@otakit/capacitor-updater 2.3.2 → 3.0.0

package/android/src/main/java/com/otakit/updater/DeltaAssembler.java

@@ -6,7 +6,6 @@ import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.InputStream;
-import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -37,9 +36,22 @@ final class DeltaAssembler {
   private final File cacheDirectory;
   private final boolean allowInsecureUrls;
 
+  interface Fetcher {
+    File download(URL url, Context context) throws Exception;
+  }
+
+  private final Fetcher fetcher;
+
   DeltaAssembler(File cacheDirectory, boolean allowInsecureUrls) {
+    this(cacheDirectory, allowInsecureUrls, (url, context) ->
+      FileDownloader.download(url, context.getCacheDir(), allowInsecureUrls)
+    );
+  }
+
+  DeltaAssembler(File cacheDirectory, boolean allowInsecureUrls, Fetcher fetcher) {
     this.cacheDirectory = cacheDirectory;
     this.allowInsecureUrls = allowInsecureUrls;
+    this.fetcher = fetcher;
   }
 
   // ── Canonical file list ─────────────────────────────────────────────
@@ -158,56 +170,42 @@ final class DeltaAssembler {
   private void ensureCached(ManifestClient.ManifestFileEntry entry, Context context)
     throws Exception {
     File cached = cachePath(entry.sha256);
-    if (cached.exists()) {
-      return;
-    }
+    if (validCached(entry)) return;
+    discardDamagedCache(cached);
 
     URL url = new URL(entry.url);
     ManifestClient.requireHTTPS(url, allowInsecureUrls);
 
-    File temporary = File.createTempFile("otakit-file-", ".tmp", context.getCacheDir());
+    File temporary = fetcher.download(url, context);
     try {
-      HttpURLConnection connection = (HttpURLConnection) url.openConnection();
-      try {
-        connection.setRequestMethod("GET");
-        connection.setConnectTimeout(15_000);
-        connection.setReadTimeout(60_000);
-
-        int status = connection.getResponseCode();
-        if (status < 200 || status >= 300) {
-          throw new IllegalStateException("File download failed with HTTP " + status);
-        }
-
-        try (
-          InputStream input = connection.getInputStream();
-          FileOutputStream output = new FileOutputStream(temporary)
-        ) {
-          byte[] buffer = new byte[8192];
-          int read;
-          while ((read = input.read(buffer)) > 0) {
-            output.write(buffer, 0, read);
-          }
-        }
-      } finally {
-        connection.disconnect();
-      }
-
-      if (!HashUtils.verify(temporary, entry.sha256)) {
-        throw new IllegalStateException("Downloaded file hash mismatch: " + entry.path);
-      }
+      HashUtils.verifyDownload(temporary, entry.sha256, entry.size, "file");
 
-      if (!cached.exists()) {
-        // Write via temp + rename so process death mid-copy can never leave
-        // a truncated file at a content-addressed path (exists() implies
-        // fully-written, hash-verified content).
-        atomicCopyIntoCache(temporary, cached);
-      }
+      if (validCached(entry)) return;
+      discardDamagedCache(cached);
+      atomicCopyIntoCache(temporary, cached);
+      HashUtils.verifyDownload(cached, entry.sha256, entry.size, "cached file");
     } finally {
       //noinspection ResultOfMethodCallIgnored
       temporary.delete();
     }
   }
 
+  private boolean validCached(ManifestClient.ManifestFileEntry entry) {
+    File file = cachePath(entry.sha256);
+    if (!file.isFile() || (entry.size >= 0 && file.length() != entry.size)) return false;
+    try {
+      return HashUtils.verify(file, entry.sha256);
+    } catch (Exception unreadable) {
+      return false;
+    }
+  }
+
+  private static void discardDamagedCache(File file) throws Exception {
+    if (file.exists() && !file.delete()) throw new java.io.IOException(
+      "Cannot remove damaged delta cache entry"
+    );
+  }
+
   // ── Assembly ────────────────────────────────────────────────────────
 
   /**
@@ -238,6 +236,8 @@ final class DeltaAssembler {
         throw new IllegalStateException("Cannot create parent: " + parent.getAbsolutePath());
       }
       copyFile(cachePath(entry.sha256), target);
+      // Recheck the installed copy if the cache changed while assembly was in progress.
+      HashUtils.verifyDownload(target, entry.sha256, entry.size, "assembled file");
     }
   }
 
