App: tap on notification brings up main view (#407)

Updates tailscale/tailscale#10104

Signed-off-by: kari-ts <kari@tailscale.com>

.github/licenses.tmpl

@@ -18,4 +18,3 @@ Client][].  See also the dependencies in the [Tailscale CLI][].
  - [{{.Name}}](https://pkg.go.dev/{{.Name}}) ([{{.LicenseName}}]({{.LicenseURL}}))
 {{- end }}
  - [tailscale.com](https://pkg.go.dev/tailscale.com) ([BSD-3-Clause](https://github.com/tailscale/tailscale/blob/HEAD/LICENSE))
- - [Gio UI](https://gioui.org/) ([MIT License](https://git.sr.ht/~eliasnaur/gio/tree/main/item/LICENSE))

.github/workflows/android.yml

@@ -28,7 +28,7 @@ jobs:
         java-version: '17'
 
     - name: Build APKs
-      run: make tailscale-new-debug.apk tailscale-new-fdroid.apk
+      run: make tailscale-debug.apk
 
     - name: Run tests
       run: make test

.github/workflows/build-legacy.yml

@@ -1,31 +0,0 @@
-name: Build Legacy Debug APK
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - '*'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
-
-    steps:
-
-    - name: Check out code
-      uses: actions/checkout@v3
-    - uses: actions/setup-go@v5
-      with: 
-        go-version-file: 'go.mod'
-    - name: Switch to Java 17 # Note: 17 is pre-installed on ubuntu-latest
-      uses: actions/setup-java@v3
-      with:
-        distribution: 'temurin'
-        java-version: '17'
-
-    - name: Build Legacy APK
-      run: make tailscale-debug.apk

.github/workflows/go_mod_tidy.yml

@@ -0,0 +1,36 @@
+name: go mod tidy
+
+on:
+  push:
+    branches:
+      - main
+      - "release-branch/*"
+  pull_request:
+    branches:
+      - "*"
+
+concurrency:
+  group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  check-go-mod-tidy:
+    runs-on: [ubuntu-latest]
+    timeout-minutes: 8
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          cache: false
+          go-version-file: go.mod
+
+      - name: Check 'go mod tidy' is clean
+        run: |
+          ./tool/go mod tidy
+          echo
+          echo
+          git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go mod tidy'."; exit 1)

.gitignore

@@ -24,6 +24,7 @@ tailscale-release.aab
 tailscale-fdroid.apk
 tailscale-new-fdroid.apk
 tailscale-new-debug.apk
+tailscale-test.apk
 
 # Signing key
 tailscale.jks

Makefile

@@ -4,22 +4,19 @@
 
 DEBUG_APK=tailscale-debug.apk
 RELEASE_AAB=tailscale-release.aab
-APPID=com.tailscale.ipn
-AAR=android_legacy/libs/ipn.aar
-KEYSTORE=tailscale.jks
-KEYSTORE_ALIAS=tailscale
+LIBTAILSCALE=android/libs/libtailscale.aar
 TAILSCALE_VERSION=$(shell ./version/tailscale-version.sh 200)
 OUR_VERSION=$(shell git describe --dirty --exclude "*" --always --abbrev=200)
 TAILSCALE_VERSION_ABBREV=$(shell ./version/tailscale-version.sh 11)
 OUR_VERSION_ABBREV=$(shell git describe --dirty --exclude "*" --always --abbrev=11)
 VERSION_LONG=$(TAILSCALE_VERSION_ABBREV)-g$(OUR_VERSION_ABBREV)
 # Extract the long version build.gradle's versionName and strip quotes.
-VERSIONNAME=$(patsubst "%",%,$(lastword $(shell grep versionName android_legacy/build.gradle)))
+VERSIONNAME=$(patsubst "%",%,$(lastword $(shell grep versionName android/build.gradle)))
 # Extract the x.y.z part for the short version.
 VERSIONNAME_SHORT=$(shell echo $(VERSIONNAME) | cut -d - -f 1)
 TAILSCALE_COMMIT=$(shell echo $(TAILSCALE_VERSION) | cut -d - -f 2 | cut -d t -f 2)
 # Extract the version code from build.gradle.
-VERSIONCODE=$(lastword $(shell grep versionCode android_legacy/build.gradle))
+VERSIONCODE=$(lastword $(shell grep versionCode android/build.gradle))
 VERSIONCODE_PLUSONE=$(shell expr $(VERSIONCODE) + 1)
 VERSION_LDFLAGS=-X tailscale.com/version.longStamp=$(VERSIONNAME) -X tailscale.com/version.shortStamp=$(VERSIONNAME_SHORT) -X tailscale.com/version.gitCommitStamp=$(TAILSCALE_COMMIT) -X tailscale.com/version.extraGitCommitStamp=$(OUR_VERSION)
 FULL_LDFLAGS=$(VERSION_LDFLAGS) -w
@@ -59,6 +56,8 @@ export JAVA_HOME ?= $(shell find "$(ANDROID_STUDIO_ROOT)/jbr" "$(ANDROID_STUDIO_
 # If JAVA_HOME is still unset, remove it, because SDK tools go into a CPU spin if it is set and empty.
 ifeq ($(JAVA_HOME),)
 	unexport JAVA_HOME
+else
+	export PATH := $(JAVA_HOME)/bin:$(PATH)
 endif
 
 # TOOLCHAINDIR is set by fdoid CI and used by tool/* scripts.
@@ -68,11 +67,68 @@ export TOOLCHAINDIR
 GOBIN ?= $(PWD)/android/build/go/bin
 export GOBIN
 
-export PATH := $(PWD)/tool:$(GOBIN):$(JAVA_HOME)/bin:$(ANDROID_HOME)/cmdline-tools/latest/bin:$(ANDROID_HOME)/platform-tools:$(PATH)
+export PATH := $(PWD)/tool:$(GOBIN):$(ANDROID_HOME)/cmdline-tools/latest/bin:$(ANDROID_HOME)/platform-tools:$(PATH)
 export GOROOT := # Unset
 
-all: tailscale-new-debug.apk test $(DEBUG_APK) tailscale-fdroid.apk ## Build and test everything
+#
+# Android Builds:
+#
+
+.PHONY: apk
+apk: $(DEBUG_APK) ## Build the debug APK
+
+.PHONY: tailscale-debug
+tailscale-debug: $(DEBUG_APK) ## Build the debug APK
+
+.PHONY: release
+release: tailscale.jks $(RELEASE_AAB) ## Build the release AAB
+	jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -keystore tailscale.jks $(RELEASE_AAB) tailscale
+
+# gradle-dependencies groups together the android sources and libtailscale needed to assemble tests/debug/release builds.
+.PHONY: gradle-dependencies
+gradle-dependencies: $(shell find android -type f -not -path "android/build/*" -not -path '*/.*') $(LIBTAILSCALE)
+
+$(DEBUG_APK): gradle-dependencies
+	(cd android && ./gradlew test assembleDebug)
+	install -C android/build/outputs/apk/debug/android-debug.apk $@
+
+$(RELEASE_AAB): gradle-dependencies
+	(cd android && ./gradlew test bundleRelease)
+	install -C ./android/build/outputs/bundle/release/android-release.aab $@
+
+tailscale-test.apk: gradle-dependencies
+	(cd android && ./gradlew assembleApplicationTestAndroidTest)
+	install -C ./android/build/outputs/apk/androidTest/applicationTest/android-applicationTest-androidTest.apk $@
+
+#
+# Go Builds:
+#
+
+android/libs:
+	mkdir -p android/libs
+
+$(GOBIN)/gomobile: $(GOBIN)/gobind go.mod go.sum
+	go install golang.org/x/mobile/cmd/gomobile
+
+$(GOBIN)/gobind: go.mod go.sum
+	go install golang.org/x/mobile/cmd/gobind
+
+$(LIBTAILSCALE): Makefile android/libs $(shell find libtailscale -name *.go) go.mod go.sum $(GOBIN)/gomobile
+	gomobile bind -target android -androidapi 26 \
+		-ldflags "$(FULL_LDFLAGS)" \
+		-o $@ ./libtailscale
+
+.PHONY: libtailscale
+libtailscale: $(LIBTAILSCALE) ## Build the libtailscale AAR
+
+#
+# Utility tasks:
+#
 
+.PHONY: all
+all: test $(DEBUG_APK) ## Build and test everything
+
+.PHONY: env
 env:
 	@echo PATH=$(PATH)
 	@echo ANDROID_SDK_ROOT=$(ANDROID_SDK_ROOT)
@@ -81,12 +137,20 @@ env:
 	@echo JAVA_HOME=$(JAVA_HOME)
 	@echo TOOLCHAINDIR=$(TOOLCHAINDIR)
 
+.PHONY: androidpath
+androidpath:
+	@echo "export ANDROID_HOME=$(ANDROID_HOME)"
+	@echo "export ANDROID_SDK_ROOT=$(ANDROID_SDK_ROOT)"
+	@echo 'export PATH=$(ANDROID_HOME)/cmdline-tools/latest/bin:$(ANDROID_HOME)/platform-tools:$$PATH'
+
+.PHONY: tag_release
 tag_release: ## Tag a release
-	sed -i'.bak' 's/versionCode $(VERSIONCODE)/versionCode $(VERSIONCODE_PLUSONE)/' android_legacy/build.gradle && rm android_legacy/build.gradle.bak
-	sed -i'.bak' 's/versionName .*/versionName "$(VERSION_LONG)"/' android_legacy/build.gradle && rm android_legacy/build.gradle.bak
-	git commit -sm "android: bump version code" android_legacy/build.gradle
+	sed -i'.bak' 's/versionCode $(VERSIONCODE)/versionCode $(VERSIONCODE_PLUSONE)/' android/build.gradle && rm android/build.gradle.bak
+	sed -i'.bak' 's/versionName .*/versionName "$(VERSION_LONG)"/' android/build.gradle && rm android/build.gradle.bak
+	git commit -sm "android: bump version code" android/build.gradle
 	git tag -a "$(VERSION_LONG)"
 
+.PHONY: bumposs
 bumposs: ## Update the tailscale.com go module
 	GOPROXY=direct go get tailscale.com@main
 	go run tailscale.com/cmd/printdep --go > go.toolchain.rev
@@ -103,6 +167,7 @@ $(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager:
 	mv $(ANDROID_HOME)/tmp/cmdline-tools $(ANDROID_HOME)/cmdline-tools/latest
 	rm -rf $(ANDROID_HOME)/tmp
 
+.PHONY: androidsdk
 androidsdk: $(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager ## Install the set of Android SDK packages we need.
 	yes | $(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager --licenses > /dev/null
 	$(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager --update
@@ -111,6 +176,7 @@ androidsdk: $(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager ## Install the s
 # Normally in make you would simply take a dependency on the task that provides
 # the binaries, however users may have a decision to make as to whether they
 # want to install an SDK or use the one from an Android Studio installation.
+.PHONY: checkandroidsdk
 checkandroidsdk: ## Check that Android SDK is installed
 	@$(ANDROID_HOME)/cmdline-tools/latest/bin/sdkmanager --list_installed | grep -q 'ndk' || (\
 		echo -e "\n\tERROR: Android SDK not installed.\n\
@@ -118,90 +184,32 @@ checkandroidsdk: ## Check that Android SDK is installed
 		\tANDROID_SDK_ROOT=$(ANDROID_SDK_ROOT)\n\n\
 		See README.md for instructions on how to install the prerequisites.\n"; exit 1)
 
-androidpath:
-	@echo "export ANDROID_HOME=$(ANDROID_HOME)"
-	@echo "export ANDROID_SDK_ROOT=$(ANDROID_SDK_ROOT)"
-	@echo 'export PATH=$(ANDROID_HOME)/cmdline-tools/latest/bin:$(ANDROID_HOME)/platform-tools:$$PATH'
-
-$(AAR): checkandroidsdk
-	@mkdir -p android_legacy/libs && \
-	go run gioui.org/cmd/gogio \
-		-ldflags "$(VERSION_LDFLAGS)" \
-		-buildmode archive -target android -appid $(APPID) -tags novulkan,tailscale_go -o $@ github.com/tailscale/tailscale-android/cmd/tailscale
-
-# tailscale-debug.apk builds a debuggable APK with the Google Play SDK.
-$(DEBUG_APK): $(AAR)
-	(cd android_legacy && ./gradlew test assemblePlayDebug)
-	mv android_legacy/build/outputs/apk/play/debug/android_legacy-play-debug.apk $@
-
-# tailscale-fdroid.apk builds a non-Google Play SDK, without the Google bits.
-# This is effectively what the F-Droid build definition produces.
-# This is useful for testing on e.g. Amazon Fire Stick devices.
-tailscale-fdroid.apk: $(AAR)
-	(cd android_legacy && ./gradlew test assembleFdroidDebug)
-	mv android_legacy/build/outputs/apk/fdroid/debug/android_legacy-fdroid-debug.apk $@
-
-$(RELEASE_AAB): $(AAR)
-	(cd android_legacy && ./gradlew test bundlePlayRelease)
-	mv ./android_legacy/build/outputs/bundle/playRelease/android_legacy-play-release.aab $@
-
-release: $(RELEASE_AAB) ## Build the release AAB
-	jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -keystore $(KEYSTORE) $(RELEASE_AAB) $(KEYSTORE_ALIAS)
-
-apk: $(DEBUG_APK) ## Build the debug APK
-
-LIBTAILSCALE=android/libs/libtailscale.aar
-LIBTAILSCALE_SOURCES=$(shell find libtailscale -name *.go) go.mod go.sum
-
-android/libs:
-	mkdir -p android/libs
-
-$(GOBIN)/gomobile: $(GOBIN)/gobind go.mod go.sum
-	go install golang.org/x/mobile/cmd/gomobile
-
-$(GOBIN)/gobind: go.mod go.sum
-	go install golang.org/x/mobile/cmd/gobind
-
-# TODO: the version names used below parse the legacy version information,
-# though hopefully they won't substantially differ for now.
-$(LIBTAILSCALE): Makefile android/libs $(LIBTAILSCALE_SOURCES) $(GOBIN)/gomobile
-	gomobile bind -target android -androidapi 26 \
-		-ldflags "$(FULL_LDFLAGS)" \
-		-o $@ ./libtailscale
-
-libtailscale: $(LIBTAILSCALE)
-
-tailscale-new-fdroid.apk: $(LIBTAILSCALE)
-	(cd android && ./gradlew test assembleFdroidDebug)
-	mv android/build/outputs/apk/fdroid/debug/android-fdroid-debug.apk $@
-
-tailscale-new-debug.apk: $(LIBTAILSCALE)
-	(cd android && ./gradlew test assemblePlayDebug)
-	mv android/build/outputs/apk/play/debug/android-play-debug.apk $@
-
-tailscale-new-debug: tailscale-new-debug.apk ## Build the new debug APK
-
-test: $(LIBTAILSCALE) ## Run the Android tests
+.PHONY: test
+test: gradle-dependencies ## Run the Android tests
 	(cd android && ./gradlew test)
 
-install: tailscale-new-debug.apk ## Install the debug APK on a connected device
+.PHONY: install
+install: $(DEBUG_APK) ## Install the debug APK on a connected device
 	adb install -r $<
 
+.PHONY: run
 run: install ## Run the debug APK on a connected device
-	adb shell am start -n com.tailscale.ipn/com.tailscale.ipn.IPNActivity
+	adb shell am start -n com.tailscale.ipn/com.tailscale.ipn.MainActivity
 
+.PHONY: dockershell
 dockershell: ## Run a shell in the Docker build container
 	docker build -t tailscale-android .
 	docker run -v $(CURDIR):/build/tailscale-android -it --rm tailscale-android
 
+.PHONY: clean
 clean: ## Remove build artifacts
-	-rm -rf android/build android_legacy/build $(DEBUG_APK) $(RELEASE_AAB) $(AAR) $(LIBTAILSCALE) android/libs tailscale-fdroid.apk *.apk
+	-rm -rf android/build $(DEBUG_APK) $(RELEASE_AAB) $(LIBTAILSCALE) android/libs *.apk *.aab
 	-pkill -f gradle
 
+.PHONY: help
 help: ## Show this help
 	@echo "\nSpecify a command. The choices are:\n"
 	@grep -hE '^[0-9a-zA-Z_-]+:.*?## .*$$' ${MAKEFILE_LIST} | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[0;36m%-20s\033[m %s\n", $$1, $$2}'
 	@echo ""
 
-.PHONY: all clean install android_legacy/lib $(DEBUG_APK) $(RELEASE_AAB) $(AAR) release bump_version dockershell lib tailscale-new-debug help
 .DEFAULT_GOAL := help

README.md

@@ -10,13 +10,19 @@ This repository contains the open source Tailscale Android client.
 
 ## Using
 
-[<img src="https://fdroid.gitlab.io/artwork/badge/get-it-on.png"
-     alt="Get it on F-Droid"
-     height="80">](https://f-droid.org/packages/com.tailscale.ipn/)
 [<img src="https://play.google.com/intl/en_us/badges/images/generic/en-play-badge.png"
      alt="Get it on Google Play"
      height="80">](https://play.google.com/store/apps/details?id=com.tailscale.ipn)
 
+Help us test new features and bug-fixes before they ship to all users! A [beta testing track](https://play.google.com/apps/testing/com.tailscale.ipn) is available on the Play Store. 
+
+#### Amazon Appstore
+
+The app can be downloaded from the [Amazon Appstore](https://www.amazon.com/dp/B0D38TRB3N) for Amazon Fire tablets and Fire TV devices.
+
+#### F-Droid
+
+The [F-Droid](https://f-droid.org/packages/com.tailscale.ipn/) project builds the source code in this repository and maintains independently-built APKs. Note that F-Droid builds are not released, updated, or verified by the Tailscale team.
 
 ## Preparing a build environment
 
@@ -87,38 +93,6 @@ release candidate builds (currently Go 1.14) in module mode. It might
 work in earlier Go versions or in GOPATH mode, but we're making no
 effort to keep those working.
 
-
-## Google Sign-In
-
-Google Sign-In support relies on configuring a [Google API Console
-project](https://developers.google.com/identity/sign-in/android/start-integrating)
-with the app identifier and [signing key
-hashes](https://developers.google.com/android/guides/client-auth).
-The official release uses the app identifier `com.tailscale.ipn`;
-custom builds should use a different identifier.
-
-## Running in the Android emulator
-
-By default, the android emulator uses an older version of OpenGL ES,
-which results in a black screen when opening the Tailscale app. To fix
-this, with the emulator running:
-
- - Open the three-dots menu to access emulator settings
- - To to `Settings > Advanced`
- - Set "OpenGL ES API level" to "Renderer maximum (up to OpenGL ES 3.1)"
- - Close the emulator.
- - In Android Studio's emulator view (that lists all your emulated
-   devices), hit the down arrow by the virtual device and select "Cold
-   boot now" to restart the emulator from scratch.
-
-The Tailscale app should now render correctly.
-
-Additionally, there seems to be a bug that prevents using the
-system-level Google sign-in option (the one that pops up a
-system-level UI to select your Google account). You can work around
-this by selecting "Other" at the sign-in screen, and then selecting
-Google from the next screen.
-
 ## Developing on a Fire Stick TV
 
 On the Fire Stick:
@@ -129,7 +103,7 @@ Then some useful commands:
 ```
 adb connect 10.2.200.213:5555
 adb install -r tailscale-fdroid.apk
-adb shell am start -n com.tailscale.ipn/com.tailscale.ipn.IPNActivity
+adb shell am start -n com.tailscale.ipn/com.tailscale.ipn.MainActivity
 adb shell pm uninstall com.tailscale.ipn
 ```
 
@@ -151,8 +125,8 @@ Origin](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin)
 
 ## About Us
 
-We are apenwarr, bradfitz, crawshaw, danderson, dfcarney,
-from Tailscale Inc.
-You can learn more about us from [our website](https://tailscale.com).
+We are [Tailscale](https://tailscale.com). See
+https://tailscale.com/company for more about us and what we're
+building.
 
 WireGuard is a registered trademark of Jason A. Donenfeld.

android/build.gradle

@@ -1,6 +1,6 @@
 buildscript {
     ext.kotlin_version = "1.9.22"
-    ext.kotlin_compose_version = "1.5.10"
+    ext.compose_version = "1.5.10"
     ext.accompanist_version = "0.34.0"
 
     repositories {
@@ -37,30 +37,41 @@ android {
     defaultConfig {
         minSdkVersion 26
         targetSdkVersion 34
-        versionCode 198
-        versionName "1.59.53-t0f042b981-g1017015de26"
+        versionCode 220
+        versionName "1.67.30-t6831a29f8-g8acfc1f7a07"
     }
+
     compileOptions {
         sourceCompatibility JavaVersion.VERSION_17
         targetCompatibility JavaVersion.VERSION_17
     }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
     buildFeatures {
         compose true
     }
     composeOptions {
-        kotlinCompilerExtensionVersion = "$kotlin_compose_version"
+        kotlinCompilerExtensionVersion = "$compose_version"
     }
     flavorDimensions "version"
-    productFlavors {
-        fdroid {
-            // The fdroid flavor contains only free dependencies and is suitable
-            // for the F-Droid app store.
-        }
-        play {
-            // The play flavor contains all features and is for the Play Store.
+    namespace 'com.tailscale.ipn'
+
+    buildTypes {
+        applicationTest {
+            initWith debug
+            buildConfigField "String", "GITHUB_USERNAME", "\"" + getLocalProperty("githubUsername")+"\""
+            buildConfigField "String", "GITHUB_PASSWORD", "\"" + getLocalProperty("githubPassword")+"\""
+            buildConfigField "String", "GITHUB_2FA_SECRET", "\"" + getLocalProperty("github2FASecret")+"\""
         }
     }
-    namespace 'com.tailscale.ipn'
+
+    testBuildType "applicationTest"
 }
 
 dependencies {
@@ -74,19 +85,18 @@ dependencies {
     // Kotlin dependencies.
     implementation "org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3"
     implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.0"
-    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.0"
+    implementation 'junit:junit:4.12'
+    runtimeOnly "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.0"
     implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
     implementation "org.jetbrains.kotlin:kotlin-reflect:$kotlin_version"
 
     // Compose dependencies.
     def composeBom = platform('androidx.compose:compose-bom:2023.06.01')
     implementation composeBom
-    androidTestImplementation composeBom
     implementation 'androidx.compose.material3:material3:1.2.1'
     implementation 'androidx.compose.material:material-icons-core:1.6.3'
     implementation "androidx.compose.ui:ui:1.6.3"
     implementation "androidx.compose.ui:ui-tooling:1.6.3"
-    implementation 'androidx.lifecycle:lifecycle-runtime-ktx:2.7.0'
     implementation 'androidx.lifecycle:lifecycle-viewmodel-ktx:2.7.0'
     implementation 'androidx.activity:activity-compose:1.8.2'
     implementation "com.google.accompanist:accompanist-permissions:$accompanist_version"
@@ -95,23 +105,42 @@ dependencies {
 
     // Navigation dependencies.
     def nav_version = "2.7.7"
-    implementation "androidx.navigation:navigation-fragment:$nav_version"
-    implementation "androidx.navigation:navigation-ui:$nav_version"
-    implementation "androidx.navigation:navigation-fragment-ktx:$nav_version"
-    implementation "androidx.navigation:navigation-ui-ktx:$nav_version"
-    implementation "androidx.navigation:navigation-dynamic-features-fragment:$nav_version"
     implementation "androidx.navigation:navigation-compose:$nav_version"
+    implementation "androidx.navigation:navigation-ui:$nav_version"
 
     // Supporting libraries.
     implementation("io.coil-kt:coil-compose:2.6.0")
+    implementation("com.google.zxing:core:3.5.1")
 
     // Tailscale dependencies.
     implementation ':libtailscale@aar'
 
-    // Tests
-    testImplementation "junit:junit:4.12"
-    androidTestImplementation "androidx.navigation:navigation-testing:$nav_version"
+    // Integration Tests
+    androidTestImplementation composeBom
+    androidTestImplementation 'androidx.test:runner:1.5.2'
+    androidTestImplementation 'androidx.test.ext:junit-ktx:1.1.5'
+    androidTestImplementation 'androidx.test.ext:junit:1.1.5'
+    androidTestImplementation 'androidx.test.espresso:espresso-core:3.5.1'
+    implementation 'androidx.test.uiautomator:uiautomator:2.3.0'
+
 
-    // Non-free dependencies.
-    playImplementation 'com.google.android.gms:play-services-auth:20.7.0'
+    // Authentication only for tests
+    androidTestImplementation 'dev.turingcomplete:kotlin-onetimepassword:2.4.0'
+    androidTestImplementation 'commons-codec:commons-codec:1.16.1'
+
+    // Unit Tests
+    testImplementation 'junit:junit:4.13.2'
+
+    debugImplementation("androidx.compose.ui:ui-tooling")
+    implementation("androidx.compose.ui:ui-tooling-preview")
+}
+
+def getLocalProperty(key) {
+    try {
+        Properties properties = new Properties()
+        properties.load(project.file('local.properties').newDataInputStream())
+        return properties.getProperty(key)
+    } catch(Throwable ignored) {
+        return ""
+    }
 }

android/src/androidTest/kotlin/com/tailscale/ipn/MainActivityTest.kt

@@ -0,0 +1,160 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn
+
+import android.os.Build
+import android.util.Log
+import android.widget.Button
+import android.widget.EditText
+import androidx.test.ext.junit.rules.activityScenarioRule
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.filters.LargeTest
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.uiautomator.By
+import androidx.test.uiautomator.UiDevice
+import androidx.test.uiautomator.UiSelector
+import dev.turingcomplete.kotlinonetimepassword.HmacAlgorithm
+import dev.turingcomplete.kotlinonetimepassword.TimeBasedOneTimePasswordConfig
+import dev.turingcomplete.kotlinonetimepassword.TimeBasedOneTimePasswordGenerator
+import org.apache.commons.codec.binary.Base32
+import org.junit.After
+import org.junit.Assert
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.net.HttpURLConnection
+import java.net.URL
+import java.util.concurrent.TimeUnit
+import kotlin.time.Duration.Companion.minutes
+import kotlin.time.Duration.Companion.seconds
+
+@RunWith(AndroidJUnit4::class)
+@LargeTest
+class MainActivityTest {
+  companion object {
+    const val TAG = "MainActivityTest"
+  }
+
+  @get:Rule val activityRule = activityScenarioRule<MainActivity>()
+
+  @Before fun setUp() {}
+
+  @After fun tearDown() {}
+
+  /**
+   * This test starts with a clean install, logs the user in to a tailnet using credentials provided
+   * through a build config, and then makes sure we can hit https://hello.ts.net.
+   */
+  @Test
+  fun loginAndVisitHello() {
+    val githubUsername = BuildConfig.GITHUB_USERNAME
+    val githubPassword = BuildConfig.GITHUB_PASSWORD
+    val github2FASecret = Base32().decode(BuildConfig.GITHUB_2FA_SECRET)
+    val config =
+        TimeBasedOneTimePasswordConfig(
+            codeDigits = 6,
+            hmacAlgorithm = HmacAlgorithm.SHA1,
+            timeStep = 30,
+            timeStepUnit = TimeUnit.SECONDS)
+    val githubTOTP = TimeBasedOneTimePasswordGenerator(github2FASecret, config)
+
+    val device = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation())
+    Log.d(TAG, "Wait for VPN permission prompt and accept")
+    device.find(By.text("Connection request"))
+    device.find(By.text("OK")).click()
+
+    Log.d(TAG, "Click through Get Started screen")
+    device.find(By.text("Get Started"))
+    device.find(By.text("Get Started")).click()
+
+    asNecessary(
+        timeout = 2.minutes,
+        {
+          Log.d(TAG, "Log in")
+          device.find(By.text("Log in")).click()
+        },
+        {
+          Log.d(TAG, "Accept Chrome terms and conditions (if necessary)")
+          device.find(By.text("Welcome to Chrome"))
+          val dismissIndex =
+              if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) 1 else 0
+          device.find(UiSelector().instance(dismissIndex).className(Button::class.java)).click()
+        },
+        {
+          Log.d(TAG, "Don't turn on sync")
+          device.find(By.text("Turn on sync?"))
+          device.find(By.text("No thanks")).click()
+        },
+        {
+          Log.d(TAG, "Log in with GitHub")
+          device.find(By.text("Sign in with GitHub")).click()
+        },
+        {
+          Log.d(TAG, "Make sure GitHub page has loaded")
+          device.find(By.text("New to GitHub"))
+          device.find(By.text("Username or email address"))
+          device.find(By.text("Sign in"))
+        },
+        {
+          Log.d(TAG, "Enter credentials")
+          device
+              .find(UiSelector().instance(0).className(EditText::class.java))
+              .setText(githubUsername)
+          device
+              .find(UiSelector().instance(1).className(EditText::class.java))
+              .setText(githubPassword)
+          device.find(By.text("Sign in")).click()
+        },
+        {
+          Log.d(TAG, "Enter 2FA")
+          device.find(By.text("Two-factor authentication"))
+          device
+              .find(UiSelector().instance(0).className(EditText::class.java))
+              .setText(githubTOTP.generate())
+          device.find(UiSelector().instance(0).className(Button::class.java)).click()
+        },
+        {
+          Log.d(TAG, "Accept Tailscale app")
+          device.find(By.text("Learn more about OAuth"))
+          // Sleep a little to give button time to activate
+          Thread.sleep(5.seconds.inWholeMilliseconds)
+          device.find(UiSelector().instance(1).className(Button::class.java)).click()
+        },
+        {
+          Log.d(TAG, "Connect device")
+          device.find(By.text("Connect device"))
+          device.find(UiSelector().instance(0).className(Button::class.java)).click()
+        },
+    )
+
+    try {
+      Log.d(TAG, "Accept Permission (Either Storage or Notifications)")
+      device.find(By.text("Continue")).click()
+      device.find(By.text("Allow")).click()
+    } catch (t: Throwable) {
+      // we're not always prompted for permissions, that's okay
+    }
+
+    Log.d(TAG, "Wait for VPN to connect")
+    device.find(By.text("Connected"))
+
+    val helloResponse = helloTSNet
+    Assert.assertTrue(
+        "Response from hello.ts.net should show success",
+        helloResponse.contains("You're connected over Tailscale!"))
+  }
+}
+
+private val helloTSNet: String
+  get() {
+    return URL("https://hello.ts.net").run {
+      openConnection().run {
+        this as HttpURLConnection
+        connectTimeout = 30000
+        readTimeout = 5000
+        inputStream.bufferedReader().readText()
+      }
+    }
+  }

android/src/androidTest/kotlin/com/tailscale/ipn/TestUtil.kt

@@ -0,0 +1,92 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn
+
+import android.util.Log
+import androidx.test.uiautomator.BySelector
+import androidx.test.uiautomator.UiDevice
+import androidx.test.uiautomator.UiObject
+import androidx.test.uiautomator.UiObject2
+import androidx.test.uiautomator.UiSelector
+import androidx.test.uiautomator.Until
+import kotlin.time.Duration
+import kotlin.time.Duration.Companion.milliseconds
+import kotlin.time.Duration.Companion.seconds
+
+private val defaultTimeout = 10.seconds
+
+private val threadLocalTimeout = ThreadLocal<Duration>()
+
+/**
+ * Wait until the specified timeout for the given selector and return the matching UiObject2.
+ * Timeout defaults to 10 seconds.
+ *
+ * @throws Exception if selector is not found within timeout.
+ */
+fun UiDevice.find(
+    selector: BySelector,
+    timeout: Duration = threadLocalTimeout.get() ?: defaultTimeout
+): UiObject2 {
+  wait(Until.findObject(selector), timeout.inWholeMilliseconds)?.let {
+    return it
+  } ?: run { throw Exception("not found") }
+}
+
+/**
+ * Wait until the specified timeout for the given selector and return the matching UiObject. Timeout
+ * defaults to 10 seconds.
+ *
+ * @throws Exception if selector is not found within timeout.
+ */
+fun UiDevice.find(
+    selector: UiSelector,
+    timeout: Duration = threadLocalTimeout.get() ?: defaultTimeout
+): UiObject {
+  val obj = findObject(selector)
+  if (!obj.waitForExists(timeout.inWholeMilliseconds)) {
+    throw Exception("not found")
+  }
+  return obj
+}
+
+/**
+ * Execute an ordered collection of steps as necessary. If an earlier step fails but a subsequent
+ * step succeeds, this skips the earlier step. This is useful for interruptible sequences like
+ * logging in that may resume in an intermediate state.
+ */
+fun asNecessary(timeout: Duration, vararg steps: () -> Unit) {
+  val interval = 250.milliseconds
+  // Use a short timeout to avoid waiting on actions that can be skipped
+  threadLocalTimeout.set(interval)
+  try {
+    val start = System.currentTimeMillis()
+    var furthestSuccessful = -1
+    while (System.currentTimeMillis() - start < timeout.inWholeMilliseconds) {
+      for (i in furthestSuccessful + 1 ..< steps.size) {
+        val step = steps[i]
+        try {
+          step()
+          furthestSuccessful = i
+          Log.d("TestUtil.asNecessary", "SUCCESS!")
+          // Going forward, use the normal timeout on the assumption that subsequent steps will
+          // succeed.
+          threadLocalTimeout.remove()
+        } catch (t: Throwable) {
+          Log.d("TestUtil.asNecessary", t.toString())
+          // Going forward, use a short timeout to avoid waiting on actions that can be skipped
+          threadLocalTimeout.set(interval)
+        }
+      }
+      if (furthestSuccessful == steps.size - 1) {
+        // All steps have completed successfully
+        return
+      }
+      // Still some steps left to run
+      Thread.sleep(interval.inWholeMilliseconds)
+    }
+    throw Exception("failed to complete within timeout")
+  } finally {
+    threadLocalTimeout.remove()
+  }
+}

android/src/main/AndroidManifest.xml

@@ -4,12 +4,13 @@
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
     <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission
         android:name="android.permission.WRITE_EXTERNAL_STORAGE"
-        android:maxSdkVersion="28" />
+        android:maxSdkVersion="29" />
     <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTED"/>
 
