@hot-updater/server 1.0.0-rc.18 → 1.0.0-rc.21

package/src/handlerManagement.spec.ts

@@ -1,202 +0,0 @@
-import type { Deployment } from "@hot-updater/plugin-core";
-import { describe, expect, it } from "vitest";
-
-import { createHotUpdaterHandlers } from "./handler";
-import {
-  createAdminHandler,
-  createApi,
-  testBundle,
-} from "./handler.testFixtures";
-
-const BASE = "http://localhost";
-
-const send = (method: string, path: string, body?: unknown) =>
-  new Request(`${BASE}${path}`, {
-    method,
-    ...(body === undefined
-      ? {}
-      : {
-          body: JSON.stringify(body),
-          headers: { "content-type": "application/json" },
-        }),
-  });
-
-const deployment = (id: string, channel = "production"): Deployment => ({
-  bundle: { ...testBundle, id },
-  release: {
-    channel,
-    enabled: false,
-    fingerprintHash: null,
-    message: null,
-    shouldForceUpdate: false,
-    targetAppVersion: "1.0.x",
-  },
-});
-
-const BUNDLE_A = "01900000-0000-7000-8000-000000000001";
-const BUNDLE_B = "01900000-0000-7000-8000-000000000002";
-
-describe("admin routes on core", () => {
-  it("does not match client routes", async () => {
-    const handler = createAdminHandler();
-    const response = await handler(
-      send("GET", `/artifacts/v1/${BUNDLE_B}/from/${BUNDLE_A}`),
-    );
-
-    expect(response.status).toBe(404);
-  });
-
-  it("reports the admin API protocol where standalone clients call", async () => {
-    const handler = createAdminHandler();
-    const response = await handler(send("GET", "/version"));
-
-    expect(response.status).toBe(200);
-    expect(response.headers.get("cache-control")).toBe("private, no-store");
-    await expect(response.json()).resolves.toMatchObject({
-      adminProtocol: 2,
-      plugins: [],
-    });
-  });
-
-  it("lists the plugins the server runs, sorted, for a console", async () => {
-    const handler = createHotUpdaterHandlers({
-      api: createApi(),
-      plugins: ["insights", "apiKeys"],
-    }).admin;
-
-    const response = await handler(send("GET", "/version"));
-
-    await expect(response.json()).resolves.toMatchObject({
-      adminProtocol: 2,
-      plugins: ["apiKeys", "insights"],
-    });
-  });
-
-  it.each([
-    ["POST", "/database/commit"],
-    ["POST", "/bundles"],
-    ["DELETE", `/bundles/${BUNDLE_A}`],
-  ])("no longer serves protocol 1's %s %s", async (method, path) => {
-    const handler = createAdminHandler();
-
-    const response = await handler(send(method, path, {}));
-
-    expect(response.status).toBe(404);
-  });
-
-  it("creates, finds, lists, and deletes a channel, with or without v=2", async () => {
-    const handler = createAdminHandler();
-
-    const created = await handler(
-      send("POST", "/channels", { name: "preview" }),
-    );
-    const again = await handler(
-      send("POST", "/channels?v=2", { name: "preview" }),
-    );
-    const { data: channel } = (await created.json()) as {
-      data: { id: string; name: string };
-    };
-    const found = await handler(send("GET", "/channels?name=preview"));
-    const listed = await handler(send("GET", "/channels?v=2"));
-
-    expect(created.status).toBe(200);
-    expect(channel.name).toBe("preview");
-    await expect(again.json()).resolves.toEqual({ data: channel });
-    await expect(found.json()).resolves.toEqual({ data: channel });
-    await expect(listed.json()).resolves.toEqual({ data: [channel] });
