@_nazmiforreal/flutter-ota 0.1.0 → 0.1.1

package/dart-src/plugins/aws/lib/src/aws_cloudfront_signer.dart

@@ -0,0 +1,130 @@
+import 'dart:convert' show base64Decode, base64Encode, jsonEncode, utf8;
+import 'dart:typed_data' show Uint8List;
+
+import 'package:asn1lib/asn1lib.dart';
+import 'package:pointycastle/export.dart'
+    show
+        PrivateKeyParameter,
+        PublicKeyParameter,
+        RSAPrivateKey,
+        RSAPublicKey,
+        RSASignature,
+        RSASigner,
+        SHA1Digest;
+
+/// ASN.1 DigestInfo prefix for SHA1, used by pointycastle's PKCS#1 v1.5 signer.
+const String _sha1DigestIdentifierHex = '3021300906052b0e03021a05000414';
+
+String _base64UrlNoPad(List<int> bytes) =>
+    base64Encode(bytes).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+
+/// Parse a PEM-encoded RSA private key (PKCS#1 `RSA PRIVATE KEY` or PKCS#8
+/// `PRIVATE KEY`) into a [RSAPrivateKey].
+RSAPrivateKey parseRsaPrivateKeyPem(String pem) {
+  final lines = pem
+      .split('\n')
+      .where((l) => l.isNotEmpty && !l.startsWith('-----'))
+      .join('');
+  final der = base64DecodeToBytes(lines);
+  final seq = ASN1Parser(der).nextObject() as ASN1Sequence;
+
+  late final ASN1Sequence keySeq;
+  if (seq.elements.length == 3) {
+    // PKCS#8: SEQUENCE { version, AlgorithmIdentifier, BIT STRING }
+    final bitString = seq.elements[2] as ASN1BitString;
+    keySeq = ASN1Parser(bitString.contentBytes()).nextObject() as ASN1Sequence;
+  } else {
+    // PKCS#1: RSAPrivateKey ::= SEQUENCE { version, n, e, d, p, q, dP, dQ, qInv }
+    keySeq = seq;
+  }
+
+  final modulus = (keySeq.elements[1] as ASN1Integer).valueAsBigInteger;
+  final privateExponent = (keySeq.elements[3] as ASN1Integer).valueAsBigInteger;
+  final p = (keySeq.elements[4] as ASN1Integer).valueAsBigInteger;
+  final q = (keySeq.elements[5] as ASN1Integer).valueAsBigInteger;
+  return RSAPrivateKey(modulus, privateExponent, p, q);
+}
+
+Uint8List base64DecodeToBytes(String s) => _base64Decode(s);
+
+Uint8List _base64Decode(String s) {
+  final normalized = s.replaceAll('-', '+').replaceAll('_', '/');
+  final padded = normalized.padRight(
+    normalized.length + (4 - normalized.length % 4) % 4,
+    '=',
+  );
+  return base64Decode(padded);
+}
+
+/// Build a CloudFront signed URL (custom policy, RSA-SHA1) for [url].
+///
+/// Faithful port of `@aws-sdk/cloudfront-signer`'s `getSignedUrl`.
+String cloudfrontSignedUrl({
+  required String url,
+  required String keyPairId,
+  required String privateKeyPem,
+  required DateTime dateLessThan,
+}) {
+  final privateKey = parseRsaPrivateKeyPem(privateKeyPem);
+
+  final policy = jsonEncode({
+    'Statement': [
+      {
+        'Resource': url,
+        'Condition': {
+          'DateLessThan': {
+            'AWS:EpochTime': dateLessThan.millisecondsSinceEpoch ~/ 1000,
+          },
+        },
+      },
+    ],
+  });
+  final policyBytes = utf8.encode(policy);
+  final policyB64 = _base64UrlNoPad(policyBytes);
+
+  final signer = RSASigner(SHA1Digest(), _sha1DigestIdentifierHex);
+  signer.init(true, PrivateKeyParameter<RSAPrivateKey>(privateKey));
+  final signature = signer.generateSignature(Uint8List.fromList(policyBytes)).bytes;
+  final signatureB64 = _base64UrlNoPad(signature);
+
+  return '$url?Policy=$policyB64&Signature=$signatureB64'
+      '&Key-Pair-Id=$keyPairId';
+}
+
+/// Verify a CloudFront signed URL's signature against [publicKeyPem] (test seam).
+bool verifyCloudfrontSignedUrl({
+  required String signedUrl,
+  required String publicKeyPem,
+}) {
+  final uri = Uri.parse(signedUrl);
+  final policy = uri.queryParameters['Policy'];
+  final signature = uri.queryParameters['Signature'];
+  if (policy == null || signature == null) return false;
+
+  final policyBytes = _base64Decode(policy);
+  final sigBytes = _base64Decode(signature);
+
+  final pub = parseRsaPublicKeyPem(publicKeyPem);
+  final signer = RSASigner(SHA1Digest(), _sha1DigestIdentifierHex);
+  signer.init(false, PublicKeyParameter<RSAPublicKey>(pub));
+  return signer.verifySignature(
+    Uint8List.fromList(policyBytes),
+    RSASignature(Uint8List.fromList(sigBytes)),
+  );
+}
+
+/// Parse a PEM-encoded RSA public key into [RSAPublicKey].
+RSAPublicKey parseRsaPublicKeyPem(String pem) {
+  final lines = pem
+      .split('\n')
+      .where((l) => l.isNotEmpty && !l.startsWith('-----'))
+      .join('');
+  final der = base64DecodeToBytes(lines);
+  final seq = ASN1Parser(der).nextObject() as ASN1Sequence;
+  // SubjectPublicKeyInfo: SEQUENCE { AlgorithmIdentifier, BIT STRING }
+  final bitString = seq.elements[1] as ASN1BitString;
+  final key = ASN1Parser(bitString.contentBytes()).nextObject() as ASN1Sequence;
+  final modulus = (key.elements[0] as ASN1Integer).valueAsBigInteger;
+  final exponent = (key.elements[1] as ASN1Integer).valueAsBigInteger;
+  return RSAPublicKey(modulus, exponent);
+}

