@goliapkg/sentori-react-native 6.2.1 → 6.4.0

package/android/build.gradle

@@ -77,6 +77,12 @@ dependencies {
     // unresolved reference. Nothing noticed because nothing ran them —
     // the CI job that was supposed to had been failing for months on a
     // missing Gradle wrapper.
+    // The mirrored tests move with the code they cover, and one of
+    // them drives a real `RemoteMessage` through the messaging
+    // service. `compileOnly` above does not reach the test source
+    // set, so without this the mirror compiles and its tests do not —
+    // which is how this module went red while `sdk/native` was green.
+    testImplementation 'com.google.firebase:firebase-messaging:24.0.3'
     testImplementation 'junit:junit:4.13.2'
     testImplementation 'org.robolectric:robolectric:4.13'
     testImplementation 'androidx.test:core:1.6.1'

package/android/src/main/java-core/com/sentori/Sentori.kt

@@ -46,18 +46,47 @@ object Sentori {
         SentoriConfig.set(config)
         SentoriDevice.bind(context)
         SentoriTransport.start(context?.let { java.io.File(it.filesDir, "sentori") })
+
+        // Crash capture needs a Context for its storage, so an app
+        // that starts without one gets everything except this.
+        if (context != null) {
+            // The handler runs inside an uncaught-exception handler
+            // where almost nothing is safe, so it reads its release
+            // and environment from SharedPreferences rather than from
+            // a live object. Without this call every crash ships as
+            // `unknown` / `prod` — matching no release, so
+            // symbolicating against nothing.
+            SentoriCrashHandler.setConfig(
+                mapOf("release" to config.release, "environment" to config.environment)
+            )
+            SentoriCrashHandler.register(context)
+
+            // The crash that killed the last launch. Until now the
+            // handler wrote files into a directory nothing emptied —
+            // a crash reporter that captured crashes and never sent
+            // one.
+            SentoriPendingCrash.ship()
+        }
     }
 
     /**
      * Identify the person using the app. Only a hash of [id] (or
      * [email] when there is no id) travels; the raw values stay here.
      *
-     * Call this before registering for push if you want the device to
-     * be reachable from an issue — a device with no user key receives
-     * broadcasts and nothing else.
+     * Order does not matter with push: a device that has registered
+     * updates itself when this changes, so signing in after
+     * registering makes the device reachable straight away. It said to
+     * call this first, which was advice for a defect rather than a
+     * design — most apps learn who the user is well after launch.
+     *
+     * [traits] are attributes a push campaign can select on: plan,
+     * cohort, org. They travel raw, unlike [id] and [email], so put
+     * nothing there that identifies the person.
      */
     @JvmStatic
-    fun user(id: String?, email: String?) = SentoriScope.setUser(id, email)
+    @JvmOverloads
+    fun user(id: String?, email: String?, traits: Map<String, Any?>? = null) =
+        SentoriScope.setUser(id, email, traits)
 
     /** Merge keys into the ambient context that rides every event. */
     @JvmStatic

