@rovq/react-native 0.0.0-stage → 0.1.0

package/android/src/main/java/com/rovq/engine/PackageDownloader.kt

@@ -0,0 +1,188 @@
+package com.rovq.engine
+
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+import java.net.HttpURLConnection
+import java.net.URL
+import java.security.MessageDigest
+
+private const val CONNECT_TIMEOUT_MS = 15_000
+private const val READ_TIMEOUT_MS = 30_000
+private const val BUFFER_SIZE = 64 * 1024
+private const val HTTP_RANGE_NOT_SATISFIABLE = 416
+
+/**
+ * Downloads a package and proves it is the signed one. HTTPS protects the transfer,
+ * but the hash is what makes the file trustworthy.
+ *
+ * @param allowInsecureUrls allows http:// for local development only.
+ */
+class PackageDownloader(
+    private val allowInsecureUrls: Boolean = false,
+    private val freeSpace: (File) -> Long = File::getUsableSpace,
+) {
+
+    /**
+     * Continues from what [target] already holds, because on a poor connection a large file might
+     * otherwise never finish. A network failure keeps the file for that reason. Any other failure
+     * deletes it. It counts as good only once the whole file matches the signed hash, so a partial
+     * or wrong file can never be mistaken for a good one.
+     *
+     * @param onProgress receives bytes received so far and the total.
+     */
+    fun download(
+        url: String,
+        manifest: VerifiedManifest,
+        target: File,
+        onProgress: (received: Long, total: Long) -> Unit = { _, _ -> },
+    ) {
+        try {
+            downloadToFile(url, manifest, target, onProgress)
+        } catch (error: RovqException) {
+            if (error.code != RovqErrorCode.DOWNLOAD_FAILED) target.delete()
+            throw error
+        } catch (error: IOException) {
+            target.delete()
+            throw error
+        }
+    }
+
+    private fun downloadToFile(
+        url: String,
+        manifest: VerifiedManifest,
+        target: File,
+        onProgress: (Long, Long) -> Unit,
+    ) {
+        val parsed = try {
+            URL(url)
+        } catch (error: IOException) {
+            throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "Malformed download URL", error)
+        }
+        if (parsed.protocol != "https" && !allowInsecureUrls) {
+            throw RovqException(RovqErrorCode.INSECURE_URL, "Download URL must use HTTPS")
+        }
+
+        val digest = MessageDigest.getInstance("SHA-256")
+        val existing = readExisting(target, manifest, digest)
+        checkFreeSpace(target, manifest, existing)
+        var received = existing
+        if (existing == manifest.packageSize) {
+            verifyHash(digest, manifest)
+            return
+        }
+
+        val connection = try {
+            parsed.openConnection() as HttpURLConnection
+        } catch (error: IOException) {
+            throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "Could not connect", error)
+        }
+        try {
+            connection.connectTimeout = CONNECT_TIMEOUT_MS
+            connection.readTimeout = READ_TIMEOUT_MS
+            if (existing > 0) connection.setRequestProperty("Range", "bytes=$existing-")
+            val status = try {
+                connection.responseCode
+            } catch (error: IOException) {
+                throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "Could not connect", error)
+            }
+            val resuming = existing > 0 && status == HttpURLConnection.HTTP_PARTIAL
+            if (resuming && connection.getHeaderField("Content-Range")?.startsWith("bytes $existing-") != true) {
+                // Appending the wrong bytes could only fail the hash check later, so start over.
+                target.delete()
+                throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "The server continued from the wrong place")
+            }
+            if (!resuming && status != HttpURLConnection.HTTP_OK) {
+                if (status == HTTP_RANGE_NOT_SATISFIABLE) target.delete()
+                throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "Server answered $status")
+            }
+            if (!resuming) {
+                // The server sent the whole file, whether or not a part was asked for.
+                digest.reset()
+                received = 0
+            }
+
+            val output = try {
+                FileOutputStream(target, resuming)
+            } catch (error: IOException) {
+                throw RovqException(RovqErrorCode.STORAGE_FAILED, "Could not create the file", error)
+            }
+            output.use { file ->
+                connection.inputStream.use { input ->
+                    val buffer = ByteArray(BUFFER_SIZE)
+                    while (true) {
+                        val count = try {
+                            input.read(buffer)
+                        } catch (error: IOException) {
+                            throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "Connection lost", error)
+                        }
+                        if (count < 0) break
+                        received += count
+                        // Stops at once, so a wrong server cannot fill the disk.
+                        if (received > manifest.packageSize) {
+                            throw RovqException(
+                                RovqErrorCode.SIZE_MISMATCH,
+                                "Download is larger than the signed size",
+                            )
+                        }
+                        digest.update(buffer, 0, count)
+                        try {
+                            file.write(buffer, 0, count)
+                        } catch (error: IOException) {
+                            throw RovqException(RovqErrorCode.STORAGE_FAILED, "Could not write the file", error)
+                        }
+                        onProgress(received, manifest.packageSize)
+                    }
+                }
+                // Forces the bytes to disk, so power loss cannot leave a file that looks complete.
+                file.fd.sync()
+            }
+        } finally {
+            connection.disconnect()
+        }
+
+        // A lost connection can look like a normal end of file, so a short download counts
+        // as a network failure, which is worth retrying.
+        if (received < manifest.packageSize) {
+            throw RovqException(RovqErrorCode.DOWNLOAD_FAILED, "The download ended early")
+        }
+        verifyHash(digest, manifest)
+    }
+
+    /** @return how many bytes are already there, after adding them to [digest]. */
+    private fun readExisting(target: File, manifest: VerifiedManifest, digest: MessageDigest): Long {
+        if (!target.isFile) return 0
+        if (target.length() > manifest.packageSize) {
+            target.delete()
+            return 0
+        }
+        target.inputStream().use { input ->
+            val buffer = ByteArray(BUFFER_SIZE)
+            while (true) {
+                val count = input.read(buffer)
+                if (count < 0) break
+                digest.update(buffer, 0, count)
+            }
+        }
+        return target.length()
+    }
+
+    /**
+     * Extracting needs room too, and its size is unknown until then, so this asks for the package
+     * twice. A package can still expand further, and extraction reports that if it happens.
+     */
+    private fun checkFreeSpace(target: File, manifest: VerifiedManifest, existing: Long) {
+        val needed = manifest.packageSize - existing + manifest.packageSize
+        val folder = target.parentFile ?: target
+        if (freeSpace(folder) < needed) {
+            throw RovqException(RovqErrorCode.STORAGE_FAILED, "Not enough free space for this update")
+        }
+    }
+
+    private fun verifyHash(digest: MessageDigest, manifest: VerifiedManifest) {
+        val hash = digest.digest().joinToString("") { "%02x".format(it) }
+        if (hash != manifest.packageHash) {
+            throw RovqException(RovqErrorCode.HASH_MISMATCH, "Download does not match the signed hash")
+        }
+    }
+}

