@capawesome/capacitor-live-update 6.0.8 → 6.2.0-dev.0a2a6a5.1722676620

package/ios/Plugin/LiveUpdate.swift

@@ -1,13 +1,16 @@
 import Foundation
+import CryptoKit
 import SSZipArchive
 import Capacitor
 import Alamofire
+import CommonCrypto
 
 // swiftlint:disable type_body_length
 @objc public class LiveUpdate: NSObject {
+    public static let defaultWebAssetDir = "public" // DO NOT CHANGE (See https://dub.sh/Buvz4yj)
+
     private let cachesDirectoryUrl = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask).first!
     private let config: LiveUpdateConfig
-    private let defaultWebAssetDir = "public" // DO NOT CHANGE (See https://dub.sh/Buvz4yj)
     private let defaultServerPathKey = "serverBasePath" // DO NOT CHANGE (See https://dub.sh/ceDl0zT)
     private let libraryDirectoryUrl = FileManager.default.urls(for: .libraryDirectory, in: .userDomainMask).first!
     private let plugin: LiveUpdatePlugin
@@ -15,6 +18,7 @@ import Alamofire
     private let preferences: LiveUpdatePreferences
 
     private var rollbackDispatchWorkItem: DispatchWorkItem?
+    private var rollbackPerformed = false
 
     init(config: LiveUpdateConfig, plugin: LiveUpdatePlugin) {
         self.config = config
@@ -50,8 +54,9 @@ import Alamofire
     }
 
     @objc public func downloadBundle(_ options: DownloadBundleOptions, completion: @escaping (Error?) -> Void) {
-        let url = options.getUrl()
         let bundleId = options.getBundleId()
+        let checksum = options.getChecksum()
+        let url = options.getUrl()
 
         // Check if the bundle already exists
         if hasBundle(bundleId: bundleId) {
@@ -61,7 +66,7 @@ import Alamofire
         }
 
         // Download the bundle
-        downloadBundle(bundleId: bundleId, url: url, completion: { error in
+        downloadBundle(bundleId: bundleId, checksum: checksum, signature: nil, url: url, completion: { error in
             if let error = error {
                 completion(error)
                 return
@@ -71,10 +76,7 @@ import Alamofire
     }
 
     @objc public func getBundle(completion: @escaping (Result?, Error?) -> Void) {
-        var bundleId = getCurrentBundleId()
-        if bundleId == defaultWebAssetDir {
-            bundleId = nil
-        }
+        let bundleId = getCurrentBundleId()
         let result = GetBundleResult(bundleId: bundleId)
         completion(result, nil)
     }
@@ -116,12 +118,18 @@ import Alamofire
         completion(result, nil)
     }
 
-    @objc public func ready() {
+    @objc public func ready(completion: @escaping (Result?, Error?) -> Void) {
         CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "App is ready.")
         stopRollbackTimer()
         if config.autoDeleteBundles {
             deleteUnusedBundles()
         }
+        let currentBundleId = getCurrentBundleId()
+        let previousBundleId = getPreviousBundleId()
+        let result = ReadyResult(currentBundleId: currentBundleId, previousBundleId: previousBundleId, rollback: rollbackPerformed)
+        completion(result, nil)
+        setPreviousBundleId(bundleId: currentBundleId)
+        rollbackPerformed = false
     }
 
     @objc public func reload() {
@@ -187,7 +195,7 @@ import Alamofire
                     completion(result, nil)
                 } else {
                     // Download and unzip the bundle
-                    self.downloadBundle(bundleId: latestBundleId, url: response.url, completion: { error in
+                    self.downloadBundle(bundleId: latestBundleId, checksum: response.checksum, signature: response.signature, url: response.url, completion: { error in
                         if let error = error {
                             completion(nil, error)
                             return
@@ -241,6 +249,20 @@ import Alamofire
         return url.path
     }
 
+    /// - Returns: The sha256 checksum of the file at the given URL.
+    private func getChecksumForFile(url: URL) throws -> String {
+        let handle = try FileHandle(forReadingFrom: url)
+        var hasher = SHA256()
+        while autoreleasepool(invoking: {
+            let nextChunk = handle.readData(ofLength: 2048)
+            guard !nextChunk.isEmpty else { return false }
+            hasher.update(data: nextChunk)
+            return true
+        }) { }
+        let digest = hasher.finalize()
+        return digest.map { String(format: "%02hhx", $0) }.joined()
+    }
+
     private func createBundlesDirectory() {
         let bundlesDirectoryUrl = libraryDirectoryUrl.appendingPathComponent(bundlesDirectory)
         let exists = FileManager.default.fileExists(atPath: bundlesDirectoryUrl.path)
@@ -274,7 +296,7 @@ import Alamofire
         }
     }
 
