@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.4

package/src/core/device-install/operations/operations.ts

@@ -4,6 +4,7 @@ import type { DeviceHello, DeviceInstallLog, PairRecordPayload } from '../types'
 import { RelayClient } from './relay-client';
 import { closeUsbmuxSession, createUsbmuxSession, type UsbmuxSession } from './usbmux';
 import { claimUsbmux, findUsbmuxCandidates, requestAppleDevice, type UsbmuxCandidate } from './webusb';
+import { errorMessage } from '../../errors';
 
 export type DeviceRelayTarget = {
   device: USBDevice;
@@ -210,10 +211,6 @@ export function deviceRelayWebSocketUrl(registryApiUrl: string, token?: string,
   return url.toString();
 }
 
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 async function resetUSBDevice(target: DeviceRelayTarget) {
   if (target.claimedInterfaceNumber !== undefined) {
     try {

package/src/core/device-install/storage/browser-storage.test.ts

@@ -0,0 +1,65 @@
+import forge from 'node-forge';
+import { describe, expect, test } from 'vitest';
+import { normalizeCertificateSerial, parseProvisioningProfileBase64 } from './browser-storage';
+
+function selfSignedCertificateBase64(serialNumber: string) {
+  const keys = forge.pki.rsa.generateKeyPair(1024);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = serialNumber;
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
+  const attrs = [{ name: 'commonName', value: 'Apple Development Test' }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.sign(keys.privateKey);
+  return forge.util.encode64(forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes());
+}
+
+function profileBase64(certificatesBase64: string[]) {
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0">
+<dict>
+  <key>Name</key><string>Limrun Dev</string>
+  <key>UUID</key><string>11111111-2222-3333-4444-555555555555</string>
+  <key>TeamIdentifier</key><array><string>TEAM123</string></array>
+  <key>ProvisionedDevices</key><array><string>00008030-000A</string></array>
+  <key>DeveloperCertificates</key>
+  <array>${certificatesBase64.map((c) => `<data>${c}</data>`).join('')}</array>
+  <key>Entitlements</key>
+  <dict>
+    <key>application-identifier</key><string>TEAM123.com.example.app</string>
+    <key>com.apple.developer.team-identifier</key><string>TEAM123</string>
+  </dict>
+</dict>
+</plist>`;
+  return btoa(xml);
+}
+
+describe('parseProvisioningProfileBase64', () => {
+  test('extracts embedded certificate serial numbers in normalized form', () => {
+    const parsed = parseProvisioningProfileBase64(
+      profileBase64([selfSignedCertificateBase64('00ab12cd'), selfSignedCertificateBase64('7f')]),
+    );
+    expect(parsed.certificateSerialNumbers).toEqual(['AB12CD', '7F']);
+    expect(parsed.bundleID).toBe('com.example.app');
+    expect(parsed.teamID).toBe('TEAM123');
+    expect(parsed.provisionedDevices).toEqual(['00008030-000A']);
+  });
+
+  test('skips unparseable certificates instead of failing the profile', () => {
+    const parsed = parseProvisioningProfileBase64(
+      profileBase64([btoa('not a certificate'), selfSignedCertificateBase64('1a')]),
+    );
+    expect(parsed.certificateSerialNumbers).toEqual(['1A']);
+  });
+});
+
+describe('normalizeCertificateSerial', () => {
+  test('uppercases and strips leading zeros', () => {
+    expect(normalizeCertificateSerial('00ab12')).toBe('AB12');
+    expect(normalizeCertificateSerial('AB12')).toBe('AB12');
+    expect(normalizeCertificateSerial('')).toBeUndefined();
+    expect(normalizeCertificateSerial(undefined)).toBeUndefined();
+  });
+});

package/src/core/device-install/storage/browser-storage.ts

@@ -1,3 +1,4 @@
+import forge from 'node-forge';
 import type {
   DeviceInstallSigningMode,
   ProvisioningProfileInfo,
@@ -198,11 +199,43 @@ export function parseProvisioningProfileBytes(bytes: Uint8Array) {
     applicationIdentifier,
     bundleID,
     provisionedDevices: stringArrayValue(value.ProvisionedDevices),
+    certificateSerialNumbers: certificateSerialNumbers(stringArrayValue(value.DeveloperCertificates)),
     getTaskAllow: booleanValue(entitlements['get-task-allow']),
     expirationDate: stringValue(value.ExpirationDate),
   } satisfies ProvisioningProfileInfo;
 }
 
