@protobase/mobile 0.57.0 → 0.57.2

package/ios/Sources/ProtobaseMobile/BundlesFolder.swift

@@ -0,0 +1,26 @@
+import Foundation
+
+/**
+ * Where the live updater unzips bundles (capacitor-live-update's LiveUpdate.swift) and Capacitor serves a persisted
+ * server base path from (CAPBridgeViewController.swift).
+ */
+enum BundlesFolder {
+    static var path: String { NSHomeDirectory() + "/Library/NoCloud/ionic_built_snapshots" }
+
+    // One path component: no separator, no `.` or `..`, no NUL, ASCII only.
+    private static let bundleId = try! NSRegularExpression(pattern: "^[A-Za-z0-9_-]{1,64}$")
+
+    static func isBundleIdShape(_ id: String) -> Bool {
+        bundleId.firstMatch(in: id, range: NSRange(id.startIndex..., in: id)) != nil
+    }
+
+    /**
+     * An id that names an existing direct child of `root` once symlinks are resolved, by its exact name on disk: the stock
+     * code joins ids to the folder unchecked, and the volume ignores case, so `ABC` would open `abc`.
+     */
+    static func isBundleId(_ id: String, in root: String = path) -> Bool {
+        guard isBundleIdShape(id), let rootPath = realPath(root), let resolved = realPath(root + "/" + id) else { return false }
+        let url = URL(fileURLWithPath: resolved)
+        return url.deletingLastPathComponent().path == rootPath && url.lastPathComponent == id
+    }
+}

package/ios/Sources/ProtobaseMobile/GuardedLiveUpdatePlugin.swift

@@ -0,0 +1,95 @@
+import Capacitor
+
+/**
+ * Takes the stock live updater's (8.7.1) place, so page script cannot steer it. The stock class is `public`, not
+ * `open`, so it cannot be subclassed here; the CLI lists this class instead of it in capacitor.config.json, and this
+ * plugin holds the stock one unregistered (StockLiveUpdate). Capacitor dispatches only the methods a plugin's own
+ * `pluginMethods` names (CapacitorBridge.swift, handleJSCall), so this list, every stock method, decides what page
+ * script reaches; page script's input never reaches the stock code, which gets a new call with what the guard built.
+ *
+ * - The methods the shell needs that take no input get none.
+ * - downloadBundle: see LiveUpdateDownload and DownloadBudget.
+ * - setNextBundle takes null, which resets to the built-in bundle, or an id naming a bundle (BundlesFolder.isBundleId):
+ *   the stock code joins ids to its path unchecked (LiveUpdate.swift, buildBundleURLFor).
+ * - Everything else is refused, and so is every method when load() refuses to load (LiveUpdateLoadCheck): the stock
+ *   plugin then never loads.
+ */
+@objc(GuardedLiveUpdatePlugin)
+public class GuardedLiveUpdatePlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "GuardedLiveUpdatePlugin"
+    public let jsName = "LiveUpdate"
+    public let pluginMethods = LiveUpdateMethods.declared.map { CAPPluginMethod(name: $0, returnType: CAPPluginReturnPromise)! }
+
+    private var stock: StockLiveUpdate?
+    private var settings: LiveUpdateSettings?
+
+    override public func load() {
+        start(LiveUpdateSettings(getConfig()), StockLiveUpdate.make())
+    }
+
+    func start(_ settings: LiveUpdateSettings, _ stock: StockLiveUpdate?) {
+        if let reason = LiveUpdateLoadCheck.refusal(settings, stockMethods: stock?.methodNames, stockResponds: { stock?.responds(to: $0) ?? false }) {
+            CAPLog.print("⚡️ ", reason)
+            return
+        }
+        guard let stock else { return }
+        stock.load(guardedBy: self)
+        self.settings = settings
+        self.stock = stock
+    }
+
+    private func refuse(_ call: CAPPluginCall) {
+        Refusal.reject(call, plugin: jsName)
+    }
+
+    private func forwardCleared(_ call: CAPPluginCall) {
+        guard let stock else { return refuse(call) }
+        stock.forward(call, call.methodName, options: [:])
+    }
+
+    // Checked
+
+    @objc func downloadBundle(_ call: CAPPluginCall) {
+        guard let stock, let settings, let options = LiveUpdateDownload.options(call.options, settings) else { return refuse(call) }
+        guard DownloadBudget.shared.take() else { return call.reject("LiveUpdate.downloadBundle was called too often in this run of the app") }
+        stock.forward(call, "downloadBundle", options: options)
+    }
+
+    @objc func setNextBundle(_ call: CAPPluginCall) {
+        guard let stock else { return refuse(call) }
+        let bundleId = call.options["bundleId"]
+        if bundleId == nil || bundleId is NSNull { return stock.forward(call, "setNextBundle", options: [:]) }
+        guard let bundleId = bundleId as? String, BundlesFolder.isBundleId(bundleId) else { return refuse(call) }
+        stock.forward(call, "setNextBundle", options: ["bundleId": bundleId])
+    }
+
+    // Cleared
+
+    @objc func ready(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func reload(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getCurrentBundle(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getNextBundle(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getDownloadedBundles(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getVersionCode(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getVersionName(_ call: CAPPluginCall) { forwardCleared(call) }
+
+    // Refused
+
+    @objc func clearBlockedBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func deleteBundle(_ call: CAPPluginCall) { refuse(call) }
+    @objc func fetchChannels(_ call: CAPPluginCall) { refuse(call) }
+    @objc func fetchLatestBundle(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getBlockedBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getChannel(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getCustomId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getDeviceId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func isSyncing(_ call: CAPPluginCall) { refuse(call) }
+    @objc func reset(_ call: CAPPluginCall) { refuse(call) }
+    @objc func resetConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setChannel(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setCustomId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func sync(_ call: CAPPluginCall) { refuse(call) }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateDownload.swift

