@protobase/mobile 0.45.1 → 0.45.3

package/android/build.gradle

@@ -13,6 +13,9 @@ buildscript {
 
 apply plugin: 'com.android.library'
 
+// The live updater's project, present only in an app that includes it (capacitor.settings.gradle lists every plugin).
+def liveUpdate = findProject(':capawesome-capacitor-live-update')
+
 android {
     namespace = "net.protobase.mobile"
     compileSdk = project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 36
@@ -31,6 +34,11 @@ android {
     lintOptions {
         abortOnError = false
     }
+    // GuardedLiveUpdate extends the live updater's plugin, so it compiles only beside it. Outside src/main, the Capacitor
+    // CLI never lists it on its own (@capacitor/cli android/update.js:63).
+    if (liveUpdate != null) {
+        sourceSets.main.java.srcDirs += 'src/liveupdate/java'
+    }
     compileOptions {
         sourceCompatibility JavaVersion.VERSION_21
         targetCompatibility JavaVersion.VERSION_21
@@ -44,4 +52,30 @@ repositories {
 
 dependencies {
     implementation project(':capacitor-android')
+    if (liveUpdate != null) {
+        implementation liveUpdate
+    }
+}
+
+// The plugin list the app loads must match what this build compiles, however the build was started (protobase mobile,
+// gradlew, Android Studio, after an `npx cap sync`): Capacitor loads no plugin at all when one listed class is missing
+// (PluginManager.java:25-36, BridgeActivity.java:36-40), which would drop every Protobase stand-in, and the stock live
+// updater listed hands page script all its methods. The CLI swaps the stock class for GuardedLiveUpdate from the same
+// list the source set above follows.
+def pluginList = rootProject.file('app/src/main/assets/capacitor.plugins.json')
+def checkPluginList = tasks.register('checkProtobasePluginList') {
+    inputs.file(pluginList)
+    def compilesGuard = liveUpdate != null
+    doLast {
+        def entries = new groovy.json.JsonSlurper().parse(pluginList)
+        entries.each { entry ->
+            if (entry.pkg == '@capawesome/capacitor-live-update' || entry.classpath == 'io.capawesome.capacitorjs.plugins.liveupdate.LiveUpdatePlugin') {
+                throw new GradleException("${pluginList} lists ${entry.classpath}, which hands page script the live updater unguarded: run protobase mobile again instead of cap sync")
+            }
+            if (entry.classpath == 'net.protobase.mobile.GuardedLiveUpdate' && !compilesGuard) {
+                throw new GradleException("${pluginList} lists ${entry.classpath}, which this app does not compile without the live updater: run protobase mobile again")
+            }
+        }
+    }
 }
+tasks.matching { it.name == 'preBuild' }.configureEach { dependsOn checkPluginList }