     <!-- Disable input emulation on ChromeOS -->
     <uses-feature
@@ -28,6 +29,7 @@
         android:name=".App"
         android:allowBackup="false"
         android:banner="@drawable/tv_banner"
+        android:requestLegacyExternalStorage="true"
         android:icon="@mipmap/ic_launcher"
         android:label="Tailscale"
         android:roundIcon="@mipmap/ic_launcher_round"
@@ -82,7 +84,6 @@
             </intent-filter>
         </activity>
 
-
         <receiver
             android:name="IPNReceiver"
             android:exported="true">
@@ -95,7 +96,8 @@
         <service
             android:name=".IPNService"
             android:exported="false"
-            android:permission="android.permission.BIND_VPN_SERVICE">
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:foregroundServiceType="systemExempted">
             <intent-filter>
                 <action android:name="android.net.VpnService" />
             </intent-filter>

android/src/main/java/com/tailscale/ipn/App.kt

@@ -3,40 +3,28 @@
 package com.tailscale.ipn
 
 import android.Manifest
-import android.app.Activity
 import android.app.Application
-import android.app.DownloadManager
-import android.app.Fragment
-import android.app.FragmentTransaction
+import android.app.Notification
 import android.app.NotificationChannel
 import android.app.PendingIntent
-import android.app.UiModeManager
-import android.content.ContentResolver
-import android.content.ContentValues
 import android.content.Context
 import android.content.Intent
 import android.content.SharedPreferences
-import android.content.pm.PackageInfo
 import android.content.pm.PackageManager
-import android.content.res.Configuration
 import android.net.ConnectivityManager
 import android.net.LinkProperties
 import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
-import android.net.Uri
-import android.net.VpnService
 import android.os.Build
 import android.os.Environment
-import android.provider.MediaStore
-import android.provider.Settings
 import android.util.Log
-import androidx.browser.customtabs.CustomTabsIntent
 import androidx.core.app.ActivityCompat
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
 import androidx.security.crypto.EncryptedSharedPreferences
 import androidx.security.crypto.MasterKey
+import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.localapi.Client
 import com.tailscale.ipn.ui.localapi.Request
 import com.tailscale.ipn.ui.model.Ipn
@@ -46,6 +34,8 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
 import libtailscale.Libtailscale
 import java.io.File
 import java.io.IOException
@@ -54,40 +44,31 @@ import java.net.NetworkInterface
 import java.security.GeneralSecurityException
 import java.util.Locale
 
-class App : Application(), libtailscale.AppContext {
+class App : UninitializedApp(), libtailscale.AppContext {
   val applicationScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
 
   companion object {
-    const val STATUS_CHANNEL_ID = "tailscale-status"
-    const val STATUS_NOTIFICATION_ID = 1
-    const val NOTIFY_CHANNEL_ID = "tailscale-notify"
-    const val NOTIFY_NOTIFICATION_ID = 2
-    private const val PEER_TAG = "peer"
     private const val FILE_CHANNEL_ID = "tailscale-files"
-    private const val FILE_NOTIFICATION_ID = 3
     private const val TAG = "App"
     private val networkConnectivityRequest =
         NetworkRequest.Builder()
             .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
             .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
             .build()
-    lateinit var appInstance: App
-
-    @JvmStatic
-    fun startActivityForResult(act: Activity, intent: Intent?, request: Int) {
-      val f: Fragment = act.fragmentManager.findFragmentByTag(PEER_TAG)
-      f.startActivityForResult(intent, request)
-    }
+    private lateinit var appInstance: App
 
+    /**
+     * Initializes the app (if necessary) and returns the singleton app instance. Always use this
+     * function to obtain an App reference to make sure the app initializes.
+     */
     @JvmStatic
-    fun getApplication(): App {
+    fun get(): App {
+      appInstance.initOnce()
       return appInstance
     }
   }
 
   val dns = DnsConfig()
-  var autoConnect = false
-  var vpnReady = false
   private lateinit var connectivityManager: ConnectivityManager
   private lateinit var app: libtailscale.Application
 
@@ -101,6 +82,35 @@ class App : Application(), libtailscale.AppContext {
 
   override fun onCreate() {
     super.onCreate()
+    createNotificationChannel(
+        STATUS_CHANNEL_ID,
+        getString(R.string.vpn_status),
+        getString(R.string.optional_notifications_which_display_the_status_of_the_vpn_tunnel),
+        NotificationManagerCompat.IMPORTANCE_MIN)
+    createNotificationChannel(
+        FILE_CHANNEL_ID,
+        getString(R.string.taildrop_file_transfers),
+        getString(R.string.notifications_delivered_when_a_file_is_received_using_taildrop),
+        NotificationManagerCompat.IMPORTANCE_DEFAULT)
+    appInstance = this
+    setUnprotectedInstance(this)
+  }
+
+  override fun onTerminate() {
+    super.onTerminate()
+    Notifier.stop()
+    applicationScope.cancel()
+  }
+
+  private var isInitialized = false
+
+  @Synchronized
+  private fun initOnce() {
+    if (isInitialized) {
+      return
+    }
+    isInitialized = true
+
     val dataDir = this.filesDir.absolutePath
 
     // Set this to enable direct mode for taildrop whereby downloads will be saved directly
@@ -108,35 +118,26 @@ class App : Application(), libtailscale.AppContext {
     // an app local directory "Taildrop" if we cannot create that.  This mode does not support
     // user notifications for incoming files.
     val directFileDir = this.prepareDownloadsFolder()
-
     app = Libtailscale.start(dataDir, directFileDir.absolutePath, this)
     Request.setApp(app)
     Notifier.setApp(app)
     Notifier.start(applicationScope)
     connectivityManager = this.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
     setAndRegisterNetworkCallbacks()
-    createNotificationChannel(
-        NOTIFY_CHANNEL_ID, "Notifications", NotificationManagerCompat.IMPORTANCE_DEFAULT)
-    createNotificationChannel(
-        STATUS_CHANNEL_ID, "VPN Status", NotificationManagerCompat.IMPORTANCE_LOW)
-    createNotificationChannel(
-        FILE_CHANNEL_ID, "File transfers", NotificationManagerCompat.IMPORTANCE_DEFAULT)
-    appInstance = this
     applicationScope.launch {
-      Notifier.tileReady.collect { isTileReady -> setTileReady(isTileReady) }
+      Notifier.state.collect { state ->
+        val ableToStartVPN = state > Ipn.State.NeedsMachineAuth
+        val vpnRunning = state == Ipn.State.Starting || state == Ipn.State.Running
+        updateConnStatus(ableToStartVPN, vpnRunning)
+        QuickToggleService.setVPNRunning(vpnRunning)
+      }
     }
   }
 
-  override fun onTerminate() {
-    super.onTerminate()
-    Notifier.stop()
-    applicationScope.cancel()
-  }
-
   fun setWantRunning(wantRunning: Boolean) {
     val callback: (Result<Ipn.Prefs>) -> Unit = { result ->
       result.fold(
-          onSuccess = { _ -> setTileStatus(wantRunning) },
+          onSuccess = {},
           onFailure = { error ->
             Log.d("TAG", "Set want running: failed to update preferences: ${error.message}")
           })
@@ -167,31 +168,19 @@ class App : Application(), libtailscale.AppContext {
             }
 
             if (dns.updateDNSFromNetwork(sb.toString())) {
-              Libtailscale.onDnsConfigChanged()
+              Libtailscale.onDNSConfigChanged(linkProperties?.interfaceName)
             }
           }
 
           override fun onLost(network: Network) {
             super.onLost(network)
             if (dns.updateDNSFromNetwork("")) {
-              Libtailscale.onDnsConfigChanged()
+              Libtailscale.onDNSConfigChanged("")
             }
           }
         })
   }
 
-  fun startVPN() {
-    val intent = Intent(this, IPNService::class.java)
-    intent.setAction(IPNService.ACTION_REQUEST_VPN)
-    startService(intent)
-  }
-
-  fun stopVPN() {
-    val intent = Intent(this, IPNService::class.java)
-    intent.setAction(IPNService.ACTION_STOP_VPN)
-    startService(intent)
-  }
-
   // encryptToPref a byte array of data using the Jetpack Security
   // library and writes it to a global encrypted preference store.
   @Throws(IOException::class, GeneralSecurityException::class)
@@ -218,30 +207,16 @@ class App : Application(), libtailscale.AppContext {
         EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)
   }
 
-  fun setTileReady(ready: Boolean) {
-    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
-      return
-    }
-    QuickToggleService.setReady(this, ready)
-    Log.d("App", "Set Tile Ready: $ready $autoConnect")
-    vpnReady = ready
-    if (ready && autoConnect) {
-      startVPN()
-    }
-  }
-
-  fun setTileStatus(status: Boolean) {
-    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
-      return
-    }
-    QuickToggleService.setStatus(this, status)
-  }
-
-  fun getHostname(): String {
-    val userConfiguredDeviceName = getUserConfiguredDeviceName()
-    if (!userConfiguredDeviceName.isNullOrEmpty()) return userConfiguredDeviceName
-
-    return modelName
+  /*
+   * setAbleToStartVPN remembers whether or not we're able to start the VPN
+   * by storing this in a shared preference. This allows us to check this
+   * value without needing a fully initialized instance of the application.
+   */
+  private fun updateConnStatus(ableToStartVPN: Boolean, vpnRunning: Boolean) {
+    setAbleToStartVPN(ableToStartVPN)
+    QuickToggleService.updateTile()
+    Log.d("App", "Set Tile Ready: $ableToStartVPN")
+    notifyStatus(vpnRunning)
   }
 
   override fun getModelName(): String {
@@ -257,138 +232,10 @@ class App : Application(), libtailscale.AppContext {
 
   override fun getOSVersion(): String = Build.VERSION.RELEASE
 
-  // get user defined nickname from Settings
-  // returns null if not available
-  private fun getUserConfiguredDeviceName(): String? {
-    val nameFromSystemDevice = Settings.Secure.getString(contentResolver, "device_name")
-    if (!nameFromSystemDevice.isNullOrEmpty()) return nameFromSystemDevice
-    return null
-  }
-
-  // attachPeer adds a Peer fragment for tracking the Activity
-  // lifecycle.
-  fun attachPeer(act: Activity) {
-    act.runOnUiThread(
-        Runnable {
-          val ft: FragmentTransaction = act.fragmentManager.beginTransaction()
-          ft.add(Peer(), PEER_TAG)
-          ft.commit()
-          act.fragmentManager.executePendingTransactions()
-        })
-  }
-
   override fun isChromeOS(): Boolean {
     return packageManager.hasSystemFeature("android.hardware.type.pc")
   }
 
-  fun prepareVPN(act: Activity, reqCode: Int) {
-    act.runOnUiThread(
-        Runnable {
-          val intent: Intent? = VpnService.prepare(act)
-          if (intent == null) {
-            startVPN()
-          } else {
-            startActivityForResult(act, intent, reqCode)
-          }
-        })
-  }
-
-  fun showURL(act: Activity, url: String?) {
-    act.runOnUiThread(
-        Runnable {
-          val builder: CustomTabsIntent.Builder = CustomTabsIntent.Builder()
-          val headerColor = -0xb69b6b
-          builder.setToolbarColor(headerColor)
-          val intent: CustomTabsIntent = builder.build()
-          intent.launchUrl(act, Uri.parse(url))
-        })
-  }
-
-  @get:Throws(Exception::class)
-  val packageCertificate: ByteArray?
-    // getPackageSignatureFingerprint returns the first package signing certificate, if any.
-    get() {
-      val info: PackageInfo
-      info = packageManager.getPackageInfo(packageName, PackageManager.GET_SIGNATURES)
-      for (signature in info.signatures) {
-        return signature.toByteArray()
-      }
-      return null
-    }
-
-  @Throws(IOException::class)
-  fun insertMedia(name: String?, mimeType: String): String {
-    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-      val resolver: ContentResolver = contentResolver
-      val contentValues = ContentValues()
-      contentValues.put(MediaStore.MediaColumns.DISPLAY_NAME, name)
-      if ("" != mimeType) {
-        contentValues.put(MediaStore.MediaColumns.MIME_TYPE, mimeType)
-      }
-      val root: Uri = MediaStore.Files.getContentUri("external")
-      resolver.insert(root, contentValues).toString()
-    } else {
-      val dir: File = Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)
-      dir.mkdirs()
-      val f = File(dir, name)
-      Uri.fromFile(f).toString()
-    }
-  }
-
-  @Throws(IOException::class)
-  fun openUri(uri: String?, mode: String?): Int? {
-    val resolver: ContentResolver = contentResolver
-    return mode?.let { resolver.openFileDescriptor(Uri.parse(uri), it)?.detachFd() }
-  }
-
-  fun deleteUri(uri: String?) {
-    val resolver: ContentResolver = contentResolver
-    resolver.delete(Uri.parse(uri), null, null)
-  }
-
-  fun notifyFile(uri: String?, msg: String?) {
-    val viewIntent: Intent
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-      viewIntent = Intent(Intent.ACTION_VIEW, Uri.parse(uri))
-    } else {
-      // uri is a file:// which is not allowed to be shared outside the app.
-      viewIntent = Intent(DownloadManager.ACTION_VIEW_DOWNLOADS)
-    }
-    val pending: PendingIntent =
-        PendingIntent.getActivity(this, 0, viewIntent, PendingIntent.FLAG_UPDATE_CURRENT)
-    val builder: NotificationCompat.Builder =
-        NotificationCompat.Builder(this, FILE_CHANNEL_ID)
-            .setSmallIcon(R.drawable.ic_notification)
-            .setContentTitle("File received")
-            .setContentText(msg)
-            .setContentIntent(pending)
-            .setAutoCancel(true)
-            .setOnlyAlertOnce(true)
-            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
-    val nm: NotificationManagerCompat = NotificationManagerCompat.from(this)
-    if (ActivityCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS) !=
-        PackageManager.PERMISSION_GRANTED) {
-      // TODO: Consider calling
-      //    ActivityCompat#requestPermissions
-      // here to request the missing permissions, and then overriding
-      //   public void onRequestPermissionsResult(int requestCode, String[] permissions,
-      //                                          int[] grantResults)
-      // to handle the case where the user grants the permission. See the documentation
-      // for ActivityCompat#requestPermissions for more details.
-      return
-    }
-    nm.notify(FILE_NOTIFICATION_ID, builder.build())
-  }
-
-  fun createNotificationChannel(id: String?, name: String?, importance: Int) {
-    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
-      return
-    }
-    val channel = NotificationChannel(id, name, importance)
-    val nm: NotificationManagerCompat = NotificationManagerCompat.from(this)
-    nm.createNotificationChannel(channel)
-  }
-
   override fun getInterfacesAsString(): String {
     val interfaces: ArrayList<NetworkInterface> =
         java.util.Collections.list(NetworkInterface.getNetworkInterfaces())
@@ -424,12 +271,7 @@ class App : Application(), libtailscale.AppContext {
     return sb.toString()
   }
 
-  fun isTV(): Boolean {
-    val mm = getSystemService(Context.UI_MODE_SERVICE) as UiModeManager
-    return mm.currentModeType == Configuration.UI_MODE_TYPE_TELEVISION
-  }
-
-  fun prepareDownloadsFolder(): File {
+  private fun prepareDownloadsFolder(): File {
     var downloads = Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)
 
     try {
@@ -451,4 +293,144 @@ class App : Application(), libtailscale.AppContext {
 
     return downloads
   }
+
+  @Throws(
+      IOException::class, GeneralSecurityException::class, MDMSettings.NoSuchKeyException::class)
+  override fun getSyspolicyBooleanValue(key: String): Boolean {
+    return getSyspolicyStringValue(key) == "true"
+  }
+
+  @Throws(
+      IOException::class, GeneralSecurityException::class, MDMSettings.NoSuchKeyException::class)
+  override fun getSyspolicyStringValue(key: String): String {
+    return MDMSettings.allSettingsByKey[key]?.flow?.value?.toString()
+        ?: run {
+          Log.d("MDM", "$key is not defined on Android. Throwing NoSuchKeyException.")
+          throw MDMSettings.NoSuchKeyException()
+        }
+  }
+
+  @Throws(
+      IOException::class, GeneralSecurityException::class, MDMSettings.NoSuchKeyException::class)
+  override fun getSyspolicyStringArrayJSONValue(key: String): String {
+    val list = MDMSettings.allSettingsByKey[key]?.flow?.value as? List<String>
+    try {
+      return Json.encodeToString(list)
+    } catch (e: Exception) {
+      Log.d("MDM", "$key is not defined on Android. Throwing NoSuchKeyException.")
+      throw MDMSettings.NoSuchKeyException()
+    }
+  }
+}
+
+/**
+ * UninitializedApp contains all of the methods of App that can be used without having to initialize
+ * the Go backend. This is useful when you want to access functions on the App without creating side
+ * effects from starting the Go backend (such as launching the VPN).
+ */
+open class UninitializedApp : Application() {
+  companion object {
+    const val STATUS_NOTIFICATION_ID = 1
+    const val STATUS_CHANNEL_ID = "tailscale-status"
+
+    // Key for shared preference that tracks whether or not we're able to start
+    // the VPN (i.e. we're logged in and machine is authorized).
+    private const val ABLE_TO_START_VPN_KEY = "ableToStartVPN"
+
+    // File for shared preferences that are not encrypted.
+    private const val UNENCRYPTED_PREFERENCES = "unencrypted"
+
+    private lateinit var appInstance: UninitializedApp
+
+    @JvmStatic
+    fun get(): UninitializedApp {
+      return appInstance
+    }
+  }
+
+  protected fun setUnprotectedInstance(instance: UninitializedApp) {
+    appInstance = instance
+  }
+
+  protected fun setAbleToStartVPN(rdy: Boolean) {
+    getUnencryptedPrefs().edit().putBoolean(ABLE_TO_START_VPN_KEY, rdy).apply()
+  }
+
+  /** This function can be called without initializing the App. */
+  fun isAbleToStartVPN(): Boolean {
+    return getUnencryptedPrefs().getBoolean(ABLE_TO_START_VPN_KEY, false)
+  }
+
+  private fun getUnencryptedPrefs(): SharedPreferences {
+    return getSharedPreferences(UNENCRYPTED_PREFERENCES, MODE_PRIVATE)
+  }
+
+  fun startVPN() {
+    val intent = Intent(this, IPNService::class.java).apply { action = IPNService.ACTION_START_VPN }
+    startForegroundService(intent)
+  }
+
+  fun stopVPN() {
+    val intent = Intent(this, IPNService::class.java).apply { action = IPNService.ACTION_STOP_VPN }
+    startService(intent)
+  }
+
+  fun createNotificationChannel(id: String, name: String, description: String, importance: Int) {
+    val channel = NotificationChannel(id, name, importance)
+    channel.description = description
+    val nm: NotificationManagerCompat = NotificationManagerCompat.from(this)
+    nm.createNotificationChannel(channel)
+  }
+
+  protected fun notifyStatus(vpnRunning: Boolean) {
+    if (ActivityCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS) !=
+        PackageManager.PERMISSION_GRANTED) {
+      // TODO: Consider calling
+      //    ActivityCompat#requestPermissions
+      // here to request the missing permissions, and then overriding
+      //   public void onRequestPermissionsResult(int requestCode, String[] permissions,
+      //                                          int[] grantResults)
+      // to handle the case where the user grants the permission. See the documentation
+      // for ActivityCompat#requestPermissions for more details.
+      return
+    }
+    val nm: NotificationManagerCompat = NotificationManagerCompat.from(this)
+    nm.notify(STATUS_NOTIFICATION_ID, buildStatusNotification(vpnRunning))
+  }
+
+  fun buildStatusNotification(vpnRunning: Boolean): Notification {
+    val message = getString(if (vpnRunning) R.string.connected else R.string.not_connected)
+    val icon = if (vpnRunning) R.drawable.ic_notification else R.drawable.ic_notification_disabled
+    val action =
+        if (vpnRunning) IPNReceiver.INTENT_DISCONNECT_VPN else IPNReceiver.INTENT_CONNECT_VPN
+    val actionLabel = getString(if (vpnRunning) R.string.disconnect else R.string.connect)
+    val buttonIntent = Intent(this, IPNReceiver::class.java).apply { this.action = action }
+    val pendingButtonIntent: PendingIntent =
+        PendingIntent.getBroadcast(
+            this,
+            0,
+            buttonIntent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE)
+
+    val intent =
+        Intent(this, MainActivity::class.java).apply {
+          flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK
+        }
+    val pendingIntent: PendingIntent =
+        PendingIntent.getActivity(
+            this, 1, intent, PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE)
+
+    return NotificationCompat.Builder(this, STATUS_CHANNEL_ID)
+        .setSmallIcon(icon)
+        .setContentTitle("Tailscale")
+        .setContentText(message)
+        .setAutoCancel(!vpnRunning)
+        .setOnlyAlertOnce(!vpnRunning)
+        .setOngoing(vpnRunning)
+        .setSilent(true)
+        .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+        .addAction(NotificationCompat.Action.Builder(0, actionLabel, pendingButtonIntent).build())
+        .setContentIntent(pendingIntent)
+        .build()
+  }
 }

android/src/main/java/com/tailscale/ipn/IPNReceiver.java

@@ -12,6 +12,9 @@ import androidx.work.WorkManager;
 
 import java.util.Objects;
 
+/**
+ * IPNReceiver allows external applications to start the VPN.
+ */
 public class IPNReceiver extends BroadcastReceiver {
 
     public static final String INTENT_CONNECT_VPN = "com.tailscale.ipn.CONNECT_VPN";

android/src/main/java/com/tailscale/ipn/IPNService.kt

@@ -8,8 +8,6 @@ import android.content.pm.PackageManager
 import android.net.VpnService
 import android.os.Build
 import android.system.OsConstants
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
 import libtailscale.Libtailscale
 import java.util.UUID
 
@@ -20,35 +18,49 @@ open class IPNService : VpnService(), libtailscale.IPNService {
     return randomID
   }
 
-  override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-    if (intent != null && ACTION_STOP_VPN == intent.action) {
-      (applicationContext as App).autoConnect = false
-      close()
-      return START_NOT_STICKY
-    }
-    val app = applicationContext as App
-    if (intent != null && "android.net.VpnService" == intent.action) {
-      // Start VPN and connect to it due to Always-on VPN
-      val i = Intent(IPNReceiver.INTENT_CONNECT_VPN)
-      i.setPackage(packageName)
-      i.setClass(applicationContext, IPNReceiver::class.java)
-      sendBroadcast(i)
-      Libtailscale.requestVPN(this)
-      app.setWantRunning(true)
-      return START_STICKY
-    }
-    Libtailscale.requestVPN(this)
-    if (app.vpnReady && app.autoConnect) {
-      app.setWantRunning(true)
-    }
-    return START_STICKY
+  override fun onCreate() {
+    super.onCreate()
+    // grab app to make sure it initializes
+    App.get()
   }
 
-  override public fun close() {
+  override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int =
+      when (intent?.action) {
+        ACTION_STOP_VPN -> {
+          App.get().setWantRunning(false)
+          close()
+          START_NOT_STICKY
+        }
+        ACTION_START_VPN -> {
+          showForegroundNotification()
+          App.get().setWantRunning(true)
+          Libtailscale.requestVPN(this)
+          START_STICKY
+        }
+        "android.net.VpnService" -> {
+          // This means we were started by Android due to Always On VPN.
+          // We don't show a foreground notification because we weren't
+          // started as a foreground service.
+          App.get().setWantRunning(true)
+          Libtailscale.requestVPN(this)
+          START_STICKY
+        }
+        else -> {
+          // This means that we were restarted after the service was killed
+          // (potentially due to OOM).
+          if (UninitializedApp.get().isAbleToStartVPN()) {
+            App.get()
+            Libtailscale.requestVPN(this)
+            START_STICKY
+          } else {
+            START_NOT_STICKY
+          }
+        }
+      }
+
+  override fun close() {
     stopForeground(true)
     Libtailscale.serviceDisconnect(this)
-    val app = applicationContext as App
-    app.setWantRunning(false)
   }
 
   override fun onDestroy() {
@@ -61,6 +73,12 @@ open class IPNService : VpnService(), libtailscale.IPNService {
     super.onRevoke()
   }
 
+  private fun showForegroundNotification() {
+    startForeground(
+        UninitializedApp.STATUS_NOTIFICATION_ID,
+        UninitializedApp.get().buildStatusNotification(true))
+  }
+
   private fun configIntent(): PendingIntent {
     return PendingIntent.getActivity(
         this,
@@ -81,10 +99,10 @@ open class IPNService : VpnService(), libtailscale.IPNService {
             .setConfigureIntent(configIntent())
             .allowFamily(OsConstants.AF_INET)
             .allowFamily(OsConstants.AF_INET6)
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
-        b.setMetered(false) // Inherit the metered status from the underlying networks.
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M)
-        b.setUnderlyingNetworks(null) // Use all available networks.
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+      b.setMetered(false) // Inherit the metered status from the underlying networks.
+    }
+    b.setUnderlyingNetworks(null) // Use all available networks.
 
