAOs

@Dao
interface DeviceDao {
    @Query("SELECT * FROM devices WHERE deleted_at IS NULL ORDER BY name ASC")
    fun getAllDevices(): Flow<List<Device>>
    
    @Query("SELECT * FROM devices WHERE id = :id AND deleted_at IS NULL")
    fun getDevice(id: UUID): Flow<Device?>
    
    @Insert(onConflict = OnConflictStrategy.REPLACE)
    suspend fun insert(device: Device): Long
    
    @Update
    suspend fun update(device: Device)
    
    @Query("UPDATE devices SET deleted_at = :timestamp, deleted_by = :deletedBy WHERE id = :id")
    suspend fun softDelete(id: UUID, timestamp: Long, deletedBy: String)
}

@Dao
interface SshCredentialDao {
    @Query("SELECT * FROM ssh_credentials WHERE device_id = :deviceId AND deleted_at IS NULL")
    fun getCredential(deviceId: UUID): Flow<SshCredential?>
    
    @Insert(onConflict = OnConflictStrategy.REPLACE)
    suspend fun insert(credential: SshCredential): Long
    
    @Query("UPDATE ssh_credentials SET deleted_at = NOW() WHERE device_id = :deviceId")
    suspend fun deleteCredential(deviceId: UUID)
}

3. WOL — Magic Packet

3.1 WolClient

Interface:

interface WolClient {
    suspend fun wake(device: Device): Result<Unit>
}

Implementation:

class WolClientImpl : WolClient {
    override suspend fun wake(device: Device): Result<Unit> = withContext(Dispatchers.IO) {
        runCatching {
            val magicPacket = PacketBuilder.buildMagicPacket(device.macAddress)
            val broadcast = if (device.broadcastAddress != null) {
                InetAddress.getByName(device.broadcastAddress)
            } else {
                InetAddress.getByName("255.255.255.255")
            }
            
            DatagramSocket().use { socket ->
                socket.broadcast = true
                val packet = DatagramPacket(
                    magicPacket,
                    magicPacket.size,
                    broadcast,
                    9  // WOL port
                )
                socket.send(packet)
            }
        }
    }
}

Magic Packet Construction:

object PacketBuilder {
    fun buildMagicPacket(macAddress: String): ByteArray {
        val bytes = getMacBytes(macAddress)
        val magicPacket = ByteArray(102)
        
        // First 6 bytes: 0xFF (sync stream)
        for (i in 0..5) {
            magicPacket[i] = 0xFF.toByte()
        }
        
        // Repeat MAC address 16 times
        for (i in 0..15) {
            for (j in 0..5) {
                magicPacket[6 + i * 6 + j] = bytes[j]
            }
        }
        
        return magicPacket
    }
    
    private fun getMacBytes(macAddress: String): ByteArray {
        val hex = macAddress.split(":").map { it.toInt(16).toByte() }
        return hex.toByteArray()
    }
}

4. SSH — Remote Shutdown

4.1 SshExecutor

Interface:

interface SshExecutor {
    suspend fun execute(
        host: String,
        port: Int,
        credential: SshCredential,
        command: String,
        timeout: Long = 5000L
    ): String  // stdout
}

Implementation (sshj):

class SshExecutorImpl : SshExecutor {
    override suspend fun execute(
        host: String,
        port: Int,
        credential: SshCredential,
        command: String,
        timeout: Long
    ): String = withContext(Dispatchers.IO) {
        val ssh = SSHClient()
        try {
            ssh.addHostKeyVerifier(object : HostKeyVerifier {
                override fun verify(hostname: String?, port: Int, key: PublicKey?): Boolean {
                    // Verify host key (simple: accept on first use)
                    return true
                }
            })
            
            ssh.connect(host, port)
            
            if (credential.password != null) {
                ssh.authPassword(credential.username, credential.password)
            } else if (credential.privateKeyPath != null) {
                val keyProvider = OpenSSHKeyFile()
                keyProvider.init(File(credential.privateKeyPath), credential.passphrase?.toCharArray())
                ssh.authPublickey(credential.username, keyProvider)
            }
            
            val cmd = ssh.startCommand(command)
            val output = cmd.inputStream.bufferedReader().readText()
            cmd.join(timeout, TimeUnit.MILLISECONDS)
            
            output
        } finally {
            ssh.disconnect()
        }
    }
}

5. Monitoring — ICMP Ping

5.1 PingService

Interface:

interface PingService {
    suspend fun ping(ipAddress: String, timeout: Long = 3000): PingResult
}

data class PingResult(
    val ipAddress: String,
    val isReachable: Boolean,
    val latency: Long,  // ms
    val ttl: Int
)

