@craft-native/ios 0.0.451 → 0.0.467

package/templates/CraftNativeFiles.swift

@@ -6,6 +6,72 @@ import Network
 import PhotosUI
 import UIKit
 import UniformTypeIdentifiers
+import UserNotifications
+
+/// UserNotifications takes ownership of attachment files. Never give it a
+/// picker/download original: stage copies and retain them until `add` answers.
+final class CraftNotificationAttachments {
+    let attachments: [UNNotificationAttachment]
+    let directory: URL?
+
+    init(_ raw: Any?) throws {
+        guard let raw else { attachments = []; directory = nil; return }
+        func invalid(_ message: String) -> NSError {
+            NSError(domain: "CraftNotification", code: 1, userInfo: [NSLocalizedDescriptionKey: message])
+        }
+        guard let entries = raw as? [[String: Any]], entries.count <= 10 else {
+            throw invalid("attachments must be an array of at most ten { id, path } entries")
+        }
+        var identifiers = Set<String>()
+        let sources: [(String, URL)] = try entries.map { entry in
+            guard let id = entry["id"] as? String, !id.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty,
+                  identifiers.insert(id).inserted,
+                  let path = entry["path"] as? String, let url = CraftNativeFiles.owned(path) else {
+                throw invalid("Each attachment needs a unique nonempty id and an existing craft.files path")
+            }
+            let attributes = try FileManager.default.attributesOfItem(atPath: url.path)
+            guard attributes[.type] as? FileAttributeType == .typeRegular,
+                  let size = attributes[.size] as? NSNumber, size.int64Value > 0, size.int64Value <= 50 * 1024 * 1024 else {
+                throw invalid("An attachment must be a nonempty regular file no larger than 50 MiB")
+            }
+            return (id, url)
+        }
+        guard !sources.isEmpty else { attachments = []; directory = nil; return }
+        let folder = FileManager.default.temporaryDirectory
+            .appendingPathComponent("craft-notification-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: folder, withIntermediateDirectories: true)
+        do {
+            attachments = try sources.map { id, source in
+                // Use generated names, keeping the extension for iOS type detection.
+                let copy = folder.appendingPathComponent(UUID().uuidString).appendingPathExtension(source.pathExtension)
+                try FileManager.default.copyItem(at: source, to: copy)
+                // iOS validates supported media, including the lower image/audio
+                // limits. A failure rejects the entire notification, never a subset.
+                return try UNNotificationAttachment(identifier: id, url: copy, options: nil)
+            }
+            directory = folder
+        } catch {
+            try? FileManager.default.removeItem(at: folder)
+            throw error
+        }
+    }
+
+    func cleanup() {
+        // Only our staging folder, never attachment.url (which iOS can move).
+        if let directory { try? FileManager.default.removeItem(at: directory) }
+    }
+
+    func schedule(_ request: UNNotificationRequest,
+                  submit: (UNNotificationRequest, @escaping (Error?) -> Void) -> Void = { UNUserNotificationCenter.current().add($0, withCompletionHandler: $1) },
+                  completion: @escaping (Error?) -> Void) {
+        submit(request) { error in
+            self.cleanup()
+            completion(error)
+        }
+    }
+
+    deinit { cleanup() }
+}
 
