@protobase/mobile 0.57.3 → 0.57.4

package/android/src/liveupdate/java/net/protobase/mobile/BlockedBundles.java

@@ -0,0 +1,30 @@
+package net.protobase.mobile;
+
+import java.util.Arrays;
+import java.util.regex.Pattern;
+
+/**
+ * The bundles the stock plugin blocked after rolling them back (`autoBlockRolledBackBundles`): ready() adds the id
+ * of a bundle that never got ready (LiveUpdate.java:460-462 of @capawesome/capacitor-live-update 8.7.1) to a comma
+ * separated list in its preferences (LiveUpdatePreferences.java:19, LiveUpdate.java:1510-1537). The stock code reads it
+ * only in sync(), which the guard refuses, so the guard reads it itself.
+ */
+final class BlockedBundles {
+
+    /** The stock plugin's key, which its source marks "DO NOT CHANGE". */
+    static final String KEY = "blockedBundleIds";
+
+    // The ids the guard lets reach the stock code are bundle ids (BundlesFolder), so a list holding anything else is
+    // one the guard cannot read, as after a plugin upgrade that changed its format.
+    private static final Pattern ID = Pattern.compile("[A-Za-z0-9_-]{1,64}");
+
+    private BlockedBundles() {}
+
+    /** Whether `list`, the stock plugin's, blocks `bundleId`; any id when the list cannot be read, so it fails closed. */
+    static boolean blocks(String list, String bundleId) {
+        if (list == null || list.isEmpty()) return false;
+        String[] ids = list.split(",", -1);
+        for (String id : ids) if (!ID.matcher(id).matches()) return true;
+        return Arrays.asList(ids).contains(bundleId);
+    }
+}

package/android/src/liveupdate/java/net/protobase/mobile/GuardedLiveUpdate.java

@@ -1,8 +1,10 @@
 package net.protobase.mobile;
 
 import android.app.Activity;
+import android.content.res.AssetManager;
 import android.content.SharedPreferences;
 import android.util.Base64;
+import com.getcapacitor.Bridge;
 import com.getcapacitor.JSObject;
 import com.getcapacitor.Logger;
 import com.getcapacitor.Plugin;
@@ -12,7 +14,9 @@ import com.getcapacitor.PluginMethod;
 import com.getcapacitor.annotation.CapacitorPlugin;
 import io.capawesome.capacitorjs.plugins.liveupdate.LiveUpdatePlugin;
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStream;
 import java.lang.reflect.Method;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -23,13 +27,14 @@ import java.security.interfaces.RSAPublicKey;
 import java.security.spec.X509EncodedKeySpec;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.atomic.AtomicInteger;
-import org.json.JSONObject;
 
 /**
  * Takes the stock LiveUpdate plugin's (8.7.1) place, so page script cannot steer the live updater. The CLI lists this
@@ -44,16 +49,21 @@ import org.json.JSONObject;
  *   or loopback http, and downloads it itself (ReleaseDownload), bound by the release's statement to the id, the pinned
  *   `publicKey`, this binary and its order; a caller's checksum and signature are dropped. A few per run of the app, so
  *   a loop cannot drain the data plan.
+ * - Both take a release only above the order of the binary's own files, `builtInOrder`, which the CLI computes as the
+ *   server computes a release's, so a reinstalled app cannot be taken below its own files; and neither takes a bundle
+ *   the stock code blocked after rolling it back (BlockedBundles), which it checks only in the refused sync().
  * - setNextBundle checks the bundle on disk (BundleCheck), then takes it only above the running bundle's order and not
  *   below the highest the app downloaded; a refused bundle that is neither running nor next is deleted, as the stock
- *   code deletes an unused one (LiveUpdate.java:803-810). It is the only way to a downloaded bundle: reset, sync and the
- *   rest are refused, reload only runs the next bundle and a rollback goes to the built-in one (LiveUpdate.java:1411).
+ *   code deletes an unused one (LiveUpdate.java:803-810). It is the only way to a downloaded bundle: reset, sync, a
+ *   next bundle of null (the built-in one) and the rest are refused, reload only runs the next bundle and a rollback
+ *   goes to the built-in one inside the stock code (LiveUpdate.java:1411).
  * - Ids are a single safe component naming a direct child of the bundles folder: the stock code joins them to its path
  *   unchecked (LiveUpdate.java:665-667,1299-1302).
  * - Everything else is refused: deleting, resetting, the vendor's cloud, config, channel and ids.
  * - load() also refuses background updates, which sync with the vendor's cloud outside every method here
- *   (LiveUpdate.java:420-433), and needs `autoDeleteBundles` and a `readyTimeout`, so ready() drops every bundle but the
- *   current and next one and a bundle that never gets ready rolls back: page script cannot pin an older one.
+ *   (LiveUpdate.java:420-433), and needs `autoDeleteBundles`, a `readyTimeout` and `autoBlockRolledBackBundles`, so
+ *   ready() drops every bundle but the current and next one, and a bundle that never gets ready rolls back and is not
+ *   taken again: page script cannot pin an older one.
  *
  * The config comes from capacitor.config.json, which ships in the binary outside the web part, beyond page script and
  * a live update. This source set compiles only when the app has the plugin's Gradle project, which the CLI's swap and
@@ -75,6 +85,7 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
     private String releasesUrl;
     private PublicKey publicKey;
     private ReleaseBinary binary;
+    private long[] builtInOrder;
 
