@hot-updater/react-native 0.24.1 → 0.24.3

package/HotUpdater.podspec

@@ -11,7 +11,7 @@ Pod::Spec.new do |s|
   s.license      = package["license"]
   s.authors      = package["author"]
 
-  s.platforms    = { :ios => "13.4" }
+  s.platforms    = { :ios => "13.4", :tvos => "13.4" }
   s.source       = { :git => "https://github.com/gronxb/hot-updater.git", :tag => "#{s.version}" }
   s.source_files  = "ios/**/*.{h,m,mm,swift}"
   s.public_header_files = "ios/HotUpdater/Public/*.h"

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -382,9 +382,31 @@ class BundleFileStorageService(
             "updateBundle bundleId $bundleId fileUrl $fileUrl fileHash $fileHash",
         )
 
-        // If no URL is provided, reset to fallback
+        // If no URL is provided, reset to fallback and clean up all bundles
         if (fileUrl.isNullOrEmpty()) {
-            setBundleURL(null)
+            Log.d(TAG, "fileUrl is null or empty, resetting to fallback bundle")
+
+            withContext(Dispatchers.IO) {
+                // 1. Set bundle URL to null (reset preference)
+                val setResult = setBundleURL(null)
+                if (!setResult) {
+                    Log.w(TAG, "Failed to reset bundle URL")
+                }
+
+                // 2. Reset metadata to initial state (clear all bundle references)
+                val metadata = createInitialMetadata()
+                val saveResult = saveMetadata(metadata)
+                if (!saveResult) {
+                    Log.w(TAG, "Failed to reset metadata")
+                }
+
+                // 3. Clean up all downloaded bundles
+                // Pass null for currentBundleId to remove all bundles except the new bundleId
+                val bundleStoreDir = getBundleStoreDir()
+                cleanupOldBundles(bundleStoreDir, null, bundleId)
+
+                Log.d(TAG, "Successfully reset to fallback bundle and cleaned up downloads")
+            }
             return
         }
 

package/android/src/main/java/com/hotupdater/BundleMetadata.kt

@@ -25,8 +25,18 @@ data class BundleMetadata(
         fun fromJson(json: JSONObject): BundleMetadata =
             BundleMetadata(
                 schema = json.optString("schema", SCHEMA_VERSION),
-                stableBundleId = json.optString("stableBundleId", null)?.takeIf { it.isNotEmpty() },
-                stagingBundleId = json.optString("stagingBundleId", null)?.takeIf { it.isNotEmpty() },
+                stableBundleId =
+                    if (json.has("stableBundleId") && !json.isNull("stableBundleId")) {
+                        json.getString("stableBundleId").takeIf { it.isNotEmpty() }
+                    } else {
+                        null
+                    },
+                stagingBundleId =
+                    if (json.has("stagingBundleId") && !json.isNull("stagingBundleId")) {
+                        json.getString("stagingBundleId").takeIf { it.isNotEmpty() }
+                    } else {
+                        null
+                    },
                 verificationPending = json.optBoolean("verificationPending", false),
                 verificationAttemptedAt =
                     if (json.has("verificationAttemptedAt") && !json.isNull("verificationAttemptedAt")) {

package/android/src/main/java/com/hotupdater/ZipDecompressionStrategy.kt

@@ -5,6 +5,7 @@ import java.io.BufferedInputStream
 import java.io.File
 import java.io.FileInputStream
 import java.io.FileOutputStream
+import java.io.IOException
 import java.util.zip.CRC32
 import java.util.zip.ZipEntry
 import java.util.zip.ZipException
@@ -85,25 +86,31 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                 destinationDir.mkdirs()
             }
 
-            val totalEntries =
+            // Calculate total bytes to extract for accurate progress reporting
+            val totalBytes =
                 try {
                     ZipFile(File(filePath)).use { zipFile ->
-                        zipFile.entries().asSequence().count()
+                        zipFile
+                            .entries()
+                            .asSequence()
+                            .filter { !it.isDirectory }
+                            .sumOf { it.size }
                     }
                 } catch (e: Exception) {
-                    Log.d(TAG, "Failed to count entries: ${e.message}")
-                    0
+                    Log.d(TAG, "Failed to calculate total bytes: ${e.message}")
+                    0L
                 }
 