+/**
+ * Normalizes a certificate serial number for comparison: uppercase hex
+ * without leading zeros, the format Apple's portal reports in serialNum.
+ */
+export function normalizeCertificateSerial(serial?: string) {
+  const normalized = (serial ?? '').replace(/^0+/, '').toUpperCase();
+  return normalized || undefined;
+}
+
+/**
+ * Reads the serial numbers of the DER certificates embedded in a profile's
+ * DeveloperCertificates array. Unparseable entries are skipped: a profile
+ * with an exotic certificate should degrade to weaker filtering, not fail
+ * the whole parse.
+ */
+function certificateSerialNumbers(developerCertificatesBase64: string[]) {
+  const serials: string[] = [];
+  for (const entry of developerCertificatesBase64) {
+    try {
+      // Plist <data> payloads wrap base64 across lines; atob rejects whitespace.
+      const der = atob(entry.replace(/\s+/g, ''));
+      const certificate = forge.pki.certificateFromAsn1(forge.asn1.fromDer(forge.util.createBuffer(der)));
+      const serial = normalizeCertificateSerial(certificate.serialNumber);
+      if (serial && !serials.includes(serial)) serials.push(serial);
+    } catch {
+      // Skip certificates forge cannot parse.
+    }
+  }
+  return serials;
+}
+
 async function getSigningAssetsByID(id?: string) {
   if (!id) return undefined;
   const db = await openDB(SIGNING_DB_NAME, SIGNING_DB_VERSION, SIGNING_STORE_NAME, 'id');

package/src/core/device-install/storage/index.ts

@@ -1 +1,2 @@
 export * from './browser-storage';
+export * from './secret-store';

