@onekeyfe/hd-core 1.2.0-alpha.96 → 1.2.0-alpha.98

package/__tests__/firmware-update/device-update-bootloader.test.ts

@@ -9,6 +9,9 @@ import {
 jest.mock('../../src/api/firmware/FirmwareUpdatePreparedPlan', () => ({
   assertFirmwareUpdatePreparedPlanBinding: jest.fn(),
   assertFirmwareUpdatePreparedPlanDeviceIdentity: jest.fn(),
+  getFirmwareUpdatePreparedRawArtifact: jest.fn(
+    ({ preparedPlan }: { preparedPlan: { artifacts: unknown[] } }) => preparedPlan.artifacts[0]
+  ),
   validateFirmwareUpdatePreparedPlan: jest.fn((preparedPlan: unknown) => preparedPlan),
 }));
 
@@ -47,7 +50,11 @@ const createMethod = () => {
       method: 'deviceUpdateBootloader',
       artifact,
       hostBindingGeneration,
-      preparedPlan: { preparedPlanDigest: 'a'.repeat(64) },
+      preparedPlan: {
+        preparedPlanDigest: 'a'.repeat(64),
+        firmwareType: EFirmwareType.Universal,
+        artifacts: [{ artifact }],
+      },
     },
   });
   (method as any).device = {

package/__tests__/firmware-update/firmware-prepared-host-digest.test.ts

@@ -207,7 +207,40 @@ describe('prepared firmware host digest binding', () => {
       },
     });
 
-    expect(() => method.init()).toThrow('Prepared firmware plans require a prepared artifact');
+    expect(() => method.init()).toThrow(
+      'Prepared firmware plans cannot be combined with legacy firmware inputs'
+    );
+  });
+
+  test('FirmwareUpdateV2 derives its component artifact from the digest-bound plan', () => {
+    const { artifact, preparedPlan } = createPreparedPlan({
+      executor: 'v2',
+      target: 'firmware',
+    });
+    const artifactReader = {
+      open: jest.fn(),
+      read: jest.fn(),
+      close: jest.fn(),
+    };
+    const hostBindingGeneration = registerFirmwareUpdateHostBinding({
+      preparedPlanDigest: preparedPlan.preparedPlanDigest,
+      artifactReader,
+    });
+    const method = new FirmwareUpdateV2({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV2',
+        platform: 'desktop',
+        updateType: 'firmware',
+        preparedPlan,
+        hostBindingGeneration,
+      },
+    });
+
+    expect(() => method.init()).not.toThrow();
+    expect((method as unknown as { params: { artifact: unknown } }).params.artifact).toEqual(
+      artifact
+    );
   });
 
   test('FirmwareUpdateV3 rejects a host registered for another prepared plan', () => {
@@ -277,6 +310,37 @@ describe('prepared firmware host digest binding', () => {
     );
   });
 
+  test('FirmwareUpdateV3 derives its component artifacts from the digest-bound plan', () => {
+    const { artifact, preparedPlan } = createPreparedPlan({
+      executor: 'v3',
+      target: 'firmware',
+    });
+    const artifactReader = {
+      open: jest.fn(),
+      read: jest.fn(),
+      close: jest.fn(),
+    };
+    const hostBindingGeneration = registerFirmwareUpdateHostBinding({
+      preparedPlanDigest: preparedPlan.preparedPlanDigest,
+      artifactReader,
+    });
+    const method = new FirmwareUpdateV3({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV3',
+        platform: 'desktop',
+        preparedPlan,
+        hostBindingGeneration,
+      },
+    });
+
+    expect(() => method.init()).not.toThrow();
+    expect(
+      (method as unknown as { params: { artifacts: { firmware: unknown } } }).params.artifacts
+        .firmware
+    ).toEqual(artifact);
+  });
+
   test('DeviceUpdateBootloader rejects a host registered for another prepared plan', async () => {
     const { artifact, preparedPlan } = createPreparedPlan({
       executor: 'v2',
@@ -349,7 +413,47 @@ describe('prepared firmware host digest binding', () => {
     method.device = { features: undefined } as any;
 