package/dart-src/plugins/aws/lib/src/aws_config.dart

@@ -0,0 +1,59 @@
+import 'dart:io' show Platform;
+
+import 'aws_s3_client.dart' show AwsS3Client, AwsS3ClientLike;
+
+/// Configuration for the AWS S3 storage plugin.
+///
+/// Faithful port of hot-updater `S3StorageConfig` (extends the AWS SDK
+/// `S3ClientConfig` with `bucketName` and `basePath`).
+class AwsS3StorageConfig {
+  AwsS3StorageConfig({
+    required this.bucketName,
+    required this.region,
+    required this.accessKeyId,
+    required this.secretAccessKey,
+    this.basePath,
+    this.endpoint,
+    this.sessionToken,
+    this.clientFactory = defaultAwsS3ClientFactory,
+  });
+
+  final String bucketName;
+  final String region;
+  final String accessKeyId;
+  final String secretAccessKey;
+  final String? basePath;
+  final String? endpoint;
+  final String? sessionToken;
+
+  /// Test seam: override the concrete S3 client.
+  final AwsS3ClientLike Function(AwsS3StorageConfig config) clientFactory;
+}
+
+/// Default factory producing a real [AwsS3Client] with runtime region applied.
+AwsS3ClientLike defaultAwsS3ClientFactory(AwsS3StorageConfig config) =>
+    AwsS3Client(applyS3RuntimeAwsConfig(config));
+
+/// Fill in a default region from the environment when one is not supplied
+/// (mirrors hot-updater's `applyS3RuntimeAwsConfig`).
+AwsS3StorageConfig applyS3RuntimeAwsConfig(AwsS3StorageConfig config) {
+  if (config.region.isNotEmpty) return config;
+  final envRegion =
+      Platform.environment['AWS_REGION'] ??
+      Platform.environment['AWS_DEFAULT_REGION'];
+  if (envRegion == null || envRegion.isEmpty) return config;
+  return AwsS3StorageConfig(
+    bucketName: config.bucketName,
+    region: envRegion,
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    basePath: config.basePath,
+    endpoint: config.endpoint,
+    sessionToken: config.sessionToken,
+    clientFactory: config.clientFactory,
+  );
+}
+
+/// Resolve the concrete S3 client from config (seam for tests).
+AwsS3ClientLike resolveAwsS3Client(AwsS3StorageConfig config) =>
+    config.clientFactory(config);

