npm - @otakit/capacitor-updater - Versions diffs - 2.3.2 → 3.0.0 - Mend

@otakit/capacitor-updater 2.3.2 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (57) hide show

package/ios/Tests/UpdaterPluginTests/BundleCryptoTests.swift ADDED Viewed

@@ -0,0 +1,80 @@
+import Foundation
+import XCTest
+@testable import UpdaterPlugin
+final class BundleCryptoTests: XCTestCase {
+  private var directory: URL!
+  private let ciphertext = "7b6aa276a9dba36ef929f2e5c5801b0cf7b3e314bf2f1e5c5e0e9df1681b658e2e78da91c3ffffb9dfebd748620c76d3e455d9b60791"
+  private var key: Data { Data(0..<32) }
+  private var nonce: String { Data(0..<12).base64EncodedString() }
+  private func hex(_ value: String) -> Data {
+    var result = Data()
+    var start = value.startIndex
+    while start < value.endIndex {
+      let end = value.index(start, offsetBy: 2)
+      result.append(UInt8(value[start..<end], radix: 16)!)
+      start = end
+    }
+    return result
+  }
+  override func setUpWithError() throws {
+    directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+  }
+  override func tearDownWithError() throws { try? FileManager.default.removeItem(at: directory) }
+  func testDecryptsCLICompatibleCiphertextAfterAuthentication() throws {
+    let input = directory.appendingPathComponent("encrypted")
+    let output = directory.appendingPathComponent("plain")
+    try hex(ciphertext).write(to: input)
+    try BundleCrypto.decryptFile(dek: key, nonceB64: nonce, input: input, output: output, availableBytes: 1024 * 1024 * 1024)
+    XCTAssertEqual(try String(contentsOf: output, encoding: .utf8), "<html>authenticated OTA fixture</html>")
+  }
+  #if targetEnvironment(simulator)
+  func testSimulatorDecryptsWithDefaultMemoryEstimate() throws {
+    let input = directory.appendingPathComponent("encrypted")
+    let output = directory.appendingPathComponent("plain")
+    try hex(ciphertext).write(to: input)
+    try BundleCrypto.decryptFile(dek: key, nonceB64: nonce, input: input, output: output)
+    XCTAssertEqual(try String(contentsOf: output, encoding: .utf8), "<html>authenticated OTA fixture</html>")
+  }
+  #endif
+  func testTamperedBodyTagAndWrongKeyCannotPublishPlaintext() throws {
+    let input = directory.appendingPathComponent("encrypted")
+    let output = directory.appendingPathComponent("plain")
+    for index in [0, hex(ciphertext).count - 1, -1] {
+      var bytes = hex(ciphertext)
+      var key = key
+      if index >= 0 { bytes[index] ^= 1 } else { key[0] ^= 1 }
+      try bytes.write(to: input)
+      try Data([42]).write(to: output)
+      XCTAssertThrowsError(try BundleCrypto.decryptFile(dek: key, nonceB64: nonce, input: input, output: output, availableBytes: 1024 * 1024 * 1024))
+      XCTAssertEqual(try Data(contentsOf: output), Data([42]))
+    }
+  }
+  func testLargeSparseFileIsRejectedBeforeAllocatingOrWriting() throws {
+    let input = directory.appendingPathComponent("encrypted")
+    let output = directory.appendingPathComponent("absent.zip")
+    try Data().write(to: input)
+    let file = try FileHandle(forWritingTo: input)
+    try file.truncate(atOffset: 200 * 1024 * 1024)
+    try file.close()
+    XCTAssertThrowsError(try BundleCrypto.decryptFile(dek: key, nonceB64: nonce, input: input, output: output, availableBytes: 80 * 1024 * 1024)) { error in
+      XCTAssertTrue(error.localizedDescription.hasPrefix("insufficient_memory_for_encrypted_bundle"))
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: output.path))
+  }
+  func testBudgetIncludesReserveAndAvoidsOverflow() throws {
+    let reserve: Int64 = 32 * 1024 * 1024
+    try BundleCrypto.requireMemoryBudget(encryptedBytes: 100, availableBytes: reserve + 400)
+    XCTAssertThrowsError(try BundleCrypto.requireMemoryBudget(encryptedBytes: 101, availableBytes: reserve + 400))
+    XCTAssertThrowsError(try BundleCrypto.requireMemoryBudget(encryptedBytes: 100, availableBytes: .min))
+    XCTAssertThrowsError(try BundleCrypto.requireMemoryBudget(encryptedBytes: 129 * 1024 * 1024, availableBytes: .max))
+  }
+  func testTruncatedInputCannotCreateOutput() throws {
+    let input = directory.appendingPathComponent("encrypted")
+    let output = directory.appendingPathComponent("absent.zip")
+    try Data(repeating: 0, count: 16).write(to: input)
+    XCTAssertThrowsError(try BundleCrypto.decryptFile(dek: key, nonceB64: nonce, input: input, output: output, availableBytes: .max))
+    XCTAssertFalse(FileManager.default.fileExists(atPath: output.path))
+  }
+}

