fastlane-security-patched 2.216.0

data/spaceship/lib/spaceship/errors.rb

@@ -0,0 +1,135 @@
+module Spaceship
+  # Base class for errors that want to present their message as
+  # preferred error info for fastlane error handling. See:
+  # fastlane_core/lib/fastlane_core/ui/fastlane_runner.rb
+  class BasicPreferredInfoError < StandardError
+    TITLE = 'The request could not be completed because:'.freeze
+
+    def preferred_error_info
+      message ? [TITLE, message] : nil
+    end
+  end
+
+  # Invalid user credentials were provided
+  class InvalidUserCredentialsError < BasicPreferredInfoError; end
+
+  # Raised when no user credentials were passed at all
+  class NoUserCredentialsError < BasicPreferredInfoError; end
+
+  class ProgramLicenseAgreementUpdated < BasicPreferredInfoError
+    def show_github_issues
+      false
+    end
+  end
+
+  class AppleIDAndPrivacyAcknowledgementNeeded < BasicPreferredInfoError
+    def show_github_issues
+      false
+    end
+  end
+
+  # User doesn't have enough permission for given action
+  class InsufficientPermissions < BasicPreferredInfoError
+    TITLE = 'Insufficient permissions for your Apple ID:'.freeze
+
+    def preferred_error_info
+      message ? [TITLE, message] : nil
+    end
+
+    # We don't want to show similar GitHub issues, as the error message
+    # should be pretty clear
+    def show_github_issues
+      false
+    end
+  end
+
+  # Raised when 429 is received from App Store Connect
+  class TooManyRequestsError < BasicPreferredInfoError
+    attr_reader :retry_after
+    attr_reader :rate_limit_user
+
+    def initialize(resp_hash)
+      headers = resp_hash[:response_headers] || {}
+      @retry_after = (headers['retry-after'] || 60).to_i
+      @rate_limit_user = headers['x-daiquiri-rate-limit-user']
+      message = 'Apple 429 detected'
+      message += " - #{rate_limit_user}" if rate_limit_user
+      super(message)
+    end
+
+    def show_github_issues
+      false
+    end
+  end
+
+  class UnexpectedResponse < StandardError
+    attr_reader :error_info
+
+    def initialize(error_info = nil)
+      super(error_info)
+      @error_info = error_info
+    end
+
+    def preferred_error_info
+      return nil unless @error_info.kind_of?(Hash) && @error_info['resultString']
+
+      [
+        "Apple provided the following error info:",
+        @error_info['resultString'],
+        @error_info['userString']
+      ].compact.uniq # sometimes 'resultString' and 'userString' are the same value
+    end
+  end
+
+  # Raised when 302 is received from portal request
+  class AppleTimeoutError < BasicPreferredInfoError; end
+
+  # Raised when 401 is received from portal request
+  class UnauthorizedAccessError < BasicPreferredInfoError; end
+
+  # Raised when 500 is received from App Store Connect
+  class InternalServerError < BasicPreferredInfoError; end
+
+  # Raised when 502 is received from App Store Connect
+  class BadGatewayError < BasicPreferredInfoError; end
+
+  # Raised when 504 is received from App Store Connect
+  class GatewayTimeoutError < BasicPreferredInfoError; end
+
+  # Raised when 403 is received from portal request
+  class AccessForbiddenError < BasicPreferredInfoError; end
+
+  # Base class for errors coming from App Store Connect locale changes
+  class AppStoreLocaleError < BasicPreferredInfoError
+    def initialize(msg)
+      @message = (msg ? "An exception occurred for locale: #{msg}." : nil)
+      super
+    end
+
+    # no need to search github issues since the error is specific
+    def show_github_issues
+      false
+    end
+  end
+
+  # Raised for localized text errors from App Store Connect
+  class AppStoreLocalizationError < AppStoreLocaleError
+    def preferred_error_info
+      "#{@message} Check the localization requirements here: https://help.apple.com/app-store-connect/en.lproj/static.html#dev354659071"
+    end
+  end
+
+  # Raised for localized screenshots errors from App Store Connect
+  class AppStoreScreenshotError < AppStoreLocaleError
+    def preferred_error_info
+      "#{@message} Check the screenshot requirements here: https://help.apple.com/app-store-connect/en.lproj/static.html#devd274dd925"
+    end
+  end
+
+  # Raised for localized app preview errors from App Store Connect
+  class AppStoreAppPreviewError < AppStoreLocaleError
+    def preferred_error_info
+      "#{@message} Check the app preview requirements here: https://help.apple.com/app-store-connect/en.lproj/static.html#dev4e413fcb8"
+    end
+  end
+end

