@hot-updater/server 1.0.0-rc.2 → 1.0.0-rc.21

package/src/handler.spec.ts

@@ -1,190 +0,0 @@
-import type { ReleaseCatalog } from "@hot-updater/core";
-import { Hono } from "hono";
-import { describe, expect, it, vi } from "vitest";
-
-import {
-  createHandlers,
-  createHotUpdaterHandlers,
-  type HandlerAPI,
-} from "./handler";
-import { createApi } from "./handler.testFixtures";
-import { HOT_UPDATER_INFRASTRUCTURE_GENERATION } from "./handlerVersionRoutes";
-import { HOT_UPDATER_SERVER_VERSION } from "./version";
-
-describe("createHandlers client routes", () => {
-  it("reports the v1 infrastructure generation", async () => {
-    const handler = createHandlers(createApi()).client;
-    const response = await handler(new Request("http://localhost/version"));
-
-    expect(response.status).toBe(200);
-    await expect(response.json()).resolves.toEqual({
-      infrastructureGeneration: HOT_UPDATER_INFRASTRUCTURE_GENERATION,
-      version: HOT_UPDATER_SERVER_VERSION,
-    });
-  });
-
-  it.each([
-    "/app-version/ios/1.0.0/production/default/default",
-    "/fingerprint/android/fingerprint-123/production/default/default",
-  ])("does not expose the v0 route %s", async (path) => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(new Request(`http://localhost${path}`));
-
-    expect(response.status).toBe(404);
-  });
-
-  it.each([
-    "/v2/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0",
-    "/v2/artifacts/target-bundle/from/current-bundle",
-  ])("does not expose the version-prefixed route %s", async (path) => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(new Request(`http://localhost${path}`));
-
-    expect(response.status).toBe(404);
-  });
-
-  it("does not match the admin mount namespace", async () => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(
-      new Request("http://localhost/admin/channels"),
-    );
-
-    expect(response.status).toBe(404);
-  });
-
-  it("returns the stored Catalog identity without accepting identity parameters", async () => {
-    const catalog = {
-      catalogId: "project-a",
-      catalogHash: "sha256:catalog",
-      fallbackPolicy: "BUILTIN_IF_ACTIVE_INELIGIBLE",
-      generation: 1,
-      releases: [],
-      schemaVersion: 1,
-      scopeKey: "v1:fingerprint:android:cHJvZHVjdGlvbg:fingerprint-123",
-    } satisfies ReleaseCatalog;
-    const getReleaseCatalog = vi
-      .fn<NonNullable<HandlerAPI["getReleaseCatalog"]>>()
-      .mockResolvedValue(catalog);
-    const handler = createHandlers({
-      ...createApi(),
-      getReleaseCatalog,
-    }).client;
-    const url =
-      "http://localhost/release-catalogs/fingerprint/android/" +
-      "cHJvZHVjdGlvbg/fingerprint-123";
-
-    const response = await handler(new Request(url));
-
-    expect(response.status).toBe(200);
-    await expect(response.json()).resolves.toMatchObject({
-      catalogId: "project-a",
-    });
-    expect(getReleaseCatalog).toHaveBeenCalledWith({
-      channelKey: "cHJvZHVjdGlvbg",
-      fingerprintHash: "fingerprint-123",
-      platform: "android",
-      strategy: "FINGERPRINT",
-    });
-
-    const legacyAuthorityPath = await handler(
-      new Request(url.replace("/android/", "/project-a/android/")),
-    );
-    expect(legacyAuthorityPath.status).toBe(404);
-    expect(getReleaseCatalog).toHaveBeenCalledOnce();
-  });
-
-  it("serves client-relative storage paths under a framework mount", async () => {
-    const api = {
-      ...createApi(),
-      getArtifactInfo: vi.fn().mockResolvedValue({
-        changedAssets: {
-          "index.bundle": {
-            file: {
-              url: "/storage/asset-token/asset-signature",
-            },
-            fileHash: "asset-hash",
-            patch: {
-              algorithm: "bsdiff",
-              baseBundleId: "bundle-1",
-              baseFileHash: "base-hash",
-              patchFileHash: "patch-hash",
-              patchUrl: "/storage/patch-token/patch-signature",
-            },
-          },
-        },
-        fileHash: "archive-hash",
-        fileUrl: "/storage/archive-token/archive-signature",
-        manifestFileHash: "manifest-hash",
-        manifestUrl: "/storage/manifest-token/manifest-signature",
-      }),
-    };
-    const handlers = createHotUpdaterHandlers(
-      api,
-      undefined,
-      undefined,
-      async () => new Response("bundle archive"),
-    );
-    const app = new Hono();
-    app.mount("/hot-updater", handlers.client);
-
-    const response = await app.request(
-      "/hot-updater/artifacts/bundle-2/from/bundle-1",
-    );
-
-    expect(response.status).toBe(200);
-    const info = (await response.json()) as {
-      changedAssets: Record<
-        string,
-        { file: { url: string }; patch: { patchUrl: string } }
-      >;
-      fileUrl: string;
-      manifestUrl: string;
-    };
-    expect(info).toMatchObject({
-      changedAssets: {
-        "index.bundle": {
-          file: { url: "/storage/asset-token/asset-signature" },
-          patch: { patchUrl: "/storage/patch-token/patch-signature" },
-        },
-      },
-      fileUrl: "/storage/archive-token/archive-signature",
-      manifestUrl: "/storage/manifest-token/manifest-signature",
-    });
-
-    const download = await app.request(`/hot-updater${info.fileUrl}`);
-    expect(download.status).toBe(200);
-    await expect(download.text()).resolves.toBe("bundle archive");
-  });
-
-  it("does not expose provider errors from the public client handler", async () => {
-    const api = {
-      ...createApi(),
-      getReleaseCatalog: vi
-        .fn()
-        .mockRejectedValue(new Error("private database connection details")),
-    };
-    const consoleError = vi
-      .spyOn(console, "error")
-      .mockImplementation(() => {});
-    const handler = createHandlers(api).client;
-
-    const response = await handler(
-      new Request(
-        "http://localhost/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0",
-      ),
-    );
-
-    expect(response.status).toBe(500);
-    await expect(response.json()).resolves.toEqual({
-      error: "Internal server error",
-    });
-    expect(consoleError).toHaveBeenCalledWith(
-      "Hot Updater handler error:",
-      expect.any(Error),
-    );
-    consoleError.mockRestore();
-  });
-});