Implementation:

class PingServiceImpl(private val icmpPinger: IcmpPinger) : PingService {
    override suspend fun ping(ipAddress: String, timeout: Long): PingResult =
        withContext(Dispatchers.IO) {
            try {
                val result = icmpPinger.ping(ipAddress, timeout)
                PingResult(
                    ipAddress = ipAddress,
                    isReachable = result.isReachable,
                    latency = result.latency,
                    ttl = result.ttl
                )
            } catch (e: Exception) {
                PingResult(
                    ipAddress = ipAddress,
                    isReachable = false,
                    latency = timeout,
                    ttl = 0
                )
            }
        }
}

6. Android Integrations

6.1 Quick Settings Tile

Intent:

class WolTileService1 : TileService() {
    override fun onClick() {
        val intent = Intent(this, MainActivity::class.java).apply {
            action = "com.ymid.wakeonlan.QUICK_WAKE"
            putExtra("tile_index", 1)
        }
        startActivityAndCollapse(intent)
    }
}

Configuration in Settings:

// User picks device for tile 1
val devices = deviceRepository.getAllDevices().first()
val selectedDevice = devices[userSelection]
preferences.edit().putString("tile_1_device_id", selectedDevice.id.toString()).apply()

6.2 Device Controls (Quick Access)

class DeviceControlsProvider : DeviceControlsProviderService() {
    @RequiresPermission(android.Manifest.permission.QUERY_ALL_PACKAGES)
    override fun createBuildersForAllAvailableDevices(): Flow<DeviceControlBuilder> {
        return flowOf()  // TODO: integrate DeviceRepository
    }
    
    override suspend fun performDeviceAction(
        controlId: String,
        action: ControlAction,
        consumer: Consumer<Int>
    ) {
        // Execute WOL, return status
        consumer.accept(ControlAction.RESPONSE_OK)
    }
}

6.3 Home Screen Widget

class WolWidget : AppWidgetProvider() {
    override fun onUpdate(
        context: Context,
        appWidgetManager: AppWidgetManager,
        appWidgetIds: IntArray
    ) {
        appWidgetIds.forEach { appWidgetId ->
            val views = RemoteViews(context.packageName, R.layout.widget_wol)
            views.setOnClickPendingIntent(
                R.id.btn_wake,
                PendingIntent.getService(
                    context,
                    0,
                    Intent(context, WidgetWakeService::class.java),
                    PendingIntent.FLAG_IMMUTABLE
                )
            )
            appWidgetManager.updateAppWidget(appWidgetId, views)
        }
    }
}

class WidgetWakeService : Service() {
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        val deviceId = intent?.getStringExtra("device_id")?.let { UUID.fromString(it) } ?: return START_NOT_STICKY
        
        lifecycleScope.launch {
            wakeDeviceUseCase(deviceId)
        }
        
        return START_NOT_STICKY
    }
}

6.4 Dynamic Shortcuts

class ShortcutManager(private val context: Context) {
    fun createWakeShortcuts(devices: List<Device>) {
        val manager = context.getSystemService(android.content.ShortcutManager::class.java)
        val shortcuts = devices.take(4).mapIndexed { index, device ->
            ShortcutInfo.Builder(context, "wake_${device.id}")
                .setShortLabel("Wake ${device.name}")
                .setIcon(Icon.createWithResource(context, R.drawable.ic_wake))
                .setIntent(
                    Intent(Intent.ACTION_VIEW, Uri.parse("wakeonlan://device?id=${device.id}&action=wake"))
                )
                .build()
        }
        manager?.dynamicShortcuts = shortcuts
    }
}

6.5 Deep Links

<activity
    android:name=".ui.main.MainActivity"
    android:exported="true">
    <intent-filter android:label="@string/wake_device">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data
            android:scheme="wakeonlan"
            android:host="device" />
    </intent-filter>
</activity>