     // RCS/Jibe https://github.com/tailscale/tailscale/issues/2322
     disallowApp(b, "com.google.android.apps.messaging")
@@ -107,33 +125,8 @@ open class IPNService : VpnService(), libtailscale.IPNService {
     return VPNServiceBuilder(b)
   }
 
-  fun notify(title: String?, message: String?) {
-    val builder: NotificationCompat.Builder =
-        NotificationCompat.Builder(this, App.NOTIFY_CHANNEL_ID)
-            .setSmallIcon(R.drawable.ic_notification)
-            .setContentTitle(title)
-            .setContentText(message)
-            .setContentIntent(configIntent())
-            .setAutoCancel(true)
-            .setOnlyAlertOnce(true)
-            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
-    val nm: NotificationManagerCompat = NotificationManagerCompat.from(this)
-    nm.notify(App.NOTIFY_NOTIFICATION_ID, builder.build())
-  }
-
-  fun updateStatusNotification(title: String?, message: String?) {
-    val builder: NotificationCompat.Builder =
-        NotificationCompat.Builder(this, App.STATUS_CHANNEL_ID)
-            .setSmallIcon(R.drawable.ic_notification)
-            .setContentTitle(title)
-            .setContentText(message)
-            .setContentIntent(configIntent())
-            .setPriority(NotificationCompat.PRIORITY_LOW)
-    startForeground(App.STATUS_NOTIFICATION_ID, builder.build())
-  }
-
   companion object {
-    const val ACTION_REQUEST_VPN = "com.tailscale.ipn.REQUEST_VPN"
+    const val ACTION_START_VPN = "com.tailscale.ipn.START_VPN"
     const val ACTION_STOP_VPN = "com.tailscale.ipn.STOP_VPN"
   }
 }

android/src/main/java/com/tailscale/ipn/MainActivity.kt

@@ -3,6 +3,7 @@
 
 package com.tailscale.ipn
 
+import android.annotation.SuppressLint
 import android.app.Activity
 import android.content.Context
 import android.content.Intent
@@ -10,7 +11,6 @@ import android.content.RestrictionsManager
 import android.content.pm.ActivityInfo
 import android.content.res.Configuration.SCREENLAYOUT_SIZE_LARGE
 import android.content.res.Configuration.SCREENLAYOUT_SIZE_MASK
-import android.net.Uri
 import android.net.VpnService
 import android.os.Bundle
 import android.provider.Settings
@@ -19,30 +19,41 @@ import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.result.ActivityResultLauncher
 import androidx.activity.result.contract.ActivityResultContract
+import androidx.activity.viewModels
 import androidx.browser.customtabs.CustomTabsIntent
 import androidx.compose.animation.core.tween
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
 import androidx.compose.animation.slideInHorizontally
 import androidx.compose.animation.slideOutHorizontally
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.runtime.collectAsState
+import androidx.compose.ui.Modifier
 import androidx.core.net.toUri
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
 import androidx.lifecycle.lifecycleScope
+import androidx.navigation.NavHostController
 import androidx.navigation.NavType
 import androidx.navigation.compose.NavHost
 import androidx.navigation.compose.composable
 import androidx.navigation.compose.rememberNavController
 import androidx.navigation.navArgument
-import androidx.navigation.navigation
-import com.tailscale.ipn.Peer.RequestCodes
 import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.notifier.Notifier
 import com.tailscale.ipn.ui.theme.AppTheme
+import com.tailscale.ipn.ui.util.AndroidTVUtil
+import com.tailscale.ipn.ui.util.set
+import com.tailscale.ipn.ui.util.universalFit
 import com.tailscale.ipn.ui.view.AboutView
-import com.tailscale.ipn.ui.view.BackNavigation
 import com.tailscale.ipn.ui.view.BugReportView
 import com.tailscale.ipn.ui.view.DNSSettingsView
 import com.tailscale.ipn.ui.view.ExitNodePicker
 import com.tailscale.ipn.ui.view.IntroView
+import com.tailscale.ipn.ui.view.LoginQRView
+import com.tailscale.ipn.ui.view.LoginWithAuthKeyView
+import com.tailscale.ipn.ui.view.LoginWithCustomControlURLView
 import com.tailscale.ipn.ui.view.MDMSettingsDebugView
 import com.tailscale.ipn.ui.view.MainView
 import com.tailscale.ipn.ui.view.MainViewNavigation
@@ -54,24 +65,26 @@ import com.tailscale.ipn.ui.view.PermissionsView
 import com.tailscale.ipn.ui.view.RunExitNodeView
 import com.tailscale.ipn.ui.view.SettingsView
 import com.tailscale.ipn.ui.view.TailnetLockSetupView
+import com.tailscale.ipn.ui.view.UserSwitcherNav
 import com.tailscale.ipn.ui.view.UserSwitcherView
 import com.tailscale.ipn.ui.viewModel.ExitNodePickerNav
+import com.tailscale.ipn.ui.viewModel.MainViewModel
 import com.tailscale.ipn.ui.viewModel.SettingsNav
-import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.launch
 
 class MainActivity : ComponentActivity() {
   private lateinit var requestVpnPermission: ActivityResultLauncher<Unit>
+  private lateinit var navController: NavHostController
+  private lateinit var vpnPermissionLauncher: ActivityResultLauncher<Intent>
+  private val viewModel: MainViewModel by viewModels()
 
   companion object {
-    // Request codes for Android callbacks.
-    // requestPrepareVPN is for when Android's VpnService.prepare completes.
-    @JvmStatic val requestPrepareVPN: Int = 1001
-
-    const val WRITE_STORAGE_RESULT = 1000
     private const val TAG = "Main Activity"
+    private const val START_AT_ROOT = "startAtRoot"
   }
 
   private fun Context.isLandscapeCapable(): Boolean {
@@ -79,9 +92,18 @@ class MainActivity : ComponentActivity() {
         SCREENLAYOUT_SIZE_LARGE
   }
 
+  // The loginQRCode is used to track whether or not we should be rendering a QR code
+  // to the user.  This is used only on TV platforms with no browser in lieu of
+  // simply opening the URL.  This should be consumed once it has been handled.
+  private val loginQRCode: StateFlow<String?> = MutableStateFlow(null)
+
+  @SuppressLint("SourceLockedOrientationActivity")
   override fun onCreate(savedInstanceState: Bundle?) {
     super.onCreate(savedInstanceState)
 
+    // grab app to make sure it initializes
+    App.get()
+
     // (jonathan) TODO: Force the app to be portrait on small screens until we have
     // proper landscape layout support
     if (!isLandscapeCapable()) {
@@ -90,123 +112,179 @@ class MainActivity : ComponentActivity() {
 
     installSplashScreen()
 
+    vpnPermissionLauncher =
+        registerForActivityResult(VpnPermissionContract()) { granted ->
+          if (granted) {
+            Log.d("VpnPermission", "VPN permission granted")
+            viewModel.setVpnPrepared(true)
+          } else {
+            Log.d("VpnPermission", "VPN permission denied")
+            viewModel.setVpnPrepared(false)
+          }
+        }
+        viewModel.setVpnPermissionLauncher(vpnPermissionLauncher)
+
     setContent {
       AppTheme {
-        val navController = rememberNavController()
-        NavHost(
-            navController = navController,
-            startDestination = "main",
-            enterTransition = {
-              slideInHorizontally(animationSpec = tween(150), initialOffsetX = { it })
-            },
-            exitTransition = {
-              slideOutHorizontally(animationSpec = tween(150), targetOffsetX = { -it })
-            },
-            popEnterTransition = {
-              slideInHorizontally(animationSpec = tween(150), initialOffsetX = { -it })
-            },
-            popExitTransition = {
-              slideOutHorizontally(animationSpec = tween(150), targetOffsetX = { it })
-            }) {
-              val mainViewNav =
-                  MainViewNavigation(
-                      onNavigateToSettings = { navController.navigate("settings") },
-                      onNavigateToPeerDetails = {
-                        navController.navigate("peerDetails/${it.StableID}")
-                      },
-                      onNavigateToExitNodes = { navController.navigate("exitNodes") },
-                  )
-
-              val settingsNav =
-                  SettingsNav(
-                      onNavigateToBugReport = { navController.navigate("bugReport") },
-                      onNavigateToAbout = { navController.navigate("about") },
-                      onNavigateToDNSSettings = { navController.navigate("dnsSettings") },
-                      onNavigateToTailnetLock = { navController.navigate("tailnetLock") },
-                      onNavigateToMDMSettings = { navController.navigate("mdmSettings") },
-                      onNavigateToManagedBy = { navController.navigate("managedBy") },
-                      onNavigateToUserSwitcher = { navController.navigate("userSwitcher") },
-                      onNavigateToPermissions = { navController.navigate("permissions") },
-                      onBackPressed = { navController.popBackStack() },
-                  )
-
-              val backNav = BackNavigation(onBack = { navController.popBackStack() })
-
-              val exitNodePickerNav =
-                  ExitNodePickerNav(
-                      onNavigateHome = {
-                        navController.popBackStack(route = "main", inclusive = false)
-                      },
-                      onNavigateBack = { navController.popBackStack() },
-                      onNavigateToExitNodePicker = { navController.popBackStack() },
-                      onNavigateToMullvad = { navController.navigate("mullvad") },
-                      onNavigateToMullvadCountry = { navController.navigate("mullvad/$it") },
-                      onNavigateToRunAsExitNode = { navController.navigate("runExitNode") })
-
-              composable("main") { MainView(navigation = mainViewNav) }
-              composable("settings") { SettingsView(settingsNav) }
-              navigation(startDestination = "list", route = "exitNodes") {
-                composable("list") { ExitNodePicker(exitNodePickerNav) }
-                composable("mullvad") { MullvadExitNodePickerList(exitNodePickerNav) }
-                composable(
-                    "mullvad/{countryCode}",
-                    arguments = listOf(navArgument("countryCode") { type = NavType.StringType })) {
-                      MullvadExitNodePicker(
-                          it.arguments!!.getString("countryCode")!!, exitNodePickerNav)
-                    }
-                composable("runExitNode") { RunExitNodeView(exitNodePickerNav) }
-              }
-              composable(
-                  "peerDetails/{nodeId}",
-                  arguments = listOf(navArgument("nodeId") { type = NavType.StringType })) {
-                    PeerDetails(nav = backNav, it.arguments?.getString("nodeId") ?: "")
+        navController = rememberNavController()
+        Surface(color = MaterialTheme.colorScheme.inverseSurface) { // Background for the letterbox
+          Surface(modifier = Modifier.universalFit()) { // Letterbox for AndroidTV
+            NavHost(
+                navController = navController,
+                startDestination = "main",
+                enterTransition = {
+                  slideInHorizontally(animationSpec = tween(150), initialOffsetX = { it })
+                },
+                exitTransition = {
+                  slideOutHorizontally(animationSpec = tween(150), targetOffsetX = { -it })
+                },
+                popEnterTransition = {
+                  slideInHorizontally(animationSpec = tween(150), initialOffsetX = { -it })
+                },
+                popExitTransition = {
+                  slideOutHorizontally(animationSpec = tween(150), targetOffsetX = { it })
+                }) {
+                  fun backTo(route: String): () -> Unit = {
+                    navController.popBackStack(route = route, inclusive = false)
+                  }
+
+                  val mainViewNav =
+                      MainViewNavigation(
+                          onNavigateToSettings = { navController.navigate("settings") },
+                          onNavigateToPeerDetails = {
+                            navController.navigate("peerDetails/${it.StableID}")
+                          },
+                          onNavigateToExitNodes = { navController.navigate("exitNodes") },
+                      )
+
+                  val settingsNav =
+                      SettingsNav(
+                          onNavigateToBugReport = { navController.navigate("bugReport") },
+                          onNavigateToAbout = { navController.navigate("about") },
+                          onNavigateToDNSSettings = { navController.navigate("dnsSettings") },
+                          onNavigateToTailnetLock = { navController.navigate("tailnetLock") },
+                          onNavigateToMDMSettings = { navController.navigate("mdmSettings") },
+                          onNavigateToManagedBy = { navController.navigate("managedBy") },
+                          onNavigateToUserSwitcher = { navController.navigate("userSwitcher") },
+                          onNavigateToPermissions = { navController.navigate("permissions") },
+                          onBackToSettings = backTo("settings"),
+                          onNavigateBackHome = backTo("main"))
+
+                  val exitNodePickerNav =
+                      ExitNodePickerNav(
+                          onNavigateBackHome = {
+                            navController.popBackStack(route = "main", inclusive = false)
+                          },
+                          onNavigateBackToExitNodes = backTo("exitNodes"),
+                          onNavigateToMullvad = { navController.navigate("mullvad") },
+                          onNavigateBackToMullvad = backTo("mullvad"),
+                          onNavigateToMullvadCountry = { navController.navigate("mullvad/$it") },
+                          onNavigateToRunAsExitNode = { navController.navigate("runExitNode") })
+
+                  val userSwitcherNav =
+                      UserSwitcherNav(
+                          backToSettings = backTo("settings"),
+                          onNavigateHome = backTo("main"),
+                          onNavigateCustomControl = {
+                            navController.navigate("loginWithCustomControl")
+                          },
+                          onNavigateToAuthKey = { navController.navigate("loginWithAuthKey") })
+
+                  composable("main", enterTransition = { fadeIn(animationSpec = tween(150)) }) {
+                    MainView(loginAtUrl = ::login, navigation = mainViewNav, viewModel = viewModel)
+                  }
+                  composable("settings") { SettingsView(settingsNav) }
+                  composable("exitNodes") { ExitNodePicker(exitNodePickerNav) }
+                  composable("mullvad") { MullvadExitNodePickerList(exitNodePickerNav) }
+                  composable(
+                      "mullvad/{countryCode}",
+                      arguments =
+                          listOf(navArgument("countryCode") { type = NavType.StringType })) {
+                        MullvadExitNodePicker(
+                            it.arguments!!.getString("countryCode")!!, exitNodePickerNav)
+                      }
+                  composable("runExitNode") { RunExitNodeView(exitNodePickerNav) }
+                  composable(
+                      "peerDetails/{nodeId}",
+                      arguments = listOf(navArgument("nodeId") { type = NavType.StringType })) {
+                        PeerDetails(backTo("main"), it.arguments?.getString("nodeId") ?: "")
+                      }
+                  composable("bugReport") { BugReportView(backTo("settings")) }
+                  composable("dnsSettings") { DNSSettingsView(backTo("settings")) }
+                  composable("tailnetLock") { TailnetLockSetupView(backTo("settings")) }
+                  composable("about") { AboutView(backTo("settings")) }
+                  composable("mdmSettings") { MDMSettingsDebugView(backTo("settings")) }
+                  composable("managedBy") { ManagedByView(backTo("settings")) }
+                  composable("userSwitcher") { UserSwitcherView(userSwitcherNav) }
+                  composable("permissions") {
+                    PermissionsView(backTo("settings"), ::openApplicationSettings)
+                  }
+                  composable("intro", exitTransition = { fadeOut(animationSpec = tween(150)) }) {
+                    IntroView(backTo("main"))
+                  }
+                  composable("loginWithAuthKey") {
+                    LoginWithAuthKeyView(onNavigateHome = backTo("main"), backTo("userSwitcher"))
                   }
-              composable("bugReport") { BugReportView(nav = backNav) }
-              composable("dnsSettings") { DNSSettingsView(nav = backNav) }
-              composable("tailnetLock") { TailnetLockSetupView(nav = backNav) }
-              composable("about") { AboutView(nav = backNav) }
-              composable("mdmSettings") { MDMSettingsDebugView(nav = backNav) }
-              composable("managedBy") { ManagedByView(nav = backNav) }
-              composable("userSwitcher") {
-                UserSwitcherView(
-                    nav = backNav,
-                    onNavigateHome = {
-                      navController.popBackStack(route = "main", inclusive = false)
-                    })
-              }
-              composable("permissions") {
-                PermissionsView(nav = backNav, openApplicationSettings = ::openApplicationSettings)
-              }
-              composable("intro") { IntroView { navController.popBackStack() } }
+                  composable("loginWithCustomControl") {
+                    LoginWithCustomControlURLView(
+                        onNavigateHome = backTo("main"), backTo("userSwitcher"))
+                  }
+                }
+
+            // Show the intro screen one time
+            if (!introScreenViewed()) {
+              navController.navigate("intro")
+              setIntroScreenViewed(true)
             }
+          }
+        }
 
-        // Show the intro screen one time
-        if (!introScreenViewed()) {
-          navController.navigate("intro")
-          setIntroScreenViewed(true)
+        // Login actions are app wide.  If we are told about a browse-to-url, we should render it
+        // over whatever screen we happen to be on.
+        loginQRCode.collectAsState().value?.let {
+          LoginQRView(onDismiss = { loginQRCode.set(null) })
         }
       }
     }
+  }
+
+  init {
+    // Watch the model's browseToURL and launch the browser when it changes or
+    // pop up a QR code to scan
     lifecycleScope.launch {
-      Notifier.readyToPrepareVPN.collect { isReady ->
-        if (isReady)
-            App.getApplication().prepareVPN(this@MainActivity, RequestCodes.requestPrepareVPN)
+      Notifier.browseToURL.collect { url ->
+        url?.let {
+          when (useQRCodeLogin()) {
+            false -> Dispatchers.Main.run { login(it) }
+            true -> loginQRCode.set(it)
+          }
+        }
       }
     }
+
+    // Once we see a loginFinished event, clear the QR code which will dismiss the QR dialog.
+    lifecycleScope.launch { Notifier.loginFinished.collect { _ -> loginQRCode.set(null) } }
   }
 
-  init {
-    // Watch the model's browseToURL and launch the browser when it changes
-    // This will trigger the login flow
-    lifecycleScope.launch {
-      Notifier.browseToURL.collect { url -> url?.let { Dispatchers.Main.run { login(it) } } }
+  // Returns true if we should render a QR code instead of launching a browser
+  // for login requests
+  private fun useQRCodeLogin(): Boolean {
+    return AndroidTVUtil.isAndroidTV()
+  }
+
+  override fun onNewIntent(intent: Intent?) {
+    super.onNewIntent(intent)
+    if (intent?.getBooleanExtra(START_AT_ROOT, false) == true) {
+      if (this::navController.isInitialized) {
+        navController.popBackStack(route = "main", inclusive = false)
+      }
     }
   }
 
   private fun login(urlString: String) {
     // Launch coroutine to listen for state changes. When the user completes login, relaunch
     // MainActivity to bring the app back to focus.
-    App.getApplication().applicationScope.launch {
+    App.get().applicationScope.launch {
       try {
         Notifier.state.collect { state ->
           if (state > Ipn.State.NeedsMachineAuth) {
@@ -215,6 +293,7 @@ class MainActivity : ComponentActivity() {
                   addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
                   action = Intent.ACTION_MAIN
                   addCategory(Intent.CATEGORY_LAUNCHER)
+                  putExtra(START_AT_ROOT, true)
                 }
             startActivity(intent)
 
@@ -246,45 +325,25 @@ class MainActivity : ComponentActivity() {
     super.onResume()
     val restrictionsManager =
         this.getSystemService(Context.RESTRICTIONS_SERVICE) as RestrictionsManager
-    lifecycleScope.launch(Dispatchers.IO) {
-      MDMSettings.update(App.getApplication(), restrictionsManager)
-    }
+    lifecycleScope.launch(Dispatchers.IO) { MDMSettings.update(App.get(), restrictionsManager) }
   }
 
   override fun onStart() {
     super.onStart()
-
-    // (jonathan) TODO: Requesting VPN permissions onStart is a bit aggressive.  This should
-    // be done when the user initiall starts the VPN
-    requestVpnPermission()
   }
 
   override fun onStop() {
     super.onStop()
     val restrictionsManager =
         this.getSystemService(Context.RESTRICTIONS_SERVICE) as RestrictionsManager
-    lifecycleScope.launch(Dispatchers.IO) {
-      MDMSettings.update(App.getApplication(), restrictionsManager)
-    }
-  }
-
-  private fun requestVpnPermission() {
-    val vpnIntent = VpnService.prepare(this)
-    if (vpnIntent != null) {
-      val contract = VpnPermissionContract()
-      requestVpnPermission =
-          registerForActivityResult(contract) { granted ->
-            Log.i("VPN", "VPN permission ${if (granted) "granted" else "denied"}")
-          }
-      requestVpnPermission.launch(Unit)
-    }
+    lifecycleScope.launch(Dispatchers.IO) { MDMSettings.update(App.get(), restrictionsManager) }
   }
 
   private fun openApplicationSettings() {
     val intent =
-        Intent(
-            Settings.ACTION_APPLICATION_DETAILS_SETTINGS,
-            Uri.fromParts("package", packageName, null))
+        Intent(Settings.ACTION_APP_NOTIFICATION_SETTINGS).apply {
+          putExtra(Settings.EXTRA_APP_PACKAGE, packageName)
+        }
     intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
     startActivity(intent)
   }
@@ -301,9 +360,9 @@ class MainActivity : ComponentActivity() {
   }
 }
 
-class VpnPermissionContract : ActivityResultContract<Unit, Boolean>() {
-  override fun createIntent(context: Context, input: Unit): Intent {
-    return VpnService.prepare(context) ?: Intent()
+class VpnPermissionContract : ActivityResultContract<Intent, Boolean>() {
+  override fun createIntent(context: Context, input: Intent): Intent {
+    return input
   }
 
   override fun parseResult(resultCode: Int, intent: Intent?): Boolean {

android/src/main/java/com/tailscale/ipn/Peer.java

@@ -1,28 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package com.tailscale.ipn;
-
-import android.app.Fragment;
-import android.content.Intent;
-
-public class Peer extends Fragment {
-
-    private static int resultOK = -1;
-
-    public class RequestCodes {
-        public static final int requestPrepareVPN = 1001;
-    }
-
-    @Override
-    public void onActivityResult(int requestCode, int resultCode, Intent data) {
-        if (requestCode == RequestCodes.requestPrepareVPN) {
-            if (resultCode == resultOK) {
-                App.getApplication().startVPN();
-            } else {
-                App.getApplication().setWantRunning(false);
-                // notify VPN revoked
-            }
-        }
-    }
-}

android/src/main/java/com/tailscale/ipn/QuickToggleService.java

@@ -3,46 +3,44 @@
 
 package com.tailscale.ipn;
 
-import android.content.Context;
+import android.app.PendingIntent;
 import android.content.Intent;
+import android.os.Build;
 import android.service.quicksettings.Tile;
 import android.service.quicksettings.TileService;
 
 public class QuickToggleService extends TileService {
     // lock protects the static fields below it.
     private static final Object lock = new Object();
-    // Active tracks whether the VPN is active.
-    private static boolean active;
-    // Ready tracks whether the tailscale backend is
-    // ready to switch on/off.
-    private static boolean ready;
+
+    // isRunning tracks whether the VPN is running.
+    private static boolean isRunning;
+
     // currentTile tracks getQsTile while service is listening.
     private static Tile currentTile;
 
-    private static void updateTile() {
+    public static void updateTile() {
+        var app = UninitializedApp.get();
         Tile t;
         boolean act;
         synchronized (lock) {
             t = currentTile;
-            act = active && ready;
+            act = isRunning && app.isAbleToStartVPN();
         }
         if (t == null) {
             return;
         }
+        t.setLabel("Tailscale");
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            t.setSubtitle(act ? app.getString(R.string.connected) : app.getString(R.string.not_connected));
+        }
         t.setState(act ? Tile.STATE_ACTIVE : Tile.STATE_INACTIVE);
         t.updateTile();
     }
 
-    static void setReady(Context ctx, boolean rdy) {
+    static void setVPNRunning(boolean running) {
         synchronized (lock) {
-            ready = rdy;
-        }
-        updateTile();
-    }
-
-    static void setStatus(Context ctx, boolean act) {
-        synchronized (lock) {
-            active = act;
+            isRunning = running;
         }
         updateTile();
     }
@@ -66,25 +64,34 @@ public class QuickToggleService extends TileService {
     public void onClick() {
         boolean r;
         synchronized (lock) {
-            r = ready;
+            r = UninitializedApp.get().isAbleToStartVPN();
         }
         if (r) {
+            // Get the application to make sure it initializes
+            App.get();
             onTileClick();
         } else {
             // Start main activity.
             Intent i = getPackageManager().getLaunchIntentForPackage(getPackageName());
-            startActivityAndCollapse(i);
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                // Request code for opening activity.
+                startActivityAndCollapse(PendingIntent.getActivity(this, 0, i, PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_IMMUTABLE));
+            } else {
+                startActivityAndCollapse(i);
+            }
         }
     }
 
     private void onTileClick() {
-        boolean act;
+        UninitializedApp app = UninitializedApp.get();
+        boolean needsToStop;
         synchronized (lock) {
-            act = active && ready;
+            needsToStop = app.isAbleToStartVPN() && isRunning;
+        }
+        if (needsToStop) {
+            app.stopVPN();
+        } else {
+            app.startVPN();
         }
-        Intent i = new Intent(act ? IPNReceiver.INTENT_DISCONNECT_VPN : IPNReceiver.INTENT_CONNECT_VPN);
-        i.setPackage(getPackageName());
-        i.setClass(getApplicationContext(), com.tailscale.ipn.IPNReceiver.class);
-        sendBroadcast(i);
     }
 }

android/src/main/java/com/tailscale/ipn/ShareActivity.kt

@@ -11,11 +11,15 @@ import android.provider.OpenableColumns
 import android.util.Log
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.ui.Modifier
 import androidx.lifecycle.lifecycleScope
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.notifier.Notifier
 import com.tailscale.ipn.ui.theme.AppTheme
 import com.tailscale.ipn.ui.util.set
+import com.tailscale.ipn.ui.util.universalFit
 import com.tailscale.ipn.ui.view.TaildropView
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -29,7 +33,13 @@ class ShareActivity : ComponentActivity() {
   override fun onCreate(state: Bundle?) {
     super.onCreate(state)
     setContent {
-      AppTheme { TaildropView(requestedTransfers, (application as App).applicationScope) }
+      AppTheme {
+        Surface(color = MaterialTheme.colorScheme.inverseSurface) { // Background for the letterbox
+          Surface(modifier = Modifier.universalFit()) {
+            TaildropView(requestedTransfers, (application as App).applicationScope)
+          }
+        }
+      }
     }
   }
 

android/src/main/java/com/tailscale/ipn/StartVPNWorker.java

@@ -11,56 +11,53 @@ import android.content.Intent;
 import android.net.VpnService;
 import android.os.Build;
 
+import androidx.annotation.NonNull;
 import androidx.work.Worker;
 import androidx.work.WorkerParameters;
 
+/**
+ * A worker that exists to support IPNReceiver.
+ */
 public final class StartVPNWorker extends Worker {
 
-    public StartVPNWorker(
-            Context appContext,
-            WorkerParameters workerParams) {
+    public StartVPNWorker(Context appContext, WorkerParameters workerParams) {
         super(appContext, workerParams);
     }
 
+    @NonNull
     @Override
     public Result doWork() {
-        App app = ((App) getApplicationContext());
-
-        // We will start the VPN from the background
-        app.setAutoConnect(true);
-        // We need to make sure we prepare the VPN Service, just in case it isn't prepared.
+        UninitializedApp app = UninitializedApp.get();
+        boolean ableToStartVPN = app.isAbleToStartVPN();
+        if (ableToStartVPN) {
+            if (VpnService.prepare(app) == null) {
+                // We're ready and have permissions, start the VPN
+                app.startVPN();
+                return Result.success();
+            }
+        }
 
-        Intent intent = VpnService.prepare(app);
-        if (intent == null) {
-            // If null then the VPN is already prepared and/or it's just been prepared because we have permission
-            app.startVPN();
-            return Result.success();
-        } else {
-            // This VPN possibly doesn't have permission, we need to display a notification which when clicked launches the intent provided.
-            android.util.Log.e("StartVPNWorker", "Tailscale doesn't have permission from the system to start VPN. Launching the intent provided.");
+        // We aren't ready to start the VPN or don't have permission, open the Tailscale app.
+        android.util.Log.e("StartVPNWorker", "Tailscale isn't ready to start the VPN, notify the user.");
 
-            // Send notification
-            NotificationManager notificationManager = (NotificationManager) app.getSystemService(Context.NOTIFICATION_SERVICE);
-            String channelId = "start_vpn_channel";
+        // Send notification
+        NotificationManager notificationManager = (NotificationManager) app.getSystemService(Context.NOTIFICATION_SERVICE);
+        String channelId = "start_vpn_channel";
 
-            // Use createNotificationChannel method from App.java
-            app.createNotificationChannel(channelId, "Start VPN Channel", NotificationManager.IMPORTANCE_DEFAULT);
+        // Use createNotificationChannel method from App.java
+        app.createNotificationChannel(channelId, getApplicationContext().getString(R.string.vpn_start), getApplicationContext().getString(R.string.notifications_delivered_when_user_interaction_is_required_to_establish_the_vpn_tunnel), NotificationManager.IMPORTANCE_HIGH);
 
-            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            int pendingIntentFlags = PendingIntent.FLAG_ONE_SHOT | (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S ? PendingIntent.FLAG_IMMUTABLE : 0);
-            PendingIntent pendingIntent = PendingIntent.getActivity(app, 0, intent, pendingIntentFlags);
+        // Use prepareIntent if available.
+        Intent intent = app.getPackageManager().getLaunchIntentForPackage(app.getPackageName());
+        assert intent != null;
+        intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        int pendingIntentFlags = PendingIntent.FLAG_ONE_SHOT | (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S ? PendingIntent.FLAG_IMMUTABLE : 0);
+        PendingIntent pendingIntent = PendingIntent.getActivity(app, 0, intent, pendingIntentFlags);
 
-            Notification notification = new Notification.Builder(app, channelId)
-                    .setContentTitle("Tailscale Connection Failed")
-                    .setContentText("Tap here to renew permission.")
-                    .setSmallIcon(R.drawable.ic_notification)
-                    .setContentIntent(pendingIntent)
-                    .setAutoCancel(true)
-                    .build();
+        Notification notification = new Notification.Builder(app, channelId).setContentTitle(app.getString(R.string.title_connection_failed)).setContentText(app.getString(R.string.body_open_tailscale)).setSmallIcon(R.drawable.ic_notification).setContentIntent(pendingIntent).setAutoCancel(true).build();
 
-            notificationManager.notify(1, notification);
+        notificationManager.notify(1, notification);
 
-            return Result.failure();
-        }
+        return Result.failure();
     }
 }

android/src/main/java/com/tailscale/ipn/StopVPNWorker.java

@@ -5,9 +5,13 @@ package com.tailscale.ipn;
 
 import android.content.Context;
 
