Get time from Clock [SDK-1973]

[skjolber]

Describe the problem you'd like to have solved

We're using a NTP library to get the current time.

Describe the ideal solution

Get current time from a java.time.Clock instance instead of System.currentTimeMillis(). Probably unit-testing will be more simple as well.

Alternatives and current work-arounds

Subclassing and/or cloning classes. Explicitly passing in the current time to methods.

Additional context

SecureCredentialsManager

[lbalmaceda]

That would be ideal, but the java.time.Clock class does not seem to be available until Android API 26, and this library targets as min API 15. We plan to raise this minimum but is not going to be 26, unfortunately. I guess we could go with a solution like the one java-jwt has.

The only reason to push back on a change that will let the developer pass the Clock instance is that you can put as much documentation and warning flags as you want, but anyone could still mistakenly use it and break the application.

Is this only for testing purposes or your use case requires to use that NTP library to avoid time sync issues across apps/services?

[skjolber]

We are going to have consumer apps, and can not controll their internal clock, and we know from experience that some of them are off (by minutes or more). So the plan is to use an NTP library to get the correct current time, so that the app is unaffected by the time skew.

I missed that backwards compatible target - then java.time.Clock is not going to work. The java-jwt approach is a good alternative.

[lbalmaceda]

I think the java-jwt solution is an easy path forward. I need to evaluate if this can be set in a global way, maybe through the Auth0 object, so it can also be considered when validating ID tokens, for example.

I'm tracking this as SDK-1973.