     await expect(method.run()).rejects.toThrow(
-      'Prepared bootloader plans require exactly one prepared artifact'
+      'Prepared bootloader plans cannot be combined with a legacy binary'
+    );
+  });
+
+  test('DeviceUpdateBootloader derives its artifact from the digest-bound plan', async () => {
+    const { artifact, preparedPlan } = createPreparedPlan({
+      executor: 'v2',
+      target: 'bootloader',
+    });
+    const artifactReader = {
+      open: jest.fn().mockResolvedValue({ readerId: 'bootloader-reader', size: artifact.size }),
+      read: jest.fn(),
+      close: jest.fn().mockResolvedValue(undefined),
+    };
+    const hostBindingGeneration = registerFirmwareUpdateHostBinding({
+      preparedPlanDigest: preparedPlan.preparedPlanDigest,
+      artifactReader,
+    });
+    const method = new DeviceUpdateBootloader({
+      id: 1,
+      payload: {
+        method: 'deviceUpdateBootloader',
+        preparedPlan,
+        hostBindingGeneration,
+      },
+    });
+    method.device = {
+      features: {
+        deviceType: EDeviceType.Classic1s,
+        serialNo: 'classic-device-id',
+      },
+      getCurrentDeviceType: () => EDeviceType.Touch,
+    } as any;
+    const updateTouchBootloader = jest
+      .spyOn(method, 'updateTouchBootloader')
+      .mockResolvedValue(true);
+
+    await expect(method.run()).resolves.toBe(true);
+    expect(artifactReader.open).toHaveBeenCalledWith({ artifactRef: artifact.artifactRef });
+    expect(updateTouchBootloader).toHaveBeenCalledWith(
+      expect.objectContaining({ firmwareType: preparedPlan.firmwareType })
     );
   });
 