 // `craft.files` on a native screen: a photo picked from the library (or taken
 // with the camera), a file downloaded for the share sheet, and those files
@@ -847,6 +913,12 @@ enum CraftNativeFiles {
 // JavaScript. The screen decides what to keep (`keep`) and what to drop
 // (`prune`); nothing is evicted behind its back.
 enum CraftNativeMedia {
+    /// A caller-owned account + resource + version identity. Never used as a network URL.
+    static func identity(_ source: String, options: [String: Any]) -> String {
+        guard let key = options["cacheKey"] as? String, !key.isEmpty, key.utf8.count <= 1024 else { return source }
+        return "craft-media-key:" + key
+    }
+
     /// Foundation often wraps ENOSPC inside a URL or Cocoa file error.
     static func errorCode(_ error: Error, fallback: String) -> String {
         var cause: NSError? = error as NSError
@@ -871,9 +943,40 @@ enum CraftNativeMedia {
     /// Addresses being fetched now, so a second `keep` waits for the first.
     private struct Flight {
         let id: UUID
+        let ownership: CraftNativeMediaOwnership.Stamp
         var waiting: [(Result<Any, CraftNativeActionError>) -> Void]
     }
     private static var inFlight: [String: Flight] = [:]
+    private static var owner: CraftNativeMediaOwnership?
+
+    /// Called under the same lock as cache commits. Keep the journal outside
+    /// the cache directory so clear/prune cannot erase revocation history.
+    private static func ownership() throws -> CraftNativeMediaOwnership {
+        if let owner { return owner }
+        let value = try CraftNativeMediaOwnership(url: root.deletingLastPathComponent().appendingPathComponent("craft-media-ownership.json"))
+        owner = value
+        return value
+    }
+
+    private static func ownerKey(_ address: String) -> String {
+        String(file(for: address).lastPathComponent.prefix(64))
+    }
+
+    /// Remove only this identity's complete and staging files. A failed
+    /// unlink remains observable; its durable tombstone still hides the copy.
+    private static func removeFiles(_ address: String) throws -> Int {
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: root.path) else { return 0 }
+        let prefix = ownerKey(address) + "."
+        var removed = 0
+        var failure: Error?
+        for url in try fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil) where url.lastPathComponent.hasPrefix(prefix) {
+            do { try fm.removeItem(at: url); removed += 1 }
+            catch { failure = error }
+        }
+        if let failure { throw failure }
+        return removed
+    }
 
     /// Where `address`'s copy lives (whether or not it is there yet). The
     /// extension is the address's, because AVPlayer reads the type from it.
@@ -887,8 +990,12 @@ enum CraftNativeMedia {
     /// The copy of `address` on this phone, or nil.
     static func local(_ address: String) -> URL? {
         guard !address.isEmpty else { return nil }
+        lock.lock()
+        defer { lock.unlock() }
+        guard (try? ownership().permitsLocal(ownerKey(address))) == true else { return nil }
         let url = file(for: address)
-        return ((try? url.resourceValues(forKeys: [.fileSizeKey]).fileSize) ?? 0) > 0 ? url : nil
+        let values = try? url.resourceValues(forKeys: [.fileSizeKey, .isRegularFileKey])
+        return values?.isRegularFile == true && (values?.fileSize ?? 0) > 0 ? url : nil
     }
 
     static func describe(_ address: String, _ url: URL) -> [String: Any] {
@@ -899,14 +1006,35 @@ enum CraftNativeMedia {
     /// A new download's identity, or nil after joining an existing download.
     static func begin(_ address: String, _ done: @escaping (Result<Any, CraftNativeActionError>) -> Void) -> UUID? {
         lock.lock()
-        defer { lock.unlock() }
         if inFlight[address] != nil {
             inFlight[address]!.waiting.append(done)
+            lock.unlock()
+            return nil
+        }
+        do {
+            let stamp = try ownership().activate(ownerKey(address)) { _ = try removeFiles(address) }
+            let id = UUID()
+            inFlight[address] = Flight(id: id, ownership: stamp, waiting: [done])
+            lock.unlock()
+            return id
+        } catch {
+            lock.unlock()
+            done(.failure(CraftNativeActionError(code: errorCode(error, fallback: "IO_ERROR"), message: "Media ownership could not be persisted")))
             return nil
         }
-        let id = UUID()
-        inFlight[address] = Flight(id: id, waiting: [done])
-        return id
+    }
+
+    static func ownershipStamp(_ address: String, flight: UUID) -> CraftNativeMediaOwnership.Stamp? {
+        lock.lock()
+        defer { lock.unlock() }
+        guard let current = inFlight[address], current.id == flight else { return nil }
+        return current.ownership
+    }
+
+    static func acceptsTransfer(_ address: String, stamp: CraftNativeMediaOwnership.Stamp) -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        return (try? ownership().accepts(ownerKey(address), stamp: stamp)) == true
     }
 
     /// Whether `flight` is still the download `address`'s keeps wait for.
@@ -925,7 +1053,7 @@ enum CraftNativeMedia {
 