Handling:

override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    setContentView(R.layout.activity_main)
    
    intent?.data?.let { uri ->
        val deviceId = uri.getQueryParameter("id")?.let { UUID.fromString(it) }
        val action = uri.getQueryParameter("action")  // "wake" or "shutdown"
        
        if (deviceId != null) {
            when (action) {
                "wake" -> viewModel.wakeDevice(deviceId)
                "shutdown" -> viewModel.shutdownDevice(deviceId)
            }
        }
    }
}

6.6 WorkManager — Device Monitoring

class DeviceMonitorWorker(
    context: Context,
    params: WorkerParameters,
    private val monitorUseCase: MonitorDevicesUseCase
) : CoroutineWorker(context, params) {
    
    override suspend fun doWork(): Result = withContext(Dispatchers.IO) {
        return@withContext try {
            monitorUseCase().collect { result ->
                // Result collected
            }
            Result.success()
        } catch (e: Exception) {
            Result.retry()
        }
    }
    
    companion object {
        fun scheduleMonitoring(context: Context, intervalMinutes: Long = 5) {
            val monitorWork = PeriodicWorkRequestBuilder<DeviceMonitorWorker>(
                Duration.ofMinutes(intervalMinutes),
                Duration.ofMinutes(5)
            ).build()
            
            WorkManager.getInstance(context).enqueueUniquePeriodicWork(
                "device_monitor",
                ExistingPeriodicWorkPolicy.KEEP,
                monitorWork
            )
        }
    }
}

7. Type Conventions

7.1 Result — Sealed Class

sealed class Result<T> {
    data class Success<T>(val data: T) : Result<T>()
    data class Failure<T>(val error: Throwable) : Result<T>()
    
    inline fun <R> map(transform: (T) -> R): Result<R> =
        when (this) {
            is Success -> Success(transform(data))
            is Failure -> Failure(error)
        }
    
    inline fun onSuccess(block: (T) -> Unit): Result<T> = apply {
        if (this is Success) block(data)
    }
    
    inline fun onFailure(block: (Throwable) -> Unit): Result<T> = apply {
        if (this is Failure) block(error)
    }
}

7.2 DeviceStatus — Enum

enum class DeviceStatus {
    ONLINE,
    OFFLINE,
    UNKNOWN;
    
    fun toDisplayString(context: Context): String = when (this) {
        ONLINE -> context.getString(R.string.status_online)
        OFFLINE -> context.getString(R.string.status_offline)
        UNKNOWN -> context.getString(R.string.status_unknown)
    }
}

7.3 OsType — Enum

enum class OsType {
    WINDOWS,
    LINUX,
    MAC;
    
    fun getShutdownCommand(): String = when (this) {
        WINDOWS -> "shutdown /s /t 60"
        LINUX -> "sudo shutdown -h +1"
        MAC -> "sudo osascript -e 'tell app \"System Events\" to shut down'"
    }
}

8. Testing

8.1 Mock Repository

class FakeDeviceRepository : DeviceRepository {
    private val devices = mutableMapOf<UUID, Device>()
    
    override fun getAllDevices(): Flow<List<Device>> =
        flowOf(devices.values.toList())
    
    override suspend fun insertDevice(device: Device): UUID {
        devices[device.id] = device
        return device.id
    }
    
    // ... more methods
}

8.2 Unit Test

@RunWith(JUnit4::class)
class WakeDeviceUseCaseTest {
    
    private val fakDeviceRepository = FakeDeviceRepository()
    private val fakeWolClient = FakeWolClient()
    private val fakeHistoryRepository = FakeHistoryRepository()
    private val useCase = WakeDeviceUseCase(fakeWolClient, fakDeviceRepository, fakeHistoryRepository)
    
    @Test
    fun wakeDevice_success() = runTest {
        val deviceId = UUID.randomUUID()
        fakDeviceRepository.insertDevice(Device(id = deviceId, name = "PC"))
        
        val result = useCase(deviceId)
        
        assertTrue(result.isSuccess)
    }
}

Document maintained alongside code — internal APIs updated when domain changes.