package/android/src/liveupdate/java/net/protobase/mobile/GuardedLiveUpdate.java

@@ -0,0 +1,304 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Logger;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginConfig;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import io.capawesome.capacitorjs.plugins.liveupdate.LiveUpdatePlugin;
+import java.lang.reflect.Method;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Iterator;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.json.JSONObject;
+
+/**
+ * Takes the stock LiveUpdate plugin's (8.7.1) place, so page script cannot steer the live updater. The CLI lists this
+ * class in capacitor.plugins.json instead of the stock one: listed beside it, two instances would each run their own
+ * rollback timer (LiveUpdate.java:147-171). Capacitor reaches only the methods a class's own overrides annotate
+ * (PluginHandle.java:145-157), so this subclass decides what page script reaches and keeps the stock lifecycle.
+ *
+ * - Every reachable method is declared here or by Capacitor's Plugin; load() refuses to load otherwise, so a plugin
+ *   upgrade that adds a method leaves no LiveUpdate at all rather than an open one.
+ * - The methods the shell needs that take no input clear what page script passed before the stock code reads it.
+ * - downloadBundle takes only a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`, over https
+ *   or loopback http, with `publicKey` pinned, so the stock code checks each file's signature (LiveUpdate.java:1633-1654)
+ *   and a caller's checksum and signature are dropped. A few per run of the app, so a loop cannot drain the data plan.
+ * - Ids are a single safe component naming a direct child of the bundles folder: the stock code joins them to its path
+ *   unchecked (LiveUpdate.java:665-667,1299-1302).
+ * - Everything else is refused: deleting, resetting, the vendor's cloud, config, channel and ids.
+ * - load() also refuses background updates, which sync with the vendor's cloud outside every method here
+ *   (LiveUpdate.java:420-433), and needs `autoDeleteBundles` and a `readyTimeout`, so ready() drops every bundle but the
+ *   current and next one and a bundle that never gets ready rolls back: page script cannot pin an older one.
+ *
+ * The config comes from capacitor.config.json, which ships in the binary outside the web part, beyond page script and
+ * a live update. This source set compiles only when the app has the plugin's Gradle project, which the CLI's swap and
+ * the build's plugin-list check take from the same list (@capacitor/cli android/update.js:20-36).
+ */
+@CapacitorPlugin(name = "LiveUpdate")
+public class GuardedLiveUpdate extends LiveUpdatePlugin {
+
+    private static final int MAX_DOWNLOADS = 3;
+    private static final AtomicInteger downloads = new AtomicInteger();
+
+    @Override
+    public void load() {
+        for (Method method : getClass().getMethods()) {
+            if (!method.isAnnotationPresent(PluginMethod.class)) continue;
+            Class<?> declaring = method.getDeclaringClass();
+            if (declaring == GuardedLiveUpdate.class || declaring == Plugin.class) continue;
+            refuseToLoad("LiveUpdate." + method.getName() + " has no guard in this Protobase app");
+        }
+        PluginConfig config = getConfig();
+        if (!"none".equals(config.getString("autoUpdateStrategy", "none"))) {
+            refuseToLoad("plugins.LiveUpdate.autoUpdateStrategy must be \"none\" in a Protobase app");
+        }
+        if (!config.getBoolean("autoDeleteBundles", false)) {
+            refuseToLoad("plugins.LiveUpdate.autoDeleteBundles must be true in a Protobase app");
+        }
+        if (config.getInt("readyTimeout", 0) <= 0) {
+            refuseToLoad("plugins.LiveUpdate.readyTimeout must be above 0 in a Protobase app");
+        }
+        super.load();
+    }
+
+    // Capacitor then leaves the plugin unregistered, logging only that it failed to load (PluginHandle.java:98-109), so
+    // the reason is logged here.
+    private static void refuseToLoad(String reason) {
+        Logger.error(reason);
+        throw new IllegalStateException(reason);
+    }
+
+    // Guarded
+
+    @Override
+    @PluginMethod
+    public void downloadBundle(PluginCall call) {
+        String releasesUrl = getConfig().getString("releasesUrl");
+        String publicKey = getConfig().getString("publicKey");
+        if (!ownSource(releasesUrl) || publicKey == null || publicKey.trim().isEmpty()) {
+            Refusal.rejectMethod(call, "LiveUpdate", "downloadBundle");
+            return;
+        }
+        String bundleId = call.getString("bundleId");
+        boolean allowed =
+            "manifest".equals(call.getString("artifactType")) &&
+            BundlesFolder.isBundleId(BundlesFolder.of(getContext()), bundleId) &&
+            (releasesUrl + "/" + bundleId).equals(call.getString("url"));
+        if (!allowed) {
+            Refusal.rejectMethod(call, "LiveUpdate", "downloadBundle");
+            return;
+        }
+        if (downloads.incrementAndGet() > MAX_DOWNLOADS) {
+            call.reject("LiveUpdate.downloadBundle was called too often in this run of the app");
+            return;
+        }
+        JSObject data = clear(call);
+        data.put("artifactType", "manifest");
+        data.put("bundleId", bundleId);
