wifi: Check AAPM flag before calling AAPM API

Also, use AAPM flag instead of WEP flag for API flag
since it has dependency on AAPM class.

Flag: android.security.aapm_api
Bug: 362586268
Test: TH
Change-Id: I21617904c6b61f245c84f81c4af4b13e42b2bb1e

7 files changed, 16 insertions, 8 deletions

diff --git a/framework/Android.bp b/framework/Android.bp
index b9d394776c..497e7c6157 100644
--- a/framework/Android.bp
+++ b/framework/Android.bp
@@ -119,6 +119,7 @@ java_defaults {
         // library for generated flag code read new storage
         "aconfig_storage_reader_java",
         "framework-configinfrastructure.stubs.module_lib",
+        "android.security.flags-aconfig-java-export",
     ],
     aidl: {
         generate_get_transaction_name: true,
diff --git a/framework/api/system-current.txt b/framework/api/system-current.txt
index 1d19d95276..c5e9f261aa 100644
--- a/framework/api/system-current.txt
+++ b/framework/api/system-current.txt
@@ -782,7 +782,7 @@ package android.net.wifi {
     method @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_SETUP_WIZARD, android.Manifest.permission.NETWORK_STACK}) public void forget(int, @Nullable android.net.wifi.WifiManager.ActionListener);
     method @NonNull @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_SETUP_WIZARD}) public java.util.List<android.util.Pair<android.net.wifi.WifiConfiguration,java.util.Map<java.lang.Integer,java.util.List<android.net.wifi.ScanResult>>>> getAllMatchingWifiConfigs(@NonNull java.util.List<android.net.wifi.ScanResult>);
     method @FlaggedApi("com.android.wifi.flags.autojoin_restriction_security_types_api") @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.MANAGE_WIFI_NETWORK_SELECTION}) public void getAutojoinDisallowedSecurityTypes(@NonNull java.util.concurrent.Executor, @NonNull java.util.function.Consumer<int[]>);
-    method @FlaggedApi("com.android.wifi.flags.wep_disabled_in_apm") @NonNull public java.util.List<android.security.advancedprotection.AdvancedProtectionFeature> getAvailableAdvancedProtectionFeatures();
+    method @FlaggedApi("android.security.aapm_api") @NonNull public java.util.List<android.security.advancedprotection.AdvancedProtectionFeature> getAvailableAdvancedProtectionFeatures();
     method @FlaggedApi("com.android.wifi.flags.get_bssid_blocklist_api") @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_SETUP_WIZARD}) public void getBssidBlocklist(@NonNull java.util.List<android.net.wifi.WifiSsid>, @NonNull java.util.concurrent.Executor, @NonNull java.util.function.Consumer<java.util.List<android.net.MacAddress>>);
     method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.ACCESS_COARSE_LOCATION}) public String getCountryCode();
     method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_SETUP_WIZARD}) public android.net.Network getCurrentNetwork();
diff --git a/framework/jarjar-rules.txt b/framework/jarjar-rules.txt
index 598c014b71..920bb0f120 100644
--- a/framework/jarjar-rules.txt
+++ b/framework/jarjar-rules.txt
@@ -96,6 +96,10 @@ rule android.net.wifi.flags.*FeatureFlags* com.android.wifi.x.@0
 rule android.net.wifi.flags.FeatureFlags* com.android.wifi.x.@0
 rule android.net.wifi.flags.Flags com.android.wifi.x.@0
 