package/dart-src/plugins/aws/lib/src/aws_database.dart

@@ -0,0 +1,198 @@
+import 'dart:convert' show jsonDecode, jsonEncode, utf8;
+
+import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart'
+    show BlobOperations, createBlobDatabasePlugin;
+
+import 'aws_cloudfront_client.dart'
+    show AwsCloudFrontClient, AwsCloudFrontClientLike, AwsCloudFrontConfig;
+import 'aws_config.dart' show AwsS3StorageConfig, applyS3RuntimeAwsConfig;
+import 'aws_s3_client.dart' show AwsS3Client, AwsS3ClientLike;
+
+/// Thrown when an S3 object is archived (Glacier) and cannot be read.
+class S3ArchivedObjectError implements Exception {
+  S3ArchivedObjectError({required this.key, required this.cause});
+
+  final String key;
+  final Object cause;
+
+  @override
+  String toString() =>
+      'S3ArchivedObjectError: object "$key" is archived and cannot be read.';
+}
+
+/// Build `toStorageKey` / `fromStorageKey` transformers for a base path.
+/// Faithful port of hot-updater `createDatabaseKeyBuilder.ts`.
+(String Function(String), String Function(String)) createDatabaseKeyBuilder(
+  String? basePath,
+) {
+  final normalized = basePath?.replaceAll(RegExp(r'^/+|/+$'), '') ?? '';
+  String toStorageKey(String key) =>
+      [normalized, key].where((s) => s.isNotEmpty).join('/');
+  String fromStorageKey(String key) {
+    if (normalized.isEmpty) return key;
+    final prefix = '$normalized/';
+    return key.startsWith(prefix) ? key.substring(prefix.length) : key;
+  }
+
+  return (toStorageKey, fromStorageKey);
+}
+
+/// Configuration for the AWS S3 blob database plugin.
+class S3DatabaseConfig {
+  S3DatabaseConfig({
+    required this.bucketName,
+    required this.region,
+    required this.accessKeyId,
+    required this.secretAccessKey,
+    this.basePath,
+    this.cloudfrontDistributionId,
+    this.shouldWaitForInvalidation = false,
+    this.apiBasePath = '/api/check-update',
+    this.endpoint,
+    this.sessionToken,
+    this.clientFactory = defaultAwsS3DatabaseClientFactory,
+    this.cloudfrontClientFactory = defaultAwsCloudFrontClientFactory,
+  });
+
+  final String bucketName;
+  final String region;
+  final String accessKeyId;
+  final String secretAccessKey;
+  final String? basePath;
+  final String? cloudfrontDistributionId;
+  final bool shouldWaitForInvalidation;
+  final String apiBasePath;
+  final String? endpoint;
+  final String? sessionToken;
+
+  /// Test seam: override the concrete S3 client.
+  final AwsS3ClientLike Function(S3DatabaseConfig config) clientFactory;
+
+  /// Test seam: override the concrete CloudFront client.
+  final AwsCloudFrontClientLike Function(S3DatabaseConfig config)
+      cloudfrontClientFactory;
+}
+
+/// Default factory producing a real [AwsS3Client] with runtime region applied.
+AwsS3ClientLike defaultAwsS3DatabaseClientFactory(S3DatabaseConfig config) =>
+    AwsS3Client(
+      applyS3RuntimeAwsConfig(
+        AwsS3StorageConfig(
+          bucketName: config.bucketName,
+          region: config.region,
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: config.secretAccessKey,
+          basePath: config.basePath,
+          endpoint: config.endpoint,
+          sessionToken: config.sessionToken,
+        ),
+      ),
+    );
+
+/// Default factory producing a real [AwsCloudFrontClient].
+AwsCloudFrontClientLike defaultAwsCloudFrontClientFactory(
+  S3DatabaseConfig config,
+) =>
+    AwsCloudFrontClient(
+      AwsCloudFrontConfig(
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey,
+        sessionToken: config.sessionToken,
+      ),
+    );
+
+bool _isUpdateJsonKey(String key) =>
+    RegExp(r'^[^/]+/(?:ios|android)/[^/]+/update\.json$').hasMatch(key);
+
+/// S3-backed [BlobOperations] for the AWS `s3Database` plugin.
+class S3BlobOperations implements BlobOperations {
+  S3BlobOperations(this.config)
+      : _client = config.clientFactory(config),
+        _cloudfront = config.cloudfrontDistributionId != null
+            ? config.cloudfrontClientFactory(config)
+            : null {
+    final keyBuilder = createDatabaseKeyBuilder(config.basePath);
+    _toStorageKey = keyBuilder.$1;
+    _fromStorageKey = keyBuilder.$2;
+  }
+
+  final S3DatabaseConfig config;
+  final AwsS3ClientLike _client;
+  final AwsCloudFrontClientLike? _cloudfront;
+  late final String Function(String) _toStorageKey;
+  late final String Function(String) _fromStorageKey;
+
+  @override
+  String get apiBasePath => config.apiBasePath;
+
+  @override
+  Future<List<String>> listObjects(String prefix) async {
+    final objects = await _client.listObjects(_toStorageKey(prefix));
+    return objects
+        .map((o) => _fromStorageKey(o.key))
+        .where(_isUpdateJsonKey)
+        .toList();
+  }
+
+  @override
+  Future<T?> loadObject<T>(String key) async {
+    final fullKey = _toStorageKey(key);
+    try {
+      final body = await _client.getObjectAsString(fullKey);
+      return jsonDecode(body) as T?;
+    } on Exception catch (e) {
+      if (e.toString().contains('NoSuchKey')) return null;
+      if (e.toString().contains('InvalidObjectState') ||
+          e.toString().contains('Archived')) {
+        throw S3ArchivedObjectError(key: fullKey, cause: e);
+      }
+      rethrow;
+    }
+  }
+
+  @override
+  Future<void> uploadObject<T>(String key, T data) async {
+    await _client.putObject(
+      _toStorageKey(key),
+      utf8.encode(jsonEncode(data)),
+      'application/json',
+    );
+  }
+
+  @override
+  Future<void> deleteObject(String key) async {
+    await _client.deleteObject(_toStorageKey(key));
+  }
+
+  @override
+  bool shouldSkipLoadObjectError(Object error, String key) =>
+      error is S3ArchivedObjectError;
+
+  @override
+  void validateChannel(String channel) {
+    // hot-updater's s3Database leaves channel validation optional (no-op).
+  }
+
+  @override
+  Future<void> invalidatePaths(List<String> paths) async {
+    final distributionId = config.cloudfrontDistributionId;
+    if (_cloudfront == null || distributionId == null || paths.isEmpty) {
+      return;
+    }
+    await _cloudfront.createInvalidation(
+      distributionId,
+      paths,
+      shouldWait: config.shouldWaitForInvalidation,
+    );
+  }
+}
+
+/// AWS S3 blob database plugin (faithful port of hot-updater `s3Database.ts`).
+///
+/// Stores bundles as JSON (`update.json`) under
+/// `channel/platform/targetAppVersion/` paths and serves them via
+/// `createBlobDatabasePlugin`, invalidating CloudFront paths on writes.
+final s3Database = createBlobDatabasePlugin<S3DatabaseConfig>(
+  name: 's3Database',
+  blobFactory: (config) => S3BlobOperations(config),
+);

