@limrun/ui 0.14.0-rc.2 → 0.14.0-rc.4

package/src/core/device-install/storage/secret-store.ts

@@ -0,0 +1,298 @@
+/**
+ * A pluggable store for Apple signing secrets.
+ *
+ * Credential material always lands in the browser first (the Apple relay
+ * only proxies); the browser then writes it into a store implementing this
+ * interface. Limrun's org secret store is the default implementation, an
+ * IndexedDB-backed one keeps everything local, and customers can bring
+ * their own store by implementing the same interface.
+ */
+
+export const APPLE_CERTIFICATE_SECRET_TYPE = 'appleCertificate';
+export const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = 'appleProvisioningProfile';
+
+export type SigningSecretType =
+  | typeof APPLE_CERTIFICATE_SECRET_TYPE
+  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE;
+
+export type SigningSecretMetadata = {
+  type: string;
+  name: string;
+  createdAt?: string;
+};
+
+/** Type-specific flat key-value payload of a signing secret. */
+export type SigningSecretData = Record<string, string>;
+
+export type SigningSecret = SigningSecretMetadata & {
+  data: SigningSecretData;
+};
+
+export interface SigningSecretStore {
+  /**
+   * Stores a secret. When a secret with the same type and name already
+   * exists its data is overwritten. Returns the stored secret; callers
+   * should use the returned data.
+   */
+  put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
+  /** Returns the secret including its data, or undefined when absent. */
+  get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
+  /** Lists metadata of all stored signing secrets, never their data. */
+  list(): Promise<SigningSecretMetadata[]>;
+  /** Deletes a secret; resolves even when the secret does not exist. */
+  delete(type: SigningSecretType, name: string): Promise<void>;
+}
+
+/**
+ * Apple's certificate types as defined by the App Store Connect API
+ * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
+ */
+export type AppleCertificateType =
+  | 'DEVELOPMENT'
+  | 'DISTRIBUTION'
+  | 'IOS_DEVELOPMENT'
+  | 'IOS_DISTRIBUTION'
+  | 'MAC_APP_DEVELOPMENT'
+  | 'MAC_APP_DISTRIBUTION'
+  | 'MAC_INSTALLER_DISTRIBUTION'
+  | 'DEVELOPER_ID_APPLICATION'
+  | 'DEVELOPER_ID_INSTALLER'
+  | 'DEVELOPER_ID_KEXT'
+  | 'PASS_TYPE_ID'
+  | 'PASS_TYPE_ID_WITH_NFC';
+
+/** Data payload of an appleCertificate secret. */
+export type AppleCertificateSecretData = {
+  certificateP12Base64: string;
+  /** Which of Apple's certificate types the p12 holds. */
+  certificateType: AppleCertificateType;
+  certificatePassword?: string;
+  teamID?: string;
+  /** Apple's portal certificate id, never a Limrun DB id. */
+  certificateID?: string;
+  /** The certificate's serial number: uppercase hex, no leading zeros. */
+  serialNumber?: string;
+  expirationDate?: string;
+};
+
+/**
+ * Data payload of an appleProvisioningProfile secret. The
+ * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
+ * the signed profile binds (as comma-separated lists) so profiles can be
+ * filtered by certificate, bundle ID or device without parsing every
+ * entry. Certificates are referenced by serial number, the identifier
+ * Apple embeds in the profile itself.
+ */
+export type AppleProvisioningProfileSecretData = {
+  provisioningProfileBase64: string;
+  certificateSerialNumbers?: string;
+  bundleIDs?: string;
+  deviceIDs?: string;
+  teamID?: string;
+  profileName?: string;
+  uuid?: string;
+  expirationDate?: string;
+};
+
+function compactData(data: Record<string, string | undefined>): SigningSecretData {
+  const result: SigningSecretData = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (value) result[key] = value;
+  }
+  return result;
+}
+
+/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
+export async function putAppleCertificateSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleCertificateSecretData,
+) {
+  return store.put(APPLE_CERTIFICATE_SECRET_TYPE, name, compactData(data));
+}
+
+/**
+ * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
+ * so a team can hold many profiles for the same bundle ID and certificate
+ * set; consumers select by the reference fields, not by name.
+ */
+export async function putAppleProvisioningProfileSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleProvisioningProfileSecretData,
+) {
+  return store.put(APPLE_PROVISIONING_PROFILE_SECRET_TYPE, name, compactData(data));
+}
+
+export type LimrunSecretStoreOptions = {
+  /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
+  apiUrl: string;
+  /** Bearer token: a user or organization token. */
+  token: string;
+  /** Organization TID owning the secrets. */
+  organizationId: string;
+  /** Custom fetch, mainly for tests. */
+  fetch?: typeof fetch;
+};
+
+type BackendSecretResult = {
+  id: string;
+  type: string;