package/ios/Tests/UpdaterPluginTests/BundlePersistenceTests.swift ADDED Viewed

@@ -0,0 +1,102 @@
+import Foundation
+import XCTest
+@testable import UpdaterPlugin
+final class BundlePersistenceTests: XCTestCase {
+  private var fixture: CoordinatorFixture!
+  override func setUpWithError() throws { fixture = try CoordinatorFixture() }
+  override func tearDownWithError() throws { try fixture.cleanup() }
+  func testFailedActivationCommitSurvivesRestartAndCanRetry() throws {
+    try fixture.installHealthy("A")
+    try fixture.stage("B")
+    try fixture.withReadOnlyState {
+      XCTAssertThrowsError(try fixture.coordinator.prepareApplyStaged(
+        isCompatibleRuntime: { _ in true }, isBundleUsable: fixture.isUsable
+      ))
+      XCTAssertEqual(fixture.store.getBundle(id: "B")?.status, .trial)
+    }
+    let reopened = fixture.reopenStore()
+    XCTAssertEqual(reopened.getCurrentBundle().id, "A")
+    XCTAssertEqual(reopened.getFallbackBundle().id, "A")
+    XCTAssertEqual(reopened.getStagedBundleId(), "B")
+    let coordinator = UpdaterCoordinator(store: reopened)
+    let startup = try coordinator.normalizeStartupState(isBundleUsable: fixture.isUsable)
+    XCTAssertNil(startup.eventPayload)
+    XCTAssertEqual(startup.activationPath, reopened.bundleDirectory(for: "A").path)
+    XCTAssertTrue(try coordinator.prepareApplyStaged(
+      isCompatibleRuntime: { _ in true }, isBundleUsable: fixture.isUsable
+    ).didApply)
+  }
+  func testFailedReadinessCommitKeepsFallbackAndCanRetryExactlyOnce() throws {
+    try fixture.installHealthy("A")
+    try fixture.apply("B")
+    try fixture.withReadOnlyState {
+      XCTAssertThrowsError(try fixture.coordinator.prepareNotifyAppReady(activationId: fixture.trial?.activationId))
+      XCTAssertEqual(fixture.store.getCurrentBundle().status, .success)
+      XCTAssertEqual(fixture.reopenStore().getFallbackBundle().id, "A")
+      XCTAssertTrue(fixture.indexExists("A"))
+    }
+    let ready = try fixture.coordinator.prepareNotifyAppReady(activationId: fixture.trial?.activationId)
+    XCTAssertEqual(ready.eventPayload?.action, .applied)
+    fixture.coordinator.cleanupBundles(ready.cleanupBundleIds)
+    XCTAssertFalse(fixture.indexExists("A"))
+    XCTAssertTrue(fixture.indexExists("B"))
+    XCTAssertNil(try fixture.coordinator.prepareNotifyAppReady(activationId: fixture.trial?.activationId).eventPayload)
+  }
+  func testFailedRollbackCommitKeepsBothBundlesAndCanRetry() throws {
+    try fixture.installHealthy("A")
+    try fixture.apply("B")
+    let trial = try XCTUnwrap(fixture.trial)
+    try fixture.withReadOnlyState {
+      XCTAssertThrowsError(try fixture.coordinator.prepareRollback(
+        expectedTrial: trial, reason: "notify_timeout", isBundleUsable: fixture.isUsable
+      ))
+      let reopened = fixture.reopenStore()
+      XCTAssertEqual(reopened.getCurrentBundle().id, "B")
+      XCTAssertEqual(reopened.getCurrentBundle().status, .trial)
+      XCTAssertEqual(reopened.getFallbackBundle().id, "A")
+      XCTAssertNil(reopened.getLastFailedBundle())
+      XCTAssertTrue(fixture.indexExists("A"))
+      XCTAssertTrue(fixture.indexExists("B"))
+    }
+    let rollback = try fixture.coordinator.prepareRollback(
+      expectedTrial: trial, reason: "notify_timeout", isBundleUsable: fixture.isUsable
+    )
+    fixture.coordinator.cleanupBundles(rollback.cleanupBundleIds)
+    XCTAssertTrue(rollback.didRollback)
+    let reopened = fixture.reopenStore()
+    XCTAssertEqual(reopened.getCurrentBundle().id, "A")
+    XCTAssertEqual(reopened.getLastFailedBundle()?.id, "B")
+    XCTAssertEqual(reopened.getLastFailedBundle()?.status, .error)
+    XCTAssertTrue(fixture.indexExists("A"))
+    XCTAssertFalse(fixture.indexExists("B"))
+  }
+  func testLegacyPreferencesMigrateOnFirstWrite() throws {
+    fixture.defaults.set("A", forKey: "otakit_current_bundle_id")
+    fixture.defaults.set("A", forKey: "otakit_fallback_bundle_id")
+    fixture.defaults.set("B", forKey: "otakit_staged_bundle_id")
+    XCTAssertEqual(fixture.store.getCurrentBundleId(), "A")
+    try fixture.store.setStagedBundleId("C")
+    fixture.defaults.set("obsolete", forKey: "otakit_current_bundle_id")
+    let reopened = fixture.reopenStore()
+    XCTAssertEqual(reopened.getCurrentBundleId(), "A")
+    XCTAssertEqual(reopened.getFallbackBundleId(), "A")
+    XCTAssertEqual(reopened.getStagedBundleId(), "C")
+  }
+  func testCorruptStateCannotAuthorizeMutationOrCleanup() throws {
+    try fixture.installHealthy("A")
+    try fixture.apply("B")
+    try Data("{truncated".utf8).write(to: fixture.root.appendingPathComponent("otakit-state.json"))
+    XCTAssertThrowsError(try fixture.coordinator.normalizeStartupState(isBundleUsable: fixture.isUsable))
+    XCTAssertThrowsError(try fixture.store.setCurrentBundleId("C"))
+    fixture.coordinator.cleanupBundles(["A", "B"])
+    XCTAssertTrue(fixture.indexExists("A"))
+    XCTAssertTrue(fixture.indexExists("B"))
+  }
+}

