@otakit/capacitor-updater 2.2.0 → 2.3.1

package/README.md

@@ -162,6 +162,11 @@ If a bundle is applied and never calls `notifyAppReady()`:
 The last failed applied bundle is persisted so the plugin does not immediately
 download and apply the same broken release again.
 
+On top of this per-device rollback, a release published with the auto-revert
+flag is reverted fleet-wide by the server when too many devices report
+rollbacks within a 24-hour window, so remaining devices never download the
+broken bundle.
+
 ## Automatic flow
 
 For the normal hosted path, most apps only need:

package/android/src/main/java/com/otakit/updater/BundleStore.java

@@ -27,6 +27,7 @@ final class BundleStore {
   private final Context context;
   private final SharedPreferences prefs;
   private final File bundlesDirectory;
+  private final File filesCacheDirectory;
   private final String builtinVersion;
   private final String nativeBuild;
   private final String appRuntimeVersion;
@@ -47,6 +48,16 @@ final class BundleStore {
       //noinspection ResultOfMethodCallIgnored
       bundlesDirectory.mkdirs();
     }
+    this.filesCacheDirectory = new File(this.context.getFilesDir(), "otakit_files");
+    if (!filesCacheDirectory.exists()) {
+      //noinspection ResultOfMethodCallIgnored
+      filesCacheDirectory.mkdirs();
+    }
+  }
+
+  /** Content-addressed file cache for the deltas strategy ({@code otakit_files/<sha256>}). */
+  File getFilesCacheDirectory() {
+    return filesCacheDirectory;
   }
 