package/android/src/main/java-core/com/sentori/SentoriAttachment.kt

@@ -0,0 +1,153 @@
+// GENERATED MIRROR — do not edit.
+// Source of truth: sdk/native/android/src/main/java/com/sentori/SentoriAttachment.kt
+// Run `node scripts/sync-native-core.mjs` after editing it.
+package com.sentori
+
+import java.net.HttpURLConnection
+import java.net.URL
+import java.net.URLEncoder
+
+/**
+ * Blobs that belong to an event: the screenshot taken as the app died,
+ * the view tree behind it.
+ *
+ * They upload *after* the event, never before. The server keys an
+ * attachment on an event id it must already know, so an upload that
+ * races the batch 404s — and it always wins that race, because the
+ * batch waits for a flush and the upload does not.
+ *
+ * The multipart body is built by hand. React Native learned why the
+ * expensive way: its `FormData` file part wants a `uri`, the `data:`
+ * form throws a bare network error on iOS, and every JS attachment
+ * died silently for a release. Doing it literally is both shorter and
+ * checkable.
+ *
+ * Mirrors `SentoriAttachment.swift` part for part.
+ */
+internal object SentoriAttachment {
+
+    /**
+     * The kinds the server's CHECK constraint accepts, from
+     * `handlers/sdk/events_attachments.rs`. Anything else is a 400,
+     * so it is dropped here with the round trip saved.
+     *
+     * Worth keeping honest: the first version of this list had three
+     * entries, and the crash handler's view tree — written on both
+     * platforms, kind `viewTree` — was not one of them. It would have
+     * been dropped on the way out by the very code meant to deliver
+     * it, silently, with the event arriving intact and the evidence
+     * missing.
+     */
+    val KNOWN =
+        setOf(
+            "logTail",
+            "replay",
+            "screens",
+            "screenshot",
+            "sessionTrail",
+            "stateSnapshot",
+            "viewTree",
+        )
+
+    /** `android` | `ios` | `js`, likewise CHECK-constrained. */
+    val KNOWN_SOURCES = setOf("android", "ios", "js")
+
+    /**
+     * Test seam: capture instead of sending.
+     *
+     * What is worth asserting is *what* would be uploaded and *when* —
+     * the kind, the event it is keyed on, the body, and that none of
+     * it moves before the batch lands. None of that is about TCP; the
+     * wire has its own gate in `android-live-ingest`.
+     */
+    internal var recorderForTests: ((String, String, String) -> Unit)? = null
+
+    private val worker = java.util.concurrent.Executors.newSingleThreadExecutor { r ->
+        Thread(r, "sentori-attachment").apply { isDaemon = true }
+    }
+
+    /**
+     * Upload one blob against an event the server already has.
+     *
+     * Fire and forget: nothing here reaches the caller, and a failure
+     * costs the attachment rather than the crash report it belongs to.
+     */
+    fun upload(
+        eventId: String,
+        kind: String,
+        base64: String,
+        mediaType: String,
+        source: String = "android",
+        completion: ((Boolean) -> Unit)? = null,
+    ) {
+        val config = SentoriConfig.current
+        if (config == null || kind !in KNOWN || source !in KNOWN_SOURCES) {
+            completion?.invoke(false)
+            return
+        }
+
+        val boundary = "----sentori-$eventId"
+        val body = multipartBody(boundary, kind, mediaType, base64, source)
+
+        recorderForTests?.let {
+            it(eventId, kind, body)
+            completion?.invoke(true)
+            return
+        }
+
+        worker.execute {
+            var conn: HttpURLConnection? = null
+            var ok = false
+            try {
+                val url =
+                    "${config.ingestUrl}/v1/events/" +
+                        URLEncoder.encode(eventId, "UTF-8") +
+                        "/attachments/" +
+                        URLEncoder.encode(kind, "UTF-8")
+                conn = URL(url).openConnection() as HttpURLConnection
+                conn.requestMethod = "POST"
+                conn.setRequestProperty("Content-Type", "multipart/form-data; boundary=$boundary")
+                conn.setRequestProperty("Authorization", "Bearer ${config.token}")
+                conn.setRequestProperty("Sentori-Sdk", "kotlin/${SentoriVersion.CURRENT}")
+                conn.connectTimeout = 15_000
+                conn.readTimeout = 30_000
+                conn.doOutput = true
+                conn.outputStream.use { it.write(body.toByteArray(Charsets.UTF_8)) }
+                ok = conn.responseCode in 200..299
+            } catch (_: Throwable) {
+                // An attachment that will not go is an attachment lost,
+                // and never the host app's problem.
+            } finally {
+                conn?.disconnect()
+                completion?.invoke(ok)
+            }
+        }
+    }
+
+    /**
+     * The multipart body, visible so a test can read what would go on
+     * the wire. Building it correctly is the whole job here, and the
+     * failure mode is a 2xx that stored the wrong bytes.
+     */
+    internal fun multipartBody(
+        boundary: String,
+        kind: String,
+        mediaType: String,
+        base64: String,
+        source: String,
+    ): String =
+        buildString {
+            append("--$boundary\r\n")
+            append("Content-Disposition: form-data; name=\"file\"; filename=\"$kind.bin\"\r\n")
+            append("Content-Type: $mediaType\r\n")
+            // The server decodes when told to. Without this header it
+            // stores the base64 text as the image, which renders as
+            // nothing and looks like a capture problem.
+            append("Content-Transfer-Encoding: base64\r\n")
+            append("\r\n$base64\r\n")
+            append("--$boundary\r\n")
+            append("Content-Disposition: form-data; name=\"source\"\r\n")
+            append("\r\n$source\r\n")
+            append("--$boundary--\r\n")
+        }
+}