     /// A finished download moved into place (atomically, so a half-written
     /// file is never played), or a refusal with the server's status.
-    static func store(_ address: String, at location: URL, response: HTTPURLResponse, flight: UUID? = nil, stillWanted: (() -> Bool)? = nil) -> Result<Any, CraftNativeActionError> {
+    static func store(_ address: String, at location: URL, response: HTTPURLResponse, flight: UUID? = nil, stamp: CraftNativeMediaOwnership.Stamp? = nil, stillWanted: (() -> Bool)? = nil) -> Result<Any, CraftNativeActionError> {
         guard response.statusCode == 200 else {
             return .success(["ok": false, "url": address, "status": response.statusCode])
         }
@@ -936,11 +1064,15 @@ enum CraftNativeMedia {
         if let flight, inFlight[address]?.id != flight {
             return .failure(CraftNativeActionError(code: "CANCELLED", message: "The media cache was cleared"))
         }
+        let captured = stamp ?? flight.flatMap { inFlight[address]?.id == $0 ? inFlight[address]?.ownership : nil }
+        guard let captured, (try? ownership().accepts(ownerKey(address), stamp: captured)) == true else {
+            return .failure(CraftNativeActionError(code: "CANCELLED", message: "Media ownership was retired"))
+        }
         // A background transfer from before the cache was cleared (sign-out).
         if let stillWanted, !stillWanted() {
             return .failure(CraftNativeActionError(code: "CANCELLED", message: "The media cache was cleared"))
         }
-        let staging = root.appendingPathComponent(UUID().uuidString + ".part")
+        let staging = root.appendingPathComponent(ownerKey(address) + "." + UUID().uuidString + ".part")
         defer { try? fm.removeItem(at: staging) }
         do {
             // URL resource values can retain a previous size when a retry
@@ -973,15 +1105,20 @@ enum CraftNativeMedia {
     /// End an account's cache lifetime.
     static func clear() throws -> Int {
         lock.lock()
+        var failure: Error?
+        do { try ownership().clear() }
+        catch { failure = error }
         let waiting = inFlight.values.flatMap { $0.waiting }
         inFlight.removeAll()
         // Under the same lock a background transfer commits under: none
         // started before this lands after it.
         CraftNativeMediaTransfers.shared.cancelAll()
         let fm = FileManager.default
-        let files = (try? fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil)) ?? []
+        var files: [URL] = []
+        do {
+            if fm.fileExists(atPath: root.path) { files = try fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil) }
+        } catch { failure = error }
         var removed = 0
-        var failure: Error?
         for url in files {
             do { try fm.removeItem(at: url); removed += 1 }
             catch { failure = error }
@@ -992,6 +1129,24 @@ enum CraftNativeMedia {
         return removed
     }
 
+    /// Revoke one cache identity without removing other authorized media.
+    static func remove(_ address: String) throws -> Int {
+        guard !address.isEmpty else { throw CraftNativeActionError(code: "INVALID_ARGUMENT", message: "media.remove needs a source or cache key") }
+        lock.lock()
+        var failure: Error?
+        do { try ownership().retire(ownerKey(address)) }
+        catch { failure = error }
+        let waiting = inFlight.removeValue(forKey: address)?.waiting ?? []
+        CraftNativeMediaTransfers.shared.cancelRetired(address: address)
+        var removed = 0
+        do { removed = try removeFiles(address) }
+        catch { failure = error }
+        lock.unlock()
+        for done in waiting { done(.failure(CraftNativeActionError(code: "CANCELLED", message: "Media ownership was retired"))) }
+        if let failure { throw failure }
+        return removed
+    }
+
     /// Removes every copy whose address is not in `keep`; answers how many.
     static func prune(keep: [String]) -> Int {
         CraftNativeMediaTransfers.shared.cancel(except: keep + Array(inFlightAddresses()))
@@ -1048,6 +1203,24 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         let generation: Int
     }
 
+    private struct Description: Codable {
+        let address: String
+        let ownership: CraftNativeMediaOwnership.Stamp
+    }
+
+    private static func describe(_ address: String, ownership: CraftNativeMediaOwnership.Stamp) -> String {
+        // No network capability is added to the journal: only the task that
+        // already owns the authorized request carries its cache identity.
+        let data = try! JSONEncoder().encode(Description(address: address, ownership: ownership))
+        return "craft-media-v2:" + data.base64EncodedString()
+    }
+
+    private static func description(_ task: URLSessionTask) -> Description? {
+        guard let text = task.taskDescription, text.hasPrefix("craft-media-v2:"),
+              let data = Data(base64Encoded: String(text.dropFirst("craft-media-v2:".count))) else { return nil }
+        return try? JSONDecoder().decode(Description.self, from: data)
+    }
+
     private let lock = NSLock()
     private var transfers: [Int: Transfer] = [:]
     /// What each finished download came to, until its task completes.
@@ -1071,7 +1244,10 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
             guard let self else { return }
             self.lock.lock()
             for case let task as URLSessionDownloadTask in tasks where task.state == .running || task.state == .suspended {
-                if let address = task.taskDescription, self.transfers[task.taskIdentifier] == nil { self.restored[address] = task }
+                // A pre-upgrade address-only description cannot establish
+                // durable ownership. A new authorized keep can replace it.
+                guard let description = Self.description(task) else { task.cancel(); continue }
+                if self.transfers[task.taskIdentifier] == nil { self.restored[description.address] = task }
             }
             self.lock.unlock()
         }
@@ -1082,15 +1258,26 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
     }
 