package/ios/Tests/UpdaterPluginTests/CheckFailureTests.swift ADDED Viewed

@@ -0,0 +1,55 @@
+import Foundation
+import XCTest
+@testable import UpdaterPlugin
+final class CheckFailureTests: XCTestCase {
+  func testFailedCheckIsReportedOnceAndStillThrowsOriginalError() async throws {
+    var reports: [CheckFailure] = []
+    let original = NSError(domain: NSURLErrorDomain, code: NSURLErrorTimedOut,
+      userInfo: [NSLocalizedDescriptionKey: "https://secret.test?token=secret"])
+    do {
+      let _: String = try await CheckFailure.observe({ throw original }, report: { reports.append($0) })
+      XCTFail("Expected original error")
+    } catch { XCTAssertTrue((error as NSError) === original) }
+    XCTAssertEqual(reports.count, 1)
+    XCTAssertEqual(reports.first?.phase, "check")
+    XCTAssertEqual(reports.first?.detail, "manifest_network_\(NSURLErrorTimedOut)")
+    XCTAssertFalse(reports[0].detail.contains("secret"))
+  }
+  func testSuccessfulNoUpdateAndCancellationDoNotEmitErrors() async throws {
+    var reports: [CheckFailure] = []
+    let result: String? = try await CheckFailure.observe({ nil }, report: { reports.append($0) })
+    XCTAssertNil(result)
+    let manifest = try await CheckFailure.observe({ "manifest" }, report: { reports.append($0) })
+    XCTAssertEqual(manifest, "manifest")
+    do {
+      let _: String = try await CheckFailure.observe({ throw CancellationError() }, report: { reports.append($0) })
+      XCTFail("Expected cancellation")
+    } catch { XCTAssertTrue(error is CancellationError) }
+    XCTAssertTrue(reports.isEmpty)
+    XCTAssertNil(CheckFailure.from(URLError(.cancelled)))
+  }
+  func testHTTPFailureIncludesOnlyStatus() {
+    let error = CheckFailure.from(ManifestClientError.httpStatus(503))
+    XCTAssertEqual(error?.detail, "manifest_http_503")
+    XCTAssertEqual(error?.phase, "check")
+  }
+  func testRealVerifierExpiryAndUnknownKeyRemainTerminalAndAreDistinguishable() async throws {
+    for expired in [true, false] {
+      var reports: [CheckFailure] = []
+      let signature = ManifestSignature(kid: "private-key-label", sig: "invalid-signature", iat: 0,
+        exp: expired ? 0 : Int(Date().timeIntervalSince1970) + 600)
+      do {
+        try await CheckFailure.observe({
+          try ManifestVerifier.verify(appId: "app-a", channel: nil, version: "1.0", sha256: "hash", size: 1,
+            runtimeVersion: nil, strategy: "zip", forceImmediate: false, encryption: nil, signature: signature, trustedKeys: [])
+        }, report: { reports.append($0) })
+        XCTFail("Invalid signature accepted")
+      } catch { XCTAssertTrue(error is ManifestVerifierError) }
+      XCTAssertEqual(reports.count, 1)
+      XCTAssertEqual(reports.first?.phase, "signature")
+      XCTAssertEqual(reports.first?.detail, expired ? "signature_expired" : "signature_unknown_key")
+      XCTAssertFalse(reports[0].detail.contains("private-key-label"))
+    }
+  }
+}

