@hot-updater/react-native 1.0.0-rc.14 → 1.0.0-rc.16

package/ios/HotUpdater/Internal/BundleMetadata.swift

@@ -84,6 +84,7 @@ public struct BundleMetadata: Codable {
     var stableSelection: PersistedSelection?
     var stagingSelection: PersistedSelection?
     var verificationPending: Bool
+    var launchInProgress: Bool
     var pendingTransition: PendingBundleTransition?
     var pendingSelectionTransition: PendingSelectionTransition?
     var highestSeenCatalogs: [String: CatalogHighWater]
@@ -98,6 +99,7 @@ public struct BundleMetadata: Codable {
         case stableSelection = "stable_selection"
         case stagingSelection = "staging_selection"
         case verificationPending = "verification_pending"
+        case launchInProgress = "launch_in_progress"
         case pendingTransition = "pending_transition"
         case pendingSelectionTransition = "pending_selection_transition"
         case highestSeenCatalogs = "highest_seen_catalogs"
@@ -113,6 +115,7 @@ public struct BundleMetadata: Codable {
         stableSelection: PersistedSelection? = nil,
         stagingSelection: PersistedSelection? = nil,
         verificationPending: Bool = false,
+        launchInProgress: Bool = false,
         pendingTransition: PendingBundleTransition? = nil,
         pendingSelectionTransition: PendingSelectionTransition? = nil,
         highestSeenCatalogs: [String: CatalogHighWater] = [:],
@@ -126,6 +129,7 @@ public struct BundleMetadata: Codable {
         self.stableSelection = stableSelection
         self.stagingSelection = stagingSelection
         self.verificationPending = verificationPending
+        self.launchInProgress = launchInProgress
         self.pendingTransition = pendingTransition
         self.pendingSelectionTransition = pendingSelectionTransition
         self.highestSeenCatalogs = highestSeenCatalogs
@@ -144,6 +148,7 @@ public struct BundleMetadata: Codable {
         stagingSelection = try values.decodeIfPresent(PersistedSelection.self, forKey: .stagingSelection)
             ?? stagingBundleId.map(PersistedSelection.legacyBundle)
         verificationPending = try values.decodeIfPresent(Bool.self, forKey: .verificationPending) ?? false
+        launchInProgress = try values.decodeIfPresent(Bool.self, forKey: .launchInProgress) ?? false
         pendingTransition = try values.decodeIfPresent(PendingBundleTransition.self, forKey: .pendingTransition)
         pendingSelectionTransition = try values.decodeIfPresent(PendingSelectionTransition.self, forKey: .pendingSelectionTransition)
         highestSeenCatalogs = try values.decodeIfPresent([String: CatalogHighWater].self, forKey: .highestSeenCatalogs) ?? [:]

package/ios/HotUpdater/Internal/FileUtilities.swift

@@ -0,0 +1,64 @@
+import Foundation
+
+enum FileUtilities {
+    static func readUpToCount(from handle: FileHandle, count: Int) throws -> Data? {
+        guard count >= 0 else {
+            throw NSError(
+                domain: "FileUtilities",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
+            )
+        }
+
+        if count == 0 {
+            return Data()
+        }
+
+        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
+            return try handle.read(upToCount: count)
+        }
+
+        return handle.readData(ofLength: count)
+    }
+
+    static func normalizedRelativePath(from rawPath: String) -> String? {
+        let candidate = rawPath.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !candidate.isEmpty,
+              !candidate.contains("\0"),
+              !candidate.contains("\\"),
+              !candidate.hasPrefix("/"),
+              candidate.range(of: #"^[A-Za-z]:"#, options: .regularExpression) == nil
+        else {
+            return nil
+        }
+
+        let components = candidate.split(separator: "/").map(String.init)
+        guard !components.isEmpty,
+              components.count == candidate.split(separator: "/", omittingEmptySubsequences: false).count,
+              !components.contains(".."),
+              !components.contains(".")
+        else {
+            return nil
+        }
+
+        return components.joined(separator: "/")
+    }
+
+    static func fileURL(for relativePath: String, destinationRoot: String) throws -> URL {
+        let rootURL = URL(fileURLWithPath: destinationRoot, isDirectory: true)
+        let targetURL = rootURL.appendingPathComponent(relativePath)
+        let standardizedRoot = rootURL.standardizedFileURL.path
+        let standardizedTarget = targetURL.standardizedFileURL.path
+
+        guard standardizedTarget == standardizedRoot ||
+                standardizedTarget.hasPrefix(standardizedRoot + "/") else {
+            throw NSError(
+                domain: "FileUtilities",
+                code: 2,
+                userInfo: [NSLocalizedDescriptionKey: "Path traversal attempt detected: \(relativePath)"]
+            )
+        }
+
+        return targetURL
+    }
+}