package/__tests__/firmware-update/firmware-prepared-resource-archive.test.ts

@@ -0,0 +1,150 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { EFirmwareType } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
+
+import { readVerifiedPreparedResourceArchive } from '../../src/api/firmware/FirmwarePreparedResourceArchive';
+import { prepareFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePreparedPlan';
+import { digestFirmwareUpdateContract } from '../../src/api/firmware/FirmwareUpdatePlan';
+
+import type {
+  FirmwareArtifactReader,
+  FirmwareArtifactReference,
+} from '../../src/types/api/firmwareUpdate';
+import type { FirmwareUpdatePlan } from '../../src/types/api/firmwareUpdatePlan';
+
+jest.mock('../../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
+}));
+
+const createReference = (artifactRef: string, binary: ArrayBuffer): FirmwareArtifactReference => ({
+  artifactRef,
+  size: binary.byteLength,
+  sha256: bytesToHex(sha256(new Uint8Array(binary))),
+});
+
+const createReader = (artifacts: Map<string, ArrayBuffer>): FirmwareArtifactReader => {
+  const opened = new Map<string, ArrayBuffer>();
+  let sequence = 0;
+  return {
+    open({ artifactRef }) {
+      const binary = artifacts.get(artifactRef);
+      if (!binary) throw new Error(`missing artifact: ${artifactRef}`);
+      sequence += 1;
+      const readerId = `reader-${sequence}`;
+      opened.set(readerId, binary);
+      return Promise.resolve({ readerId, size: binary.byteLength });
+    },
+    read({ readerId, offset, length }) {
+      const binary = opened.get(readerId);
+      if (!binary) throw new Error(`missing reader: ${readerId}`);
+      const data = binary.slice(offset, offset + length);
+      return Promise.resolve({
+        data,
+        bytesRead: data.byteLength,
+        eof: offset + length === binary.byteLength,
+      });
+    },
+    close({ readerId }) {
+      opened.delete(readerId);
+      return Promise.resolve();
+    },
+  };
+};
+
+const createPreparedResourcePlan = ({
+  executor,
+  archiveBinary,
+  entryBinary,
+}: {
+  executor: 'v2' | 'v3';
+  archiveBinary: ArrayBuffer;
+  entryBinary: ArrayBuffer;
+}) => {
+  const archiveArtifact = createReference('resource-archive', archiveBinary);
+  const entryArtifact = createReference('resource-entry', entryBinary);
+  const planWithoutDigest: Omit<FirmwareUpdatePlan, 'planDigest'> = {
+    schemaVersion: 2,
+    executor,
+    deviceIdentity: `${executor}-device`,
+    deviceModel: executor === 'v2' ? 'TOUCH' : 'PRO',
+    firmwareType: EFirmwareType.Universal,
+    platform: 'desktop',
+    artifacts: [
+      {
+        artifactId: 'resource',
+        role: 'resource',
+        target: 'resource',
+        url: 'https://firmware.onekey.so/resource.zip',
+        container: 'zip',
+        expectedSize: archiveArtifact.size,
+        expectedSha256: archiveArtifact.sha256,
+      },
+    ],
+    targetsToUpdate: ['resource'],
+  };
+  const plan: FirmwareUpdatePlan = {
+    ...planWithoutDigest,
+    planDigest: digestFirmwareUpdateContract(planWithoutDigest),
+  };
+  return {
+    archiveArtifact,
+    preparedPlan: prepareFirmwareUpdatePlan({
+      plan,
+      leaseRef: `${executor}-resource-lease`,
+      artifacts: [
+        {
+          artifactId: 'resource',
+          artifact: archiveArtifact,
+          materializedEntries: [{ entryName: 'images/logo.bin', artifact: entryArtifact }],
+        },
+      ],
+    }),
+  };
+};
+
+describe.each(['v2', 'v3'] as const)('%s prepared resource archive binding', executor => {
+  test('uses canonical bytes extracted from the approved ZIP', async () => {
+    const entryBinary = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', entryBinary);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary,
+    });
+
+    const result = await readVerifiedPreparedResourceArchive({
+      preparedPlan,
+      reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+    });
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entryName).toBe('logo.bin');
+    expect(new Uint8Array(result[0].binary)).toEqual(new Uint8Array(entryBinary));
+  });
+
+  test('rejects entries that are not derived from the approved ZIP', async () => {
+    const approvedEntry = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const substitutedEntry = Uint8Array.from([9, 9, 9, 9]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', approvedEntry);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary: substitutedEntry,
+    });
+
+    await expect(
+      readVerifiedPreparedResourceArchive({
+        preparedPlan,
+        reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+      })
+    ).rejects.toMatchObject({
+      params: { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' },
+    });
+  });
+});

package/__tests__/firmware-update/firmware-update-bootloader-poll.test.ts

@@ -1,8 +1,11 @@
+import { EDeviceType } from '@onekeyfe/hd-shared';
+
 import FirmwareUpdate from '../../src/api/FirmwareUpdate';
 import FirmwareUpdateV2 from '../../src/api/FirmwareUpdateV2';
 import FirmwareUpdateV3 from '../../src/api/FirmwareUpdateV3';
 import { BOOTLOADER_POLL_INITIALIZE_TIMEOUT_MS } from '../../src/api/firmware/FirmwareUpdateBaseMethod';
 import { DataManager } from '../../src/data-manager';
+import { DevicePool } from '../../src/device/DevicePool';
 
 import type { Device } from '../../src/device/Device';
 
@@ -12,6 +15,7 @@ jest.mock('../../src/data/config', () => ({
 }));
 
 const BLE_ID = 'ble-device';
+const WEBUSB_ID = 'webusb-device';
 