package/ios/Tests/UpdaterPluginTests/DeltaCacheIntegrityTests.swift ADDED Viewed

@@ -0,0 +1,69 @@
+import Foundation
+import XCTest
+@testable import UpdaterPlugin
+final class DeltaCacheIntegrityTests: XCTestCase {
+  private var directory: URL!
+  private var cache: URL!
+  private let good = Data([1,2,3])
+  override func setUpWithError() throws {
+    directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    cache = directory.appendingPathComponent("cache")
+    try FileManager.default.createDirectory(at: cache, withIntermediateDirectories: true)
+  }
+  override func tearDownWithError() throws { try? FileManager.default.removeItem(at: directory) }
+  private func entry() throws -> ManifestFileEntry {
+    let source = directory.appendingPathComponent("source")
+    try good.write(to: source)
+    return ManifestFileEntry(path: "index.html", sha256: try HashUtils.sha256(fileURL: source), size: 3, url: "https://example.test/file")
+  }
+  private func download() throws -> URL {
+    let file = directory.appendingPathComponent(UUID().uuidString)
+    try good.write(to: file)
+    return file
+  }
+  func testCorruptedCacheIsRepairedBeforeAssembly() async throws {
+    let entry = try entry()
+    let cached = cache.appendingPathComponent(entry.sha256)
+    try Data([9,9,9]).write(to: cached)
+    var requests = 0
+    let assembler = DeltaAssembler(cacheDirectory: cache, downloader: Downloader(), fetch: { _ in
+      requests += 1; return try self.download()
+    })
+    let output = directory.appendingPathComponent("assembled")
+    try assembler.validate([entry], expectedFilesHash: DeltaAssembler.computeFilesHash([entry]))
+    try await assembler.assemble(entries: [entry], into: output)
+    XCTAssertEqual(try Data(contentsOf: output.appendingPathComponent("index.html")), good)
+    XCTAssertEqual(try Data(contentsOf: cached), good)
+    XCTAssertEqual(requests, 1)
+  }
+  func testValidCacheNeedsNoNetwork() async throws {
+    let entry = try entry()
+    try good.write(to: cache.appendingPathComponent(entry.sha256))
+    let assembler = DeltaAssembler(cacheDirectory: cache, downloader: Downloader(), fetch: { _ in
+      XCTFail("Network used for valid cache"); throw URLError(.notConnectedToInternet)
+    })
+    let output = directory.appendingPathComponent("assembled")
+    try await assembler.assemble(entries: [entry], into: output)
+    XCTAssertEqual(try Data(contentsOf: output.appendingPathComponent("index.html")), good)
+  }
+  func testDamagedCacheAndOfflineFailureCannotProduceBundle() async throws {
+    let entry = try entry()
+    try Data([9]).write(to: cache.appendingPathComponent(entry.sha256))
+    let assembler = DeltaAssembler(cacheDirectory: cache, downloader: Downloader(), fetch: { _ in throw URLError(.notConnectedToInternet) })
+    let output = directory.appendingPathComponent("assembled")
+    do { try await assembler.assemble(entries: [entry], into: output); XCTFail("Expected offline failure") }
+    catch { XCTAssertEqual((error as NSError).code, NSURLErrorNotConnectedToInternet) }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: output.appendingPathComponent("index.html").path))
+  }
+  func testCorruptConcurrentWriterCannotBypassVerification() async throws {
+    let entry = try entry()
+    let assembler = DeltaAssembler(cacheDirectory: cache, downloader: Downloader(), fetch: { _ in
+      try Data([9]).write(to: self.cache.appendingPathComponent(entry.sha256))
+      return try self.download()
+    })
+    let output = directory.appendingPathComponent("assembled")
+    try await assembler.assemble(entries: [entry], into: output)
+    XCTAssertEqual(try Data(contentsOf: output.appendingPathComponent("index.html")), good)
+  }
+}

