@onekeyfe/react-native-bundle-update 3.0.29 → 3.0.31

package/android/src/main/java/com/margelo/nitro/reactnativebundleupdate/ReactNativeBundleUpdate.kt

@@ -409,10 +409,20 @@ object BundleUpdateStoreAndroid {
     /**
      * Subtype of the most recent calculateSHA256 failure on this thread, or
      * null if the last call succeeded. Surfaces the specific reason —
-     * FILE_NOT_FOUND / FILE_EMPTY / FILE_TRUNCATED / OOM / IO_<class> /
-     * UNEXPECTED_<class> — so analytics can split the previously opaque
-     * "Failed to calculate SHA256" bucket (mixpanel: 91.3 percent of
-     * verifyPackage failures) into actionable categories.
+     * FILE_NOT_FOUND / FILE_DISAPPEARED / FILE_TRUNCATED /
+     * PERMISSION_DENIED / OOM / IO_<class> / UNEXPECTED_<class> — so
+     * analytics can split the previously opaque "Failed to calculate
+     * SHA256" bucket (mixpanel: 91.3 percent of verifyPackage failures)
+     * into actionable categories. Keep this list in sync with the
+     * lastSHA256Failure.set(...) call sites in calculateSHA256 below.
+     *
+     * Note: 0-byte files are NOT treated as a failure. They hash to the
+     * well-known empty-content SHA-256 and the caller's expected/actual
+     * comparison handles legitimate vs. corrupt-empty cases. Rejecting
+     * empty files here would make any OTA bundle that legitimately
+     * contains a 0-byte file (touched marker, blank locale fallback)
+     * fail validateAllFilesInDir / validateWebEmbedSha256 / launch entry
+     * verification — all of which share this calculator.
      */
     fun lastSHA256FailureReason(): String? = lastSHA256Failure.get()
 
@@ -424,11 +434,6 @@ object BundleUpdateStoreAndroid {
             OneKeyLog.error("BundleUpdate", "calculateSHA256: file not found: $filePath")
             return null
         }
-        if (file.length() == 0L) {
-            lastSHA256Failure.set("FILE_EMPTY")
-            OneKeyLog.error("BundleUpdate", "calculateSHA256: file empty: $filePath")
-            return null
-        }
         return try {
             val digest = MessageDigest.getInstance("SHA-256")
             BufferedInputStream(FileInputStream(filePath)).use { bis ->
@@ -1460,8 +1465,10 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 }
                 OneKeyLog.warn("BundleUpdate", "downloadBundle: HTTP 416 (range not satisfiable), discarding partial and failing this attempt")
                 if (partialFile.exists()) partialFile.delete()
-                sendEvent("update/error", message = "HTTP 416 (range not satisfiable)")
-                throw Exception("HTTP 416")
+                // Don't pre-emit update/error here; the outer catch is the
+                // single source of error events. sanitizeErrorMessageForEvent
+                // recognizes "HTTP " prefix and forwards this string verbatim.
+                throw Exception("HTTP 416 (range not satisfiable)")
             }
 
             val expectsResume = partialBytes > 0
@@ -1470,7 +1477,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             if (!response.isSuccessful || (response.code != 200 && response.code != 206)) {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: HTTP error, statusCode=${response.code}")
                 response.close()
-                sendEvent("update/error", message = "HTTP ${response.code}")
+                // outer catch is the single source of update/error events.
                 throw Exception("HTTP ${response.code}")
             }
 
@@ -1542,7 +1549,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             if (downloadedFile.exists()) downloadedFile.delete()
             if (!partialAfter.renameTo(downloadedFile)) {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: rename .partial -> final failed")
-                sendEvent("update/error", message = "rename .partial failed")
+                // outer catch is the single source of update/error events;
+                // "Failed to finalize download" is in the verbatim allowlist.
                 throw Exception("Failed to finalize download")
             }
 