@@ -0,0 +1,39 @@
+import Foundation
+
+/**
+ * What page script may download: a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`, with
+ * `publicKey` pinned, so the stock code checks the manifest and each file against it with the response's signature
+ * (LiveUpdate.swift, downloadAndVerifyFile and verifyFile). A caller's checksum and signature are dropped.
+ */
+enum LiveUpdateDownload {
+    /** The options the stock code downloads with, or nil when the call is refused. */
+    static func options(_ call: [AnyHashable: Any], _ settings: LiveUpdateSettings) -> [String: Any]? {
+        guard let releasesUrl = settings.releasesUrl, ReleasesUrl.isOwnSource(releasesUrl) else { return nil }
+        guard let publicKey = settings.publicKey, !publicKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else { return nil }
+        guard call["artifactType"] as? String == "manifest", let bundleId = call["bundleId"] as? String else { return nil }
+        let url = releasesUrl + "/" + bundleId
+        guard BundlesFolder.isBundleIdShape(bundleId), call["url"] as? String == url else { return nil }
+        return ["artifactType": "manifest", "bundleId": bundleId, "url": url]
+    }
+}
+
+/** A few downloads per run of the app, so a loop cannot drain the data plan; a reload of the page keeps the count. */
+final class DownloadBudget {
+    static let shared = DownloadBudget(limit: 3)
+
+    private let lock = NSLock()
+    private let limit: Int
+    private var used = 0
+
+    init(limit: Int) {
+        self.limit = limit
+    }
+
+    func take() -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        if used >= limit { return false }
+        used += 1
+        return true
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateLoadCheck.swift

@@ -0,0 +1,21 @@
+/**
+ * Why the guard refuses to load the live updater, or nil. A stock method the guard does not declare means a plugin
+ * upgrade added one: no live updater then rather than an open one. Background updates sync with the vendor's cloud
+ * outside every method (LiveUpdate.swift, handleLoad); `autoDeleteBundles` and a `readyTimeout` make ready() drop every
+ * bundle but the current and next one and roll back a bundle that never gets ready, so page script cannot pin an older one.
+ */
+enum LiveUpdateLoadCheck {
+    static func refusal(_ settings: LiveUpdateSettings, stockMethods: [String]?, stockResponds: (String) -> Bool) -> String? {
+        guard let stockMethods else { return "LiveUpdate has no stock LiveUpdatePlugin in this Protobase app" }
+        if let unguarded = stockMethods.first(where: { !LiveUpdateMethods.declared.contains($0) }) {
+            return "LiveUpdate.\(unguarded) has no guard in this Protobase app"
+        }
+        if let missing = LiveUpdateMethods.forwarded.first(where: { !stockResponds($0) }) {
+            return "LiveUpdate.\(missing) is missing from the stock LiveUpdatePlugin"
+        }
+        if settings.autoUpdateStrategy != "none" { return "plugins.LiveUpdate.autoUpdateStrategy must be \"none\" in a Protobase app" }
+        if !settings.autoDeleteBundles { return "plugins.LiveUpdate.autoDeleteBundles must be true in a Protobase app" }
+        if settings.readyTimeout <= 0 { return "plugins.LiveUpdate.readyTimeout must be above 0 in a Protobase app" }
+        return nil
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateMethods.swift

