@onekeyfe/hd-core 1.2.0-alpha.62 → 1.2.0-alpha.64

package/__tests__/firmware-update/firmware-update-plan-bootloader-identity.test.ts

@@ -156,6 +156,102 @@ describe('firmware update plan identity in bootloader mode', () => {
     expect(plan.executor).toBe('v2');
   });
 
+  describe('degraded plan identity transition within one recovery workflow', () => {
+    // Bootloader recovery installs the main firmware while the device has no serial;
+    // it then reboots into normal mode and reports one, and the remaining phases of
+    // the SAME workflow reuse the same prepared plan.
+    let lease = 0;
+    const prepareRecoveryPlan = () => {
+      lease += 1;
+      const plan = buildDesktopPlan(bootloaderClassic1sFeatures);
+      return prepareFirmwareUpdatePlan({
+        plan,
+        leaseRef: `fwlease:00000000-0000-4000-8000-00000000000${lease}`,
+        artifacts: [
+          {
+            artifactId: 'firmware',
+            artifact: {
+              artifactRef: `fw:${FIRMWARE_SHA256}`,
+              size: 4,
+              sha256: FIRMWARE_SHA256,
+            },
+          },
+        ],
+      });
+    };
+
+    test('accepts the phase that runs after the device reboots and reports a serial', () => {
+      const preparedPlan = prepareRecoveryPlan();
+      // Phase 1: still in bootloader, no serial.
+      expect(() =>
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan,
+          deviceIdentity: undefined,
+          bootloaderMode: true,
+          deviceModel: String(EDeviceType.Classic1s),
+        })
+      ).not.toThrow();
+      // Phase 2: firmware installed, device rebooted and now has an identity.
+      expect(() =>
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan,
+          deviceIdentity: 'CLA45F0023',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Classic1s),
+        })
+      ).not.toThrow();
+    });
+
+    test('pins the first identity it sees, so a different device cannot take over', () => {
+      const preparedPlan = prepareRecoveryPlan();
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan,
+        deviceIdentity: 'CLA45F0023',
+        bootloaderMode: false,
+        deviceModel: String(EDeviceType.Classic1s),
+      });
+      expect(() =>
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan,
+          deviceIdentity: 'CLA99Z9999',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Classic1s),
+        })
+      ).toThrow();
+    });
+
+    test('still refuses a different device model after the identity appears', () => {
+      const preparedPlan = prepareRecoveryPlan();
+      expect(() =>
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan,
+          deviceIdentity: 'MINI0000001',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Mini),
+        })
+      ).toThrow();
+    });
+
+    test('a fresh workflow does not inherit the previous workflow identity pin', () => {
+      const first = prepareRecoveryPlan();
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan: first,
+        deviceIdentity: 'CLA45F0023',
+        bootloaderMode: false,
+        deviceModel: String(EDeviceType.Classic1s),
+      });
+      const second = prepareRecoveryPlan();
+      expect(() =>
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan: second,
+          deviceIdentity: 'CLA99Z9999',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Classic1s),
+        })
+      ).not.toThrow();
+    });
+  });
+
   describe('prepared plan device identity assertion', () => {
     const prepareDegradedPlan = () => {
       const plan = buildDesktopPlan(bootloaderClassic1sFeatures);
@@ -210,7 +306,11 @@ describe('firmware update plan identity in bootloader mode', () => {
       ).toThrow();
     });
 
-    test('rejects a degraded plan when the live device reports a real identity', () => {
+    // Superseded: a degraded plan MUST accept the first real identity, because that is
+    // the recovering device reporting its serial after the firmware phase rebooted it.
+    // The boundary that remains — a SECOND, different identity — is covered by
+    // 'pins the first identity it sees, so a different device cannot take over'.
+    test('binds to the identity the recovered device reports', () => {
       const preparedPlan = prepareDegradedPlan();
       expect(() =>
         assertFirmwareUpdatePreparedPlanDeviceIdentity({
@@ -219,7 +319,7 @@ describe('firmware update plan identity in bootloader mode', () => {
           bootloaderMode: true,
           deviceModel: String(EDeviceType.Classic1s),
         })
-      ).toThrow();
+      ).not.toThrow();
     });
 