package/src/handler.testFixtures.ts

@@ -1,30 +0,0 @@
-import type { Bundle } from "@hot-updater/core";
-import { vi } from "vitest";
-
-import { createHandlers, type HandlerAPI } from "./handler";
-
-export const testBundle: Bundle = {
-  id: "bundle-1",
-  platform: "ios",
-  fileHash: "hash123",
-  gitCommitHash: null,
-  storageUri: "s3://test-bucket/bundles/bundle-1.zip",
-  archiveByteSize: 3_000_000_001,
-};
-
-export const createApi = () =>
-  ({
-    getBundleById: vi.fn<HandlerAPI["getBundleById"]>(),
-    getBundles: vi.fn<HandlerAPI["getBundles"]>(),
-    getChannels: vi
-      .fn<HandlerAPI["getChannels"]>()
-      .mockResolvedValue([{ id: "channel-production", name: "production" }]),
-    insertChannel: vi.fn<HandlerAPI["insertChannel"]>(),
-    deleteChannel: vi.fn<HandlerAPI["deleteChannel"]>(),
-    insertBundle: vi.fn<HandlerAPI["insertBundle"]>(),
-    updateBundleById: vi.fn<HandlerAPI["updateBundleById"]>(),
-    deleteBundleById: vi.fn<HandlerAPI["deleteBundleById"]>(),
-  }) satisfies HandlerAPI;
-
-export const createAdminHandler = (api: HandlerAPI) =>
-  createHandlers(api).admin;

