@bota.dev/react-native-app-sdk 2.0.0-beta.1 → 2.0.0-beta.11

package/ios/UploadBackend/BotaUploadV2BackendBridge.swift

@@ -0,0 +1,98 @@
+import BotaAppSDK
+import Foundation
+
+@objc(BotaUploadV2BackendBridge)
+public final class BotaUploadV2BackendBridge: NSObject, @unchecked Sendable {
+  @MainActor private var coordinator: UploadCoordinator?
+  @MainActor private var destroyed = false
+  @MainActor private var credentialsRequested: (@Sendable (String, String) -> Void)?
+
+  @objc(prepare:credentialsRequested:completion:)
+  public func prepare(_ json: String,
+    credentialsRequested: @escaping @Sendable (String, String) -> Void,
+    completion: @escaping @Sendable (String?, NSError?) -> Void) {
+    Task { @MainActor in
+      do {
+        guard !destroyed else { throw UploadFailure.cancelled }
+        self.credentialsRequested = credentialsRequested
+        let input = try UploadInput.decode(Data(json.utf8))
+        let result = try await service().prepare(input)
+        let data = try JSONSerialization.data(withJSONObject: result.dictionary)
+        completion(String(decoding: data, as: UTF8.self), nil)
+      } catch { completion(nil, UploadFailure.safe(error) as NSError) }
+    }
+  }
+
+  @objc(cancel:completion:)
+  public func cancel(_ id: String, completion: @escaping @Sendable () -> Void) {
+    Task { @MainActor in coordinator?.cancel(id); completion() }
+  }
+  @objc(complete:completion:)
+  public func complete(_ id: String, completion: @escaping @Sendable (NSError?) -> Void) {
+    Task { @MainActor in
+      do {
+        guard !destroyed, let coordinator else { throw UploadFailure.cancelled }
+        try coordinator.complete(id); completion(nil)
+      } catch { completion(UploadFailure.safe(error) as NSError) }
+    }
+  }
+  @objc(resolveCredentials:token:completion:)
+  public func resolveCredentials(_ id: String, token: String, completion: @escaping @Sendable () -> Void) {
+    Task { @MainActor in coordinator?.credentials.resolve(requestId: id, token: token); completion() }
+  }
+  @objc(rejectCredentials:completion:)
+  public func rejectCredentials(_ id: String, completion: @escaping @Sendable () -> Void) {
+    Task { @MainActor in coordinator?.credentials.reject(requestId: id); completion() }
+  }
+  @objc public func invalidate() {
+    Task { @MainActor in destroyed = true; coordinator?.cancelAll(); credentialsRequested = nil }
+  }
+
+  @MainActor private func service() -> UploadCoordinator {
+    if let coordinator { return coordinator }
+    let credentials = UploadCredentials()
+    credentials.emit = { [weak self] requestId, operationId in
+      self?.credentialsRequested?(requestId, operationId)
+    }
+    let journal = UploadJournal(root: FileManager.default.urls(for: .applicationSupportDirectory,
+      in: .userDomainMask)[0].appendingPathComponent("BotaSDKUploadV2", isDirectory: true))
+    let http = UploadURLSessionHTTP()
+    let coordinator = UploadCoordinator(credentials: credentials, makeOperation: { input in
+      UploadOperation(input: input, journal: journal, http: http, credentials: credentials,
+        readNonce: { operationId in try await BotaDeviceSDKEncryptedUploadV2Materials.readAuthNonce(operationId) })
+    }, register: { operation, prepared in
+      let policy: EncryptedUploadV2SecurityPolicy
+      switch prepared.session.policy {
+      case "legacy_allowed": policy = .legacyAllowed
+      case "v2_preferred": policy = .v2Preferred
+      case "v2_required": policy = .v2Required
+      default: throw UploadFailure.invalidDocument
+      }
+      guard let sessionId = UUID(uuidString: prepared.session.session_id) else { throw UploadFailure.invalidDocument }
+      let material = EncryptedUploadV2Material(
+        materialID: UUID().uuidString.lowercased(), recordingID: operation.input.recording.uuid,
+        uploadSessionID: sessionId, ownerRevision: prepared.session.owner_revision, policy: policy,
+        authorization: prepared.authorization,
+        stagingRequest: { try await operation.stagingRequest(Self.evidence($0)) },