Security — Aweken

Version: 2.0
Stack: SQLCipher · Android Biometric · AndroidKeyStore · SSH RSA/Password

1. Security Model

Aweken implements multiple security layers to protect sensitive data and critical actions:

User attempts action
   │
   ▼
[1] Biometric Lock ────── Fingerprint/face unlock (optional)
   │
   ▼
[2] Local Auth ────────── PIN/pattern (fallback)
   │
   ▼
[3] SQLCipher ────────── Encrypted database at rest
   │
   ▼
[4] SSH Credentials ──── Password or private key (encrypted)
   │
   ▼
[5] Network Security ─── HTTPS for APIs, SSH with host key verification
   │
   ▼
Action executed (WOL, SSH shutdown)

2. Local Authentication — Biometric + PIN

2.1 Biometric Lock

class BiometricManager(context: Context) {
    fun authenticate(
        title: String,
        subtitle: String,
        onSuccess: () -> Unit,
        onFailed: () -> Unit
    ) {
        val biometricPrompt = BiometricPrompt(
            activity,
            ContextCompat.getMainExecutor(context),
            object : BiometricPrompt.AuthenticationCallback() {
                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
                    super.onAuthenticationSucceeded(result)
                    onSuccess()
                }
                
                override fun onAuthenticationFailed() {
                    super.onAuthenticationFailed()
                    onFailed()
                }
            }
        )
        
        biometricPrompt.authenticate(BiometricPrompt.PromptInfo.Builder()
            .setTitle(title)
            .setSubtitle(subtitle)
            .setNegativeButtonText("Cancel")
            .build())
    }
}

Enablement:

Global configuration in Settings
Per-device: apply biometric check only for critical actions (shutdown)
Fallback to PIN if device doesn't support biometric

Lifetimes:

Cache: 5 minutes — after authentication, actions don't require re-authentication
Reset: screen lock timeout or manual lock

2.2 PIN/Pattern Fallback

If device doesn't support biometric or user disables it:

showPinPrompt(
    correctPin = userPin,
    maxAttempts = 3,
    onSuccess = { executeAction() },
    onFailed = { /* Toast: Incorrect PIN */ }
)

Max failed attempts: 3
Temporary lockout: 30 seconds after 3 failures
PIN stored: SHA-256 hashed, never plaintext

3. Secure Storage — SQLCipher

3.1 Database Encryption

val passphrase = EncryptionUtil.generatePassphrase(context)
val database = Room.databaseBuilder(
    context,
    AwekenDatabase::class.java,
    "aweken.db"
)
    .openHelperFactory(SupportFactory(passphrase))  // SQLCipher
    .build()

Technical Details:

Cipher: AES-256-CBC (SQLCipher default)
Key derivation: PBKDF2 with 64000 iterations
Page size: 4096 bytes

Passphrase Generation:

object EncryptionUtil {
    fun generatePassphrase(context: Context): ByteArray {
        val keyStore = KeyStore.getInstance("AndroidKeyStore")
        keyStore.load(null)
        
        val keyAlias = "aweken_db_key"
        if (!keyStore.containsAlias(keyAlias)) {
            val keyGenParameterSpec = KeyGenParameterSpec.Builder(
                keyAlias,
                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
            )
                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                .build()
            
            KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore")
                .init(keyGenParameterSpec)
                .generateKey()
        }
        
        val cipher = Cipher.getInstance(
            KeyProperties.KEY_ALGORITHM_AES + "/" +
            KeyProperties.BLOCK_MODE_GCM + "/" +
            KeyProperties.ENCRYPTION_PADDING_NONE
        )
        val secretKey = keyStore.getKey(keyAlias, null) as SecretKey
        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
        
        val passphrase = ByteArray(32)  // 256 bits
        SecureRandom().nextBytes(passphrase)
        
        return passphrase
    }
}

Benefit: Key is sealed in the device's AndroidKeyStore — cannot be extracted or used on another device.