package/ios/HotUpdater/Internal/HotUpdater-Bridging-Header.h

@@ -7,7 +7,6 @@
 #import "React/RCTConstants.h"
 #import "React/RCTRootView.h"
 #import "React/RCTUtils.h" // Needed for RCTPromiseResolveBlock/RejectBlock in Swift
-#import <SSZipArchive/SSZipArchive.h>
 #import "BsdiffPatchBridge.h"
 
 @interface HotUpdaterRecoverySignalBridge : NSObject

package/ios/HotUpdater/Internal/HotUpdater.mm

@@ -274,8 +274,6 @@ extern "C" void *HotUpdaterCopyMinBundleId(void)
 
 
 // Define Notification names used for observing Swift Core
-NSNotificationName const HotUpdaterDownloadProgressUpdateNotification = @"HotUpdaterDownloadProgressUpdate";
-NSNotificationName const HotUpdaterDownloadDidFinishNotification = @"HotUpdaterDownloadDidFinish";
 NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUpdaterUpdateProgressDidChange";
 
 @interface HotUpdaterRecoverySignalBridge : NSObject
@@ -300,8 +298,6 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
 
 @implementation HotUpdater {
     bool hasListeners;
-    // Keep track of tasks ONLY for removing observers when this ObjC instance is invalidated
-    NSMutableSet<NSURLSessionTask *> *observedTasks; // Changed to NSURLSessionTask for broader compatibility if needed
 }
 
 @synthesize bridge = _bridge;
@@ -314,16 +310,10 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
 - (instancetype)init {
     self = [super init];
     if (self) {
-        observedTasks = [NSMutableSet set];
-
         [[NSNotificationCenter defaultCenter] addObserver:self
                                                  selector:@selector(handleDownloadProgress:)
                                                      name:HotUpdaterUpdateProgressDidChangeNotification
                                                    object:nil];
-        [[NSNotificationCenter defaultCenter] addObserver:self
-                                                 selector:@selector(handleDownloadCompletion:)
-                                                     name:HotUpdaterDownloadDidFinishNotification
-                                                   object:nil];
 
         _lastUpdateTime = 0;
     }
@@ -349,7 +339,6 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
     if (gHotUpdaterBridge == self.bridge) {
         gHotUpdaterBridge = nil;
     }
-    // Swift side should handle KVO observer removal for its tasks
     [super invalidate];
 }
 
@@ -520,14 +509,6 @@ RCT_EXPORT_MODULE();
      }
  }
 
-- (void)handleDownloadCompletion:(NSNotification *)notification {
-      NSURLSessionTask *task = notification.object; // Task that finished
-      RCTLogInfo(@"[HotUpdater.mm] Received download completion notification for task: %@", task.originalRequest.URL);
-      // Swift side handles KVO observer removal internally now when task finishes.
-      // No specific cleanup needed here based on this notification anymore.
-}
-
-
 #pragma mark - React Native Events (Keep as is)
 