     @Override
     public void load() {
@@ -94,6 +105,13 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
         if (config.getInt("readyTimeout", 0) <= 0) {
             refuseToLoad("plugins.LiveUpdate.readyTimeout must be above 0 in a Protobase app");
         }
+        if (!config.getBoolean("autoBlockRolledBackBundles", false)) {
+            refuseToLoad("plugins.LiveUpdate.autoBlockRolledBackBundles must be true in a Protobase app");
+        }
+        builtInOrder = ReleaseOrder.parseBuiltIn(config.getString("builtInOrder"));
+        if (builtInOrder == null) {
+            refuseToLoad("plugins.LiveUpdate needs the order of the binary's own files, builtInOrder, in a Protobase app: run protobase mobile again");
+        }
         releasesUrl = config.getString("releasesUrl");
         if (!ownSource(releasesUrl)) {
             refuseToLoad("plugins.LiveUpdate.releasesUrl must be an https URL, or http to the device itself, in a Protobase app");
@@ -147,6 +165,10 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
             Refusal.rejectMethod(call, "LiveUpdate", "downloadBundle");
             return;
         }
+        if (blocked(bundleId)) {
+            call.reject("LiveUpdate.downloadBundle refused release " + bundleId + ": it was rolled back");
+            return;
+        }
         if (downloads.incrementAndGet() > MAX_DOWNLOADS) {
             call.reject("LiveUpdate.downloadBundle was called too often in this run of the app");
             return;
@@ -155,42 +177,51 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
         downloader.execute(() -> download(call, bundleId));
     }
 
+    // Answers the call once what the download left is deleted, so its caller never sees it.
     private void download(PluginCall call, String bundleId) {
-        File bundles = BundlesFolder.of(getContext());
         File downloads = new File(getContext().getFilesDir(), DOWNLOADS);
         File dir = new File(downloads, UUID.randomUUID().toString());
+        String refusal = null;
         try {
-            if (!dir.mkdirs() || !(bundles.isDirectory() || bundles.mkdirs())) throw new IOException("Cannot create " + dir);
-            String current = bundleIdOf(getBridge().getServerBasePath());
-            ReleaseStatement statement = new ReleaseDownload(releasesUrl, publicKey, binary).download(bundleId, dir, current == null ? null : new File(bundles, current), highestOrder());
-            File target = new File(bundles, bundleId);
-            // The same release downloaded before stays; setNextBundle checks it anyway.
-            if (!target.exists() && !dir.renameTo(target)) throw new IOException("Cannot move " + dir);
-            synchronized (order) {
-                if (ReleaseOrder.compare(statement.order, highestOrder()) > 0) {
-                    prefs().edit().putString(HIGHEST_ORDER, ReleaseOrder.format(statement.order)).commit();
-                }
-            }
-            call.resolve();
+            downloadInto(dir, bundleId);
         } catch (BundleRefused e) {
-            call.reject("LiveUpdate.downloadBundle refused release " + bundleId + ": " + e.getMessage());
+            refusal = "LiveUpdate.downloadBundle refused release " + bundleId + ": " + e.getMessage();
         } catch (IOException e) {
-            call.reject("LiveUpdate.downloadBundle could not download release " + bundleId);
+            refusal = "LiveUpdate.downloadBundle could not download release " + bundleId;
         } finally {
             BundleRemoval.delete(downloads, dir);
         }
+        if (refusal == null) call.resolve();
+        else call.reject(refusal);
+    }
+
+    // Downloads release `bundleId` into `dir`, then moves it into the bundles folder and raises the highest order.
+    private void downloadInto(File dir, String bundleId) throws BundleRefused, IOException {
+        File bundles = BundlesFolder.of(getContext());
+        if (!dir.mkdirs() || !(bundles.isDirectory() || bundles.mkdirs())) throw new IOException("Cannot create " + dir);
+        String current = bundleIdOf(getBridge().getServerBasePath());
+        OwnFiles own = current == null ? builtInFiles() : OwnFiles.inFolder(new File(bundles, current));
+        long[] highest;
+        synchronized (order) {
+            highest = highestOrder();
+        }
+        ReleaseStatement statement = new ReleaseDownload(releasesUrl, publicKey, binary).download(bundleId, dir, own, builtInOrder, highest);
+        File target = new File(bundles, bundleId);
+        // The same release downloaded before stays; setNextBundle checks it anyway.
+        if (!target.exists() && !dir.renameTo(target)) throw new IOException("Cannot move " + dir);
+        synchronized (order) {
+            if (ReleaseOrder.compare(statement.order, highestOrder()) > 0) {
+                prefs().edit().putString(HIGHEST_ORDER, ReleaseOrder.format(statement.order)).commit();
+            }
+        }
     }
 