     /// Fetches `request` into the copy for `address`, finishing `flight`.
-    func start(_ request: URLRequest, address: String, flight: UUID, wifiOnly: Bool) -> URLSessionTask {
+    func start(_ request: URLRequest, address: String, flight: UUID, ownership: CraftNativeMediaOwnership.Stamp, wifiOnly: Bool) -> URLSessionTask {
         lock.lock()
         let task: URLSessionDownloadTask
         if let earlier = restored.removeValue(forKey: address), earlier.state == .running || earlier.state == .suspended {
-            task = earlier
+            if Self.description(earlier)?.ownership == ownership,
+               earlier.originalRequest?.url == request.url && earlier.originalRequest?.allHTTPHeaderFields == request.allHTTPHeaderFields {
+                task = earlier
+            }
+            else {
+                // A queued capability can expire while the app is suspended.
+                // Retain its cache identity, replace only its authorized source.
+                earlier.taskDescription = nil
+                earlier.cancel()
+                task = session.downloadTask(with: request)
+                task.taskDescription = Self.describe(address, ownership: ownership)
+            }
         }
         else {
             task = session.downloadTask(with: request)
-            task.taskDescription = address
+            task.taskDescription = Self.describe(address, ownership: ownership)
         }
         transfers[task.taskIdentifier] = Transfer(address: address, flight: flight, wifiOnly: wifiOnly, generation: generation)
         lock.unlock()
@@ -1122,7 +1309,28 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         generation += 1
         restored.removeAll()
         lock.unlock()
-        session.getAllTasks { tasks in tasks.forEach { $0.cancel() } }
+        // The asynchronous enumeration may run after a new authorized keep.
+        // Retire only obsolete stamps, never that new generation's task.
+        session.getAllTasks { tasks in
+            for task in tasks {
+                guard let description = Self.description(task), CraftNativeMedia.acceptsTransfer(description.address, stamp: description.ownership) else {
+                    task.cancel()
+                    continue
+                }
+            }
+        }
+    }
+
+    func cancelRetired(address: String) {
+        lock.lock()
+        restored.removeValue(forKey: address)
+        lock.unlock()
+        session.getAllTasks { tasks in
+            for task in tasks {
+                guard let description = Self.description(task) else { task.cancel(); continue }
+                if description.address == address && !CraftNativeMedia.acceptsTransfer(address, stamp: description.ownership) { task.cancel() }
+            }
+        }
     }
 
     /// Stops the transfers for addresses no longer wanted.
@@ -1132,7 +1340,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         restored = restored.filter { wanted.contains($0.key) }
         lock.unlock()
         session.getAllTasks { tasks in
-            for task in tasks where !wanted.contains(task.taskDescription ?? "") { task.cancel() }
+            for task in tasks where !wanted.contains(Self.description(task)?.address ?? "") { task.cancel() }
         }
     }
 
@@ -1142,7 +1350,11 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         lock.unlock()
         // One left by an earlier launch belongs to the generation this launch began with.
         let started = transfer?.generation ?? 0
-        guard let address = transfer?.address ?? downloadTask.taskDescription else { return }
+        guard let description = Self.description(downloadTask) else {
+            record(downloadTask, .failure(CraftNativeActionError(code: "CANCELLED", message: "The media transfer has no durable ownership")))
+            return
+        }
+        let address = description.address
         guard let http = downloadTask.response as? HTTPURLResponse else {
             record(downloadTask, .failure(CraftNativeActionError(code: "NETWORK_ERROR", message: "media.keep received a response that is not HTTP")))
             return
@@ -1150,7 +1362,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         // The system deletes `location` once this returns: move it now. It
         // lands whether its keep is still waiting or was answered early; only
         // a clear since it started (sign-out) keeps it out.
-        record(downloadTask, CraftNativeMedia.store(address, at: location, response: http, stillWanted: { [weak self] in self?.isCurrent(started) ?? false }))
+        record(downloadTask, CraftNativeMedia.store(address, at: location, response: http, stamp: description.ownership, stillWanted: { [weak self] in self?.isCurrent(started) ?? false }))
     }
 