+  name: string;
+  organizationId: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore backed by Limrun's organization secret store
+ * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
+ * shared across the organization.
+ */
+export function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore {
+  const doFetch = options.fetch ?? fetch.bind(globalThis);
+  const base = options.apiUrl.replace(/\/+$/, '');
+  const secretUrl = (type: string, name: string) =>
+    `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets/${encodeURIComponent(
+      type,
+    )}/${encodeURIComponent(name)}`;
+  const headers = {
+    Authorization: `Bearer ${options.token}`,
+    'Content-Type': 'application/json',
+  };
+
+  async function fail(response: Response, action: string): Promise<never> {
+    let message = `${response.status}`;
+    try {
+      const body = (await response.json()) as { message?: string };
+      if (body.message) message = body.message;
+    } catch {
+      // Non-JSON error body; the status code is the best we have.
+    }
+    throw new Error(`Failed to ${action} secret: ${message}`);
+  }
+
+  return {
+    async put(type, name, data) {
+      const response = await doFetch(secretUrl(type, name), {
+        method: 'PUT',
+        headers,
+        body: JSON.stringify({ data, replace: true }),
+      });
+      if (!response.ok) await fail(response, 'store');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async get(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'GET', headers });
+      if (response.status === 404) return undefined;
+      if (!response.ok) await fail(response, 'fetch');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async list() {
+      const response = await doFetch(
+        `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets`,
+        { method: 'GET', headers },
+      );
+      if (!response.ok) await fail(response, 'list');
+      const result = (await response.json()) as Omit<BackendSecretResult, 'data'>[];
+      return result
+        .filter(
+          (s) =>
+            s.type === APPLE_CERTIFICATE_SECRET_TYPE || s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
+        )
+        .map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'DELETE', headers });
+      if (response.status === 404) return;
+      if (!response.ok) await fail(response, 'delete');
+    },
+  };
+}
+
+const SECRETS_DB_NAME = 'limrun-signing-secrets';
+const SECRETS_DB_VERSION = 1;
+const SECRETS_STORE_NAME = 'secrets';
+
+type BrowserStoredSecret = {
+  id: string;
+  type: string;
+  name: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore keeping everything in the browser's IndexedDB.
+ * Nothing leaves the machine; secrets are per-browser-profile.
+ */
+export function createBrowserSecretStore(): SigningSecretStore {
+  const idOf = (type: string, name: string) => `${type}:${name}`;
+
+  function open() {
+    return new Promise<IDBDatabase>((resolve, reject) => {
+      const request = indexedDB.open(SECRETS_DB_NAME, SECRETS_DB_VERSION);
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(SECRETS_STORE_NAME)) {
+          db.createObjectStore(SECRETS_STORE_NAME, { keyPath: 'id' });
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('Open IndexedDB failed'));
+    });
+  }
+
+  function toPromise<T = unknown>(request: IDBRequest<T>) {
+    return new Promise<T>((resolve, reject) => {
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
+    });
+  }
+
+  return {
+    async put(type, name, data) {
+      const db = await open();
+      const existing = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      const stored: BrowserStoredSecret = {
+        id: idOf(type, name),
+        type,
+        name,
+        data,
+        createdAt: existing?.createdAt ?? new Date().toISOString(),
+      };
+      await toPromise(
+        db.transaction(SECRETS_STORE_NAME, 'readwrite').objectStore(SECRETS_STORE_NAME).put(stored),
+      );
+      return { type, name, createdAt: stored.createdAt, data };
+    },
+    async get(type, name) {
+      const db = await open();
+      const stored = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      if (!stored) return undefined;
+      return { type: stored.type, name: stored.name, createdAt: stored.createdAt, data: stored.data };
+    },
+    async list() {
+      const db = await open();
+      const all = await toPromise<BrowserStoredSecret[]>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).getAll(),
+      );
+      return all.map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const db = await open();
+      await toPromise(
+        db
+          .transaction(SECRETS_STORE_NAME, 'readwrite')
+          .objectStore(SECRETS_STORE_NAME)
+          .delete(idOf(type, name)),
+      );
+    },
+  };
+}