data/spaceship/lib/spaceship/globals.rb

@@ -0,0 +1,21 @@
+module Spaceship
+  class Globals
+    class << self
+      attr_writer(:check_session)
+    end
+
+    # if spaceship is run with a FastlaneCore available respect the global state there
+    # otherwise fallback to $verbose
+    def self.verbose?
+      if Object.const_defined?("FastlaneCore")
+        return FastlaneCore::Globals.verbose? # rubocop:disable Require/MissingRequireStatement
+      end
+      return $verbose
+    end
+
+    # if spaceship is run with the --check_session flag this value will be set to true
+    def self.check_session
+      return @check_session
+    end
+  end
+end

data/spaceship/lib/spaceship/hashcash.rb

@@ -0,0 +1,52 @@
+require 'digest'
+
+module Spaceship
+  module Hashcash
+    # This App Store Connect hashcash spec was generously donated by...
+    #
+    #                         __  _
+    #    __ _  _ __   _ __   / _|(_)  __ _  _   _  _ __  ___  ___
+    #   / _` || '_ \ | '_ \ | |_ | | / _` || | | || '__|/ _ \/ __|
+    #  | (_| || |_) || |_) ||  _|| || (_| || |_| || |  |  __/\__ \
+    #   \__,_|| .__/ | .__/ |_|  |_| \__, | \__,_||_|   \___||___/
+    #         |_|    |_|             |___/
+    #
+    #
+    # <summary>
+    #             1:11:20230223170600:4d74fb15eb23f465f1f6fcbf534e5877::6373
+    # X-APPLE-HC: 1:11:20230223170600:4d74fb15eb23f465f1f6fcbf534e5877::6373
+    #             ^  ^      ^                       ^                     ^
+    #             |  |      |                       |                     +-- Counter
+    #             |  |      |                       +-- Resource
+    #             |  |      +-- Date YYMMDD[hhmm[ss]]
+    #             |  +-- Bits (number of leading zeros)
+    #             +-- Version
+    #
+    # We can't use an off-the-shelf Hashcash because Apple's implementation is not quite the same as the spec/convention.
+    #  1. The spec calls for a nonce called "Rand" to be inserted between the Ext and Counter. They don't do that at all.
+    #  2. The Counter conventionally encoded as base-64 but Apple just uses the decimal number's string representation.
+    #
+    # Iterate from Counter=0 to Counter=N finding an N that makes the SHA1(X-APPLE-HC) lead with Bits leading zero bits
+    #
+    #
+    # We get the "Resource" from the X-Apple-HC-Challenge header and Bits from X-Apple-HC-Bits
+    #
+    # </summary>
+    def self.make(bits:, challenge:)
+      version = 1
+      date = Time.now.strftime("%Y%m%d%H%M%S")
+
+      counter = 0
+      loop do
+        hc = [
+          version, bits, date, challenge, ":#{counter}"
+        ].join(":")
+
+        if Digest::SHA1.digest(hc).unpack1('B*')[0, bits.to_i].to_i == 0
+          return hc
+        end
+        counter += 1
+      end
+    end
+  end
+end