     test('rejects a degraded plan on a different device model', () => {

package/dist/api/device/DeviceUpdateBootloader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceUpdateBootloader.d.ts","sourceRoot":"","sources":["../../../src/api/device/DeviceUpdateBootloader.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,wBAAwB,CAAC,GAAG,CAAC;IAC/E,IAAI;IAOE,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAoBtE,2CAA2C,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB;IAcvF,qBAAqB,CAAC,EAC1B,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,cAAc,GACvB,EAAE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,YAAY,EAAE,aAAa,CAAC;QAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,MAAM,CAAC,EAAE,kBAAkB,CAAC;KAC7B;IA0EK,GAAG;CAwEV"}
+{"version":3,"file":"DeviceUpdateBootloader.d.ts","sourceRoot":"","sources":["../../../src/api/device/DeviceUpdateBootloader.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAgBhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,wBAAwB,CAAC,GAAG,CAAC;IAC/E,IAAI;IAOE,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAoBtE,2CAA2C,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB;IAcvF,qBAAqB,CAAC,EAC1B,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,cAAc,GACvB,EAAE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,YAAY,EAAE,aAAa,CAAC;QAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,MAAM,CAAC,EAAE,kBAAkB,CAAC;KAC7B;IA0EK,GAAG;CA0EV"}

package/dist/api/firmware/FirmwareUpdatePreparedPlan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FirmwareUpdatePreparedPlan.d.ts","sourceRoot":"","sources":["../../../src/api/firmware/FirmwareUpdatePreparedPlan.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,mCAAmC,EAEnC,0BAA0B,EAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAwB7E,eAAO,MAAM,6BAA6B,UAAW,OAAO,KAAG,MA8B9D,CAAC;AAgGF,eAAO,MAAM,yBAAyB;UAK9B,kBAAkB;cACd,MAAM;eACL,mCAAmC,EAAE;MAC9C,0BAmBH,CAAC;AAEF,eAAO,MAAM,kCAAkC,UAAW,OAAO,KAAG,0BAmGnE,CAAC;AAEF,eAAO,MAAM,8CAA8C;kBAM3C,OAAO;oBACL,MAAM,GAAG,SAAS;;;MAKhC,0BAuBH,CAAC;AAEF,KAAK,6BAA6B,GAAG;IACnC,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,EAAE,yBAAyB,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,eAAO,MAAM,uCAAuC;kBAQpC,OAAO;cACX,0BAA0B,CAAC,UAAU,CAAC;;;kBAGlC,0BAA0B,CAAC,iBAAiB,CAAC;cACjD,6BAA6B,EAAE;MACvC,0BAmDH,CAAC"}
+{"version":3,"file":"FirmwareUpdatePreparedPlan.d.ts","sourceRoot":"","sources":["../../../src/api/firmware/FirmwareUpdatePreparedPlan.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,mCAAmC,EAEnC,0BAA0B,EAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAwB7E,eAAO,MAAM,6BAA6B,UAAW,OAAO,KAAG,MA8B9D,CAAC;AAgGF,eAAO,MAAM,yBAAyB;UAK9B,kBAAkB;cACd,MAAM;eACL,mCAAmC,EAAE;MAC9C,0BAmBH,CAAC;AAEF,eAAO,MAAM,kCAAkC,UAAW,OAAO,KAAG,0BAmGnE,CAAC;AAuBF,eAAO,MAAM,8CAA8C;kBAM3C,OAAO;oBACL,MAAM,GAAG,SAAS;;;MAKhC,0BAoCH,CAAC;AAEF,KAAK,6BAA6B,GAAG;IACnC,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,EAAE,yBAAyB,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,eAAO,MAAM,uCAAuC;kBAQpC,OAAO;cACX,0BAA0B,CAAC,UAAU,CAAC;;;kBAGlC,0BAA0B,CAAC,iBAAiB,CAAC;cACjD,6BAA6B,EAAE;MACvC,0BAmDH,CAAC"}