 - (NSArray<NSString *> *)supportedEvents {
@@ -594,20 +575,17 @@ RCT_EXPORT_MODULE();
     if (params.bundleId()) {
         paramDict[@"bundleId"] = params.bundleId();
     }
-    if (params.fileUrl()) {
-        paramDict[@"fileUrl"] = params.fileUrl();
-    }
-    if (params.fileHash()) {
-        paramDict[@"fileHash"] = params.fileHash();
-    }
     if (params.manifestUrl()) {
         paramDict[@"manifestUrl"] = params.manifestUrl();
     }
     if (params.manifestFileHash()) {
         paramDict[@"manifestFileHash"] = params.manifestFileHash();
     }
-    if (params.changedAssets()) {
-        paramDict[@"changedAssets"] = params.changedAssets();
+    if (params.archiveUrl()) {
+        paramDict[@"archiveUrl"] = params.archiveUrl();
+    }
+    if (params.assets()) {
+        paramDict[@"assets"] = params.assets();
     }
     if (params.channel()) {
         paramDict[@"channel"] = params.channel();

package/ios/HotUpdater/Internal/HotUpdaterImpl.swift

@@ -61,6 +61,21 @@ private func hotUpdaterGetMinBundleId() -> String {
     private static let DEFAULT_CHANNEL = "production"
     private static let CHANNEL_STORAGE_KEY = "HotUpdaterChannel"
 
+    private static func parseSafeByteSize(_ value: Any?) -> Int64? {
+        guard let number = value as? NSNumber,
+              String(cString: number.objCType) != "c" else {
+            return nil
+        }
+        let doubleValue = number.doubleValue
+        guard doubleValue.isFinite,
+              doubleValue >= 0,
+              doubleValue <= 9_007_199_254_740_991,
+              doubleValue.rounded(.towardZero) == doubleValue else {
+            return nil
+        }
+        return Int64(doubleValue)
+    }
+
     // MARK: - Initialization
 
     /**
@@ -71,12 +86,9 @@ private func hotUpdaterGetMinBundleId() -> String {
         let isolationKey = HotUpdaterImpl.getIsolationKey()
         let preferences = VersionedPreferencesService()
         let downloadService = URLSessionDownloadService()
-        let decompressService = DecompressService()
-
         let bundleStorage = BundleFileStorageService(
             fileSystem: fileSystem,
             downloadService: downloadService,
-            decompressService: decompressService,
             preferences: preferences,
             isolationKey: isolationKey,
             builtInBundleIdProvider: { HotUpdaterImpl.minBundleId() }
@@ -231,7 +243,7 @@ private func hotUpdaterGetMinBundleId() -> String {
     /**
      * Updates the bundle from JavaScript bridge.
      * This method acts as the primary error boundary for all bundle operations.
-     * @param params Dictionary with bundleId and fileUrl parameters
+     * @param params Dictionary with bundleId, manifest, and asset parameters
      * @param resolve Promise resolve callback
      * @param reject Promise reject callback
      */
@@ -255,36 +267,40 @@ private func hotUpdaterGetMinBundleId() -> String {
                 return
             }
 