@@ -0,0 +1,15 @@
+/** The stock live updater's (8.7.1) methods, by what page script may do with them. */
+enum LiveUpdateMethods {
+    /** Forwarded with their input cleared. */
+    static let cleared = ["ready", "reload", "getCurrentBundle", "getNextBundle", "getDownloadedBundles", "getVersionCode", "getVersionName"]
+    /** Forwarded with only the input the guard checked and built. */
+    static let checked = ["downloadBundle", "setNextBundle"]
+    /** Never forwarded: deleting, resetting, the vendor's cloud, config, channel and ids. */
+    static let refused = [
+        "clearBlockedBundles", "deleteBundle", "fetchChannels", "fetchLatestBundle", "getBlockedBundles", "getBundles", "getChannel",
+        "getConfig", "getCustomId", "getDeviceId", "isSyncing", "reset", "resetConfig", "setChannel", "setConfig", "setCustomId", "sync",
+    ]
+
+    static var forwarded: [String] { cleared + checked }
+    static var declared: [String] { forwarded + refused }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateSettings.swift

@@ -0,0 +1,25 @@
+import Capacitor
+
+/**
+ * The live updater's `plugins.LiveUpdate` settings the guard checks, read with the stock plugin's own keys and defaults
+ * (capacitor-live-update's LiveUpdatePlugin.swift, liveUpdateConfig), plus Protobase's `releasesUrl`. They come from
+ * capacitor.config.json, which ships in the binary outside the web part, beyond page script and a live update.
+ */
+struct LiveUpdateSettings {
+    var autoUpdateStrategy: String?
+    var autoDeleteBundles: Bool
+    var readyTimeout: Int
+    var releasesUrl: String?
+    var publicKey: String?
+}
+
+extension LiveUpdateSettings {
+    init(_ config: PluginConfig) {
+        self.init(
+            autoUpdateStrategy: config.getString("autoUpdateStrategy", "none"),
+            autoDeleteBundles: config.getBoolean("autoDeleteBundles", false),
+            readyTimeout: config.getInt("readyTimeout", 0),
+            releasesUrl: config.getString("releasesUrl"),
+            publicKey: config.getString("publicKey"))
+    }
+}

package/ios/Sources/ProtobaseMobile/LocalFileGuard.swift

@@ -7,9 +7,6 @@ import Foundation
  * live updater's bundles folder. Each check runs on the decoded path, the one the asset handler opens.
  */
 final class LocalFileGuard {
-    // Where the live updater unzips bundles (capacitor-live-update's LiveUpdate.swift) and Capacitor serves a persisted
-    // server base path from (CAPBridgeViewController.swift).
-    private static let bundlesFolder = "Library/NoCloud/ionic_built_snapshots"
     private static let refusedPrefixes = [
         CapacitorBridge.fileStartIdentifier,
         CapacitorBridge.httpInterceptorStartIdentifier,
@@ -18,14 +15,15 @@ final class LocalFileGuard {
 
     private let lock = NSLock()
     private let appBundle: String?
-    // Resolved once: with no bundles folder at launch, nothing outside the app bundle is served.
-    private let bundles: String?
+    // Resolved once it exists, under the lock: a fresh install has none until its first download, which the app then
+    // loads in the same run. Until then nothing outside the app bundle is served.
+    private var bundles: String?
     var basePath: String
 
     init(basePath: String) {
         self.basePath = basePath
-        appBundle = Self.realPath(Bundle.main.bundlePath)
-        bundles = Self.realPath(NSHomeDirectory() + "/" + Self.bundlesFolder)
+        appBundle = realPath(Bundle.main.bundlePath)
+        bundles = realPath(BundlesFolder.path)
     }
 
