@hot-updater/react-native 1.0.0-rc.2 → 1.0.0-rc.21

package/android/src/main/java/com/hotupdater/TarBrArchiveExtractor.kt

@@ -0,0 +1,119 @@
+package com.hotupdater
+
+import com.hotupdater.vendor.brotli.dec.BrotliInputStream
+import java.io.File
+import java.io.FileInputStream
+import java.io.IOException
+import java.io.InputStream
+
+internal object TarBrArchiveExtractor {
+    fun extract(
+        archiveFile: File,
+        destination: File,
+        expectedTarByteSize: Long,
+        expectedFiles: Map<String, Long>,
+    ) {
+        require(expectedTarByteSize >= 0) { "Invalid TAR byte size" }
+        if (destination.exists() && !destination.deleteRecursively()) {
+            throw IOException("Cannot clear archive extraction directory")
+        }
+        if (!destination.mkdirs()) throw IOException("Cannot create archive extraction directory")
+
+        try {
+            FileInputStream(archiveFile).use { compressedInput ->
+                BrotliInputStream(compressedInput).use { brotliInput ->
+                    val boundedInput = ExactSizeInputStream(brotliInput, expectedTarByteSize)
+                    TarArchiveInputStream(boundedInput).use { tarInput ->
+                        val extractedPaths = linkedSetOf<String>()
+                        var entry = tarInput.getNextEntry()
+                        while (entry != null) {
+                            if (!entry.isRegularFile) {
+                                throw IOException("Unsupported TAR entry type for ${entry.name}")
+                            }
+                            val normalizedPath = RelativePathResolver.normalizeRelativePath(entry.name)
+                            if (normalizedPath == null || normalizedPath != entry.name) {
+                                throw IOException("Unsafe TAR entry path: ${entry.name}")
+                            }
+                            val expectedSize =
+                                expectedFiles[normalizedPath]
+                                    ?: throw IOException("Unexpected TAR entry: $normalizedPath")
+                            if (!extractedPaths.add(normalizedPath)) {
+                                throw IOException("Duplicate TAR entry: $normalizedPath")
+                            }
+                            if (entry.size != expectedSize) {
+                                throw IOException("TAR entry size mismatch: $normalizedPath")
+                            }
+
+                            val outputFile =
+                                RelativePathResolver.resolveInside(destination, normalizedPath)
+                                    ?: throw IOException("Unsafe TAR entry path: $normalizedPath")
+                            if (outputFile.exists()) throw IOException("TAR output already exists: $normalizedPath")
+                            val parentDirectory = outputFile.parentFile
+                            if (parentDirectory != null && !parentDirectory.isDirectory && !parentDirectory.mkdirs()) {
+                                throw IOException("Cannot create TAR output directory: $normalizedPath")
+                            }
+                            outputFile.outputStream().use { output ->
+                                val buffer = ByteArray(8192)
+                                var written = 0L
+                                while (true) {
+                                    val count = tarInput.read(buffer)
+                                    if (count < 0) break
+                                    output.write(buffer, 0, count)
+                                    written += count
+                                }
+                                if (written != expectedSize) {
+                                    throw IOException("TAR entry was truncated: $normalizedPath")
+                                }
+                            }
+                            entry = tarInput.getNextEntry()
+                        }
+
+                        if (extractedPaths != expectedFiles.keys) {
+                            throw IOException("TAR file set does not match manifest")
+                        }
+                    }
+                    boundedInput.requireExactSize()
+                }
+            }
+        } catch (error: Throwable) {
+            destination.deleteRecursively()
+            throw error
+        }
+    }
+
+    private class ExactSizeInputStream(
+        private val input: InputStream,
+        private val expectedSize: Long,
+    ) : InputStream() {
+        private var byteCount = 0L
+
+        override fun read(): Int {
+            val result = input.read()
+            if (result >= 0) recordRead(1)
+            return result
+        }
+
+        override fun read(
+            buffer: ByteArray,
+            offset: Int,
+            length: Int,
+        ): Int {
+            val count = input.read(buffer, offset, length)
+            if (count > 0) recordRead(count.toLong())
+            return count
+        }
+
+        fun requireExactSize() {
+            if (byteCount != expectedSize) {
+                throw IOException("TAR stream size mismatch: expected $expectedSize, got $byteCount")
+            }
+        }
+
+        private fun recordRead(count: Long) {
+            if (byteCount > expectedSize - count) {
+                throw IOException("TAR stream exceeds declared size")
+            }
+            byteCount += count
+        }
+    }
+}