-            let fileUrlString = data["fileUrl"] as? String ?? ""
-
-            var fileUrl: URL? = nil
-            if !fileUrlString.isEmpty {
-                guard let url = URL(string: fileUrlString) else {
-                    let error = NSError(domain: "HotUpdater", code: 0,
-                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'fileUrl' provided: \(fileUrlString)"])
-                    reject("INVALID_FILE_URL", error.localizedDescription, error)
-                    return
-                }
-                fileUrl = url
+            guard let manifestFileHash = data["manifestFileHash"] as? String,
+                  !manifestFileHash.isEmpty else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Missing manifest file hash"])
+                reject("INVALID_MANIFEST", error.localizedDescription, error)
+                return
             }
-
-            // Extract fileHash if provided
-            let fileHash = data["fileHash"] as? String
-            let manifestFileHash = data["manifestFileHash"] as? String
             let channel = data["channel"] as? String
             let manifestUrlString = data["manifestUrl"] as? String ?? ""
-            var manifestUrl: URL? = nil
-            if !manifestUrlString.isEmpty {
-                guard let url = URL(string: manifestUrlString) else {
+            guard let manifestUrl = URL(string: manifestUrlString) else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Invalid 'manifestUrl' provided: \(manifestUrlString)"])
+                reject("INVALID_FILE_URL", error.localizedDescription, error)
+                return
+            }
+            let archiveUrl: URL?
+            if let archiveUrlString = data["archiveUrl"] as? String {
+                guard let parsedArchiveUrl = URL(string: archiveUrlString) else {
                     let error = NSError(domain: "HotUpdater", code: 0,
-                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'manifestUrl' provided: \(manifestUrlString)"])
+                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'archiveUrl' provided: \(archiveUrlString)"])
                     reject("INVALID_FILE_URL", error.localizedDescription, error)
                     return
                 }
-                manifestUrl = url
+                archiveUrl = parsedArchiveUrl
+            } else {
+                archiveUrl = nil
+            }
+            guard let assetsPayload = data["assets"] as? [String: [String: Any]] else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Missing manifest assets"])
+                reject("INVALID_MANIFEST", error.localizedDescription, error)
+                return
             }
-            let changedAssetsPayload = data["changedAssets"] as? [String: [String: Any]]
-            let changedAssets = changedAssetsPayload?.reduce(into: [String: ChangedAssetDescriptor]()) { partialResult, entry in
+            let assets = assetsPayload.reduce(into: [String: ChangedAssetDescriptor]()) { partialResult, entry in
                 guard let fileHash = entry.value["fileHash"] as? String,
                       !fileHash.isEmpty
                 else {
@@ -308,7 +324,8 @@ private func hotUpdaterGetMinBundleId() -> String {
                         baseBundleId: baseBundleId,
                         baseFileHash: baseFileHash,
                         patchFileHash: patchFileHash,
-                        patchUrl: patchUrl
+                        patchUrl: patchUrl,
+                        byteSize: Self.parseSafeByteSize(payload["byteSize"])
                     )
                 }
                 let filePayload = entry.value["file"] as? [String: Any]
@@ -339,10 +356,10 @@ private func hotUpdaterGetMinBundleId() -> String {
             // Extract progress callback if provided
             let progressCallback = data["progressCallback"] as? RCTResponseSenderBlock
 
-            NSLog("[HotUpdaterImpl] updateBundle called with bundleId: \(bundleId), fileUrl: \(fileUrl?.absoluteString ?? "nil"), fileHash: \(fileHash ?? "nil")")
+            NSLog("[HotUpdaterImpl] updateBundle called with bundleId: \(bundleId), manifestUrl: \(manifestUrl.absoluteString)")
 
             // Heavy work is delegated to bundle storage service with safe error handling
-            bundleStorage.updateBundle(bundleId: bundleId, fileUrl: fileUrl, fileHash: fileHash, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, changedAssets: changedAssets, progressHandler: { payload in
+            bundleStorage.updateBundle(bundleId: bundleId, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, archiveUrl: archiveUrl, assets: assets, progressHandler: { payload in
                 DispatchQueue.main.async {
                     NotificationCenter.default.post(
                         name: .updateProgressDidChange,
@@ -544,7 +561,6 @@ private func hotUpdaterGetMinBundleId() -> String {
         "DIRECTORY_CREATION_FAILED",
         "DOWNLOAD_FAILED",
         "INCOMPLETE_DOWNLOAD",
-        "EXTRACTION_FORMAT_ERROR",
         "INVALID_BUNDLE",
         "INSUFFICIENT_DISK_SPACE",
         "SIGNATURE_VERIFICATION_FAILED",
@@ -614,7 +630,7 @@ private func hotUpdaterGetMinBundleId() -> String {
 
     /**
      * Gets the current active bundle ID from bundle storage.
-     * Reads manifest.json first and falls back to the legacy BUNDLE_ID file.
+     * Reads the required OTA manifest.json.
      * Built-in bundle fallback is handled in JS.
      */
     public func getBundleId() -> String? {

package/ios/HotUpdater/Internal/NotificationExtension.swift

@@ -1,7 +1,5 @@
 import Foundation
 
 extension Notification.Name {
-    static let downloadProgressUpdate = Notification.Name("HotUpdaterDownloadProgressUpdate")
-    static let downloadDidFinish = Notification.Name("HotUpdaterDownloadDidFinish")
     static let updateProgressDidChange = Notification.Name("HotUpdaterUpdateProgressDidChange")
 }