package/ios/Tests/UpdaterPluginTests/DocumentReadyBridgeTests.swift ADDED Viewed

@@ -0,0 +1,102 @@
+import Capacitor
+import Foundation
+import UIKit
+import WebKit
+import XCTest
+@testable import UpdaterPlugin
+final class DocumentReadyBridgeTests: XCTestCase {
+  @MainActor
+  func testOldWebViewDocumentCannotConfirmReplacementUsingCapacitorBridge() async throws {
+    let fixture = try CoordinatorFixture()
+    defer { try? fixture.cleanup() }
+    try fixture.installHealthy("A")
+    let oldTrial = try XCTUnwrap(fixture.trial)
+    let configuration = WKWebViewConfiguration()
+    let controller = configuration.userContentController
+    let recorder = ReadyMessageRecorder()
+    controller.add(recorder, name: "bridge")
+    let capacitorBundle = Bundle(for: CAPBridgeViewController.self)
+    let nativeBridgeURL = try XCTUnwrap(capacitorBundle.url(forResource: "native-bridge", withExtension: "js"))
+    let nativeBridge = try String(contentsOf: nativeBridgeURL, encoding: .utf8)
+    controller.addUserScript(WKUserScript(source: nativeBridge, injectionTime: .atDocumentStart, forMainFrameOnly: true))
+    controller.addUserScript(WKUserScript(source: "window.otherPluginMarker = 42;", injectionTime: .atDocumentStart, forMainFrameOnly: true))
+    let webView = WKWebView(frame: CGRect(x: 0, y: 0, width: 320, height: 480), configuration: configuration)
+    let navigation = ReadyNavigationRecorder()
+    webView.navigationDelegate = navigation
+    let window: UIWindow
+    if let scene = UIApplication.shared.connectedScenes.first as? UIWindowScene {
+      window = UIWindow(windowScene: scene)
+    } else {
+      window = UIWindow(frame: webView.frame)
+    }
+    let host = UIViewController()
+    host.view.addSubview(webView)
+    window.rootViewController = host
+    window.makeKeyAndVisible()
+    defer { window.isHidden = true; webView.removeFromSuperview() }
+    let readinessBridge = DocumentReadyBridge()
+    try readinessBridge.install(on: webView, activationId: oldTrial.activationId)
+    let readyJS = "Capacitor.nativePromise('OtaKit', 'notifyAppReady', {}).catch(() => {});"
+    let html = "<html><script>\(readyJS)</script></html>"
+    let firstReady = expectation(description: "Original document sends readiness")
+    recorder.onReady = { firstReady.fulfill() }
+    webView.loadHTMLString(html, baseURL: URL(string: "https://localhost"))
+    // Cold simulator WebKit startup is separate from the updater's readiness budget.
+    await fulfillment(of: [firstReady], timeout: 30)
+    guard recorder.activationId != nil else {
+      XCTFail("Initial WebView load: \(navigation.status); bridge messages: \(recorder.lastMessage)")
+      return
+    }
+    XCTAssertEqual(recorder.activationId, oldTrial.activationId)
+    try fixture.apply("B")
+    let newTrial = try XCTUnwrap(fixture.trial)
+    try readinessBridge.install(on: webView, activationId: newTrial.activationId)
+    XCTAssertEqual(controller.userScripts.count, 3, "Keep other plugins and replace only our script")
+    let staleReady = expectation(description: "Old document calls after preparing replacement")
+    recorder.onReady = { staleReady.fulfill() }
+    _ = try await webView.evaluateJavaScript(readyJS + "'sent';")
+    await fulfillment(of: [staleReady], timeout: 30)
+    XCTAssertEqual(recorder.activationId, oldTrial.activationId)
+    XCTAssertNil(try fixture.coordinator.prepareNotifyAppReady(activationId: recorder.activationId).eventPayload)
+    XCTAssertEqual(fixture.store.getCurrentBundle().status, .trial)
+    XCTAssertTrue(fixture.indexExists("A"))
+    let replacementReady = expectation(description: "Replacement document gets its own activation")
+    recorder.onReady = { replacementReady.fulfill() }
+    webView.loadHTMLString(html, baseURL: URL(string: "https://localhost"))
+    await fulfillment(of: [replacementReady], timeout: 30)
+    XCTAssertEqual(recorder.activationId, newTrial.activationId)
+    XCTAssertNotNil(try fixture.coordinator.prepareNotifyAppReady(activationId: recorder.activationId).eventPayload)
+    let marker = try await webView.evaluateJavaScript("window.otherPluginMarker") as? Int
+    XCTAssertEqual(marker, 42)
+    webView.stopLoading()
+    controller.removeScriptMessageHandler(forName: "bridge")
+  }
+}
+private final class ReadyMessageRecorder: NSObject, WKScriptMessageHandler {
+  var activationId: String?
+  var onReady: (() -> Void)?
+  var lastMessage = "none"
+  func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
+    lastMessage = String(describing: message.body)
+    guard let body = message.body as? [String: Any],
+          body["methodName"] as? String == "notifyAppReady" else { return }
+    activationId = (body["options"] as? [String: Any])?["_otakitActivationId"] as? String
+    onReady?()
+  }
+}
+private final class ReadyNavigationRecorder: NSObject, WKNavigationDelegate {
+  var status = "not started"
+  func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) { status = "started" }
+  func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { status = "finished" }
+  func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) { status = "failed: \(error)" }
+  func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) { status = "provisional failure: \(error)" }
+  func webViewWebContentProcessDidTerminate(_ webView: WKWebView) { status = "content process terminated" }
+}