data/spaceship/lib/spaceship/helper/net_http_generic_request.rb

@@ -0,0 +1,20 @@
+require 'net/http'
+
+## monkey-patch Net::HTTP
+#
+# Certain apple endpoints return 415 responses if a Content-Type is supplied.
+# Net::HTTP will default a content-type if none is provided by faraday
+# This monkey-patch allows us to leave out the content-type if we do not specify one.
+module NetHTTPGenericRequestMonkeypatch
+  def supply_default_content_type
+    # Return no content type if we communicating with an apple.com domain
+    return if !self['host'].nil? && self['host'].end_with?('.apple.com')
+
+    # Otherwise use the default implementation
+    super
+  end
+end
+
+# We prepend the monkeypatch so the patch has access to the original implementation
+# using `super`.
+Net::HTTPGenericRequest.prepend(NetHTTPGenericRequestMonkeypatch)

data/spaceship/lib/spaceship/helper/plist_middleware.rb

@@ -0,0 +1,16 @@
+require 'faraday_middleware/response_middleware'
+
+module FaradayMiddleware
+  class PlistMiddleware < ResponseMiddleware
+    dependency do
+      require 'plist' unless Object.const_defined?("Plist")
+    end
+
+    define_parser do |body|
+      body = body.force_encoding("UTF-8")
+      Plist.parse_xml(body)
+    end
+  end
+end
+
+Faraday::Response.register_middleware(plist: FaradayMiddleware::PlistMiddleware)

data/spaceship/lib/spaceship/helper/rels_middleware.rb

@@ -0,0 +1,28 @@
+module Faraday
+  class Env
+    attr_accessor :rels
+  end
+end
+
+require 'faraday'
+
+module FaradayMiddleware
+  class RelsMiddleware < Faraday::Middleware
+    def initialize(app, options = {})
+      @app = app
+      @options = options
+    end
+
+    def call(environment)
+      @app.call(environment).on_complete do |env|
+        links = (env.response_headers["Link"] || "").split(', ').map do |link|
+          href, name = link.match(/<(.*?)>; rel="(\w+)"/).captures
+
+          [name.to_sym, href]
+        end
+
+        env.rels = Hash[*links.flatten]
+      end
+    end
+  end
+end

data/spaceship/lib/spaceship/launcher.rb

@@ -0,0 +1,99 @@
+require_relative 'portal/portal_client'
+
+module Spaceship
+  class Launcher
+    attr_accessor :client
+
+    # Launch a new spaceship, which can be used to maintain multiple instances of
+    # spaceship. You can call `.new` without any parameters, but you'll have to call
+    # `.login` at a later point. If you prefer, you can pass the login credentials
+    # here already.
+    #
+    # Authenticates with Apple's web services. This method has to be called once
+    # to generate a valid session. The session will automatically be used from then
+    # on.
+    #
+    # This method will automatically use the username from the Appfile (if available)
+    # and fetch the password from the Keychain (if available)
+    #
+    # @param user (String) (optional): The username (usually the email address)
+    # @param password (String) (optional): The password
+    #
+    # @raise InvalidUserCredentialsError: raised if authentication failed
+    def initialize(user = nil, password = nil)
+      @client = PortalClient.new
+
+      if user || password
+        @client.login(user, password)
+      end
+    end
+
+    #####################################################
+    # @!group Login Helper
+    #####################################################
+
+    # Authenticates with Apple's web services. This method has to be called once
+    # to generate a valid session. The session will automatically be used from then
+    # on.
+    #
+    # This method will automatically use the username from the Appfile (if available)
+    # and fetch the password from the Keychain (if available)
+    #
+    # @param user (String) (optional): The username (usually the email address)
+    # @param password (String) (optional): The password
+    #
+    # @raise InvalidUserCredentialsError: raised if authentication failed
+    #
+    # @return (Spaceship::Client) The client the login method was called for
+    def login(user, password)
+      @client.login(user, password)
+    end
+
+    # Open up the team selection for the user (if necessary).
+    #
+    # If the user is in multiple teams, a team selection is shown.
+    # The user can then select a team by entering the number
+    #
+    # Additionally, the team ID is shown next to each team name
+    # so that the user can use the environment variable `FASTLANE_TEAM_ID`
+    # for future user.
+    #
+    # @param team_id (String) (optional): The ID of a Developer Portal team
+    # @param team_name (String) (optional): The name of a Developer Portal team
+    #
+    # @return (String) The ID of the select team. You also get the value if
+    #   the user is only in one team.
+    def select_team(team_id: nil, team_name: nil)
+      @client.select_team(team_id: team_id, team_name: team_name)
+    end
+
+    #####################################################
+    # @!group Helper methods for managing multiple instances of spaceship
+    #####################################################
+
+    # @return (Class) Access the apps for this spaceship
+    def app
+      Spaceship::Portal::App.set_client(@client)
+    end
+
+    # @return (Class) Access the app groups for this spaceship
+    def app_group
+      Spaceship::Portal::AppGroup.set_client(@client)
+    end
+
+    # @return (Class) Access the devices for this spaceship
+    def device
+      Spaceship::Portal::Device.set_client(@client)
+    end
+
+    # @return (Class) Access the certificates for this spaceship
+    def certificate
+      Spaceship::Portal::Certificate.set_client(@client)
+    end
+
+    # @return (Class) Access the provisioning profiles for this spaceship
+    def provisioning_profile
+      Spaceship::Portal::ProvisioningProfile.set_client(@client)
+    end
+  end
+end