     @Override
     @PluginMethod
     public void setNextBundle(PluginCall call) {
+        // A null id, which the stock code takes for the built-in bundle, is refused too: it would take the app below
+        // what it downloaded, and only the stock rollback goes there.
         Object bundleId = call.getData().opt("bundleId");
-        if (bundleId == null || bundleId == JSONObject.NULL) {
-            // The stock code resets to the built-in bundle.
-            clear(call);
-            super.setNextBundle(call);
-            return;
-        }
         if (!(bundleId instanceof String) || !BundlesFolder.isBundleId(BundlesFolder.of(getContext()), (String) bundleId)) {
             Refusal.rejectMethod(call, "LiveUpdate", "setNextBundle");
             return;
@@ -199,6 +230,7 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
         File bundles = BundlesFolder.of(getContext());
         synchronized (order) {
             try {
+                if (blocked(id)) throw new BundleRefused("it was rolled back");
                 ReleaseStatement next = BundleCheck.check(new File(bundles, id), id, publicKey, binary);
                 ReleaseOrder.acceptNext(next.order, currentOrder(bundles), highestOrder());
             } catch (BundleRefused e) {
@@ -213,10 +245,24 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
         }
     }
 
+    // The binary's own files, in the assets folder Capacitor serves them from, as the manifest the CLI writes beside them lists them; none without one, as in a binary built before it.
+    private OwnFiles builtInFiles() throws IOException {
+        AssetManager assets = getContext().getAssets();
+        ReleaseManifest manifest;
+        try (InputStream in = assets.open(Bridge.DEFAULT_WEB_ASSET_DIR + "/" + ReleaseManifest.FILE)) {
+            manifest = ReleaseManifest.parse(Bounded.read(in, ReleaseManifest.MAX_BYTES, "the built-in manifest"), new File(Bridge.DEFAULT_WEB_ASSET_DIR));
+        } catch (FileNotFoundException | BundleRefused e) {
+            return OwnFiles.NONE;
+        }
+        Map<String, String> hrefs = new HashMap<>();
+        for (ReleaseManifest.Item item : manifest.items) hrefs.put(item.checksum, item.href);
+        return checksum -> hrefs.containsKey(checksum) ? assets.open(Bridge.DEFAULT_WEB_ASSET_DIR + "/" + hrefs.get(checksum)) : null;
+    }
+
     // The running bundle's order: the built-in one's, or what its statement says, checked against the key.
     private long[] currentOrder(File bundles) throws BundleRefused {
         String current = bundleIdOf(getBridge().getServerBasePath());
-        if (current == null) return ReleaseOrder.BUILT_IN;
+        if (current == null) return builtInOrder;
         try {
             byte[] statement = Bounded.read(new File(new File(bundles, current), ReleaseStatement.FILE), ReleaseStatement.MAX_BYTES, "the running bundle's statement");
             return ReleaseStatement.verify(statement, current, publicKey).order;
@@ -229,6 +275,11 @@ public class GuardedLiveUpdate extends LiveUpdatePlugin {
         return ReleaseOrder.parse(prefs().getString(HIGHEST_ORDER, null));
     }
 