-    private func downloadBundle(bundleId: String, url: String, completion: @escaping (Error?) -> Void) {
+    private func downloadBundle(bundleId: String, checksum: String?, signature: String?, url: String, completion: @escaping (Error?) -> Void) {
         // Download the bundle
         downloadFile(url: url, completion: { url, error in
             if let error = error {
@@ -282,6 +304,39 @@ import Alamofire
                 return
             }
             if let url = url {
+                // Verify the signature
+                if let publicKey = self.config.publicKey {
+                    guard let signature = signature else {
+                        completion(CustomError.signatureMissing)
+                        return
+                    }
+                    // Verify the signature
+                    do {
+                        let verified = try self.verifySignatureForFile(url: url, signature: signature, publicKey: publicKey)
+                        if !verified {
+                            completion(CustomError.signatureVerificationFailed)
+                            return
+                        }
+                    } catch {
+                        completion(CustomError.signatureVerificationFailed)
+                        return
+                    }
+                }
+                // Verify the checksum
+                else if let expectedChecksum = checksum {
+                    // Calculate the checksum
+                    do {
+                        let receivedChecksum = try self.getChecksumForFile(url: url)
+                        if receivedChecksum != expectedChecksum {
+                            completion(CustomError.checksumMismatch)
+                            return
+                        }
+                    } catch {
+                        completion(CustomError.checksumCalculationFailed)
+                        return
+                    }
+                }
+
                 // Add the bundle
                 self.addBundle(bundleId: bundleId, zipFile: url, completion: { error in
                     // Delete the temporary file
@@ -328,7 +383,13 @@ import Alamofire
         parameters["osVersion"] = UIDevice.current.systemVersion
         parameters["platform"] = "1"
         parameters["pluginVersion"] = LiveUpdatePlugin.version
-        let url = URL(string: "https://api.cloud.capawesome.io/v1/apps/\(config.appId ?? "")/bundles/latest")!
+        var host = "api.cloud.capawesome.io"
+        if let location = config.location {
+            if location == "eu" {
+                host = "api.cloud.capawesome.eu"
+            }
+        }
+        let url = URL(string: "https://\(host)/v1/apps/\(config.appId ?? "")/bundles/latest")!
         AF.request(url, method: .get, parameters: parameters).validate().responseDecodable(of: GetLatestBundleResponse.self) { response in
             CAPLog.print("[", LiveUpdatePlugin.tag, "] Fetching latest bundle from ", response.request?.url?.absoluteString ?? "")
             if let error = response.error {
@@ -400,20 +461,27 @@ import Alamofire
 
     /// - Returns: The absolute path to the next bundle directory.
     private func getNextCapacitorServerPath() -> String {
-        let defaultCapacitorServerPath = buildCapacitorServerPathFor(bundleId: defaultWebAssetDir)
+        let defaultCapacitorServerPath = buildCapacitorServerPathFor(bundleId: LiveUpdate.defaultWebAssetDir)
         if let path = KeyValueStore.standard[self.defaultServerPathKey, as: String.self] {
             return path.isEmpty ? defaultCapacitorServerPath : path
         }
         return defaultCapacitorServerPath
     }
 
+    private func getPreviousBundleId() -> String? {
+        return preferences.getPreviousBundleId()
+    }
+
     private func hasBundle(bundleId: String) -> Bool {
         let path = buildBundlePathFor(bundleId: bundleId)
         return FileManager.default.fileExists(atPath: path)
     }
 
     private func rollback() {
-        if getCurrentBundleId() == defaultWebAssetDir {
+        rollbackPerformed = true
+        let currentBundleId = getCurrentBundleId()
+        setPreviousBundleId(bundleId: currentBundleId)
+        if currentBundleId == LiveUpdate.defaultWebAssetDir {
             CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "App is not ready. Default bundle is already in use.")
             return
         }
@@ -447,7 +515,7 @@ import Alamofire
     }
 
     private func setCurrentCapacitorServerPathToDefaultWebAssetDir() {
-        let path = buildCapacitorServerPathFor(bundleId: defaultWebAssetDir)
+        let path = buildCapacitorServerPathFor(bundleId: LiveUpdate.defaultWebAssetDir)
         setCurrentCapacitorServerPath(path: path)
     }
 