+rule android.security.*FeatureFlags* com.android.wifi.x.@0
+rule android.security.FeatureFlags* com.android.wifi.x.@0
+rule android.security.Flags com.android.wifi.x.@0
+
 # Use our statically linked bouncy castle library
 rule org.bouncycastle.** com.android.wifi.x.@0
 # Use our statically linked protobuf library
diff --git a/framework/java/android/net/wifi/WifiManager.java b/framework/java/android/net/wifi/WifiManager.java
index f0212c034e..f36196a873 100644
--- a/framework/java/android/net/wifi/WifiManager.java
+++ b/framework/java/android/net/wifi/WifiManager.java
@@ -13167,17 +13167,18 @@ public class WifiManager {
      * @hide
      */
     @SystemApi
-    @FlaggedApi(Flags.FLAG_WEP_DISABLED_IN_APM)
+    @FlaggedApi(android.security.Flags.FLAG_AAPM_API)
     @RequiresApi(Build.VERSION_CODES.BAKLAVA)
-    @SuppressLint("ReferencesHidden")
     @NonNull
     public List<AdvancedProtectionFeature> getAvailableAdvancedProtectionFeatures() {
         if (!Environment.isSdkAtLeastB()) {
             throw new UnsupportedOperationException();
         }
-        List<AdvancedProtectionFeature> features = List.of(
-        // TODO: b/362586268 Change to AdvancedProtectionManager.FEATURE_ID_DISALLOW_WEP
-                new AdvancedProtectionFeature("WEP"));
+        List<AdvancedProtectionFeature> features = new ArrayList<>();
+        if (Flags.wepDisabledInApm()) {
+            // TODO: b/362586268 Change to AdvancedProtectionManager.FEATURE_ID_DISALLOW_WEP
+            features.add(new AdvancedProtectionFeature("WEP"));
+        }
         return features;
     }
 }
diff --git a/service/Android.bp b/service/Android.bp
index b2455fa717..797fc73ff7 100644
--- a/service/Android.bp
+++ b/service/Android.bp
@@ -124,6 +124,7 @@ java_library {
         "wifi-lite-protos",
         "wifi-nano-protos",
         "android.net.wifi.flags-aconfig-java",
+        "android.security.flags-aconfig-java-export",
         "net-utils-service-wifi",
     ],
     apex_available: ["com.android.wifi"],
diff --git a/service/java/com/android/server/wifi/WifiDeviceStateChangeManager.java b/service/java/com/android/server/wifi/WifiDeviceStateChangeManager.java
index 8a93f4c5d5..6efa28fc90 100644
--- a/service/java/com/android/server/wifi/WifiDeviceStateChangeManager.java
+++ b/service/java/com/android/server/wifi/WifiDeviceStateChangeManager.java
@@ -24,6 +24,7 @@ import android.content.IntentFilter;
 import android.net.wifi.util.Environment;
 import android.os.Handler;
 import android.os.PowerManager;
+import android.security.Flags;
 import android.security.advancedprotection.AdvancedProtectionManager;
 import android.text.TextUtils;
 import android.util.ArraySet;
@@ -97,8 +98,7 @@ public class WifiDeviceStateChangeManager {
                 },
                 filter);
         handleScreenStateChanged(mPowerManager.isInteractive());
-        //TODO: b/362586268 - check AAPM API flag.
-        if (Environment.isSdkAtLeastB() && mFeatureFlags.wepDisabledInApm()) {
+        if (Environment.isSdkAtLeastB() && mFeatureFlags.wepDisabledInApm() && Flags.aapmApi()) {
             mAdvancedProtectionManager =
                     mContext.getSystemService(AdvancedProtectionManager.class);
             if (mAdvancedProtectionManager != null) {
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiDeviceStateChangeManagerTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiDeviceStateChangeManagerTest.java
index 0a73e25d78..ec3c259f11 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiDeviceStateChangeManagerTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiDeviceStateChangeManagerTest.java
@@ -123,6 +123,7 @@ public class WifiDeviceStateChangeManagerTest extends WifiBaseTest {
     @Test
     public void testCallbackWhenAdvancedProtectionModeSupported() {
         assumeTrue(Environment.isSdkAtLeastB());
+        assumeTrue(android.security.Flags.aapmApi());
         ArgumentCaptor<AdvancedProtectionManager.Callback> apmCallbackCaptor =
                 ArgumentCaptor.forClass(AdvancedProtectionManager.Callback.class);
         when(mFeatureFlags.wepDisabledInApm()).thenReturn(true);