     func withLock<T>(_ body: () throws -> T) rethrows -> T {
@@ -37,23 +35,18 @@ final class LocalFileGuard {
     func refuses(path: String) -> Bool {
         if Self.refusedPrefixes.contains(where: { path.hasPrefix($0) }) { return true }
         if path.contains("\0") || path.split(separator: "/", omittingEmptySubsequences: false).contains("..") { return true }
-        guard let base = Self.realPath(basePath) else { return true }
+        guard let base = realPath(basePath) else { return true }
         if let appBundle, Self.isInside(base, appBundle) { return false }
+        if bundles == nil { bundles = realPath(BundlesFolder.path) }
         guard let bundles else { return true }
         // The file the asset handler opens, by Capacitor's own routing.
         var router = CapacitorRouter()
         router.basePath = basePath
-        guard let file = Self.realPath(router.route(for: path)) else { return true }
+        guard let file = realPath(router.route(for: path)) else { return true }
         return !Self.isInside(file, bundles)
     }
 
     private static func isInside(_ path: String, _ folder: String) -> Bool {
         path == folder || path.hasPrefix(folder.hasSuffix("/") ? folder : folder + "/")
     }
-
-    private static func realPath(_ path: String) -> String? {
-        guard let resolved = realpath(path, nil) else { return nil }
-        defer { free(resolved) }
-        return String(cString: resolved)
-    }
 }

package/ios/Sources/ProtobaseMobile/PageScriptFilter.swift

@@ -5,7 +5,9 @@ import WebKit
  * Stands in front of Capacitor's `bridge` script message handler, the way page script calls native code. It drops
  * messages from any frame but the main one of the app's own origin, as Capacitor Android's MessageHandler does, and
  * refuses `CapacitorHttp`, `CapacitorCookies` and `WebView`, which hand over or plant the session, and any plugin id
- * the bridge has not loaded: Capacitor would otherwise load a plugin by class name, such as `CAPHttpPlugin`.
+ * the bridge has not loaded: Capacitor would otherwise load a plugin by class name, such as `CAPHttpPlugin` or the stock
+ * `LiveUpdatePlugin`. `LiveUpdate` passes only when GuardedLiveUpdatePlugin holds the name: an `npx cap sync` lists the
+ * stock class again, which then registers under it beside or instead of the guard.
  */
 final class PageScriptFilter: NSObject, WKScriptMessageHandler {
     private static let handlerName = "bridge"
@@ -32,7 +34,7 @@ final class PageScriptFilter: NSObject, WKScriptMessageHandler {
         }
         guard type == "message" else { return }
         let pluginId = body["pluginId"] as? String ?? ""
-        if !Self.refusedPlugins.contains(pluginId), bridge.plugin(withName: pluginId) != nil {
+        if !Self.refusedPlugins.contains(pluginId), let plugin = bridge.plugin(withName: pluginId), pluginId != "LiveUpdate" || plugin is GuardedLiveUpdatePlugin {
             bridge.webViewDelegationHandler.userContentController(userContentController, didReceive: message)
             return
         }
@@ -47,7 +49,7 @@ final class PageScriptFilter: NSObject, WKScriptMessageHandler {
             "pluginId": pluginId,
             "methodName": body["methodName"] as? String ?? "",
             "success": false,
-            "error": ["message": "\(pluginId) is not available to page script in a Protobase app"],
+            "error": ["message": Refusal.message(pluginId)],
         ]
         guard let json = try? JSONSerialization.data(withJSONObject: answer), let text = String(data: json, encoding: .utf8) else { return }
         webView?.evaluateJavaScript("window.Capacitor.fromNative(\(text))")

package/ios/Sources/ProtobaseMobile/RealPath.swift

@@ -0,0 +1,8 @@
+import Foundation
+
+/** A path with its symlinks, `.` and `..` resolved and each component in its case on disk, or nil when it does not exist. */
+func realPath(_ path: String) -> String? {
+    guard let resolved = realpath(path, nil) else { return nil }
+    defer { free(resolved) }
+    return String(cString: resolved)
+}

