@capgo/capacitor-updater 6.1.17 → 6.1.19

package/ios/Plugin/CapacitorUpdater.swift

@@ -9,11 +9,12 @@ import SSZipArchive
 import Alamofire
 import zlib
 import SwiftyRSA
+import CryptoKit
 
 extension Collection {
-  subscript(safe index: Index) -> Element? {
-      return indices.contains(index) ? self[index] : nil
-  }
+    subscript(safe index: Index) -> Element? {
+        return indices.contains(index) ? self[index] : nil
+    }
 }
 extension URL {
     var isDirectory: Bool {
@@ -97,7 +98,6 @@ struct AppVersionDec: Decodable {
     let session_key: String?
     let major: Bool?
     let data: [String: String]?
-    let signature: String?
 }
 public class AppVersion: NSObject {
     var version: String = ""
@@ -108,7 +108,6 @@ public class AppVersion: NSObject {
     var sessionKey: String?
     var major: Bool?
     var data: [String: String]?
-    var signature: String?
 }
 
 extension AppVersion {
@@ -177,8 +176,8 @@ enum CustomError: Error {
     case cannotUnflat
     case cannotCreateDirectory
     case cannotDeleteDirectory
-    case signatureNotProvided
-    case invalidSignature
+    case cannotDecryptSessionKey
+    case invalidBase64
 
     // Throw in all other cases
     case unexpected(code: Int)
@@ -187,16 +186,6 @@ enum CustomError: Error {
 extension CustomError: LocalizedError {
     public var errorDescription: String? {
         switch self {
-        case .signatureNotProvided:
-            return NSLocalizedString(
-                "Signature was required but none was provided",
-                comment: "Signature not provided"
-            )
-        case .invalidSignature:
-            return NSLocalizedString(
-                "Signature is not valid, cannot accept update",
-                comment: "Invalid signature"
-            )
         case .cannotUnzip:
             return NSLocalizedString(
                 "The file cannot be unzip",
@@ -225,19 +214,29 @@ extension CustomError: LocalizedError {
         case .cannotDecode:
             return NSLocalizedString(
                 "Decoding the zip failed with this key",
-                comment: "Invalid private key"
+                comment: "Invalid public key"
             )
         case .cannotWrite:
             return NSLocalizedString(
                 "Cannot write to the destination",
                 comment: "Invalid destination"
             )
+        case .cannotDecryptSessionKey:
+            return NSLocalizedString(
+                "Decrypting the session key failed",
+                comment: "Invalid session key"
+            )
+        case .invalidBase64:
+            return NSLocalizedString(
+                "Decrypting the base64 failed",
+                comment: "Invalid checksum key"
+            )
         }
     }
 }
 
 @objc public class CapacitorUpdater: NSObject {
-    
+
     private let versionCode: String = Bundle.main.versionCode ?? ""
     private let versionOs = UIDevice.current.systemVersion
     private let libraryDir: URL = FileManager.default.urls(for: .libraryDirectory, in: .userDomainMask).first!
@@ -247,7 +246,7 @@ extension CustomError: LocalizedError {
     private let FALLBACK_VERSION: String = "pastVersion"
     private let NEXT_VERSION: String = "nextVersion"
     private var unzipPercent = 0
-    
+
     public let TAG: String = "✨  Capacitor-updater:"
     public let CAP_SERVER_PATH: String = "serverBasePath"
     public var versionBuild: String = ""
@@ -260,8 +259,9 @@ extension CustomError: LocalizedError {
     public var appId: String = ""
     public var deviceID = ""
     public var privateKey: String = ""
-    public var signKey: PublicKey?
-    
+    public var publicKey: String = ""
+    public var hasOldPrivateKeyPropertyInConfig: Bool = false
+
     public var notifyDownloadRaw: (String, Int, Bool) -> Void = { _, _, _  in }
     public func notifyDownload(id: String, percent: Int, ignoreMultipleOfTen: Bool = false) {
         notifyDownloadRaw(id, percent, ignoreMultipleOfTen)
@@ -360,37 +360,56 @@ extension CustomError: LocalizedError {
         }
     }
 