package/android/src/main/java-core/com/sentori/SentoriConfig.kt

@@ -57,5 +57,5 @@ constructor(
  * direction of a lie.
  */
 object SentoriVersion {
-    const val CURRENT = "1.0.0"
+    const val CURRENT = "1.7.1"
 }

package/android/src/main/java-core/com/sentori/SentoriCrashHandler.kt

@@ -196,6 +196,25 @@ object SentoriCrashHandler {
         }
     }
 
+    /**
+     * Test-only seam that writes a crash file verbatim.
+     *
+     * `persistForTesting(throwable)` goes through `write`, which
+     * composes the file from a live throwable and a live window —
+     * neither of which a Robolectric test can arrange. Delivery tests
+     * need to state the file they are about to deliver, particularly
+     * the pre-death attachments, which only exist when there was a
+     * window to capture.
+     */
+    internal fun persistRawForTesting(event: JSONObject) {
+        val dir = pendingDir() ?: return
+        try {
+            File(dir, "${uuidLower()}.json").writeText(event.toString())
+        } catch (_: Throwable) {
+            // best-effort
+        }
+    }
+
     private fun attachPending(event: JSONObject) {
         val snap = try {
             SentoriScreenshotCapture.captureKeyWindow()

package/android/src/main/java-core/com/sentori/SentoriFirebaseMessagingService.kt

@@ -33,6 +33,11 @@ class SentoriFirebaseMessagingService : FirebaseMessagingService() {
         super.onNewToken(token)
         try {
             SentoriPushNotifications.handleRegisteredToken(token)
+            // And tell the server, now. Buffering it in a field was
+            // the whole of what happened here before, so a rotation
+            // was invisible until the host next called `register` —
+            // and the device received nothing in between.
+            SentoriPush.handleRotatedToken(applicationContext, token)
         } catch (_: Throwable) {
             // never crash a Firebase callback
         }
@@ -52,6 +57,16 @@ class SentoriFirebaseMessagingService : FirebaseMessagingService() {
                 notif.channelId?.let { payload["channelId"] = it }
             }
             SentoriPushNotifications.handleIncomingNotification(payload)
+
+            // A `data` message is invisible until somebody draws it,
+            // and the Sentori server sends `data` on purpose so that
+            // the tap comes back through a pending intent we own. If
+            // the system already drew this one — a `notification`
+            // message from some other sender — leave it alone rather
+            // than showing it twice.
+            if (message.notification == null) {
+                SentoriPushNotifications.postNotification(applicationContext, message.data)
+            }
         } catch (_: Throwable) {
             // never crash a Firebase callback
         }