   String getNativeBuild() {

package/android/src/main/java/com/otakit/updater/DeltaAssembler.java

@@ -0,0 +1,416 @@
+package com.otakit.updater;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+/**
+ * Assembles a delta-strategy bundle from per-file content-addressed objects.
+ *
+ * <p>The content cache ({@code otakit_files/<sha256>}) is the device-side
+ * state: previous bundles and the builtin seed populate it, and assembling a
+ * new bundle downloads only the cache misses. Mirrors DeltaAssembler.swift.
+ */
+final class DeltaAssembler {
+
+  // Mirror ZipUtils' extraction limits.
+  private static final int MAX_FILES = 10_000;
+  private static final long MAX_TOTAL_SIZE = 500_000_000L; // 500 MB
+  private static final int MAX_PATH_LENGTH = 512;
+
+  private static final String BUILTIN_SEED_MARKER_NAME = "builtin_seed.json";
+
+  private final File cacheDirectory;
+  private final boolean allowInsecureUrls;
+
+  DeltaAssembler(File cacheDirectory, boolean allowInsecureUrls) {
+    this.cacheDirectory = cacheDirectory;
+    this.allowInsecureUrls = allowInsecureUrls;
+  }
+
+  // ── Canonical file list ─────────────────────────────────────────────
+
+  /**
+   * Canonical file list hash — must match the server's computeFilesHash
+   * (console/lib/delta-files.ts) and the iOS mirror byte-for-byte: entries
+   * sorted by UTF-8 bytes of path, lines {@code <path>:<sha256 lowercase>},
+   * joined with "\n", hashed with SHA-256 (hex).
+   */
+  static String computeFilesHash(List<ManifestClient.ManifestFileEntry> entries) throws Exception {
+    List<ManifestClient.ManifestFileEntry> sorted = new ArrayList<>(entries);
+    sorted.sort((lhs, rhs) -> {
+      byte[] lhsBytes = lhs.path.getBytes(StandardCharsets.UTF_8);
+      byte[] rhsBytes = rhs.path.getBytes(StandardCharsets.UTF_8);
+      int limit = Math.min(lhsBytes.length, rhsBytes.length);
+      for (int index = 0; index < limit; index++) {
+        int lhsByte = lhsBytes[index] & 0xff;
+        int rhsByte = rhsBytes[index] & 0xff;
+        if (lhsByte != rhsByte) {
+          return Integer.compare(lhsByte, rhsByte);
+        }
+      }
+      return Integer.compare(lhsBytes.length, rhsBytes.length);
+    });
+
+    StringBuilder canonical = new StringBuilder();
+    for (int index = 0; index < sorted.size(); index++) {
+      if (index > 0) {
+        canonical.append('\n');
+      }
+      ManifestClient.ManifestFileEntry entry = sorted.get(index);
+      canonical.append(entry.path).append(':').append(entry.sha256.toLowerCase());
+    }
+
+    MessageDigest digest = MessageDigest.getInstance("SHA-256");
+    byte[] hash = digest.digest(canonical.toString().getBytes(StandardCharsets.UTF_8));
+    StringBuilder builder = new StringBuilder();
+    for (byte b : hash) {
+      builder.append(String.format("%02x", b));
+    }
+    return builder.toString();
+  }
+
+  // ── Validation ──────────────────────────────────────────────────────
+
+  private static boolean isValidEntryPath(String path) {
+    if (path == null || path.isEmpty() || path.length() > MAX_PATH_LENGTH) {
+      return false;
+    }
+    if (path.startsWith("/") || path.contains("\\")) {
+      return false;
+    }
+    for (String segment : path.split("/", -1)) {
+      if (segment.isEmpty() || ".".equals(segment) || "..".equals(segment)) {
+        return false;
+      }
+    }
+    for (int index = 0; index < path.length(); index++) {
+      char c = path.charAt(index);
+      if (c < 0x20 || c == 0x7f) {
+        return false;
+      }
+    }
+    // Metadata files the plugin writes into the bundle directory; an app
+    // file with the same root-level name would be overwritten.
+    if ("bundle.json".equals(path) || "otakit_files.json".equals(path)) {
+      return false;
+    }
+    return true;
+  }
+
+  void validate(List<ManifestClient.ManifestFileEntry> entries, String expectedFilesHash)
+    throws Exception {
+    if (entries == null || entries.isEmpty()) {
+      throw new IllegalStateException("Delta manifest has no files");
+    }
+    if (entries.size() > MAX_FILES) {
+      throw new IllegalStateException("Delta manifest exceeds file count limit: " + entries.size());
+    }
+
+    Set<String> seenPaths = new HashSet<>();
+    long totalSize = 0;
+    for (ManifestClient.ManifestFileEntry entry : entries) {
+      if (!isValidEntryPath(entry.path)) {
+        throw new IllegalStateException("Invalid file path in delta manifest: " + entry.path);
+      }
+      if (!seenPaths.add(entry.path)) {
+        throw new IllegalStateException("Duplicate file path in delta manifest: " + entry.path);
+      }
+      if (entry.size > 0) {
+        totalSize += entry.size;
+        if (totalSize > MAX_TOTAL_SIZE) {