package/dart-src/plugins/aws/lib/src/aws_lambda_edge_storage.dart

@@ -0,0 +1,72 @@
+import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart'
+    show StoragePlugin, StoragePluginHooks;
+
+import 'aws_config.dart' show AwsS3StorageConfig;
+import 'aws_storage.dart' show s3Storage;
+import 'with_cloudfront_signed_url.dart'
+    show WithCloudFrontSignedUrlOptions, withCloudFrontSignedUrl;
+
+/// Configuration for the AWS Lambda@Edge S3 storage plugin.
+///
+/// Combines `S3StorageConfig` (credentials/bucket) with the CloudFront signed
+/// URL options. Faithful port of hot-updater `AwsLambdaEdgeStorageConfig`.
+class AwsLambdaEdgeStorageConfig extends AwsS3StorageConfig {
+  AwsLambdaEdgeStorageConfig({
+    required super.bucketName,
+    required super.region,
+    required super.accessKeyId,
+    required super.secretAccessKey,
+    super.basePath,
+    super.endpoint,
+    super.sessionToken,
+    super.clientFactory,
+    required this.keyPairId,
+    this.publicBaseUrl,
+    this.publicBaseUrlResolver,
+    this.getPrivateKey,
+    this.ssmParameterName,
+    this.ssmRegion,
+    this.expiresSeconds,
+  });
+
+  final String keyPairId;
+  final String? publicBaseUrl;
+  final Future<String> Function()? publicBaseUrlResolver;
+  final Future<String> Function()? getPrivateKey;
+  final String? ssmParameterName;
+  final String? ssmRegion;
+  final int? expiresSeconds;
+
+  WithCloudFrontSignedUrlOptions toSignedUrlOptions() =>
+      WithCloudFrontSignedUrlOptions(
+        keyPairId: keyPairId,
+        publicBaseUrl: publicBaseUrl,
+        publicBaseUrlResolver: publicBaseUrlResolver,
+        getPrivateKey: getPrivateKey,
+        ssmParameterName: ssmParameterName,
+        ssmRegion: ssmRegion,
+        expiresSeconds: expiresSeconds,
+        accessKeyId: accessKeyId,
+        secretAccessKey: secretAccessKey,
+        sessionToken: sessionToken,
+      );
+}
+
+/// AWS Lambda@Edge S3 storage plugin: S3 storage whose `s3://` download URLs
+/// are rewritten as CloudFront signed URLs. Faithful port of
+/// `s3LambdaEdgeStorage.ts` / `awsLambdaEdgeStorage.ts`.
+StoragePlugin s3LambdaEdgeStorage(
+  AwsLambdaEdgeStorageConfig config, [
+  StoragePluginHooks? hooks,
+]) =>
+    withCloudFrontSignedUrl(
+      () => s3Storage(config, hooks),
+      config.toSignedUrlOptions(),
+    )();
+
+/// Alias matching hot-updater's `awsLambdaEdgeStorage` export.
+StoragePlugin awsLambdaEdgeStorage(
+  AwsLambdaEdgeStorageConfig config, [
+  StoragePluginHooks? hooks,
+]) =>
+    s3LambdaEdgeStorage(config, hooks);