+import androidx.annotation.NonNull;
 import androidx.work.Worker;
 import androidx.work.WorkerParameters;
 
+/**
+ * A worker that exists to support IPNReceiver.
+ */
 public final class StopVPNWorker extends Worker {
 
     public StopVPNWorker(
@@ -16,9 +20,10 @@ public final class StopVPNWorker extends Worker {
         super(appContext, workerParams);
     }
 
+    @NonNull
     @Override
     public Result doWork() {
-        App.getApplication().setWantRunning(false);
+        UninitializedApp.get().stopVPN();
         return Result.success();
     }
 }

android/src/main/java/com/tailscale/ipn/VPNServiceBuilder.kt

@@ -5,6 +5,8 @@ package com.tailscale.ipn
 
 import android.net.VpnService
 import libtailscale.ParcelFileDescriptor
+import java.net.InetAddress
+import android.net.IpPrefix as AndroidIpPrefix
 
 class VPNServiceBuilder(private val builder: VpnService.Builder) : libtailscale.VPNServiceBuilder {
   override fun addAddress(p0: String, p1: Int) {
@@ -19,6 +21,12 @@ class VPNServiceBuilder(private val builder: VpnService.Builder) : libtailscale.
     builder.addRoute(p0, p1)
   }
 
+  override fun excludeRoute(p0: String, p1: Int) {
+    val inetAddress = InetAddress.getByName(p0)
+    val prefix = AndroidIpPrefix(inetAddress, p1)
+    builder.excludeRoute(prefix)
+  }
+
   override fun addSearchDomain(p0: String) {
     builder.addSearchDomain(p0)
   }

android/src/main/java/com/tailscale/ipn/mdm/MDMSettings.kt

@@ -11,42 +11,78 @@ import kotlin.reflect.full.isSubclassOf
 import kotlin.reflect.jvm.jvmErasure
 
 object MDMSettings {
+  // The String message used in this NoSuchKeyException must match the value of
+  // syspolicy.ErrNoSuchKey defined in Go, since the backend checks the value
+  // returned by the handler for equality using errors.Is().
+  class NoSuchKeyException : Exception("no such key")
+
   val forceEnabled = BooleanMDMSetting("ForceEnabled", "Force Enabled Connection Toggle")
 
+  // Handled on the backed
   val exitNodeID = StringMDMSetting("ExitNodeID", "Forced Exit Node: Stable ID")
+
+  // (jonathan) TODO: Unused but required. There is some funky go string duration parsing required
+  // here.
   val keyExpirationNotice = StringMDMSetting("KeyExpirationNotice", "Key Expiration Notice Period")
+
   val loginURL = StringMDMSetting("LoginURL", "Custom control server URL")
+
   val managedByCaption = StringMDMSetting("ManagedByCaption", "Managed By - Caption")
+
   val managedByOrganizationName =
       StringMDMSetting("ManagedByOrganizationName", "Managed By - Organization Name")
+
   val managedByURL = StringMDMSetting("ManagedByURL", "Managed By - Support URL")
+
+  // Handled on the backend
   val tailnet = StringMDMSetting("Tailnet", "Recommended/Required Tailnet Name")
 
   val hiddenNetworkDevices =
       StringArrayListMDMSetting("HiddenNetworkDevices", "Hidden Network Device Categories")
 
+  // Unused on Android
   val allowIncomingConnections =
       AlwaysNeverUserDecidesMDMSetting("AllowIncomingConnections", "Allow Incoming Connections")
+
+  // Unused on Android
   val detectThirdPartyAppConflicts =
       AlwaysNeverUserDecidesMDMSetting(
           "DetectThirdPartyAppConflicts", "Detect potentially problematic third-party apps")
+
   val exitNodeAllowLANAccess =
       AlwaysNeverUserDecidesMDMSetting(
           "ExitNodeAllowLANAccess", "Allow LAN Access when using an exit node")
+
+  // Handled on the backend
   val postureChecking =
       AlwaysNeverUserDecidesMDMSetting("PostureChecking", "Enable Posture Checking")
+
   val useTailscaleDNSSettings =
       AlwaysNeverUserDecidesMDMSetting("UseTailscaleDNSSettings", "Use Tailscale DNS Settings")
+
+  // Unused on Android
   val useTailscaleSubnets =
       AlwaysNeverUserDecidesMDMSetting("UseTailscaleSubnets", "Use Tailscale Subnets")
 
   val exitNodesPicker = ShowHideMDMSetting("ExitNodesPicker", "Exit Nodes Picker")
+
   val manageTailnetLock = ShowHideMDMSetting("ManageTailnetLock", "“Manage Tailnet lock” menu item")
+
+  // Unused on Android
   val resetToDefaults = ShowHideMDMSetting("ResetToDefaults", "“Reset to Defaults” menu item")
+
   val runExitNode = ShowHideMDMSetting("RunExitNode", "Run as Exit Node")
+
+  // Unused on Android
   val testMenu = ShowHideMDMSetting("TestMenu", "Show Debug Menu")
+
+  // Unused on Android
   val updateMenu = ShowHideMDMSetting("UpdateMenu", "“Update Available” menu item")
 
+  // (jonathan) TODO: Use this when suggested exit nodes are implemented
+  val allowedSuggestedExitNodes =
+      StringArrayListMDMSetting("AllowedSuggestedExitNodes", "Allowed Suggested Exit Nodes")
+
   val allSettings by lazy {
     MDMSettings::class
         .declaredMemberProperties
@@ -57,6 +93,8 @@ object MDMSettings {
         .map { it.call(MDMSettings) as MDMSetting<*> }
   }
 
+  val allSettingsByKey by lazy { allSettings.associateBy { it.key } }
+
   fun update(app: App, restrictionsManager: RestrictionsManager?) {
     val bundle = restrictionsManager?.applicationRestrictions
     allSettings.forEach { it.setFrom(bundle, app) }

android/src/main/java/com/tailscale/ipn/mdm/MDMSettingsDefinitions.kt

@@ -44,7 +44,7 @@ class AlwaysNeverUserDecidesMDMSetting(key: String, localizedTitle: String) :
   override fun getFrom(bundle: Bundle?, app: App): AlwaysNeverUserDecides {
     val storedString =
         bundle?.getString(key)
-            ?: App.getApplication().getEncryptedPrefs().getString(key, null)
+            ?: App.get().getEncryptedPrefs().getString(key, null)
             ?: "user-decides"
     return when (storedString) {
       "always" -> {
@@ -64,9 +64,7 @@ class ShowHideMDMSetting(key: String, localizedTitle: String) :
     MDMSetting<ShowHide>(ShowHide.Show, key, localizedTitle) {
   override fun getFrom(bundle: Bundle?, app: App): ShowHide {
     val storedString =
-        bundle?.getString(key)
-            ?: App.getApplication().getEncryptedPrefs().getString(key, null)
-            ?: "show"
+        bundle?.getString(key) ?: App.get().getEncryptedPrefs().getString(key, null) ?: "show"
     return when (storedString) {
       "hide" -> {
         ShowHide.Hide
@@ -81,7 +79,12 @@ class ShowHideMDMSetting(key: String, localizedTitle: String) :
 enum class AlwaysNeverUserDecides(val value: String) {
   Always("always"),
   Never("never"),
-  UserDecides("user-decides")
+  UserDecides("user-decides");
+
+  val hiddenFromUser: Boolean
+    get() {
+      return this != UserDecides
+    }
 }
 
 enum class ShowHide(val value: String) {

android/src/main/java/com/tailscale/ipn/ui/localapi/Client.kt

@@ -46,6 +46,7 @@ private object Endpoint {
   const val FILES = "files"
   const val FILE_PUT = "file-put"
   const val TAILFS_SERVER_ADDRESS = "tailfs/fileserver-address"
+  const val ENABLE_EXIT_NODE = "set-use-exit-node-enabled"
 }
 
 typealias StatusResponseHandler = (Result<IpnState.Status>) -> Unit
@@ -85,6 +86,11 @@ class Client(private val scope: CoroutineScope) {
     return patch(Endpoint.PREFS, body, responseHandler = responseHandler)
   }
 
+  fun setUseExitNode(use: Boolean, responseHandler: (Result<Ipn.Prefs>) -> Unit) {
+    val path = "${Endpoint.ENABLE_EXIT_NODE}?enabled=$use"
+    return post(path, responseHandler = responseHandler)
+  }
+
   fun profiles(responseHandler: (Result<List<IpnLocal.LoginProfile>>) -> Unit) {
     get(Endpoint.PROFILES, responseHandler = responseHandler)
   }

android/src/main/java/com/tailscale/ipn/ui/model/Ipn.kt

@@ -65,7 +65,22 @@ class Ipn {
       var ForceDaemon: Boolean = false,
       var HostName: String = "",
       var AutoUpdate: AutoUpdatePrefs? = AutoUpdatePrefs(true, true),
-  )
+      var InternalExitNodePrior: String? = null,
+  ) {
+
+    // For the InternalExitNodePrior and ExitNodeId, these will treats the empty string as null to
+    // simplify the downstream logic.
+
+    val selectedExitNodeID: String?
+      get() {
+        return if (InternalExitNodePrior.isNullOrEmpty()) null else InternalExitNodePrior
+      }
+
+    val activeExitNodeID: String?
+      get() {
+        return if (ExitNodeID.isNullOrEmpty()) null else ExitNodeID
+      }
+  }
 
   @Serializable
   data class MaskedPrefs(
@@ -79,6 +94,7 @@ class Ipn {
       var AdvertiseRoutesSet: Boolean? = null,
       var ForceDaemonSet: Boolean? = null,
       var HostnameSet: Boolean? = null,
+      var InternalExitNodePriorSet: Boolean? = null,
   ) {
 
     var ControlURL: String? = null
@@ -105,6 +121,12 @@ class Ipn {
         ExitNodeIDSet = true
       }
 
+    var InternalExitNodePrior: String? = null
+      set(value) {
+        field = value
+        InternalExitNodePriorSet = true
+      }
+
     var ExitNodeAllowLANAccess: Boolean? = null
       set(value) {
         field = value
@@ -194,7 +216,8 @@ class Ipn {
   @Serializable
   data class Options(
       var FrontendLogID: String? = null,
-      var Prefs: Prefs? = null,
+      var UpdatePrefs: Prefs? = null,
+      var AuthKey: String? = null,
   )
 }
 

android/src/main/java/com/tailscale/ipn/ui/model/TailCfg.kt

@@ -7,6 +7,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.res.stringResource
 import com.tailscale.ipn.R
+import com.tailscale.ipn.ui.Links
 import com.tailscale.ipn.ui.theme.off
 import com.tailscale.ipn.ui.theme.on
 import com.tailscale.ipn.ui.util.ComposableStringFormatter
@@ -91,6 +92,16 @@ class Tailcfg {
           Capabilities?.contains("https://tailscale.com/cap/is-admin") == true ||
               CapMap?.contains("https://tailscale.com/cap/is-admin") == true
 
+    // Derives the url to directly administer a node
+    val nodeAdminUrl: String
+      get() = primaryIPv4Address?.let { "${Links.ADMIN_URL}/machines/${it}" } ?: Links.ADMIN_URL
+
+    val primaryIPv4Address: String?
+      get() = displayAddresses.firstOrNull { it.type == DisplayAddress.addrType.V4 }?.address
+
+    val primaryIPv6Address: String?
+      get() = displayAddresses.firstOrNull { it.type == DisplayAddress.addrType.V6 }?.address
+
     // isExitNode reproduces the Go logic in local.go peerStatusFromNode
     val isExitNode: Boolean =
         AllowedIPs?.contains("0.0.0.0/0") ?: false && AllowedIPs?.contains("::/0") ?: false
@@ -101,6 +112,11 @@ class Tailcfg {
     val displayName: String
       get() = ComputedName ?: Name
 
+    val keyDoesNotExpire: Boolean
+      get() = KeyExpiry == "0001-01-01T00:00:00Z"
+
+    fun isSelfNode(netmap: Netmap.NetworkMap): Boolean = StableID == netmap.SelfNode.StableID
+
     fun connectedOrSelfNode(nm: Netmap.NetworkMap?) =
         Online == true || StableID == nm?.SelfNode?.StableID
 
@@ -129,7 +145,13 @@ class Tailcfg {
               PeerSettingInfo(R.string.os, ComposableStringFormatter(Hostinfo.OS!!)),
           )
         }
-        result.add(PeerSettingInfo(R.string.key_expiry, TimeUtil.keyExpiryFromGoTime(KeyExpiry)))
+        if (keyDoesNotExpire) {
+          result.add(
+              PeerSettingInfo(
+                  R.string.key_expiry, ComposableStringFormatter(R.string.deviceKeyNeverExpires)))
+        } else {
+          result.add(PeerSettingInfo(R.string.key_expiry, TimeUtil.keyExpiryFromGoTime(KeyExpiry)))
+        }
         return result
       }
 

android/src/main/java/com/tailscale/ipn/ui/notifier/Notifier.kt

@@ -4,6 +4,7 @@
 package com.tailscale.ipn.ui.notifier
 
 import android.util.Log
+import com.tailscale.ipn.App
 import com.tailscale.ipn.ui.model.Empty
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.model.Ipn.Notify
@@ -30,10 +31,6 @@ object Notifier {
   private val TAG = Notifier::class.simpleName
   private val decoder = Json { ignoreUnknownKeys = true }
 
-  // Global App State
-  val tileReady: StateFlow<Boolean> = MutableStateFlow(false)
-  val readyToPrepareVPN: StateFlow<Boolean> = MutableStateFlow(false)
-
   // General IPN Bus State
   val state: StateFlow<Ipn.State> = MutableStateFlow(Ipn.State.NoState)
   val netmap: StateFlow<Netmap.NetworkMap?> = MutableStateFlow(null)
@@ -60,6 +57,9 @@ object Notifier {
   @OptIn(ExperimentalSerializationApi::class)
   fun start(scope: CoroutineScope) {
     Log.d(TAG, "Starting")
+    if (!::app.isInitialized) {
+      App.get()
+    }
     scope.launch(Dispatchers.IO) {
       val mask =
           NotifyWatchOpt.Netmap.value or
@@ -80,10 +80,6 @@ object Notifier {
             notify.FilesWaiting?.let(filesWaiting::set)
             notify.IncomingFiles?.let(incomingFiles::set)
           }
-      state.collect { currstate ->
-        readyToPrepareVPN.set(currstate > Ipn.State.Stopped)
-        tileReady.set(currstate >= Ipn.State.Stopped)
-      }
     }
   }
 

android/src/main/java/com/tailscale/ipn/ui/theme/Theme.kt

@@ -16,6 +16,7 @@ import androidx.compose.material3.TextFieldColors
 import androidx.compose.material3.TopAppBarColors
 import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.material3.Typography
+import androidx.compose.material3.darkColorScheme
 import androidx.compose.material3.lightColorScheme
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.DisposableEffect
@@ -27,7 +28,12 @@ import com.google.accompanist.systemuicontroller.rememberSystemUiController
 
 @Composable
 fun AppTheme(useDarkTheme: Boolean = isSystemInDarkTheme(), content: @Composable() () -> Unit) {
-  val colors = LightColors
+  val colors =
+      if (useDarkTheme) {
+        DarkColors
+      } else {
+        LightColors
+      }
 
   val typography =
       Typography(
@@ -75,7 +81,36 @@ private val LightColors =
         outlineVariant = Color(0xFFEDEBEA), // gray-200
         inverseSurface = Color(0xFF232222), // gray-800
         inverseOnSurface = Color(0xFFFFFFFF), // white
-        scrim = Color(0xFF000000), // black
+        scrim = Color(0xAA000000), // black
+    )
+
+private val DarkColors =
+    darkColorScheme(
+        primary = Color(0xFF3E5DB3), // blue-600
+        onPrimary = Color(0xFFFFFFFF), // white
+        primaryContainer = Color(0xFFf0f5ff), // blue-0
+        onPrimaryContainer = Color(0xFF5A82DC), // blue-400
+        error = Color(0xFFEF5350), // red-400
+        onError = Color(0xFFFFFFFF), // white
+        errorContainer = Color(0xFFfff6f4), // red-0
+        onErrorContainer = Color(0xFF940822), // red-600
+        surfaceDim = Color(0xFF1f1e1e), // gray-900
+        surface = Color(0xFF232222), // gray-800
+        background = Color(0xFF181717), // gray-1000
+        surfaceBright = Color(0xFF444342), // gray-600
+        surfaceContainerLowest = Color(0xFF1f1e1e), // gray-900
+        surfaceContainerLow = Color(0xFF232222), // gray-800
+        surfaceContainer = Color(0xFF181717), // gray-1000
+        surfaceContainerHigh = Color(0xFF232222), // gray-800
+        surfaceContainerHighest = Color(0xFF2e2d2d), // gray-700
+        surfaceVariant = Color(0xFF1f1e1e), // gray-900
+        onSurface = Color(0xFFfaf9f8), // gray-0
+        onSurfaceVariant = Color(0xFFafacab), // gray-400
+        outline = Color(0xFF706E6D), // gray-500
+        outlineVariant = Color(0xFF2E2D2D), // gray-700
+        inverseSurface = Color(0xFFEDEBEA), // gray-200
+        inverseOnSurface = Color(0xFF000000), // black
+        scrim = Color(0xAA000000), // black
     )
 
 val ColorScheme.warning: Color
@@ -106,7 +141,13 @@ val ColorScheme.on: Color
   get() = Color(0xFF1CA672) // green-300
 
 val ColorScheme.off: Color
-  get() = Color(0xFFD9D6D5) // gray-300
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0xFF444342) // gray-600
+      } else {
+        Color(0xFFD9D6D5) // gray-300
+      }
 
 val ColorScheme.link: Color
   get() = onPrimaryContainer
@@ -207,7 +248,7 @@ val ColorScheme.warningListItem: ListItemColors
         containerColor = MaterialTheme.colorScheme.warning,
         headlineColor = MaterialTheme.colorScheme.onPrimary,
         leadingIconColor = MaterialTheme.colorScheme.onPrimary,
-        overlineColor = MaterialTheme.colorScheme.onPrimary.copy(alpha = 0.7f),
+        overlineColor = MaterialTheme.colorScheme.onPrimary.copy(alpha = 0.8f),
         supportingTextColor = MaterialTheme.colorScheme.onPrimary,
         trailingIconColor = MaterialTheme.colorScheme.onPrimary,
         disabledHeadlineColor = default.disabledHeadlineColor,
@@ -231,11 +272,92 @@ val ColorScheme.secondaryButton: ButtonColors
   @Composable
   get() {
     val defaults = ButtonDefaults.buttonColors()
-    return ButtonColors(
-        containerColor = Color(0xFF6D94EC), // blue-400
-        contentColor = Color(0xFFFFFFFF), // white
-        disabledContainerColor = defaults.disabledContainerColor,
-        disabledContentColor = defaults.disabledContentColor)
+    if (isSystemInDarkTheme()) {
+      return ButtonColors(
+          containerColor = Color(0xFF4B70CC), // blue-500
+          contentColor = Color(0xFFFFFFFF), // white
+          disabledContainerColor = defaults.disabledContainerColor,
+          disabledContentColor = defaults.disabledContentColor)
+    } else {
+      return ButtonColors(
+          containerColor = Color(0xFF5A82DC), // blue-400
+          contentColor = Color(0xFFFFFFFF), // white
+          disabledContainerColor = defaults.disabledContainerColor,
+          disabledContentColor = defaults.disabledContentColor)
+    }
+  }
+
+val ColorScheme.defaultTextColor: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color.White
+      } else {
+        Color.Black
+      }
+
+val ColorScheme.logoBackground: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0xFFFFFFFF) // white
+      } else {
+        Color(0xFF1F1E1E)
+      }
+
+val ColorScheme.standaloneLogoDotEnabled: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0xFFFFFFFF)
+      } else {
+        Color(0xFF000000)
+      }
+
+val ColorScheme.standaloneLogoDotDisabled: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0x66FFFFFF)
+      } else {
+        Color(0x661F1E1E)
+      }
+
+val ColorScheme.onBackgroundLogoDotEnabled: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0xFF141414)
+      } else {
+        Color(0xFFFFFFFF)
+      }
+
+val ColorScheme.onBackgroundLogoDotDisabled: Color
+  @Composable
+  get() =
+      if (isSystemInDarkTheme()) {
+        Color(0x66141414)
+      } else {
+        Color(0x66FFFFFF)
+      }
+
+val ColorScheme.exitNodeToggleButton: ButtonColors
+  @Composable
+  get() {
+    val defaults = ButtonDefaults.buttonColors()
+    return if (isSystemInDarkTheme()) {
+      ButtonColors(
+          containerColor = Color(0xFF444342), // grey-600
+          contentColor = Color(0xFFFFFFFF), // white
+          disabledContainerColor = defaults.disabledContainerColor,
+          disabledContentColor = defaults.disabledContentColor)
+    } else {
+      ButtonColors(
+          containerColor = Color(0xFFEDEBEA), // grey-300
+          contentColor = Color(0xFF000000), // black
+          disabledContainerColor = defaults.disabledContainerColor,
+          disabledContentColor = defaults.disabledContentColor)
+    }
   }
 
 val ColorScheme.disabled: Color
@@ -252,9 +374,9 @@ val ColorScheme.searchBarColors: TextFieldColors
         focusedTextColor = MaterialTheme.colorScheme.onSurface,
         unfocusedTextColor = MaterialTheme.colorScheme.onSurfaceVariant,
         disabledTextColor = MaterialTheme.colorScheme.onSurfaceVariant,
-        focusedContainerColor = MaterialTheme.colorScheme.background,
-        unfocusedContainerColor = MaterialTheme.colorScheme.background,
-        disabledContainerColor = MaterialTheme.colorScheme.background,
+        focusedContainerColor = MaterialTheme.colorScheme.surfaceContainer,
+        unfocusedContainerColor = MaterialTheme.colorScheme.surfaceContainer,
+        disabledContainerColor = MaterialTheme.colorScheme.surfaceContainer,
         focusedBorderColor = Color.Transparent,
         unfocusedBorderColor = Color.Transparent)
   }

android/src/main/java/com/tailscale/ipn/ui/util/AndroidTVUtil.kt

@@ -0,0 +1,30 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn.ui.util
+
+import android.content.pm.PackageManager
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.unit.dp
+import com.tailscale.ipn.UninitializedApp
+import com.tailscale.ipn.ui.util.AndroidTVUtil.isAndroidTV
+
+object AndroidTVUtil {
+  fun isAndroidTV(): Boolean {
+    val pm = UninitializedApp.get().packageManager
+    return (pm.hasSystemFeature(PackageManager.FEATURE_TELEVISION) ||
+        pm.hasSystemFeature(PackageManager.FEATURE_LEANBACK))
+  }
+}
+
+// Applies a letterbox effect iff we're running on Android TV to reduce the overall width
+// of the UI.
+fun Modifier.universalFit(): Modifier {
+  return when (isAndroidTV()) {
+    true -> this.padding(horizontal = 150.dp, vertical = 10.dp).clip(RoundedCornerShape(10.dp))
+    false -> this
+  }
+}

android/src/main/java/com/tailscale/ipn/ui/util/ClipboardValueView.kt

@@ -27,16 +27,17 @@ fun ClipboardValueView(value: String, title: String? = null, subtitle: String? =
   ListItem(
       colors = MaterialTheme.colorScheme.titledListItem,
       modifier = Modifier.clickable { localClipboardManager.setText(AnnotatedString(value)) },
-      overlineContent = { title?.let { Text(it, style = MaterialTheme.typography.titleMedium) } },
+      overlineContent = title?.let { { Text(it, style = MaterialTheme.typography.titleMedium) } },
       headlineContent = { Text(text = value, style = MaterialTheme.typography.bodyMedium) },
-      supportingContent = {
-        subtitle?.let { subtitle ->
-          Text(
-              subtitle,
-              modifier = Modifier.padding(top = 8.dp),
-              style = MaterialTheme.typography.bodyMedium)
-        }
-      },
+      supportingContent =
+          subtitle?.let {
+            {
+              Text(
+                  it,
+                  modifier = Modifier.padding(top = 8.dp),
+                  style = MaterialTheme.typography.bodyMedium)
+            }
+          },
       trailingContent = {
         Icon(
             painterResource(R.drawable.clipboard),

android/src/main/java/com/tailscale/ipn/ui/util/DisplayAddress.kt

@@ -3,7 +3,7 @@
 
 package com.tailscale.ipn.ui.util
 
-class DisplayAddress(val ip: String) {
+class DisplayAddress(ip: String) {
   enum class addrType {
     V4,
     V6,

android/src/main/java/com/tailscale/ipn/ui/util/Lists.kt

@@ -10,12 +10,15 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyItemScope
 import androidx.compose.foundation.lazy.LazyListScope
+import androidx.compose.foundation.text.ClickableText
 import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.ListItem
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.RectangleShape
+import androidx.compose.ui.text.AnnotatedString
 import androidx.compose.ui.text.TextStyle
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.Dp
@@ -25,7 +28,7 @@ object Lists {
   @Composable
   fun SectionDivider(title: String? = null) {
     Box(Modifier.size(0.dp, 16.dp))
-    title?.let { SectionTitle(title) }
+    title?.let { LargeTitle(title) }
   }
 
   @Composable
@@ -34,7 +37,7 @@ object Lists {
   }
 
   @Composable
-  fun SectionTitle(
+  fun LargeTitle(
       title: String,
       bottomPadding: Dp = 0.dp,
       style: TextStyle = MaterialTheme.typography.titleMedium,
@@ -52,8 +55,46 @@ object Lists {
               fontWeight = fontWeight)
         }
   }
+
+  @Composable
+  fun MutedHeader(text: String) {
+    Box(
+        modifier =
+            Modifier.fillMaxWidth()
+                .background(color = MaterialTheme.colorScheme.surface, shape = RectangleShape)) {
+          Text(
+              modifier = Modifier.padding(start = 16.dp, top = 16.dp),
+              text = text,
+              style = MaterialTheme.typography.titleSmall,
+              color = MaterialTheme.colorScheme.onSurfaceVariant)
+        }
+  }
+
+  @Composable
+  fun InfoItem(text: CharSequence, onClick: (() -> Unit)? = null) {
+    val style =
+        MaterialTheme.typography.bodyMedium.copy(color = MaterialTheme.colorScheme.onSurfaceVariant)
+    ListItem(
+        headlineContent = {
+          Box(modifier = Modifier.padding(vertical = 4.dp)) {
+            onClick?.let {
+              ClickableText(text = text as AnnotatedString, style = style, onClick = { onClick() })
+            } ?: run { Text(text as String, style = style) }
+          }
+        })
+  }
+
+  @Composable
+  fun MultilineDescription(headlineContent: @Composable () -> Unit) {
+    ListItem(
+        headlineContent = {
+          Box(modifier = Modifier.padding(vertical = 8.dp)) { headlineContent() }
+        })
+  }
 }
 
+/** Similar to items() but includes a horizontal divider between items. */
+
 /** Similar to items() but includes a horizontal divider between items. */
 inline fun <T> LazyListScope.itemsWithDividers(
     items: List<T>,

android/src/main/java/com/tailscale/ipn/ui/util/LoadingIndicator.kt

@@ -12,9 +12,11 @@ import androidx.compose.foundation.layout.size
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.State
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.runtime.produceState
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
 import com.tailscale.ipn.ui.view.TailscaleLogoView
@@ -39,7 +41,7 @@ object LoadingIndicator {
         contentAlignment = Alignment.Center,
     ) {
       content()
-      val isLoading = loading.collectAsState().value
+      val isLoading by loading.collectAsState()
       if (isLoading) {
         Box(Modifier.clickable {}.matchParentSize().background(Color.Gray.copy(alpha = 0.0f)))
 
@@ -53,7 +55,8 @@ object LoadingIndicator {
           Column(
               modifier = Modifier.fillMaxWidth(),
               horizontalAlignment = Alignment.CenterHorizontally) {
-                TailscaleLogoView(true, Modifier.size(72.dp))
+                TailscaleLogoView(
+                    true, usesOnBackgroundColors = false, Modifier.size(72.dp).alpha(0.4f))
               }
         }
       }

android/src/main/java/com/tailscale/ipn/ui/util/PeerHelper.kt

@@ -3,6 +3,7 @@
 
 package com.tailscale.ipn.ui.util
 
+import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.model.Netmap
 import com.tailscale.ipn.ui.model.Tailcfg
 import com.tailscale.ipn.ui.model.UserID
@@ -19,27 +20,58 @@ class PeerCategorizer {
     val selfNode = netmap.SelfNode
     var grouped = mutableMapOf<UserID, MutableList<Tailcfg.Node>>()
 
+    val mdm = MDMSettings.hiddenNetworkDevices.flow.value
+    val hideMyDevices = mdm?.contains("current-user") ?: false
+    val hideOtherDevices = mdm?.contains("other-users") ?: false
+    val hideTaggedDevices = mdm?.contains("tagged-devices") ?: false
+
+    val me = netmap.currentUserProfile()
+
     for (peer in (peers + selfNode)) {
-      // (jonathan) TODO: MDM -> There are a number of MDM settings to hide devices from the user
-      // (jonathan) TODO: MDM -> currentUser, otherUsers, taggedDevices
+
       val userId = peer.User
+      val profile = netmap.userProfile(userId)
 
-      // Mullvad based nodes should not be shown in the peer list
-      if (!peer.isMullvadNode) {
-        if (!grouped.containsKey(userId)) {
-          grouped[userId] = mutableListOf()
-        }
-        grouped[userId]?.add(peer)
+      // Mullvad nodes should not be shown in the peer list
+      if (peer.isMullvadNode) {
+        continue
       }
-    }
 