package/dist/index.js

@@ -1174,14 +1174,38 @@ const validateFirmwareUpdatePreparedPlan = (value) => {
     }
     return preparedPlan;
 };
+const degradedPlanIdentityPins = new Map();
+const DEGRADED_PLAN_IDENTITY_PIN_LIMIT = 32;
+const pinDegradedPlanIdentity = (leaseRef, deviceIdentity) => {
+    if (degradedPlanIdentityPins.size >= DEGRADED_PLAN_IDENTITY_PIN_LIMIT) {
+        const oldest = degradedPlanIdentityPins.keys().next();
+        if (!oldest.done) {
+            degradedPlanIdentityPins.delete(oldest.value);
+        }
+    }
+    degradedPlanIdentityPins.set(leaseRef, deviceIdentity);
+};
 const assertFirmwareUpdatePreparedPlanDeviceIdentity = ({ preparedPlan: value, deviceIdentity: reportedIdentity, bootloaderMode, deviceModel, }) => {
     const preparedPlan = validateFirmwareUpdatePreparedPlan(value);
     const deviceIdentity = reportedIdentity === 'unavailable' ? undefined : reportedIdentity;
-    if (preparedPlan.deviceIdentity === 'unavailable' &&
-        !deviceIdentity &&
-        bootloaderMode === true &&
-        deviceModel !== undefined &&
-        preparedPlan.deviceModel === deviceModel) {
+    if (preparedPlan.deviceIdentity === 'unavailable') {
+        if (deviceModel === undefined || preparedPlan.deviceModel !== deviceModel) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.DeviceCheckDeviceIdError);
+        }
+        const pinnedIdentity = degradedPlanIdentityPins.get(preparedPlan.leaseRef);
+        if (!deviceIdentity) {
+            if (bootloaderMode !== true) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.DeviceCheckDeviceIdError);
+            }
+            return preparedPlan;
+        }
+        if (!pinnedIdentity) {
+            pinDegradedPlanIdentity(preparedPlan.leaseRef, deviceIdentity);
+            return preparedPlan;
+        }
+        if (pinnedIdentity !== deviceIdentity) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.DeviceCheckDeviceIdError);
+        }
         return preparedPlan;
     }
     if (!deviceIdentity || preparedPlan.deviceIdentity !== deviceIdentity) {
@@ -48639,6 +48663,8 @@ class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod {
                 assertFirmwareUpdatePreparedPlanDeviceIdentity({
                     preparedPlan: payload.preparedPlan,
                     deviceIdentity: getDeviceUUID(features) || undefined,
+                    bootloaderMode: resolveDeviceBootloaderMode(features),
+                    deviceModel: String(getDeviceType(features)),
                 });
                 assertFirmwareUpdatePreparedPlanBinding({
                     preparedPlan: payload.preparedPlan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/hd-core",
-  "version": "1.2.0-alpha.62",
+  "version": "1.2.0-alpha.64",
   "description": "Core processes and APIs for communicating with OneKey hardware devices.",
   "author": "OneKey",
   "homepage": "https://github.com/OneKeyHQ/hardware-js-sdk#readme",
@@ -25,8 +25,8 @@
     "url": "https://github.com/OneKeyHQ/hardware-js-sdk/issues"
   },
   "dependencies": {
-    "@onekeyfe/hd-shared": "1.2.0-alpha.62",
-    "@onekeyfe/hd-transport": "1.2.0-alpha.62",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.64",
+    "@onekeyfe/hd-transport": "1.2.0-alpha.64",
     "axios": "1.15.2",
     "bignumber.js": "^9.0.2",
     "bytebuffer": "^5.0.1",
@@ -44,5 +44,5 @@
     "@types/w3c-web-usb": "^1.0.10",
     "@types/web-bluetooth": "^0.0.21"
   },
-  "gitHead": "f38f4fc8bf05aea42a4da5b2bd633544597ad958"
+  "gitHead": "636cd3d9874820414cee6faa7e521f90a42ce6d5"
 }

package/src/api/device/DeviceUpdateBootloader.ts

@@ -15,7 +15,8 @@ import {
   assertFirmwareUpdatePreparedPlanBinding,
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
 } from '../firmware/FirmwareUpdatePreparedPlan';
-import { getDeviceUUID } from '../../utils';
+import { getDeviceType, getDeviceUUID } from '../../utils';
+import { resolveDeviceBootloaderMode } from '../../utils/deviceFeaturesCompat';
 
 import type { DeviceUpdateBootloaderParams } from '../../types/api/deviceUpdateBootloader';
 import type { EFirmwareType } from '@onekeyfe/hd-shared';
@@ -167,6 +168,8 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
       assertFirmwareUpdatePreparedPlanDeviceIdentity({
         preparedPlan: payload.preparedPlan,
         deviceIdentity: getDeviceUUID(features) || undefined,
+        bootloaderMode: resolveDeviceBootloaderMode(features),
+        deviceModel: String(getDeviceType(features)),
       });
       assertFirmwareUpdatePreparedPlanBinding({
         preparedPlan: payload.preparedPlan,

package/src/api/firmware/FirmwareUpdatePreparedPlan.ts

@@ -295,6 +295,27 @@ export const validateFirmwareUpdatePreparedPlan = (value: unknown): FirmwareUpda
   return preparedPlan;
 };
 