+        data.put("url", releasesUrl + "/" + bundleId);
+        super.downloadBundle(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void setNextBundle(PluginCall call) {
+        Object bundleId = call.getData().opt("bundleId");
+        if (bundleId == null || bundleId == JSONObject.NULL) {
+            // The stock code resets to the built-in bundle.
+            clear(call);
+            super.setNextBundle(call);
+            return;
+        }
+        if (!(bundleId instanceof String) || !BundlesFolder.isBundleId(BundlesFolder.of(getContext()), (String) bundleId)) {
+            Refusal.rejectMethod(call, "LiveUpdate", "setNextBundle");
+            return;
+        }
+        clear(call).put("bundleId", bundleId);
+        super.setNextBundle(call);
+    }
+
+    // Allowed: no input
+
+    @Override
+    @PluginMethod
+    public void ready(PluginCall call) {
+        clear(call);
+        super.ready(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void reload(PluginCall call) {
+        clear(call);
+        super.reload(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void getCurrentBundle(PluginCall call) {
+        clear(call);
+        super.getCurrentBundle(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void getNextBundle(PluginCall call) {
+        clear(call);
+        super.getNextBundle(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void getDownloadedBundles(PluginCall call) {
+        clear(call);
+        super.getDownloadedBundles(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void getVersionCode(PluginCall call) {
+        clear(call);
+        super.getVersionCode(call);
+    }
+
+    @Override
+    @PluginMethod
+    public void getVersionName(PluginCall call) {
+        clear(call);
+        super.getVersionName(call);
+    }
+
+    // Refused
+
+    @Override
+    @PluginMethod
+    public void clearBlockedBundles(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "clearBlockedBundles");
+    }
+
+    @Override
+    @PluginMethod
+    public void deleteBundle(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "deleteBundle");
+    }
+
+    @Override
+    @PluginMethod
+    public void fetchChannels(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "fetchChannels");
+    }
+
+    @Override
+    @PluginMethod
+    public void fetchLatestBundle(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "fetchLatestBundle");
+    }
+
+    @Override
+    @PluginMethod
+    public void getBlockedBundles(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getBlockedBundles");
+    }
+
+    @Override
+    @PluginMethod
+    public void getBundles(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getBundles");
+    }
+
+    @Override
+    @PluginMethod
+    public void getChannel(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getChannel");
+    }
+
+    @Override
+    @PluginMethod
+    public void getConfig(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getConfig");
+    }
+
+    @Override
+    @PluginMethod
+    public void getCustomId(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getCustomId");
+    }
+
+    @Override
+    @PluginMethod
+    public void getDeviceId(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "getDeviceId");
+    }
+
+    @Override
+    @PluginMethod
+    public void isSyncing(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "isSyncing");
+    }
+
+    @Override
+    @PluginMethod
+    public void reset(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "reset");
+    }
+
+    @Override
+    @PluginMethod
+    public void resetConfig(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "resetConfig");
+    }
+
+    @Override
+    @PluginMethod
+    public void setChannel(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "setChannel");
+    }
+
+    @Override
+    @PluginMethod
+    public void setConfig(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "setConfig");
+    }
+
+    @Override
+    @PluginMethod
+    public void setCustomId(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "setCustomId");
+    }
+
+    @Override
+    @PluginMethod
+    public void sync(PluginCall call) {
+        Refusal.rejectMethod(call, "LiveUpdate", "sync");
+    }
+
+    // https, or http to the device itself, where no one sits on the path; a bare origin and path only.
+    private static boolean ownSource(String releasesUrl) {
+        if (releasesUrl == null) return false;
+        URI uri;
+        try {
+            uri = new URI(releasesUrl);
+        } catch (URISyntaxException e) {
+            return false;
+        }
+        if (uri.getHost() == null || uri.getRawUserInfo() != null || uri.getRawQuery() != null || uri.getRawFragment() != null) return false;
+        if ("https".equals(uri.getScheme())) return true;
+        return "http".equals(uri.getScheme()) && Arrays.asList("localhost", "127.0.0.1", "[::1]").contains(uri.getHost());
+    }
+
+    // The live data the stock code reads (PluginCall.java:150-152), emptied: keys collected first, then removed.
+    private static JSObject clear(PluginCall call) {
+        JSObject data = call.getData();
+        List<String> keys = new ArrayList<>();
+        for (Iterator<String> it = data.keys(); it.hasNext(); ) keys.add(it.next());
+        for (String key : keys) data.remove(key);
+        return data;
+    }
+}