package/src/core/device-install/storage/secret-store.ts

@@ -0,0 +1,298 @@
+/**
+ * A pluggable store for Apple signing secrets.
+ *
+ * Credential material always lands in the browser first (the Apple relay
+ * only proxies); the browser then writes it into a store implementing this
+ * interface. Limrun's org secret store is the default implementation, an
+ * IndexedDB-backed one keeps everything local, and customers can bring
+ * their own store by implementing the same interface.
+ */
+
+export const APPLE_CERTIFICATE_SECRET_TYPE = 'appleCertificate';
+export const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = 'appleProvisioningProfile';
+
+export type SigningSecretType =
+  | typeof APPLE_CERTIFICATE_SECRET_TYPE
+  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE;
+
+export type SigningSecretMetadata = {
+  type: string;
+  name: string;
+  createdAt?: string;
+};
+
+/** Type-specific flat key-value payload of a signing secret. */
+export type SigningSecretData = Record<string, string>;
+
+export type SigningSecret = SigningSecretMetadata & {
+  data: SigningSecretData;
+};
+
+export interface SigningSecretStore {
+  /**
+   * Stores a secret. When a secret with the same type and name already
+   * exists its data is overwritten. Returns the stored secret; callers
+   * should use the returned data.
+   */
+  put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
+  /** Returns the secret including its data, or undefined when absent. */
+  get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
+  /** Lists metadata of all stored signing secrets, never their data. */
+  list(): Promise<SigningSecretMetadata[]>;
+  /** Deletes a secret; resolves even when the secret does not exist. */
+  delete(type: SigningSecretType, name: string): Promise<void>;
+}
+
+/**
+ * Apple's certificate types as defined by the App Store Connect API
+ * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
+ */
+export type AppleCertificateType =
+  | 'DEVELOPMENT'
+  | 'DISTRIBUTION'
+  | 'IOS_DEVELOPMENT'
+  | 'IOS_DISTRIBUTION'
+  | 'MAC_APP_DEVELOPMENT'
+  | 'MAC_APP_DISTRIBUTION'
+  | 'MAC_INSTALLER_DISTRIBUTION'
+  | 'DEVELOPER_ID_APPLICATION'
+  | 'DEVELOPER_ID_INSTALLER'
+  | 'DEVELOPER_ID_KEXT'
+  | 'PASS_TYPE_ID'
+  | 'PASS_TYPE_ID_WITH_NFC';
+
+/** Data payload of an appleCertificate secret. */
+export type AppleCertificateSecretData = {
+  certificateP12Base64: string;
+  /** Which of Apple's certificate types the p12 holds. */
+  certificateType: AppleCertificateType;
+  certificatePassword?: string;
+  teamID?: string;
+  /** Apple's portal certificate id, never a Limrun DB id. */
+  certificateID?: string;
+  /** The certificate's serial number: uppercase hex, no leading zeros. */
+  serialNumber?: string;
+  expirationDate?: string;
+};
+
+/**
+ * Data payload of an appleProvisioningProfile secret. The
+ * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
+ * the signed profile binds (as comma-separated lists) so profiles can be
+ * filtered by certificate, bundle ID or device without parsing every
+ * entry. Certificates are referenced by serial number, the identifier
+ * Apple embeds in the profile itself.
+ */
+export type AppleProvisioningProfileSecretData = {
+  provisioningProfileBase64: string;
+  certificateSerialNumbers?: string;
+  bundleIDs?: string;
+  deviceIDs?: string;
+  teamID?: string;
+  profileName?: string;
+  uuid?: string;
+  expirationDate?: string;
+};
+
+function compactData(data: Record<string, string | undefined>): SigningSecretData {
+  const result: SigningSecretData = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (value) result[key] = value;
+  }
+  return result;
+}
+
+/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
+export async function putAppleCertificateSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleCertificateSecretData,
+) {
+  return store.put(APPLE_CERTIFICATE_SECRET_TYPE, name, compactData(data));
+}
+
+/**
+ * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
+ * so a team can hold many profiles for the same bundle ID and certificate
+ * set; consumers select by the reference fields, not by name.
+ */
+export async function putAppleProvisioningProfileSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleProvisioningProfileSecretData,
+) {
+  return store.put(APPLE_PROVISIONING_PROFILE_SECRET_TYPE, name, compactData(data));
+}
+
+export type LimrunSecretStoreOptions = {
+  /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
+  apiUrl: string;
+  /** Bearer token: a user or organization token. */
+  token: string;
+  /** Organization TID owning the secrets. */
+  organizationId: string;
+  /** Custom fetch, mainly for tests. */
+  fetch?: typeof fetch;
+};
+
+type BackendSecretResult = {
+  id: string;
+  type: string;
+  name: string;
+  organizationId: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore backed by Limrun's organization secret store
+ * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
+ * shared across the organization.
+ */
+export function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore {
+  const doFetch = options.fetch ?? fetch.bind(globalThis);
+  const base = options.apiUrl.replace(/\/+$/, '');
+  const secretUrl = (type: string, name: string) =>
+    `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets/${encodeURIComponent(
+      type,
+    )}/${encodeURIComponent(name)}`;
+  const headers = {
+    Authorization: `Bearer ${options.token}`,
+    'Content-Type': 'application/json',
+  };
+
+  async function fail(response: Response, action: string): Promise<never> {
+    let message = `${response.status}`;
+    try {
+      const body = (await response.json()) as { message?: string };
+      if (body.message) message = body.message;
+    } catch {
+      // Non-JSON error body; the status code is the best we have.
+    }
+    throw new Error(`Failed to ${action} secret: ${message}`);
+  }
+
+  return {
+    async put(type, name, data) {
+      const response = await doFetch(secretUrl(type, name), {
+        method: 'PUT',
+        headers,
+        body: JSON.stringify({ data, replace: true }),
+      });
+      if (!response.ok) await fail(response, 'store');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async get(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'GET', headers });
+      if (response.status === 404) return undefined;
+      if (!response.ok) await fail(response, 'fetch');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async list() {
+      const response = await doFetch(
+        `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets`,
+        { method: 'GET', headers },
+      );
+      if (!response.ok) await fail(response, 'list');
+      const result = (await response.json()) as Omit<BackendSecretResult, 'data'>[];
+      return result
+        .filter(
+          (s) =>
+            s.type === APPLE_CERTIFICATE_SECRET_TYPE || s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
+        )
+        .map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'DELETE', headers });
+      if (response.status === 404) return;
+      if (!response.ok) await fail(response, 'delete');
+    },
+  };
+}
+
+const SECRETS_DB_NAME = 'limrun-signing-secrets';
+const SECRETS_DB_VERSION = 1;
+const SECRETS_STORE_NAME = 'secrets';
+
+type BrowserStoredSecret = {
+  id: string;
+  type: string;
+  name: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore keeping everything in the browser's IndexedDB.
+ * Nothing leaves the machine; secrets are per-browser-profile.
+ */
+export function createBrowserSecretStore(): SigningSecretStore {
+  const idOf = (type: string, name: string) => `${type}:${name}`;
+
+  function open() {
+    return new Promise<IDBDatabase>((resolve, reject) => {
+      const request = indexedDB.open(SECRETS_DB_NAME, SECRETS_DB_VERSION);
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(SECRETS_STORE_NAME)) {
+          db.createObjectStore(SECRETS_STORE_NAME, { keyPath: 'id' });
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('Open IndexedDB failed'));
+    });
+  }
+
+  function toPromise<T = unknown>(request: IDBRequest<T>) {
+    return new Promise<T>((resolve, reject) => {
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
+    });
+  }
+
+  return {
+    async put(type, name, data) {
+      const db = await open();
+      const existing = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      const stored: BrowserStoredSecret = {
+        id: idOf(type, name),
+        type,
+        name,
+        data,
+        createdAt: existing?.createdAt ?? new Date().toISOString(),
+      };
+      await toPromise(
+        db.transaction(SECRETS_STORE_NAME, 'readwrite').objectStore(SECRETS_STORE_NAME).put(stored),
+      );
+      return { type, name, createdAt: stored.createdAt, data };
+    },
+    async get(type, name) {
+      const db = await open();
+      const stored = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      if (!stored) return undefined;
+      return { type: stored.type, name: stored.name, createdAt: stored.createdAt, data: stored.data };
+    },
+    async list() {
+      const db = await open();
+      const all = await toPromise<BrowserStoredSecret[]>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).getAll(),
+      );
+      return all.map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const db = await open();
+      await toPromise(
+        db
+          .transaction(SECRETS_STORE_NAME, 'readwrite')
+          .objectStore(SECRETS_STORE_NAME)
+          .delete(idOf(type, name)),
+      );
+    },
+  };
+}