-
-    const deleted = await handler(send("DELETE", `/channels/${channel.id}`));
-    const missing = await handler(send("DELETE", `/channels/${channel.id}`));
-
-    expect(deleted.status).toBe(204);
-    await expect(deleted.text()).resolves.toBe("");
-    expect(missing.status).toBe(404);
-    await expect(missing.json()).resolves.toEqual({
-      data: { deleted: false, reason: "not_found" },
-    });
-  });
-
-  it("refuses to delete a channel a release uses", async () => {
-    const api = createApi();
-    await api.core.deploy([deployment(BUNDLE_A)]);
-    const channel = await api.core.findChannelByName("production");
-    const handler = createAdminHandler(api);
-
-    const response = await handler(send("DELETE", `/channels/${channel!.id}`));
-
-    expect(response.status).toBe(409);
-    await expect(response.json()).resolves.toEqual({
-      data: { deleted: false, reason: "not_empty" },
-    });
-  });
-
-  it("pages bundles by key, newest first", async () => {
-    const api = createApi();
-    await api.core.deploy([deployment(BUNDLE_A)]);
-    await api.core.deploy([deployment(BUNDLE_B)]);
-    const handler = createAdminHandler(api);
-
-    const first = await handler(send("GET", "/bundles?limit=1&total=true"));
-    const firstPage = (await first.json()) as {
-      data: { bundle: { id: string } }[];
-      next: string;
-      total: number;
-    };
-    const second = await handler(
-      send("GET", `/bundles?limit=1&cursor=${firstPage.next}`),
-    );
-    const secondPage = (await second.json()) as {
-      data: { bundle: { id: string } }[];
-    };
-
-    expect(firstPage.data.map(({ bundle }) => bundle.id)).toEqual([BUNDLE_B]);
-    expect(firstPage.total).toBe(2);
-    expect(secondPage.data.map(({ bundle }) => bundle.id)).toEqual([BUNDLE_A]);
-  });
-
-  it.each(["limit=101", "order=random", "platform=web"])(
-    "refuses the bundle list query %s",
-    async (query) => {
-      const handler = createAdminHandler();
-
-      const response = await handler(send("GET", `/bundles?${query}`));
-
-      expect(response.status).toBe(400);
-    },
-  );
-
-  it("changes a bundle's fields and refuses another bundle's id", async () => {
-    const api = createApi();
-    await api.core.deploy([deployment(BUNDLE_A)]);
-    const handler = createAdminHandler(api);
-
-    const updated = await handler(
-      send("PATCH", `/bundles/${BUNDLE_A}`, { gitCommitHash: "abc123" }),
-    );
-    const mismatch = await handler(
-      send("PATCH", `/bundles/${BUNDLE_A}`, { id: BUNDLE_B }),
-    );
-
-    expect(updated.status).toBe(204);
-    expect((await api.core.getBundle(BUNDLE_A))?.bundle.git_commit_hash).toBe(
-      "abc123",
-    );
-    expect(mismatch.status).toBe(400);
-  });
-
-  it("hard-deletes a disabled release only when confirm names it", async () => {
-    const api = createApi();
-    const [result] = await api.core.deploy([deployment(BUNDLE_A)]);
-    const releaseId = result!.release!.id;
-    const handler = createAdminHandler(api);
-
-    const unconfirmed = await handler(send("DELETE", `/releases/${releaseId}`));
-    const deleted = await handler(
-      send("DELETE", `/releases/${releaseId}?confirm=${releaseId}`),
-    );
-
-    expect(unconfirmed.status).toBe(400);
-    expect(deleted.status).toBe(200);
-    await expect(api.core.getRelease(releaseId)).resolves.toBeNull();
-  });
-});