+/**
+ * Identity observed on the live device while a degraded recovery plan runs, keyed by
+ * the plan's opaque lease. Bootloader recovery starts with no serial and the device
+ * reports one only after the firmware phase reboots it, so the later phases of the
+ * SAME workflow must be allowed to continue — but only for the device that first
+ * answered, never for a second one that appears mid-recovery.
+ */
+const degradedPlanIdentityPins = new Map<string, string>();
+/** Keep the pin map from growing without bound across many workflows. */
+const DEGRADED_PLAN_IDENTITY_PIN_LIMIT = 32;
+
+const pinDegradedPlanIdentity = (leaseRef: string, deviceIdentity: string) => {
+  if (degradedPlanIdentityPins.size >= DEGRADED_PLAN_IDENTITY_PIN_LIMIT) {
+    const oldest = degradedPlanIdentityPins.keys().next();
+    if (!oldest.done) {
+      degradedPlanIdentityPins.delete(oldest.value);
+    }
+  }
+  degradedPlanIdentityPins.set(leaseRef, deviceIdentity);
+};
+
 export const assertFirmwareUpdatePreparedPlanDeviceIdentity = ({
   preparedPlan: value,
   deviceIdentity: reportedIdentity,
@@ -303,7 +324,7 @@ export const assertFirmwareUpdatePreparedPlanDeviceIdentity = ({
 }: {
   preparedPlan: unknown;
   deviceIdentity: string | undefined;
-  /** Live device mode; only bootloader mode may accept a degraded-identity plan. */
+  /** Live device mode; a degraded plan may only START while the device is in bootloader. */
   bootloaderMode?: boolean;
   /** Live device model; a degraded plan must target the same model. */
   deviceModel?: string;
@@ -312,20 +333,33 @@ export const assertFirmwareUpdatePreparedPlanDeviceIdentity = ({
   // 'unavailable' is the reserved degraded sentinel — a device-reported serial equal
   // to it must never satisfy the exact-match branch below.
   const deviceIdentity = reportedIdentity === 'unavailable' ? undefined : reportedIdentity;
-  // Bootloader recovery: classic-family devices report no serial in bootloader mode,
-  // so a degraded plan is only acceptable when the live device is equally
-  // identity-less AND targets the same device model (identity equality implies the
-  // model match in the strict branch; the degraded branch must substitute it).
-  // A device that DOES report an identity must match the plan exactly.
-  if (
-    preparedPlan.deviceIdentity === 'unavailable' &&
-    !deviceIdentity &&
-    bootloaderMode === true &&
-    deviceModel !== undefined &&
-    preparedPlan.deviceModel === deviceModel
-  ) {
+
+  if (preparedPlan.deviceIdentity === 'unavailable') {
+    // Identity equality implies a model match in the strict branch; the degraded
+    // branch has no identity to compare, so the model check must stand in for it.
+    if (deviceModel === undefined || preparedPlan.deviceModel !== deviceModel) {
+      throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
+    }
+    const pinnedIdentity = degradedPlanIdentityPins.get(preparedPlan.leaseRef);
+    if (!deviceIdentity) {
+      // Still identity-less: only legitimate while the device sits in bootloader.
+      if (bootloaderMode !== true) {
+        throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
+      }
+      return preparedPlan;
+    }
+    // The recovered device now reports a serial: bind this recovery to it, and hold
+    // every later phase to the same one.
+    if (!pinnedIdentity) {
+      pinDegradedPlanIdentity(preparedPlan.leaseRef, deviceIdentity);
+      return preparedPlan;
+    }
+    if (pinnedIdentity !== deviceIdentity) {
+      throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
+    }
     return preparedPlan;
   }
+
   if (!deviceIdentity || preparedPlan.deviceIdentity !== deviceIdentity) {
     throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
   }