@mpgd/cli 0.47.0 → 0.48.0

package/dist/windows-host/Core/BridgeCommand.cs

@@ -0,0 +1,17 @@
+namespace Mpgd.MicrosoftStore.Host;
+
+public abstract record BridgeCommand(string RequestId, string Method);
+
+public sealed record GetCatalogDetailsCommand(
+    string RequestId,
+    IReadOnlyList<string> ItemIds)
+    : BridgeCommand(RequestId, NativeBridgeProtocol.CatalogGetDetailsMethod);
+
+public sealed record SignInCommand(string RequestId)
+    : BridgeCommand(RequestId, NativeBridgeProtocol.IdentitySignInMethod);
+
+public sealed record ListPurchasesCommand(string RequestId)
+    : BridgeCommand(RequestId, NativeBridgeProtocol.PurchaseListMethod);
+
+public sealed record RequestPurchaseCommand(string RequestId, string ItemId)
+    : BridgeCommand(RequestId, NativeBridgeProtocol.PurchaseRequestMethod);

package/dist/windows-host/Core/Mpgd.MicrosoftStore.Host.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>12</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+</Project>

package/dist/windows-host/Core/NativeBridgeContracts.cs

@@ -0,0 +1,33 @@
+namespace Mpgd.MicrosoftStore.Host;
+
+// Only these web-facing results are serialized. SDK credentials and backend
+// collections tickets stay inside the game-owned implementation.
+public sealed record NativeProductPrice(string CurrencyCode, string Formatted);
+public sealed record NativeProductDetail(string ItemId, string Title, string? Description, NativeProductPrice Price);
+public sealed record NativeProductDetailsResult(IReadOnlyList<NativeProductDetail> Items);
+public sealed record NativePlayerSession(long ExpiresAt, string PlayerId, string SessionToken);
+public sealed record NativePurchase(string ItemId, string PurchaseToken);
+public sealed record NativePurchasesResult(IReadOnlyList<NativePurchase> Items);
+public sealed record NativePurchaseResult(string Status, string? PurchaseToken = null);
+
+public interface INativeStoreOperations
+{
+    Task<NativeProductDetailsResult> GetDetailsAsync(GetCatalogDetailsCommand command, CancellationToken cancellation);
+    Task<NativePlayerSession> SignInAsync(CancellationToken cancellation);
+    Task<NativePurchasesResult> ListPurchasesAsync(CancellationToken cancellation);
+    Task<NativePurchaseResult> RequestPurchaseAsync(RequestPurchaseCommand command, CancellationToken cancellation);
+}
+
+/// <summary>Run the callback on the owning window's UI thread. Cancellation must
+/// prevent callbacks that are still queued from starting.</summary>
+public interface INativeBridgeDispatcher
+{
+    Task RunAsync(Func<Task> callback, CancellationToken cancellation);
+}
+
+public enum NativeBridgeFailure { UserCancelled, IdentityUnavailable, StoreUnavailable }
+
+public sealed class NativeBridgeOperationException(NativeBridgeFailure failure) : Exception
+{
+    public NativeBridgeFailure Failure { get; } = failure;
+}