+          throw new IllegalStateException("Delta manifest exceeds total size limit: " + totalSize);
+        }
+      }
+    }
+
+    if (!seenPaths.contains("index.html")) {
+      throw new IllegalStateException("Delta bundle does not contain index.html");
+    }
+
+    // The signed manifest sha256 is the filesHash; recomputing it here is what
+    // extends signature coverage to every (path, sha256) pair.
+    if (!computeFilesHash(entries).equals(expectedFilesHash.toLowerCase())) {
+      throw new IllegalStateException("Delta file list does not match the signed filesHash");
+    }
+  }
+
+  // ── Cache ───────────────────────────────────────────────────────────
+
+  private File cachePath(String sha256) {
+    return new File(cacheDirectory, sha256.toLowerCase());
+  }
+
+  private void ensureCached(ManifestClient.ManifestFileEntry entry, Context context)
+    throws Exception {
+    File cached = cachePath(entry.sha256);
+    if (cached.exists()) {
+      return;
+    }
+
+    URL url = new URL(entry.url);
+    ManifestClient.requireHTTPS(url, allowInsecureUrls);
+
+    File temporary = File.createTempFile("otakit-file-", ".tmp", context.getCacheDir());
+    try {
+      HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+      try {
+        connection.setRequestMethod("GET");
+        connection.setConnectTimeout(15_000);
+        connection.setReadTimeout(60_000);
+
+        int status = connection.getResponseCode();
+        if (status < 200 || status >= 300) {
+          throw new IllegalStateException("File download failed with HTTP " + status);
+        }
+
+        try (
+          InputStream input = connection.getInputStream();
+          FileOutputStream output = new FileOutputStream(temporary)
+        ) {
+          byte[] buffer = new byte[8192];
+          int read;
+          while ((read = input.read(buffer)) > 0) {
+            output.write(buffer, 0, read);
+          }
+        }
+      } finally {
+        connection.disconnect();
+      }
+
+      if (!HashUtils.verify(temporary, entry.sha256)) {
+        throw new IllegalStateException("Downloaded file hash mismatch: " + entry.path);
+      }
+
+      if (!cached.exists()) {
+        // Write via temp + rename so process death mid-copy can never leave
+        // a truncated file at a content-addressed path (exists() implies
+        // fully-written, hash-verified content).
+        atomicCopyIntoCache(temporary, cached);
+      }
+    } finally {
+      //noinspection ResultOfMethodCallIgnored
+      temporary.delete();
+    }
+  }
+
+  // ── Assembly ────────────────────────────────────────────────────────
+
+  /**
+   * Fill cache misses and lay out the bundle directory from the cache.
+   * Entries must be validated first.
+   */
+  void assemble(List<ManifestClient.ManifestFileEntry> entries, File destination, Context context)
+    throws Exception {
+    if (destination.exists()) {
+      deleteRecursively(destination);
+    }
+    if (!destination.mkdirs()) {
+      throw new IllegalStateException("Cannot create assembly directory");
+    }
+
+    String destinationPrefix = destination.getCanonicalPath() + File.separator;
+
+    for (ManifestClient.ManifestFileEntry entry : entries) {
+      ensureCached(entry, context);
+
+      File target = new File(destination, entry.path);
+      // Defense in depth alongside isValidEntryPath (mirrors ZipUtils).
+      if (!target.getCanonicalPath().startsWith(destinationPrefix)) {
+        throw new IllegalStateException("Invalid file path in delta manifest: " + entry.path);
+      }
+      File parent = target.getParentFile();
+      if (parent != null && !parent.exists() && !parent.mkdirs()) {
+        throw new IllegalStateException("Cannot create parent: " + parent.getAbsolutePath());
+      }
+      copyFile(cachePath(entry.sha256), target);
+    }
+  }
+
+  // ── Builtin seeding ─────────────────────────────────────────────────
+
+  private File builtinSeedFile() {
+    return new File(cacheDirectory, BUILTIN_SEED_MARKER_NAME);
+  }
+
+  private JSONObject readBuiltinSeed() {
+    try (FileInputStream input = new FileInputStream(builtinSeedFile())) {
+      java.io.ByteArrayOutputStream out = new java.io.ByteArrayOutputStream();
+      byte[] buffer = new byte[8192];
+      int read;
+      while ((read = input.read(buffer)) > 0) {
+        out.write(buffer, 0, read);
+      }
+      return new JSONObject(new String(out.toByteArray(), StandardCharsets.UTF_8));
+    } catch (Exception e) {
+      return null;
+    }
+  }
+
+  /**
+   * Hash the store-build web assets into the cache once per native build, so
+   * the first OTA only downloads what changed relative to the binary.
+   * Best-effort: failures only cost extra downloads.
+   */
