fix: [SDK-4753] narrow overly broad consumer ProGuard/R8 keep rules

OneSignalSDK/onesignal/core/consumer-rules.pro

@@ -1,19 +1,39 @@
--dontwarn com.onesignal.**
-
+# Amazon ADM is a compileOnly dependency; suppress missing-class warnings when the app omits it.
 -dontwarn com.amazon.**
 
--keepclassmembers class com.onesignal.core.** { *; }
-
--keepclassmembers class com.onesignal.session.** { *; }
-
--keepclassmembers class com.onesignal.user.** { *; }
-
--keepclassmembers class com.onesignal.internal.** { *; }
-
--keepclassmembers class com.onesignal.debug.** { *; }
-
--keepclassmembers class com.onesignal.common.** { *; }
-
+# ServiceRegistrationReflection.resolve matches constructors via genericParameterTypes
+# (e.g. List<IBackgroundService>). Keep Signature so R8 cannot strip that metadata.
+-keepattributes Signature
+
+# Service implementations are instantiated by reflectively selecting a constructor
+# (ServiceRegistrationReflection.resolve -> constructor.newInstance). The classes are retained via
+# ::class.java literals in the modules, so only their constructors need protecting here.
+-keepclassmembers class com.onesignal.** {
+    <init>(...);
+}
+
+# Models are populated from JSON by matching getter method *names* via reflection
+# (Model.initializeFromJson looks up "get<Property>"). Kotlin boolean properties also expose
+# is*() getters that must keep their names. No allowobfuscation.
+-keepclassmembers class * extends com.onesignal.common.modeling.Model {
+    *** get*();
+    *** is*();
+}
+
+# Enum constants are looked up by name via valueOf/enumValueOf against server-supplied strings
+# (e.g. Model.getOptEnumProperty -> ConfigModel.logLevel from remote-params JSON). Their names must
+# survive obfuscation, so keep enum fields and the synthetic values()/valueOf(String) methods.
+-keepclassmembers enum com.onesignal.** {
+    <fields>;
+    public static **[] values();
+    public static ** valueOf(java.lang.String);
+}
+
+# Optional feature modules are loaded by fully-qualified name (OneSignalImp loads them via
+# Class.forName(...).newInstance()), so the name must be preserved and a no-arg constructor kept.
+-keep class ** implements com.onesignal.common.modules.IModule {
+    <init>();
+}
+
+# Fallback "misconfigured" managers are reflectively constructed when an optional module is absent.
 -keepclassmembers @com.onesignal.core.internal.minification.KeepStub class * { <init>(...); }
-
--keep class ** implements com.onesignal.common.modules.IModule { *; }

OneSignalSDK/onesignal/in-app-messages/consumer-rules.pro

@@ -1,3 +1,13 @@
--dontwarn com.onesignal.iam.**
+# In-app-messages service implementations are instantiated via reflective constructor selection
+# (ServiceRegistrationReflection). Keep only their constructors.
+-keepclassmembers class com.onesignal.inAppMessages.** {
+    <init>(...);
+}
 
--keepclassmembers class com.onesignal.inAppMessages.** { *; }
+# IAM display Position is resolved via Position.valueOf(serverString) (WebViewManager) and the
+# IllegalArgumentException on a renamed constant is uncaught. Keep enum constant names.
+-keepclassmembers enum com.onesignal.inAppMessages.** {
+    <fields>;
+    public static **[] values();
+    public static ** valueOf(java.lang.String);
+}

OneSignalSDK/onesignal/location/consumer-rules.pro

@@ -1,3 +1,19 @@
--dontwarn com.onesignal.location.**
+# Location service implementations are instantiated via reflective constructor selection
+# (ServiceRegistrationReflection). Keep only their constructors.
+-keepclassmembers class com.onesignal.location.** {
+    <init>(...);
+}
 
--keepclassmembers class com.onesignal.location.** { *; }
+# GMS and HMS location libraries are compileOnly; LocationModule references both
+# GmsLocationController and HmsLocationController directly, so an app that ships only one
+# provider will see the other's classes as missing at R8 time.
+-dontwarn com.google.android.gms.**
+-dontwarn com.huawei.**
+
+# GoogleApiClientCompatProxy invokes these GMS methods reflectively by string name (for
+# compatibility across Google Play services versions), so their names must be preserved.
+-keepclassmembers class com.google.android.gms.common.api.GoogleApiClient {
+    com.google.android.gms.common.ConnectionResult blockingConnect();
+    void connect();
+    void disconnect();
+}