package/src/handlerParameters.ts

@@ -1,105 +0,0 @@
-import type { Platform } from "@hot-updater/core";
-
-import { HandlerBadRequestError } from "./handlerErrors";
-
-type PositiveIntegerBounds = {
-  readonly defaultValue: number;
-  readonly maxValue: number;
-};
-
-export const decodeMaybe = (value: string | undefined): string | undefined => {
-  if (value === undefined) return undefined;
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-};
-
-export const isPlatform = (value: string): value is Platform =>
-  value === "ios" || value === "android";
-
-export const requireRouteParam = (
-  params: Record<string, string>,
-  key: string,
-): string => {
-  const value = params[key];
-  if (!value) {
-    throw new HandlerBadRequestError(`Missing route parameter: ${key}`);
-  }
-  return value;
-};
-
-export const requirePlatformParam = (
-  params: Record<string, string>,
-): Platform => {
-  const platform = requireRouteParam(params, "platform");
-  if (!isPlatform(platform)) {
-    throw new HandlerBadRequestError(
-      `Invalid platform: ${platform}. Expected 'ios' or 'android'.`,
-    );
-  }
-  return platform;
-};
-
-export const parseBooleanSearchParam = (
-  url: URL,
-  key: string,
-): boolean | undefined => {
-  const value = url.searchParams.get(key);
-  if (value === null) return undefined;
-  if (value === "true") return true;
-  if (value === "false") return false;
-  throw new HandlerBadRequestError(
-    `The '${key}' query parameter must be 'true' or 'false'.`,
-  );
-};
-
-export const parseNullableStringSearchParam = (
-  url: URL,
-  key: string,
-): string | null | undefined => {
-  const value = url.searchParams.get(key);
-  if (value === null) return undefined;
-  return value === "null" ? null : value;
-};
-
-export const parseStringArraySearchParam = (
-  url: URL,
-  key: string,
-): string[] | undefined => {
-  const values = url.searchParams.getAll(key);
-  return values.length > 0 ? values : undefined;
-};
-
-export const parsePositiveIntegerSearchParam = (
-  url: URL,
-  key: string,
-  bounds: PositiveIntegerBounds,
-): number => {
-  const value = url.searchParams.get(key);
-  if (value === null) return bounds.defaultValue;
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed < 1 || parsed > bounds.maxValue) {
-    throw new HandlerBadRequestError(
-      `The '${key}' query parameter must be a positive integer between 1 and ${bounds.maxValue}.`,
-    );
-  }
-  return parsed;
-};
-
-export const parseNonNegativeIntegerSearchParam = (
-  url: URL,
-  key: string,
-  defaultValue: number,
-): number => {
-  const value = url.searchParams.get(key);
-  if (value === null) return defaultValue;
-  const parsed = Number(value);
-  if (!Number.isSafeInteger(parsed) || parsed < 0) {
-    throw new HandlerBadRequestError(
-      `The '${key}' query parameter must be a non-negative integer.`,
-    );
-  }
-  return parsed;
-};