package/src/core/device-install/types.ts

@@ -40,6 +40,12 @@ export type ProvisioningProfileInfo = {
   applicationIdentifier?: string;
   bundleID?: string;
   provisionedDevices: string[];
+  /**
+   * Serial numbers (uppercase hex, no leading zeros) of the developer
+   * certificates embedded in the profile; the profile is only usable for
+   * signing with one of these certificates.
+   */
+  certificateSerialNumbers: string[];
   getTaskAllow?: boolean;
   expirationDate?: string;
 };

package/src/core/errors.ts

@@ -0,0 +1,3 @@
+export function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}

package/src/core/play-publish/google.ts

@@ -0,0 +1,113 @@
+const GSI_SRC = 'https://accounts.google.com/gsi/client';
+
+export const ANDROID_PUBLISHER_SCOPE = 'https://www.googleapis.com/auth/androidpublisher';
+
+type TokenResponse = { access_token?: string; error?: string; error_description?: string };
+type TokenClient = { requestAccessToken: () => void };
+type GoogleOAuth2 = {
+  initTokenClient: (config: {
+    client_id: string;
+    scope: string;
+    callback: (response: TokenResponse) => void;
+    error_callback?: (error: { type?: string; message?: string }) => void;
+  }) => TokenClient;
+};
+
+function googleOAuth2(): GoogleOAuth2 | undefined {
+  return (globalThis as { google?: { accounts?: { oauth2?: GoogleOAuth2 } } }).google?.accounts?.oauth2;
+}
+
+let gsiLoad: Promise<void> | undefined;
+
+export function loadGoogleIdentityServices(): Promise<void> {
+  if (googleOAuth2()) {
+    return Promise.resolve();
+  }
+  if (typeof document === 'undefined') {
+    return Promise.reject(new Error('Google sign-in requires a browser environment.'));
+  }
+  if (!gsiLoad) {
+    gsiLoad = new Promise<void>((resolve, reject) => {
+      const script = document.createElement('script');
+      script.src = GSI_SRC;
+      script.async = true;
+      script.addEventListener(
+        'load',
+        () => {
+          if (googleOAuth2()) {
+            resolve();
+          } else {
+            reject(new Error('Google sign-in script loaded without the OAuth client.'));
+          }
+        },
+        { once: true },
+      );
+      script.addEventListener(
+        'error',
+        () => {
+          script.remove();
+          reject(new Error('Failed to load the Google sign-in script.'));
+        },
+        { once: true },
+      );
+      document.head.appendChild(script);
+    });
+    // A failed load (offline, blocked CDN) must not poison retries.
+    gsiLoad.catch(() => {
+      gsiLoad = undefined;
+    });
+  }
+  return gsiLoad;
+}
+
+export type RequestGoogleAccessTokenInput = {
+  clientId: string;
+  scope?: string;
+};
+
+/**
+ * Opens the Google consent popup and resolves with a short-lived OAuth
+ * access token. Call from a user gesture so popup blockers allow it, and
+ * call loadGoogleIdentityServices beforehand (e.g. when the surrounding
+ * dialog opens) to keep this call synchronous with the click.
+ */
+export function requestGoogleAccessToken(input: RequestGoogleAccessTokenInput): Promise<string> {
+  // When GSI is already loaded the popup must open inside the caller's
+  // click turn: even an await of a resolved promise yields a microtask,
+  // which the strictest popup blockers treat as leaving the gesture.
+  if (googleOAuth2()) {
+    return openTokenPopup(input);
+  }
+  return loadGoogleIdentityServices().then(() => openTokenPopup(input));
+}
+
+function openTokenPopup({
+  clientId,
+  scope = ANDROID_PUBLISHER_SCOPE,
+}: RequestGoogleAccessTokenInput): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const client = googleOAuth2()!.initTokenClient({
+      client_id: clientId,
+      scope,
+      callback: (response) => {
+        if (response.error) {
+          reject(new Error(response.error_description || response.error));
+          return;
+        }
+        if (!response.access_token) {
+          reject(new Error('Google returned no access token.'));
+          return;
+        }
+        resolve(response.access_token);
+      },
+      error_callback: (error) => {
+        const fallback =
+          error?.type === 'popup_failed_to_open' ?
+            'Google sign-in popup was blocked by the browser.'
+          : 'Google sign-in was cancelled.';
+        reject(new Error(error?.message || fallback));
+      },
+    });
+    client.requestAccessToken();
+  });
+}