-            if (totalEntries == 0) {
-                Log.d(TAG, "No entries found in ZIP")
+            if (totalBytes == 0L) {
+                Log.d(TAG, "No content found in ZIP")
                 return false
             }
 
-            Log.d(TAG, "Extracting $totalEntries entries from ZIP")
+            Log.d(TAG, "Extracting $totalBytes bytes from ZIP")
 
             var extractedFileCount = 0
-            var processedEntries = 0
+            var extractedBytes = 0L
+            var lastReportedProgress = 0.0
 
             FileInputStream(filePath).use { fileInputStream ->
                 BufferedInputStream(fileInputStream).use { bufferedInputStream ->
@@ -112,10 +119,20 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                         while (entry != null) {
                             val file = File(destinationPath, entry.name)
 
-                            if (!file.canonicalPath.startsWith(destinationDir.canonicalPath)) {
-                                Log.w(TAG, "Skipping potentially malicious zip entry: ${entry.name}")
+                            // Zip Slip vulnerability check - verify entry path is within destination
+                            try {
+                                val canonicalDestPath = destinationDir.canonicalPath
+                                val canonicalFilePath = file.canonicalPath
+
+                                if (!canonicalFilePath.startsWith(canonicalDestPath)) {
+                                    Log.w(TAG, "Skipping potentially malicious zip entry: ${entry.name}")
+                                    entry = zipInputStream.nextEntry
+                                    continue
+                                }
+                            } catch (e: IOException) {
+                                // If we can't resolve canonical paths, treat as potentially malicious
+                                Log.w(TAG, "Failed to resolve canonical path for zip entry: ${entry.name}", e)
                                 entry = zipInputStream.nextEntry
-                                processedEntries++
                                 continue
                             }
 
@@ -132,6 +149,16 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                                     while (zipInputStream.read(buffer).also { bytesRead = it } != -1) {
                                         output.write(buffer, 0, bytesRead)
                                         crc.update(buffer, 0, bytesRead)
+
+                                        // Track bytes written for byte-based progress
+                                        extractedBytes += bytesRead
+
+                                        // Report progress more frequently (every 1%)
+                                        val currentProgress = extractedBytes.toDouble() / totalBytes
+                                        if (currentProgress - lastReportedProgress >= 0.01) {
+                                            progressCallback.invoke(currentProgress)
+                                            lastReportedProgress = currentProgress
+                                        }
                                     }
                                 }
 
@@ -145,11 +172,6 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                             }
 
                             zipInputStream.closeEntry()
-                            processedEntries++
-
-                            val progress = processedEntries.toDouble() / totalEntries
-                            progressCallback.invoke(progress)
-
                             entry = zipInputStream.nextEntry
                         }
                     }
@@ -161,7 +183,7 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                 return false
             }
 
-            Log.d(TAG, "Successfully extracted $extractedFileCount files")
+            Log.d(TAG, "Successfully extracted $extractedFileCount files ($extractedBytes bytes)")
             progressCallback.invoke(1.0)
             true
         } catch (e: ZipException) {

package/android/src/newarch/HotUpdaterModule.kt

@@ -1,8 +1,8 @@
 package com.hotupdater
 
+import android.os.Handler
+import android.os.Looper
 import android.util.Log
-import androidx.fragment.app.FragmentActivity
-import androidx.lifecycle.lifecycleScope
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.bridge.ReadableMap
@@ -11,6 +11,8 @@ import com.facebook.react.bridge.WritableNativeMap
 import com.facebook.react.modules.core.DeviceEventManagerModule
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 
 class HotUpdaterModule internal constructor(
@@ -18,15 +20,24 @@ class HotUpdaterModule internal constructor(
 ) : HotUpdaterSpec(reactContext) {
     private val mReactApplicationContext: ReactApplicationContext = reactContext
 
+    // Managed coroutine scope for the module lifecycle
+    private val moduleScope = CoroutineScope(SupervisorJob() + Dispatchers.Main)
+
     override fun getName(): String = NAME
 