+        submitManifest: { try await operation.submitManifest($0, evidence: Self.evidence($1)) },
+        finalize: { try await operation.finalize(Self.evidence($0)) },
+        completionReceipt: { try await operation.completionReceipt(Self.evidence($0)) },
+        cancel: { await operation.cancel() },
+        uploadContext: { nonce in
+          let context = try await operation.uploadContext(nonce)
+          return EncryptedUploadV2ContextExchange(challenge: context.challenge, exchangeProof: context.exchangeProof)
+        },
+        shouldUploadCiphertext: { try await operation.shouldUpload(Self.evidence($0)) },
+        reconcileStaging: { try await operation.reconcileStaging($0, evidence: Self.evidence($1)) }
+      )
+      return BotaDeviceSDKEncryptedUploadV2Materials.register(material)
+    }, unregister: { id in _ = BotaDeviceSDKEncryptedUploadV2Materials.remove(id) })
+    self.coordinator = coordinator
+    return coordinator
+  }
+
+  private static func evidence(_ evidence: EncryptedUploadV2TransferEvidence) -> UploadEvidence {
+    UploadEvidence(ciphertextLength: evidence.ciphertextLength, ciphertextSHA256: evidence.ciphertextSHA256,
+      manifestLength: evidence.manifestLength, manifestSHA256: evidence.manifestSHA256)
+  }
+}

package/ios/UploadBackend/UploadCoordinator.swift

@@ -0,0 +1,84 @@
+import Foundation
+
+struct UploadSelection: Sendable {
+  let profile = "encrypted_upload_v2"
+  let uploadSessionId: String
+  let ownerRevision: UInt32
+  let securityPolicy: String
+  let materialRegistrationId: String
+  let recordingId: String
+
+  var dictionary: [String: Any] {
+    ["profile": profile, "uploadSessionId": uploadSessionId, "ownerRevision": ownerRevision,
+     "securityPolicy": securityPolicy, "materialRegistrationId": materialRegistrationId, "recordingId": recordingId]
+  }
+}
+
+@MainActor final class UploadCoordinator {
+  private struct Slot {
+    let operation: UploadOperation
+    var registrationId: String?
+    var preparing: Bool = true
+  }
+  let credentials: UploadCredentials
+  private let makeOperation: (UploadInput) -> UploadOperation
+  private let register: (UploadOperation, UploadPrepared) throws -> String
+  private let unregister: (String) -> Void
+  private var slots: [String: Slot] = [:]
+  private var usedIDs = Set<String>()
+
+  init(credentials: UploadCredentials, makeOperation: @escaping (UploadInput) -> UploadOperation,
+       register: @escaping (UploadOperation, UploadPrepared) throws -> String,
+       unregister: @escaping (String) -> Void) {
+    self.credentials = credentials
+    self.makeOperation = makeOperation
+    self.register = register
+    self.unregister = unregister
+  }
+
+  func prepare(_ input: UploadInput) async throws -> UploadSelection {
+    try input.validate()
+    guard !usedIDs.contains(input.operationId) else { throw UploadFailure.cancelled }
+    guard !slots.values.contains(where: { $0.operation.input.journalKey == input.journalKey }) else {
+      throw UploadFailure.state
+    }
+    usedIDs.insert(input.operationId)
+    let operation = makeOperation(input)
+    slots[input.operationId] = Slot(operation: operation)
+    do {
+      let prepared = try await operation.prepare()
+      try operation.check()
+      let id = try register(operation, prepared)
+      slots[input.operationId]?.registrationId = id
+      slots[input.operationId]?.preparing = false
+      return UploadSelection(uploadSessionId: prepared.session.session_id, ownerRevision: prepared.session.owner_revision,
+        securityPolicy: prepared.session.policy, materialRegistrationId: id, recordingId: prepared.recordingId)
+    } catch {
+      operation.cancel()
+      remove(input.operationId)
+      throw UploadFailure.safe(error)
+    }
+  }
+
+  func cancel(_ operationId: String) {
+    usedIDs.insert(operationId)
+    guard let slot = slots[operationId] else { return }
+    slot.operation.cancel()
+    // A preparing operation retains its journal lease until committed responses drain.