package/src/handlerReleaseCatalogRoutes.ts

@@ -1,176 +0,0 @@
-import type { ReleaseCatalog } from "@hot-updater/core";
-import { canonicalizeAppVersion } from "@hot-updater/plugin-core";
-
-import { requirePlatformParam, requireRouteParam } from "./handlerParameters";
-import type { RouteHandler } from "./handlerTypes";
-
-const CATALOG_CONTENT_TYPE =
-  "application/vnd.hot-updater.release-catalog+json; version=1";
-const ARTIFACT_CONTENT_TYPE =
-  "application/vnd.hot-updater.artifact+json; version=1";
-const ORIGIN_CACHE_TTL_MS = 5_000;
-const ORIGIN_CACHE_MAX_ENTRIES = 128;
-/** Marks the 404 of a scope that has no catalog. */
-const NO_CATALOG_HEADER = "x-hot-updater-catalog";
-/** A shared cache keeps a catalog, or a scope's lack of one, five seconds. */
-const CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
-
-const privateNotFound = (): Response =>
-  Response.json(
-    { error: "Not found" },
-    {
-      status: 404,
-      headers: { "cache-control": "private, no-store" },
-    },
-  );
-
-/**
- * A scope with no catalog yet, such as a store version before its first
- * OTA release: cached like a catalog, so its update checks don't all reach
- * the origin, and it holds nothing an API key protects. The header tells it
- * apart from a 404 for a wrong URL: clients read it as "no update", and
- * doctor as a live catalog route.
- */
-const missingCatalog = (): Response =>
-  Response.json(
-    { error: "Not found" },
-    {
-      status: 404,
-      headers: {
-        "cache-control": CATALOG_CACHE_CONTROL,
-        vary: "Accept-Encoding",
-        [NO_CATALOG_HEADER]: "none",
-      },
-    },
-  );
-
-const responseHash = async (body: string): Promise<string> => {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(body),
-  );
-  return [...new Uint8Array(digest)]
-    .map((byte) => byte.toString(16).padStart(2, "0"))
-    .join("");
-};
-
-const catalogResponse = async (
-  catalog: ReleaseCatalog | null,
-  request: Request,
-): Promise<Response> => {
-  if (catalog === null) return missingCatalog();
-  const body = JSON.stringify(catalog);
-  const etag = `"sha256:${await responseHash(body)}"`;
-  const headers = {
-    "cache-control": CATALOG_CACHE_CONTROL,
-    "content-type": CATALOG_CONTENT_TYPE,
-    etag,
-    vary: "Accept-Encoding",
-  };
-  if (request.headers.get("if-none-match") === etag) {
-    return new Response(null, { headers, status: 304 });
-  }
-  return new Response(body, { headers, status: 200 });
-};
-
-export const createReleaseCatalogRouteHandlers = (): Record<
-  string,
-  RouteHandler
-> => {
-  const cache = new Map<
-    string,
-    { readonly catalog: ReleaseCatalog; readonly expiresAt: number }
-  >();
-  const inFlight = new Map<string, Promise<ReleaseCatalog | null>>();
-  const loadCatalog = async (
-    key: string,
-    load: () => Promise<ReleaseCatalog | null>,
-  ): Promise<ReleaseCatalog | null> => {
-    const cached = cache.get(key);
-    if (cached !== undefined && cached.expiresAt > Date.now()) {
-      cache.delete(key);
-      cache.set(key, cached);
-      return cached.catalog;
-    }
-    if (cached !== undefined) cache.delete(key);
-    const pending = inFlight.get(key);
-    if (pending !== undefined) return pending;
-
-    const next = load().then((catalog) => {
-      if (catalog !== null) {
-        cache.set(key, {
-          catalog,
-          expiresAt: Date.now() + ORIGIN_CACHE_TTL_MS,
-        });
-        while (cache.size > ORIGIN_CACHE_MAX_ENTRIES) {
-          const oldestKey = cache.keys().next().value as string | undefined;
-          if (oldestKey === undefined) break;
-          cache.delete(oldestKey);
-        }
-      }
-      return catalog;
-    });
-    inFlight.set(key, next);
-    try {
-      return await next;
-    } finally {
-      inFlight.delete(key);
-    }
-  };
-
-  return {
-    appVersionReleaseCatalog: async (params, request, { core }) => {
-      const rawAppVersion = requireRouteParam(params, "appVersion");
-      const appVersion = canonicalizeAppVersion(rawAppVersion);
-      if (appVersion === null || appVersion !== rawAppVersion) {
-        return Response.json(
-          { error: "Invalid app version" },
-          { status: 400, headers: { "cache-control": "private, no-store" } },
-        );
-      }
-      const input = {
-        appVersion,
-        channelKey: requireRouteParam(params, "channelKey"),
-        platform: requirePlatformParam(params),
-        strategy: "APP_VERSION",
-      } as const;
-      return catalogResponse(
-        await loadCatalog(`app-version:${JSON.stringify(input)}`, () =>
-          core.getReleaseCatalog(input),
-        ),
-        request,
-      );
-    },
-
-    fingerprintReleaseCatalog: async (params, request, { core }) => {
-      const input = {
-        channelKey: requireRouteParam(params, "channelKey"),
-        fingerprintHash: requireRouteParam(params, "fingerprintHash"),
-        platform: requirePlatformParam(params),
-        strategy: "FINGERPRINT",
-      } as const;
-      return catalogResponse(
-        await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () =>
-          core.getReleaseCatalog(input),
-        ),
-        request,
-      );
-    },
-
-    artifactV1: async (params, _request, { core }) => {
-      const info = await core.getArtifactInfo(
-        requireRouteParam(params, "targetBundleId"),
-        requireRouteParam(params, "currentBundleId"),
-        1,
-      );
-      if (info === null) return privateNotFound();
-      return new Response(JSON.stringify(info), {
-        status: 200,
-        headers: {
-          "cache-control": "private, no-store",
-          "content-type": ARTIFACT_CONTENT_TYPE,
-        },
-      });
-    },
-  };
-};

package/src/handlerTypes.ts

@@ -1,19 +0,0 @@
-import type { CoreApi } from "./core/api";
-
-/** What the handlers run on: core's reads and typed writes. */
-export interface HandlerAPI {
-  readonly core: CoreApi;
-}
-
-export type HotUpdaterHandler = (request: Request) => Promise<Response>;
-
-export interface HotUpdaterHandlers {
-  readonly client: HotUpdaterHandler;
-  readonly admin: HotUpdaterHandler;
-}
-
-export type RouteHandler = (
-  params: Record<string, string>,
-  request: Request,
-  api: HandlerAPI,
-) => Promise<Response>;

