@onekeyfe/hd-core 1.2.0-alpha.97 → 1.2.0-alpha.99

package/__tests__/firmware-update/firmware-prepared-resource-archive.test.ts

@@ -0,0 +1,150 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { EFirmwareType } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
+
+import { readVerifiedPreparedResourceArchive } from '../../src/api/firmware/FirmwarePreparedResourceArchive';
+import { prepareFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePreparedPlan';
+import { digestFirmwareUpdateContract } from '../../src/api/firmware/FirmwareUpdatePlan';
+
+import type {
+  FirmwareArtifactReader,
+  FirmwareArtifactReference,
+} from '../../src/types/api/firmwareUpdate';
+import type { FirmwareUpdatePlan } from '../../src/types/api/firmwareUpdatePlan';
+
+jest.mock('../../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
+}));
+
+const createReference = (artifactRef: string, binary: ArrayBuffer): FirmwareArtifactReference => ({
+  artifactRef,
+  size: binary.byteLength,
+  sha256: bytesToHex(sha256(new Uint8Array(binary))),
+});
+
+const createReader = (artifacts: Map<string, ArrayBuffer>): FirmwareArtifactReader => {
+  const opened = new Map<string, ArrayBuffer>();
+  let sequence = 0;
+  return {
+    open({ artifactRef }) {
+      const binary = artifacts.get(artifactRef);
+      if (!binary) throw new Error(`missing artifact: ${artifactRef}`);
+      sequence += 1;
+      const readerId = `reader-${sequence}`;
+      opened.set(readerId, binary);
+      return Promise.resolve({ readerId, size: binary.byteLength });
+    },
+    read({ readerId, offset, length }) {
+      const binary = opened.get(readerId);
+      if (!binary) throw new Error(`missing reader: ${readerId}`);
+      const data = binary.slice(offset, offset + length);
+      return Promise.resolve({
+        data,
+        bytesRead: data.byteLength,
+        eof: offset + length === binary.byteLength,
+      });
+    },
+    close({ readerId }) {
+      opened.delete(readerId);
+      return Promise.resolve();
+    },
+  };
+};
+
+const createPreparedResourcePlan = ({
+  executor,
+  archiveBinary,
+  entryBinary,
+}: {
+  executor: 'v2' | 'v3';
+  archiveBinary: ArrayBuffer;
+  entryBinary: ArrayBuffer;
+}) => {
+  const archiveArtifact = createReference('resource-archive', archiveBinary);
+  const entryArtifact = createReference('resource-entry', entryBinary);
+  const planWithoutDigest: Omit<FirmwareUpdatePlan, 'planDigest'> = {
+    schemaVersion: 2,
+    executor,
+    deviceIdentity: `${executor}-device`,
+    deviceModel: executor === 'v2' ? 'TOUCH' : 'PRO',
+    firmwareType: EFirmwareType.Universal,
+    platform: 'desktop',
+    artifacts: [
+      {
+        artifactId: 'resource',
+        role: 'resource',
+        target: 'resource',
+        url: 'https://firmware.onekey.so/resource.zip',
+        container: 'zip',
+        expectedSize: archiveArtifact.size,
+        expectedSha256: archiveArtifact.sha256,
+      },
+    ],
+    targetsToUpdate: ['resource'],
+  };
+  const plan: FirmwareUpdatePlan = {
+    ...planWithoutDigest,
+    planDigest: digestFirmwareUpdateContract(planWithoutDigest),
+  };
+  return {
+    archiveArtifact,
+    preparedPlan: prepareFirmwareUpdatePlan({
+      plan,
+      leaseRef: `${executor}-resource-lease`,
+      artifacts: [
+        {
+          artifactId: 'resource',
+          artifact: archiveArtifact,
+          materializedEntries: [{ entryName: 'images/logo.bin', artifact: entryArtifact }],
+        },
+      ],
+    }),
+  };
+};
+
+describe.each(['v2', 'v3'] as const)('%s prepared resource archive binding', executor => {
+  test('uses canonical bytes extracted from the approved ZIP', async () => {
+    const entryBinary = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', entryBinary);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary,
+    });
+
+    const result = await readVerifiedPreparedResourceArchive({
+      preparedPlan,
+      reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+    });
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entryName).toBe('logo.bin');
+    expect(new Uint8Array(result[0].binary)).toEqual(new Uint8Array(entryBinary));
+  });
+
+  test('rejects entries that are not derived from the approved ZIP', async () => {
+    const approvedEntry = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const substitutedEntry = Uint8Array.from([9, 9, 9, 9]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', approvedEntry);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary: substitutedEntry,
+    });
+
+    await expect(
+      readVerifiedPreparedResourceArchive({
+        preparedPlan,
+        reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+      })
+    ).rejects.toMatchObject({
+      params: { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' },
+    });
+  });
+});