-
-    
-    private func verifyBundleSignature(version: String, filePath: URL, signature: String?) throws -> Bool {
-        if (self.signKey == nil) {
-            print("\(self.TAG) Signing not configured")
-            return true
-        }
-        
-        if (self.signKey != nil && (signature == nil || signature?.isEmpty == true)) {
-            print("\(self.TAG) Signature required but none provided")
-            self.sendStats(action: "signature_not_provided", versionName: version)
-            throw CustomError.signatureNotProvided
+    private func decryptFileV2(filePath: URL, sessionKey: String, version: String) throws {
+        if self.publicKey.isEmpty || sessionKey.isEmpty  || sessionKey.components(separatedBy: ":").count != 2 {
+            print("\(self.TAG) Cannot find public key or sessionKey")
+            return
         }
-        
         do {
-            // let publicKey = try PublicKey(pemEncoded: self.signKey)
-            let signatureObj = try Signature(base64Encoded: signature!) // I THINK I can unwrap safely here (?)
-            let clear = try ClearMessage(data: Data(contentsOf: filePath))
-            
-            let isSuccessful = try clear.verify(with: self.signKey!, signature: signatureObj, digestType: .sha512)
-            return isSuccessful
+            guard let rsaPublicKey: RSAPublicKey = .load(rsaPublicKey: self.publicKey) else {
+                print("cannot decode publicKey", self.publicKey)
+                throw CustomError.cannotDecode
+            }
+
+            let sessionKeyArray: [String] = sessionKey.components(separatedBy: ":")
+            guard let ivData: Data = Data(base64Encoded: sessionKeyArray[0]) else {
+                print("cannot decode sessionKey", sessionKey)
+                throw CustomError.cannotDecode
+            }
+
+            guard let sessionKeyDataEncrypted = Data(base64Encoded: sessionKeyArray[1]) else {
+                throw NSError(domain: "Invalid session key data", code: 1, userInfo: nil)
+            }
+
+            guard let sessionKeyDataDecrypted = rsaPublicKey.decrypt(data: sessionKeyDataEncrypted) else {
+                throw NSError(domain: "Failed to decrypt session key data", code: 2, userInfo: nil)
+            }
+
+            let aesPrivateKey = AES128Key(iv: ivData, aes128Key: sessionKeyDataDecrypted)
+
+            guard let encryptedData = try? Data(contentsOf: filePath) else {
+                throw NSError(domain: "Failed to read encrypted data", code: 3, userInfo: nil)
+            }
+
+            guard let decryptedData = aesPrivateKey.decrypt(data: encryptedData) else {
+                throw NSError(domain: "Failed to decrypt data", code: 4, userInfo: nil)
+            }
+
+            try decryptedData.write(to: filePath)
+
         } catch {
-            print("\(self.TAG) Signature validation failed", error)
-            self.sendStats(action: "signature_validation_failed", versionName: version)
-            throw error
+            print("\(self.TAG) Cannot decode: \(filePath.path)", error)
+            self.sendStats(action: "decrypt_fail", versionName: version)
+            throw CustomError.cannotDecode
         }
     }
 
     private func decryptFile(filePath: URL, sessionKey: String, version: String) throws {
-        if self.privateKey.isEmpty || sessionKey.isEmpty  || sessionKey.components(separatedBy: ":").count != 2 {
-            print("\(self.TAG) Cannot found privateKey or sessionKey")
+        if self.privateKey.isEmpty {
+            print("\(self.TAG) Cannot found privateKey")
+            return
+        } else if sessionKey.isEmpty  || sessionKey.components(separatedBy: ":").count != 2 {
+            print("\(self.TAG) Cannot found sessionKey")
             return
         }
         do {
@@ -424,7 +443,7 @@ extension CustomError: LocalizedError {
             }
 