+    if !slot.preparing { remove(operationId) }
+  }
+
+  func complete(_ operationId: String) throws {
+    guard let slot = slots[operationId], !slot.preparing else { throw UploadFailure.state }
+    try slot.operation.complete()
+    remove(operationId)
+  }
+
+  func cancelAll() {
+    for id in Array(slots.keys) { cancel(id) }
+  }
+
+  private func remove(_ operationId: String) {
+    if let id = slots.removeValue(forKey: operationId)?.registrationId { unregister(id) }
+  }
+}

package/ios/UploadBackend/UploadHTTP.swift

@@ -0,0 +1,82 @@
+import Foundation
+
+struct UploadHTTPResponse: Sendable { let status: Int; let body: Data }
+
+@MainActor protocol UploadHTTP {
+  func send(_ request: URLRequest) async throws -> UploadHTTPResponse
+}
+
+// Refuse redirects so Cognito credentials and opaque bodies never change origin.
+private final class UploadRedirectPolicy: NSObject, URLSessionTaskDelegate, Sendable {
+  func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse,
+                  newRequest request: URLRequest, completionHandler: @escaping @Sendable (URLRequest?) -> Void) {
+    completionHandler(nil)
+  }
+}
+
+@MainActor final class UploadURLSessionHTTP: UploadHTTP {
+  private let session: URLSession
+
+  init() {
+    let configuration = URLSessionConfiguration.ephemeral
+    configuration.urlCache = nil
+    configuration.httpCookieStorage = nil
+    configuration.urlCredentialStorage = nil
+    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+    configuration.timeoutIntervalForRequest = 30
+    configuration.timeoutIntervalForResource = 60
+    session = URLSession(configuration: configuration, delegate: UploadRedirectPolicy(), delegateQueue: nil)
+  }
+  deinit { session.invalidateAndCancel() }
+
+  func send(_ request: URLRequest) async throws -> UploadHTTPResponse {
+    do {
+      let (body, response) = try await session.data(for: request)
+      guard let response = response as? HTTPURLResponse, body.count <= 1_048_576 else { throw UploadFailure.invalidDocument }
+      return UploadHTTPResponse(status: response.statusCode, body: body)
+    } catch { throw UploadFailure.safe(error) }
+  }
+}
+
+@MainActor final class UploadCredentials {
+  private struct Pending {
+    let operationId: String
+    let continuation: CheckedContinuation<String, Error>
+    let timer: Task<Void, Never>
+  }
+  var emit: ((String, String) -> Void)?
+  private var pending: [String: Pending] = [:]
+
+  func request(operationId: String) async throws -> String {
+    try Task.checkCancellation()
+    let id = UUID().uuidString.lowercased()
+    return try await withTaskCancellationHandler {
+      try await withCheckedThrowingContinuation { continuation in
+        let timer = Task {
+          do { try await Task.sleep(nanoseconds: 30_000_000_000) }
+          catch { return }
+          self.reject(requestId: id)
+        }
+        pending[id] = Pending(operationId: operationId, continuation: continuation, timer: timer)
+        emit?(id, operationId)
+      }
+    } onCancel: { Task { @MainActor in self.finish(id, result: .failure(UploadFailure.cancelled)) } }
+  }
+
+  func resolve(requestId: String, token: String) {
+    guard !token.isEmpty, token.utf8.count <= 16_384,
+          token.utf8.allSatisfy({ (33...126).contains($0) }) else { reject(requestId: requestId); return }
+    finish(requestId, result: .success(token))
+  }
+  func reject(requestId: String) { finish(requestId, result: .failure(UploadFailure.http(401))) }
+  func cancel(operationId: String) {
+    for id in pending.filter({ $0.value.operationId == operationId }).map(\.key) {
+      finish(id, result: .failure(UploadFailure.cancelled))
+    }
+  }
+  private func finish(_ id: String, result: Result<String, Error>) {
+    guard let request = pending.removeValue(forKey: id) else { return }
+    request.timer.cancel()
+    request.continuation.resume(with: result)
+  }
+}

package/ios/UploadBackend/UploadJournal.swift

@@ -0,0 +1,187 @@
+import Darwin
+import Foundation
+
+final class UploadJournal {
+  private struct Record: Codable {
+    let version: Int
+    let identity: String
+    let phase: String
+    let entry: UploadJournalEntry?