package/dist/windows-host/Core/NativeBridgeHost.cs

@@ -0,0 +1,162 @@
+namespace Mpgd.MicrosoftStore.Host;
+
+/// <summary>A window-owned native bridge. InvalidateDocument on every top-level
+/// accepted navigation start, activate when an allowed document commits, invalidate on
+/// navigation failure, and dispose when the window closes. PostResponse must
+/// synchronously send JSON.</summary>
+public sealed class NativeBridgeHost : IDisposable
+{
+    private readonly NativeBridgeOrigin origin;
+    private readonly HashSet<string> allowedItems;
+    private readonly INativeStoreOperations operations;
+    private readonly INativeBridgeDispatcher dispatcher;
+    private readonly Action<string> postResponse;
+    private readonly SemaphoreSlim serial = new(1, 1);
+    private readonly object sync = new();
+    private Document? document;
+    private bool closed;
+    private readonly int maximumPendingRequests;
+
+    private sealed record Document(CancellationTokenSource Lifetime, NativeBridgeRequestGate Gate);
+
+    public NativeBridgeHost(NativeBridgeOrigin origin, IEnumerable<string> allowedItemIds,
+        INativeStoreOperations operations, INativeBridgeDispatcher dispatcher,
+        Action<string> postResponse, int maximumPendingRequests = 64)
+    {
+        ArgumentNullException.ThrowIfNull(origin);
+        ArgumentNullException.ThrowIfNull(allowedItemIds);
+        ArgumentNullException.ThrowIfNull(operations);
+        ArgumentNullException.ThrowIfNull(dispatcher);
+        ArgumentNullException.ThrowIfNull(postResponse);
+        if (maximumPendingRequests < 1) throw new ArgumentOutOfRangeException(nameof(maximumPendingRequests));
+        this.origin = origin;
+        allowedItems = new(allowedItemIds, StringComparer.Ordinal);
+        if (allowedItems.Any(item => !NativeBridgeProtocol.IsValidIdentifier(item, NativeBridgeProtocol.MaximumItemIdLength)))
+            throw new ArgumentException("Invalid product allowlist.", nameof(allowedItemIds));
+        this.operations = operations;
+        this.dispatcher = dispatcher;
+        this.postResponse = postResponse;
+        this.maximumPendingRequests = maximumPendingRequests;
+    }
+
+    public bool ActivateDocument(string source)
+    {
+        InvalidateDocument();
+        lock (sync)
+        {
+            if (closed || !origin.Allows(source)) return false;
+            document = new(new(), new(maximumPendingRequests));
+            return true;
+        }
+    }
+
+    public void InvalidateDocument()
+    {
+        Document? previous;
+        lock (sync)
+        {
+            previous = document;
+            document = null;
+        }
+        // Cancellation callbacks are game code and must run outside the state lock.
+        try { previous?.Lifetime.Cancel(); }
+        catch (AggregateException)
+        {
+            // Cancel invokes every registered callback before aggregating its
+            // exceptions. State is already revoked; a game callback must not
+            // abort window cleanup or allow an old document to publish again.
+        }
+    }
+
+    public async Task HandleMessageAsync(string source, string message, CancellationToken cancellation = default)
+    {
+        Document current;
+        lock (sync)
+        {
+            if (closed || document is null || !origin.Allows(source)) return;
+            current = document;
+        }
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(current.Lifetime.Token, cancellation);
+        var token = linked.Token;
+        try
+        {
+            if (!NativeBridgeProtocol.TryParseCommand(message, allowedItems, out var command, out var parseError) || command is null)
+            {
+                if (NativeBridgeProtocol.TryReadRouting(message, out var id, out var method))
+                    await SendAsync(current, NativeBridgeResult.Failure(id, method, parseError), token).ConfigureAwait(false);
+                return;
+            }
+            if (!current.Gate.TryEnter(command.RequestId, out var lease, out var gateError))
+            {
+                await SendAsync(current, NativeBridgeResult.Failure(command.RequestId, command.Method, gateError), token).ConfigureAwait(false);
+                return;
+            }
+            using (lease)
+            {
+                await serial.WaitAsync(token).ConfigureAwait(false);
+                string response;
+                try
+                {
+                    token.ThrowIfCancellationRequested();
+                    string? success = null;
+                    await dispatcher.RunAsync(async () =>
+                    {
+                        token.ThrowIfCancellationRequested();
+                        object result = command switch
+                        {
+                            GetCatalogDetailsCommand catalog => await operations.GetDetailsAsync(catalog, token),
+                            SignInCommand => await operations.SignInAsync(token),
+                            ListPurchasesCommand => await operations.ListPurchasesAsync(token),
+                            RequestPurchaseCommand purchase => await operations.RequestPurchaseAsync(purchase, token),
+                            _ => throw new InvalidOperationException(),
+                        };
+                        token.ThrowIfCancellationRequested();
+                        success = NativeBridgeResult.Success(command, result, allowedItems);
+                    }, token).ConfigureAwait(false);
+                    response = success ?? throw new InvalidOperationException();
+                }
+                catch (OperationCanceledException) when (token.IsCancellationRequested) { return; }
+                catch (NativeBridgeOperationException error)
+                {
+                    if (command is RequestPurchaseCommand && error.Failure == NativeBridgeFailure.UserCancelled)
+                    {
+                        response = NativeBridgeResult.Success(command, new NativePurchaseResult("not-purchased"), allowedItems);
+                    }
+                    else
+                    {
+                        string code = error.Failure switch
+                        {
+                            NativeBridgeFailure.UserCancelled => "USER_CANCELLED",
+                            NativeBridgeFailure.IdentityUnavailable => "IDENTITY_UNAVAILABLE",
+                            NativeBridgeFailure.StoreUnavailable => "STORE_UNAVAILABLE",
+                            _ => "NATIVE_OPERATION_FAILED",
+                        };
+                        response = NativeBridgeResult.Failure(command.RequestId, command.Method, code);
+                    }
+                }
+                catch { response = NativeBridgeResult.Failure(command.RequestId, command.Method, "NATIVE_OPERATION_FAILED"); }
+                finally { serial.Release(); }
+                await SendAsync(current, response, token).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException) when (token.IsCancellationRequested) { }
+    }
+
+    private Task SendAsync(Document current, string response, CancellationToken token) => dispatcher.RunAsync(() =>
+    {
+        lock (sync)
+        {
+            if (!closed && ReferenceEquals(document, current) && !token.IsCancellationRequested)
+                postResponse(response);
+        }
+        return Task.CompletedTask;
+    }, token);
+
+    public void Dispose()
+    {
+        lock (sync) { if (closed) return; closed = true; }
+        InvalidateDocument();
+        // In-flight callbacks retain their document and may still observe its
+        // token. The semaphore remains valid until this host is collected.
+    }
+}