package/android/src/newarch/HotUpdater.kt

@@ -36,7 +36,7 @@ class HotUpdater {
          * Updates the bundle using the default singleton instance
          * @param context Application context
          * @param bundleId ID of the bundle to update
-         * @param fileUrl URL of the bundle file to download (or null to reset)
+         * @param params Manifest and asset descriptors for the target bundle
          * @param fileHash Combined hash string for verification (sig:<signature> or <hex_hash>)
          * @param progressCallback Callback for download progress updates
          * @throws HotUpdaterException if the update fails
@@ -44,22 +44,20 @@ class HotUpdater {
         suspend fun updateBundle(
             context: Context,
             bundleId: String,
-            fileUrl: String?,
-            fileHash: String?,
-            manifestUrl: String?,
-            manifestFileHash: String?,
-            changedAssets: Map<String, ChangedAssetDescriptor>?,
+            manifestUrl: String,
+            manifestFileHash: String,
+            assets: Map<String, ChangedAssetDescriptor>,
             channel: String?,
+            archiveUrl: String? = null,
             progressCallback: (UpdateProgressPayload) -> Unit,
         ) {
             getInstance(context).updateBundle(
                 bundleId,
-                fileUrl,
-                fileHash,
                 manifestUrl,
                 manifestFileHash,
-                changedAssets,
+                assets,
                 channel,
+                archiveUrl = archiveUrl,
                 progressCallback = progressCallback,
             )
         }

package/android/src/newarch/HotUpdaterModule.kt

@@ -26,6 +26,16 @@ class HotUpdaterModule internal constructor(
 
     override fun getName(): String = NAME
 
+    private fun readSafeInteger(
+        map: ReadableMap,
+        key: String,
+    ): Long? {
+        if (!map.hasKey(key) || map.isNull(key)) return null
+        val value = runCatching { map.getDouble(key) }.getOrNull() ?: return null
+        if (!value.isFinite() || value % 1.0 != 0.0) return null
+        return value.toLong().takeIf { it in 0..9_007_199_254_740_991L }
+    }
+
     override fun invalidate() {
         super.invalidate()
         // Cancel all ongoing coroutines when module is destroyed
@@ -37,12 +47,12 @@ class HotUpdaterModule internal constructor(
      */
     private fun getInstance(): HotUpdaterImpl = HotUpdater.getInstance(mReactApplicationContext)
 
-    private fun parseChangedAssets(params: ReadableMap): Map<String, ChangedAssetDescriptor>? {
-        if (!params.hasKey("changedAssets") || params.isNull("changedAssets")) {
+    private fun parseAssets(params: ReadableMap): Map<String, ChangedAssetDescriptor>? {
+        if (!params.hasKey("assets") || params.isNull("assets")) {
             return null
         }
 
-        val changedAssetsMap = params.getMap("changedAssets") ?: return null
+        val changedAssetsMap = params.getMap("assets") ?: return null
         val parsedAssets = linkedMapOf<String, ChangedAssetDescriptor>()
         val iterator = changedAssetsMap.keySetIterator()
 
@@ -58,6 +68,7 @@ class HotUpdaterModule internal constructor(
                     val baseFileHash = patchMap.getString("baseFileHash")
                     val patchFileHash = patchMap.getString("patchFileHash")
                     val patchUrl = patchMap.getString("patchUrl")
+                    val byteSize = readSafeInteger(patchMap, "byteSize")
 
                     if (
                         algorithm != null &&
@@ -72,6 +83,7 @@ class HotUpdaterModule internal constructor(
                             baseFileHash = baseFileHash,
                             patchFileHash = patchFileHash,
                             patchUrl = patchUrl,
+                            byteSize = byteSize,
                         )
                     } else {
                         null
@@ -162,97 +174,112 @@ class HotUpdaterModule internal constructor(
             try {
                 val bundleId = params.getString("bundleId")
                 if (bundleId == null || bundleId.isEmpty()) {
-                    promise.reject("MISSING_BUNDLE_ID", "Missing or empty 'bundleId'")
+                    promise.rejectUpdateBundle(HotUpdaterException.missingBundleId())
                     return@launch
                 }
 