data/spaceship/lib/spaceship/module.rb

@@ -0,0 +1,8 @@
+module Spaceship
+  # Requiring pathname is required here if not using bundler and requiring spaceship directly
+  # https://github.com/fastlane/fastlane/issues/14661
+  require 'pathname'
+
+  ROOT = Pathname.new(File.expand_path('../../..', __FILE__))
+  DESCRIPTION = "Ruby library to access the Apple Dev Center and App Store Connect".freeze
+end

data/spaceship/lib/spaceship/playground.rb

@@ -0,0 +1,75 @@
+require "colored"
+require "credentials_manager"
+
+require_relative 'tunes/tunes'
+require_relative 'portal/portal'
+
+module Spaceship
+  class Playground
+    def initialize(username: nil)
+      # Make sure the user has pry installed
+      begin
+        Gem::Specification.find_by_name("pry")
+      rescue Gem::LoadError
+        puts("Could not find gem 'pry'".red)
+        puts("")
+        puts("If you installed spaceship using `gem install spaceship` run")
+        puts("  gem install pry".yellow)
+        puts("to install the missing gem")
+        puts("")
+        puts("If you use a Gemfile add this to your Gemfile:")
+        puts("  gem 'pry'".yellow)
+        puts("and run " + "`bundle install`".yellow)
+
+        abort
+      end
+
+      require 'pry'
+
+      @username = username
+      @username ||= CredentialsManager::AppfileConfig.try_fetch_value(:apple_id)
+      @username ||= ask("Username: ")
+    end
+
+    def run
+      begin
+        puts("Logging into to App Store Connect (#{@username})...")
+        Spaceship::Tunes.login(@username)
+        puts("Successfully logged in to App Store Connect".green)
+        puts("")
+      rescue
+        puts("Could not login to App Store Connect...".red)
+      end
+      begin
+        puts("Logging into the Developer Portal (#{@username})...")
+        Spaceship::Portal.login(@username)
+        puts("Successfully logged in to the Developer Portal".green)
+        puts("")
+      rescue
+        puts("Could not login to the Developer Portal...".red)
+      end
+
+      puts("---------------------------------------".green)
+      puts("| Welcome to the spaceship playground |".green)
+      puts("---------------------------------------".green)
+      puts("")
+      puts("Enter #{'docs'.yellow} to open up the documentation")
+      puts("Enter #{'exit'.yellow} to exit the spaceship playground")
+      puts("Enter #{'_'.yellow} to access the return value of the last executed command")
+      puts("")
+      puts("Just enter the commands and confirm with Enter".green)
+
+      # rubocop:disable Lint/Debugger
+      binding.pry(quiet: true)
+      # rubocop:enable Lint/Debugger
+
+      puts("") # Fixes https://github.com/fastlane/fastlane/issues/3493
+    end
+
+    def docs
+      url = 'https://github.com/fastlane/fastlane/tree/master/spaceship/docs'
+      `open '#{url}'`
+      url
+    end
+  end
+end

