Align native encrypted sync with the key-broker request contract

.github/workflows/parity-build.yml

@@ -2,7 +2,7 @@ name: Android parity build
 
 on:
   push:
-    branches: [web-mobile-ui-parity]
+    branches: [main, web-mobile-ui-parity]
   pull_request:
     branches: [main]
   workflow_dispatch:
@@ -22,12 +22,12 @@ jobs:
           java-version: '17'
       - uses: gradle/actions/setup-gradle@v4
         with:
-          gradle-version: current
-      - name: Compile Android app
+          gradle-version: '9.6.0'
+      - name: Compile and validate Android app
         shell: bash
         run: |
           set -o pipefail
-          gradle :app:compileDebugKotlin --stacktrace 2>&1 | tee build.log
+          gradle :app:compileDebugKotlin :app:testDebugUnitTest :app:lintDebug --stacktrace 2>&1 | tee build.log
       - name: Report build diagnostics
         if: ${{ failure() && github.event_name == 'pull_request' }}
         env:

README.md

@@ -175,3 +175,17 @@ Original project code and documentation are available under the [MIT License](LI
 [Open Gapwise →](https://gapwise.ca)
 
 </div>
+
+### Local validation
+
+Use Java 17 or newer, the Android SDK configured for this project, and Gradle 9.6.0
+(the version in `gradle/wrapper/gradle-wrapper.properties` and CI):
+
+```bash
+gradle :app:compileDebugKotlin :app:testDebugUnitTest :app:lintDebug
+```
+
+The repository currently contains wrapper properties but no wrapper executable/JAR, so
+install that Gradle version explicitly. The optional encrypted-sync adapter must send the
+key broker's first-party `Origin` as well as the user's bearer token; the broker's web origin
+guard remains enforced. Device/Keystore/OAuth behavior still needs emulator or device validation.

app/src/main/java/ca/gapwise/android/data/sync/EncryptedCloudSync.kt

@@ -460,6 +460,11 @@ class EncryptedCloudSync(private val accounts: GapwiseAccountManager) {
             readTimeout = 15_000
             setRequestProperty("Accept", "application/json")
             setRequestProperty("Authorization", "Bearer $accessToken")
+            // The first-party broker enforces the same explicit origin contract as the web client.
+            if (url == GapwiseCloudConfig.KEY_BROKER_URL) {
+                val endpoint = URL(url)
+                setRequestProperty("Origin", "${endpoint.protocol}://${endpoint.authority}")
+            }
             if (includeApiKey) setRequestProperty("apikey", GapwiseCloudConfig.SUPABASE_PUBLISHABLE_KEY)
             if (preferRepresentation) setRequestProperty("Prefer", "return=representation")
             if (body != null) {