+    private boolean blocked(String bundleId) {
+        String list = getContext().getSharedPreferences(LiveUpdatePlugin.SHARED_PREFERENCES_NAME, Activity.MODE_PRIVATE).getString(BlockedBundles.KEY, null);
+        return BlockedBundles.blocks(list, bundleId);
+    }
+
     private SharedPreferences prefs() {
         return getContext().getSharedPreferences(ORDER_PREFS, Activity.MODE_PRIVATE);
     }

package/android/src/liveupdate/java/net/protobase/mobile/OwnFiles.java

@@ -0,0 +1,38 @@
+package net.protobase.mobile;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * The files of the bundle the app runs, by checksum, which a download copies instead of fetching: a downloaded
+ * bundle's folder, or the binary's own files. A copy is hashed again as it is written, so it is bound by its content
+ * to the release's manifest, never by where it came from.
+ */
+interface OwnFiles {
+
+    /** None: every file is fetched. */
+    OwnFiles NONE = checksum -> null;
+
+    /** The file of checksum `checksum`, opened, or null when the bundle has none. */
+    InputStream open(String checksum) throws IOException;
+
+    /** The files of the bundle folder `dir` as its own manifest lists them; none when it has none that parses. */
+    static OwnFiles inFolder(File dir) throws IOException {
+        ReleaseManifest manifest;
+        try {
+            manifest = ReleaseManifest.parse(Bounded.read(new File(dir, ReleaseManifest.FILE), ReleaseManifest.MAX_BYTES, "its manifest"), dir);
+        } catch (BundleRefused e) {
+            return NONE;
+        }
+        Map<String, File> files = new HashMap<>();
+        for (ReleaseManifest.Item item : manifest.items) {
+            File file = new File(dir, item.href);
+            if (file.isFile() && !BundleRemoval.isLink(file)) files.put(item.checksum, file);
+        }
+        return checksum -> files.containsKey(checksum) ? new FileInputStream(files.get(checksum)) : null;
+    }
+}

package/android/src/liveupdate/java/net/protobase/mobile/ReleaseDownload.java

@@ -1,7 +1,6 @@
 package net.protobase.mobile;
 
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -11,8 +10,6 @@ import java.net.HttpURLConnection;
 import java.net.URI;
 import java.net.URLEncoder;
 import java.security.PublicKey;
-import java.util.HashMap;
-import java.util.Map;
 
 /**
  * Downloads release `bundleId` from `releasesUrl/<id>?href=<file>` into a folder, in place of the stock downloader,
@@ -20,8 +17,8 @@ import java.util.Map;
  * (LiveUpdate.java:817-872 of @capawesome/capacitor-live-update 8.7.1). First the statement, checked against the id,
  * the key, this binary and the highest order the app downloaded; then the manifest, checked against the statement and
  * every href against the folder before any file is fetched; then each file, hashed as it is written and refused unless
- * it is the one the manifest names. A file the running bundle has with the same checksum is copied from it and hashed
- * again, so it is bound by its content, never by its href.
+ * it is the one the manifest names. A file the running bundle has with the same checksum (OwnFiles) is copied from it
+ * and hashed again, so it is bound by its content, never by its href.
  */
 final class ReleaseDownload {
 
@@ -38,23 +35,23 @@ final class ReleaseDownload {
     }
 
     /**
-     * Fills the empty folder `dir` with release `bundleId`, `current` the running bundle's folder (null for the built-in
-     * one), and checks it as a whole. Returns its statement.
+     * Fills the empty folder `dir` with release `bundleId`, copying what `own`, the running bundle's files, has, and
+     * checks it as a whole: its order above the built-in files' `builtIn` and not below `highest`, the highest
+     * the app downloaded. Returns its statement.
      */
-    ReleaseStatement download(String bundleId, File dir, File current, long[] highest) throws BundleRefused, IOException {
+    ReleaseStatement download(String bundleId, File dir, OwnFiles own, long[] builtIn, long[] highest) throws BundleRefused, IOException {
         byte[] statementBytes = fetch(bundleId, ReleaseStatement.FILE, ReleaseStatement.MAX_BYTES);
         ReleaseStatement statement = ReleaseStatement.verify(statementBytes, bundleId, key);
         binary.accept(statement);
-        if (ReleaseOrder.compare(statement.order, highest) < 0) throw new BundleRefused("it is older than a release the app downloaded");
+        ReleaseOrder.acceptDownload(statement.order, builtIn, highest);
         byte[] manifestBytes = fetch(bundleId, ReleaseManifest.FILE, ReleaseManifest.MAX_BYTES);
         ReleaseManifest manifest = ReleaseManifest.verify(manifestBytes, statement, dir);
-        Map<String, File> own = filesOf(current);
         for (ReleaseManifest.Item item : manifest.items) {
             File target = new File(dir, item.href);
             File parent = target.getParentFile();
             if (!parent.isDirectory() && !parent.mkdirs()) throw new IOException("Cannot create " + parent);
-            File copy = own.get(item.checksum);
-            if (copy != null && item.checksum.equals(write(new FileInputStream(copy), target, item.size))) continue;
+            InputStream copy = own.open(item.checksum);
+            if (copy != null && item.checksum.equals(write(copy, target, item.size))) continue;
             if (!item.checksum.equals(write(open(bundleId, item.href), target, item.size))) {
                 throw new BundleRefused("its " + item.href + " is not the file its manifest names");
             }
@@ -64,23 +61,6 @@ final class ReleaseDownload {
         return BundleCheck.check(dir, bundleId, key, binary);
     }
 