package/ios/Tests/UpdaterPluginTests/DownloadIntegrityTests.swift ADDED Viewed

@@ -0,0 +1,40 @@
+import Foundation
+import XCTest
+@testable import UpdaterPlugin
+final class DownloadIntegrityTests: XCTestCase {
+  func testMismatchIncludesHashesAndByteCountsWithoutPaths() throws {
+    let file = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try Data([1, 2, 3]).write(to: file)
+    defer { try? FileManager.default.removeItem(at: file) }
+    let expected = String(repeating: "0", count: 64)
+    let actual = try HashUtils.sha256(fileURL: file)
+    XCTAssertThrowsError(try HashUtils.verifyDownload(fileURL: file, expectedSha256: expected, expectedBytes: 10, kind: "bundle")) { error in
+      let detail = error.localizedDescription
+      XCTAssertTrue(detail.contains("hash mismatch"))
+      XCTAssertTrue(detail.contains("expectedSha256=\(expected)"))
+      XCTAssertTrue(detail.contains("actualSha256=\(actual)"))
+      XCTAssertTrue(detail.contains("expectedBytes=10; receivedBytes=3"))
+      XCTAssertFalse(detail.contains(file.path))
+      XCTAssertLessThan(detail.count, 500)
+    }
+  }
+  func testSizeMismatchFailsEvenWithMatchingHash() throws {
+    let file = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try Data([1, 2, 3]).write(to: file)
+    defer { try? FileManager.default.removeItem(at: file) }
+    let hash = try HashUtils.sha256(fileURL: file)
+    XCTAssertThrowsError(try HashUtils.verifyDownload(fileURL: file, expectedSha256: hash, expectedBytes: 4, kind: "bundle"))
+    try HashUtils.verifyDownload(fileURL: file, expectedSha256: hash.uppercased(), expectedBytes: 3, kind: "bundle")
+    try HashUtils.verifyDownload(fileURL: file, expectedSha256: hash, expectedBytes: nil, kind: "bundle")
+  }
+  func testInvalidExpectedHashIsRedacted() throws {
+    let file = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try Data([1, 2, 3]).write(to: file)
+    defer { try? FileManager.default.removeItem(at: file) }
+    XCTAssertThrowsError(try HashUtils.verifyDownload(fileURL: file, expectedSha256: "https://secret.test?token=secret", expectedBytes: nil, kind: "bundle")) { error in
+      XCTAssertTrue(error.localizedDescription.contains("expectedSha256=invalid"))
+      XCTAssertFalse(error.localizedDescription.contains("secret"))
+    }
+  }
+}