data/spaceship/lib/spaceship/portal/app.rb

@@ -0,0 +1,201 @@
+require_relative 'portal_base'
+require_relative 'app_group'
+require_relative 'cloud_container'
+
+module Spaceship
+  module Portal
+    # Represents an App ID from the Developer Portal
+    class App < PortalBase
+      # @return (String) The identifier of this app, provided by the Dev Portal
+      # @example
+      #   "RGAWZGXSAA"
+      attr_accessor :app_id
+
+      # @return (String) The name you provided for this app
+      # @example
+      #   "Spaceship"
+      attr_accessor :name
+
+      # @return (String) the supported platform of this app
+      # @example
+      #   "ios"
+      attr_accessor :platform
+
+      # Prefix provided by the Dev Portal
+      # @example
+      #   "5A997XSHK2"
+      attr_accessor :prefix
+
+      # @return (String) The bundle_id (app identifier) of your app
+      # @example
+      #   "com.krausefx.app"
+      attr_accessor :bundle_id
+
+      # @return (Bool) Is this app a wildcard app (e.g. com.krausefx.*)
+      attr_accessor :is_wildcard
+
+      # @return (Hash) Feature details
+      attr_accessor :features
+
+      # @return (Array) List of enabled services
+      attr_accessor :enable_services
+
+      # @return (Bool) Development Push Enabled?
+      attr_accessor :dev_push_enabled
+
+      # @return (Bool) Production Push Enabled?
+      attr_accessor :prod_push_enabled
+
+      # @return (Fixnum) Number of associated app groups
+      attr_accessor :app_groups_count
+
+      # @return (Fixnum) Number of associated cloud containers
+      attr_accessor :cloud_containers_count
+
+      # @return (Fixnum) Number of associated identifiers
+      attr_accessor :identifiers_count
+
+      # @return (Array of Spaceship::Portal::AppGroup) Associated groups
+      attr_accessor :associated_groups
+
+      # @return (Array of Spaceship::Portal::CloudContainer) Associated cloud containers
+      attr_accessor :associated_cloud_containers
+
+      attr_mapping(
+        'appIdId' => :app_id,
+        'name' => :name,
+        'appIdPlatform' => :platform,
+        'prefix' => :prefix,
+        'identifier' => :bundle_id,
+        'isWildCard' => :is_wildcard,
+        'features' => :features,
+        'enabledFeatures' => :enable_services,
+        'isDevPushEnabled' => :dev_push_enabled,
+        'isProdPushEnabled' => :prod_push_enabled,
+        'associatedApplicationGroupsCount' => :app_groups_count,
+        'associatedCloudContainersCount' => :cloud_containers_count,
+        'associatedIdentifiersCount' => :identifiers_count,
+        'associatedCloudContainers' => :associated_cloud_containers
+      )
+
+      class << self
+        # @param mac [Bool] Fetches Mac apps if true
+        # @return (Array) Returns all apps available for this account
+        def all(mac: false)
+          client.apps(mac: mac).map { |app| self.new(app) }
+        end
+
+        # Creates a new App ID on the Apple Dev Portal
+        #
+        # if bundle_id ends with '*' then it is a wildcard id otherwise, it is an explicit id
+        # @param bundle_id [String] the bundle id (app_identifier) of the app associated with this provisioning profile
+        # @param name [String] the name of the App
+        # @param mac [Bool] is this a Mac app?
+        # @return (App) The app you just created
+        def create!(bundle_id: nil, name: nil, mac: false, enable_services: {})
+          if bundle_id.end_with?('*')
+            type = :wildcard
+          else
+            type = :explicit
+          end
+
+          new_app = client.create_app!(type, name, bundle_id, mac: mac, enable_services: enable_services)