             try decryptedData.write(to: filePath)
-           
+
         } catch {
             print("\(self.TAG) Cannot decode: \(filePath.path)", error)
             self.sendStats(action: "decrypt_fail", versionName: version)
@@ -564,9 +583,6 @@ extension CustomError: LocalizedError {
                 if let data = response.value?.data {
                     latest.data = data
                 }
-                if let signature = response.value?.signature {
-                    latest.signature = signature
-                }
             case let .failure(error):
                 print("\(self.TAG) Error getting Latest", response.value ?? "", error )
                 latest.message = "Error getting Latest \(String(describing: response.value))"
@@ -611,7 +627,35 @@ extension CustomError: LocalizedError {
             return ""
         }
     }
-    
+
+    private func calcChecksumV2(filePath: URL) -> String {
+        let bufferSize = 1024 * 1024 * 5 // 5 MB
+        var sha256 = SHA256()
+
+        do {
+            let fileHandle = try FileHandle(forReadingFrom: filePath)
+            defer {
+                fileHandle.closeFile()
+            }
+
+            while autoreleasepool(invoking: {
+                let fileData = fileHandle.readData(ofLength: bufferSize)
+                if fileData.count > 0 {
+                    sha256.update(data: fileData)
+                    return true // Continue
+                } else {
+                    return false // End of file
+                }
+            }) {}
+
+            let digest = sha256.finalize()
+            return digest.compactMap { String(format: "%02x", $0) }.joined()
+        } catch {
+            print("\(self.TAG) Cannot get checksum: \(filePath.path)", error)
+            return ""
+        }
+    }
+
     private var tempDataPath: URL {
         return FileManager.default.urls(for: .documentDirectory, in: .userDomainMask).first!.appendingPathComponent("package.tmp")
     }
@@ -620,26 +664,48 @@ extension CustomError: LocalizedError {
         return FileManager.default.urls(for: .documentDirectory, in: .userDomainMask).first!.appendingPathComponent("update.dat")
     }
     private var tempData = Data()
-    public func download(url: URL, version: String, sessionKey: String, signature: String) throws -> BundleInfo {
+
+    public func decryptChecksum(checksum: String, version: String) throws -> String {
+        if self.publicKey.isEmpty {
+            return checksum
+        }
+        do {
+            let checksumBytes: Data = Data(base64Encoded: checksum)!
+            guard let rsaPublicKey: RSAPublicKey = .load(rsaPublicKey: self.publicKey) else {
+                print("cannot decode publicKey", self.publicKey)
+                throw CustomError.cannotDecode
+            }
+            guard let decryptedChecksum = try? rsaPublicKey.decrypt(data: checksumBytes) else {
+                throw NSError(domain: "Failed to decrypt session key data", code: 2, userInfo: nil)
+            }
+            return decryptedChecksum.base64EncodedString()
+        } catch {
+            print("\(self.TAG) Cannot decrypt checksum: \(checksum)", error)
+            self.sendStats(action: "decrypt_fail", versionName: version)
+            throw CustomError.cannotDecode
+        }
+    }
+
+    public func download(url: URL, version: String, sessionKey: String) throws -> BundleInfo {
         let id: String = self.randomString(length: 10)
         let semaphore = DispatchSemaphore(value: 0)
-        if(version != getLocalUpdateVersion()){
-            cleanDlData()
+        if version != getLocalUpdateVersion() {
+            cleanDownloadData()
         }
         ensureResumableFilesExist()
         saveDownloadInfo(version)
         var checksum = ""
         var targetSize = -1
         var lastSentProgress = 0
-        var totalReceivedBytes: Int64 = loadDownloadProgress() //Retrieving the amount of already downloaded data if exist, defined at 0 otherwise
-         let requestHeaders: HTTPHeaders = ["Range": "bytes=\(totalReceivedBytes)-"]
-        //Opening connection for streaming the bytes
-        if(totalReceivedBytes == 0){
+        var totalReceivedBytes: Int64 = loadDownloadProgress() // Retrieving the amount of already downloaded data if exist, defined at 0 otherwise
+        let requestHeaders: HTTPHeaders = ["Range": "bytes=\(totalReceivedBytes)-"]
+        // Opening connection for streaming the bytes
+        if totalReceivedBytes == 0 {
             self.notifyDownload(id: id, percent: 0, ignoreMultipleOfTen: true)
         }
         var mainError: NSError?
         let monitor = ClosureEventMonitor()
-        monitor.requestDidCompleteTaskWithError = { (request, task, error) in
+        monitor.requestDidCompleteTaskWithError = { (_, _, error) in
             if error != nil {
                 print("\(self.TAG) Downloading failed - ClosureEventMonitor activated")
                 mainError = error as NSError?
@@ -652,37 +718,34 @@ extension CustomError: LocalizedError {
                 targetSize = (Int(contentLength) ?? -1) + Int(totalReceivedBytes)
             }
         }).responseStream { [weak self] streamResponse in
-             guard let self = self else { return }
-             switch streamResponse.event {
-             case .stream(let result):
-                 if case .success(let data) = result {
-                     self.tempData.append(data)
-                     
-                     self.savePartialData(startingAt: UInt64(totalReceivedBytes)) // Saving the received data in the package.tmp file
-                     totalReceivedBytes += Int64(data.count)
-                     
-                     let percent = max(10, Int((Double(totalReceivedBytes) / Double(targetSize)) * 70.0))
-                     
-                     print("\(self.TAG) Downloading: \(percent)%")
-                     let currentMilestone = (percent / 10) * 10
-                             if currentMilestone > lastSentProgress && currentMilestone <= 70 {
-                                 for milestone in stride(from: lastSentProgress + 10, through: currentMilestone, by: 10) {
-                                         self.notifyDownload(id: id, percent: milestone, ignoreMultipleOfTen: false)
-                                 }
-                                 lastSentProgress = currentMilestone
-                             }
-
-                 }
-                 else {
-                     print("\(self.TAG) Download failed")
-                 }
-
-
-             case .complete(_):
+            guard let self = self else { return }
+            switch streamResponse.event {
+            case .stream(let result):
+                if case .success(let data) = result {
+                    self.tempData.append(data)
+
+                    self.savePartialData(startingAt: UInt64(totalReceivedBytes)) // Saving the received data in the package.tmp file
+                    totalReceivedBytes += Int64(data.count)
+
+                    let percent = max(10, Int((Double(totalReceivedBytes) / Double(targetSize)) * 70.0))
+
+                    let currentMilestone = (percent / 10) * 10
+                    if currentMilestone > lastSentProgress && currentMilestone <= 70 {
+                        for milestone in stride(from: lastSentProgress + 10, through: currentMilestone, by: 10) {
+                            self.notifyDownload(id: id, percent: milestone, ignoreMultipleOfTen: false)
+                        }
+                        lastSentProgress = currentMilestone
+                    }
+
+                } else {
+                    print("\(self.TAG) Download failed")
+                }
+
+            case .complete:
                 print("\(self.TAG) Download complete, total received bytes: \(totalReceivedBytes)")
-                 self.notifyDownload(id: id, percent: 70, ignoreMultipleOfTen: true)
+                self.notifyDownload(id: id, percent: 70, ignoreMultipleOfTen: true)
                 semaphore.signal()
-             }
+            }
         }
         self.saveBundleInfo(id: id, bundle: BundleInfo(id: id, version: version, status: BundleStatus.DOWNLOADING, downloaded: Date(), checksum: checksum))
         let reachabilityManager = NetworkReachabilityManager()
@@ -700,50 +763,50 @@ extension CustomError: LocalizedError {
         semaphore.wait()
         reachabilityManager?.stopListening()
 
