# TASK-066: download page and in-app update check

Status: done; superseded by TASK-070 (the page and its publishing script are no longer used)
Owner: Claude
Reviewer: human product owner

## Request

The human product owner asked for a web link to download the app, protected by a download
password they chose, and for the app to offer the newest version when it is not on it. They chose
to host it in a folder of the existing `choimy0204.github.io` site.

## Acceptance criteria

- `https://choimy0204.github.io/ubgitea/` serves a page that asks for the password and only then
  gives the APK. The APK on the host is encrypted (AES-256-GCM, key from PBKDF2-SHA256), so its
  address alone gives nothing. The password is not in this repository.
- `version.json` beside it names the newest versionCode, versionName and notes.
- The app reads it once at launch; when it is newer than the installed build, a dialog offers the
  download page. Settings shows the installed version, a check button, and the download page when
  something newer is out. No Gitea token is sent to that host.
- `tools/publish-download.py` builds the page from an APK; versionCode is raised for every build
  published.

## Writable paths

`app/build.gradle.kts`, `app/src/main/java/com/ubisam/ubgitea/core/update/`, `MainActivity.kt`,
`feature/settings/SettingsScreen.kt`, `res/values/strings_update.xml`, `app/src/test/.../core/update/`,
`tools/publish-download.py`, `docs/development-log.md`, this file.

## Checks

```text
./gradlew compileDebugKotlin compileDebugUnitTestKotlin testDebugUnitTest assembleDebug lintDebug
```

## Evidence

- 2026-10-07: the required checks pass; 468 unit tests, 0 failures; lint 0 errors.
- The page's decryption was run with Node's WebCrypto (the browser's API): the right password
  gives a file byte-identical to `app-debug.apk`, a wrong one is refused.
- Published version 0.2.0 (versionCode 2), the debug build, to `choimy0204.github.io/ubgitea/`.
- Not seen: the page opened on a phone, the install over an existing copy, the in-app dialog.

## Review findings

- 2026-10-07, product owner: a wrong password still downloaded. In a desktop browser a wrong
  password got nothing, but the page fetched the encrypted APK before checking the password,
  and a phone browser can keep that fetch as a download (still encrypted, not installable). The
  page now opens a small sealed check with the password first and fetches nothing when it is
  wrong; tried in the browser: a wrong password made no request, the right one downloaded.