@forthtilliath/expo-release-updates-ui 0.4.0 → 0.5.0

package/README.md

@@ -138,24 +138,28 @@ Mount it once near the root: it checks on launch (`useUpdateCheck`), shows the b
 ```tsx
 import { UpdateNotifier } from "@forthtilliath/expo-release-updates-ui/UpdateNotifier";
 
+const repo = { owner: "acme", repo: "app" };
+
 <View
   style={{ position: "absolute", top: 56, left: 16, right: 16, zIndex: 10 }}
 >
   <UpdateNotifier
     enabled={settings !== undefined}
     currentVersion={Constants.expoConfig?.version ?? "0.0.0"}
-    checkForUpdate={fetchLatestRelease}
+    checkForUpdate={() => fetchLatestRelease(repo)}
     getLastCheck={() => ({
       lastCheckedAt: settings?.lastUpdateCheckAt ?? null,
       dismissedVersion: settings?.dismissedUpdateVersion ?? null,
     })}
     onChecked={(at) => recordUpdateCheck(at)}
     onDismissVersion={(version) => dismissUpdateVersion(version)}
-    downloadAndInstallApk={(apkUrl, onProgress) =>
+    downloadAndInstallApk={(apkUrl, onProgress, apkSha256) =>
       downloadAndInstallApk({
         apkUrl,
         fileName: "myapp-update.apk",
         onProgress,
+        allowedUrlPrefix: releaseDownloadUrlPrefix(repo),
+        expectedSha256: apkSha256,
       })
     }
     styles={{ banner: { container: { backgroundColor: colors.surface } } }}
@@ -165,7 +169,9 @@ import { UpdateNotifier } from "@forthtilliath/expo-release-updates-ui/UpdateNot
 
 Pass **`enabled={false}` until the settings `getLastCheck` reads have loaded** (async database, live query…): the check runs once, on mount, so starting earlier would ignore both the 12h throttle and the dismissed version. Positioning is left to the parent. `labels` / `styles` take `{ banner, install }`, same keys as `UpdateAvailableBanner` and `UpdateInstallCard`.
 
-The building blocks are exported too, to compose a different flow: `useApkInstall(downloadAndInstallApk)` (`{ state, start(version, apkUrl), retry, reset }`) and `<UpdateInstallCard state onRetry onClose />` (renders nothing while idle).
+`downloadAndInstallApk` receives the release's `apkSha256` (from `fetchLatestRelease`) as its third argument: pass it on as `expectedSha256` so a swapped or damaged APK is never installed (needs expo-file-system 58+), and restrict the URL to your repo's releases with `allowedUrlPrefix`.
+
+The building blocks are exported too, to compose a different flow: `useApkInstall(downloadAndInstallApk)` (`{ state, start(version, apkUrl, apkSha256?), retry, reset }`) and `<UpdateInstallCard state onRetry onClose />` (renders nothing while idle).
 
 ## Scripts
 

package/dist/UpdateNotifier.js

@@ -37,7 +37,7 @@ function ActiveUpdateNotifier({ downloadAndInstallApk, onDismissVersion, locale
             // Not persisted as dismissed: if the install doesn't go through, the
             // banner may come back on a later launch (unlike "Ignore").
             update.dismiss();
-            install.start(release.version, release.apkUrl);
+            install.start(release.version, release.apkUrl, release.apkSha256);
         }, onDismiss: () => {
             onDismissVersion(release.version);
             update.dismiss();

package/dist/useApkInstall.d.ts

@@ -1,5 +1,9 @@
-/** Downloads an APK then hands it to Android's installer, reporting progress from 0 to 1. */
-export type DownloadAndInstallApk = (apkUrl: string, onProgress?: (fraction: number) => void) => Promise<void>;
+/**
+ * Downloads an APK then hands it to Android's installer, reporting progress
+ * from 0 to 1. `apkSha256` is the release's `apkSha256` (from
+ * `fetchLatestRelease`), to pass on as `expectedSha256`.
+ */
+export type DownloadAndInstallApk = (apkUrl: string, onProgress?: (fraction: number) => void, apkSha256?: string) => Promise<void>;
 export type ApkInstallState = {
     status: "idle";
 } | {
@@ -10,10 +14,11 @@ export type ApkInstallState = {
     status: "error";
     version: string;
     apkUrl: string;
+    apkSha256?: string;
 };
 export declare function useApkInstall(downloadAndInstallApk: DownloadAndInstallApk): {
     state: ApkInstallState;
-    start: (version: string, apkUrl: string) => void;
+    start: (version: string, apkUrl: string, apkSha256?: string) => void;
     retry: () => void;
     reset: () => void;
 };

package/dist/useApkInstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useApkInstall.d.ts","sourceRoot":"","sources":["../src/useApkInstall.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAKzD,wBAAgB,aAAa,CAAC,qBAAqB,EAAE,qBAAqB;;qBAGhD,MAAM,UAAU,MAAM;;;EAsB/C"}
+{"version":3,"file":"useApkInstall.d.ts","sourceRoot":"","sources":["../src/useApkInstall.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,EACvC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAK7E,wBAAgB,aAAa,CAAC,qBAAqB,EAAE,qBAAqB;;qBAGhD,MAAM,UAAU,MAAM,cAAc,MAAM;;;EA4BnE"}

package/dist/useApkInstall.js

@@ -4,21 +4,22 @@ import { useState } from "react";
 // state (keeping the URL) so the user can retry.
 export function useApkInstall(downloadAndInstallApk) {
     const [state, setState] = useState({ status: "idle" });
-    function start(version, apkUrl) {
+    function start(version, apkUrl, apkSha256) {
         setState({ status: "downloading", version, progress: 0 });
         downloadAndInstallApk(apkUrl, (progress) => {
             setState({ status: "downloading", version, progress });
-        })
+        }, apkSha256)
             .then(() => {
             setState({ status: "idle" });
         })
             .catch(() => {
-            setState({ status: "error", version, apkUrl });
+            setState({ status: "error", version, apkUrl, apkSha256 });
         });
     }
     function retry() {
-        if (state.status === "error")
-            start(state.version, state.apkUrl);
+        if (state.status === "error") {
+            start(state.version, state.apkUrl, state.apkSha256);
+        }
     }
     function reset() {
         setState({ status: "idle" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forthtilliath/expo-release-updates-ui",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -22,7 +22,7 @@
     "./*": "./dist/*.js"
   },
   "dependencies": {
-    "@forthtilliath/expo-release-updates": "^0.6.1"
+    "@forthtilliath/expo-release-updates": "^0.8.0"
   },
   "peerDependencies": {
     "react": ">=19",