@@ -372,8 +372,13 @@ final class DeltaAssembler {
 
   private void atomicCopyIntoCache(File source, File destination) throws Exception {
     File staging = new File(cacheDirectory, ".tmp-" + java.util.UUID.randomUUID());
-    copyFile(source, staging);
-    renameIntoCache(staging, destination);
+    try {
+      copyFile(source, staging);
+      renameIntoCache(staging, destination);
+    } finally {
+      //noinspection ResultOfMethodCallIgnored
+      staging.delete();
+    }
   }
 
   private static void renameIntoCache(File staging, File destination) throws Exception {

package/android/src/main/java/com/otakit/updater/DeviceEventClient.java

@@ -9,16 +9,96 @@ import java.util.Date;
 import java.util.Locale;
 import java.util.TimeZone;
 import java.util.UUID;
-import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
+import java.util.concurrent.TimeUnit;
 import org.json.JSONObject;
 
 final class DeviceEventClient {
 
-  private static final ExecutorService executor = Executors.newSingleThreadExecutor();
+  private static final ScheduledExecutorService executor =
+    Executors.newSingleThreadScheduledExecutor();
+  private static EventOutbox outbox;
+  private static ScheduledFuture<?> scheduled;
+  private static boolean sending;
 
   private DeviceEventClient() {}
 
+  static synchronized boolean hasPendingEvents() {
+    return outbox != null && outbox.waitMilliseconds(System.currentTimeMillis()) != null;
+  }
+
+  static synchronized void resume(java.io.File directory) {
+    try {
+      if (outbox == null) outbox = new EventOutbox(directory);
+      schedule();
+    } catch (Exception error) {
+      android.util.Log.w("OtaKit", "Cannot open device event outbox");
+    }
+  }
+
+  private static synchronized void schedule() {
+    if (sending || outbox == null) return;
+    if (scheduled != null) scheduled.cancel(false);
+    Long delay = outbox.waitMilliseconds(System.currentTimeMillis());
+    scheduled =
+      delay == null
+        ? null
+        : executor.schedule(DeviceEventClient::drain, delay, TimeUnit.MILLISECONDS);
+  }
+
+  private static void drain() {
+    synchronized (DeviceEventClient.class) {
+      if (sending) return;
+      sending = true;
+      if (scheduled != null) scheduled.cancel(false);
+      scheduled = null;
+    }
+    boolean storageFailed = false;
+    try {
+      EventOutbox.Entry entry = outbox.ready(System.currentTimeMillis());
+      if (entry == null) return;
+      int status = 0;
+      String retryAfter = null;
+      HttpURLConnection connection = null;
+      try {
+        connection = (HttpURLConnection) new URL(entry.url).openConnection();
+        connection.setRequestMethod("POST");
+        connection.setInstanceFollowRedirects(false);
+        connection.setRequestProperty("X-App-Id", entry.appId);
+        connection.setRequestProperty("Content-Type", "application/json");
+        connection.setConnectTimeout(10_000);
+        connection.setReadTimeout(10_000);
+        connection.setDoOutput(true);
+        try (OutputStream output = connection.getOutputStream()) {
+          output.write(entry.body.getBytes(StandardCharsets.UTF_8));
+        }
+        status = connection.getResponseCode();
+        retryAfter = connection.getHeaderField("Retry-After");
+      } catch (Exception ignored) {
+        // Retain the original ID and body after a lost response or offline failure.
+      } finally {
+        if (connection != null) connection.disconnect();
+      }
+      outbox.complete(entry.id, status, retryAfter, System.currentTimeMillis(), Math.random());
+    } catch (Exception error) {
+      storageFailed = true;
+      android.util.Log.w("OtaKit", "Cannot persist device event delivery state");
+    } finally {
+      synchronized (DeviceEventClient.class) {
+        sending = false;
+        // A broken disk must not create a zero-delay retry loop.
+        if (storageFailed) scheduled = executor.schedule(
+          DeviceEventClient::drain,
+          60,
+          TimeUnit.SECONDS
+        );
+        else schedule();
+      }
+    }
+  }
+
   static void send(
     String ingestUrl,
     String appId,
@@ -31,8 +111,39 @@ final class DeviceEventClient {
     String nativeBuild,
     String detail
   ) {
-    executor.execute(() -> {
-      HttpURLConnection connection = null;
+    send(
+      ingestUrl,
+      appId,
+      platform,
+      action,
+      bundleVersion,
+      channel,
+      runtimeVersion,
+      releaseId,
+      nativeBuild,
+      detail,
+      null,
+      null,
+      "unknown"
+    );
+  }
+
+  static void send(
+    String ingestUrl,
+    String appId,
+    String platform,
+    String action,
+    String bundleVersion,
+    String channel,
+    String runtimeVersion,
+    String releaseId,
+    String nativeBuild,
+    String detail,
+    String attemptId,
+    String phase,
+    String lifecycle
+  ) {
+    synchronized (DeviceEventClient.class) {
       try {
         String base = ingestUrl.replaceAll("/+$", "");
         URL url = new URL(base + "/events");
@@ -51,35 +162,23 @@ final class DeviceEventClient {
         }
         payload.put("releaseId", releaseId);
         payload.put("nativeBuild", nativeBuild);
+        payload.put("nativeSdkVersion", SDKVersion.VALUE);
+        payload.put("attemptId", attemptId);
+        payload.put("phase", phase);
+        payload.put("lifecycle", lifecycle);
         if (detail != null) {
           String truncated = detail.length() > 500 ? detail.substring(0, 500) : detail;
           payload.put("detail", truncated);
         }
 