package/src/core/play-publish/publish.test.ts

@@ -0,0 +1,68 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { PlaystorePublishError, publishToPlaystore } from './publish';
+
+function mockFetch(status: number, body: string) {
+  const fetchMock = vi.fn(async () => new Response(body, { status }));
+  vi.stubGlobal('fetch', fetchMock);
+  return fetchMock;
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('publishToPlaystore', () => {
+  it('posts to the publish path with auth and org headers and returns the versionCode', async () => {
+    const fetchMock = mockFetch(200, JSON.stringify({ versionCode: 42 }));
+    const result = await publishToPlaystore({
+      registryApiUrl: 'https://registry-staging.limrun.dev',
+      token: 'limrun-token',
+      organizationId: 'org_x',
+      accessToken: 'google-token',
+      packageName: 'com.example.app',
+      assetName: 'app-release.aab',
+    });
+    expect(result.versionCode).toBe(42);
+    const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe('https://registry-staging.limrun.dev/android/playstore/publish');
+    const headers = init.headers as Record<string, string>;
+    expect(headers.Authorization).toBe('Bearer limrun-token');
+    expect(headers['X-Limrun-Organization']).toBe('org_x');
+    const body = JSON.parse(init.body as string) as Record<string, unknown>;
+    expect(body).toEqual({
+      accessToken: 'google-token',
+      packageName: 'com.example.app',
+      assetName: 'app-release.aab',
+    });
+  });
+
+  it('surfaces the registry error message and code', async () => {
+    mockFetch(
+      409,
+      JSON.stringify({ message: 'Version code 2 has already been used', code: 'versionCodeExists' }),
+    );
+    const error = await publishToPlaystore({
+      registryApiUrl: 'https://registry-staging.limrun.dev',
+      accessToken: 'google-token',
+      packageName: 'com.example.app',
+      assetName: 'app-release.aab',
+    }).catch((caught: unknown) => caught);
+    expect(error).toBeInstanceOf(PlaystorePublishError);
+    const publishError = error as PlaystorePublishError;
+    expect(publishError.code).toBe('versionCodeExists');
+    expect(publishError.status).toBe(409);
+    expect(publishError.message).toContain('already been used');
+  });
+
+  it('handles non-JSON error bodies', async () => {
+    mockFetch(502, '<html>bad gateway</html>');
+    const error = await publishToPlaystore({
+      registryApiUrl: 'https://registry-staging.limrun.dev',
+      accessToken: 'google-token',
+      packageName: 'com.example.app',
+      assetId: 'asset_1',
+    }).catch((caught: unknown) => caught);
+    expect(error).toBeInstanceOf(PlaystorePublishError);
+    expect((error as PlaystorePublishError).message).toContain('HTTP 502');
+  });
+});