-    val me = netmap.currentUserProfile()
+      // Hide devices based on MDM settings
+      if (hideMyDevices && userId == me?.ID) {
+        continue
+      }
+
+      if (hideOtherDevices && userId != me?.ID) {
+        continue
+      }
+
+      if (hideTaggedDevices && (profile?.isTaggedDevice() == true)) {
+        continue
+      }
+
+      if (!grouped.containsKey(userId)) {
+        grouped[userId] = mutableListOf()
+      }
+      grouped[userId]?.add(peer)
+    }
 
     peerSets =
         grouped
             .map { (userId, peers) ->
               val profile = netmap.userProfile(userId)
-              PeerSet(profile, peers.sortedBy { it.ComputedName })
+              PeerSet(
+                  profile,
+                  peers.sortedWith { a, b ->
+                    when {
+                      a.StableID == b.StableID -> 0
+                      a.isSelfNode(netmap) -> -1
+                      b.isSelfNode(netmap) -> 1
+                      else ->
+                          (a.ComputedName?.lowercase() ?: "").compareTo(
+                              b.ComputedName?.lowercase() ?: "")
+                    }
+                  })
             }
             .sortedBy {
               if (it.user?.ID == me?.ID) {

android/src/main/java/com/tailscale/ipn/ui/util/TimeUtil.kt

@@ -3,12 +3,16 @@
 
 package com.tailscale.ipn.ui.util
 
+import android.util.Log
 import com.tailscale.ipn.R
+import java.time.Duration
 import java.time.Instant
 import java.time.format.DateTimeFormatter
 import java.util.Date
 
 object TimeUtil {
+  val TAG = "TimeUtil"
+
   fun keyExpiryFromGoTime(goTime: String?): ComposableStringFormatter {
 
     val time = goTime ?: return ComposableStringFormatter(R.string.empty)
@@ -70,10 +74,51 @@ object TimeUtil {
     return Date.from(i)
   }
 
-  // Returns true if the given time is within 24 hours from now or in the past.
-  fun isWithin24Hours(goTime: String): Boolean {
+  // Returns true if the given Go time string is in the past, or will occur within the given
+  // duration from now.
+  fun isWithinExpiryNotificationWindow(window: Duration, goTime: String): Boolean {
     val expTime = epochMillisFromGoTime(goTime)
     val now = Instant.now().toEpochMilli()
-    return (expTime - now) / 1000 < 86400
+    return (expTime - now) / 1000 < window.seconds
+  }
+
+  // Parses a Go duration string (e.g. "2h3.2m4s") and returns a Java Duration object.
+  // Returns null if the input string is not a valid Go duration or contains
+  // units other than y,w,d,h,m,s (ms and us are explicitly not supported).
+  fun duration(goDuration: String): Duration? {
+    if (goDuration.contains("ms") || goDuration.contains("us")) {
+      return null
+    }
+
+    var duration = 0.0
+    var valStr = ""
+    for (c in goDuration) {
+      // Scan digits and decimal points
+      if (c.isDigit() || c == '.') {
+        valStr += c
+      } else {
+        try {
+          val durationFragment = valStr.toDouble()
+          duration +=
+              when (c) {
+                'y' -> durationFragment * 31536000.0 // 365 days
+                'w' -> durationFragment * 604800.0
+                'd' -> durationFragment * 86400.0
+                'h' -> durationFragment * 3600.0
+                'm' -> durationFragment * 60.0
+                's' -> durationFragment
+                else -> {
+                  Log.e(TAG, "Invalid duration string: $goDuration")
+                  return null
+                }
+              }
+        } catch (e: NumberFormatException) {
+          Log.e(TAG, "Invalid duration string: $goDuration")
+          return null
+        }
+        valStr = ""
+      }
+    }
+    return Duration.ofSeconds(duration.toLong())
   }
 }

android/src/main/java/com/tailscale/ipn/ui/view/AboutView.kt

@@ -3,8 +3,8 @@
 
 package com.tailscale.ipn.ui.view
 
-import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxHeight
@@ -12,7 +12,9 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
@@ -20,32 +22,41 @@ import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
-import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.platform.LocalClipboardManager
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.AnnotatedString
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import com.tailscale.ipn.BuildConfig
 import com.tailscale.ipn.R
 import com.tailscale.ipn.ui.Links
+import com.tailscale.ipn.ui.theme.logoBackground
 
 @Composable
-fun AboutView(nav: BackNavigation) {
-  Scaffold(topBar = { Header(R.string.about_view_title, onBack = nav.onBack) }) { innerPadding ->
+fun AboutView(backToSettings: BackNavigation) {
+  val localClipboardManager = LocalClipboardManager.current
+
+  Scaffold(topBar = { Header(R.string.about_view_header, onBack = backToSettings) }) { innerPadding
+    ->
     Column(
         verticalArrangement =
             Arrangement.spacedBy(space = 20.dp, alignment = Alignment.CenterVertically),
         horizontalAlignment = Alignment.CenterHorizontally,
-        modifier = Modifier.fillMaxWidth().fillMaxHeight().padding(innerPadding)) {
-          Image(
+        modifier =
+            Modifier.fillMaxWidth()
+                .fillMaxHeight()
+                .padding(innerPadding)
+                .verticalScroll(rememberScrollState())) {
+          TailscaleLogoView(
+              usesOnBackgroundColors = true,
               modifier =
                   Modifier.width(100.dp)
                       .height(100.dp)
                       .clip(RoundedCornerShape(50))
-                      .background(MaterialTheme.colorScheme.onSurface)
-                      .padding(15.dp),
-              painter = painterResource(id = R.drawable.androidicon),
-              contentDescription = stringResource(R.string.app_icon_content_description))
+                      .background(MaterialTheme.colorScheme.logoBackground)
+                      .padding(25.dp))
 
           Column(
               verticalArrangement =
@@ -56,6 +67,10 @@ fun AboutView(nav: BackNavigation) {
                     fontWeight = FontWeight.SemiBold,
                     fontSize = MaterialTheme.typography.titleLarge.fontSize)
                 Text(
+                    modifier =
+                        Modifier.clickable {
+                          localClipboardManager.setText(AnnotatedString(BuildConfig.VERSION_NAME))
+                        },
                     text = "${stringResource(R.string.version)} ${BuildConfig.VERSION_NAME}",
                     fontWeight = MaterialTheme.typography.bodyMedium.fontWeight,
                     fontSize = MaterialTheme.typography.bodyMedium.fontSize)
@@ -75,3 +90,9 @@ fun AboutView(nav: BackNavigation) {
         }
   }
 }
+
+@Preview
+@Composable
+fun AboutPreview() {
+  AboutView({})
+}

android/src/main/java/com/tailscale/ipn/ui/view/Avatar.kt

@@ -17,9 +17,11 @@ import androidx.compose.runtime.remember
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
 import coil.annotation.ExperimentalCoilApi
 import coil.compose.AsyncImage
+import com.tailscale.ipn.R
 import com.tailscale.ipn.ui.model.IpnLocal
 
 @OptIn(ExperimentalCoilApi::class)
@@ -34,7 +36,10 @@ fun Avatar(profile: IpnLocal.LoginProfile?, size: Int = 50, action: (() -> Unit)
               indication = rememberRipple(bounded = false),
               onClick = action)
     }
-    Icon(imageVector = Icons.Default.Person, contentDescription = null, modifier = modifier)
+    Icon(
+        imageVector = Icons.Default.Person,
+        contentDescription = stringResource(R.string.settings_title),
+        modifier = modifier)
 
     profile?.UserProfile?.ProfilePicURL?.let { url ->
       AsyncImage(model = url, modifier = Modifier.size((size * 1.2f).dp), contentDescription = null)

android/src/main/java/com/tailscale/ipn/ui/view/BugReportView.kt

@@ -7,12 +7,14 @@ import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxHeight
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.text.ClickableText
-import androidx.compose.material3.ListItem
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.res.stringResource
@@ -21,40 +23,50 @@ import androidx.compose.ui.text.SpanStyle
 import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.text.withStyle
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
 import com.tailscale.ipn.ui.Links
+import com.tailscale.ipn.ui.theme.defaultTextColor
 import com.tailscale.ipn.ui.theme.link
 import com.tailscale.ipn.ui.util.ClipboardValueView
+import com.tailscale.ipn.ui.util.Lists
+import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.viewModel.BugReportViewModel
 
 @Composable
-fun BugReportView(nav: BackNavigation, model: BugReportViewModel = viewModel()) {
+fun BugReportView(backToSettings: BackNavigation, model: BugReportViewModel = viewModel()) {
   val handler = LocalUriHandler.current
-  val bugReportID = model.bugReportID.collectAsState().value
+  val bugReportID by model.bugReportID.collectAsState()
 
-  Scaffold(topBar = { Header(R.string.bug_report_title, onBack = nav.onBack) }) { innerPadding ->
-    Column(modifier = Modifier.padding(innerPadding).fillMaxWidth().fillMaxHeight()) {
-      ListItem(
-          headlineContent = {
+  Scaffold(topBar = { Header(R.string.bug_report_title, onBack = backToSettings) }) { innerPadding
+    ->
+    Column(
+        modifier =
+            Modifier.padding(innerPadding)
+                .fillMaxWidth()
+                .fillMaxHeight()
+                .verticalScroll(rememberScrollState())) {
+          Lists.MultilineDescription {
             ClickableText(
                 text = contactText(),
                 style = MaterialTheme.typography.bodyMedium,
                 onClick = { handler.openUri(Links.SUPPORT_URL) })
-          })
+          }
 
-      ClipboardValueView(
-          bugReportID,
-          title = stringResource(R.string.bug_report_id),
-          subtitle = stringResource(id = R.string.bug_report_id_desc))
-    }
+          ClipboardValueView(bugReportID, title = stringResource(R.string.bug_report_id))
+
+          Lists.InfoItem(stringResource(id = R.string.bug_report_id_desc))
+        }
   }
 }
 
 @Composable
 fun contactText(): AnnotatedString {
   val annotatedString = buildAnnotatedString {
-    append(stringResource(id = R.string.bug_report_instructions_prefix))
+    withStyle(SpanStyle(color = MaterialTheme.colorScheme.defaultTextColor)) {
+      append(stringResource(id = R.string.bug_report_instructions_prefix))
+    }
 
     pushStringAnnotation(tag = "reportLink", annotation = Links.SUPPORT_URL)
     withStyle(
@@ -66,7 +78,17 @@ fun contactText(): AnnotatedString {
         }
     pop()
 
-    append(stringResource(id = R.string.bug_report_instructions_suffix))
+    withStyle(SpanStyle(color = MaterialTheme.colorScheme.defaultTextColor)) {
+      append(stringResource(id = R.string.bug_report_instructions_suffix))
+    }
   }
   return annotatedString
 }
+
+@Preview
+@Composable
+fun BugReportPreview() {
+  val vm = BugReportViewModel()
+  vm.bugReportID.set("12345678ABCDEF-12345678ABCDEF")
+  BugReportView({}, vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/Buttons.kt

@@ -6,19 +6,12 @@ package com.tailscale.ipn.ui.view
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.size
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.outlined.Clear
-import androidx.compose.material.icons.outlined.Close
 import androidx.compose.material3.Button
-import androidx.compose.material3.Icon
-import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalFocusManager
 import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.unit.dp
@@ -46,19 +39,3 @@ fun OpenURLButton(title: String, url: String) {
     )
   }
 }
-
-@Composable
-fun ClearButton(onClick: () -> Unit) {
-  IconButton(onClick = onClick, modifier = Modifier.size(24.dp)) {
-    Icon(Icons.Outlined.Clear, null)
-  }
-}
-
-@Composable
-fun CloseButton() {
-  val focusManager = LocalFocusManager.current
-
-  IconButton(onClick = { focusManager.clearFocus() }, modifier = Modifier.size(24.dp)) {
-    Icon(Icons.Outlined.Close, null)
-  }
-}

android/src/main/java/com/tailscale/ipn/ui/view/CustomLogin.kt

@@ -0,0 +1,153 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn.ui.view
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material3.Button
+import androidx.compose.material3.ListItem
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextFieldDefaults
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import com.tailscale.ipn.R
+import com.tailscale.ipn.ui.theme.listItem
+import com.tailscale.ipn.ui.util.set
+import com.tailscale.ipn.ui.viewModel.LoginWithAuthKeyViewModel
+import com.tailscale.ipn.ui.viewModel.LoginWithCustomControlURLViewModel
+
+data class LoginViewStrings(
+    var title: String,
+    var explanation: String,
+    var inputTitle: String,
+    var placeholder: String,
+)
+
+@Composable
+fun LoginWithCustomControlURLView(
+    onNavigateHome: BackNavigation,
+    backToSettings: BackNavigation,
+    viewModel: LoginWithCustomControlURLViewModel = LoginWithCustomControlURLViewModel()
+) {
+
+  Scaffold(
+      topBar = {
+        Header(
+            R.string.add_account,
+            onBack = backToSettings,
+        )
+      }) { innerPadding ->
+        val error by viewModel.errorDialog.collectAsState()
+        val strings =
+            LoginViewStrings(
+                title = stringResource(id = R.string.custom_control_menu),
+                explanation = stringResource(id = R.string.custom_control_menu_desc),
+                inputTitle = stringResource(id = R.string.custom_control_url_title),
+                placeholder = stringResource(id = R.string.custom_control_placeholder),
+            )
+
+        error?.let { ErrorDialog(type = it, action = { viewModel.errorDialog.set(null) }) }
+
+        LoginView(
+            innerPadding = innerPadding,
+            strings = strings,
+            onSubmitAction = { viewModel.setControlURL(it, onNavigateHome) })
+      }
+}
+
+@Composable
+fun LoginWithAuthKeyView(
+    onNavigateHome: BackNavigation,
+    backToSettings: BackNavigation,
+    viewModel: LoginWithAuthKeyViewModel = LoginWithAuthKeyViewModel()
+) {
+
+  Scaffold(
+      topBar = {
+        Header(
+            R.string.add_account,
+            onBack = backToSettings,
+        )
+      }) { innerPadding ->
+        val error by viewModel.errorDialog.collectAsState()
+        val strings =
+            LoginViewStrings(
+                title = stringResource(id = R.string.auth_key_title),
+                explanation = stringResource(id = R.string.auth_key_explanation),
+                inputTitle = stringResource(id = R.string.auth_key_input_title),
+                placeholder = stringResource(id = R.string.auth_key_placeholder),
+            )
+        // Show the error overlay if need be
+        error?.let { ErrorDialog(type = it, action = { viewModel.errorDialog.set(null) }) }
+
+        LoginView(
+            innerPadding = innerPadding,
+            strings = strings,
+            onSubmitAction = { viewModel.setAuthKey(it, onNavigateHome) })
+      }
+}
+
+@Composable
+fun LoginView(
+    innerPadding: PaddingValues = PaddingValues(16.dp),
+    strings: LoginViewStrings,
+    onSubmitAction: (String) -> Unit,
+) {
+
+  var textVal by remember { mutableStateOf("") }
+
+  Column(
+      modifier =
+          Modifier.padding(innerPadding)
+              .fillMaxWidth()
+              .background(MaterialTheme.colorScheme.surface)) {
+        ListItem(
+            colors = MaterialTheme.colorScheme.listItem,
+            headlineContent = { Text(text = strings.title) },
+            supportingContent = { Text(text = strings.explanation) })
+
+        ListItem(
+            colors = MaterialTheme.colorScheme.listItem,
+            headlineContent = { Text(text = strings.inputTitle) },
+            supportingContent = {
+              OutlinedTextField(
+                  modifier = Modifier.fillMaxWidth(),
+                  colors =
+                      TextFieldDefaults.colors(
+                          focusedContainerColor = Color.Transparent,
+                          unfocusedContainerColor = Color.Transparent),
+                  textStyle = MaterialTheme.typography.bodyMedium,
+                  value = textVal,
+                  onValueChange = { textVal = it },
+                  placeholder = {
+                    Text(strings.placeholder, style = MaterialTheme.typography.bodySmall)
+                  })
+            })
+
+        ListItem(
+            colors = MaterialTheme.colorScheme.listItem,
+            headlineContent = {
+              Box(modifier = Modifier.fillMaxWidth()) {
+                Button(
+                    onClick = { onSubmitAction(textVal) },
+                    content = { Text(stringResource(id = R.string.add_account_short)) })
+              }
+            })
+      }
+}

android/src/main/java/com/tailscale/ipn/ui/view/DNSSettingsView.kt

@@ -14,18 +14,22 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
+import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.model.DnsType
 import com.tailscale.ipn.ui.notifier.Notifier
 import com.tailscale.ipn.ui.util.ClipboardValueView
 import com.tailscale.ipn.ui.util.Lists
 import com.tailscale.ipn.ui.util.LoadingIndicator
 import com.tailscale.ipn.ui.util.itemsWithDividers
+import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.viewModel.DNSEnablementState
 import com.tailscale.ipn.ui.viewModel.DNSSettingsViewModel
 import com.tailscale.ipn.ui.viewModel.DNSSettingsViewModelFactory
@@ -35,10 +39,10 @@ data class ViewableRoute(val name: String, val resolvers: List<DnsType.Resolver>
 @OptIn(ExperimentalFoundationApi::class)
 @Composable
 fun DNSSettingsView(
-    nav: BackNavigation,
+    backToSettings: BackNavigation,
     model: DNSSettingsViewModel = viewModel(factory = DNSSettingsViewModelFactory())
 ) {
-  val state: DNSEnablementState = model.enablementState.collectAsState().value
+  val state: DNSEnablementState by model.enablementState.collectAsState()
   val resolvers = model.dnsConfig.collectAsState().value?.Resolvers ?: emptyList()
   val domains = model.dnsConfig.collectAsState().value?.Domains ?: emptyList()
   val routes: List<ViewableRoute> =
@@ -46,8 +50,9 @@ fun DNSSettingsView(
         entry.value?.let { resolvers -> ViewableRoute(name = entry.key, resolvers) } ?: run { null }
       } ?: emptyList()
   val useCorpDNS = Notifier.prefs.collectAsState().value?.CorpDNS == true
+  val dnsSettingsMDMDisposition by MDMSettings.useTailscaleDNSSettings.flow.collectAsState()
 
-  Scaffold(topBar = { Header(R.string.dns_settings, onBack = nav.onBack) }) { innerPadding ->
+  Scaffold(topBar = { Header(R.string.dns_settings, onBack = backToSettings) }) { innerPadding ->
     LoadingIndicator.Wrap {
       LazyColumn(Modifier.padding(innerPadding)) {
         item("state") {
@@ -64,14 +69,16 @@ fun DNSSettingsView(
               },
               supportingContent = { Text(stringResource(state.caption)) })
 
-          Lists.ItemDivider()
-          Setting.Switch(
-              R.string.use_ts_dns,
-              isOn = useCorpDNS,
-              onToggle = {
-                LoadingIndicator.start()
-                model.toggleCorpDNS { LoadingIndicator.stop() }
-              })
+          if (!dnsSettingsMDMDisposition.hiddenFromUser) {
+            Lists.ItemDivider()
+            Setting.Switch(
+                R.string.use_ts_dns,
+                isOn = useCorpDNS,
+                onToggle = {
+                  LoadingIndicator.start()
+                  model.toggleCorpDNS { LoadingIndicator.stop() }
+                })
+          }
         }
 
         if (resolvers.isNotEmpty()) {
@@ -99,3 +106,11 @@ fun DNSSettingsView(
     }
   }
 }
+
+@Preview
+@Composable
+fun DNSSettingsViewPreview() {
+  val vm = DNSSettingsViewModel()
+  vm.enablementState.set(DNSEnablementState.ENABLED)
+  DNSSettingsView(backToSettings = {}, vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/ErrorDialog.kt

@@ -8,7 +8,9 @@ import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.tooling.preview.Preview
 import com.tailscale.ipn.R
+import com.tailscale.ipn.ui.theme.AppTheme
 
 
 enum class ErrorDialogType {
@@ -17,7 +19,8 @@ enum class ErrorDialogType {
   SWITCH_USER_FAILED,
   ADD_PROFILE_FAILED,
   SHARE_DEVICE_NOT_CONNECTED,
-  SHARE_FAILED;
+  SHARE_FAILED,
+  INVALID_AUTH_KEY;
 
   val message: Int
     get() {
@@ -28,6 +31,7 @@ enum class ErrorDialogType {
         ADD_PROFILE_FAILED -> R.string.add_profile_failed
         SHARE_DEVICE_NOT_CONNECTED -> R.string.share_device_not_connected
         SHARE_FAILED -> R.string.taildrop_share_failed
+        INVALID_AUTH_KEY -> R.string.invalidAuthKey
       }
     }
 
@@ -40,6 +44,7 @@ enum class ErrorDialogType {
         ADD_PROFILE_FAILED -> R.string.add_profile_failed_title
         SHARE_DEVICE_NOT_CONNECTED -> R.string.share_device_not_connected_title
         SHARE_FAILED -> R.string.taildrop_share_failed_title
+        INVALID_AUTH_KEY -> R.string.invalidAuthKeyTitle
       }
     }
 
@@ -59,11 +64,19 @@ fun ErrorDialog(
     @StringRes buttonText: Int = R.string.ok,
     onDismiss: () -> Unit = {}
 ) {
-  AlertDialog(
+  AppTheme {
+    AlertDialog(
       onDismissRequest = onDismiss,
       title = { Text(text = stringResource(id = title)) },
       text = { Text(text = stringResource(id = message)) },
       confirmButton = {
         PrimaryActionButton(onClick = onDismiss) { Text(text = stringResource(id = buttonText)) }
       })
+  }
+}
+
+@Preview
+@Composable
+fun ErrorDialogPreview() {
+  ErrorDialog(ErrorDialogType.LOGOUT_FAILED)
 }

android/src/main/java/com/tailscale/ipn/ui/view/ExitNodePicker.kt

@@ -17,10 +17,13 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
+import com.tailscale.ipn.mdm.MDMSettings
+import com.tailscale.ipn.mdm.ShowHide
 import com.tailscale.ipn.ui.notifier.Notifier
 import com.tailscale.ipn.ui.theme.disabledListItem
 import com.tailscale.ipn.ui.theme.listItem
@@ -38,13 +41,15 @@ fun ExitNodePicker(
     model: ExitNodePickerViewModel = viewModel(factory = ExitNodePickerViewModelFactory(nav))
 ) {
   LoadingIndicator.Wrap {
-    Scaffold(topBar = { Header(R.string.choose_exit_node, onBack = nav.onNavigateBack) }) {
+    Scaffold(topBar = { Header(R.string.choose_exit_node, onBack = nav.onNavigateBackHome) }) {
         innerPadding ->
-      val tailnetExitNodes = model.tailnetExitNodes.collectAsState().value
-      val mullvadExitNodesByCountryCode = model.mullvadExitNodesByCountryCode.collectAsState().value
-      val mullvadExitNodeCount = model.mullvadExitNodeCount.collectAsState().value
-      val anyActive = model.anyActive.collectAsState()
+      val tailnetExitNodes by model.tailnetExitNodes.collectAsState()
+      val mullvadExitNodesByCountryCode by model.mullvadExitNodesByCountryCode.collectAsState()
+      val mullvadExitNodeCount by model.mullvadExitNodeCount.collectAsState()
+      val anyActive by model.anyActive.collectAsState()
       val allowLANAccess = Notifier.prefs.collectAsState().value?.ExitNodeAllowLANAccess == true
+      val showRunAsExitNode by MDMSettings.runExitNode.flow.collectAsState()
+      val allowLanAccessMDMDisposition by MDMSettings.exitNodeAllowLANAccess.flow.collectAsState()
 
       LazyColumn(modifier = Modifier.padding(innerPadding)) {
         item(key = "header") {
@@ -53,10 +58,13 @@ fun ExitNodePicker(
               ExitNodePickerViewModel.ExitNode(
                   label = stringResource(R.string.none),
                   online = true,
-                  selected = !anyActive.value,
+                  selected = !anyActive,
               ))
-          Lists.ItemDivider()
-          RunAsExitNodeItem(nav = nav, viewModel = model)
+
+          if (showRunAsExitNode == ShowHide.Show) {
+            Lists.ItemDivider()
+            RunAsExitNodeItem(nav = nav, viewModel = model)
+          }
         }
 
         item(key = "divider1") { Lists.SectionDivider() }
@@ -66,17 +74,19 @@ fun ExitNodePicker(
         if (mullvadExitNodeCount > 0) {
           item(key = "mullvad") {
             Lists.SectionDivider()
-            MullvadItem(nav, mullvadExitNodeCount, mullvadExitNodesByCountryCode.selected)
+            MullvadItem(
+                nav, mullvadExitNodesByCountryCode.size, mullvadExitNodesByCountryCode.selected)
           }
         }
 
-        // TODO: make sure this actually works, and if not, leave it out for now
-        item(key = "allowLANAccess") {
-          Lists.SectionDivider()
+        if (!allowLanAccessMDMDisposition.hiddenFromUser) {
+          item(key = "allowLANAccess") {
+            Lists.SectionDivider()
 
-          Setting.Switch(R.string.allow_lan_access, isOn = allowLANAccess) {
-            LoadingIndicator.start()
-            model.toggleAllowLANAccess { LoadingIndicator.stop() }
+            Setting.Switch(R.string.allow_lan_access, isOn = allowLANAccess) {
+              LoadingIndicator.start()
+              model.toggleAllowLANAccess { LoadingIndicator.stop() }
+            }
           }
         }
       }
@@ -109,7 +119,7 @@ fun ExitNodeItem(
         trailingContent = {
           Row {
             if (node.selected) {
-              Icon(Icons.Outlined.Check, contentDescription = stringResource(R.string.selected))
+              Icon(Icons.Outlined.Check, null)
             }
           }
         })
@@ -128,12 +138,12 @@ fun MullvadItem(nav: ExitNodePickerNav, count: Int, selected: Boolean) {
         },
         supportingContent = {
           Text(
-              "$count ${stringResource(R.string.exit_nodes_available)}",
+              "$count ${stringResource(R.string.countries)}",
               style = MaterialTheme.typography.bodyMedium)
         },
         trailingContent = {
           if (selected) {
-            Icon(Icons.Outlined.Check, contentDescription = stringResource(R.string.selected))
+            Icon(Icons.Outlined.Check, null)
           }
         })
   }

android/src/main/java/com/tailscale/ipn/ui/view/IntroView.kt

@@ -3,15 +3,17 @@
 
 package com.tailscale.ipn.ui.view
 
-import androidx.compose.foundation.Image
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxHeight
+import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.Button
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
@@ -19,46 +21,48 @@ import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import com.tailscale.ipn.R
+import com.tailscale.ipn.ui.theme.AppTheme
 
 @Composable
 fun IntroView(onContinue: () -> Unit) {
-  Surface {
-    Column(
-        modifier = Modifier.fillMaxHeight(),
-        horizontalAlignment = Alignment.CenterHorizontally,
-        verticalArrangement = Arrangement.Center) {
-          Image(
-              modifier = Modifier.width(80.dp).height(80.dp),
-              painter = painterResource(id = R.drawable.androidicon_light),
-              contentDescription = stringResource(R.string.app_icon_content_description))
-          Spacer(modifier = Modifier.height(40.dp))
-          Text(
-              modifier = Modifier.padding(start = 40.dp, end = 40.dp, bottom = 40.dp),
-              text = stringResource(R.string.welcome1),
-              style = MaterialTheme.typography.bodyLarge,
-              textAlign = TextAlign.Center)
-
-          Button(onClick = onContinue) {
-            Text(
-                text = stringResource(id = R.string.getStarted),
-                fontSize = MaterialTheme.typography.titleMedium.fontSize)
-          }
-          Spacer(modifier = Modifier.height(40.dp))
-        }
+  Column(
+      modifier = Modifier.fillMaxHeight().fillMaxWidth().verticalScroll(rememberScrollState()),
+      horizontalAlignment = Alignment.CenterHorizontally,
+      verticalArrangement = Arrangement.Center) {
+        TailscaleLogoView(modifier = Modifier.width(60.dp).height(60.dp))
+        Spacer(modifier = Modifier.height(40.dp))
+        Text(
+            modifier = Modifier.padding(start = 40.dp, end = 40.dp, bottom = 40.dp),
+            text = stringResource(R.string.welcome1),
+            style = MaterialTheme.typography.bodyLarge,
+            textAlign = TextAlign.Center)
 