+    override fun invalidate() {
+        super.invalidate()
+        // Cancel all ongoing coroutines when module is destroyed
+        moduleScope.cancel()
+    }
+
     /**
      * Gets the singleton HotUpdaterImpl instance
      */
     private fun getInstance(): HotUpdaterImpl = HotUpdater.getInstance(mReactApplicationContext)
 
     override fun reload(promise: Promise) {
-        CoroutineScope(Dispatchers.Main.immediate).launch {
+        moduleScope.launch {
             try {
                 val impl = getInstance()
                 val currentActivity = mReactApplicationContext.currentActivity
@@ -40,17 +51,11 @@ class HotUpdaterModule internal constructor(
     }
 
     override fun updateBundle(
-        params: ReadableMap?,
+        params: ReadableMap,
         promise: Promise,
     ) {
-        (mReactApplicationContext.currentActivity as FragmentActivity?)?.lifecycleScope?.launch {
+        moduleScope.launch {
             try {
-                // Parameter validation
-                if (params == null) {
-                    promise.reject("UNKNOWN_ERROR", "Missing or invalid parameters for updateBundle")
-                    return@launch
-                }
-
                 val bundleId = params.getString("bundleId")
                 if (bundleId == null || bundleId.isEmpty()) {
                     promise.reject("MISSING_BUNDLE_ID", "Missing or empty 'bundleId'")
@@ -78,15 +83,22 @@ class HotUpdaterModule internal constructor(
                     fileUrl,
                     fileHash,
                 ) { progress ->
-                    val progressParams =
-                        WritableNativeMap().apply {
-                            putDouble("progress", progress)
+                    // Post to Main thread for React Native event emission
+                    Handler(Looper.getMainLooper()).post {
+                        try {
+                            val progressParams =
+                                WritableNativeMap().apply {
+                                    putDouble("progress", progress)
+                                }
+
+                            this@HotUpdaterModule
+                                .mReactApplicationContext
+                                .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+                                ?.emit("onProgress", progressParams)
+                        } catch (e: Exception) {
+                            Log.w("HotUpdater", "Failed to emit progress (bridge may be unavailable): ${e.message}")
                         }
-
-                    this@HotUpdaterModule
-                        .mReactApplicationContext
-                        .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
-                        .emit("onProgress", progressParams)
+                    }
                 }
                 promise.resolve(true)
             } catch (e: HotUpdaterException) {
@@ -118,9 +130,9 @@ class HotUpdaterModule internal constructor(
         // No-op
     }
 
-    override fun notifyAppReady(params: ReadableMap?): WritableNativeMap {
+    override fun notifyAppReady(params: ReadableMap): WritableNativeMap {
         val result = WritableNativeMap()
-        val bundleId = params?.getString("bundleId")
+        val bundleId = params.getString("bundleId")
         if (bundleId == null) {
             result.putString("status", "STABLE")
             return result

package/android/src/oldarch/HotUpdaterModule.kt

@@ -1,8 +1,8 @@
 package com.hotupdater
 
+import android.os.Handler
+import android.os.Looper
 import android.util.Log
-import androidx.fragment.app.FragmentActivity
-import androidx.lifecycle.lifecycleScope
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.bridge.ReactMethod
@@ -11,6 +11,8 @@ import com.facebook.react.bridge.WritableNativeMap
 import com.facebook.react.modules.core.DeviceEventManagerModule
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 import org.json.JSONArray
 import org.json.JSONObject
@@ -20,8 +22,17 @@ class HotUpdaterModule internal constructor(
 ) : HotUpdaterSpec(context) {
     private val mReactApplicationContext: ReactApplicationContext = context
 
+    // Managed coroutine scope for the module lifecycle
+    private val moduleScope = CoroutineScope(SupervisorJob() + Dispatchers.Main)
+
     override fun getName(): String = NAME
 
+    override fun onCatalystInstanceDestroy() {
+        super.onCatalystInstanceDestroy()
+        // Cancel all ongoing coroutines when module is destroyed
+        moduleScope.cancel()
+    }
+
     /**
      * Gets the singleton HotUpdaterImpl instance
      */
@@ -29,7 +40,7 @@ class HotUpdaterModule internal constructor(
 