package/src/core/play-publish/publish.ts

@@ -0,0 +1,89 @@
+export type PlaystorePublishInput = {
+  registryApiUrl: string;
+  /** Limrun API token authenticating the registry call. */
+  token?: string;
+  /** Organization tid; required when it differs from the token's default organization. */
+  organizationId?: string;
+  /** Google OAuth access token with the androidpublisher scope. Sent per request, never stored. */
+  accessToken: string;
+  packageName: string;
+  assetId?: string;
+  assetName?: string;
+  /** Play track ID, defaults to internal on the server. */
+  track?: string;
+  /** Required by the server when track is production. */
+  releaseStatus?: 'draft' | 'completed';
+};
+
+export type PlaystorePublishResult = {
+  versionCode: number;
+};
+
+/**
+ * Registry publish failure. `code` carries the registry's machine-readable
+ * error code when available: invalidRequest, assetNotFound, internal, busy,
+ * listingNotFound, permissionDenied, versionCodeExists, uploadKeyMismatch
+ * or unknown; the set grows additively.
+ */
+export class PlaystorePublishError extends Error {
+  readonly code?: string;
+  readonly status?: number;
+
+  constructor(message: string, options: { code?: string; status?: number } = {}) {
+    super(message);
+    this.name = 'PlaystorePublishError';
+    this.code = options.code;
+    this.status = options.status;
+  }
+}
+
+export async function publishToPlaystore(input: PlaystorePublishInput): Promise<PlaystorePublishResult> {
+  const { registryApiUrl, token, organizationId, ...body } = input;
+  let url: URL;
+  try {
+    url = new URL(registryApiUrl);
+  } catch {
+    throw new PlaystorePublishError(`Invalid registry URL: ${registryApiUrl}`);
+  }
+  url.pathname = `${url.pathname.replace(/\/$/, '')}/android/playstore/publish`;
+  url.search = '';
+  url.hash = '';
+  const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  if (organizationId) {
+    headers['X-Limrun-Organization'] = organizationId;
+  }
+  let response: Response;
+  try {
+    response = await fetch(url.toString(), {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+    });
+  } catch (caught) {
+    throw new PlaystorePublishError(
+      `Cannot reach the registry: ${caught instanceof Error ? caught.message : String(caught)}`,
+    );
+  }
+  const raw = await response.text();
+  let parsed: { versionCode?: number; message?: string; code?: string } | undefined;
+  try {
+    parsed = raw ? (JSON.parse(raw) as typeof parsed) : undefined;
+  } catch {
+    parsed = undefined;
+  }
+  if (!response.ok) {
+    throw new PlaystorePublishError(parsed?.message || `Play publish failed with HTTP ${response.status}`, {
+      code: parsed?.code,
+      status: response.status,
+    });
+  }
+  if (typeof parsed?.versionCode !== 'number') {
+    throw new PlaystorePublishError('Play publish response is missing versionCode.', {
+      status: response.status,
+    });
+  }
+  return { versionCode: parsed.versionCode };
+}

package/src/device-build/react.ts

@@ -8,6 +8,7 @@ import {
   type IOSOTAInstall,
   type StoredSigningAssets,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type UseDeviceBuildOptions = {
   apiUrl?: string;
@@ -127,7 +128,3 @@ export function useDeviceBuild({
     reset,
   };
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/device-install/demo/demo.tsx

@@ -29,6 +29,7 @@ import {
 import { useDeviceBuild } from '../../device-build/react';
 import { useDeviceInstallRelay } from '../react';
 import './demo.css';
+import { errorMessage } from '../../core/errors';
 
 type ActivityLine = {
   id: number;
@@ -295,10 +296,7 @@ function App() {
     }
   }
 
-  async function loadAppleResources(
-    teamId = developerTeamId,
-    relay = appleLogin.session?.relay,
-  ) {
+  async function loadAppleResources(teamId = developerTeamId, relay = appleLogin.session?.relay) {
     if (!apiUrl.trim() || !relay || !teamId) return;
     const base = {
       relay,
@@ -1056,10 +1054,6 @@ function useLocalStorage(key: string, initialValue: string) {
   return [value, setValue] as const;
 }
 
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <App />