Allow screenOffScan to holders of MEDIA_CONTENT_CONTROL

Before this change, only holders of MEDIA_ROUTING_CONTROL are allowed to
perform screen off scans. But MEDIA_ROUTING_CONTROL is an appopp
permission that's not available to privileged apps via pre-granting.

MEDIA_CONTENT_CONTROL is a privileged permission that's pre-grantable.

Bug: b/352401364
Test: atest CtsMediaBetterTogetherTestCases CtsMediaHostTestCases
Flag: com.android.media.flags.enable_full_scan_with_media_content_control
Change-Id: I1118bf56a03977ddcfdf37c21f14f532ff3ad0d5

4 files changed, 47 insertions, 4 deletions

diff --git a/media/java/android/media/MediaRouter2.java b/media/java/android/media/MediaRouter2.java
index 0667bfda7596..1930c3d8b9b7 100644
--- a/media/java/android/media/MediaRouter2.java
+++ b/media/java/android/media/MediaRouter2.java
@@ -107,7 +107,8 @@ public final class MediaRouter2 {
      * #SCANNING_STATE_WHILE_INTERACTIVE}.
      *
      * <p>Routers requesting unrestricted scanning must hold {@link
-     * Manifest.permission#MEDIA_ROUTING_CONTROL}.
+     * Manifest.permission#MEDIA_ROUTING_CONTROL} or {@link
+     * Manifest.permission#MEDIA_CONTENT_CONTROL}.
      *
      * @hide
      */
@@ -522,11 +523,16 @@ public final class MediaRouter2 {
      *
      * <p>{@code scanRequest} specifies relevant scanning options, like whether the system should
      * scan with the screen off. Screen off scanning requires {@link
-     * Manifest.permission#MEDIA_ROUTING_CONTROL}
+     * Manifest.permission#MEDIA_ROUTING_CONTROL} or {@link
+     * Manifest.permission#MEDIA_CONTENT_CONTROL}.
      *
      * <p>Proxy routers use the registered {@link RouteDiscoveryPreference} of their target routers.
      *
      * @return A unique {@link ScanToken} that identifies the scan request.
+     * @throws SecurityException If a {@link ScanRequest} with {@link
+     *     ScanRequest.Builder#setScreenOffScan} true is passed, while not holding {@link
+     *     Manifest.permission#MEDIA_ROUTING_CONTROL} or {@link
+     *     Manifest.permission#MEDIA_CONTENT_CONTROL}.
      */
     @FlaggedApi(FLAG_ENABLE_SCREEN_OFF_SCANNING)
     @NonNull
@@ -1745,8 +1751,9 @@ public final class MediaRouter2 {
 
             /**
              * Sets whether the app is requesting to scan even while the screen is off, bypassing
-             * default scanning restrictions. Only companion apps holding {@link
-             * Manifest.permission#MEDIA_ROUTING_CONTROL} should set this to {@code true}.
+             * default scanning restrictions. Only apps holding {@link
+             * Manifest.permission#MEDIA_ROUTING_CONTROL} or {@link
+             * Manifest.permission#MEDIA_CONTENT_CONTROL} should set this to {@code true}.
              *
              * @see #requestScan(ScanRequest)
              */
diff --git a/media/java/android/media/flags/media_better_together.aconfig b/media/java/android/media/flags/media_better_together.aconfig
index 91c4f118658a..7c41f968a03b 100644
--- a/media/java/android/media/flags/media_better_together.aconfig
+++ b/media/java/android/media/flags/media_better_together.aconfig
@@ -134,3 +134,13 @@ flag {
         purpose: PURPOSE_BUGFIX
     }
 }
+
+flag {
+    name: "enable_full_scan_with_media_content_control"
+    namespace: "media_better_together"
+    description: "Allows holders of the MEDIA_CONTENT_CONTROL permission to scan for routes while not in the foreground."
+    bug: "352401364"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}
diff --git a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
index 9acf0301ce42..1070f2f8faf1 100644
--- a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
+++ b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
@@ -328,6 +328,12 @@ class MediaRouter2ServiceImpl {
         }
     }
 
+    @RequiresPermission(
+            anyOf = {
+                Manifest.permission.MEDIA_ROUTING_CONTROL,
+                Manifest.permission.MEDIA_CONTENT_CONTROL
+            },
+            conditional = true)
     public void updateScanningState(
             @NonNull IMediaRouter2 router, @ScanningState int scanningState) {
         Objects.requireNonNull(router, "router must not be null");
@@ -1216,6 +1222,12 @@ class MediaRouter2ServiceImpl {
         disposeUserIfNeededLocked(userRecord); // since router removed from user
     }
 
+    @RequiresPermission(
+            anyOf = {
+                Manifest.permission.MEDIA_ROUTING_CONTROL,
+                Manifest.permission.MEDIA_CONTENT_CONTROL
+            },
+            conditional = true)
     @GuardedBy("mLock")
     private void updateScanningStateLocked(
             @NonNull IMediaRouter2 router, @ScanningState int scanningState) {
@@ -1226,7 +1238,11 @@ class MediaRouter2ServiceImpl {
             return;
         }
 
+        boolean enableScanViaMediaContentControl =
+                Flags.enableFullScanWithMediaContentControl()
+                        && routerRecord.mHasMediaContentControlPermission;
         if (scanningState == SCANNING_STATE_SCANNING_FULL
+                && !enableScanViaMediaContentControl
                 && !routerRecord.mHasMediaRoutingControl) {
             throw new SecurityException("Screen off scan requires MEDIA_ROUTING_CONTROL");
         }
@@ -1679,7 +1695,11 @@ class MediaRouter2ServiceImpl {
             return;
         }
 
+        boolean enableScanViaMediaContentControl =
+                Flags.enableFullScanWithMediaContentControl()
+                        && managerRecord.mHasMediaContentControl;
         if (!managerRecord.mHasMediaRoutingControl
+                && !enableScanViaMediaContentControl
                 && scanningState == SCANNING_STATE_SCANNING_FULL) {
             throw new SecurityException("Screen off scan requires MEDIA_ROUTING_CONTROL");
         }
diff --git a/services/core/java/com/android/server/media/MediaRouterService.java b/services/core/java/com/android/server/media/MediaRouterService.java
index 1188a0764051..363b8e4228b0 100644
--- a/services/core/java/com/android/server/media/MediaRouterService.java
+++ b/services/core/java/com/android/server/media/MediaRouterService.java
@@ -443,6 +443,12 @@ public final class MediaRouterService extends IMediaRouterService.Stub
 
     // Binder call
     @Override
+    @RequiresPermission(
+            anyOf = {
+                Manifest.permission.MEDIA_ROUTING_CONTROL,
+                Manifest.permission.MEDIA_CONTENT_CONTROL
+            },
+            conditional = true)
     public void updateScanningStateWithRouter2(
             IMediaRouter2 router, @ScanningState int scanningState) {
         mService2.updateScanningState(router, scanningState);