     @ReactMethod
     override fun reload(promise: Promise) {
-        CoroutineScope(Dispatchers.Main.immediate).launch {
+        moduleScope.launch {
             try {
                 val impl = getInstance()
                 val currentActivity = mReactApplicationContext.currentActivity
@@ -47,14 +58,8 @@ class HotUpdaterModule internal constructor(
         params: ReadableMap,
         promise: Promise,
     ) {
-        (mReactApplicationContext.currentActivity as FragmentActivity?)?.lifecycleScope?.launch {
+        moduleScope.launch {
             try {
-                // Parameter validation
-                if (params == null) {
-                    promise.reject("UNKNOWN_ERROR", "Missing or invalid parameters for updateBundle")
-                    return@launch
-                }
-
                 val bundleId = params.getString("bundleId")
                 if (bundleId == null || bundleId.isEmpty()) {
                     promise.reject("MISSING_BUNDLE_ID", "Missing or empty 'bundleId'")
@@ -82,15 +87,22 @@ class HotUpdaterModule internal constructor(
                     fileUrl,
                     fileHash,
                 ) { progress ->
-                    val progressParams =
-                        WritableNativeMap().apply {
-                            putDouble("progress", progress)
+                    // Post to Main thread for React Native event emission
+                    Handler(Looper.getMainLooper()).post {
+                        try {
+                            val progressParams =
+                                WritableNativeMap().apply {
+                                    putDouble("progress", progress)
+                                }
+
+                            this@HotUpdaterModule
+                                .mReactApplicationContext
+                                .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+                                ?.emit("onProgress", progressParams)
+                        } catch (e: Exception) {
+                            Log.w("HotUpdater", "Failed to emit progress (bridge may be unavailable): ${e.message}")
                         }
-
-                    this@HotUpdaterModule
-                        .mReactApplicationContext
-                        .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
-                        .emit("onProgress", progressParams)
+                    }
                 }
                 promise.resolve(true)
             } catch (e: HotUpdaterException) {
@@ -126,7 +138,7 @@ class HotUpdaterModule internal constructor(
 
     @ReactMethod(isBlockingSynchronousMethod = true)
     override fun notifyAppReady(params: ReadableMap): String {
-        val bundleId = params?.getString("bundleId")
+        val bundleId = params.getString("bundleId")
         val result = JSONObject()
 
         if (bundleId == null) {

package/ios/HotUpdater/Internal/URLSessionDownloadService.swift

@@ -1,4 +1,7 @@
 import Foundation
+#if !os(macOS)
+import UIKit
+#endif
 
 protocol DownloadService {
     /**
@@ -25,16 +28,70 @@ enum DownloadError: Error {
     case invalidContentLength
 }
 
+// Task state for persistence and recovery
+struct TaskState: Codable {
+    let taskIdentifier: Int
+    let destination: String
+    let bundleId: String
+    let startedAt: TimeInterval
+}
+
 class URLSessionDownloadService: NSObject, DownloadService {
     private var session: URLSession!
+    private var backgroundSession: URLSession!
     private var progressHandlers: [URLSessionTask: (Double) -> Void] = [:]
     private var completionHandlers: [URLSessionTask: (Result<URL, Error>) -> Void] = [:]
     private var destinations: [URLSessionTask: String] = [:]
+    private var taskStates: [Int: TaskState] = [:]
 
     override init() {
         super.init()
-        let configuration = URLSessionConfiguration.default
-        session = URLSession(configuration: configuration, delegate: self, delegateQueue: nil)
+
+        // Foreground session (existing behavior)
+        let defaultConfig = URLSessionConfiguration.default
+        session = URLSession(configuration: defaultConfig, delegate: self, delegateQueue: nil)
+
+        // Background session for persistent downloads
+        let backgroundConfig = URLSessionConfiguration.background(
+            withIdentifier: "com.hotupdater.background.download"
+        )
+        backgroundConfig.isDiscretionary = false
+        backgroundConfig.sessionSendsLaunchEvents = true
+        backgroundSession = URLSession(configuration: backgroundConfig, delegate: self, delegateQueue: nil)
+
+        // Load persisted task states
+        taskStates = loadTaskStates()
+    }
+
+    // MARK: - State Persistence
+
+    private var stateFileURL: URL {
+        let documentsPath = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)[0]
+        return documentsPath.appendingPathComponent("download-state.json")
+    }
+
+    private func saveTaskState(_ state: TaskState) {
+        taskStates[state.taskIdentifier] = state
+
+        if let data = try? JSONEncoder().encode(taskStates) {
+            try? data.write(to: stateFileURL)
+        }
+    }
+
+    private func loadTaskStates() -> [Int: TaskState] {
+        guard let data = try? Data(contentsOf: stateFileURL),
+              let states = try? JSONDecoder().decode([Int: TaskState].self, from: data) else {
+            return [:]
+        }
+        return states
+    }
+
+    private func removeTaskState(_ taskIdentifier: Int) {
+        taskStates.removeValue(forKey: taskIdentifier)
+
+        if let data = try? JSONEncoder().encode(taskStates) {
+            try? data.write(to: stateFileURL)
+        }
     }
 