package/ios/Tests/UpdaterPluginTests/DownloadRetryTests.swift ADDED Viewed

@@ -0,0 +1,189 @@
+import Foundation
+import Network
+import XCTest
+@testable import UpdaterPlugin
+final class DownloadRetryTests: XCTestCase {
+  func testOnlyActualHTTP403And410RefreshTheManifest() {
+    XCTAssertTrue(DownloadRetry.isExpiredURLFailure(DownloadHTTPError(status: 403, retryAfter: nil)))
+    XCTAssertTrue(DownloadRetry.isExpiredURLFailure(DownloadHTTPError(status: 410, retryAfter: nil)))
+    XCTAssertFalse(DownloadRetry.isExpiredURLFailure(DownloadHTTPError(status: 503, retryAfter: nil)))
+    XCTAssertFalse(DownloadRetry.isExpiredURLFailure(NSError(domain: "OtaKit", code: 1,
+      userInfo: [NSLocalizedDescriptionKey: "hash mismatch; actualSha256=abc403def410; receivedBytes=40300"])))
+    XCTAssertFalse(DownloadRetry.isExpiredURLFailure(NSError(domain: "OtaKit", code: 403,
+      userInfo: [NSLocalizedDescriptionKey: "forbidden local path or expired key"])))
+  }
+  func testTransientHTTPAndDisconnectedBodyRetryFreshDownloads() async throws {
+    let server = try DownloadHTTPServer(responses: [
+      .http(status: 503), .truncated, .success
+    ])
+    let url = try await server.start()
+    defer { server.stop() }
+    var delays: [TimeInterval] = []
+    let downloader = Downloader(allowInsecureUrls: true,
+      retry: DownloadRetry(random: { 0.5 }), sleep: { delays.append($0) })
+    let downloaded = try await downloader.download(from: url)
+    defer { try? FileManager.default.removeItem(at: downloaded) }
+    XCTAssertEqual(try Data(contentsOf: downloaded), Data([1, 2, 3]))
+    XCTAssertEqual(server.requestCount, 3)
+    XCTAssertEqual(delays, [1, 2])
+  }
+  func testRetryAfterIsHonoredAndLongDelayIsNotRetriedEarly() async throws {
+    let server = try DownloadHTTPServer(responses: [.http(status: 429, retryAfter: "12"), .success])
+    let url = try await server.start()
+    defer { server.stop() }
+    var delays: [TimeInterval] = []
+    let downloader = Downloader(allowInsecureUrls: true,
+      retry: DownloadRetry(random: { 0.5 }), sleep: { delays.append($0) })
+    let downloaded = try await downloader.download(from: url)
+    try FileManager.default.removeItem(at: downloaded)
+    XCTAssertEqual(delays, [12])
+    XCTAssertNil(DownloadRetry().delay(for: DownloadHTTPError(status: 503, retryAfter: "120"), attempt: 1))
+  }
+  func testExhaustionStopsAfterThreeRequests() async throws {
+    let server = try DownloadHTTPServer(responses: [.http(status: 504)])
+    let url = try await server.start()
+    defer { server.stop() }
+    var delays: [TimeInterval] = []
+    let downloader = Downloader(allowInsecureUrls: true, sleep: { delays.append($0) })
+    do {
+      _ = try await downloader.download(from: url)
+      XCTFail("Expected terminal HTTP error")
+    } catch let error as DownloadHTTPError { XCTAssertEqual(error.status, 504) }
+    XCTAssertEqual(server.requestCount, 3)
+    XCTAssertEqual(delays.count, 2)
+  }
+  func testPermanentHTTPDoesNotRetry() async throws {
+    let server = try DownloadHTTPServer(responses: [.http(status: 403)])
+    let url = try await server.start()
+    defer { server.stop() }
+    let downloader = Downloader(allowInsecureUrls: true, sleep: { _ in XCTFail("Unexpected retry") })
+    do { _ = try await downloader.download(from: url); XCTFail("Expected HTTP 403") }
+    catch let error as DownloadHTTPError { XCTAssertEqual(error.status, 403) }
+    XCTAssertEqual(server.requestCount, 1)
+  }
+  func testUnsolicitedPartialResponseIsRejected() async throws {
+    let server = try DownloadHTTPServer(responses: [.http(status: 206)])
+    let url = try await server.start()
+    defer { server.stop() }
+    do {
+      _ = try await Downloader(allowInsecureUrls: true).download(from: url)
+      XCTFail("A whole-object request must not accept a partial response")
+    } catch let error as DownloadHTTPError { XCTAssertEqual(error.status, 206) }
+    XCTAssertEqual(server.requestCount, 1)
+  }
+  func testCancellationDuringBackoffStopsFurtherRequests() async throws {
+    let server = try DownloadHTTPServer(responses: [.http(status: 503)])
+    let url = try await server.start()
+    defer { server.stop() }
+    let waiting = expectation(description: "Retry backoff begins")
+    let downloader = Downloader(allowInsecureUrls: true, sleep: { _ in
+      waiting.fulfill()
+      try await Task.sleep(nanoseconds: 30_000_000_000)
+    })
+    let download = Task { try await downloader.download(from: url) }
+    await fulfillment(of: [waiting], timeout: 10)
+    download.cancel()
+    do { _ = try await download.value; XCTFail("Expected cancellation") }