-                val fileUrl = params.getString("fileUrl")
-
-                // Validate fileUrl format if provided
-                if (fileUrl != null && fileUrl.isNotEmpty()) {
+                val manifestUrl = params.getString("manifestUrl")
+                val manifestFileHash = params.getString("manifestFileHash")
+                val assets = parseAssets(params)
+                if (manifestUrl.isNullOrEmpty() || manifestFileHash.isNullOrEmpty() || assets == null) {
+                    promise.rejectUpdateBundle(HotUpdaterException.invalidManifestParams())
+                    return@launch
+                }
+                try {
+                    java.net.URL(manifestUrl)
+                } catch (e: java.net.MalformedURLException) {
+                    promise.rejectUpdateBundle(
+                        HotUpdaterException.invalidFileUrl("manifestUrl", manifestUrl, UpdateFailureResource.MANIFEST),
+                    )
+                    return@launch
+                }
+                val channel = params.getString("channel")
+                val archiveUrl =
+                    if (params.hasKey("archiveUrl") && !params.isNull("archiveUrl")) {
+                        params.getString("archiveUrl")
+                    } else {
+                        null
+                    }
+                if (archiveUrl != null) {
                     try {
-                        java.net.URL(fileUrl)
+                        java.net.URL(archiveUrl)
                     } catch (e: java.net.MalformedURLException) {
-                        promise.reject("INVALID_FILE_URL", "Invalid 'fileUrl' provided: $fileUrl")
+                        promise.rejectUpdateBundle(
+                            HotUpdaterException.invalidFileUrl("archiveUrl", archiveUrl, UpdateFailureResource.ARCHIVE),
+                        )
                         return@launch
                     }
                 }
-
-                val fileHash = params.getString("fileHash")
-                val manifestUrl = params.getString("manifestUrl")
-                val manifestFileHash = params.getString("manifestFileHash")
-                val changedAssets = parseChangedAssets(params)
-                val channel = params.getString("channel")
                 val selection = parseSelection(params)
 
                 val impl = getInstance()
 
-                impl.updateBundle(
-                    bundleId,
-                    fileUrl,
-                    fileHash,
-                    manifestUrl,
-                    manifestFileHash,
-                    changedAssets,
-                    channel,
-                    selection,
-                ) { progress ->
-                    // Post to Main thread for React Native event emission
-                    Handler(Looper.getMainLooper()).post {
-                        try {
-                            val progressParams =
-                                WritableNativeMap().apply {
-                                    putDouble("progress", progress.progress)
-                                    putString("artifactType", progress.artifactType)
-                                    progress.downloadedBytes?.let { putDouble("downloadedBytes", it.toDouble()) }
-                                    progress.totalBytes?.let { putDouble("totalBytes", it.toDouble()) }
-                                    progress.details?.let { details ->
-                                        putMap(
-                                            "details",
-                                            WritableNativeMap().apply {
-                                                putInt("totalFilesCount", details.totalFilesCount)
-                                                putInt("completedFilesCount", details.completedFilesCount)
-                                                putArray(
-                                                    "files",
-                                                    WritableNativeArray().apply {
-                                                        details.files.forEach { file ->
-                                                            pushMap(
-                                                                WritableNativeMap().apply {
-                                                                    putString("path", file.path)
-                                                                    putString("downloadPath", file.downloadPath)
-                                                                    putString("status", file.status)
-                                                                    putDouble("progress", file.progress)
-                                                                    putInt("order", file.order)
-                                                                    file.downloadedBytes?.let {
-                                                                        putDouble(
-                                                                            "downloadedBytes",
-                                                                            it.toDouble(),
-                                                                        )
-                                                                    }
-                                                                    file.totalBytes?.let { putDouble("totalBytes", it.toDouble()) }
-                                                                },
-                                                            )
-                                                        }
-                                                    },
-                                                )
-                                            },
-                                        )
+                val result =
+                    impl.updateBundle(
+                        bundleId,
+                        manifestUrl,
+                        manifestFileHash,
+                        assets,
+                        channel,
+                        selection,
+                        archiveUrl,
+                    ) { progress ->
+                        // Post to Main thread for React Native event emission
+                        Handler(Looper.getMainLooper()).post {
+                            try {
+                                val progressParams =
+                                    WritableNativeMap().apply {
+                                        putDouble("progress", progress.progress)
+                                        putString("artifactType", progress.artifactType)
+                                        progress.details?.let { details ->
+                                            putMap(
+                                                "details",
+                                                WritableNativeMap().apply {
+                                                    putInt("totalFilesCount", details.totalFilesCount)
+                                                    putInt("completedFilesCount", details.completedFilesCount)
+                                                    putArray(
+                                                        "files",
+                                                        WritableNativeArray().apply {
+                                                            details.files.forEach { file ->
+                                                                pushMap(
+                                                                    WritableNativeMap().apply {
+                                                                        putString("path", file.path)
+                                                                        putString("downloadPath", file.downloadPath)
+                                                                        putString("status", file.status)
+                                                                        putDouble("progress", file.progress)
+                                                                        putInt("order", file.order)
+                                                                        file.downloadedBytes?.let {
+                                                                            putDouble(
+                                                                                "downloadedBytes",
+                                                                                it.toDouble(),
+                                                                            )
+                                                                        }
+                                                                        file.totalBytes?.let { putDouble("totalBytes", it.toDouble()) }
+                                                                    },
+                                                                )
+                                                            }
+                                                        },
+                                                    )
+                                                },
+                                            )
+                                        }
                                     }
-                                }
-
-                            this@HotUpdaterModule
-                                .mReactApplicationContext
-                                .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
-                                ?.emit("onProgress", progressParams)
-                        } catch (e: Exception) {
-                            Log.w("HotUpdater", "Failed to emit progress (bridge may be unavailable): ${e.message}")
+
+                                this@HotUpdaterModule
+                                    .mReactApplicationContext
+                                    .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+                                    ?.emit("onProgress", progressParams)
+                            } catch (e: Exception) {
+                                Log.w("HotUpdater", "Failed to emit progress (bridge may be unavailable): ${e.message}")
+                            }
                         }
                     }
-                }
-                promise.resolve(true)
+                promise.resolve(result.toWritableMap())
             } catch (e: HotUpdaterException) {
-                promise.reject(e.code, e.message)
+                promise.rejectUpdateBundle(e)
             } catch (e: Exception) {
+                // Not an update failure (a stale Release selection, for example),
+                // so the rejection carries no classification.
                 promise.reject("UNKNOWN_ERROR", e.message ?: "An unknown error occurred")
             }
         }
@@ -389,15 +416,13 @@ class HotUpdaterModule internal constructor(
 