     func getFileSize(from url: URL, completion: @escaping (Result<Int64, Error>) -> Void) {
@@ -66,10 +123,39 @@ class URLSessionDownloadService: NSObject, DownloadService {
     }
 
     func downloadFile(from url: URL, to destination: String, progressHandler: @escaping (Double) -> Void, completion: @escaping (Result<URL, Error>) -> Void) -> URLSessionDownloadTask? {
-        let task = session.downloadTask(with: url)
+        // Determine if we should use background session
+        #if !os(macOS)
+        let appState = UIApplication.shared.applicationState
+        let useBackgroundSession = (appState == .background || appState == .inactive)
+        #else
+        let useBackgroundSession = false
+        #endif
+
+        let selectedSession = useBackgroundSession ? backgroundSession : session
+        let task = selectedSession?.downloadTask(with: url)
+
+        guard let task = task else {
+            return nil
+        }
+
         progressHandlers[task] = progressHandler
         completionHandlers[task] = completion
         destinations[task] = destination
+
+        // Extract bundleId from destination path (e.g., "bundle-store/{bundleId}/bundle.zip")
+        let bundleId = (destination as NSString).pathComponents
+            .dropFirst()
+            .first(where: { $0 != "bundle-store" }) ?? "unknown"
+
+        // Save task metadata for background recovery
+        let taskState = TaskState(
+            taskIdentifier: task.taskIdentifier,
+            destination: destination,
+            bundleId: bundleId,
+            startedAt: Date().timeIntervalSince1970
+        )
+        saveTaskState(taskState)
+
         task.resume()
         return task
     }
@@ -84,6 +170,7 @@ extension URLSessionDownloadService: URLSessionDownloadDelegate {
             progressHandlers.removeValue(forKey: downloadTask)
             completionHandlers.removeValue(forKey: downloadTask)
             destinations.removeValue(forKey: downloadTask)
+            removeTaskState(downloadTask.taskIdentifier)
 
             // 다운로드 완료 알림
             NotificationCenter.default.post(name: .downloadDidFinish, object: downloadTask)
@@ -136,10 +223,11 @@ extension URLSessionDownloadService: URLSessionDownloadDelegate {
             progressHandlers.removeValue(forKey: task)
             completionHandlers.removeValue(forKey: task)
             destinations.removeValue(forKey: task)
-            
+            removeTaskState(task.taskIdentifier)
+
             NotificationCenter.default.post(name: .downloadDidFinish, object: task)
         }
-        
+
         if let error = error {
             completion?(.failure(error))
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/react-native",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "React Native OTA solution for self-hosted",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -120,14 +120,14 @@
     "react-native": "0.79.1",
     "react-native-builder-bob": "^0.40.10",
     "typescript": "^5.8.3",
-    "hot-updater": "0.24.1"
+    "hot-updater": "0.24.3"
   },
   "dependencies": {
     "use-sync-external-store": "1.5.0",
-    "@hot-updater/cli-tools": "0.24.1",
-    "@hot-updater/core": "0.24.1",
-    "@hot-updater/plugin-core": "0.24.1",
-    "@hot-updater/js": "0.24.1"
+    "@hot-updater/js": "0.24.3",
+    "@hot-updater/plugin-core": "0.24.3",
+    "@hot-updater/cli-tools": "0.24.3",
+    "@hot-updater/core": "0.24.3"
   },
   "scripts": {
     "build": "bob build && tsc -p plugin/tsconfig.build.json",