@@ -467,10 +535,14 @@ import Alamofire
     }
 
     private func setNextCapacitorServerPathToDefaultWebAssetDir() {
-        let path = buildCapacitorServerPathFor(bundleId: defaultWebAssetDir)
+        let path = buildCapacitorServerPathFor(bundleId: LiveUpdate.defaultWebAssetDir)
         setNextCapacitorServerPath(path: path)
     }
 
+    private func setPreviousBundleId(bundleId: String?) {
+        preferences.setPreviousBundleId(bundleId)
+    }
+
     private func startRollbackTimer() {
         stopRollbackTimer()
         rollbackDispatchWorkItem = DispatchWorkItem { [weak self] in
@@ -492,6 +564,64 @@ import Alamofire
         })
     }
 
+    private func verifySignatureForFile(url: URL, signature: String, publicKey: String) throws -> Bool {
+        let publicKeyAsBase64 = publicKey
+            .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "\n", with: "")
+        guard let publicKeyData = Data(base64Encoded: publicKeyAsBase64) else {
+            CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "Failed to decode public key.")
+            return false
+        }
+        let publicKeyAttributes: [CFString: Any] = [
+            kSecAttrKeyType: kSecAttrKeyTypeRSA,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecAttrKeySizeInBits: 2048,
+            kSecReturnPersistentRef: true
+        ]
+        var secKeyCreateWithDataError: Unmanaged<CFError>?
+        guard let publicKey = SecKeyCreateWithData(publicKeyData as CFData, publicKeyAttributes as CFDictionary, &secKeyCreateWithDataError) else {
+            if let error = secKeyCreateWithDataError?.takeRetainedValue() {
+                CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "Failed to create public key with error: \(error)")
+            }
+            return false
+        }
+        guard let signatureData = Data(base64Encoded: signature) else {
+            CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "Failed to decode signature.")
+            return false
+        }
+
+        // Create SHA256 digest
+        var digestContext = CC_SHA256_CTX()
+        CC_SHA256_Init(&digestContext)
+
+        // Update the digest with the file's data
+        let handle = try FileHandle(forReadingFrom: url)
+        while autoreleasepool(invoking: {
+            let nextChunk = handle.readData(ofLength: 2048)
+            guard !nextChunk.isEmpty else { return false }
+            nextChunk.withUnsafeBytes {
+                _ = CC_SHA256_Update(&digestContext, $0.baseAddress, CC_LONG(nextChunk.count))
+            }
+            return true
+        }) { }
+
+        // Compute the digest
+        var digest = Data(count: Int(CC_SHA256_DIGEST_LENGTH))
+        digest.withUnsafeMutableBytes {
+            _ = CC_SHA256_Final($0.bindMemory(to: UInt8.self).baseAddress, &digestContext)
+        }
+
+        // Verify the signature
+        var secKeyVerifySignatureError: Unmanaged<CFError>?
+        let signatureAlgorithm = SecKeyAlgorithm.rsaSignatureDigestPKCS1v15SHA256
+        let verificationResult = SecKeyVerifySignature(publicKey, signatureAlgorithm, digest as CFData, signatureData as CFData, &secKeyVerifySignatureError)
+        if let error = secKeyVerifySignatureError?.takeRetainedValue() {
+            CAPLog.print("[", LiveUpdatePlugin.tag, "] ", "Failed to verify signature with error: \(error)")
+        }
+        return verificationResult
+    }
+
     private func wasUpdated() -> Bool {
         guard let lastBundleVersionString = preferences.getLastBundleVersion() else {
             return false

package/ios/Plugin/LiveUpdateConfig.swift

@@ -2,6 +2,8 @@ public struct LiveUpdateConfig {
     var appId: String?
     var autoDeleteBundles = false
     var enabled = true
+    var location: String?
+    var publicKey: String?
     var readyTimeout = 10000
     var resetOnUpdate = true
 }

package/ios/Plugin/LiveUpdatePlugin.swift

@@ -8,7 +8,7 @@ import Capacitor
 @objc(LiveUpdatePlugin)
 public class LiveUpdatePlugin: CAPPlugin {
     public static let tag = "LiveUpdate"
-    public static let version = "6.0.7"
+    public static let version = "6.2.0-dev.0a2a6a5.1722676620"
     public static let userDefaultsPrefix = "CapawesomeLiveUpdate" // DO NOT CHANGE
 
     private var config: LiveUpdateConfig?
@@ -42,12 +42,13 @@ public class LiveUpdatePlugin: CAPPlugin {
             call.reject(CustomError.bundleIdMissing.localizedDescription)
             return
         }
+        let checksum = call.getString("checksum")
         guard let url = call.getString("url") else {
             call.reject(CustomError.urlMissing.localizedDescription)
             return
         }
 