     override fun getInstallId(): String = getInstance().getInstallId()
 
-    override fun getUserId(): String? = getInstance().getUserId()
-
-    override fun getUsername(): String? = getInstance().getUsername()
+    override fun getStorageItem(key: String): String? = getInstance().getStorageItem(key)
 
-    override fun setUser(
-        userId: String?,
-        username: String?,
+    override fun setStorageItem(
+        key: String,
+        value: String?,
     ) {
-        getInstance().setUser(userId, username)
+        getInstance().setStorageItem(key, value)
     }
 
     override fun resetChannel(promise: Promise) {

package/android/src/oldarch/HotUpdater.kt

@@ -35,7 +35,7 @@ class HotUpdater {
          * Updates the bundle using the default singleton instance
          * @param context Application context
          * @param bundleId ID of the bundle to update
-         * @param fileUrl URL of the bundle file to download (or null to reset)
+         * @param params Manifest and asset descriptors for the target bundle
          * @param fileHash Combined hash string for verification (sig:<signature> or <hex_hash>)
          * @param progressCallback Callback for download progress updates
          * @throws HotUpdaterException if the update fails
@@ -43,22 +43,20 @@ class HotUpdater {
         suspend fun updateBundle(
             context: Context,
             bundleId: String,
-            fileUrl: String?,
-            fileHash: String?,
-            manifestUrl: String?,
-            manifestFileHash: String?,
-            changedAssets: Map<String, ChangedAssetDescriptor>?,
+            manifestUrl: String,
+            manifestFileHash: String,
+            assets: Map<String, ChangedAssetDescriptor>,
             channel: String?,
+            archiveUrl: String? = null,
             progressCallback: (UpdateProgressPayload) -> Unit,
         ) {
             getInstance(context).updateBundle(
                 bundleId,
-                fileUrl,
-                fileHash,
                 manifestUrl,
                 manifestFileHash,
-                changedAssets,
+                assets,
                 channel,
+                archiveUrl = archiveUrl,
                 progressCallback = progressCallback,
             )
         }