+  void seedFromBuiltinIfNeeded(Context context, String assetPath, String nativeBuild) {
+    JSONObject seed = readBuiltinSeed();
+    if (seed != null && nativeBuild.equals(seed.optString("nativeBuild"))) {
+      return;
+    }
+
+    List<String> hashes = new ArrayList<>();
+    try {
+      seedAssetDirectory(context.getAssets(), assetPath, hashes, context);
+    } catch (Exception e) {
+      android.util.Log.w("OtaKit", "builtin delta seed failed", e);
+      return;
+    }
+
+    try {
+      JSONObject newSeed = new JSONObject();
+      newSeed.put("nativeBuild", nativeBuild);
+      newSeed.put("hashes", new JSONArray(hashes));
+      try (FileOutputStream output = new FileOutputStream(builtinSeedFile())) {
+        output.write(newSeed.toString().getBytes(StandardCharsets.UTF_8));
+      }
+    } catch (Exception e) {
+      android.util.Log.w("OtaKit", "builtin delta seed marker write failed", e);
+    }
+  }
+
+  private void seedAssetDirectory(
+    AssetManager assets,
+    String assetPath,
+    List<String> hashes,
+    Context context
+  ) throws Exception {
+    String[] children = assets.list(assetPath);
+    if (children == null || children.length == 0) {
+      // Leaf: treat as a file.
+      String sha256;
+      try (InputStream input = assets.open(assetPath)) {
+        sha256 = HashUtils.sha256(input);
+      }
+      File cached = cachePath(sha256);
+      if (!cached.exists()) {
+        File staging = new File(cacheDirectory, ".tmp-" + java.util.UUID.randomUUID());
+        try (
+          InputStream input = assets.open(assetPath);
+          FileOutputStream output = new FileOutputStream(staging)
+        ) {
+          byte[] buffer = new byte[8192];
+          int read;
+          while ((read = input.read(buffer)) > 0) {
+            output.write(buffer, 0, read);
+          }
+        }
+        renameIntoCache(staging, cached);
+      }
+      hashes.add(sha256);
+      return;
+    }
+    for (String child : children) {
+      seedAssetDirectory(assets, assetPath + "/" + child, hashes, context);
+    }
+  }
+
+  // ── Eviction ────────────────────────────────────────────────────────
+
+  /**
+   * Remove cache entries not referenced by any live bundle and not part of
+   * the builtin seed. Best-effort.
+   */
+  void pruneCache(Set<String> referencedHashes) {
+    Set<String> keep = new HashSet<>();
+    for (String hash : referencedHashes) {
+      keep.add(hash.toLowerCase());
+    }
+    JSONObject seed = readBuiltinSeed();
+    if (seed != null) {
+      JSONArray seedHashes = seed.optJSONArray("hashes");
+      if (seedHashes != null) {
+        for (int index = 0; index < seedHashes.length(); index++) {
+          String hash = seedHashes.optString(index, null);
+          if (hash != null) {
+            keep.add(hash.toLowerCase());
+          }
+        }
+      }
+    }
+
+    File[] items = cacheDirectory.listFiles();
+    if (items == null) {
+      return;
+    }
+    for (File item : items) {
+      String name = item.getName();
+      if (BUILTIN_SEED_MARKER_NAME.equals(name) || name.startsWith(".tmp-")) {
+        continue;
+      }
+      if (!keep.contains(name.toLowerCase())) {
+        //noinspection ResultOfMethodCallIgnored
+        item.delete();
+      }
+    }
+  }
+
+  // ── Helpers ─────────────────────────────────────────────────────────
+
+  private void atomicCopyIntoCache(File source, File destination) throws Exception {
+    File staging = new File(cacheDirectory, ".tmp-" + java.util.UUID.randomUUID());
+    copyFile(source, staging);
+    renameIntoCache(staging, destination);
+  }
+
+  private static void renameIntoCache(File staging, File destination) throws Exception {
+    if (!staging.renameTo(destination)) {
+      //noinspection ResultOfMethodCallIgnored
+      staging.delete();
+      // A concurrent writer may have won the rename; that's fine.
+      if (!destination.exists()) {
+        throw new IllegalStateException("Failed to move cached file into place: " + destination);
+      }
+    }
+  }
+
+  private static void copyFile(File source, File destination) throws Exception {
+    try (
+      FileInputStream input = new FileInputStream(source);
+      FileOutputStream output = new FileOutputStream(destination)
+    ) {
+      byte[] buffer = new byte[8192];
+      int read;
+      while ((read = input.read(buffer)) > 0) {
+        output.write(buffer, 0, read);
+      }
+    }
+  }
+
+  private static void deleteRecursively(File target) {
+    if (!target.exists()) {
+      return;
+    }
+    File[] children = target.listFiles();
+    if (children != null) {
+      for (File child : children) {
+        deleteRecursively(child);
+      }
+    }
+    //noinspection ResultOfMethodCallIgnored
+    target.delete();
+  }
+}