OneSignalSDK/onesignal/notifications/consumer-rules.pro

@@ -1,72 +1,51 @@
--dontwarn com.onesignal.notification.**
-
-# These 2 methods are called with reflection.
--keep class com.google.android.gms.common.api.GoogleApiClient {
-    void connect();
-    void disconnect();
-}
-
-# Need to keep as these 2 methods are called with reflection from com.onesignal.PushRegistratorFCM
--keep class com.google.firebase.iid.FirebaseInstanceId {
-    static com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp);
-    java.lang.String getToken(java.lang.String, java.lang.String);
-}
-
--keep class ** implements com.onesignal.notifications.IPermissionObserver{
-    void onNotificationPermissionChange(java.lang.Boolean);
-}
-
--keep class ** implements com.onesignal.user.subscriptions.IPushSubscriptionObserver {
-    void onPushSubscriptionChange(com.onesignal.user.subscriptions.PushSubscriptionChangedState);
-}
-
--keep class ** implements com.onesignal.user.state.IUserStateObserver {
-    void onUserStateChange(com.onesignal.user.state.UserChangedState);
-}
-
--keep class ** implements com.onesignal.notifications.INotificationServiceExtension{
+# The notification service extension class is named in the app's AndroidManifest <meta-data> and is
+# reflectively instantiated (NotificationLifecycleService -> Class.forName(name).newInstance()), so the
+# class name and its no-arg constructor must be preserved.
+-keep class ** implements com.onesignal.notifications.INotificationServiceExtension {
+   <init>();
    void onNotificationReceived(com.onesignal.notifications.INotificationReceivedEvent);
 }
 
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.AdwHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.ApexHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.AsusHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.DefaultBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.EverythingMeHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.HuaweiHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.LGHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.NewHtcHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.NovaHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.OPPOHomeBader { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.SamsungHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.SonyHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.VivoHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.XiaomiHomeBadger { <init>(...); }
--keep class com.onesignal.notifications.internal.badges.impl.shortcutbadger.impl.ZukHomeBadger { <init>(...); }
+# Home-screen badgers are instantiated via newInstance() from a list of class literals
+# (ShortcutBadger.initBadger), so each implementation needs its constructor kept.
+-keep class * implements com.onesignal.notifications.internal.badges.impl.shortcutbadger.Badger {
+    <init>(...);
+}
 
+# Optional / excludable push providers are referenced directly by the provider-specific
+# registrators. firebase-messaging is api (pulled in by default) but Huawei apps routinely
+# exclude it; play-services-base, HMS, and ADM are compileOnly. When a consuming app omits a
+# provider, those classes are absent at R8 time: Huawei-only apps drop firebase-messaging (and
+# typically have no Play services), so PushRegistratorFCM's com.google.firebase.** /
+# com.google.android.gms.tasks.** and GooglePlayServicesUpgradePrompt's
+# com.google.android.gms.common.** are missing; GMS apps omit HMS (com.huawei.**) and ADM
+# (com.amazon.**). Suppress the missing-class errors for all of them.
 -dontwarn com.huawei.**
 -dontwarn com.amazon.**
+-dontwarn com.google.firebase.**
+-dontwarn com.google.android.gms.**
 
-# Proguard ends up removing this class even if it is used in AndroidManifest.xml so force keeping it.
--keep public class com.onesignal.notifications.services.ADMMessageHandler {*;}
+# ADM handlers are instantiated by name from the app manifest AND their on* lifecycle callbacks
+# (onMessage/onRegistered/onRegistrationError/onUnregistered) are invoked by the ADM framework, not
+# the SDK, so keep both constructors and those methods. (Amazon-device-only path, untestable in CI.)
+-keep public class com.onesignal.notifications.services.ADMMessageHandler { <init>(...); void on*(...); }
+-keep public class com.onesignal.notifications.services.ADMMessageHandlerJob { <init>(...); void on*(...); }
 
--keep public class com.onesignal.notifications.services.ADMMessageHandlerJob {*;}
-
--keep class com.onesignal.JobIntentService$* {*;}
-
--keepclassmembers class com.onesignal.notifications.** { *; }
+# Notification service implementations are instantiated via reflective constructor selection
+# (ServiceRegistrationReflection). Keep only their constructors.
+-keepclassmembers class com.onesignal.notifications.** {
+    <init>(...);
+}
 
-# Keep OneSignal WorkManager workers and constructors used for runtime instantiation.
+# WorkManager instantiates workers via reflection using the (Context, WorkerParameters) constructor.
 -keep class com.onesignal.notifications.internal.** extends androidx.work.ListenableWorker {
     public <init>(android.content.Context, androidx.work.WorkerParameters);
 }
 
 # WorkManager instantiates InputMerger classes via reflection (InputMerger.fromClassName).
 # R8 full mode (AGP 8+) strips no-arg constructors, causing:
 # java.lang.NoSuchMethodException: androidx.work.OverwritingInputMerger.<init>()
-# WM-WorkerWrapper E Could not create Input Merger androidx.work.OverwritingInputMerger
 # Keep all InputMerger subclasses (OverwritingInputMerger, ArrayCreatingInputMerger, etc.)
 -keep class * extends androidx.work.InputMerger {
     public <init>();
 }
-

examples/demo/app/build.gradle.kts

@@ -98,7 +98,7 @@ android {
             signingConfig = signingConfigs.getByName("debug")
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro"
+                "proguard-rules.pro",
             )
         }
         debug {