-        if (mainError != nil) {
+        if mainError != nil {
             print("\(self.TAG) Failed to download: \(String(describing: mainError))")
             self.saveBundleInfo(id: id, bundle: BundleInfo(id: id, version: version, status: BundleStatus.ERROR, downloaded: Date(), checksum: checksum))
             throw mainError!
         }
-        
+
         let finalPath = tempDataPath.deletingLastPathComponent().appendingPathComponent("\(id)")
         do {
-            let valid = try self.verifyBundleSignature(version: version, filePath: tempDataPath, signature: signature)
-            if (!valid) {
-                print("\(self.TAG) Invalid signature, cannot accept download")
-                self.sendStats(action: "invalid_signature", versionName: version)
-                throw CustomError.invalidSignature
+            var checksumDecrypted = checksum
+            if !self.hasOldPrivateKeyPropertyInConfig {
+                try self.decryptFileV2(filePath: tempDataPath, sessionKey: sessionKey, version: version)
             } else {
-                print("\(self.TAG) Valid signature")
+                try self.decryptFile(filePath: tempDataPath, sessionKey: sessionKey, version: version)
             }
-            
-            try self.decryptFile(filePath: tempDataPath, sessionKey: sessionKey, version: version)
             try FileManager.default.moveItem(at: tempDataPath, to: finalPath)
         } catch {
-            print("\(self.TAG) Failed decrypt file or verify signature or move it: \(error)")
+            print("\(self.TAG) Failed decrypt file : \(error)")
             self.saveBundleInfo(id: id, bundle: BundleInfo(id: id, version: version, status: BundleStatus.ERROR, downloaded: Date(), checksum: checksum))
-            cleanDlData()
+            cleanDownloadData()
             throw error
         }
-        
+
         do {
-            checksum = self.calcChecksum(filePath: finalPath)
+            if !self.hasOldPrivateKeyPropertyInConfig && !sessionKey.isEmpty {
+                checksum = self.calcChecksumV2(filePath: finalPath)
+            } else {
+                checksum = self.calcChecksum(filePath: finalPath)
+            }
             print("\(self.TAG) Downloading: 80% (unzipping)")
             try self.saveDownloaded(sourceZip: finalPath, id: id, base: self.libraryDir.appendingPathComponent(self.bundleDirectory), notify: true)
-            
+
         } catch {
             print("\(self.TAG) Failed to unzip file: \(error)")
             self.saveBundleInfo(id: id, bundle: BundleInfo(id: id, version: version, status: BundleStatus.ERROR, downloaded: Date(), checksum: checksum))
-            cleanDlData()
+            cleanDownloadData()
             // todo: cleanup zip attempts
             throw error
         }
-        
+
         self.notifyDownload(id: id, percent: 90)
         print("\(self.TAG) Downloading: 90% (wrapping up)")
         let info = BundleInfo(id: id, version: version, status: BundleStatus.PENDING, downloaded: Date(), checksum: checksum)
         self.saveBundleInfo(id: id, bundle: info)
-        self.cleanDlData()
+        self.cleanDownloadData()
         self.notifyDownload(id: id, percent: 100)
         print("\(self.TAG) Downloading: 100% (complete)")
         return info
@@ -755,39 +818,34 @@ extension CustomError: LocalizedError {
                 print("\(self.TAG) Cannot ensure that a file at \(tempDataPath.path) exists")
             }
         }
-        
+
         if !fileManager.fileExists(atPath: updateInfo.path) {
             if !fileManager.createFile(atPath: updateInfo.path, contents: Data()) {
                 print("\(self.TAG) Cannot ensure that a file at \(updateInfo.path) exists")
             }
         }
     }
-    
-    private func cleanDlData(){
+
+    private func cleanDownloadData() {
         // Deleting package.tmp
         let fileManager = FileManager.default
         if fileManager.fileExists(atPath: tempDataPath.path) {
-             do {
-                 try fileManager.removeItem(at: tempDataPath)
-             } catch {
-                 print("\(self.TAG) Could not delete file at \(tempDataPath): \(error)")
-             }
-         } else {
-             print("\(self.TAG) \(tempDataPath.lastPathComponent) does not exist")
-         }
-         
-         // Deleting update.dat
-         if fileManager.fileExists(atPath: updateInfo.path) {
-             do {
-                 try fileManager.removeItem(at: updateInfo)
-             } catch {
-                 print("\(self.TAG) Could not delete file at \(updateInfo): \(error)")
-             }
-         } else {
-             print("\(self.TAG) \(updateInfo.lastPathComponent) does not exist")
-         }
-    }
-    
+            do {
+                try fileManager.removeItem(at: tempDataPath)
+            } catch {
+                print("\(self.TAG) Could not delete file at \(tempDataPath): \(error)")
+            }
+        }
+        // Deleting update.dat
+        if fileManager.fileExists(atPath: updateInfo.path) {
+            do {
+                try fileManager.removeItem(at: updateInfo)
+            } catch {
+                print("\(self.TAG) Could not delete file at \(updateInfo): \(error)")
+            }
+        }
+    }
+
     private func savePartialData(startingAt byteOffset: UInt64) {
         let fileManager = FileManager.default
         do {
@@ -807,7 +865,6 @@ extension CustomError: LocalizedError {
         self.tempData.removeAll() // Clearing tempData to avoid writing the same data multiple times
     }
 
