Add RemoteConfigManager and TopicFetcher

[tonidero]

Motivation

Builds on #3435 by adding the orchestration layer that turns a remote-config response into a populated on-disk cache of topic blobs. With this PR, calling RemoteConfigManager.updateRemoteConfigIfNeeded will (a) hit the backend for the latest manifest and (b) download every referenced topic blob, verify its SHA-256, and persist it under noBackupFilesDir. Subsequent stack PRs build on this orchestration.

Description

Adds two classes in the remoteconfig package:

• TopicFetcher — exposes suspend fun fetchTopicIfNeeded(topic, variant, topicEntry, source): PurchasesError?. Given the inputs, downloads the blob from source.urlFormat (with {blob_ref} substituted), writes to a temp file, verifies SHA-256 against topicEntry.blobRef, and atomically renames into noBackupFilesDir/RevenueCat/topics/<topic.key>/<blobRef>. The blocking I/O is wrapped in withContext(Dispatchers.IO). Skips the download entirely when the target file already exists. Errors surface as PurchasesError(NetworkError, ...) for checksum mismatch or IOException → toPurchasesError() for transport failures.
• RemoteConfigManager — keeps a callback boundary externally (fun updateRemoteConfigIfNeeded(appInBackground, completion)) since its caller (PurchasesOrchestrator) is callback-shaped. Internally launches a private suspend fun refresh(...) on a private CoroutineScope(SupervisorJob() + dispatcher) (dispatcher: CoroutineDispatcher = Dispatchers.IO, overridable for tests). The refresh:
  • Bridges the legacy callback-based Backend.getRemoteConfig via suspendCancellableCoroutine + safeResume/safeResumeWithException(PurchasesException(error)). The backend network call stays callback-based intentionally.
  • Fans the topic downloads out with coroutineScope { tasks.map { async { topicFetcher.fetchTopicIfNeeded(...) } }.awaitAll().firstNotNullOfOrNull { it } }. The first error wins; structured concurrency makes this much smaller than a hand-rolled CompletionTracker.

Currently only the DEFAULT variant of each known topic is downloaded.

Tests

runTest + UnconfinedTestDispatcher(testScheduler) for both. coEvery / coVerify for the suspend TopicFetcher. Coverage:

• TopicFetcherTest — cache hit, successful download + verify + persist, URL-format substitution, HTTP failure, IO failure, SHA mismatch, multi-variant filename isolation.
• RemoteConfigManagerTest — empty-source / empty-topics / no-DEFAULT skip paths, first-error-wins fan-out, backend-error short-circuit, background flag forwarded, null completion.

All new types are internal. No public API surface change.

Stack

• ⬇ Add network scaffolding for remote config endpoint: Add network scaffolding for remote config endpoint #3435
• This PR: Add RemoteConfigManager and TopicFetcher #3437
• ⬆ Clean up unreferenced topic files after successful remote-config refresh: Clean up unreferenced topic files after successful remote-config refresh #3439

Checklist

• Unit tests
• Follow-up issues for purchases-ios / hybrids (deferred)

---

Note

Medium Risk
Adds new remote-config orchestration that performs concurrent network downloads and filesystem writes under noBackupFilesDir, including checksum verification and new error-handling paths. While internal-only, bugs here could impact startup/network behavior and caching correctness.

Overview
Adds a new remote-config orchestration layer: RemoteConfigManager.updateRemoteConfigIfNeeded fetches the remote-config manifest from Backend.getRemoteConfig (bridged into coroutines) and concurrently downloads each topic’s default entry via a new TopicFetcher, returning the first download error (if any).

Introduces TopicFetcher to cache topic blobs on disk under noBackupFilesDir/RevenueCat/topics/<topic>/<blob_ref>, with blob-ref input validation, limited parallel downloads, temp-file writes, and SHA-256 verification.

Refactors FontLoader to reuse new UrlConnectionFactory.downloadToFile helpers, and extends UrlConnectionFactory with shared download + checksum-verification utilities. Updates/expands tests to cover the new manager/fetcher behavior and changes the manifest entry key from DEFAULT to default in RemoteConfigResponseTest.

^{Reviewed by Cursor Bugbot for commit 8cdae44. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tonidero]

• Use product_entitlement_mapping topic blob for offline entitlements when remote config enabled #3455
• Wire RemoteConfigManager refresh on first foreground and identity changes (off by default) #3450
• Fall back across blob sources when topic downloads fail #3466
• Select blob source by priority and weighted random #3458
• Clean up unreferenced topic files after successful remote-config refresh #3439
• Cache remote config response in memory with TTL and persist to disk #3457
• Add RemoteConfigManager and TopicFetcher #3437 👈 (View in Graphite)
• Add network scaffolding for remote config endpoint #3435
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[codecov]

Codecov Report

❌ Patch coverage is 89.76378% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.52%. Comparing base (315b770) to head (8cdae44).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...ecat/purchases/common/remoteconfig/TopicFetcher.kt	79.59%	7 Missing and 3 partials ⚠️
...revenuecat/purchases/utils/UrlConnectionFactory.kt	94.87%	0 Missing and 2 partials ⚠️
...rchases/common/remoteconfig/RemoteConfigManager.kt	97.36%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3437      +/-   ##
==========================================
+ Coverage   79.45%   79.52%   +0.06%     
==========================================
  Files         364      366       +2     
  Lines       14647    14754     +107     
  Branches     1999     2013      +14     
==========================================
+ Hits        11638    11733      +95     
- Misses       2200     2208       +8     
- Partials      809      813       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tonidero]

This is still todo, right now only product entitlement mapping is fetched, which only has a a single entry in the topic, which is the default.

[ajpallares]

Some initial comments. But this is looking good!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ba8adae. Configure here.}

[ajpallares]

I think it looks good! Just one minor comment, not a blocker though

[ajpallares]

Should we tighten BLOB_REF_PATTERN to exactly ^[a-fA-F0-9]{64}$? Right now any alphanumeric string of any length (including non-hex chars like G–Z) passes validation and we only catch obviously-bad values after downloading and recomputing SHA-256. Since blobRef is the SHA-256 hex digest itself, enforcing the exact shape feels like cheap insurance and would make the "accepts mixed-case 64-char hex blobRef" test case actually exercise the real constraint.

[tonidero]

Indeed, I started with that, and then thought to futureproof it by relaxing the constraints... Though it's true that this just means it will fail later when verifying the checksum... So yeah, can change it back 👍

[tonidero]

Will do this in the follow-up PR, so we can merge this and avoid the extra iterations. Thanks again!