3.2 Entities with Sensitive Data

Entity	Sensitive Data	Storage
`SshCredential`	Password, private key	Encrypted in SQLCipher
`Device`	IP, hostname	Encrypted in SQLCipher (DB)
`NetworkConfig`	Proxy credentials (if any)	Encrypted in SQLCipher

Access to Sensitive Data:

@Entity
data class SshCredential(
    @PrimaryKey val id: UUID,
    val deviceId: UUID,
    val username: String,
    val password: String?,          // nullable — use key if available
    val privateKeyPath: String?,    // path in app's private FileSystem
    val passphrase: String?         // for password-protected keys
)

Private key files are stored in context.filesDir (private to app, encrypted on Android 10+).

4. SSH Credential Management

4.1 Password Storage

// Save
val encrypted = encryptPassword(plainPassword, context)
repository.saveSshCredential(
    deviceId = device.id,
    username = "admin",
    password = encrypted,
    privateKeyPath = null
)

// Retrieve and decrypt
val credential = repository.getSshCredential(device.id)
val plainPassword = decryptPassword(credential.password, context)
sshClient.connect(device.ip, username, plainPassword)

Decryption:

Only in memory (RAM)
Never logged
Cleared after use (.fill(0) on ByteArray)

4.2 Private Key Storage

// Save
val keyFile = File(context.filesDir, "ssh_key_${device.id}")
keyFile.writeText(privateKeyPem)  // Stored in private filesDir

// Retrieve and use
val keyFile = File(context.filesDir, "ssh_key_${device.id}")
val keyContent = keyFile.readText()
sshClient.connectWithKey(
    host = device.ip,
    username = "admin",
    privateKey = keyContent,
    passphrase = credential.passphrase  // if password-protected
)

Security:

Files in context.filesDir → private to app
On Android 10+, storage is encrypted by the system
Permissions: only app can read (mode = Context.MODE_PRIVATE)

4.3 Host Key Verification

sshClient.setKnownHostsProvider { hostKey ->
    // Compare against previously stored key
    repository.getStoredHostKey(device.ip)?.let { stored ->
        if (stored.fingerprint == hostKey.fingerprint) {
            HostKeyVerifier.Result.ACCEPT
        } else {
            // Potential MITM — deny
            HostKeyVerifier.Result.DENY
        }
    } ?: HostKeyVerifier.Result.ACCEPT_ONCE  // First connection
}

Prevents man-in-the-middle (MITM) attacks by verifying SSH server identity.

5. Network Communication

5.1 Wake-on-LAN (UDP)

// Magic Packet broadcast
val packet = DatagramPacket(magicPacket, magicPacket.size, InetAddress.getByName(broadcast), 9)
val socket = DatagramSocket()
socket.broadcast = true
socket.send(packet)
socket.close()

No authentication required — WOL is unauthenticated by design (device is powered off, cannot verify identity).

Mitigation:

Only sent within LAN (local broadcast)
For WAN, use authenticated WOL proxy (intermediary server)

5.2 SSH (TCP Port 22)

val session = jsch.getSession(username, host, 22)
session.setPassword(password)
session.setConfig("StrictHostKeyChecking", "yes")  // Verify host key
session.setConfig("PreferredAuthentications", "password,publickey")
session.connect(timeout = 5000)  // 5 seconds

// Execute command
val channel = session.openChannel("exec") as ChannelExec
channel.setCommand("shutdown -h now")
channel.connect()
channel.disconnect()
session.disconnect()

Security Configuration:

Host key verification enforced
Short timeout (5 seconds)
Password or public key authentication only
No interactive shell (exec only)

5.3 ICMP Ping (unencrypted)

// ICMP Echo Request — no encryption, host identification
val pinger = IcmpPinger()
val result = pinger.ping(ipAddress, timeout = 3000)
println("Latency: ${result.latency}ms, TTL: ${result.ttl}")

Consideration: ICMP is unencrypted — pings can be monitored. No sensitive data sent.

6. Android Permissions

6.1 Dangerous Permissions

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
<uses-permission android:name="android.permission.USE_BIOMETRIC" />

INTERNET: WOL, SSH, ICMP
ACCESS_NETWORK_STATE: Detect network changes (Wi-Fi/mobile)
CHANGE_NETWORK_STATE: Socket broadcast
ACCESS_FINE_LOCATION: (optional) for future geofencing
POST_NOTIFICATIONS: Monitoring alerts
USE_BIOMETRIC: Biometric authentication

All require runtime permissions on Android 6.0+.