 const flush = () =>
   new Promise(resolve => {
@@ -198,3 +202,111 @@ describe.each([
     expect(maxActiveProbes).toBe(1);
   });
 });
+
+describe.each([
+  [
+    'FirmwareUpdateV2',
+    () =>
+      new FirmwareUpdateV2({
+        id: 1,
+        payload: { method: 'firmwareUpdateV2', connectId: WEBUSB_ID },
+      }),
+  ],
+  [
+    'FirmwareUpdateV3 (base method)',
+    () =>
+      new FirmwareUpdateV3({
+        id: 1,
+        payload: { method: 'firmwareUpdateV3', connectId: WEBUSB_ID },
+      }),
+  ],
+])('%s WebUSB bootloader authorization', (_name, buildMethod) => {
+  beforeEach(() => {
+    jest.useFakeTimers({ doNotFake: ['setImmediate', 'performance'] });
+  });
+
+  afterEach(() => {
+    jest.clearAllTimers();
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  test('pauses the reboot deadline while waiting for browser authorization', async () => {
+    jest.spyOn(DataManager, 'getSettings').mockReturnValue('webusb' as never);
+    jest.spyOn(DataManager, 'isBleConnect').mockReturnValue(false);
+    jest.spyOn(DataManager, 'isBrowserWebUsb').mockReturnValue(true);
+
+    const method = buildMethod();
+    let permissionGranted = false;
+    const bootloaderDevice = {
+      isBootloader: jest.fn(() => true),
+    } as unknown as Device;
+    jest.spyOn(DevicePool, 'getDevices').mockImplementation(() =>
+      Promise.resolve({
+        devices: {},
+        deviceList: permissionGranted ? [bootloaderDevice] : [],
+      })
+    );
+
+    const commands = { disposed: true };
+    const updateFromCache = jest.fn();
+    method.device = {
+      originalDescriptor: {
+        id: WEBUSB_ID,
+        path: WEBUSB_ID,
+        protocolType: 'V1',
+      },
+      deviceConnector: {
+        enumerate: jest.fn(() =>
+          Promise.resolve({
+            descriptors: permissionGranted ? [{ path: 'bootloader-device' }] : [],
+          })
+        ),
+      },
+      commands,
+      updateFromCache,
+      getCurrentDeviceType: jest.fn(() => EDeviceType.Pro),
+    } as unknown as Device;
+    method.postTipMessage = jest.fn();
+
+    let resolvePrompt: (deviceId: string) => void = () => undefined;
+    const promptPromise = new Promise<string>(resolve => {
+      resolvePrompt = resolve;
+    });
+    const prompt = jest
+      .spyOn(method as any, '_promptDeviceInBootloaderForWebDevice')
+      .mockReturnValue(promptPromise);
+
+    method.checkDeviceToBootloader(WEBUSB_ID);
+    const resolved = jest.fn();
+    const rejected = jest.fn();
+    method.checkPromise?.promise.then(resolved, rejected);
+
+    for (let elapsed = 0; elapsed < 15000; elapsed += 500) {
+      jest.advanceTimersByTime(500);
+      // eslint-disable-next-line no-await-in-loop
+      await flush();
+      if (prompt.mock.calls.length) break;
+    }
+
+    expect(prompt).toHaveBeenCalledTimes(1);
+
+    // Browser permission depends on a user gesture and must not consume the
+    // automatic reboot detection deadline.
+    for (let elapsed = 0; elapsed < 35000; elapsed += 500) {
+      jest.advanceTimersByTime(500);
+      // eslint-disable-next-line no-await-in-loop
+      await flush();
+    }
+    expect(rejected).not.toHaveBeenCalled();
+
+    permissionGranted = true;
+    resolvePrompt('bootloader-device');
+    await flush();
+    await flush();
+
+    expect(resolved).toHaveBeenCalledWith(true);
+    expect(updateFromCache).toHaveBeenCalledWith(bootloaderDevice);
+    expect(commands.disposed).toBe(false);
+  });
+});

package/__tests__/firmware-update/firmware-update-plan.test.ts

@@ -54,6 +54,8 @@ const createLegacyForceInput = (
   release: Record<string, unknown> = {
     url: 'https://firmware.onekey.so/pro/firmware.bin',
     version: [4, 21, 0],
+    expectedSize: 1024,
+    fingerprint: '1'.repeat(64),
   }
 ): BuildPlanInput => ({
   features: createFeatures({
@@ -172,6 +174,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 0, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
         },
       },
       ble: noUpdate,
@@ -197,7 +201,11 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 21, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
           resource: 'https://firmware.onekey.so/pro/resource.zip',
+          resourceExpectedSize: 4096,
+          resourceFingerprint: '1'.repeat(64),
         },
       },
       ble: {
@@ -205,6 +213,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           webUpdate: 'https://firmware.onekey.so/pro/ble.bin',
           version: [2, 3, 7],
+          expectedSize: 512,
+          fingerprintWeb: '2'.repeat(64),
         },
       },
       bootloader: {
@@ -212,6 +222,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           bootloaderResource: 'https://firmware.onekey.so/pro/bootloader.bin',
           bootloaderVersion: [2, 8, 4],
+          bootloaderExpectedSize: 768,
+          bootloaderFingerprint: '3'.repeat(64),
         },
       },
       forceUpdateTargets: ['firmware', 'resource', 'ble', 'bootloader'],
@@ -241,6 +253,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 21, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
           resource: 'https://firmware.onekey.so/pro/resource.zip',
         },
       },
@@ -253,6 +267,32 @@ describe('buildFirmwareUpdatePlan', () => {
     expect(plan.targetsToUpdate).toEqual(['firmware']);
   });
 