+          self.new(new_app)
+        end
+
+        # Find a specific App ID based on the bundle_id
+        # @param mac [Bool] Searches Mac apps if true
+        # @return (App) The app you're looking for. This is nil if the app can't be found.
+        def find(bundle_id, mac: false)
+          raise "`bundle_id` parameter must not be nil" if bundle_id.nil?
+          found_app = all(mac: mac).find do |app|
+            app if app.bundle_id.casecmp(bundle_id) == 0
+          end
+
+          # Find catalyst enabled mac apps (look for mac first and then iOS)
+          if !found_app && mac
+            found_app = all(mac: false).find do |app|
+              app if app.bundle_id.casecmp(bundle_id) == 0
+            end
+          end
+
+          found_app
+        end
+      end
+
+      def associated_groups
+        return unless raw_data['associatedApplicationGroups']
+
+        @associated_groups ||= raw_data['associatedApplicationGroups'].map do |info|
+          Spaceship::Portal::AppGroup.new(info)
+        end
+      end
+
+      def associated_cloud_containers
+        return unless raw_data['associatedCloudContainers']
+
+        @associated_cloud_containers ||= raw_data['associatedCloudContainers'].map do |info|
+          Spaceship::Portal::CloudContainer.new(info)
+        end
+      end
+
+      # Delete this App ID. This action will most likely fail if the App ID is already in the store
+      # or there are active profiles
+      # @return (App) The app you just deletd
+      def delete!
+        client.delete_app!(app_id, mac: mac?)
+        self
+      end
+
+      # Update name of this App ID.
+      # @return (App) The app you updated. This is nil if the app can't be found
+      def update_name!(name, mac: false)
+        app = client.update_app_name!(app_id, name, mac: mac)
+        self.class.factory(app)
+      end
+
+      # Fetch a specific App ID details based on the bundle_id
+      # @return (App) The app you're looking for. This is nil if the app can't be found.
+      def details
+        app = client.details_for_app(self)
+        self.class.factory(app)
+      end
+
+      # Associate specific groups with this app
+      # @return (App) The updated detailed app. This is nil if the app couldn't be found
+      def associate_groups(groups)
+        raise "`associate_groups` not available for Mac apps" if mac?
+        app = client.associate_groups_with_app(self, groups)
+        self.class.factory(app)
+      end
+
+      # Associate specific iCloud Containers with this app
+      # @return (App) The updated detailed app. This is nil if the app couldn't be found.
+      def associate_cloud_containers(containers)
+        raise "`associate_cloud_containers` not available for Mac apps" if mac?
+        app = client.associate_cloud_containers_with_app(self, containers)
+        self.class.factory(app)
+      end
+
+      # Associate specific merchants with this app
+      # @return (App) The updated detailed app. This is nil if the app couldn't be found
+      def associate_merchants(merchants)
+        app = client.associate_merchants_with_app(self, merchants, mac?)
+        self.class.factory(app)
+      end
+
+      # Update a service for the app with given AppService object
+      # @return (App) The updated detailed app. This is nil if the app couldn't be found
+      def update_service(service)
+        raise "`update_service` not implemented for Mac apps" if mac?
+        app = client.update_service_for_app(self, service)
+        self.class.factory(app)
+      end
+
+      # @return (Bool) Is this a Mac app?
+      def mac?
+        platform == 'mac'
+      end
+    end
+  end
+end