@@ -1551,7 +1559,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 val reason = BundleUpdateStoreAndroid.lastSHA256FailureReason() ?: "MISMATCH"
                 File(filePath).delete()
                 OneKeyLog.error("BundleUpdate", "downloadBundle: SHA256 verification failed after download, reason=$reason")
-                sendEvent("update/error", message = "SHA256_$reason")
+                // outer catch emits the verbatim "Bundle SHA256 verification
+                // failed: <REASON>" payload (recognized by sanitize/JS).
                 throw Exception("Bundle SHA256 verification failed: $reason")
             }
 
@@ -1563,13 +1572,22 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 // event channel must NOT carry e.message verbatim — Android
                 // FileNotFoundException etc. embed the full /data/user/.../
                 // path including the package identifier, and downstream
-                // listeners would forward that into analytics. Emit only a
-                // domain+code shape; mirrors the iOS sendEvent payload at
-                // ReactNativeBundleUpdate.swift's "update/error" sites.
+                // listeners would forward that into analytics. Emit only the
+                // sanitized tag; mirrors the iOS sendEvent payload at
+                // ReactNativeBundleUpdate.swift's "update/error" sites and
+                // matches the verbatim guarantees documented on
+                // sanitizeErrorMessageForEvent.
                 OneKeyLog.error("BundleUpdate", "downloadBundle: failed: ${e.javaClass.simpleName}: ${e.message}")
-                val codeTag = sanitizeErrorMessageForEvent(e)
-                sendEvent("update/error", message = "${e.javaClass.simpleName}: $codeTag")
-                throw e
+                val sanitized = sanitizeErrorMessageForEvent(e)
+                sendEvent("update/error", message = sanitized)
+                // Rethrow with the same sanitized message so the Promise
+                // rejection surfacing to JS carries no /data/user/<u>/<pkg>/
+                // paths. Without this rewrap, FileNotFoundException etc.
+                // would re-leak via Promise.reject's message channel even
+                // though the event payload was already sanitized. Keep
+                // the original exception as `cause` so OneKeyLog (and any
+                // native crash reporter) still sees the full chain.
+                throw Exception(sanitized, e)
             } finally {
                 isDownloading.set(false)
             }