package/android/src/main/java-core/com/sentori/SentoriNotificationTap.kt

@@ -0,0 +1,148 @@
+// GENERATED MIRROR — do not edit.
+// Source of truth: sdk/native/android/src/main/java/com/sentori/SentoriNotificationTap.kt
+// Run `node scripts/sync-native-core.mjs` after editing it.
+package com.sentori
+
+import android.app.Activity
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.os.Bundle
+
+/**
+ * Taps, delivered without asking the host for anything.
+ *
+ * `handleNotificationTap` used to be the only way a tap reached
+ * `register(onTap:)`, and its own comment said the host wires this in
+ * `Activity.onCreate to forward the intent extras`. Nothing in the SDK
+ * called it, the public docs never mentioned it, and so a native host
+ * passed an `onTap` callback that could not fire. insight measured
+ * that: the tray entry appeared, the app opened, and the callback
+ * stayed silent. It is the same shape as the permission bug — a
+ * premise carried over from the React Native integration, where the
+ * host module did the forwarding, and quietly false everywhere else.
+ *
+ * There are two ways a tap can reach an app, and this covers both.
+ *
+ * **A notification the SDK posted.** The pending intent is ours, so
+ * the tap arrives here with the message that produced it. Nothing can
+ * intercept it and nothing needs to cooperate. This is the path the
+ * Sentori server produces, because it sends `data` messages for
+ * exactly this reason.
+ *
+ * **A notification the system posted**, from a `notification` message
+ * some other sender emitted. The system opens the launcher activity
+ * with the payload in the intent extras and never calls our service.
+ * All that can be done is to read the intent the Activity was handed,
+ * which `register` does. A tap that arrives while the app is already
+ * running reaches the host's `onNewIntent`, and only a host that
+ * calls `setIntent` makes it visible to anyone else — so that case
+ * still needs the host, and the documentation says so rather than
+ * pretending otherwise.
+ */
+object SentoriNotificationTap {
+
+    /** Extras on our own pending intent. */
+    const val EXTRA_MARKER = "com.sentori.tap"
+
+    /**
+     * FCM stamps this on anything it delivers. Its presence is how an
+     * ordinary launch is told apart from a notification tap when the
+     * system posted the notification.
+     */
+    private const val FCM_MESSAGE_ID = "google.message_id"
+
+    private val lock = Any()
+    private val seen = ArrayDeque<String>()
+    private const val SEEN_CAP = 32
+
+    /**
+     * A tap is delivered once.
+     *
+     * The same intent is visible to `register` on a cold start and to
+     * the pending intent that caused it, and an Activity that is
+     * recreated on rotation hands back the intent it launched with.
+     * Reporting a tap twice makes a host count one open as two.
+     */
+    private fun firstTime(id: String): Boolean = synchronized(lock) {
+        if (seen.contains(id)) return false
+        seen.addLast(id)
+        while (seen.size > SEEN_CAP) seen.removeFirst()
+        true
+    }
+
+    /** The pending intent attached to a notification the SDK posts. */
+    fun pendingIntent(ctx: Context, data: Map<String, String>, requestCode: Int): PendingIntent? {
+        // `getLaunchIntentForPackage` returns null more often than it
+        // looks: an app with no exported launcher activity, and any
+        // Robolectric host. The first version gave up there and
+        // posted a notification with no content intent — a tray entry
+        // that swallows the tap, which is worse than the bug this
+        // file exists to fix, because it looks like it works.
+        val launch = ctx.packageManager.getLaunchIntentForPackage(ctx.packageName)
+            ?: Intent(Intent.ACTION_MAIN)
+                .addCategory(Intent.CATEGORY_LAUNCHER)
+                .setPackage(ctx.packageName)
+        launch.flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
+        launch.putExtra(EXTRA_MARKER, true)
+        for ((k, v) in data) launch.putExtra(k, v)
+        return PendingIntent.getActivity(
+            ctx,
+            requestCode,
+            launch,
+            // Immutable is required from Android 12 and correct
+            // everywhere: nothing downstream should be able to rewrite
+            // the payload this carries.
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+    }
+
+    /**
+     * Read whatever launched this Activity and report a tap if that is
+     * what it was.
+     *
+     * Called by `register`, so a host that does nothing at all still
+     * gets its `onTap`.
+     */
+    fun consume(activity: Activity?) {
+        consume(activity?.intent?.extras)
+    }
+
+    /**
+     * Report a tap from intent extras, if that is what they are.
+     *
+     * Public because the documentation asks hosts to call it. A tap
+     * arriving while the app is already running reaches the host's
+     * `onNewIntent` and nowhere else, and the docs said so — while
+     * this object was `internal`, so the only reachable alternative
+     * was `handleNotificationTap`, which records whatever it is
+     * given. insight ended up copying the two-key test out of here by
+     * hand, including a constant that exists only in this file.
+     *
+     * Safe to call with any intent's extras: an ordinary launch is
+     * not a tap and is ignored, and the same tap is reported once.
+     */
+    fun consume(extras: Bundle?) {
+        val bundle = extras ?: return
+        val ours = bundle.getBoolean(EXTRA_MARKER, false)
+        val fcm = bundle.containsKey(FCM_MESSAGE_ID)
+        // An ordinary launch has neither, and reporting it as a tap
+        // would put a notification in every session that never had
+        // one.
+        if (!ours && !fcm) return
+
+        val payload = mutableMapOf<String, Any?>()
+        for (key in bundle.keySet()) {
+            if (key == EXTRA_MARKER) continue
+            payload[key] = bundle.get(key)
+        }
+        val id = (bundle.getString(FCM_MESSAGE_ID) ?: payload["id"] as? String)
+            ?: payload.toString()
+        if (!firstTime(id)) return
+        SentoriPushNotifications.handleNotificationTap(payload)
+    }
+
+    internal fun resetForTests() {
+        synchronized(lock) { seen.clear() }
+    }
+}