package/dist/windows-host/Core/NativeBridgeOrigin.cs

@@ -0,0 +1,19 @@
+namespace Mpgd.MicrosoftStore.Host;
+
+public sealed class NativeBridgeOrigin
+{
+    private readonly Uri origin;
+
+    public NativeBridgeOrigin(Uri startUri)
+    {
+        ArgumentNullException.ThrowIfNull(startUri);
+        if (!startUri.IsAbsoluteUri || startUri.Scheme != Uri.UriSchemeHttps || startUri.UserInfo.Length != 0)
+            throw new ArgumentException("A credential-free HTTPS start URI is required.", nameof(startUri));
+        origin = startUri;
+    }
+
+    public bool Allows(string? source) => Uri.TryCreate(source, UriKind.Absolute, out var uri)
+        && uri.Scheme == Uri.UriSchemeHttps && uri.UserInfo.Length == 0
+        && string.Equals(uri.IdnHost, origin.IdnHost, StringComparison.OrdinalIgnoreCase)
+        && uri.Port == origin.Port;
+}

package/dist/windows-host/Core/NativeBridgeProtocol.cs

@@ -0,0 +1,335 @@
+using System.Globalization;
+using System.Text.Json;
+
+namespace Mpgd.MicrosoftStore.Host;
+
+public static class NativeBridgeProtocol
+{
+    public const string Protocol = "mpgd.microsoft-store.native.v1";
+    public const string CatalogGetDetailsMethod = "catalog.getDetails";
+    public const string IdentitySignInMethod = "identity.signIn";
+    public const string PurchaseListMethod = "purchase.list";
+    public const string PurchaseRequestMethod = "purchase.request";
+
+    public const string InvalidRequestError = "INVALID_REQUEST";
+    public const string BridgeBusyError = "BRIDGE_BUSY";
+    public const string DuplicateRequestError = "DUPLICATE_REQUEST";
+    public const string ProductNotAllowedError = "PRODUCT_NOT_ALLOWED";
+    public const string UnsupportedMethodError = "UNSUPPORTED_METHOD";
+
+    public const int MaximumMessageLength = 64 * 1024;
+    public const int MaximumItemCount = 64;
+    public const int MaximumItemIdLength = 256;
+    public const int MaximumMethodNameLength = 64;
+    public const int MaximumRequestIdLength = 128;
+
+    private static readonly JsonDocumentOptions DocumentOptions = new()
+    {
+        AllowTrailingCommas = false,
+        CommentHandling = JsonCommentHandling.Disallow,
+        MaxDepth = 8,
+    };
+
+    private static readonly HashSet<string> RequestProperties =
+        ["protocol", "requestId", "method", "payload"];
+    private static readonly HashSet<string> EmptyProperties = [];
+    private static readonly HashSet<string> CatalogPayloadProperties = ["itemIds"];
+    private static readonly HashSet<string> PurchasePayloadProperties = ["itemId"];
+
+    public static bool TryParseCommand(
+        string message,
+        IReadOnlySet<string> allowedItemIds,
+        out BridgeCommand? command,
+        out string errorCode)
+    {
+        command = null;
+        errorCode = InvalidRequestError;
+        if (string.IsNullOrEmpty(message) || message.Length > MaximumMessageLength)
+        {
+            return false;
+        }
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(message, DocumentOptions);
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object || !HasExactProperties(root, RequestProperties))
+            {
+                return false;
+            }
+
+            if (!TryReadExactString(root, "protocol", Protocol.Length, out string protocol)
+                || protocol != Protocol
+                || !TryReadIdentifier(
+                    root,
+                    "requestId",
+                    MaximumRequestIdLength,
+                    out string requestId)
+                || !TryReadIdentifier(
+                    root,
+                    "method",
+                    MaximumMethodNameLength,
+                    out string method)
+                || !root.TryGetProperty("payload", out JsonElement payload)
+                || payload.ValueKind != JsonValueKind.Object)
+            {
+                return false;
+            }
+
+            switch (method)
+            {
+                case CatalogGetDetailsMethod:
+                    return TryParseCatalogCommand(
+                        requestId,
+                        payload,
+                        allowedItemIds,
+                        out command,
+                        out errorCode);
+                case IdentitySignInMethod:
+                    if (!HasExactProperties(payload, EmptyProperties))
+                    {
+                        return false;
+                    }
+
+                    command = new SignInCommand(requestId);
+                    return true;
+                case PurchaseListMethod:
+                    if (!HasExactProperties(payload, EmptyProperties))
+                    {
+                        return false;
+                    }
+
+                    command = new ListPurchasesCommand(requestId);
+                    return true;
+                case PurchaseRequestMethod:
+                    return TryParsePurchaseCommand(
+                        requestId,
+                        payload,
+                        allowedItemIds,
+                        out command,
+                        out errorCode);
+                default:
+                    errorCode = UnsupportedMethodError;
+                    return false;
+            }
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+        catch (InvalidOperationException)
+        {
+            return false;
+        }
+    }
+
+    public static bool TryReadRouting(
+        string message,
+        out string requestId,
+        out string method)
+    {
+        requestId = string.Empty;
+        method = string.Empty;
+        if (string.IsNullOrEmpty(message) || message.Length > MaximumMessageLength)
+        {
+            return false;
+        }
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(message, DocumentOptions);
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object