package/android/src/main/java/com/otakit/updater/HashUtils.java

@@ -2,12 +2,28 @@ package com.otakit.updater;
 
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.InputStream;
 import java.security.MessageDigest;
 
 final class HashUtils {
 
   private HashUtils() {}
 
+  static String sha256(InputStream input) throws Exception {
+    MessageDigest digest = MessageDigest.getInstance("SHA-256");
+    byte[] buffer = new byte[1024 * 1024];
+    int read;
+    while ((read = input.read(buffer)) > 0) {
+      digest.update(buffer, 0, read);
+    }
+    byte[] hash = digest.digest();
+    StringBuilder builder = new StringBuilder();
+    for (byte b : hash) {
+      builder.append(String.format("%02x", b));
+    }
+    return builder.toString();
+  }
+
   static String sha256(File file) throws Exception {
     MessageDigest digest = MessageDigest.getInstance("SHA-256");
     try (FileInputStream input = new FileInputStream(file)) {

package/android/src/main/java/com/otakit/updater/ManifestClient.java

@@ -45,10 +45,27 @@ final class ManifestClient {
     }
   }
 
+  static final class ManifestFileEntry {
+
+    final String path;
+    final String sha256;
+    final long size;
+    final String url;
+
+    ManifestFileEntry(String path, String sha256, long size, String url) {
+      this.path = path;
+      this.sha256 = sha256;
+      this.size = size;
+      this.url = url;
+    }
+  }
+
   static final class LatestManifest {
 
     final String version;
+    /** Bundle zip URL. Present for the zip strategy; null for deltas. */
     final String url;
+    /** Zip hash for the zip strategy; canonical filesHash for deltas. */
     final String sha256;
     final int size;
     final String runtimeVersion;
@@ -56,6 +73,8 @@ final class ManifestClient {
     final String strategy;
     final boolean forceImmediate;
     final ManifestEncryption encryption;
+    /** Per-file entries for the deltas strategy; null for zip. */
+    final java.util.List<ManifestFileEntry> files;
 
     LatestManifest(
       String version,
@@ -66,7 +85,8 @@ final class ManifestClient {
       String releaseId,
       String strategy,
       boolean forceImmediate,
-      ManifestEncryption encryption
+      ManifestEncryption encryption,
+      java.util.List<ManifestFileEntry> files
     ) {
       this.version = version;
       this.url = url;
@@ -77,6 +97,7 @@ final class ManifestClient {
       this.strategy = strategy;
       this.forceImmediate = forceImmediate;
       this.encryption = encryption;
+      this.files = files;
     }
   }
 
@@ -146,7 +167,6 @@ final class ManifestClient {
       JSONObject json = new JSONObject(payload);
 
       String version = json.getString("version");
-      String downloadUrl = json.getString("url");
       String sha256 = json.getString("sha256");
       int size = json.getInt("size");
 
@@ -183,7 +203,23 @@ final class ManifestClient {
       boolean forceImmediate = Boolean.TRUE.equals(rawForceImmediate);
       ManifestEncryption encryption = parseEncryption(json);
 
-      requireHTTPS(new URL(downloadUrl), allowInsecureUrls);
+      String downloadUrl = null;
+      if (json.has("url") && !json.isNull("url")) {
+        String rawUrl = json.getString("url").trim();
+        if (!rawUrl.isEmpty()) {
+          downloadUrl = rawUrl;
+        }
+      }
+
+      java.util.List<ManifestFileEntry> files = null;
+      if ("deltas".equals(strategy)) {
+        files = parseFiles(json, allowInsecureUrls);
+      } else {
+        if (downloadUrl == null) {
+          throw new IllegalStateException("Manifest response missing required url");
+        }
+        requireHTTPS(new URL(downloadUrl), allowInsecureUrls);
+      }
 
       if (manifestKeys == null || manifestKeys.isEmpty()) {
         android.util.Log.w(
@@ -223,13 +259,42 @@ final class ManifestClient {
         releaseId,
         strategy,
         forceImmediate,
-        encryption
+        encryption,
+        files
       );
     } finally {
       connection.disconnect();
     }
   }
 
+  private static java.util.List<ManifestFileEntry> parseFiles(
+    JSONObject json,
+    boolean allowInsecureUrls
+  ) throws Exception {
+    if (!json.has("files") || json.isNull("files")) {
+      throw new IllegalStateException("Delta manifest is missing its file list");
+    }
+    org.json.JSONArray rawFiles = json.getJSONArray("files");
+    if (rawFiles.length() == 0) {
+      throw new IllegalStateException("Delta manifest has an empty file list");
+    }
+
+    java.util.List<ManifestFileEntry> entries = new java.util.ArrayList<>(rawFiles.length());
+    for (int index = 0; index < rawFiles.length(); index++) {
+      JSONObject rawFile = rawFiles.getJSONObject(index);
+      if (!rawFile.has("path") || !rawFile.has("sha256") || !rawFile.has("url")) {
+        throw new IllegalStateException("Delta manifest file entry is missing required fields");
+      }
+      String path = rawFile.getString("path");
+      String fileSha256 = rawFile.getString("sha256");
+      String fileUrl = rawFile.getString("url");
+      long fileSize = rawFile.optLong("size", -1);
+      requireHTTPS(new URL(fileUrl), allowInsecureUrls);
+      entries.add(new ManifestFileEntry(path, fileSha256, fileSize, fileUrl));
+    }
+    return entries;
+  }
+
   private static ManifestEncryption parseEncryption(JSONObject json) throws Exception {
     if (!json.has("encryption") || json.isNull("encryption")) {
       return null;