-    Box(
-        modifier = Modifier.fillMaxHeight().padding(start = 20.dp, end = 20.dp, bottom = 40.dp),
-        contentAlignment = Alignment.BottomCenter) {
+        Button(onClick = onContinue) {
           Text(
-              text = stringResource(R.string.welcome2),
-              style = MaterialTheme.typography.bodyMedium,
-              color = MaterialTheme.colorScheme.onSurfaceVariant,
-              textAlign = TextAlign.Center)
+              text = stringResource(id = R.string.getStarted),
+              fontSize = MaterialTheme.typography.titleMedium.fontSize)
         }
-  }
+        Spacer(modifier = Modifier.height(40.dp))
+
+        Box(
+            modifier = Modifier.fillMaxHeight().padding(start = 20.dp, end = 20.dp, bottom = 40.dp),
+            contentAlignment = Alignment.BottomCenter) {
+              Text(
+                  text = stringResource(R.string.welcome2),
+                  style = MaterialTheme.typography.bodyMedium,
+                  color = MaterialTheme.colorScheme.onSurfaceVariant,
+                  textAlign = TextAlign.Center)
+            }
+      }
+}
+
+@Composable
+@Preview
+fun IntroViewPreview() {
+  AppTheme { Surface { IntroView({}) } }
 }

android/src/main/java/com/tailscale/ipn/ui/view/LoginQRView.kt

@@ -0,0 +1,80 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn.ui.view
+
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.Button
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.tooling.preview.Preview
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.Dialog
+import androidx.lifecycle.viewmodel.compose.viewModel
+import com.tailscale.ipn.R
+import com.tailscale.ipn.ui.theme.AppTheme
+import com.tailscale.ipn.ui.util.set
+import com.tailscale.ipn.ui.viewModel.LoginQRViewModel
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun LoginQRView(onDismiss: () -> Unit = {}, model: LoginQRViewModel = viewModel()) {
+  Surface(color = MaterialTheme.colorScheme.scrim, modifier = Modifier.fillMaxSize()) {
+    Dialog(onDismissRequest = onDismiss) {
+      val image by model.qrCode.collectAsState()
+
+      Column(
+          modifier =
+              Modifier.clip(RoundedCornerShape(10.dp))
+                  .background(MaterialTheme.colorScheme.surfaceContainer)
+                  .padding(20.dp),
+          verticalArrangement = Arrangement.spacedBy(10.dp),
+          horizontalAlignment = Alignment.CenterHorizontally) {
+            Text(
+                text = stringResource(R.string.scan_to_connect_to_your_tailnet),
+                style = MaterialTheme.typography.titleMedium,
+                color = MaterialTheme.colorScheme.onSurface)
+            Box(
+                modifier =
+                    Modifier.size(200.dp)
+                        .background(MaterialTheme.colorScheme.onSurface)
+                        .fillMaxWidth(),
+                contentAlignment = Alignment.Center) {
+                  image?.let {
+                    Image(
+                        bitmap = it,
+                        contentDescription = "Scan to login",
+                        modifier = Modifier.fillMaxSize())
+                  }
+                }
+            Button(onClick = onDismiss) { Text(text = stringResource(R.string.dismiss)) }
+          }
+    }
+  }
+}
+
+@Composable
+@Preview
+fun LoginQRViewPreview() {
+  val vm = LoginQRViewModel()
+  vm.qrCode.set(vm.generateQRCode("https://tailscale.com", 200, 0))
+  AppTheme { LoginQRView({}, vm) }
+}

android/src/main/java/com/tailscale/ipn/ui/view/MDMSettingsDebugView.kt

@@ -12,6 +12,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.font.FontWeight
@@ -24,9 +25,9 @@ import com.tailscale.ipn.ui.viewModel.IpnViewModel
 
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
-fun MDMSettingsDebugView(nav: BackNavigation, model: IpnViewModel = viewModel()) {
-  Scaffold(topBar = { Header(R.string.current_mdm_settings, onBack = nav.onBack) }) { innerPadding
-    ->
+fun MDMSettingsDebugView(backToSettings: BackNavigation, model: IpnViewModel = viewModel()) {
+  Scaffold(topBar = { Header(R.string.current_mdm_settings, onBack = backToSettings) }) {
+      innerPadding ->
     LazyColumn(modifier = Modifier.padding(innerPadding)) {
       itemsWithDividers(MDMSettings.allSettings.sortedBy { "${it::class.java.name}|${it.key}" }) {
           setting ->
@@ -38,7 +39,7 @@ fun MDMSettingsDebugView(nav: BackNavigation, model: IpnViewModel = viewModel())
 
 @Composable
 fun MDMSettingView(setting: MDMSetting<*>) {
-  val value = setting.flow.collectAsState().value
+  val value by setting.flow.collectAsState()
   ListItem(
       headlineContent = { Text(setting.localizedTitle, maxLines = 3) },
       supportingContent = {

android/src/main/java/com/tailscale/ipn/ui/view/MainView.kt

@@ -20,11 +20,13 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.statusBars
 import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.outlined.ArrowDropDown
 import androidx.compose.material.icons.outlined.Clear
 import androidx.compose.material.icons.outlined.Close
+import androidx.compose.material.icons.outlined.Lock
 import androidx.compose.material.icons.outlined.Search
 import androidx.compose.material.icons.outlined.Settings
 import androidx.compose.material3.Button
@@ -38,13 +40,16 @@ import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.focus.onFocusChanged
 import androidx.compose.ui.platform.LocalFocusManager
@@ -55,16 +60,19 @@ import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
-import androidx.lifecycle.viewmodel.compose.viewModel
 import com.google.accompanist.permissions.ExperimentalPermissionsApi
 import com.tailscale.ipn.R
+import com.tailscale.ipn.mdm.MDMSettings
+import com.tailscale.ipn.mdm.ShowHide
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.model.IpnLocal
 import com.tailscale.ipn.ui.model.Netmap
 import com.tailscale.ipn.ui.model.Permissions
 import com.tailscale.ipn.ui.model.Tailcfg
 import com.tailscale.ipn.ui.theme.disabled
+import com.tailscale.ipn.ui.theme.exitNodeToggleButton
 import com.tailscale.ipn.ui.theme.listItem
 import com.tailscale.ipn.ui.theme.minTextSize
 import com.tailscale.ipn.ui.theme.primaryListItem
@@ -77,7 +85,6 @@ import com.tailscale.ipn.ui.util.AutoResizingText
 import com.tailscale.ipn.ui.util.Lists
 import com.tailscale.ipn.ui.util.LoadingIndicator
 import com.tailscale.ipn.ui.util.PeerSet
-import com.tailscale.ipn.ui.util.TimeUtil
 import com.tailscale.ipn.ui.util.flag
 import com.tailscale.ipn.ui.util.itemsWithDividers
 import com.tailscale.ipn.ui.viewModel.MainViewModel
@@ -91,23 +98,40 @@ data class MainViewNavigation(
 
 @OptIn(ExperimentalPermissionsApi::class)
 @Composable
-fun MainView(navigation: MainViewNavigation, viewModel: MainViewModel = viewModel()) {
+fun MainView(
+    loginAtUrl: (String) -> Unit,
+    navigation: MainViewNavigation,
+    viewModel: MainViewModel
+) {
   LoadingIndicator.Wrap {
     Scaffold(contentWindowInsets = WindowInsets.Companion.statusBars) { paddingInsets ->
       Column(
           modifier = Modifier.fillMaxWidth().padding(paddingInsets),
           verticalArrangement = Arrangement.Center) {
-            val state = viewModel.ipnState.collectAsState(initial = Ipn.State.NoState).value
-            val user = viewModel.loggedInUser.collectAsState(initial = null).value
-            val stateVal = viewModel.stateRes.collectAsState(initial = R.string.placeholder).value
+            // Assume VPN has been prepared. Whether or not it has been prepared cannot be known
+            // until permission has been granted to prepare the VPN.
+            val isPrepared by viewModel.vpnPrepared.collectAsState(initial = true)
+            val isOn by viewModel.vpnToggleState.collectAsState(initial = false)
+            val state by viewModel.ipnState.collectAsState(initial = Ipn.State.NoState)
+            val user by viewModel.loggedInUser.collectAsState(initial = null)
+            val stateVal by viewModel.stateRes.collectAsState(initial = R.string.placeholder)
             val stateStr = stringResource(id = stateVal)
-            val netmap = viewModel.netmap.collectAsState(initial = null)
+            val netmap by viewModel.netmap.collectAsState(initial = null)
+            val showExitNodePicker by MDMSettings.exitNodesPicker.flow.collectAsState()
+            val disableToggle by MDMSettings.forceEnabled.flow.collectAsState(initial = true)
+            val showKeyExpiry by viewModel.showExpiry.collectAsState(initial = false)
 
             ListItem(
                 colors = MaterialTheme.colorScheme.surfaceContainerListItem,
                 leadingContent = {
-                  val isOn = viewModel.vpnToggleState.collectAsState(initial = false)
-                  TintedSwitch(onCheckedChange = { viewModel.toggleVpn() }, checked = isOn.value)
+                  TintedSwitch(
+                      onCheckedChange = {
+                        if (!disableToggle) {
+                          viewModel.toggleVpn()
+                        }
+                      },
+                      enabled = !disableToggle,
+                      checked = isOn)
                 },
                 headlineContent = {
                   user?.NetworkProfile?.DomainName?.let { domain ->
@@ -126,7 +150,16 @@ fun MainView(navigation: MainViewNavigation, viewModel: MainViewModel = viewMode
                     when (user) {
                       null -> SettingsButton { navigation.onNavigateToSettings() }
                       else ->
-                          Avatar(profile = user, size = 36) { navigation.onNavigateToSettings() }
+                          Box(
+                              contentAlignment = Alignment.Center,
+                              modifier =
+                                  Modifier.size(42.dp).clip(CircleShape).clickable {
+                                    navigation.onNavigateToSettings()
+                                  }) {
+                                Avatar(profile = user, size = 36) {
+                                  navigation.onNavigateToSettings()
+                                }
+                              }
                     }
                   }
                 })
@@ -136,10 +169,14 @@ fun MainView(navigation: MainViewNavigation, viewModel: MainViewModel = viewMode
 
                 PromptPermissionsIfNecessary()
 
-                ExpiryNotificationIfNecessary(
-                    netmap = netmap.value, action = { viewModel.login {} })
+                if (showKeyExpiry) {
+                  ExpiryNotification(netmap = netmap, action = { viewModel.login() })
+                }
 
-                ExitNodeStatus(navAction = navigation.onNavigateToExitNodes, viewModel = viewModel)
+                if (showExitNodePicker == ShowHide.Show) {
+                  ExitNodeStatus(
+                      navAction = navigation.onNavigateToExitNodes, viewModel = viewModel)
+                }
 
                 PeerList(
                     viewModel = viewModel,
@@ -148,7 +185,17 @@ fun MainView(navigation: MainViewNavigation, viewModel: MainViewModel = viewMode
               }
               Ipn.State.NoState,
               Ipn.State.Starting -> StartingView()
-              else -> ConnectView(state, user, { viewModel.toggleVpn() }, { viewModel.login {} })
+              else -> {
+                ConnectView(
+                    state,
+                    isPrepared,
+                    user,
+                    { viewModel.toggleVpn() },
+                    { viewModel.login() },
+                    loginAtUrl,
+                    netmap?.SelfNode,
+                    { viewModel.showVPNPermissionLauncherIfUnauthorized() })
+              }
             }
           }
     }
@@ -157,13 +204,26 @@ fun MainView(navigation: MainViewNavigation, viewModel: MainViewModel = viewMode
 
 @Composable
 fun ExitNodeStatus(navAction: () -> Unit, viewModel: MainViewModel) {
-  val prefs = viewModel.prefs.collectAsState()
-  val netmap = viewModel.netmap.collectAsState()
-  val exitNodeId = prefs.value?.ExitNodeID
-  val peer = exitNodeId?.let { id -> netmap.value?.Peers?.find { it.StableID == id } }
-  val location = peer?.Hostinfo?.Location
-  val name = peer?.ComputedName
-  val active = peer != null
+  val maybePrefs by viewModel.prefs.collectAsState()
+  val netmap by viewModel.netmap.collectAsState()
+
+  // There's nothing to render if we haven't loaded the prefs yet
+  val prefs = maybePrefs ?: return
+
+  // The activeExitNode is the source of truth.  The selectedExitNode is only relevant if we
+  // don't have an active node.
+  val chosenExitNodeId = prefs.activeExitNodeID ?: prefs.selectedExitNodeID
+
+  val exitNodePeer = chosenExitNodeId?.let { id -> netmap?.Peers?.find { it.StableID == id } }
+  val location = exitNodePeer?.Hostinfo?.Location
+  val name = exitNodePeer?.ComputedName
+
+  // We're connected to an exit node if we found an active peer for the *active* exit node
+  val activeAndRunning = (exitNodePeer != null) && !prefs.activeExitNodeID.isNullOrEmpty()
+
+  // (jonathan) TODO: We will block the "enable/disable" button for an exit node for which we cannot
+  // find a peer  on purpose and render the "No Exit Node" state, however, that should
+  // eventually show up in the UI as an error case so the user knows to pick an available node.
 
   Box(modifier = Modifier.background(color = MaterialTheme.colorScheme.surfaceContainer)) {
     Box(
@@ -174,8 +234,8 @@ fun ExitNodeStatus(navAction: () -> Unit, viewModel: MainViewModel) {
           ListItem(
               modifier = Modifier.clickable { navAction() },
               colors =
-                  if (active) MaterialTheme.colorScheme.primaryListItem
-                  else ListItemDefaults.colors(),
+                  if (activeAndRunning) MaterialTheme.colorScheme.primaryListItem
+                  else ListItemDefaults.colors(containerColor = MaterialTheme.colorScheme.surface),
               overlineContent = {
                 Text(
                     stringResource(R.string.exit_node),
@@ -196,17 +256,24 @@ fun ExitNodeStatus(navAction: () -> Unit, viewModel: MainViewModel) {
                       imageVector = Icons.Outlined.ArrowDropDown,
                       contentDescription = null,
                       tint =
-                          if (active) MaterialTheme.colorScheme.onPrimary.copy(alpha = 0.7f)
+                          if (activeAndRunning)
+                              MaterialTheme.colorScheme.onPrimary.copy(alpha = 0.7f)
                           else MaterialTheme.colorScheme.onSurfaceVariant,
                   )
                 }
               },
               trailingContent = {
-                if (peer != null) {
+                if (exitNodePeer != null) {
                   Button(
-                      colors = MaterialTheme.colorScheme.secondaryButton,
-                      onClick = { viewModel.disableExitNode() }) {
-                        Text(stringResource(R.string.stop))
+                      colors =
+                          if (prefs.activeExitNodeID.isNullOrEmpty())
+                              MaterialTheme.colorScheme.exitNodeToggleButton
+                          else MaterialTheme.colorScheme.secondaryButton,
+                      onClick = { viewModel.toggleExitNode() }) {
+                        Text(
+                            if (prefs.activeExitNodeID.isNullOrEmpty())
+                                stringResource(id = R.string.enable)
+                            else stringResource(id = R.string.disable))
                       }
                 }
               })
@@ -216,13 +283,11 @@ fun ExitNodeStatus(navAction: () -> Unit, viewModel: MainViewModel) {
 
 @Composable
 fun SettingsButton(action: () -> Unit) {
-  // (jonathan) TODO: On iOS this is the users avatar or a letter avatar.
-
   IconButton(modifier = Modifier.size(24.dp), onClick = { action() }) {
     Icon(
         Icons.Outlined.Settings,
-        null,
-    )
+        contentDescription = "Open settings",
+        tint = MaterialTheme.colorScheme.onSurfaceVariant)
   }
 }
 
@@ -232,17 +297,27 @@ fun StartingView() {
       modifier = Modifier.fillMaxSize(),
       verticalArrangement = Arrangement.Center,
       horizontalAlignment = Alignment.CenterHorizontally) {
-        TailscaleLogoView(animated = true, Modifier.size(40.dp))
+        TailscaleLogoView(
+            animated = true, usesOnBackgroundColors = false, Modifier.size(40.dp).alpha(0.3f))
       }
 }
 
 @Composable
 fun ConnectView(
     state: Ipn.State,
+    isPrepared: Boolean,
     user: IpnLocal.LoginProfile?,
     connectAction: () -> Unit,
-    loginAction: () -> Unit
+    loginAction: () -> Unit,
+    loginAtUrlAction: (String) -> Unit,
+    selfNode: Tailcfg.Node?,
+    showVPNPermissionLauncherIfUnauthorized: () -> Unit
 ) {
+  LaunchedEffect(isPrepared) {
+    if (!isPrepared) {
+      showVPNPermissionLauncherIfUnauthorized()
+    }
+  }
   Row(horizontalArrangement = Arrangement.Center, modifier = Modifier.fillMaxWidth()) {
     Column(horizontalAlignment = Alignment.CenterHorizontally, modifier = Modifier.fillMaxWidth()) {
       Column(
@@ -250,7 +325,45 @@ fun ConnectView(
           verticalArrangement = Arrangement.spacedBy(8.dp, alignment = Alignment.CenterVertically),
           horizontalAlignment = Alignment.CenterHorizontally,
       ) {
-        if (state != Ipn.State.NeedsLogin && user != null && !user.isEmpty()) {
+        if (!isPrepared) {
+          TailscaleLogoView(modifier = Modifier.size(50.dp))
+          Spacer(modifier = Modifier.size(1.dp))
+          Text(
+              text = stringResource(id = R.string.welcome_to_tailscale),
+              style = MaterialTheme.typography.titleMedium,
+              textAlign = TextAlign.Center)
+          Text(
+              stringResource(R.string.give_permissions),
+              style = MaterialTheme.typography.titleSmall,
+              textAlign = TextAlign.Center)
+          Spacer(modifier = Modifier.size(1.dp))
+          PrimaryActionButton(onClick = connectAction) {
+            Text(
+                text = stringResource(id = R.string.connect),
+                fontSize = MaterialTheme.typography.titleMedium.fontSize)
+          }
+        } else if (state == Ipn.State.NeedsMachineAuth) {
+          Icon(
+              modifier = Modifier.size(40.dp),
+              imageVector = Icons.Outlined.Lock,
+              contentDescription = "Device requires authentication")
+          Text(
+              text = stringResource(id = R.string.machine_auth_required),
+              style = MaterialTheme.typography.titleMedium,
+              textAlign = TextAlign.Center)
+          Text(
+              text = stringResource(id = R.string.machine_auth_explainer),
+              style = MaterialTheme.typography.bodyMedium,
+              textAlign = TextAlign.Center)
+          Spacer(modifier = Modifier.size(1.dp))
+          selfNode?.let {
+            PrimaryActionButton(onClick = { loginAtUrlAction(it.nodeAdminUrl) }) {
+              Text(
+                  text = stringResource(id = R.string.open_admin_console),
+                  fontSize = MaterialTheme.typography.titleMedium.fontSize)
+            }
+          }
+        } else if (state != Ipn.State.NeedsLogin && user != null && !user.isEmpty()) {
           Icon(
               painter = painterResource(id = R.drawable.power),
               contentDescription = null,
@@ -311,8 +424,11 @@ fun PeerList(
     onNavigateToPeerDetails: (Tailcfg.Node) -> Unit,
     onSearch: (String) -> Unit
 ) {
-  val peerList = viewModel.peers.collectAsState(initial = emptyList<PeerSet>())
+  val peerList by viewModel.peers.collectAsState(initial = emptyList<PeerSet>())
   val searchTermStr by viewModel.searchTerm.collectAsState(initial = "")
+  val showNoResults =
+      remember { derivedStateOf { searchTermStr.isNotEmpty() && peerList.isEmpty() } }.value
+
   val netmap = viewModel.netmap.collectAsState()
 
   val focusManager = LocalFocusManager.current
@@ -356,8 +472,23 @@ fun PeerList(
 
   LazyColumn(
       modifier = Modifier.fillMaxSize().background(color = MaterialTheme.colorScheme.surface)) {
+        if (showNoResults) {
+          item {
+            Spacer(
+                Modifier.height(16.dp)
+                    .fillMaxSize()
+                    .background(color = MaterialTheme.colorScheme.surface))
+
+            Lists.LargeTitle(
+                stringResource(id = R.string.no_results),
+                bottomPadding = 8.dp,
+                style = MaterialTheme.typography.bodyMedium,
+                fontWeight = FontWeight.Light)
+          }
+        }
+
         var first = true
-        peerList.value.forEach { peerSet ->
+        peerList.forEach { peerSet ->
           if (!first) {
             item(key = "user_divider_${peerSet.user?.ID ?: 0L}") { Lists.ItemDivider() }
           }
@@ -369,7 +500,7 @@ fun PeerList(
                     .fillMaxSize()
                     .background(color = MaterialTheme.colorScheme.surface))
 
-            Lists.SectionTitle(
+            Lists.LargeTitle(
                 peerSet.user?.DisplayName ?: stringResource(id = R.string.unknown_user),
                 bottomPadding = 8.dp,
                 style = MaterialTheme.typography.titleLarge,
@@ -406,12 +537,8 @@ fun PeerList(
 }
 
 @Composable
-fun ExpiryNotificationIfNecessary(netmap: Netmap.NetworkMap?, action: () -> Unit = {}) {
-  // Key expiry warning shown only if the key is expiring within 24 hours (or has already expired)
-  val networkMap = netmap ?: return
-  if (!TimeUtil.isWithin24Hours(networkMap.SelfNode.KeyExpiry)) {
-    return
-  }
+fun ExpiryNotification(netmap: Netmap.NetworkMap?, action: () -> Unit = {}) {
+  if (netmap == null) return
 
   Box(modifier = Modifier.background(color = MaterialTheme.colorScheme.surfaceContainer)) {
     Box(
@@ -424,7 +551,7 @@ fun ExpiryNotificationIfNecessary(netmap: Netmap.NetworkMap?, action: () -> Unit
               colors = MaterialTheme.colorScheme.warningListItem,
               headlineContent = {
                 Text(
-                    networkMap.SelfNode.expiryLabel(),
+                    netmap.SelfNode.expiryLabel(),
                     style = MaterialTheme.typography.titleMedium,
                 )
               },
@@ -449,3 +576,14 @@ fun PromptPermissionsIfNecessary() {
         }
   }
 }
+
+@Preview
+@Composable
+fun MainViewPreview() {
+  val vm = MainViewModel()
+  MainView(
+      {},
+      MainViewNavigation(
+          onNavigateToSettings = {}, onNavigateToPeerDetails = {}, onNavigateToExitNodes = {}),
+      vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/ManagedByView.kt

@@ -7,6 +7,8 @@ import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.safeContentPadding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
@@ -14,6 +16,7 @@ import androidx.compose.runtime.collectAsState
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
@@ -21,13 +24,13 @@ import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.viewModel.IpnViewModel
 
 @Composable
-fun ManagedByView(nav: BackNavigation, model: IpnViewModel = viewModel()) {
-  Scaffold(topBar = { Header(R.string.managed_by, onBack = nav.onBack) }) { innerPadding ->
+fun ManagedByView(backToSettings: BackNavigation, model: IpnViewModel = viewModel()) {
+  Scaffold(topBar = { Header(R.string.managed_by, onBack = backToSettings) }) { innerPadding ->
     Column(
         verticalArrangement =
             Arrangement.spacedBy(space = 20.dp, alignment = Alignment.CenterVertically),
         horizontalAlignment = Alignment.Start,
-        modifier = Modifier.fillMaxWidth().safeContentPadding()) {
+        modifier = Modifier.fillMaxWidth().safeContentPadding().verticalScroll(rememberScrollState())) {
           val managedByOrganization =
               MDMSettings.managedByOrganizationName.flow.collectAsState().value
           val managedByCaption = MDMSettings.managedByCaption.flow.collectAsState().value
@@ -44,3 +47,10 @@ fun ManagedByView(nav: BackNavigation, model: IpnViewModel = viewModel()) {
         }
   }
 }
+
+@Preview
+@Composable
+fun ManagedByViewPreview() {
+  val vm = IpnViewModel()
+  ManagedByView(backToSettings = {}, vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/MullvadExitNodePicker.kt

@@ -10,6 +10,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.lifecycle.viewmodel.compose.viewModel
@@ -29,10 +30,10 @@ fun MullvadExitNodePicker(
     nav: ExitNodePickerNav,
     model: ExitNodePickerViewModel = viewModel(factory = ExitNodePickerViewModelFactory(nav))
 ) {
-  val mullvadExitNodes = model.mullvadExitNodesByCountryCode.collectAsState()
-  val bestAvailableByCountry = model.mullvadBestAvailableByCountry.collectAsState()
+  val mullvadExitNodes by model.mullvadExitNodesByCountryCode.collectAsState()
+  val bestAvailableByCountry by model.mullvadBestAvailableByCountry.collectAsState()
 
-  mullvadExitNodes.value[countryCode]?.toList()?.let { nodes ->
+  mullvadExitNodes[countryCode]?.toList()?.let { nodes ->
     val any = nodes.first()
 
     LoadingIndicator.Wrap {
@@ -40,11 +41,11 @@ fun MullvadExitNodePicker(
           topBar = {
             Header(
                 title = { Text("${countryCode.flag()} ${any.country}") },
-                onBack = nav.onNavigateBack)
+                onBack = nav.onNavigateBackToMullvad)
           }) { innerPadding ->
             LazyColumn(modifier = Modifier.padding(innerPadding)) {
               if (nodes.size > 1) {
-                val bestAvailableNode = bestAvailableByCountry.value[countryCode]!!
+                val bestAvailableNode = bestAvailableByCountry[countryCode]!!
                 item {
                   ExitNodeItem(
                       model,

android/src/main/java/com/tailscale/ipn/ui/view/MullvadExitNodePickerList.kt

@@ -17,6 +17,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.lifecycle.viewmodel.compose.viewModel
@@ -36,60 +37,63 @@ fun MullvadExitNodePickerList(
     model: ExitNodePickerViewModel = viewModel(factory = ExitNodePickerViewModelFactory(nav))
 ) {
   LoadingIndicator.Wrap {
-    Scaffold(topBar = { Header(R.string.choose_mullvad_exit_node, onBack = nav.onNavigateBack) }) {
-        innerPadding ->
-      val mullvadExitNodes = model.mullvadExitNodesByCountryCode.collectAsState()
+    Scaffold(
+        topBar = {
+          Header(R.string.choose_mullvad_exit_node, onBack = nav.onNavigateBackToExitNodes)
+        }) { innerPadding ->
+          val mullvadExitNodes by model.mullvadExitNodesByCountryCode.collectAsState()
 
-      LazyColumn(modifier = Modifier.padding(innerPadding)) {
-        val sortedCountries =
-            mullvadExitNodes.value.entries.toList().sortedBy {
-              it.value.first().country.lowercase()
-            }
-        itemsWithDividers(sortedCountries) { (countryCode, nodes) ->
-          val first = nodes.first()
+          LazyColumn(modifier = Modifier.padding(innerPadding)) {
+            val sortedCountries =
+                mullvadExitNodes.entries.toList().sortedBy {
+                  it.value.first().country.lowercase()
+                }
+            itemsWithDividers(sortedCountries) { (countryCode, nodes) ->
+              val first = nodes.first()
 
-          // TODO(oxtoacart): the modifier on the ListItem occasionally causes a crash
-          // with java.lang.ClassCastException: androidx.compose.ui.ComposedModifier cannot be cast
-          // to androidx.compose.runtime.RecomposeScopeImpl
-          // Wrapping it in a Box eliminates this. It appears to be some kind of
-          // interaction between the LazyList and the modifier.
-          Box {
-            ListItem(
-                modifier =
-                    Modifier.clickable {
-                      if (nodes.size > 1) {
-                        nav.onNavigateToMullvadCountry(countryCode)
-                      } else {
-                        model.setExitNode(first)
-                      }
+              // TODO(oxtoacart): the modifier on the ListItem occasionally causes a crash
+              // with java.lang.ClassCastException: androidx.compose.ui.ComposedModifier cannot be
+              // cast
+              // to androidx.compose.runtime.RecomposeScopeImpl
+              // Wrapping it in a Box eliminates this. It appears to be some kind of
+              // interaction between the LazyList and the modifier.
+              Box {
+                ListItem(
+                    modifier =
+                        Modifier.clickable {
+                          if (nodes.size > 1) {
+                            nav.onNavigateToMullvadCountry(countryCode)
+                          } else {
+                            model.setExitNode(first)
+                          }
+                        },
+                    leadingContent = {
+                      Text(
+                          countryCode.flag(),
+                          style = MaterialTheme.typography.titleLarge,
+                      )
+                    },
+                    headlineContent = {
+                      Text(first.country, style = MaterialTheme.typography.bodyMedium)
                     },
-                leadingContent = {
-                  Text(
-                      countryCode.flag(),
-                      style = MaterialTheme.typography.titleLarge,
-                  )
-                },
-                headlineContent = {
-                  Text(first.country, style = MaterialTheme.typography.bodyMedium)
-                },
-                supportingContent = {
-                  Text(
-                      if (nodes.size == 1) first.city
-                      else "${nodes.size} ${stringResource(R.string.cities_available)}",
-                      style = MaterialTheme.typography.bodyMedium)
-                },
-                trailingContent = {
-                  if (nodes.size > 1 && nodes.selected || first.selected) {
-                    if (nodes.selected) {
-                      Icon(
-                          Icons.Outlined.Check,
-                          contentDescription = stringResource(R.string.selected))
-                    }
-                  }
-                })
+                    supportingContent = {
+                      Text(
+                          if (nodes.size == 1) first.city
+                          else "${nodes.size} ${stringResource(R.string.cities_available)}",
+                          style = MaterialTheme.typography.bodyMedium)
+                    },
+                    trailingContent = {
+                      if (nodes.size > 1 && nodes.selected || first.selected) {
+                        if (nodes.selected) {
+                          Icon(
+                              Icons.Outlined.Check,
+                              contentDescription = stringResource(R.string.selected))
+                        }
+                      }
+                    })
+              }
+            }
           }
         }
-      }
-    }
   }
 }

android/src/main/java/com/tailscale/ipn/ui/view/PeerDetails.kt

@@ -9,7 +9,6 @@ import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyColumn
@@ -24,7 +23,6 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.RectangleShape
 import androidx.compose.ui.platform.LocalClipboardManager
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.painterResource
@@ -43,7 +41,7 @@ import com.tailscale.ipn.ui.viewModel.PeerDetailsViewModelFactory
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
 fun PeerDetails(
-    nav: BackNavigation,
+    backToHome: BackNavigation,
     nodeId: String,
     model: PeerDetailsViewModel =
         viewModel(factory = PeerDetailsViewModelFactory(nodeId, LocalContext.current.filesDir))
@@ -74,24 +72,14 @@ fun PeerDetails(
                     }
                   }
                 },
-                onBack = { nav.onBack() })
+                onBack = backToHome)
           },
       ) { innerPadding ->
         LazyColumn(
             modifier = Modifier.padding(innerPadding),
         ) {
           item(key = "tailscaleAddresses") {
-            Box(
-                modifier =
-                    Modifier.fillMaxWidth()
-                        .background(
-                            color = MaterialTheme.colorScheme.surface, shape = RectangleShape)) {
-                  Text(
-                      modifier = Modifier.padding(start = 16.dp, top = 16.dp),
-                      text = stringResource(R.string.tailscale_addresses),
-                      style = MaterialTheme.typography.titleSmall,
-                      color = MaterialTheme.colorScheme.onSurfaceVariant)
-                }
+            Lists.MutedHeader(stringResource(R.string.tailscale_addresses))
           }
 
           itemsWithDividers(node.displayAddresses, key = { it.address }) {

android/src/main/java/com/tailscale/ipn/ui/view/PeerView.kt

@@ -28,7 +28,7 @@ fun PeerView(
     peer: Tailcfg.Node,
     selfPeer: String? = null,
     stateVal: Ipn.State? = null,
-    subtitle: () -> String = { peer.Addresses?.first()?.split("/")?.first() ?: "" },
+    subtitle: () -> String = { peer.primaryIPv4Address ?: peer.primaryIPv6Address ?: "" },
     onClick: (Tailcfg.Node) -> Unit = {},
     trailingContent: @Composable () -> Unit = {}
 ) {

android/src/main/java/com/tailscale/ipn/ui/view/PermissionsView.kt

@@ -25,10 +25,10 @@ import com.tailscale.ipn.ui.util.itemsWithDividers
 
 @OptIn(ExperimentalPermissionsApi::class)
 @Composable
-fun PermissionsView(nav: BackNavigation, openApplicationSettings: () -> Unit) {
+fun PermissionsView(backToSettings: BackNavigation, openApplicationSettings: () -> Unit) {
   val permissions = Permissions.withGrantedStatus
-  Scaffold(topBar = { Header(titleRes = R.string.permissions, onBack = nav.onBack) }) { innerPadding
-    ->
+  Scaffold(topBar = { Header(titleRes = R.string.permissions, onBack = backToSettings) }) {
+      innerPadding ->
     LazyColumn(modifier = Modifier.padding(innerPadding)) {
       itemsWithDividers(permissions) { (permission, granted) ->
         ListItem(

android/src/main/java/com/tailscale/ipn/ui/view/RunExitNodeView.kt

@@ -10,6 +10,8 @@ import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxHeight
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.outlined.ArrowForward
 import androidx.compose.material3.Button
@@ -19,6 +21,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.painterResource
@@ -37,17 +40,21 @@ fun RunExitNodeView(
     nav: ExitNodePickerNav,
     model: RunExitNodeViewModel = viewModel(factory = RunExitNodeViewModelFactory())
 ) {
-  val isRunningExitNode = model.isRunningExitNode.collectAsState().value
+  val isRunningExitNode by model.isRunningExitNode.collectAsState()
 