+                || !TryReadExactString(root, "protocol", Protocol.Length, out string protocol)
+                || protocol != Protocol
+                || !TryReadIdentifier(
+                    root,
+                    "requestId",
+                    MaximumRequestIdLength,
+                    out requestId)
+                || !TryReadIdentifier(
+                    root,
+                    "method",
+                    MaximumMethodNameLength,
+                    out method))
+            {
+                requestId = string.Empty;
+                method = string.Empty;
+                return false;
+            }
+
+            return true;
+        }
+        catch (JsonException)
+        {
+            requestId = string.Empty;
+            method = string.Empty;
+            return false;
+        }
+        catch (InvalidOperationException)
+        {
+            requestId = string.Empty;
+            method = string.Empty;
+            return false;
+        }
+    }
+
+    private static bool TryParseCatalogCommand(
+        string requestId,
+        JsonElement payload,
+        IReadOnlySet<string> allowedItemIds,
+        out BridgeCommand? command,
+        out string errorCode)
+    {
+        command = null;
+        errorCode = InvalidRequestError;
+        if (!HasExactProperties(payload, CatalogPayloadProperties)
+            || !payload.TryGetProperty("itemIds", out JsonElement itemIds)
+            || itemIds.ValueKind != JsonValueKind.Array
+            || itemIds.GetArrayLength() is < 1 or > MaximumItemCount)
+        {
+            return false;
+        }
+
+        List<string> normalized = new(itemIds.GetArrayLength());
+        HashSet<string> unique = new(StringComparer.Ordinal);
+        foreach (JsonElement itemIdValue in itemIds.EnumerateArray())
+        {
+            if (!TryReadIdentifier(itemIdValue, MaximumItemIdLength, out string itemId)
+                || !unique.Add(itemId))
+            {
+                return false;
+            }
+
+            if (!allowedItemIds.Contains(itemId))
+            {
+                errorCode = ProductNotAllowedError;
+                return false;
+            }
+
+            normalized.Add(itemId);
+        }
+
+        command = new GetCatalogDetailsCommand(requestId, normalized.AsReadOnly());
+        return true;
+    }
+
+    private static bool TryParsePurchaseCommand(
+        string requestId,
+        JsonElement payload,
+        IReadOnlySet<string> allowedItemIds,
+        out BridgeCommand? command,
+        out string errorCode)
+    {
+        command = null;
+        errorCode = InvalidRequestError;
+        if (!HasExactProperties(payload, PurchasePayloadProperties)
+            || !TryReadIdentifier(
+                payload,
+                "itemId",
+                MaximumItemIdLength,
+                out string itemId))
+        {
+            return false;
+        }
+
+        if (!allowedItemIds.Contains(itemId))
+        {
+            errorCode = ProductNotAllowedError;
+            return false;
+        }
+
+        command = new RequestPurchaseCommand(requestId, itemId);
+        return true;
+    }
+
+    private static bool HasExactProperties(JsonElement value, IReadOnlySet<string> expected)
+    {
+        HashSet<string> seen = new(StringComparer.Ordinal);
+        foreach (JsonProperty property in value.EnumerateObject())
+        {
+            if (!expected.Contains(property.Name) || !seen.Add(property.Name))
+            {
+                return false;
+            }
+        }
+
+        return seen.Count == expected.Count;
+    }
+
+    private static bool TryReadExactString(
+        JsonElement owner,
+        string propertyName,
+        int expectedLength,
+        out string value)
+    {
+        value = string.Empty;
+        if (!owner.TryGetProperty(propertyName, out JsonElement candidate)
+            || candidate.ValueKind != JsonValueKind.String
+            || candidate.GetString() is not string text
+            || text.Length != expectedLength)
+        {
+            return false;
+        }
+
+        value = text;
+        return true;
+    }
+
+    private static bool TryReadIdentifier(
+        JsonElement owner,
+        string propertyName,
+        int maximumLength,
+        out string value)
+    {
+        value = string.Empty;
+        return owner.TryGetProperty(propertyName, out JsonElement candidate)
+            && TryReadIdentifier(candidate, maximumLength, out value);
+    }
+
+    private static bool TryReadIdentifier(
+        JsonElement candidate,
+        int maximumLength,
+        out string value)
+    {
+        value = string.Empty;
+        if (candidate.ValueKind != JsonValueKind.String
+            || candidate.GetString() is not string text
+            || !IsValidIdentifier(text, maximumLength))
+        {
+            return false;
+        }
+
+        value = text;
+        return true;
+    }
+
+    internal static bool IsValidIdentifier(string? text, int maximumLength) => text is not null
+        && text.Length is >= 1 && text.Length <= maximumLength && text == text.Trim()
+        && !ContainsForbiddenIdentifierCharacter(text);
+
+    private static bool ContainsForbiddenIdentifierCharacter(string value)
+    {
+        for (int index = 0; index < value.Length; index += 1)
+        {
+            char character = value[index];
+            if (char.IsSurrogate(character) && !char.IsSurrogatePair(value, index))
+            {
+                return true;
+            }
+
+            UnicodeCategory category = CharUnicodeInfo.GetUnicodeCategory(value, index);
+            if (category is UnicodeCategory.Control or UnicodeCategory.Format)
+            {
+                return true;
+            }
+
+            if (char.IsHighSurrogate(character))
+            {
+                index += 1;
+            }
+        }
+
+        return false;
+    }
+}