+  test('does not approve an unexecutable V2 resource during bootloader recovery', () => {
+    const features = createFeatures({ deviceType: EDeviceType.Classic1s });
+    features.bootloaderMode = true;
+    const plan = buildFirmwareUpdatePlan({
+      features,
+      firmwareType: EFirmwareType.Universal,
+      platform: 'desktop',
+      firmware: {
+        status: 'none',
+        release: {
+          url: 'https://firmware.onekey.so/classic/firmware.bin',
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
+          resource: 'https://firmware.onekey.so/classic/resource.zip',
+          resourceExpectedSize: 4096,
+          resourceFingerprint: '2'.repeat(64),
+        },
+      },
+      ble: noUpdate,
+      bootloader: noUpdate,
+    });
+
+    expect(plan.artifacts.map(artifact => artifact.artifactId)).toEqual(['firmware']);
+    expect(plan.targetsToUpdate).toEqual(['firmware']);
+  });
+
   test.each([
     {
       label: 'a non-array value',
@@ -276,6 +316,65 @@ describe('buildFirmwareUpdatePlan', () => {
     expectFirmwarePlanInvalid(() => buildFirmwareUpdatePlan(createLegacyForceInput(['resource'])));
   });
 
+  test('rejects a legacy resource archive without complete integrity metadata', () => {
+    expectFirmwarePlanInvalid(
+      () =>
+        buildFirmwareUpdatePlan(
+          createLegacyForceInput(['resource'], {
+            url: 'https://firmware.onekey.so/pro/firmware.bin',
+            resource: 'https://firmware.onekey.so/pro/resource.zip',
+            resourceExpectedSize: 4096,
+          })
+        ),
+      'integrity metadata is invalid'
+    );
+  });
+
+  test.each(['firmware', 'ble', 'bootloader'] as const)(
+    'rejects a remote legacy %s artifact without complete integrity metadata',
+    target => {
+      expectFirmwarePlanInvalid(
+        () =>
+          buildFirmwareUpdatePlan({
+            features: createFeatures({ deviceType: EDeviceType.Classic1s }),
+            firmwareType: EFirmwareType.Universal,
+            platform: 'desktop',
+            firmware:
+              target === 'firmware'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      url: 'https://firmware.onekey.so/classic/firmware.bin',
+                      expectedSize: 1024,
+                    },
+                  }
+                : noUpdate,
+            ble:
+              target === 'ble'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      webUpdate: 'https://firmware.onekey.so/classic/ble.bin',
+                      expectedSize: 512,
+                    },
+                  }
+                : noUpdate,
+            bootloader:
+              target === 'bootloader'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      bootloaderResource: 'https://firmware.onekey.so/classic/bootloader.bin',
+                      bootloaderExpectedSize: 768,
+                    },
+                  }
+                : noUpdate,
+          }),
+        'integrity metadata is invalid'
+      );
+    }
+  );
+
   test.each(['ble', 'bootloader'] as const)(
     'rejects the unsupported Pro2 %s force target',
     forceTarget => {
@@ -358,6 +457,8 @@ describe('buildFirmwareUpdatePlan', () => {
           status: 'outdated',
           release: {
             url: 'https://firmware.onekey.so/classic/firmware.bin',
+            expectedSize: 1024,
+            fingerprint: '1'.repeat(64),
           },
         },
         ble: noUpdate,