-        byte[] body = payload.toString().getBytes(StandardCharsets.UTF_8);
-
-        connection = (HttpURLConnection) url.openConnection();
-        connection.setRequestMethod("POST");
-        connection.setRequestProperty("X-App-Id", appId);
-        connection.setRequestProperty("Content-Type", "application/json");
-        connection.setConnectTimeout(10_000);
-        connection.setReadTimeout(10_000);
-        connection.setDoOutput(true);
-
-        try (OutputStream output = connection.getOutputStream()) {
-          output.write(body);
-        }
-
-        // Device events are best-effort and should never block the update flow.
-        connection.getResponseCode();
+        if (outbox == null) throw new java.io.IOException("Outbox unavailable");
+        outbox.enqueue(url.toString(), appId, payload.toString(), System.currentTimeMillis());
+        schedule();
       } catch (Exception ignored) {
-        // Device events are best-effort, don't fail on errors
-      } finally {
-        if (connection != null) {
-          connection.disconnect();
-        }
+        // Persistence failure must not fail or roll back the update itself.
+        android.util.Log.w("OtaKit", "Cannot persist device event");
       }
-    });
+    }
   }
 
   private static String iso8601Now() {

package/android/src/main/java/com/otakit/updater/DocumentReadyBridge.java

@@ -0,0 +1,71 @@
+package com.otakit.updater;
+
+import android.net.Uri;
+import android.webkit.WebView;
+import androidx.webkit.ScriptHandler;
+import androidx.webkit.WebViewCompat;
+import androidx.webkit.WebViewFeature;
+import java.util.Collections;
+import org.json.JSONObject;
+
+/** Captures the activation in the document's bridge before application JavaScript runs. */
+final class DocumentReadyBridge {
+
+  private ScriptHandler script;
+
+  static void requireSupported() {
+    if (!WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)) {
+      throw new IllegalStateException(
+        "Update Android System WebView before applying OtaKit updates: document-start scripts are unavailable"
+      );
+    }
+  }
+
+  private static String origin(String appUrl) {
+    return Uri.parse(appUrl).buildUpon().path(null).fragment(null).clearQuery().build().toString();
+  }
+
+  static void preflight(WebView webView, String appUrl) {
+    requireSupported();
+    // Validate this WebView and origin before publishing a trial in persistent state.
+    WebViewCompat.addDocumentStartJavaScript(
+      webView,
+      "",
+      Collections.singleton(origin(appUrl))
+    ).remove();
+  }
+
+  static String source(String activationId) {
+    return String.format(
+      java.util.Locale.ROOT,
+      """
+      (() => {
+        if (window !== window.top) return;
+        const cap = window.Capacitor;
+        if (!cap || typeof cap.toNative !== 'function') return;
+        const original = cap.toNative;
+        const activationId = %s;
+        cap.toNative = function(plugin, method, options, callback) {
+          if (plugin === 'OtaKit' && method === 'notifyAppReady') {
+            options = Object.assign({}, options, { _otakitActivationId: activationId });
+          }
+          return original.call(this, plugin, method, options, callback);
+        };
+      })();
+      """,
+      JSONObject.quote(activationId)
+    );
+  }
+
+  void install(WebView webView, String appUrl, String activationId) {
+    requireSupported();
+    // Register before removing the old script so registration failure preserves it.
+    ScriptHandler replacement = WebViewCompat.addDocumentStartJavaScript(
+      webView,
+      source(activationId),
+      Collections.singleton(origin(appUrl))
+    );
+    if (script != null) script.remove();
+    script = replacement;
+  }
+}