package/dist/windows-host/Core/NativeBridgeRequestGate.cs

@@ -0,0 +1,76 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace Mpgd.MicrosoftStore.Host;
+
+public sealed class NativeBridgeRequestGate
+{
+    private readonly HashSet<string> activeRequestIds = new(StringComparer.Ordinal);
+    private readonly int maximumPendingRequests;
+    private readonly object sync = new();
+    private int pendingRequests;
+
+    public NativeBridgeRequestGate(
+        int maximumPendingRequests = 64)
+    {
+        if (maximumPendingRequests < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(maximumPendingRequests));
+        }
+        this.maximumPendingRequests = maximumPendingRequests;
+    }
+
+    public bool TryEnter(
+        string requestId,
+        [NotNullWhen(true)] out NativeBridgeRequestLease? lease,
+        out string errorCode)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(requestId);
+        lock (sync)
+        {
+            lease = null;
+            if (activeRequestIds.Contains(requestId))
+            {
+                errorCode = NativeBridgeProtocol.DuplicateRequestError;
+                return false;
+            }
+            if (pendingRequests >= maximumPendingRequests)
+            {
+                errorCode = NativeBridgeProtocol.BridgeBusyError;
+                return false;
+            }
+
+            activeRequestIds.Add(requestId);
+            pendingRequests += 1;
+            lease = new NativeBridgeRequestLease(() => Release(requestId));
+            errorCode = string.Empty;
+            return true;
+        }
+    }
+
+    private void Release(string requestId)
+    {
+        lock (sync)
+        {
+            if (pendingRequests < 1 || !activeRequestIds.Remove(requestId))
+            {
+                throw new InvalidOperationException("Native bridge request lease underflow.");
+            }
+            pendingRequests -= 1;
+        }
+    }
+}
+
+public sealed class NativeBridgeRequestLease : IDisposable
+{
+    private Action? release;
+
+    internal NativeBridgeRequestLease(Action release)
+    {
+        this.release = release;
+    }
+
+    public void Dispose()
+    {
+        Interlocked.Exchange(ref release, null)?.Invoke();
+    }
+}