-
     private func saveDownloadInfo(_ version: String) {
         do {
             try "\(version)".write(to: updateInfo, atomically: true, encoding: .utf8)
@@ -815,34 +872,30 @@ extension CustomError: LocalizedError {
             print("\(self.TAG) Failed to save progress: \(error)")
         }
     }
-    private func getLocalUpdateVersion() -> String { //Return the version that was tried to be downloaded on last download attempt
+    private func getLocalUpdateVersion() -> String { // Return the version that was tried to be downloaded on last download attempt
         if !FileManager.default.fileExists(atPath: updateInfo.path) {
             return "nil"
         }
-         guard let versionString = try? String(contentsOf: updateInfo),
-               let version = Optional(versionString) else {
-             return "nil"
-         }
-         return version
-     }
+        guard let versionString = try? String(contentsOf: updateInfo),
+              let version = Optional(versionString) else {
+            return "nil"
+        }
+        return version
+    }
     private func loadDownloadProgress() -> Int64 {
-        
+
         let fileManager = FileManager.default
-         do {
-             let attributes = try fileManager.attributesOfItem(atPath: tempDataPath.path)
-             if let fileSize = attributes[.size] as? NSNumber {
-                 return fileSize.int64Value
-             }
-         } catch {
-             print("\(self.TAG) Could not retrieve already downloaded data size : \(error)")
-         }
-         return 0
+        do {
+            let attributes = try fileManager.attributesOfItem(atPath: tempDataPath.path)
+            if let fileSize = attributes[.size] as? NSNumber {
+                return fileSize.int64Value
+            }
+        } catch {
+            print("\(self.TAG) Could not retrieve already downloaded data size : \(error)")
+        }
+        return 0
     }
 