+    let importedPriorSHA256: String?
+    let authorizationNonceSHA256: String?
+    let recoveryNonceBase64: String?
+  }
+  private let root: URL
+  private let synchronize: (Int32) -> Int32
+
+  init(root: URL, synchronize: @escaping (Int32) -> Int32 = { fsync($0) }) {
+    self.root = root
+    self.synchronize = synchronize
+  }
+
+  private func rootFD() throws -> Int32 {
+    let manager = FileManager.default
+    do {
+      try manager.createDirectory(at: root, withIntermediateDirectories: true, attributes: [.posixPermissions: 0o700])
+      let fd = open(root.path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW)
+      guard fd >= 0 else { throw UploadFailure.journal }
+      do {
+        guard fchmod(fd, 0o700) == 0 else { throw UploadFailure.journal }
+        var url = root
+        var values = URLResourceValues()
+        values.isExcludedFromBackup = true
+        try url.setResourceValues(values)
+        guard synchronize(fd) == 0 else { throw UploadFailure.journal }
+        let parent = open(root.deletingLastPathComponent().path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW)
+        guard parent >= 0 else { throw UploadFailure.journal }
+        defer { close(parent) }
+        guard synchronize(parent) == 0 else { throw UploadFailure.journal }
+        return fd
+      } catch { close(fd); throw error }
+    } catch { throw UploadFailure.journal }
+  }
+
+  private func name(_ input: UploadInput) throws -> String {
+    guard UploadValidation.hex(input.journalKey, bytes: 32) else { throw UploadFailure.invalidInput }
+    return input.journalKey + ".json"
+  }
+
+  func load(_ input: UploadInput) throws -> UploadJournalEntry? {
+    guard let record = try read(input) else { return nil }
+    guard record.phase == "ready" else { throw UploadFailure.pending }
+    guard let entry = record.entry else { throw UploadFailure.journal }
+    if let prior = input.priorJournalEntry {
+      let priorIdentity = try prior.identity()
+      guard prior.agrees(with: entry) || record.importedPriorSHA256 == priorIdentity else {
+        throw UploadFailure.identityConflict
+      }
+    }
+    return entry
+  }
+
+  func authorizationNonceSHA256(_ input: UploadInput) throws -> String? {
+    try read(input)?.authorizationNonceSHA256
+  }
+
+  func recoveryNonceBase64(_ input: UploadInput) throws -> String? {
+    try read(input)?.recoveryNonceBase64
+  }
+
+  private func read(_ input: UploadInput) throws -> Record? {
+    let name = try name(input)
+    let directory = try rootFD()
+    defer { close(directory) }
+    let fd = openat(directory, name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK)
+    if fd < 0 {
+      if errno == ENOENT { return nil }
+      throw UploadFailure.journal
+    }
+    defer { close(fd) }
+    var info = stat()
+    guard fstat(fd, &info) == 0, info.st_mode & S_IFMT == S_IFREG, info.st_size <= 16_384 else {
+      throw UploadFailure.journal
+    }
+    do {
+      let data = try FileHandle(fileDescriptor: fd, closeOnDealloc: false).readToEnd() ?? Data()
+      let record = try JSONDecoder().decode(Record.self, from: data)
+      guard (1...2).contains(record.version),
+            record.identity == (try input.identity(includeTransport: record.version == 1)) else {
+        throw UploadFailure.identityConflict
+      }
+      guard ["ready", "recording_create_unknown", "session_create_unknown"].contains(record.phase),
+            record.importedPriorSHA256 == nil || UploadValidation.hex(record.importedPriorSHA256!, bytes: 32) else {
+        throw UploadFailure.journal
+      }
+      try record.entry?.validate()
+      guard record.authorizationNonceSHA256 == nil ||
+        (record.entry?.sessionId != nil && UploadValidation.hex(record.authorizationNonceSHA256!, bytes: 32)) else {
+        throw UploadFailure.journal
+      }
+      if let nonce = record.recoveryNonceBase64 {
+        guard record.phase == "ready", record.entry?.sessionId != nil else { throw UploadFailure.journal }
+        _ = try UploadValidation.document(nonce, size: 16)