package/android/src/main/java/com/rovq/engine/PackageRules.kt

@@ -0,0 +1,39 @@
+package com.rovq.engine
+
+import java.text.Normalizer
+import java.util.Locale
+
+/**
+ * The same rules as packages/package-format/src/format.ts. The file
+ * packages/package-format/test/path-rules.json is checked against both, so a change
+ * on one side fails the tests until the other side matches.
+ */
+internal object PackageRules {
+    const val BUNDLE_FILE_NAME = "index.android.bundle"
+    const val MAX_ENTRIES = 10_000
+    const val MAX_TOTAL_SIZE = 2L * 1024 * 1024 * 1024
+    private const val MAX_PATH_LENGTH = 512
+    private val ASSET_FOLDER = Regex("^(drawable(-[a-z0-9]+)*|raw)$")
+    private val ABSOLUTE_DRIVE = Regex("^[A-Za-z]:.*")
+
+    /** Returns why a path is not allowed, or null if it is fine. */
+    fun findPathProblem(path: String): String? {
+        if (path.isEmpty() || path.length > MAX_PATH_LENGTH) return "has an invalid length"
+        if (path.any { it.code <= 0x1f || it.code == 0x7f }) return "contains a control character"
+        if ('\\' in path) return "contains a backslash"
+        if (path.startsWith("/") || ABSOLUTE_DRIVE.matches(path)) return "is an absolute path"
+
+        val segments = path.split("/")
+        if (segments.any { it.isEmpty() || it == "." || it == ".." }) {
+            return "contains an empty, \".\" or \"..\" segment"
+        }
+        if (path == BUNDLE_FILE_NAME) return null
+        if (segments.size < 2) return "is not the bundle file"
+        if (segments.size != 2) return "is nested too deeply for an Android resource folder"
+        return if (ASSET_FOLDER.matches(segments[0])) null else "is outside the Android resource folders"
+    }
+
+    /** The same name in another letter case or Unicode form is one file on some file systems. */
+    fun pathIdentity(path: String): String =
+        Normalizer.normalize(path, Normalizer.Form.NFC).lowercase(Locale.ROOT)
+}

package/android/src/main/java/com/rovq/engine/ProgressThrottle.kt

@@ -0,0 +1,17 @@
+package com.rovq.engine
+
+/**
+ * Passes on progress only when the whole percentage changes. A download reports every chunk,
+ * which is thousands of times for a large file, and each one sent to JavaScript has a cost.
+ */
+class ProgressThrottle(private val onChange: (received: Long, total: Long) -> Unit) {
+    private var lastPercent = -1L
+
+    fun report(received: Long, total: Long) {
+        val percent = received * 100 / total
+        if (percent != lastPercent) {
+            lastPercent = percent
+            onChange(received, total)
+        }
+    }
+}