package/__tests__/firmware-update/firmware-update-bootloader-poll.test.ts

@@ -231,7 +231,7 @@ describe.each([
     jest.restoreAllMocks();
   });
 
-  test('pauses the reboot deadline while waiting for browser authorization', async () => {
+  test('resumes bounded polling after browser authorization returns an empty enumeration', async () => {
     jest.spyOn(DataManager, 'getSettings').mockReturnValue('webusb' as never);
     jest.spyOn(DataManager, 'isBleConnect').mockReturnValue(false);
     jest.spyOn(DataManager, 'isBrowserWebUsb').mockReturnValue(true);
@@ -300,13 +300,76 @@ describe.each([
     }
     expect(rejected).not.toHaveBeenCalled();
 
-    permissionGranted = true;
     resolvePrompt('bootloader-device');
     await flush();
     await flush();
 
+    // The chooser may resolve before the newly authorized device appears in the
+    // next WebUSB enumeration. That transient empty result must not strand the
+    // deferred check after its original interval and timeout were cleared.
+    expect(resolved).not.toHaveBeenCalled();
+    expect(rejected).not.toHaveBeenCalled();
+
+    permissionGranted = true;
+    for (let elapsed = 0; elapsed < 5000; elapsed += 500) {
+      jest.advanceTimersByTime(500);
+      // eslint-disable-next-line no-await-in-loop
+      await flush();
+      if (resolved.mock.calls.length) break;
+    }
+
     expect(resolved).toHaveBeenCalledWith(true);
     expect(updateFromCache).toHaveBeenCalledWith(bootloaderDevice);
     expect(commands.disposed).toBe(false);
   });
+
+  test('rejects after the fresh deadline when the authorized device never appears', async () => {
+    jest.spyOn(DataManager, 'getSettings').mockReturnValue('webusb' as never);
+    jest.spyOn(DataManager, 'isBleConnect').mockReturnValue(false);
+    jest.spyOn(DataManager, 'isBrowserWebUsb').mockReturnValue(true);
+    jest.spyOn(DevicePool, 'getDevices').mockResolvedValue({ devices: {}, deviceList: [] });
+
+    const method = buildMethod();
+    method.device = {
+      originalDescriptor: {
+        id: WEBUSB_ID,
+        path: WEBUSB_ID,
+        protocolType: 'V1',
+      },
+      deviceConnector: {
+        enumerate: jest.fn().mockResolvedValue({ descriptors: [] }),
+      },
+      commands: { disposed: true },
+      updateFromCache: jest.fn(),
+      getCurrentDeviceType: jest.fn(() => EDeviceType.Pro),
+    } as unknown as Device;
+    method.postTipMessage = jest.fn();
+    const prompt = jest
+      .spyOn(method as any, '_promptDeviceInBootloaderForWebDevice')
+      .mockResolvedValue('bootloader-device');
+
+    method.checkDeviceToBootloader(WEBUSB_ID);
+    const resolved = jest.fn();
+    const rejected = jest.fn();
+    method.checkPromise?.promise.then(resolved, rejected);
+
+    for (let elapsed = 0; elapsed < 15000; elapsed += 500) {
+      jest.advanceTimersByTime(500);
+      // eslint-disable-next-line no-await-in-loop
+      await flush();
+      if (prompt.mock.calls.length) break;
+    }
+    expect(prompt).toHaveBeenCalledTimes(1);
+
+    for (let elapsed = 0; elapsed < 31000; elapsed += 500) {
+      jest.advanceTimersByTime(500);
+      // eslint-disable-next-line no-await-in-loop
+      await flush();
+      if (rejected.mock.calls.length) break;
+    }
+
+    expect(resolved).not.toHaveBeenCalled();
+    expect(rejected).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+  });
 });

package/__tests__/firmware-update/firmware-update-plan-bootloader-identity.test.ts