package/src/handler.ts

@@ -1,245 +0,0 @@
-import { createBundleRouteHandlers } from "./handlerBundleRoutes";
-import { HandlerBadRequestError } from "./handlerErrors";
-import { createReleaseCatalogRouteHandlers } from "./handlerReleaseCatalogRoutes";
-import { createReleaseManagementRouteHandlers } from "./handlerReleaseManagementRoutes";
-import type {
-  HandlerAPI,
-  HotUpdaterHandler,
-  HotUpdaterHandlers,
-  RouteHandler,
-} from "./handlerTypes";
-import { createVersionRouteHandlers } from "./handlerVersionRoutes";
-import {
-  createInsightsRouteHandlers,
-  registerInsightsAdminRoutes,
-  registerInsightsClientRoutes,
-} from "./insights/routes";
-import type { InsightsProvider } from "./insights/types";
-import { addRoute, createRouter, findRoute } from "./internalRouter";
-
-export type {
-  HandlerAPI,
-  HotUpdaterHandler,
-  HotUpdaterHandlers,
-} from "./handlerTypes";
-
-const withPrivateNoStore = (response: Response): Response => {
-  const headers = new Headers(response.headers);
-  headers.set("cache-control", "private, no-store");
-  return new Response(response.body, {
-    headers,
-    status: response.status,
-    statusText: response.statusText,
-  });
-};
-
-const errorResponse = (error: string, status: number): Response =>
-  Response.json(
-    { error },
-    {
-      headers: { "cache-control": "private, no-store" },
-      status,
-    },
-  );
-
-const requiresApiKey = (handlerName: string): boolean =>
-  handlerName === "appVersionReleaseCatalog" ||
-  handlerName === "fingerprintReleaseCatalog" ||
-  handlerName === "artifact" ||
-  handlerName === "appendBundleEvent";
-
-const createRequestHandler =
-  ({
-    api,
-    apiKeyAuth,
-    privateResponses = false,
-    routeHandlers,
-    router,
-  }: {
-    readonly api: HandlerAPI;
-    readonly apiKeyAuth?: {
-      readonly authenticate: (request: Request) => Promise<boolean>;
-    };
-    readonly privateResponses?: boolean;
-    readonly routeHandlers: Record<string, RouteHandler>;
-    readonly router: ReturnType<typeof createRouter<string>>;
-  }): HotUpdaterHandler =>
-  async (request): Promise<Response> => {
-    try {
-      const match = findRoute(
-        router,
-        request.method,
-        new URL(request.url).pathname,
-      );
-      if (!match) {
-        return errorResponse("Not found", 404);
-      }
-
-      if (apiKeyAuth !== undefined && requiresApiKey(match.data)) {
-        let authenticated: boolean;
-        try {
-          authenticated = await apiKeyAuth.authenticate(request);
-        } catch {
-          return errorResponse("Service unavailable", 503);
-        }
-        if (!authenticated) {
-          return errorResponse("Unauthorized", 401);
-        }
-      }
-
-      const handler = routeHandlers[match.data];
-      if (!handler) {
-        return errorResponse("Handler not found", 500);
-      }
-      const response = await handler(match.params, request, api);
-      return privateResponses ? withPrivateNoStore(response) : response;
-    } catch (error) {
-      if (error instanceof HandlerBadRequestError) {
-        return errorResponse(error.message, 400);
-      }
-      console.error("Hot Updater handler error:", error);
-      return Response.json(
-        { error: "Internal server error" },
-        {
-          headers: { "cache-control": "private, no-store" },
-          status: 500,
-        },
-      );
-    }
-  };
-
-const createDownloadStorageRouteHandler =
-  (
-    downloadStorageObject: (
-      token: string,
-      signature: string,
-    ) => Promise<Response | null>,
-  ): RouteHandler =>
-  async (params) => {
-    const token = params.token;
-    const signature = params.signature;
-    if (!token || !signature) {
-      return errorResponse("Not found", 404);
-    }
-    const response = await downloadStorageObject(token, signature);
-    if (!response) {
-      return errorResponse("Not found", 404);
-    }
-    const headers = new Headers(response.headers);
-    if (!headers.has("cache-control")) {
-      headers.set("cache-control", "public, max-age=31536000, immutable");
-    }
-    return new Response(response.body, {
-      headers,
-      status: response.status,
-      statusText: response.statusText,
-    });
-  };
-
-export function createHandlers(api: HandlerAPI): HotUpdaterHandlers {
-  return createHotUpdaterHandlers(api);
-}
-
-export function createHotUpdaterHandlers(
-  api: HandlerAPI,
-  insights?: InsightsProvider,
-  apiKeyAuth?: {
-    readonly authenticate: (request: Request) => Promise<boolean>;
-    readonly headerName: string;
-  },
-  downloadStorageObject?: (
-    token: string,
-    signature: string,
-  ) => Promise<Response | null>,
-): HotUpdaterHandlers {
-  const routeHandlers: Record<string, RouteHandler> = {
-    ...createVersionRouteHandlers(),
-    ...createReleaseCatalogRouteHandlers(apiKeyAuth?.headerName),
-    ...createReleaseManagementRouteHandlers(),
-    ...createBundleRouteHandlers(),
-    ...(insights === undefined ? {} : createInsightsRouteHandlers(insights)),
-    ...(downloadStorageObject === undefined
-      ? {}
-      : {
-          downloadStorageObject: createDownloadStorageRouteHandler(
-            downloadStorageObject,
-          ),
-        }),
-  };
-
-  const clientRouter = createRouter<string>();
-  const addClientRoute = (
-    method: string,
-    path: string,
-    handler: string,
-  ): void => addRoute(clientRouter, method, path, handler);
-  addClientRoute("GET", "/version", "version");
-  if (downloadStorageObject !== undefined) {
-    addClientRoute(
-      "GET",
-      "/storage/:token/:signature",
-      "downloadStorageObject",
-    );
-  }
-  addClientRoute(
-    "GET",
-    "/release-catalogs/app-version/:platform/:channelKey/:appVersion",
-    "appVersionReleaseCatalog",
-  );
-  addClientRoute(
-    "GET",
-    "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash",
-    "fingerprintReleaseCatalog",
-  );
-  addClientRoute(
-    "GET",
-    "/artifacts/:targetBundleId/from/:currentBundleId",
-    "artifact",
-  );
-  if (insights !== undefined) {
-    registerInsightsClientRoutes(addClientRoute);
-  }
-
-  const adminRouter = createRouter<string>();
-  const addAdminRoute = (method: string, path: string, handler: string): void =>
-    addRoute(adminRouter, method, path, handler);
-  addAdminRoute("GET", "/releases/:id", "getRelease");
-  addAdminRoute("GET", "/releases", "getReleases");
-  addAdminRoute("PATCH", "/releases/:id", "updateRelease");
-  addAdminRoute("POST", "/releases/:id/preflight", "preflightRelease");
-  addAdminRoute("DELETE", "/releases/:id", "deleteRelease");
-  addAdminRoute("GET", "/release-catalogs/:scopeKey", "getReleaseCatalogRow");
-  addAdminRoute("GET", "/release-catalogs", "getReleaseCatalogs");
-  addAdminRoute(
-    "POST",
-    "/release-catalogs/:scopeKey/rebuild",
-    "rebuildReleaseCatalog",
-  );
-  addAdminRoute("POST", "/database/commit", "commitDatabase");
-  addAdminRoute("GET", "/channels", "getChannels");
-  addAdminRoute("POST", "/channels", "createChannel");
-  addAdminRoute("DELETE", "/channels/:id", "deleteChannel");
-  addAdminRoute("GET", "/bundles/:id", "getBundle");
-  addAdminRoute("GET", "/bundles", "getBundles");
-  addAdminRoute("POST", "/bundles", "createBundles");
-  addAdminRoute("PATCH", "/bundles/:id", "updateBundle");
-  addAdminRoute("DELETE", "/bundles/:id", "deleteBundle");
-  if (insights !== undefined) {
-    registerInsightsAdminRoutes(addAdminRoute);
-  }
-
-  return Object.freeze({
-    client: createRequestHandler({
-      api,
-      apiKeyAuth,
-      routeHandlers,
-      router: clientRouter,
-    }),
-    admin: createRequestHandler({
-      api,
-      privateResponses: true,
-      routeHandlers,
-      router: adminRouter,
-    }),
-  });
-}