+      }
+      if record.version == 1 {
+        let migrated = Record(version: 2, identity: try input.identity(), phase: record.phase,
+          entry: record.entry, importedPriorSHA256: record.importedPriorSHA256,
+          authorizationNonceSHA256: record.authorizationNonceSHA256, recoveryNonceBase64: record.recoveryNonceBase64)
+        try persist(input, record: migrated)
+        return migrated
+      }
+      return record
+    } catch { throw (error as? UploadFailure) ?? .journal }
+  }
+
+  func save(_ input: UploadInput, entry: UploadJournalEntry, authorizationNonceSHA256: String? = nil,
+            recoveryNonceBase64: String? = nil) throws {
+    try entry.validate()
+    try write(input, entry: entry, phase: "ready", authorizationNonceSHA256: authorizationNonceSHA256,
+      recoveryNonceBase64: recoveryNonceBase64)
+  }
+
+  func markUnknown(_ input: UploadInput, entry: UploadJournalEntry?) throws {
+    try entry?.validate()
+    try write(input, entry: entry, phase: entry == nil ? "recording_create_unknown" : "session_create_unknown")
+  }
+
+  func rollbackRejectedCreate(_ input: UploadInput, entry: UploadJournalEntry?) throws {
+    let phase = entry == nil ? "recording_create_unknown" : "session_create_unknown"
+    guard let record = try read(input), record.phase == phase, record.entry == entry else {
+      throw UploadFailure.identityConflict
+    }
+    if let entry {
+      try save(input, entry: entry)
+    } else {
+      let directory = try rootFD()
+      defer { close(directory) }
+      guard unlinkat(directory, try name(input), 0) == 0, synchronize(directory) == 0 else { throw UploadFailure.journal }
+    }
+  }
+
+  private func write(_ input: UploadInput, entry: UploadJournalEntry?, phase: String,
+                     authorizationNonceSHA256: String? = nil, recoveryNonceBase64: String? = nil) throws {
+    let previous = try read(input)
+    let imported = try previous?.importedPriorSHA256 ?? input.priorJournalEntry?.identity()
+    try persist(input, record: Record(version: 2, identity: try input.identity(), phase: phase,
+      entry: entry, importedPriorSHA256: imported,
+      authorizationNonceSHA256: authorizationNonceSHA256 ??
+        (previous?.entry?.sessionId == entry?.sessionId ? previous?.authorizationNonceSHA256 : nil),
+      recoveryNonceBase64: recoveryNonceBase64))
+  }
+
+  private func persist(_ input: UploadInput, record: Record) throws {
+    let name = try name(input)
+    let directory = try rootFD()
+    defer { close(directory) }
+    let temporary = UUID().uuidString.lowercased() + ".tmp"
+    var fd = openat(directory, temporary, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, 0o600)
+    guard fd >= 0 else { throw UploadFailure.journal }
+    defer {
+      if fd >= 0 { close(fd) }
+      unlinkat(directory, temporary, 0)
+    }
+    do {
+      let data = try JSONEncoder().encode(record)
+      try FileHandle(fileDescriptor: fd, closeOnDealloc: false).write(contentsOf: data)
+      var url = root.appendingPathComponent(temporary)
+      var values = URLResourceValues()
+      values.isExcludedFromBackup = true
+      try url.setResourceValues(values)
+      #if os(iOS)
+      try FileManager.default.setAttributes([.protectionKey: FileProtectionType.completeUntilFirstUserAuthentication], ofItemAtPath: url.path)
+      #endif
+      guard synchronize(fd) == 0 else { throw UploadFailure.journal }
+      let result = close(fd)
+      fd = -1
+      guard result == 0, renameat(directory, temporary, directory, name) == 0,
+            synchronize(directory) == 0 else { throw UploadFailure.journal }
+    } catch { throw UploadFailure.journal }
+  }
+
+  func remove(_ input: UploadInput, expected: UploadJournalEntry) throws {
+    guard try load(input) == expected else { throw UploadFailure.identityConflict }
+    let directory = try rootFD()
+    defer { close(directory) }
+    guard unlinkat(directory, try name(input), 0) == 0, synchronize(directory) == 0 else { throw UploadFailure.journal }
+  }
+}