   Scaffold(
-      topBar = { Header(R.string.run_as_exit_node, onBack = nav.onNavigateToExitNodePicker) }) {
+      topBar = { Header(R.string.run_as_exit_node, onBack = nav.onNavigateBackToExitNodes) }) {
           innerPadding ->
         LoadingIndicator.Wrap {
           Column(
               horizontalAlignment = Alignment.CenterHorizontally,
               verticalArrangement =
                   Arrangement.spacedBy(24.dp, alignment = Alignment.CenterVertically),
-              modifier = Modifier.padding(innerPadding).padding(24.dp).fillMaxHeight()) {
+              modifier =
+                  Modifier.padding(innerPadding)
+                      .padding(24.dp)
+                      .fillMaxHeight()
+                      .verticalScroll(rememberScrollState())) {
                 RunExitNodeGraphic()
 
                 if (isRunningExitNode) {

android/src/main/java/com/tailscale/ipn/ui/view/SettingsView.kt

@@ -6,13 +6,15 @@ package com.tailscale.ipn.ui.view
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.text.ClickableText
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.ListItem
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.platform.LocalUriHandler
@@ -21,42 +23,69 @@ import androidx.compose.ui.text.SpanStyle
 import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.text.withStyle
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.BuildConfig
 import com.tailscale.ipn.R
+import com.tailscale.ipn.mdm.MDMSettings
+import com.tailscale.ipn.mdm.ShowHide
 import com.tailscale.ipn.ui.Links
 import com.tailscale.ipn.ui.theme.link
 import com.tailscale.ipn.ui.theme.listItem
 import com.tailscale.ipn.ui.util.Lists
+import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.viewModel.SettingsNav
 import com.tailscale.ipn.ui.viewModel.SettingsViewModel
 
 @Composable
 fun SettingsView(settingsNav: SettingsNav, viewModel: SettingsViewModel = viewModel()) {
   val handler = LocalUriHandler.current
-  val user = viewModel.loggedInUser.collectAsState().value
-  val isAdmin = viewModel.isAdmin.collectAsState().value
-  val managedByOrganization = viewModel.managedByOrganization.collectAsState().value
+
+  val user by viewModel.loggedInUser.collectAsState()
+  val isAdmin by viewModel.isAdmin.collectAsState()
+  val managedByOrganization by viewModel.managedByOrganization.collectAsState()
+  val tailnetLockEnabled by viewModel.tailNetLockEnabled.collectAsState()
+  val corpDNSEnabled by viewModel.corpDNSEnabled.collectAsState()
+  val isVPNPrepared by viewModel.vpnPrepared.collectAsState()
+  val showTailnetLock by MDMSettings.manageTailnetLock.flow.collectAsState()
 
   Scaffold(
       topBar = {
-        Header(titleRes = R.string.settings_title, onBack = settingsNav.onBackPressed)
+        Header(titleRes = R.string.settings_title, onBack = settingsNav.onNavigateBackHome)
       }) { innerPadding ->
-        Column(modifier = Modifier.padding(innerPadding)) {
-          UserView(
-              profile = user,
-              actionState = UserActionState.NAV,
-              onClick = settingsNav.onNavigateToUserSwitcher)
+        Column(modifier = Modifier.padding(innerPadding).verticalScroll(rememberScrollState())) {
+          if (isVPNPrepared){
+            UserView(
+                profile = user,
+                actionState = UserActionState.NAV,
+                onClick = settingsNav.onNavigateToUserSwitcher)
+          }
 
           if (isAdmin) {
+            Lists.ItemDivider()
             AdminTextView { handler.openUri(Links.ADMIN_URL) }
           }
 
           Lists.SectionDivider()
-          Setting.Text(R.string.dns_settings, onClick = settingsNav.onNavigateToDNSSettings)
-
-          Lists.ItemDivider()
-          Setting.Text(R.string.tailnet_lock, onClick = settingsNav.onNavigateToTailnetLock)
+          Setting.Text(
+              R.string.dns_settings,
+              subtitle =
+                  corpDNSEnabled?.let {
+                    stringResource(
+                        if (it) R.string.using_tailscale_dns else R.string.not_using_tailscale_dns)
+                  },
+              onClick = settingsNav.onNavigateToDNSSettings)
+
+          if (showTailnetLock == ShowHide.Show) {
+            Lists.ItemDivider()
+            Setting.Text(
+                R.string.tailnet_lock,
+                subtitle =
+                    tailnetLockEnabled?.let {
+                      stringResource(if (it) R.string.enabled else R.string.disabled)
+                    },
+                onClick = settingsNav.onNavigateToTailnetLock)
+          }
 
           Lists.ItemDivider()
           Setting.Text(R.string.permissions, onClick = settingsNav.onNavigateToPermissions)
@@ -72,11 +101,15 @@ fun SettingsView(settingsNav: SettingsNav, viewModel: SettingsViewModel = viewMo
           Setting.Text(R.string.bug_report, onClick = settingsNav.onNavigateToBugReport)
 
           Lists.ItemDivider()
-          Setting.Text(R.string.about_tailscale, onClick = settingsNav.onNavigateToAbout)
+          Setting.Text(
+              R.string.about_tailscale,
+              subtitle = "${stringResource(id = R.string.version)} ${BuildConfig.VERSION_NAME}",
+              onClick = settingsNav.onNavigateToAbout)
 
           // TODO: put a heading for the debug section
           if (BuildConfig.DEBUG) {
             Lists.SectionDivider()
+            Lists.MutedHeader(text = stringResource(R.string.internal_debug_options))
             Setting.Text(R.string.mdm_settings, onClick = settingsNav.onNavigateToMDMSettings)
           }
         }
@@ -88,6 +121,7 @@ object Setting {
   fun Text(
       titleRes: Int = 0,
       title: String? = null,
+      subtitle: String? = null,
       destructive: Boolean = false,
       enabled: Boolean = true,
       onClick: (() -> Unit)? = null
@@ -105,7 +139,15 @@ object Setting {
               style = MaterialTheme.typography.bodyMedium,
               color = if (destructive) MaterialTheme.colorScheme.error else Color.Unspecified)
         },
-    )
+        supportingContent =
+            subtitle?.let {
+              {
+                Text(
+                    it,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant)
+              }
+            })
   }
 
   @Composable
@@ -133,9 +175,7 @@ object Setting {
 @Composable
 fun AdminTextView(onNavigateToAdminConsole: () -> Unit) {
   val adminStr = buildAnnotatedString {
-    withStyle(style = SpanStyle(color = MaterialTheme.colorScheme.onSurfaceVariant)) {
-      append(stringResource(id = R.string.settings_admin_prefix))
-    }
+    append(stringResource(id = R.string.settings_admin_prefix))
 
     pushStringAnnotation(tag = "link", annotation = Links.ADMIN_URL)
     withStyle(
@@ -145,14 +185,18 @@ fun AdminTextView(onNavigateToAdminConsole: () -> Unit) {
                 textDecoration = TextDecoration.Underline)) {
           append(stringResource(id = R.string.settings_admin_link))
         }
-    pop()
   }
 
-  ListItem(
-      headlineContent = {
-        ClickableText(
-            text = adminStr,
-            style = MaterialTheme.typography.bodyMedium,
-            onClick = { onNavigateToAdminConsole() })
-      })
+  Lists.InfoItem(adminStr, onClick = onNavigateToAdminConsole)
+}
+
+@Preview
+@Composable
+fun SettingsPreview() {
+  val vm = SettingsViewModel()
+  vm.corpDNSEnabled.set(true)
+  vm.tailNetLockEnabled.set(true)
+  vm.isAdmin.set(true)
+  vm.managedByOrganization.set("Tails and Scales Inc.")
+  SettingsView(SettingsNav({}, {}, {}, {}, {}, {}, {}, {}, {}, {}), vm)
 }

android/src/main/java/com/tailscale/ipn/ui/view/SharedViews.kt

@@ -29,9 +29,7 @@ import androidx.compose.ui.unit.dp
 import com.tailscale.ipn.ui.theme.topAppBar
 import com.tailscale.ipn.ui.theme.ts_color_light_blue
 
-data class BackNavigation(
-    val onBack: () -> Unit,
-)
+typealias BackNavigation = () -> Unit
 
 // Header view for all secondary screens
 // @see TopAppBar actions for additional actions (usually a row of icons)
@@ -62,7 +60,7 @@ fun BackArrow(action: () -> Unit) {
   Box(modifier = Modifier.padding(start = 8.dp, end = 8.dp)) {
     Icon(
         Icons.AutoMirrored.Filled.ArrowBack,
-        null,
+        contentDescription = "Go back to the previous screen",
         modifier =
             Modifier.clickable(
                 interactionSource = remember { MutableInteractionSource() },
@@ -73,7 +71,7 @@ fun BackArrow(action: () -> Unit) {
 
 @Composable
 fun CheckedIndicator() {
-  Icon(Icons.Default.CheckCircle, "selected", tint = ts_color_light_blue)
+  Icon(Icons.Default.CheckCircle, null, tint = ts_color_light_blue)
 }
 
 @Composable

android/src/main/java/com/tailscale/ipn/ui/view/TaildropView.kt

@@ -19,6 +19,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
@@ -57,7 +58,7 @@ fun TaildropView(
 
       when (viewModel.state.collectAsState().value) {
         Ipn.State.Running -> {
-          val peers = viewModel.myPeers.collectAsState().value
+          val peers by viewModel.myPeers.collectAsState()
           val context = LocalContext.current
           FileSharePeerList(
               peers = peers,

android/src/main/java/com/tailscale/ipn/ui/view/TailnetLockSetupView.kt

@@ -3,7 +3,6 @@
 
 package com.tailscale.ipn.ui.view
 
-import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
@@ -15,6 +14,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.res.painterResource
@@ -24,27 +24,30 @@ import androidx.compose.ui.text.SpanStyle
 import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.text.withStyle
-import androidx.compose.ui.unit.dp
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
 import com.tailscale.ipn.ui.Links
+import com.tailscale.ipn.ui.theme.defaultTextColor
 import com.tailscale.ipn.ui.theme.link
 import com.tailscale.ipn.ui.util.ClipboardValueView
 import com.tailscale.ipn.ui.util.Lists
 import com.tailscale.ipn.ui.util.LoadingIndicator
+import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.viewModel.TailnetLockSetupViewModel
 import com.tailscale.ipn.ui.viewModel.TailnetLockSetupViewModelFactory
 
 @Composable
 fun TailnetLockSetupView(
-    nav: BackNavigation,
+    backToSettings: BackNavigation,
     model: TailnetLockSetupViewModel = viewModel(factory = TailnetLockSetupViewModelFactory())
 ) {
-  val statusItems = model.statusItems.collectAsState().value
-  val nodeKey = model.nodeKey.collectAsState().value
-  val tailnetLockKey = model.tailnetLockKey.collectAsState().value
+  val statusItems by model.statusItems.collectAsState()
+  val nodeKey by model.nodeKey.collectAsState()
+  val tailnetLockKey by model.tailnetLockKey.collectAsState()
+  val tailnetLockTlPubKey = tailnetLockKey.replace("nlpub", "tlpub")
 
-  Scaffold(topBar = { Header(R.string.tailnet_lock, onBack = nav.onBack) }) { innerPadding ->
+  Scaffold(topBar = { Header(R.string.tailnet_lock, onBack = backToSettings) }) { innerPadding ->
     LoadingIndicator.Wrap {
       LazyColumn(modifier = Modifier.padding(innerPadding)) {
         item(key = "header") { ExplainerView() }
@@ -75,7 +78,7 @@ fun TailnetLockSetupView(
           Lists.SectionDivider()
 
           ClipboardValueView(
-              value = tailnetLockKey,
+              value = tailnetLockTlPubKey,
               title = stringResource(R.string.tailnet_lock_key),
               subtitle = stringResource(R.string.tailnet_lock_key_explainer))
         }
@@ -88,21 +91,20 @@ fun TailnetLockSetupView(
 private fun ExplainerView() {
   val handler = LocalUriHandler.current
 
-  ListItem(
-      headlineContent = {
-        Box(modifier = Modifier.padding(vertical = 8.dp)) {
-          ClickableText(
-              explainerText(),
-              onClick = { handler.openUri(Links.TAILNET_LOCK_KB_URL) },
-              style = MaterialTheme.typography.bodyMedium)
-        }
-      })
+  Lists.MultilineDescription {
+    ClickableText(
+        explainerText(),
+        onClick = { handler.openUri(Links.TAILNET_LOCK_KB_URL) },
+        style = MaterialTheme.typography.bodyMedium)
+  }
 }
 
 @Composable
 fun explainerText(): AnnotatedString {
   val annotatedString = buildAnnotatedString {
-    append(stringResource(id = R.string.tailnet_lock_explainer))
+    withStyle(SpanStyle(color = MaterialTheme.colorScheme.defaultTextColor)) {
+      append(stringResource(id = R.string.tailnet_lock_explainer))
+    }
 
     pushStringAnnotation(tag = "tailnetLockSupportURL", annotation = Links.TAILNET_LOCK_KB_URL)
 
@@ -117,3 +119,12 @@ fun explainerText(): AnnotatedString {
   }
   return annotatedString
 }
+
+@Composable
+@Preview
+fun TailnetLockSetupViewPreview() {
+  val vm = TailnetLockSetupViewModel()
+  vm.nodeKey.set("8BADF00D-EA7-1337-DEAD-BEEF")
+  vm.tailnetLockKey.set("C0FFEE-CAFE-50DA")
+  TailnetLockSetupView(backToSettings = {}, vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/TailscaleLogoView.kt

@@ -14,6 +14,10 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
+import com.tailscale.ipn.ui.theme.onBackgroundLogoDotDisabled
+import com.tailscale.ipn.ui.theme.onBackgroundLogoDotEnabled
+import com.tailscale.ipn.ui.theme.standaloneLogoDotDisabled
+import com.tailscale.ipn.ui.theme.standaloneLogoDotEnabled
 import com.tailscale.ipn.ui.util.set
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -31,10 +35,24 @@ val logoDotsMatrix: DotsMatrix =
     )
 
 @Composable
-fun TailscaleLogoView(animated: Boolean = false, modifier: Modifier) {
+fun TailscaleLogoView(
+    animated: Boolean = false,
+    usesOnBackgroundColors: Boolean = false,
+    modifier: Modifier
+) {
 
-  val primaryColor: Color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.3f)
-  val secondaryColor: Color = primaryColor.copy(alpha = 0.1f)
+  val primaryColor: Color =
+      if (usesOnBackgroundColors) {
+        MaterialTheme.colorScheme.onBackgroundLogoDotEnabled
+      } else {
+        MaterialTheme.colorScheme.standaloneLogoDotEnabled
+      }
+  val secondaryColor: Color =
+      if (usesOnBackgroundColors) {
+        MaterialTheme.colorScheme.onBackgroundLogoDotDisabled
+      } else {
+        MaterialTheme.colorScheme.standaloneLogoDotDisabled
+      }
 
   val currentDotsMatrix: StateFlow<DotsMatrix> = MutableStateFlow(logoDotsMatrix)
   var currentDotsMatrixIndex = 0

android/src/main/java/com/tailscale/ipn/ui/view/UserSwitcherView.kt

@@ -7,7 +7,6 @@ import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
@@ -19,19 +18,16 @@ import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
-import androidx.compose.material3.TextFieldDefaults
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.tailscale.ipn.R
@@ -40,26 +36,32 @@ import com.tailscale.ipn.ui.util.itemsWithDividers
 import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.viewModel.UserSwitcherViewModel
 
+data class UserSwitcherNav(
+    val backToSettings: BackNavigation,
+    val onNavigateHome: () -> Unit,
+    val onNavigateCustomControl: () -> Unit,
+    val onNavigateToAuthKey: () -> Unit
+)
+
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
-fun UserSwitcherView(
-    nav: BackNavigation,
-    onNavigateHome: () -> Unit,
-    viewModel: UserSwitcherViewModel = viewModel()
-) {
+fun UserSwitcherView(nav: UserSwitcherNav, viewModel: UserSwitcherViewModel = viewModel()) {
 
-  val users = viewModel.loginProfiles.collectAsState().value
-  val currentUser = viewModel.loggedInUser.collectAsState().value
-  val showHeaderMenu = viewModel.showHeaderMenu.collectAsState().value
+  val users by viewModel.loginProfiles.collectAsState()
+  val currentUser by viewModel.loggedInUser.collectAsState()
+  val showHeaderMenu by viewModel.showHeaderMenu.collectAsState()
 
   Scaffold(
       topBar = {
         Header(
             R.string.accounts,
-            onBack = nav.onBack,
+            onBack = nav.backToSettings,
             actions = {
               Row {
-                FusMenu(viewModel = viewModel)
+                FusMenu(
+                    viewModel = viewModel,
+                    onAuthKeyClick = nav.onNavigateToAuthKey,
+                    onCustomClick = nav.onNavigateCustomControl)
                 IconButton(onClick = { viewModel.showHeaderMenu.set(!showHeaderMenu) }) {
                   Icon(Icons.Default.MoreVert, "menu")
                 }
@@ -69,7 +71,7 @@ fun UserSwitcherView(
         Column(
             modifier = Modifier.padding(innerPadding).fillMaxWidth(),
             verticalArrangement = Arrangement.spacedBy(8.dp)) {
-              val showErrorDialog = viewModel.errorDialog.collectAsState().value
+              val showErrorDialog by viewModel.errorDialog.collectAsState()
 
               // Show the error overlay if need be
               showErrorDialog?.let {
@@ -102,7 +104,7 @@ fun UserSwitcherView(
                               viewModel.errorDialog.set(ErrorDialogType.LOGOUT_FAILED)
                               nextUserId.value = null
                             } else {
-                              onNavigateHome()
+                              nav.onNavigateHome()
                             }
                           }
                         })
@@ -120,7 +122,7 @@ fun UserSwitcherView(
                   }
 
                   Lists.ItemDivider()
-                  Setting.Text(R.string.reauthenticate) { viewModel.login {} }
+                  Setting.Text(R.string.reauthenticate) { viewModel.login() }
 
                   if (currentUser != null) {
                     Lists.ItemDivider()
@@ -129,9 +131,10 @@ fun UserSwitcherView(
                         destructive = true,
                         onClick = {
                           viewModel.logout {
-                            if (it.isFailure) {
-                              viewModel.errorDialog.set(ErrorDialogType.LOGOUT_FAILED)
-                            }
+                            it.onSuccess { nav.onNavigateHome() }
+                                .onFailure {
+                                  viewModel.errorDialog.set(ErrorDialogType.LOGOUT_FAILED)
+                                }
                           }
                         })
                   }
@@ -142,50 +145,49 @@ fun UserSwitcherView(
 }
 
 @Composable
-fun FusMenu(viewModel: UserSwitcherViewModel) {
-  var url by remember { mutableStateOf("") }
-  val expanded = viewModel.showHeaderMenu.collectAsState().value
+fun FusMenu(
+    onCustomClick: () -> Unit,
+    onAuthKeyClick: () -> Unit,
+    viewModel: UserSwitcherViewModel
+) {
+  val expanded by viewModel.showHeaderMenu.collectAsState()
 
   DropdownMenu(
       expanded = expanded,
-      onDismissRequest = {
-        url = ""
-        viewModel.showHeaderMenu.set(false)
-      },
+      onDismissRequest = { viewModel.showHeaderMenu.set(false) },
       modifier = Modifier.background(MaterialTheme.colorScheme.surfaceContainer)) {
-        DropdownMenuItem(
-            onClick = {},
-            text = {
-              Column {
-                Text(
-                    stringResource(id = R.string.custom_control_menu),
-                    style = MaterialTheme.typography.titleMedium)
-                Spacer(modifier = Modifier.padding(2.dp))
-                Text(
-                    stringResource(id = R.string.custom_control_menu_desc),
-                    style = MaterialTheme.typography.bodySmall)
-                Spacer(modifier = Modifier.padding(8.dp))
-
-                OutlinedTextField(
-                    colors =
-                        TextFieldDefaults.colors(
-                            focusedContainerColor = Color.Transparent,
-                            unfocusedContainerColor = Color.Transparent),
-                    textStyle = MaterialTheme.typography.bodyMedium,
-                    value = url,
-                    onValueChange = { url = it },
-                    placeholder = {
-                      Text(
-                          stringResource(id = R.string.custom_control_placeholder),
-                          style = MaterialTheme.typography.bodySmall)
-                    })
-
-                Spacer(modifier = Modifier.padding(8.dp))
-
-                PrimaryActionButton(onClick = { viewModel.setControlURL(url) }) {
-                  Text(stringResource(id = R.string.add_account_short))
-                }
-              }
-            })
+        MenuItem(
+            onClick = {
+              onCustomClick()
+              viewModel.showHeaderMenu.set(false)
+            },
+            text = stringResource(id = R.string.custom_control_menu))
+        MenuItem(
+            onClick = {
+              onAuthKeyClick()
+              viewModel.showHeaderMenu.set(false)
+            },
+            text = stringResource(id = R.string.auth_key_menu))
       }
 }
+
+@Composable
+fun MenuItem(text: String, onClick: () -> Unit) {
+  DropdownMenuItem(
+      modifier = Modifier.padding(horizontal = 8.dp, vertical = 0.dp),
+      onClick = onClick,
+      text = { Text(text = text) })
+}
+
+@Composable
+@Preview
+fun UserSwitcherViewPreview() {
+  val vm = UserSwitcherViewModel()
+  val nav =
+      UserSwitcherNav(
+          backToSettings = {},
+          onNavigateHome = {},
+          onNavigateCustomControl = {},
+          onNavigateToAuthKey = {})
+  UserSwitcherView(nav, vm)
+}

android/src/main/java/com/tailscale/ipn/ui/view/UserView.kt

@@ -5,13 +5,20 @@ package com.tailscale.ipn.ui.view
 
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.offset
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.KeyboardArrowRight
+import androidx.compose.material3.Icon
 import androidx.compose.material3.ListItem
+import androidx.compose.material3.ListItemColors
+import androidx.compose.material3.ListItemDefaults
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
 import com.tailscale.ipn.R
 import com.tailscale.ipn.ui.model.IpnLocal
 import com.tailscale.ipn.ui.theme.minTextSize
@@ -33,13 +40,17 @@ enum class UserActionState {
 @Composable
 fun UserView(
     profile: IpnLocal.LoginProfile?,
-    onClick: () -> Unit = {},
-    actionState: UserActionState = UserActionState.NONE
+    onClick: (() -> Unit)? = null,
+    colors: ListItemColors = ListItemDefaults.colors(),
+    actionState: UserActionState = UserActionState.NONE,
 ) {
   Box {
+    var modifier: Modifier = Modifier
+    onClick?.let { modifier = modifier.clickable { it() } }
     profile?.let {
       ListItem(
-          modifier = Modifier.clickable { onClick() },
+          modifier = modifier,
+          colors = colors,
           leadingContent = { Avatar(profile = profile, size = 36) },
           headlineContent = {
             AutoResizingText(
@@ -59,14 +70,17 @@ fun UserView(
             when (actionState) {
               UserActionState.CURRENT -> CheckedIndicator()
               UserActionState.SWITCHING -> SimpleActivityIndicator(size = 26)
-              UserActionState.NAV -> Unit
+              UserActionState.NAV ->
+                  Icon(
+                      Icons.AutoMirrored.Filled.KeyboardArrowRight, null, Modifier.offset(x = 6.dp))
               UserActionState.NONE -> Unit
             }
           })
     }
         ?: run {
           ListItem(
-              modifier = Modifier.clickable { onClick() },
+              modifier = modifier,
+              colors = colors,
               headlineContent = {
                 Text(
                     text = stringResource(id = R.string.accounts),

android/src/main/java/com/tailscale/ipn/ui/viewModel/BugReportViewModel.kt

@@ -15,7 +15,9 @@ class BugReportViewModel : ViewModel() {
 
   init {
     Client(viewModelScope).bugReportId { result ->
-      result.onSuccess { bugReportID.set(it) }.onFailure { bugReportID.set("(Error fetching ID)") }
+      result
+          .onSuccess { bugReportID.set(it.trim()) }
+          .onFailure { bugReportID.set("(Error fetching ID)") }
     }
   }
 }

android/src/main/java/com/tailscale/ipn/ui/viewModel/CustomLoginViewModel.kt

@@ -0,0 +1,52 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn.ui.viewModel
+
+import com.tailscale.ipn.ui.util.set
+import com.tailscale.ipn.ui.view.ErrorDialogType
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+
+const val AUTH_KEY_LENGTH = 16
+
+open class CustomLoginViewModel : IpnViewModel() {
+  val errorDialog: StateFlow<ErrorDialogType?> = MutableStateFlow(null)
+}
+
+class LoginWithAuthKeyViewModel : CustomLoginViewModel() {
+  // Sets the auth key and invokes the login flow
+  fun setAuthKey(authKey: String, onSuccess: () -> Unit) {
+    // The most basic of checks for auth key syntax
+    if (authKey.isEmpty()) {
+      errorDialog.set(ErrorDialogType.INVALID_AUTH_KEY)
+      return
+    }
+    loginWithAuthKey(authKey) {
+      it.onFailure { errorDialog.set(ErrorDialogType.ADD_PROFILE_FAILED) }
+      it.onSuccess { onSuccess() }
+    }
+  }
+}
+
+class LoginWithCustomControlURLViewModel : CustomLoginViewModel() {
+  // Sets the custom control URL and invokes the login flow
+  fun setControlURL(urlStr: String, onSuccess: () -> Unit) {
+    // Some basic checks that the entered URL is "reasonable".  The underlying
+    // localAPIClient will use the default server if we give it a broken URL,
+    // but we can make sure we can construct a URL from the input string and
+    // ensure it has an http/https scheme
+    when (urlStr.startsWith("http") && urlStr.contains("://") && urlStr.length > 7) {
+      false -> {
+        errorDialog.set(ErrorDialogType.INVALID_CUSTOM_URL)
+        return
+      }
+      true -> {
+        loginWithCustomControlURL(urlStr) {
+          it.onFailure { errorDialog.set(ErrorDialogType.ADD_PROFILE_FAILED) }
+          it.onSuccess { onSuccess() }
+        }
+      }
+    }
+  }
+}

android/src/main/java/com/tailscale/ipn/ui/viewModel/ExitNodePickerViewModel.kt

@@ -20,10 +20,10 @@ import kotlinx.coroutines.launch
 import java.util.TreeMap
 
 data class ExitNodePickerNav(
-    val onNavigateHome: () -> Unit,
-    val onNavigateBack: () -> Unit,
-    val onNavigateToExitNodePicker: () -> Unit,
+    val onNavigateBackHome: () -> Unit,
+    val onNavigateBackToExitNodes: () -> Unit,
     val onNavigateToMullvad: () -> Unit,
+    val onNavigateBackToMullvad: () -> Unit,
     val onNavigateToMullvadCountry: (String) -> Unit,
     val onNavigateToRunAsExitNode: () -> Unit,
 )
@@ -63,7 +63,7 @@ class ExitNodePickerViewModel(private val nav: ExitNodePickerNav) : IpnViewModel
           .stateIn(viewModelScope)
           .collect { (netmap, prefs) ->
             isRunningExitNode.set(prefs?.let { AdvertisedRoutesHelper.exitNodeOnFromPrefs(it) })
-            val exitNodeId = prefs?.ExitNodeID
+            val exitNodeId = prefs?.activeExitNodeID ?: prefs?.selectedExitNodeID
             netmap?.Peers?.let { peers ->
               val allNodes =
                   peers
@@ -137,8 +137,9 @@ class ExitNodePickerViewModel(private val nav: ExitNodePickerNav) : IpnViewModel
     LoadingIndicator.start()
     val prefsOut = Ipn.MaskedPrefs()
     prefsOut.ExitNodeID = node.id
+
     Client(viewModelScope).editPrefs(prefsOut) {
-      nav.onNavigateHome()
+      nav.onNavigateBackHome()
       LoadingIndicator.stop()
     }
   }

android/src/main/java/com/tailscale/ipn/ui/viewModel/IpnViewModel.kt

@@ -3,20 +3,20 @@
 
 package com.tailscale.ipn.ui.viewModel
 
-import android.app.Activity
-import android.content.Context
-import android.content.ContextWrapper
-import android.content.Intent
+import android.net.VpnService
 import android.util.Log
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.tailscale.ipn.App
-import com.tailscale.ipn.IPNReceiver
+import com.tailscale.ipn.UninitializedApp
+import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.localapi.Client
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.model.IpnLocal
 import com.tailscale.ipn.ui.model.UserID
 import com.tailscale.ipn.ui.notifier.Notifier
+import com.tailscale.ipn.ui.notifier.Notifier.prefs
+import com.tailscale.ipn.ui.util.LoadingIndicator
 import com.tailscale.ipn.ui.util.set
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -31,11 +31,23 @@ open class IpnViewModel : ViewModel() {
 
   val loggedInUser: StateFlow<IpnLocal.LoginProfile?> = MutableStateFlow(null)
   val loginProfiles: StateFlow<List<IpnLocal.LoginProfile>?> = MutableStateFlow(null)
+  private val _vpnPrepared = MutableStateFlow(false)
+  val vpnPrepared: StateFlow<Boolean> = _vpnPrepared
 