package/android/src/main/java-core/com/sentori/SentoriPendingCrash.kt

@@ -0,0 +1,154 @@
+// GENERATED MIRROR — do not edit.
+// Source of truth: sdk/native/android/src/main/java/com/sentori/SentoriPendingCrash.kt
+// Run `node scripts/sync-native-core.mjs` after editing it.
+package com.sentori
+
+import org.json.JSONArray
+import org.json.JSONObject
+
+/**
+ * The crash that killed the app, sent on the next launch.
+ *
+ * [SentoriCrashHandler] writes one JSON file per crash from inside an
+ * uncaught-exception handler, where almost nothing is safe to do — so
+ * it writes a flat, older shape and gets out. Something has to read
+ * those files, convert them to the wire format and enqueue them, and
+ * until now nothing in this package did: the crash handler filled a
+ * directory nobody emptied.
+ *
+ * React Native has had the missing half since the beginning, in
+ * `sdk/react-native/src/native-pending.ts`. This is the same
+ * conversion as that and as the Swift one, so a crash arrives
+ * identical whichever SDK sent it — the dashboard cannot tell and
+ * should not have to.
+ *
+ * Attachments captured before death are carried in the file and are
+ * **not** uploaded yet: that needs the attachment endpoint this
+ * package does not speak. They are left in place rather than silently
+ * dropped, and the event ships without them — a crash report with no
+ * screenshot beats no crash report.
+ */
+internal object SentoriPendingCrash {
+
+    /** Drain, convert, enqueue. Called once by [Sentori.start]. */
+    fun ship() {
+        val files = SentoriCrashHandler.consumePending()
+        if (files.isEmpty()) return
+
+        for (text in files) {
+            val raw =
+                try {
+                    JSONObject(text)
+                } catch (_: Throwable) {
+                    // One corrupt file must not cost the others.
+                    continue
+                }
+            // The screenshot and view tree the handler captured as the
+            // app died. They travel in the file and never on the wire —
+            // the server takes them separately, keyed on an event it
+            // must already have.
+            val blobs = raw.optJSONArray("_pendingAttachments")
+            raw.remove("_pendingAttachments")
+            val wire = toWire(raw)
+            val id = wire["id"] as? String
+
+            // Registered before this event is queued, and keyed on its
+            // id. Two races close here, and one of them was real: the
+            // first version registered after `flush`, which hands the
+            // send to a worker and returns — so on a fast network the
+            // batch was accepted before the block existed and the
+            // attachments never uploaded at all. Registering before the
+            // loop's flush is not enough either, since `enqueue` sends
+            // of its own accord once ten events are queued, and a run
+            // with ten crash files would flush mid-loop.
+            if (blobs != null && blobs.length() > 0 && id != null) {
+                SentoriTransport.afterDelivery(setOf(id)) {
+                    for (i in 0 until blobs.length()) {
+                        val blob = blobs.optJSONObject(i) ?: continue
+                        val kind = blob.optString("kind", "")
+                        val base64 = blob.optString("base64", "")
+                        if (kind.isEmpty() || base64.isEmpty()) continue
+                        SentoriAttachment.upload(
+                            eventId = id,