6.2 Trusted Networks

// Skip biometric on known Wi-Fi networks
val knownNetworks = setOf("MyHomeWiFi", "OfficeWiFi")

val currentSSID = connectivityManager.getNetworkCapabilities(network)
    ?.let { /* parse SSID */ }

if (currentSSID in knownNetworks) {
    // Allow actions without biometric check
    executeWakeCommand()
} else {
    // Require biometric
    biometricManager.authenticate(onSuccess = ::executeWakeCommand)
}

7. Auditing — Activity Log

@Entity
data class HistoryEvent(
    @PrimaryKey val id: UUID,
    val deviceId: UUID,
    val deviceName: String,
    val action: String,  // "WAKE", "SHUTDOWN", "PING"
    val status: String,  // "SUCCESS", "FAILED", "TIMEOUT"
    val timestamp: Long,
    val ipAddress: String,
    val macAddress: String
)

Logging:

All actions recorded in encrypted database
Timestamp in UTC
No credentials included

Access:

In-app interface (History tab)
Not exportable (except full backup)

8. Data Export / Import

8.1 JSON Backup

val backup = DeviceBackup(
    version = 2,
    exportedAt = System.currentTimeMillis(),
    devices = repository.getAllDevices().map { device ->
        DeviceBackupModel(
            id = device.id,
            name = device.name,
            macAddress = device.macAddress,
            ipAddress = device.ipAddress,
            // SSH Credentials: NOT included in backup (too sensitive)
            // Or encrypt them with backup password
        )
    }
)

val json = Gson().toJson(backup)
exportToFile(json)  // Save to Downloads (user controls access)

User Recommendation:

Backup: include only devices, not SSH credentials
If exporting credentials, protect with password (AES-256)
Store backup in secure location (encrypted Drive, etc.)

9. Firebase — Optional

9.1 Crashlytics

FirebaseCrashlytics.getInstance().recordException(throwable)

Reports crashes without including user data (filtered).

9.2 Analytics

FirebaseAnalytics.getInstance(context).logEvent("device_wake", bundleOf(
    "device_id" to device.id.toString(),  // Anonymized
    "network_type" to "LAN"
))

Usage metrics: no real IPs or MACs.

9.3 Remote Config

val remoteConfig = Firebase.remoteConfig
remoteConfig.fetchAndActivate().addOnCompleteListener {
    val monitoringEnabled = remoteConfig.getBoolean("monitoring_enabled")
    val updateCheckInterval = remoteConfig.getLong("update_check_interval_minutes")
}

Feature flags to enable/disable functionality without updating the app.

Privacy: Firebase is optional — app works without google-services.json.

10. Design Decisions

10.1 SQLCipher over SharedPreferences

Decision: Encrypted SQL database.
Why: SharedPreferences is insecure for SSH credentials. SQLCipher is the Android standard for protected storage.

10.2 AndroidKeyStore for database key

Decision: Generate SQLCipher passphrase from AndroidKeyStore.
Why: Keys are sealed in hardware (TEE/Secure Enclave if available). Impossible to extract.

10.3 5-minute biometric cache

Decision: Cache authentication.
Why: Re-requiring biometric for each action is poor UX. 5 minutes balances usability and security.

10.4 HTTPS for external APIs (if any)

Decision: Enforce HTTPS; verify certificates.
Why: Prevents MITM on public Wi-Fi. OkHttp interceptors validate certificates.

10.5 Don't store credentials in memory between sessions

Decision: Credentials only in RAM during execution.
Why: A crash or memory dump could expose credentials. Better to retrieve them from encrypted storage when needed.

11. Future Considerations

11.1 Hardware Security Module (HSM)

On Android 10+, can force TEE for certain operations:

val spec = KeyGenParameterSpec.Builder(alias, purpose)
    .setIsStrongBoxBacked(true)  // Force TEE/StrongBox
    .build()

11.2 Biometric Strong (Level 3)

Requires hardware verification, not software:

val authenticators = BiometricManager.Authenticators.BIOMETRIC_STRONG

11.3 Multi-factor Authentication (MFA)

Combine biometric + PIN for maximum security in critical actions (shutdown).

Document maintained alongside code — security configurations defined in Hilt modules and strings.xml (expiration times, etc.).