+    catch { XCTAssertTrue(error is CancellationError) }
+    XCTAssertEqual(server.requestCount, 1)
+  }
+  func testPolicyRejectsCertificateDiskIntegrityAndCancelledErrors() {
+    let retry = DownloadRetry()
+    for code in [NSURLErrorServerCertificateUntrusted, NSURLErrorServerCertificateHasBadDate,
+                 NSURLErrorCancelled, NSURLErrorCannotWriteToFile] {
+      XCTAssertNil(retry.delay(for: NSError(domain: NSURLErrorDomain, code: code), attempt: 1))
+    }
+    XCTAssertNil(retry.delay(for: CocoaError(.fileWriteOutOfSpace), attempt: 1))
+    XCTAssertNil(retry.delay(for: NSError(domain: "OtaKit", code: 1,
+      userInfo: [NSLocalizedDescriptionKey: "hash mismatch"]), attempt: 1))
+    for status in [400, 401, 403, 404, 410] {
+      XCTAssertNil(retry.delay(for: DownloadHTTPError(status: status, retryAfter: nil), attempt: 1))
+    }
+  }
+  func testRetryAfterDateAndOverflow() {
+    XCTAssertEqual(DownloadRetry.retryAfter("Thu, 01 Jan 1970 00:00:12 GMT", now: Date(timeIntervalSince1970: 0)), 12)
+    XCTAssertEqual(DownloadRetry.retryAfter("Thu, 01 Jan 1970 00:00:12 GMT", now: Date(timeIntervalSince1970: 20)), 0)
+    XCTAssertNil(DownloadRetry.retryAfter("invalid", now: Date()))
+    XCTAssertNil(DownloadRetry.retryAfter("-1", now: Date()))
+    let huge = String(repeating: "9", count: 500)
+    XCTAssertNil(DownloadRetry().delay(for: DownloadHTTPError(status: 429, retryAfter: huge), attempt: 1))
+  }
+}
+/// Real loopback HTTP responses, including a body disconnected before Content-Length.
+final class DownloadHTTPServer {
+  struct Response {
+    let status: Int
+    let retryAfter: String?
+    let body: Data
+    let advertisedLength: Int
+    static func http(status: Int, retryAfter: String? = nil) -> Response {
+      Response(status: status, retryAfter: retryAfter, body: Data(), advertisedLength: 0)
+    }
+    static let success = Response(status: 200, retryAfter: nil, body: Data([1, 2, 3]), advertisedLength: 3)
+    static let truncated = Response(status: 200, retryAfter: nil, body: Data([9, 9]), advertisedLength: 100)
+  }
+  private let listener: NWListener
+  private let responses: [Response]
+  private let lock = NSLock()
+  private var requests = 0
+  var requestCount: Int { lock.lock(); defer { lock.unlock() }; return requests }
+  init(responses: [Response]) throws {
+    self.responses = responses
+    let parameters = NWParameters.tcp
+    parameters.requiredLocalEndpoint = .hostPort(host: "127.0.0.1", port: .any)
+    listener = try NWListener(using: parameters)
+  }
+  func start() async throws -> URL {
+    try await withCheckedThrowingContinuation { continuation in
+      listener.stateUpdateHandler = { [weak self] state in
+        guard let self else { return }
+        switch state {
+        case .ready:
+          self.listener.stateUpdateHandler = nil
+          continuation.resume(returning: URL(string: "http://127.0.0.1:\(self.listener.port!.rawValue)/object")!)
+        case .failed(let error):
+          self.listener.stateUpdateHandler = nil
+          continuation.resume(throwing: error)
+        default: break
+        }
+      }
+      listener.newConnectionHandler = { [weak self] connection in
+        connection.start(queue: .global())
+        self?.receive(connection, previous: Data())
+      }
+      listener.start(queue: .global())
+    }
+  }
+  func stop() { listener.cancel() }
+  private func receive(_ connection: NWConnection, previous: Data) {
+    connection.receive(minimumIncompleteLength: 1, maximumLength: 65536) { [weak self] data, _, complete, error in
+      guard let self else { connection.cancel(); return }
+      var request = previous
+      if let data { request.append(data) }
+      guard request.range(of: Data("\r\n\r\n".utf8)) != nil else {
+        if complete || error != nil { connection.cancel() }
+        else { self.receive(connection, previous: request) }
+        return
+      }
+      self.lock.lock()
+      let response = self.responses[min(self.requests, self.responses.count - 1)]
+      self.requests += 1
+      self.lock.unlock()
+      var header = "HTTP/1.1 \(response.status) Test\r\nContent-Length: \(response.advertisedLength)\r\nConnection: close\r\nCache-Control: no-store\r\n"
+      if let retryAfter = response.retryAfter { header += "Retry-After: \(retryAfter)\r\n" }
+      var bytes = Data((header + "\r\n").utf8)
+      bytes.append(response.body)
+      connection.send(content: bytes, contentContext: .finalMessage, isComplete: true,
+        completion: .contentProcessed { _ in connection.cancel() })
+    }
+  }
+}