     /// How many times the cache was cleared in this launch; a transfer started before the last clear does not land.
@@ -1174,7 +1386,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         lock.lock()
         let transfer = transfers.removeValue(forKey: task.taskIdentifier)
         let result = finished.removeValue(forKey: task.taskIdentifier)
-        if let address = task.taskDescription, restored[address] === task { restored.removeValue(forKey: address) }
+        if let address = Self.description(task)?.address, restored[address] === task { restored.removeValue(forKey: address) }
         lock.unlock()
         guard let transfer, let flight = transfer.flight else { return }
         if let error {

package/templates/CraftNativeMediaOwnership.swift

@@ -0,0 +1,92 @@
+import Foundation
+
+/// Durable ownership of cached media and background transfers. The media
+/// store serializes access to this journal with its file-commit lock.
+final class CraftNativeMediaOwnership {
+    struct Stamp: Codable, Equatable {
+        let epoch: String
+        let revision: String
+    }
+
+    private struct Journal: Codable {
+        var version = 1
+        var epoch = UUID().uuidString
+        var legacyCopiesAllowed = true
+        var revisions: [String: String] = [:]
+        var revoked: Set<String> = []
+        var authorized: Set<String> = []
+    }
+
+    private let url: URL
+    private var journal: Journal
+    private var persistenceFailure: Error?
+
+    init(url: URL) throws {
+        self.url = url
+        if FileManager.default.fileExists(atPath: url.path) {
+            journal = try JSONDecoder().decode(Journal.self, from: Data(contentsOf: url))
+            guard journal.version == 1 else { throw CocoaError(.fileReadCorruptFile) }
+        } else {
+            journal = Journal()
+            try persist(journal)
+        }
+    }
+
+    func permitsLocal(_ identity: String) -> Bool {
+        persistenceFailure == nil && !journal.revoked.contains(identity)
+            && (journal.legacyCopiesAllowed || journal.authorized.contains(identity))
+    }
+
+    func accepts(_ identity: String, stamp: Stamp) -> Bool {
+        permitsLocal(identity) && stamp.epoch == journal.epoch
+            && stamp.revision == (journal.revisions[identity] ?? "")
+    }
+
+    /// A new explicit authorized keep may use this identity again. Old bytes
+    /// must be removed before lifting a tombstone, including after a failed
+    /// unlink. Its old transfer stamp never becomes current again.
+    func activate(_ identity: String, removeRetiredFiles: () throws -> Void) throws -> Stamp {
+        if persistenceFailure != nil { try persist(journal) }
+        if !permitsLocal(identity) {
+            try removeRetiredFiles()
+            var next = journal
+            next.revoked.remove(identity)
+            next.authorized.insert(identity)
+            try persist(next)
+        }
+        return Stamp(epoch: journal.epoch, revision: journal.revisions[identity] ?? "")
+    }
+
+    /// Persist before cancelling or unlinking: a task that outlives this
+    /// process cannot regain ownership on the next launch.
+    func retire(_ identity: String) throws {
+        var next = journal
+        next.revisions[identity] = UUID().uuidString
+        next.revoked.insert(identity)
+        try persist(next)
+    }
+
+    /// Sign-out invalidates all existing stamps and all copies, even if a
+    /// filesystem error prevents unlinking one of them.
+    func clear() throws {
+        var next = Journal()
+        next.legacyCopiesAllowed = false
+        try persist(next)
+    }
+
+    private func persist(_ next: Journal) throws {
+        // A failed journal write is observable and fails closed in this
+        // process. A later retire/clear can retry once storage is writable.
+        journal = next
+        do {
+            try FileManager.default.createDirectory(at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+            let encoder = JSONEncoder()
+            encoder.outputFormatting = [.sortedKeys]
+            try encoder.encode(next).write(to: url, options: .atomic)
+            persistenceFailure = nil
+        } catch {
+            persistenceFailure = error
+            throw error
+        }
+    }
+}