-    // The running bundle's files by checksum, as its own manifest lists them; none when it has none that parses.
-    private static Map<String, File> filesOf(File current) throws IOException {
-        Map<String, File> files = new HashMap<>();
-        if (current == null) return files;
-        ReleaseManifest manifest;
-        try {
-            manifest = ReleaseManifest.parse(Bounded.read(new File(current, ReleaseManifest.FILE), ReleaseManifest.MAX_BYTES, "its manifest"), current);
-        } catch (BundleRefused e) {
-            return files;
-        }
-        for (ReleaseManifest.Item item : manifest.items) {
-            File file = new File(current, item.href);
-            if (file.isFile() && !BundleRemoval.isLink(file)) files.put(item.checksum, file);
-        }
-        return files;
-    }
-
     // Writes at most `size` bytes of `in` to `target`; returns their sha256, or null when there were more or fewer.
     private static String write(InputStream in, File target, long size) throws IOException {
         try (InputStream source = in; OutputStream out = new FileOutputStream(target)) {

package/android/src/liveupdate/java/net/protobase/mobile/ReleaseOrder.java

@@ -1,13 +1,18 @@
 package net.protobase.mobile;
 
+import java.util.regex.Pattern;
+
 /**
  * Release orders, compared element by element, a missing element counting as 0, so a later server can add one without
  * breaking binaries already shipped. Kept as text such as `1800000000000,0`.
  */
 final class ReleaseOrder {
 
-    /** The built-in bundle's order. */
-    static final long[] BUILT_IN = { 0 };
+    /** No order: below every release, the highest order downloaded before the app downloaded any. */
+    static final long[] NONE = { 0 };
+
+    // An order the CLI writes: up to 8 elements of up to 19 digits, which parse() still checks for overflow.
+    private static final Pattern TEXT = Pattern.compile("[0-9]{1,19}(,[0-9]{1,19}){0,7}");
 
     private ReleaseOrder() {}
 
@@ -29,15 +34,40 @@ final class ReleaseOrder {
         if (compare(next, highest) < 0) throw new BundleRefused("it is older than a release the app downloaded");
     }
 
+    /**
+     * Refuses to download a release of order `order` unless it is above the app's built-in files, `builtIn`, and not
+     * below the highest order the app downloaded, `highest`: equal to it is the same release again, which the app
+     * downloaded and may still have to set as the next bundle.
+     */
+    static void acceptDownload(long[] order, long[] builtIn, long[] highest) throws BundleRefused {
+        if (compare(order, builtIn) <= 0) throw new BundleRefused("it is not newer than the app's built-in files");
+        if (compare(order, highest) < 0) throw new BundleRefused("it is older than a release the app downloaded");
+    }
+
     static String format(long[] order) {
         StringBuilder text = new StringBuilder();
         for (int i = 0; i < order.length; i++) text.append(i == 0 ? "" : ",").append(order[i]);
         return text.toString();
     }
 
-    /** The order `text` holds, or the built-in bundle's for none. Only this class writes it. */
+    /**
+     * The order the CLI wrote, `plugins.LiveUpdate.builtInOrder`, or null when it is missing, malformed or no order
+     * above none, so the guard never runs with a floor of 0.
+     */
+    static long[] parseBuiltIn(String text) {
+        if (text == null || !TEXT.matcher(text).matches()) return null;
+        long[] order;
+        try {
+            order = parse(text);
+        } catch (NumberFormatException e) {
+            return null;
+        }
+        return compare(order, NONE) > 0 ? order : null;
+    }
+
+    /** The order `text` holds, or none. Only this class writes it. */
     static long[] parse(String text) {
-        if (text == null || text.isEmpty()) return BUILT_IN;
+        if (text == null || text.isEmpty()) return NONE;
         String[] parts = text.split(",");
         long[] order = new long[parts.length];
         for (int i = 0; i < parts.length; i++) order[i] = Long.parseLong(parts[i]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.57.3",
+  "version": "0.57.4",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugins that keep page script away from the session and give the iOS app its bounce; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,7 @@
     "android/build.gradle",
     "icon"
   ],
-  "nativeContract": 6,
+  "nativeContract": 7,
   "capacitor": {
     "ios": {
       "src": "ios"