-        let options = DownloadBundleOptions(bundleId: bundleId, url: url)
+        let options = DownloadBundleOptions(bundleId: bundleId, checksum: checksum, url: url)
 
         implementation?.downloadBundle(options, completion: { error in
             if let error = error {
@@ -151,8 +152,16 @@ public class LiveUpdatePlugin: CAPPlugin {
     }
 
     @objc func ready(_ call: CAPPluginCall) {
-        implementation?.ready()
-        call.resolve()
+        implementation?.ready(completion: { result, error in
+            if let error = error {
+                CAPLog.print("[", LiveUpdatePlugin.tag, "] ", error)
+                call.reject(error.localizedDescription)
+                return
+            }
+            if let result = result?.toJSObject() as? JSObject {
+                call.resolve(result)
+            }
+        })
     }
 
     @objc func reload(_ call: CAPPluginCall) {
@@ -239,6 +248,8 @@ public class LiveUpdatePlugin: CAPPlugin {
         config.appId = getConfig().getString("appId", config.appId)
         config.autoDeleteBundles = getConfig().getBoolean("autoDeleteBundles", config.autoDeleteBundles)
         config.enabled = getConfig().getBoolean("enabled", config.enabled)
+        config.location = getConfig().getString("location", config.location)
+        config.publicKey = getConfig().getString("publicKey", config.publicKey)
         config.readyTimeout = getConfig().getInt("readyTimeout", config.readyTimeout)
         config.resetOnUpdate = getConfig().getBoolean("resetOnUpdate", config.resetOnUpdate)
 

package/ios/Plugin/LiveUpdatePreferences.swift

@@ -4,6 +4,7 @@ public class LiveUpdatePreferences: NSObject {
     private let channelKey = "channel" // DO NOT CHANGE
     private let customIdKey = "customId" // DO NOT CHANGE
     private let lastBundleVersionKey = "lastBundleVersion" // DO NOT CHANGE
+    private let previousBundleIdKey = "previousBundleIdKey" // DO NOT CHANGE
 
     public func getChannel() -> String? {
         return UserDefaults.standard.string(forKey: applyPrefix(to: channelKey))
@@ -17,6 +18,10 @@ public class LiveUpdatePreferences: NSObject {
         return UserDefaults.standard.string(forKey: applyPrefix(to: lastBundleVersionKey))
     }
 
+    public func getPreviousBundleId() -> String? {
+        return UserDefaults.standard.string(forKey: applyPrefix(to: previousBundleIdKey))
+    }
+
     public func setChannel(_ value: String?) {
         if let value = value {
             UserDefaults.standard.set(value, forKey: applyPrefix(to: channelKey))
@@ -36,6 +41,15 @@ public class LiveUpdatePreferences: NSObject {
         UserDefaults.standard.synchronize()
     }
 
+    public func setPreviousBundleId(_ value: String?) {
+        if let value = value {
+            UserDefaults.standard.set(value, forKey: applyPrefix(to: previousBundleIdKey))
+        } else {
+            UserDefaults.standard.removeObject(forKey: applyPrefix(to: previousBundleIdKey))
+        }
+        UserDefaults.standard.synchronize()
+    }
+
     private func applyPrefix(to key: String) -> String {
         return LiveUpdatePlugin.userDefaultsPrefix + "." + key
     }

package/ios/Plugin/Protocols/Api/GetLatestBundleResponse.swift

@@ -1,4 +1,6 @@
 struct GetLatestBundleResponse: Codable {
     var bundleId: String
+    var checksum: String?
+    var signature: String?
     var url: String
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capawesome/capacitor-live-update",
-  "version": "6.0.8",
+  "version": "6.2.0-dev.0a2a6a5.1722676620",
   "description": "Capacitor plugin to update your app remotely in real-time.",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",