package/ios/ReactNativeBundleUpdate.swift

@@ -314,12 +314,20 @@ public class BundleUpdateStore: NSObject {
     }
 
     /// Subtype of the most recent calculateSHA256 failure on this thread, or
-    /// nil if the last call succeeded. Surfaces FILE_NOT_FOUND / FILE_EMPTY /
+    /// nil if the last call succeeded. Surfaces FILE_NOT_FOUND /
     /// FILE_DISAPPEARED / IO_<NSError code> / UNEXPECTED so analytics can
     /// split the previously opaque "Failed to calculate SHA256" bucket
     /// (mixpanel: 91.3% of verifyPackage failures are Android; iOS shares
     /// the calculator and inherits the same blind spot for its 14 ASC +
     /// 2 verifyPackage Promise-destroyed cases).
+    ///
+    /// Note: 0-byte files are NOT treated as a failure. They hash to the
+    /// well-known empty-content SHA256 and the caller's expected/actual
+    /// comparison handles legitimate vs. corrupt-empty cases. Rejecting
+    /// empty files here would make any OTA bundle that legitimately
+    /// contains a 0-byte file (touched marker, blank locale fallback)
+    /// fail validateAllFilesInDir / validateWebEmbedSha256 / launch entry
+    /// verification — all of which share this calculator.
     public static func lastSHA256FailureReason() -> String? {
         return Thread.current.threadDictionary[kSHA256FailureKey] as? String
     }
@@ -340,13 +348,6 @@ public class BundleUpdateStore: NSObject {
             OneKeyLog.error("BundleUpdate", "calculateSHA256: file not found: \(filePath)")
             return nil
         }
-        let attrs = (try? fm.attributesOfItem(atPath: filePath)) ?? [:]
-        let fileSize = (attrs[.size] as? NSNumber)?.int64Value ?? -1
-        if fileSize == 0 {
-            setSHA256Failure("FILE_EMPTY")
-            OneKeyLog.error("BundleUpdate", "calculateSHA256: file empty: \(filePath)")
-            return nil
-        }
         guard let fileHandle = FileHandle(forReadingAtPath: filePath) else {
             setSHA256Failure("FILE_DISAPPEARED")
             OneKeyLog.error("BundleUpdate", "calculateSHA256: open failed (file disappeared between stat and open): \(filePath)")
@@ -376,7 +377,11 @@ public class BundleUpdateStore: NSObject {
             }) {}
             if let err = threwError {
                 let nsErr = err as NSError
-                setSHA256Failure("IO_\(nsErr.domain)_\(nsErr.code)")
+                // Keep the failure tag low-cardinality (`IO_<code>`) so it
+                // matches the doc on lastSHA256FailureReason and stays under
+                // the analytics bucket cap. The full `domain code description`
+                // detail is still logged below for local debugging.
+                setSHA256Failure("IO_\(nsErr.code)")
                 OneKeyLog.error("BundleUpdate", "calculateSHA256: read failed: \(nsErr.domain) \(nsErr.code) \(nsErr.localizedDescription)")
                 return nil
             }
@@ -1249,17 +1254,22 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
     /// On iOS, force-quit (user swipes the app off the App Switcher) cannot
     /// fire `URLSession`'s `didCompleteWithError` — SIGKILL leaves no time
     /// for callbacks. The kill is, however, *always* preceded by the app
-    /// transitioning to the background. We hook that transition and call
-    /// `cancel(byProducingResumeData:)` synchronously, so the resume blob
-    /// is on disk before the app can possibly be terminated. Memory-pressure
-    /// kills follow the same chain (the OS only reaps backgrounded apps
-    /// under memory pressure), so this also covers OOM termination.
+    /// transitioning to the background. We hook that transition and kick
+    /// off `cancel(byProducingResumeData:)` for any in-flight downloads so
+    /// the resume blob lands on disk before the app can be terminated.
+    /// Memory-pressure kills follow the same chain (the OS only reaps
+    /// backgrounded apps under memory pressure), so this also covers OOM
+    /// termination.
     ///
-    /// `beginBackgroundTask` extends the ~5s of guaranteed background runtime
-    /// to ~30s, which is plenty for a few-KB blob write — but we don't rely
-    /// on the extension to *complete* the snapshot; the `cancel` callback
-    /// returns the data synchronously, so even if iOS suspends us right
-    /// after `endBackgroundTask` the resume blob is already persisted.
+    /// Both `URLSession.getAllTasks(_:)` and `cancel(byProducingResumeData:)`
+    /// deliver their results *asynchronously* via a closure — the resume
+    /// data does not pop out synchronously. We wrap the work in a
+    /// `beginBackgroundTask` window that extends the ~5s of guaranteed
+    /// background runtime to ~30s so the closures actually have time to
+    /// fire and write the few-KB blob before suspension. Persistence is
+    /// best-effort: if iOS reaps us before the writer closure runs (very
+    /// short background windows, expiration), the next launch simply
+    /// re-downloads from scratch — a resume miss is correct, just slower.
     private func registerBackgroundSnapshotObserver() {
         didEnterBackgroundObserver = NotificationCenter.default.addObserver(
             forName: UIApplication.didEnterBackgroundNotification,
@@ -1273,9 +1283,14 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
     private func snapshotResumeDataForBackgrounding() {
         guard let session = self.urlSession else { return }
         // Read both isDownloading AND activeDownloadFilePath inside the
-        // same stateQueue.sync block so a concurrent downloadBundle entry
-        // (which writes filePath BEFORE flipping isDownloading) cannot
-        // produce a torn read where isDownloading=true but filePath=nil.
+        // same stateQueue.sync block. A concurrent downloadBundle entry
+        // flips isDownloading=true at the start of the Promise body but
+        // only writes activeDownloadFilePath later (after the early
+        // guards / version + URL validation). Without this paired read,
+        // didEnterBackground could observe isDownloading=true while
+        // activeDownloadFilePath is still nil from a previous run, or —
+        // on the unwind via defer — see isDownloading=false alongside a
+        // not-yet-cleared path.
         let snapshot: (Bool, String?) = self.stateQueue.sync {
             (self.isDownloading, self.activeDownloadFilePath)
         }
@@ -1284,14 +1299,35 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
 