+                            kind = kind,
+                            base64 = base64,
+                            mediaType =
+                                blob.optString("mediaType", "").ifEmpty {
+                                    "application/octet-stream"
+                                },
+                            source = blob.optString("source", "").ifEmpty { "android" },
+                        )
+                    }
+                }
+            }
+            SentoriTransport.enqueue(wire)
+        }
+        SentoriTransport.flush()
+    }
+
+    /**
+     * The flat on-disk shape into the nested wire one. Mirrors
+     * `toWire` in `native-pending.ts` and `SentoriPendingCrash.swift`
+     * field for field.
+     */
+    fun toWire(raw: JSONObject): Map<String, Any?> {
+        val rawError = raw.optJSONObject("error") ?: JSONObject()
+        val rawStack = rawError.optJSONArray("stack") ?: JSONArray()
+        val frames =
+            (0 until rawStack.length()).mapNotNull { i ->
+                val f = rawStack.optJSONObject(i) ?: return@mapNotNull null
+                buildMap<String, Any?> {
+                    f.optString("file", "").takeIf { it.isNotEmpty() }?.let { put("file", it) }
+                    f.optString("function", "").takeIf { it.isNotEmpty() }
+                        ?.let { put("function", it) }
+                    if (f.has("line")) put("line", f.optInt("line"))
+                    if (f.has("inApp")) put("inApp", f.optBoolean("inApp"))
+                }
+            }
+
+        val payload =
+            mutableMapOf<String, Any?>(
+                "error" to
+                    mapOf(
+                        // A crash with no type is still a crash. The
+                        // default names what it is rather than leaving
+                        // the issue title empty.
+                        "type" to
+                            rawError.optString("type", "").ifEmpty { "NativeCrash" },
+                        "message" to rawError.optString("message", ""),
+                        "stack" to frames,
+                    ),
+                // Tells the dashboard this arrived from the grave
+                // rather than from a caught error — the difference
+                // between "the app died" and "the app noticed".
+                "nativeCrash" to true,
+            )
+        raw.optJSONObject("device")?.let { payload["device"] = it.toMap() }
+        raw.optJSONObject("app")?.let { payload["app"] = it.toMap() }
+
+        return mapOf(
+            "id" to raw.optString("id", "").ifEmpty { Sentori.newEventId() },
+            "kind" to "error",
+            // The file says `timestamp`; the wire says `occurredAt`.
+            // Keeping the crash's own time matters — it is the moment
+            // the app died, not the moment the next launch noticed.
+            "occurredAt" to
+                raw.optString("timestamp", "").ifEmpty {
+                    Sentori.iso8601(java.util.Date())
+                },
+            "platform" to if (raw.optString("platform") == "ios") "ios" else "android",
+            "release" to raw.optString("release", ""),
+            "environment" to raw.optString("environment", ""),
+            "payload" to payload,
+        )
+    }
+
+    private fun JSONObject.toMap(): Map<String, Any?> =
+        keys().asSequence().associateWith { k ->
+            when (val v = get(k)) {
+                is JSONObject -> v.toMap()
+                JSONObject.NULL -> null
+                else -> v
+            }
+        }
+}