-
-
-
-
     public func list() -> [BundleInfo] {
         let dest: URL = libraryDir.appendingPathComponent(bundleDirectory)
         do {
@@ -1100,34 +1153,30 @@ extension CustomError: LocalizedError {
         parameters.action = action
         parameters.version_name = versionName
         parameters.old_version_name = oldVersionName ?? ""
-        
-        
+
         let operation = BlockOperation {
             let semaphore = DispatchSemaphore(value: 0)
             AF.request(
-                 self.statsUrl,
-                 method: .post,
-                 parameters: parameters,
-                 encoder: JSONParameterEncoder.default,
-                 requestModifier: { $0.timeoutInterval = self.timeout }
-             ).responseData { response in
-                 switch response.result {
-                 case .success:
-                     print("\(self.TAG) Stats sent for \(action), version \(versionName)")
-                 case let .failure(error):
-                     print("\(self.TAG) Error sending stats: ", response.value ?? "", error.localizedDescription)
-                 }
-                 semaphore.signal()
-             }
-             semaphore.wait()
-         }
+                self.statsUrl,
+                method: .post,
+                parameters: parameters,
+                encoder: JSONParameterEncoder.default,
+                requestModifier: { $0.timeoutInterval = self.timeout }
+            ).responseData { response in
+                switch response.result {
+                case .success:
+                    print("\(self.TAG) Stats sent for \(action), version \(versionName)")
+                case let .failure(error):
+                    print("\(self.TAG) Error sending stats: ", response.value ?? "", error.localizedDescription)
+                }
+                semaphore.signal()
+            }
+            semaphore.wait()
+        }
         operationQueue.addOperation(operation)
-        
 
-        
     }
 
-
     public func getBundleInfo(id: String?) -> BundleInfo {
         var trueId = BundleInfo.VERSION_UNKNOWN
         if id != nil {