         let resumeDataPath = "\(filePath).resume"
         let bgTaskName = "BundleUpdateResumeSnapshot"
-        var bgTaskId: UIBackgroundTaskIdentifier = .invalid
-        bgTaskId = UIApplication.shared.beginBackgroundTask(withName: bgTaskName) {
-            // Expiration handler — system is reclaiming us. Best-effort end.
-            if bgTaskId != .invalid {
-                UIApplication.shared.endBackgroundTask(bgTaskId)
-                bgTaskId = .invalid
+
+        // bgTaskId is mutated from three escaping closures: the
+        // beginBackgroundTask expiration handler (called on main),
+        // session.getAllTasks's completion (NOT guaranteed to be main),
+        // and group.notify on .main. Wrap reads/writes in a tiny holder
+        // serialized through a dedicated queue so we cannot double-end
+        // the background task or leak it. `endOnce` guarantees endBackgroundTask
+        // is invoked exactly once across whichever closure reaches it first.
+        final class BgTaskHolder {
+            private let q = DispatchQueue(label: "so.onekey.bundleupdate.bgtask")
+            private var id: UIBackgroundTaskIdentifier = .invalid
+            func set(_ newId: UIBackgroundTaskIdentifier) {
+                q.sync { id = newId }
+            }
+            func endOnce() {
+                q.sync {
+                    if id != .invalid {
+                        UIApplication.shared.endBackgroundTask(id)
+                        id = .invalid
+                    }
+                }
             }
         }
+        let bgTask = BgTaskHolder()
+        let started = UIApplication.shared.beginBackgroundTask(withName: bgTaskName) {
+            // Expiration handler — system is reclaiming us. Best-effort end.
+            bgTask.endOnce()
+        }
+        bgTask.set(started)
         OneKeyLog.info("BundleUpdate", "didEnterBackground: snapshotting resumeData for \(filePath)")
 
         session.getAllTasks { tasks in
@@ -1318,10 +1354,7 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
                 })
             }
             group.notify(queue: .main) {
-                if bgTaskId != .invalid {
-                    UIApplication.shared.endBackgroundTask(bgTaskId)
-                    bgTaskId = .invalid
-                }
+                bgTask.endOnce()
             }
         }
     }
@@ -1514,7 +1547,19 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
                 let nsError = error as NSError
                 OneKeyLog.error("BundleUpdate", "downloadBundle: download failed: \(nsError.domain) \(nsError.code) \(nsError.localizedDescription)")
                 self.sendEvent(type: "update/error", message: "\(nsError.domain) \(nsError.code)")
-                throw error
+                // Rethrow a sanitized NSError. The original `error` is a
+                // URLSession/system error whose `localizedDescription` may
+                // include the temp file path (e.g. NSURLErrorFailingURLString
+                // userInfo, or the ~/Library/.../CFNetworkDownload_*.tmp
+                // path on cancel-with-resume) — Promise rejections surface
+                // that string to JS, which would re-leak the paths the
+                // event-payload sanitization just stripped. Keep the full
+                // detail in OneKeyLog (above) and emit only `domain code`.
+                throw NSError(
+                    domain: nsError.domain,
+                    code: nsError.code,
+                    userInfo: [NSLocalizedDescriptionKey: "Download failed: \(nsError.domain) \(nsError.code)"]
+                )
 
             case .success(let (tempURL, response)):
                 // Successful completion ⇒ no longer need the resume blob.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-update",
-  "version": "3.0.29",
+  "version": "3.0.31",
   "description": "react-native-bundle-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",