package/src/core/device-install/types.ts

@@ -40,6 +40,12 @@ export type ProvisioningProfileInfo = {
   applicationIdentifier?: string;
   bundleID?: string;
   provisionedDevices: string[];
+  /**
+   * Serial numbers (uppercase hex, no leading zeros) of the developer
+   * certificates embedded in the profile; the profile is only usable for
+   * signing with one of these certificates.
+   */
+  certificateSerialNumbers: string[];
   getTaskAllow?: boolean;
   expirationDate?: string;
 };

package/src/core/errors.ts

@@ -0,0 +1,3 @@
+export function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}

package/src/core/play-publish/google.ts

@@ -71,11 +71,20 @@ export type RequestGoogleAccessTokenInput = {
  * call loadGoogleIdentityServices beforehand (e.g. when the surrounding
  * dialog opens) to keep this call synchronous with the click.
  */
-export async function requestGoogleAccessToken({
+export function requestGoogleAccessToken(input: RequestGoogleAccessTokenInput): Promise<string> {
+  // When GSI is already loaded the popup must open inside the caller's
+  // click turn: even an await of a resolved promise yields a microtask,
+  // which the strictest popup blockers treat as leaving the gesture.
+  if (googleOAuth2()) {
+    return openTokenPopup(input);
+  }
+  return loadGoogleIdentityServices().then(() => openTokenPopup(input));
+}
+
+function openTokenPopup({
   clientId,
   scope = ANDROID_PUBLISHER_SCOPE,
 }: RequestGoogleAccessTokenInput): Promise<string> {
-  await loadGoogleIdentityServices();
   return new Promise<string>((resolve, reject) => {
     const client = googleOAuth2()!.initTokenClient({
       client_id: clientId,

package/src/device-build/react.ts

@@ -8,6 +8,7 @@ import {
   type IOSOTAInstall,
   type StoredSigningAssets,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type UseDeviceBuildOptions = {
   apiUrl?: string;
@@ -127,7 +128,3 @@ export function useDeviceBuild({
     reset,
   };
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/device-install/demo/demo.tsx

@@ -29,6 +29,7 @@ import {
 import { useDeviceBuild } from '../../device-build/react';
 import { useDeviceInstallRelay } from '../react';
 import './demo.css';
+import { errorMessage } from '../../core/errors';
 
 type ActivityLine = {
   id: number;
@@ -1053,10 +1054,6 @@ function useLocalStorage(key: string, initialValue: string) {
   return [value, setValue] as const;
 }
 
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <App />

package/src/device-install/react.ts

@@ -12,6 +12,7 @@ import {
   type RelayClient,
   type StoredPairRecord,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type DeviceInstallRelayBusyAction = 'usb' | 'pair' | 'install';
 
@@ -192,7 +193,3 @@ export function useDeviceInstallRelay({
 function noopLog() {
   // Intentionally empty. Consumers can pass a logger for progress messages.
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/play-publish/README.md

@@ -29,7 +29,8 @@ const play = usePlaystorePublish({
   googleClientId: GOOGLE_OAUTH_CLIENT_ID,
 });
 
-// On dialog open, warm the sign-in script so the click stays popup-safe:
+// On dialog open, warm the sign-in script so the click stays popup-safe.
+// Optionally await the returned promise (true = ready) to gate the button:
 play.preloadGoogle();
 
 // Button handlers:
@@ -39,9 +40,9 @@ await play.publish({ assetName: 'app-release.aab', packageName: 'com.example.app
 // Render from state: play.status, play.versionCode, play.error, play.errorCode
 ```
 
-`errorCode` values: `invalidRequest`, `assetNotFound`, `internal`, `busy`,
-`listingNotFound`, `permissionDenied`, `versionCodeExists`,
-`uploadKeyMismatch`, `unknown`. The set grows additively.
+`errorCode` carries the registry's machine-readable error code; the
+canonical value list lives on `PlaystorePublishError`'s doc comment and
+grows additively.
 
 Google access tokens expire after about an hour. A `permissionDenied`
 error long after sign-in usually means the token expired; offer "Sign in