package/android/src/main/java/net/protobase/mobile/BundlesFolder.java

@@ -0,0 +1,46 @@
+package net.protobase.mobile;
+
+import android.content.Context;
+import java.io.File;
+import java.io.IOException;
+import java.util.regex.Pattern;
+
+/** The folder the live updater keeps its bundles in, a fixed name below the app's files (LiveUpdate.java:114). */
+final class BundlesFolder {
+
+    static final String NAME = "_capacitor_live_update_bundles";
+
+    // One path component: no separator, no `.` or `..`, no NUL.
+    private static final Pattern BUNDLE_ID = Pattern.compile("[A-Za-z0-9_-]{1,64}");
+
+    private BundlesFolder() {}
+
+    static File of(Context context) {
+        return new File(context.getFilesDir(), NAME);
+    }
+
+    // Compares whole path components of the canonical paths, so a sibling such as `<bundles>_x` is not inside. One
+    // that cannot be made canonical is refused.
+    static boolean contains(File root, File file) {
+        String canonical;
+        String rootPath;
+        try {
+            canonical = file.getCanonicalPath();
+            rootPath = root.getCanonicalPath();
+        } catch (IOException e) {
+            return false;
+        }
+        return canonical.equals(rootPath) || canonical.startsWith(rootPath + File.separator);
+    }
+
+    // An id that names a direct child of the folder once symlinks are resolved, so an entry linked elsewhere is refused.
+    static boolean isBundleId(File root, String id) {
+        if (id == null || !BUNDLE_ID.matcher(id).matches()) return false;
+        try {
+            File parent = new File(root, id).getCanonicalFile().getParentFile();
+            return parent != null && parent.getPath().equals(root.getCanonicalPath());
+        } catch (IOException e) {
+            return false;
+        }
+    }
+}

package/android/src/main/java/net/protobase/mobile/GuardedWebViewClient.java

@@ -7,7 +7,6 @@ import com.getcapacitor.Bridge;
 import com.getcapacitor.BridgeWebViewClient;
 import java.io.ByteArrayInputStream;
 import java.io.File;
-import java.io.IOException;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Objects;
@@ -50,21 +49,7 @@ final class GuardedWebViewClient extends BridgeWebViewClient {
         if (path.startsWith(Bridge.CAPACITOR_FILE_START) || path.startsWith(Bridge.CAPACITOR_CONTENT_START)) return true;
         if (Arrays.asList(path.split("/")).contains("..")) return true;
         if (basePath == null || !new File(basePath).isAbsolute()) return false;
-        return !inside(new File(basePath + path));
-    }
-
-    // Compares whole path components of the canonical paths, so a sibling such as `<bundles>_x` is not inside. One
-    // that cannot be made canonical is refused.
-    private boolean inside(File file) {
-        String canonical;
-        String root;
-        try {
-            canonical = file.getCanonicalPath();
-            root = bundles.getCanonicalPath();
-        } catch (IOException e) {
-            return false;
-        }
-        return canonical.equals(root) || canonical.startsWith(root + File.separator);
+        return !BundlesFolder.contains(bundles, new File(basePath + path));
     }
 
     private static WebResourceResponse forbidden() {

package/android/src/main/java/net/protobase/mobile/LocalServerGuard.java

@@ -2,7 +2,6 @@ package net.protobase.mobile;
 
 import com.getcapacitor.Plugin;
 import com.getcapacitor.annotation.CapacitorPlugin;
-import java.io.File;
 
 /**
  * Puts GuardedWebViewClient in front of the app's local server. It has no methods: it only acts when it loads, which
@@ -12,11 +11,8 @@ import java.io.File;
 @CapacitorPlugin(name = "ProtobaseLocalServerGuard")
 public class LocalServerGuard extends Plugin {
 
-    // The folder the live updater keeps its bundles in, a fixed name below the app's files (LiveUpdate.java:114).
-    private static final String LIVE_UPDATE_BUNDLES = "_capacitor_live_update_bundles";
-
     @Override
     public void load() {
-        getBridge().setWebViewClient(new GuardedWebViewClient(getBridge(), new File(getContext().getFilesDir(), LIVE_UPDATE_BUNDLES)));
+        getBridge().setWebViewClient(new GuardedWebViewClient(getBridge(), BundlesFolder.of(getContext())));
     }
 }

package/android/src/main/java/net/protobase/mobile/Refusal.java

@@ -10,4 +10,8 @@ final class Refusal {
     static void reject(PluginCall call, String plugin) {
         call.reject(plugin + " is not available to page script in a Protobase app");
     }
+
+    static void rejectMethod(PluginCall call, String plugin, String method) {
+        call.reject(plugin + "." + method + " is not available to page script in a Protobase app");
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.45.1",
+  "version": "0.45.3",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugin that keeps page script away from the session; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
@@ -16,9 +16,10 @@
   "files": [
     "LICENSE",
     "android/src/main/",
+    "android/src/liveupdate/",
     "android/build.gradle"
   ],
-  "nativeContract": 1,
+  "nativeContract": 2,
   "capacitor": {
     "android": {
       "src": "android"