   // The userId associated with the current node. ie: The logged in user.
   private var selfNodeUserId: UserID? = null
 
   init {
+    // Check if the user has granted permission yet.
+    if (!vpnPrepared.value) {
+      val vpnIntent = VpnService.prepare(App.get())
+      if (vpnIntent != null) {
+        setVpnPrepared(false)
+      } else {
+        setVpnPrepared(true)
+      }
+    }
+
     viewModelScope.launch {
       Notifier.state.collect {
         // Reload the user profiles on all state transitions to ensure loggedInUser is correct
@@ -60,55 +72,82 @@ open class IpnViewModel : ViewModel() {
     Log.d(TAG, "Created")
   }
 
-  protected fun Context.findActivity(): Activity? =
-      when (this) {
-        is Activity -> this
-        is ContextWrapper -> baseContext.findActivity()
-        else -> null
+  // VPN Control
+  fun setVpnPrepared(prepared: Boolean) {
+    _vpnPrepared.value = prepared
+  }
+
+  fun startVPN() {
+    UninitializedApp.get().startVPN()
+  }
+
+  fun stopVPN() {
+    UninitializedApp.get().stopVPN()
+  }
+
+  // Login/Logout
+
+  fun login(
+      maskedPrefs: Ipn.MaskedPrefs? = null,
+      authKey: String? = null,
+      completionHandler: (Result<Unit>) -> Unit = {}
+  ) {
+
+    val loginAction = {
+      Client(viewModelScope).startLoginInteractive { result ->
+        result
+            .onSuccess { Log.d(TAG, "Login started: $it") }
+            .onFailure { Log.e(TAG, "Error starting login: ${it.message}") }
+        completionHandler(result)
       }
+    }
 
-  private fun loadUserProfiles() {
-    Client(viewModelScope).profiles { result ->
-      result.onSuccess(loginProfiles::set).onFailure {
-        Log.e(TAG, "Error loading profiles: ${it.message}")
+    // Need to stop running before logging in to clear routes:
+    // https://linear.app/tailscale/issue/ENG-3441/routesdns-is-not-cleared-when-switching-profiles-or-reauthenticating
+    val stopThenLogin = {
+      Client(viewModelScope).editPrefs(Ipn.MaskedPrefs().apply { WantRunning = false }) { result ->
+        result
+            .onSuccess { loginAction() }
+            .onFailure { Log.e(TAG, "Error setting wantRunning to false: ${it.message}") }
       }
     }
 
-    Client(viewModelScope).currentProfile { result ->
-      result
-          .onSuccess { loggedInUser.set(if (it.isEmpty()) null else it) }
-          .onFailure { Log.e(TAG, "Error loading current profile: ${it.message}") }
+    val startAction = {
+      Client(viewModelScope).start(Ipn.Options(AuthKey = authKey)) { start ->
+        start.onFailure { completionHandler(Result.failure(it)) }.onSuccess { stopThenLogin() }
+      }
     }
-  }
 
-  fun toggleVpn() {
-    when (Notifier.state.value) {
-      Ipn.State.Running -> stopVPN()
-      else -> startVPN()
+    // If an MDM control URL is set, we will always use that in lieu of anything the user sets.
+    var prefs = maskedPrefs
+    val mdmControlURL = MDMSettings.loginURL.flow.value
+
+    if (mdmControlURL != null) {
+      prefs = prefs ?: Ipn.MaskedPrefs()
+      prefs.ControlURL = mdmControlURL
+      Log.d(TAG, "Overriding control URL with MDM value: $mdmControlURL")
     }
-  }
 
-  fun startVPN() {
-    val context = App.getApplication().applicationContext
-    val intent = Intent(context, IPNReceiver::class.java)
-    intent.action = IPNReceiver.INTENT_CONNECT_VPN
-    context.sendBroadcast(intent)
+    prefs?.let {
+      Client(viewModelScope).editPrefs(it) { result ->
+        result.onFailure { completionHandler(Result.failure(it)) }.onSuccess { startAction() }
+      }
+    } ?: run { startAction() }
   }
 
-  fun stopVPN() {
-    val context = App.getApplication().applicationContext
-    val intent = Intent(context, IPNReceiver::class.java)
-    intent.action = IPNReceiver.INTENT_DISCONNECT_VPN
-    context.sendBroadcast(intent)
+  fun loginWithAuthKey(authKey: String, completionHandler: (Result<Unit>) -> Unit = {}) {
+    val prefs = Ipn.MaskedPrefs()
+    prefs.WantRunning = true
+    login(prefs, authKey = authKey, completionHandler)
   }
 
-  fun login(completionHandler: (Result<Unit>) -> Unit = {}) {
-    Client(viewModelScope).startLoginInteractive { result ->
-      result
-          .onSuccess { Log.d(TAG, "Login started: $it") }
-          .onFailure { Log.e(TAG, "Error starting login: ${it.message}") }
-      completionHandler(result)
-    }
+  fun loginWithCustomControlURL(
+      controlURL: String,
+      completionHandler: (Result<Unit>) -> Unit = {}
+  ) {
+    val prefs = Ipn.MaskedPrefs()
+    prefs.ControlURL = controlURL
+    login(prefs, completionHandler = completionHandler)
   }
 
   fun logout(completionHandler: (Result<String>) -> Unit = {}) {
@@ -120,17 +159,40 @@ open class IpnViewModel : ViewModel() {
     }
   }
 
+  // User Profiles
+
+  private fun loadUserProfiles() {
+    Client(viewModelScope).profiles { result ->
+      result.onSuccess(loginProfiles::set).onFailure {
+        Log.e(TAG, "Error loading profiles: ${it.message}")
+      }
+    }
+
+    Client(viewModelScope).currentProfile { result ->
+      result
+          .onSuccess { loggedInUser.set(if (it.isEmpty()) null else it) }
+          .onFailure { Log.e(TAG, "Error loading current profile: ${it.message}") }
+    }
+  }
+
   fun switchProfile(profile: IpnLocal.LoginProfile, completionHandler: (Result<String>) -> Unit) {
-    Client(viewModelScope).switchProfile(profile) {
-      startVPN()
-      completionHandler(it)
+    val switchProfile = {
+      Client(viewModelScope).switchProfile(profile) {
+        startVPN()
+        completionHandler(it)
+      }
+    }
+    Client(viewModelScope).editPrefs(Ipn.MaskedPrefs().apply { WantRunning = false }) { result ->
+      result
+          .onSuccess { switchProfile() }
+          .onFailure { Log.e(TAG, "Error setting wantRunning to false: ${it.message}") }
     }
   }
 
   fun addProfile(completionHandler: (Result<String>) -> Unit) {
     Client(viewModelScope).addProfile {
       if (it.isSuccess) {
-        login {}
+        login()
       }
       startVPN()
       completionHandler(it)
@@ -144,51 +206,21 @@ open class IpnViewModel : ViewModel() {
     }
   }
 
-  // The below handle all types of preference modifications typically invoked by the UI.
-  // Callers generally shouldn't care about the returned prefs value - the source of
-  // truth is the IPNModel, who's prefs flow will change in value to reflect the true
-  // value of the pref setting in the back end (and will match the value returned here).
-  // Generally, you will want to inspect the returned value in the callback for errors
-  // to indicate why a particular setting did not change in the interface.
-  //
-  // Usage:
-  // - User/Interface changed to new value.  Render the new value.
-  // - Submit the new value to the PrefsEditor
-  // - Observe the prefs on the IpnModel and update the UI when/if the value changes.
-  //   For a typical flow, the changed value should reflect the value already shown.
-  // - Inform the user of any error which may have occurred
-  //
-  // The "toggle' functions here will attempt to set the pref value to the inverse of
-  // what is currently known in the IpnModel.prefs.  If IpnModel.prefs is not available,
-  // the callback will be called with a NO_PREFS error
-  fun setWantRunning(wantRunning: Boolean, callback: (Result<Ipn.Prefs>) -> Unit) {
-    Ipn.MaskedPrefs().WantRunning = wantRunning
-    Client(viewModelScope).editPrefs(Ipn.MaskedPrefs(), callback)
-  }
-
-  fun toggleShieldsUp(callback: (Result<Ipn.Prefs>) -> Unit) {
-    val prefs =
-        Notifier.prefs.value
-            ?: run {
-              callback(Result.failure(Exception("no prefs")))
-              return@toggleShieldsUp
-            }
-
-    val prefsOut = Ipn.MaskedPrefs()
-    prefsOut.ShieldsUp = !prefs.ShieldsUp
-    Client(viewModelScope).editPrefs(prefsOut, callback)
-  }
-
-  fun toggleRouteAll(callback: (Result<Ipn.Prefs>) -> Unit) {
-    val prefs =
-        Notifier.prefs.value
-            ?: run {
-              callback(Result.failure(Exception("no prefs")))
-              return@toggleRouteAll
-            }
-
-    val prefsOut = Ipn.MaskedPrefs()
-    prefsOut.RouteAll = !prefs.RouteAll
-    Client(viewModelScope).editPrefs(prefsOut, callback)
+  // Exit Node Manipulation
+
+  fun toggleExitNode() {
+    val prefs = prefs.value ?: return
+
+    LoadingIndicator.start()
+    if (prefs.activeExitNodeID != null) {
+      // We have an active exit node so we should keep it, but disable it
+      Client(viewModelScope).setUseExitNode(false) { LoadingIndicator.stop() }
+    } else if (prefs.selectedExitNodeID != null) {
+      // We have a prior exit node to enable
+      Client(viewModelScope).setUseExitNode(true) { LoadingIndicator.stop() }
+    } else {
+      // This should not be possible.  In this state the button is hidden
+      Log.e(TAG, "No exit node to disable and no prior exit node to enable")
+    }
   }
 }

android/src/main/java/com/tailscale/ipn/ui/viewModel/LoginQRViewModel.kt

@@ -0,0 +1,62 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package com.tailscale.ipn.ui.viewModel
+
+import android.graphics.Bitmap
+import android.graphics.Color
+import androidx.compose.ui.graphics.ImageBitmap
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.lifecycle.viewModelScope
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.EncodeHintType
+import com.google.zxing.WriterException
+import com.google.zxing.qrcode.QRCodeWriter
+import com.tailscale.ipn.ui.notifier.Notifier
+import com.tailscale.ipn.ui.util.set
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.launch
+
+class LoginQRViewModel : IpnViewModel() {
+
+  val qrCode: StateFlow<ImageBitmap?> = MutableStateFlow(null)
+
+  init {
+    viewModelScope.launch {
+      Notifier.browseToURL.collect { url ->
+        url?.let { qrCode.set(generateQRCode(url, 200, 0)) } ?: run { qrCode.set(null) }
+      }
+    }
+  }
+
+  fun generateQRCode(content: String, size: Int, padding: Int): ImageBitmap? {
+    val qrCodeWriter = QRCodeWriter()
+
+    val encodeHints = mapOf<EncodeHintType, Any?>(EncodeHintType.MARGIN to padding)
+
+    val bitmapMatrix =
+        try {
+          qrCodeWriter.encode(content, BarcodeFormat.QR_CODE, size, size, encodeHints)
+        } catch (ex: WriterException) {
+          return null
+        }
+
+    val qrCode =
+        Bitmap.createBitmap(
+            size,
+            size,
+            Bitmap.Config.ARGB_8888,
+        )
+
+    for (x in 0 until size) {
+      for (y in 0 until size) {
+        val shouldColorPixel = bitmapMatrix?.get(x, y) ?: false
+        val pixelColor = if (shouldColorPixel) Color.BLACK else Color.WHITE
+        qrCode.setPixel(x, y, pixelColor)
+      }
+    }
+
+    return qrCode.asImageBitmap()
+  }
+}

android/src/main/java/com/tailscale/ipn/ui/viewModel/MainViewModel.kt

@@ -3,27 +3,38 @@
 
 package com.tailscale.ipn.ui.viewModel
 
+import android.content.Intent
+import android.net.VpnService
+import android.util.Log
+import androidx.activity.result.ActivityResultLauncher
 import androidx.lifecycle.viewModelScope
+import com.tailscale.ipn.App
 import com.tailscale.ipn.R
-import com.tailscale.ipn.ui.localapi.Client
+import com.tailscale.ipn.mdm.MDMSettings
 import com.tailscale.ipn.ui.model.Ipn
 import com.tailscale.ipn.ui.model.Ipn.State
 import com.tailscale.ipn.ui.notifier.Notifier
-import com.tailscale.ipn.ui.util.LoadingIndicator
 import com.tailscale.ipn.ui.util.PeerCategorizer
 import com.tailscale.ipn.ui.util.PeerSet
+import com.tailscale.ipn.ui.util.TimeUtil
 import com.tailscale.ipn.ui.util.set
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.launch
+import java.time.Duration
 
 class MainViewModel : IpnViewModel() {
 
   // The user readable state of the system
-  val stateRes: StateFlow<Int> = MutableStateFlow(State.NoState.userStringRes())
+  val stateRes: StateFlow<Int> = MutableStateFlow(userStringRes(State.NoState, State.NoState, true))
 
   // The expected state of the VPN toggle
-  val vpnToggleState: StateFlow<Boolean> = MutableStateFlow(false)
+  private val _vpnToggleState = MutableStateFlow(false)
+  val vpnToggleState: StateFlow<Boolean> = _vpnToggleState
+
+  // Permission to prepare VPN
+  private var vpnPermissionLauncher: ActivityResultLauncher<Intent>? = null
 
   // The list of peers
   val peers: StateFlow<List<PeerSet>> = MutableStateFlow(emptyList<PeerSet>())
@@ -37,15 +48,29 @@ class MainViewModel : IpnViewModel() {
   // The active search term for filtering peers
   val searchTerm: StateFlow<String> = MutableStateFlow("")
 
+  // True if we should render the key expiry bannder
+  val showExpiry: StateFlow<Boolean> = MutableStateFlow(false)
+
   private val peerCategorizer = PeerCategorizer()
 
   init {
     viewModelScope.launch {
-      Notifier.state.collect { state ->
-        stateRes.set(state.userStringRes())
-        vpnToggleState.set(
-            (state == State.Running || state == State.Starting || state == State.NoState))
-      }
+      var previousState: State? = null
+
+      combine(Notifier.state, vpnPrepared) { state, prepared -> state to prepared }
+          .collect { (currentState, prepared) ->
+            stateRes.set(userStringRes(currentState, previousState, prepared))
+
+            val isOn =
+                when {
+                  currentState == State.Running || currentState == State.Starting -> true
+                  previousState == State.NoState && currentState == State.Starting -> true
+                  else -> false
+                }
+
+            _vpnToggleState.value = isOn
+            previousState = currentState
+          }
     }
 
     viewModelScope.launch {
@@ -53,6 +78,18 @@ class MainViewModel : IpnViewModel() {
         it?.let { netmap ->
           peerCategorizer.regenerateGroupedPeers(netmap)
           peers.set(peerCategorizer.groupedAndFilteredPeers(searchTerm.value))
+
+          if (netmap.SelfNode.keyDoesNotExpire) {
+            showExpiry.set(false)
+            return@let
+          } else {
+            val expiryNotificationWindowMDM = MDMSettings.keyExpirationNotice.flow.value
+            val window =
+                expiryNotificationWindowMDM?.let { TimeUtil.duration(it) } ?: Duration.ofHours(24)
+            val expiresSoon =
+                TimeUtil.isWithinExpiryNotificationWindow(window, it.SelfNode.KeyExpiry)
+            showExpiry.set(expiresSoon)
+          }
         }
       }
     }
@@ -60,29 +97,53 @@ class MainViewModel : IpnViewModel() {
     viewModelScope.launch {
       searchTerm.collect { term -> peers.set(peerCategorizer.groupedAndFilteredPeers(term)) }
     }
+
+    viewModelScope.launch {
+      Notifier.prefs.collect { prefs -> Log.d(TAG, "Main VM - prefs = ${prefs}") }
+    }
+  }
+
+  fun showVPNPermissionLauncherIfUnauthorized() {
+    val vpnIntent = VpnService.prepare(App.get())
+    if (vpnIntent != null) {
+      vpnPermissionLauncher?.launch(vpnIntent)
+    } else {
+      setVpnPrepared(true)
+    }
+  }
+
+  fun toggleVpn() {
+    val state = Notifier.state.value
+    val isPrepared = vpnPrepared.value
+
+    when {
+      !isPrepared -> showVPNPermissionLauncherIfUnauthorized()
+      state == Ipn.State.Running -> stopVPN()
+      else -> startVPN()
+    }
   }
 
   fun searchPeers(searchTerm: String) {
     this.searchTerm.set(searchTerm)
   }
 
-  fun disableExitNode() {
-    LoadingIndicator.start()
-    val prefsOut = Ipn.MaskedPrefs()
-    prefsOut.ExitNodeID = null
-    Client(viewModelScope).editPrefs(prefsOut) { LoadingIndicator.stop() }
+  fun setVpnPermissionLauncher(launcher: ActivityResultLauncher<Intent>) {
+    // No intent means we're already authorized
+    vpnPermissionLauncher = launcher
   }
 }
 
-private fun State?.userStringRes(): Int {
-  return when (this) {
-    State.NoState -> R.string.waiting
-    State.InUseOtherUser -> R.string.placeholder
-    State.NeedsLogin -> R.string.please_login
-    State.NeedsMachineAuth -> R.string.placeholder
-    State.Stopped -> R.string.stopped
-    State.Starting -> R.string.starting
-    State.Running -> R.string.connected
+private fun userStringRes(currentState: State?, previousState: State?, vpnPrepared: Boolean): Int {
+  return when {
+    previousState == State.NoState && currentState == State.Starting -> R.string.starting
+    currentState == State.NoState -> R.string.placeholder
+    currentState == State.InUseOtherUser -> R.string.placeholder
+    currentState == State.NeedsLogin ->
+        if (vpnPrepared) R.string.please_login else R.string.connect_to_vpn
+    currentState == State.NeedsMachineAuth -> R.string.needs_machine_auth
+    currentState == State.Stopped -> R.string.stopped
+    currentState == State.Starting -> R.string.starting
+    currentState == State.Running -> R.string.connected
     else -> R.string.placeholder
   }
 }

android/src/main/java/com/tailscale/ipn/ui/viewModel/SettingsViewModel.kt

@@ -5,7 +5,9 @@ package com.tailscale.ipn.ui.viewModel
 
 import androidx.lifecycle.viewModelScope
 import com.tailscale.ipn.mdm.MDMSettings
+import com.tailscale.ipn.ui.localapi.Client
 import com.tailscale.ipn.ui.notifier.Notifier
+import com.tailscale.ipn.ui.util.LoadingIndicator
 import com.tailscale.ipn.ui.util.set
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -20,17 +22,38 @@ data class SettingsNav(
     val onNavigateToManagedBy: () -> Unit,
     val onNavigateToUserSwitcher: () -> Unit,
     val onNavigateToPermissions: () -> Unit,
-    val onBackPressed: () -> Unit,
+    val onNavigateBackHome: () -> Unit,
+    val onBackToSettings: () -> Unit,
 )
 
-class SettingsViewModel() : IpnViewModel() {
+class SettingsViewModel : IpnViewModel() {
   // Display name for the logged in user
   val isAdmin: StateFlow<Boolean> = MutableStateFlow(false)
   val managedByOrganization = MDMSettings.managedByOrganizationName.flow
+  // True if tailnet lock is enabled.  nil if not yet known.
+  val tailNetLockEnabled: StateFlow<Boolean?> = MutableStateFlow(null)
+  // True if tailscaleDNS is enabled. nil if not yet known.
+  val corpDNSEnabled: StateFlow<Boolean?> = MutableStateFlow(null)
 
   init {
     viewModelScope.launch {
       Notifier.netmap.collect { netmap -> isAdmin.set(netmap?.SelfNode?.isAdmin ?: false) }
     }
+
+    Client(viewModelScope).tailnetLockStatus { result ->
+      result.onSuccess { status -> tailNetLockEnabled.set(status.Enabled) }
+
+      LoadingIndicator.stop()
+    }
+
+    viewModelScope.launch {
+      Notifier.prefs.collect {
+        it?.let {
+          corpDNSEnabled.set(it.CorpDNS)
+        } ?: run {
+          corpDNSEnabled.set(null)
+        }
+      }
+    }
   }
 }

android/src/main/java/com/tailscale/ipn/ui/viewModel/TaildropViewModel.kt

@@ -153,7 +153,7 @@ class TaildropViewModel(
   fun TrailingContentForPeer(peerId: String) {
     // Check our outgoing files for the peer and determine the state of the transfer.
     val transfers = this.transfers.collectAsState().value.filter { it.PeerID == peerId }
-    var status: TransferState = transferState(transfers) ?: return
+    val status: TransferState = transferState(transfers) ?: return
 
     // Still no status? Nothing to render for this peer
 

android/src/main/java/com/tailscale/ipn/ui/viewModel/UserSwitcherViewModel.kt

@@ -3,11 +3,6 @@
 
 package com.tailscale.ipn.ui.viewModel
 
-import androidx.lifecycle.viewModelScope
-import com.tailscale.ipn.ui.localapi.Client
-import com.tailscale.ipn.ui.model.Ipn
-import com.tailscale.ipn.ui.notifier.Notifier
-import com.tailscale.ipn.ui.util.set
 import com.tailscale.ipn.ui.view.ErrorDialogType
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -19,49 +14,4 @@ class UserSwitcherViewModel : IpnViewModel() {
 
   // True if we should render the kebab menu
   val showHeaderMenu: StateFlow<Boolean> = MutableStateFlow(false)
-
-  // Sets the custom control URL and immediatly invokes the login flow
-  fun setControlURL(urlStr: String) {
-    // Some basic checks that the entered URL is "reasonable".  The underlying
-    // localAPIClient will use the default server if we give it a broken URL,
-    // but we can make sure we can construct a URL from the input string and
-    // ensure it has an http/https scheme
-
-    when (urlStr.startsWith("http") && urlStr.contains("://") && urlStr.length > 7) {
-      false -> errorDialog.set(ErrorDialogType.INVALID_CUSTOM_URL)
-      true -> {
-        showHeaderMenu.set(false)
-
-        // We need to have the current prefs to set them back with the new control URL
-        val prefs = Notifier.prefs.value
-        if (prefs == null) {
-          errorDialog.set(ErrorDialogType.ADD_PROFILE_FAILED)
-          return
-        }
-
-        // The basic flow for logging in with a custom control URL is to add a profile,
-        // call start with prefs that include the control URL pref, then
-        // start an interactive login.
-
-        val fail: (Throwable) -> Unit = { errorDialog.set(ErrorDialogType.ADD_PROFILE_FAILED) }
-
-        val login = {
-          Client(viewModelScope).startLoginInteractive { startLogin -> startLogin.onFailure(fail) }
-        }
-
-        val start = {
-          prefs.ControlURL = urlStr
-          val options = Ipn.Options(Prefs = prefs)
-
-          Client(viewModelScope).start(options) { start ->
-            start.onFailure(fail).onSuccess { login() }
-          }
-        }
-
-        Client(viewModelScope).addProfile { addProfile ->
-          addProfile.onFailure(fail).onSuccess { start() }
-        }
-      }
-    }
-  }
 }

android/src/main/res/drawable/androidicon.xml

@@ -1,41 +0,0 @@
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="200dp"
-    android:height="200dp"
-    android:viewportWidth="200"
-    android:viewportHeight="200">
-  <path
-      android:pathData="M0,0h200v200h-200z"
-      android:fillColor="#1F1E1E"/>
-  <path
-      android:pathData="M50,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"
-      android:fillAlpha="0.4"/>
-  <path
-      android:pathData="M87.5,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"
-      android:fillAlpha="0.4"/>
-  <path
-      android:pathData="M125,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"
-      android:fillAlpha="0.4"/>
-  <path
-      android:pathData="M50,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"/>
-  <path
-      android:pathData="M87.5,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"/>
-  <path
-      android:pathData="M125,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"/>
-  <path
-      android:pathData="M50,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"
-      android:fillAlpha="0.4"/>
-  <path
-      android:pathData="M87.5,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"/>
-  <path
-      android:pathData="M125,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#ffffff"
-      android:fillAlpha="0.4"/>
-</vector>

android/src/main/res/drawable/androidicon_light.xml

@@ -1,34 +0,0 @@
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="200dp"
-    android:height="200dp"
-    android:viewportWidth="200"
-    android:viewportHeight="200">
-
-  <path
-      android:pathData="M50,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#cccccc"/>
-  <path
-      android:pathData="M87.5,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#cccccc"/>
-  <path
-      android:pathData="M125,62.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#cccccc"/>
-  <path
-      android:pathData="M50,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#222222"/>
-  <path
-      android:pathData="M87.5,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#222222"/>
-  <path
-      android:pathData="M125,100a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#222222"/>
-  <path
-      android:pathData="M50,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#cccccc"/>
-  <path
-      android:pathData="M87.5,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#222222"/>
-  <path
-      android:pathData="M125,137.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
-      android:fillColor="#cccccc"/>
-</vector>

android/src/main/res/drawable/ic_launcher_foreground.xml

@@ -1,36 +1,38 @@
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="108dp"
     android:height="108dp"
-    android:viewportWidth="100"
-    android:viewportHeight="100">
-  <group android:translateX="20"
-      android:translateY="20">
-    <path
-        android:pathData="M15,30.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#FFFDFA"/>
-    <path
-        android:pathData="M30,30.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#FFFDFA"/>
-    <path
-        android:pathData="M15,45.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#54514D"/>
-    <path
-        android:pathData="M45,45.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#54514D"/>
-    <path
-        android:pathData="M30,45.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#FFFDFA"/>
-    <path
-        android:pathData="M45,30.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#FFFDFA"/>
-    <path
-        android:pathData="M15,15.0002m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#54514D"/>
-    <path
-        android:pathData="M30,14.9999m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#54514D"/>
-    <path
-        android:pathData="M45,14.9999m-5,0a5,5 0,1 1,10 0a5,5 0,1 1,-10 0"
-        android:fillColor="#54514D"/>
-  </group>
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+  <path
+      android:pathData="M34.5,39.37a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M49.13,39.37a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M63.75,39.37a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M34.5,54a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"/>
+  <path
+      android:pathData="M49.13,54a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"/>
+  <path
+      android:pathData="M63.75,54a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"/>
+  <path
+      android:pathData="M34.5,68.62a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M49.13,68.62a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"/>
+  <path
+      android:pathData="M63.75,68.62a4.87,4.88 0,1 0,9.75 0a4.87,4.88 0,1 0,-9.75 0z"
+      android:fillColor="#ffffff"
+      android:fillAlpha="0.4"/>
 </vector>

android/src/main/res/drawable/ic_notification.xml

@@ -0,0 +1,38 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="100dp"
+    android:height="100dp"
+    android:viewportWidth="100"
+    android:viewportHeight="100">
+  <path
+      android:pathData="M0,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M37.5,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M75,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M-0,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"/>
+  <path
+      android:pathData="M37.5,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"/>
+  <path
+      android:pathData="M75,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"/>
+  <path
+      android:pathData="M-0,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M37.5,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"/>
+  <path
+      android:pathData="M75,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+</vector>

android/src/main/res/drawable/ic_notification_disabled.xml

@@ -0,0 +1,46 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="100dp"
+    android:height="100dp"
+    android:viewportWidth="100"
+    android:viewportHeight="100">
+  <path
+      android:pathData="M0,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M37.5,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M75,12.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M-0,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:strokeAlpha="0.4"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M37.5,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:strokeAlpha="0.4"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M75,50a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:strokeAlpha="0.4"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M-0,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M37.5,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:strokeAlpha="0.4"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+  <path
+      android:pathData="M75,87.5a12.5,12.5 0,1 0,25 0a12.5,12.5 0,1 0,-25 0z"
+      android:fillColor="#000000"
+      android:fillAlpha="0.4"/>
+</vector>

android/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -2,4 +2,6 @@
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
     <background android:drawable="@color/ic_launcher_background"/>
     <foreground android:drawable="@drawable/ic_launcher_foreground"/>
+
+    <monochrome android:drawable="@drawable/ic_launcher_foreground" />
 </adaptive-icon>

android/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -2,4 +2,6 @@
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
     <background android:drawable="@color/ic_launcher_background"/>
     <foreground android:drawable="@drawable/ic_launcher_foreground"/>
+
+    <monochrome android:drawable="@drawable/ic_launcher_foreground" />
 </adaptive-icon>