package/src/handlerVersionRoutes.ts

@@ -1,25 +0,0 @@
-import { ADMIN_API_PROTOCOL } from "./handlerAdminRoutes";
-import type { RouteHandler } from "./handlerTypes";
-import { HOT_UPDATER_SERVER_VERSION } from "./version";
-
-export const HOT_UPDATER_INFRASTRUCTURE_GENERATION = 1;
-
-/**
- * `/version` on both mounts. The admin mount also lists the ids of the
- * plugins the server runs, sorted, so a console shows only the features they
- * serve; apps never learn which plugins a server runs.
- */
-export const createVersionRouteHandlers = (
-  plugins: readonly string[] = [],
-): Record<string, RouteHandler> => {
-  const version = {
-    adminProtocol: ADMIN_API_PROTOCOL,
-    infrastructureGeneration: HOT_UPDATER_INFRASTRUCTURE_GENERATION,
-    version: HOT_UPDATER_SERVER_VERSION,
-  };
-  const adminVersion = { ...version, plugins: [...plugins].sort() };
-  return {
-    version: async () => Response.json(version),
-    adminVersion: async () => Response.json(adminVersion),
-  };
-};

package/src/index.ts

@@ -1,13 +0,0 @@
-export type { HotUpdaterHandler, HotUpdaterHandlers } from "./handler";
-export { createHotUpdater } from "./createHotUpdaterCore";
-export type {
-  ClientAccessPolicy,
-  ClientAccessRule,
-  CreateHotUpdaterOptions,
-  HotUpdaterAPI,
-  RuntimeHotUpdaterAPI,
-} from "./createHotUpdaterCore";
-export { HotUpdaterConfigError } from "./assembly/assemblePlugins";
-export * from "./types";
-export { HOT_UPDATER_SERVER_VERSION } from "./version";
-export { HOT_UPDATER_INFRASTRUCTURE_GENERATION } from "./handlerVersionRoutes";

package/src/internalRouter.ts

@@ -1,104 +0,0 @@
-interface RouteRecord<T> {
-  data: T;
-  method: string;
-  paramNames: string[];
-  segments: string[];
-}
-
-interface RouteMatch<T> {
-  data: T;
-  params: Record<string, string>;
-}
-
-interface Router<T> {
-  routes: RouteRecord<T>[];
-}
-
-const normalizePath = (path: string) => {
-  if (!path) {
-    return "/";
-  }
-
-  if (path === "/") {
-    return path;
-  }
-
-  const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
-  return withLeadingSlash.endsWith("/")
-    ? withLeadingSlash.slice(0, -1)
-    : withLeadingSlash;
-};
-
-const toSegments = (path: string) => {
-  const normalized = normalizePath(path);
-  return normalized === "/" ? [] : normalized.slice(1).split("/");
-};
-
-export function createRouter<T>(): Router<T> {
-  return { routes: [] };
-}
-
-export function addRoute<T>(
-  router: Router<T>,
-  method: string,
-  path: string,
-  data: T,
-) {
-  const segments = toSegments(path);
-  const paramNames = segments
-    .filter((segment) => segment.startsWith(":"))
-    .map((segment) => segment.slice(1));
-
-  router.routes.push({
-    data,
-    method: method.toUpperCase(),
-    paramNames,
-    segments,
-  });
-}
-
-export function findRoute<T>(
-  router: Router<T>,
-  method: string,
-  path: string,
-): RouteMatch<T> | undefined {
-  const normalizedMethod = method.toUpperCase();
-  const pathSegments = toSegments(path);
-
-  for (const route of router.routes) {
-    if (route.method !== normalizedMethod) {
-      continue;
-    }
-
-    if (route.segments.length !== pathSegments.length) {
-      continue;
-    }
-
-    const params: Record<string, string> = {};
-    let matched = true;
-
-    for (let index = 0; index < route.segments.length; index += 1) {
-      const routeSegment = route.segments[index];
-      const pathSegment = pathSegments[index];
-
-      if (routeSegment.startsWith(":")) {
-        params[routeSegment.slice(1)] = pathSegment;
-        continue;
-      }
-
-      if (routeSegment !== pathSegment) {
-        matched = false;
-        break;
-      }
-    }
-
-    if (matched) {
-      return {
-        data: route.data,
-        params,
-      };
-    }
-  }
-
-  return undefined;
-}