package/android/src/main/java/com/otakit/updater/DownloadRetry.java

@@ -0,0 +1,144 @@
+package com.otakit.updater;
+
+import java.io.IOException;
+import java.text.ParsePosition;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Locale;
+import java.util.TimeZone;
+import java.util.concurrent.Callable;
+import java.util.function.DoubleSupplier;
+import java.util.function.LongSupplier;
+import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.SSLPeerUnverifiedException;
+
+/** Bounded retries for GET transport failures. Integrity and disk failures stay terminal. */
+final class DownloadRetry {
+
+  static boolean isExpiredUrlFailure(Exception error) {
+    if (!(error instanceof HttpFailure)) return false;
+    int status = ((HttpFailure) error).status;
+    return status == 403 || status == 410;
+  }
+
+  interface Sleeper {
+    void sleep(long milliseconds) throws InterruptedException;
+  }
+
+  static final class HttpFailure extends IOException {
+
+    final int status;
+    final String retryAfter;
+
+    HttpFailure(int status, String retryAfter) {
+      super("Download failed with HTTP " + status);
+      this.status = status;
+      this.retryAfter = retryAfter;
+    }
+  }
+
+  static final class NetworkFailure extends IOException {
+
+    NetworkFailure(IOException cause) {
+      super("Download connection failed (" + cause.getClass().getSimpleName() + ")", cause);
+    }
+
+    @Override
+    public String getMessage() {
+      // Only locally constructed EOF diagnostics are safe to include; arbitrary network messages may contain URLs.
+      String detail = getCause() instanceof java.io.EOFException ? getCause().getMessage() : null;
+      return (
+        super.getMessage() +
+        (detail != null && detail.startsWith("body length mismatch;") ? "; " + detail : "")
+      );
+    }
+  }
+
+  private final Sleeper sleeper;
+  private final DoubleSupplier random;
+  private final LongSupplier now;
+
+  DownloadRetry() {
+    this(Thread::sleep, Math::random, System::currentTimeMillis);
+  }
+
+  DownloadRetry(Sleeper sleeper, DoubleSupplier random, LongSupplier now) {
+    this.sleeper = sleeper;
+    this.random = random;
+    this.now = now;
+  }
+
+  <T> T run(Callable<T> operation) throws Exception {
+    for (int attempt = 1; ; attempt++) {
+      if (
+        Thread.currentThread().isInterrupted()
+      ) throw new java.util.concurrent.CancellationException("Download cancelled");
+      try {
+        return operation.call();
+      } catch (Exception failure) {
+        Long delay = delay(failure, attempt);
+        if (delay == null) throw failure;
+        try {
+          sleeper.sleep(delay);
+        } catch (InterruptedException interrupted) {
+          Thread.currentThread().interrupt();
+          throw new java.util.concurrent.CancellationException("Download cancelled");
+        }
+      }
+    }
+  }
+
+  Long delay(Exception failure, int attempt) {
+    if (attempt >= 3 || attempt < 1 || Thread.currentThread().isInterrupted()) return null;
+    Long retryAfterMs = null;
+    if (failure instanceof HttpFailure) {
+      HttpFailure http = (HttpFailure) failure;
+      if (
+        !(http.status == 408 ||
+          http.status == 425 ||
+          http.status == 429 ||
+          http.status == 500 ||
+          http.status == 502 ||
+          http.status == 503 ||
+          http.status == 504)
+      ) return null;
+      retryAfterMs = retryAfterMilliseconds(http.retryAfter, now.getAsLong());
+      // Do not sleep indefinitely or retry earlier than a long server-requested delay.
+      if (retryAfterMs != null && retryAfterMs > 30_000) return null;
+    } else if (!(failure instanceof NetworkFailure)) {
+      return null;
+    }
+    long backoff = (long) (1000L * (1L << (attempt - 1)) * (0.5 + random.getAsDouble()));
+    return retryAfterMs == null ? backoff : Math.max(backoff, retryAfterMs);
+  }
+
+  static Long retryAfterMilliseconds(String value, long now) {
+    if (value == null) return null;
+    String trimmed = value.trim();
+    if (trimmed.matches("[0-9]+")) {
+      try {
+        return Math.multiplyExact(Long.parseLong(trimmed), 1000L);
+      } catch (ArithmeticException | NumberFormatException error) {
+        return Long.MAX_VALUE;
+      }
+    }
+    SimpleDateFormat format = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US);
+    format.setTimeZone(TimeZone.getTimeZone("GMT"));
+    format.setLenient(false);
+    ParsePosition position = new ParsePosition(0);
+    Date date = format.parse(trimmed, position);
+    return date != null && position.getIndex() == trimmed.length()
+      ? Math.max(0, date.getTime() - now)
+      : null;
+  }
+
+  static <T> T network(Callable<T> operation) throws Exception {
+    try {
+      return operation.call();
+    } catch (SSLHandshakeException | SSLPeerUnverifiedException failure) {
+      throw failure;
+    } catch (IOException failure) {
+      throw new NetworkFailure(failure);
+    }
+  }
+}