@@ -1,6 +1,10 @@
 import { EDeviceType, EFirmwareType } from '@onekeyfe/hd-shared';
 
 import { buildFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePlan';
+import {
+  registerFirmwareUpdateHostBinding,
+  unregisterFirmwareUpdateHostBinding,
+} from '../../src/api/firmware/FirmwareHostBinding';
 import {
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
   prepareFirmwareUpdatePlan,
@@ -179,6 +183,19 @@ describe('firmware update plan identity in bootloader mode', () => {
         ],
       });
     };
+    const createBinding = (preparedPlanDigest: string) => ({
+      preparedPlanDigest,
+      artifactReader: {
+        open: () => Promise.resolve({ readerId: 'unused', size: 0 }),
+        read: () =>
+          Promise.resolve({
+            data: new ArrayBuffer(0),
+            bytesRead: 0,
+            eof: true,
+          }),
+        close: () => Promise.resolve(),
+      },
+    });
 
     test('accepts the phase that runs after the device reboots and reports a serial', () => {
       const preparedPlan = prepareRecoveryPlan();
@@ -250,6 +267,69 @@ describe('firmware update plan identity in bootloader mode', () => {
         })
       ).not.toThrow();
     });
+
+    test('releases the identity pin when the digest-bound host workflow ends', () => {
+      const preparedPlan = prepareRecoveryPlan();
+      const firstGeneration = registerFirmwareUpdateHostBinding(
+        createBinding(preparedPlan.preparedPlanDigest)
+      );
+      try {
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan,
+          deviceIdentity: 'CLA45F0023',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Classic1s),
+        });
+      } finally {
+        expect(unregisterFirmwareUpdateHostBinding(firstGeneration)).toBe(true);
+      }
+
+      const secondGeneration = registerFirmwareUpdateHostBinding(
+        createBinding(preparedPlan.preparedPlanDigest)
+      );
+      try {
+        expect(() =>
+          assertFirmwareUpdatePreparedPlanDeviceIdentity({
+            preparedPlan,
+            deviceIdentity: 'CLA99Z9999',
+            bootloaderMode: false,
+            deviceModel: String(EDeviceType.Classic1s),
+          })
+        ).not.toThrow();
+      } finally {
+        expect(unregisterFirmwareUpdateHostBinding(secondGeneration)).toBe(true);
+      }
+    });
+
+    test('a stale unregister cannot release the active workflow identity pin', () => {
+      const stalePlan = prepareRecoveryPlan();
+      const staleGeneration = registerFirmwareUpdateHostBinding(
+        createBinding(stalePlan.preparedPlanDigest)
+      );
+      const activePlan = prepareRecoveryPlan();
+      const activeGeneration = registerFirmwareUpdateHostBinding(
+        createBinding(activePlan.preparedPlanDigest)
+      );
+      try {
+        assertFirmwareUpdatePreparedPlanDeviceIdentity({
+          preparedPlan: activePlan,
+          deviceIdentity: 'CLA45F0023',
+          bootloaderMode: false,
+          deviceModel: String(EDeviceType.Classic1s),
+        });
+        expect(unregisterFirmwareUpdateHostBinding(staleGeneration)).toBe(false);
+        expect(() =>
+          assertFirmwareUpdatePreparedPlanDeviceIdentity({
+            preparedPlan: activePlan,
+            deviceIdentity: 'CLA99Z9999',
+            bootloaderMode: false,
+            deviceModel: String(EDeviceType.Classic1s),
+          })
+        ).toThrow();
+      } finally {
+        expect(unregisterFirmwareUpdateHostBinding(activeGeneration)).toBe(true);
+      }
+    });
   });
 
   describe('prepared plan device identity assertion', () => {