package/ios/Sources/ProtobaseMobile/Refusal.swift

@@ -0,0 +1,12 @@
+import Capacitor
+
+/** How Protobase answers page script that calls a plugin or method it may not reach. */
+enum Refusal {
+    static func message(_ name: String) -> String {
+        "\(name) is not available to page script in a Protobase app"
+    }
+
+    static func reject(_ call: CAPPluginCall, plugin: String) {
+        call.reject(message("\(plugin).\(call.methodName ?? "")"))
+    }
+}

package/ios/Sources/ProtobaseMobile/ReleasesUrl.swift

@@ -0,0 +1,13 @@
+import Foundation
+
+/** The app's own releases URL: https, or http to the device itself, where no one sits on the path; a bare origin and path. */
+enum ReleasesUrl {
+    private static let loopbackHosts: Set<String> = ["localhost", "127.0.0.1", "::1", "[::1]"]
+
+    static func isOwnSource(_ text: String?) -> Bool {
+        guard let text, let parts = URLComponents(string: text), let host = parts.host, !host.isEmpty else { return false }
+        if parts.user != nil || parts.password != nil || parts.query != nil || parts.fragment != nil { return false }
+        if parts.scheme == "https" { return true }
+        return parts.scheme == "http" && loopbackHosts.contains(host)
+    }
+}

package/ios/Sources/ProtobaseMobile/StockLiveUpdate.swift

@@ -0,0 +1,58 @@
+import Capacitor
+
+/**
+ * The stock live updater's plugin, held by the guard and never registered with the bridge, so page script reaches it by
+ * no name: Capacitor dispatches only to registered plugins, and PageScriptFilter refuses a plugin id the bridge has not
+ * registered before Capacitor could load it by class name. Looked up by its `@objc` name, so Protobase's package builds
+ * without the live updater's.
+ */
+final class StockLiveUpdate {
+    private static let className = "LiveUpdatePlugin"
+
+    let plugin: CAPPlugin & CAPBridgedPlugin
+
+    init(plugin: CAPPlugin & CAPBridgedPlugin) {
+        self.plugin = plugin
+    }
+
+    /** The stock plugin, not loaded yet, or nil when the app does not include it. */
+    static func make() -> StockLiveUpdate? {
+        guard let type = NSClassFromString(className) as? CAPPlugin.Type, let plugin = type.init() as? CAPPlugin & CAPBridgedPlugin else { return nil }
+        return StockLiveUpdate(plugin: plugin)
+    }
+
+    var methodNames: [String] {
+        plugin.pluginMethods.map(\.name)
+    }
+
+    func responds(to method: String) -> Bool {
+        plugin.responds(to: Self.selector(method))
+    }
+
+    /**
+     * Loads it as the bridge would (Capacitor's CAPPlugin+LoadInstance.swift), on `guarding`'s bridge, config and
+     * listeners, so its events reach the listeners page script added to the guard.
+     */
+    func load(guardedBy guarding: CAPPlugin & CAPBridgedPlugin) {
+        plugin.bridge = guarding.bridge
+        plugin.webView = guarding.webView
+        plugin.shouldStringifyDatesInCalls = true
+        plugin.eventListeners = guarding.eventListeners
+        plugin.retainedEventArguments = guarding.retainedEventArguments
+        plugin.pluginId = plugin.identifier
+        plugin.pluginName = guarding.pluginName
+        plugin.load()
+    }
+
+    /** Runs `method` as Capacitor would (CapacitorBridge.swift, handleJSCall), on a new call that holds only `options`. */
+    func forward(_ call: CAPPluginCall, _ method: String, options: [String: Any]) {
+        guard let forwarded = CAPPluginCall(callbackId: call.callbackId, methodName: method, options: options, success: call.successHandler, error: call.errorHandler) else {
+            fatalError("Capacitor made no plugin call")
+        }
+        plugin.perform(Self.selector(method), with: forwarded)
+    }
+
+    private static func selector(_ method: String) -> Selector {
+        NSSelectorFromString(method + ":")
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.57.0",
+  "version": "0.57.2",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugins that keep page script away from the session and give the iOS app its bounce; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,7 @@
     "android/build.gradle",
     "icon"
   ],
-  "nativeContract": 3,
+  "nativeContract": 5,
   "capacitor": {
     "ios": {
       "src": "ios"