package/src/handlerAuth.integration.spec.ts

@@ -1,33 +0,0 @@
-import { Hono } from "hono";
-import { bearerAuth } from "hono/bearer-auth";
-import { describe, expect, it } from "vitest";
-
-import { createInMemoryDatabasePlugin } from "../../test-utils/test/inMemoryDatabasePlugin";
-import { createHotUpdater } from "./index";
-
-describe("framework-owned admin authentication", () => {
-  it("protects admin without affecting the client handler", async () => {
-    const hotUpdater = createHotUpdater({
-      database: createInMemoryDatabasePlugin(),
-      clientAccess: { type: "public" },
-    });
-    const adminToken = "test-management-token";
-    const app = new Hono();
-    app.use("/hot-updater/admin/*", bearerAuth({ token: adminToken }));
-    app.mount("/hot-updater/admin", hotUpdater.handlers.admin);
-    app.mount("/hot-updater", hotUpdater.handlers.client);
-
-    const clientResponse = await app.request("/hot-updater/version");
-    const unauthorizedAdmin = await app.request("/hot-updater/admin/channels");
-    const authorizedAdmin = await app.request("/hot-updater/admin/channels", {
-      headers: { Authorization: `Bearer ${adminToken}` },
-    });
-
-    expect(clientResponse.status).toBe(200);
-    expect(unauthorizedAdmin.status).toBe(401);
-    expect(authorizedAdmin.status).toBe(200);
-    expect(authorizedAdmin.headers.get("cache-control")).toBe(
-      "private, no-store",
-    );
-  });
-});