@rovq/react-native 0.0.0-stage → 0.1.0

package/ios/Engine/PackageDownloader.swift

@@ -0,0 +1,231 @@
+import CryptoKit
+import Foundation
+
+private let requestTimeout: TimeInterval = 30
+
+/// Downloads a package and proves it is the signed one. HTTPS protects the transfer, but the
+/// hash is what makes the file trustworthy.
+public final class PackageDownloader {
+    private let allowInsecureURLs: Bool
+    private let freeSpace: (URL) -> Int64
+
+    /// - Parameter allowInsecureURLs: allows http:// for local development only.
+    public init(
+        allowInsecureURLs: Bool = false,
+        freeSpace: @escaping (URL) -> Int64 = PackageDownloader.availableSpace
+    ) {
+        self.allowInsecureURLs = allowInsecureURLs
+        self.freeSpace = freeSpace
+    }
+
+    public static func availableSpace(in folder: URL) -> Int64 {
+        let values = try? folder.resourceValues(forKeys: [.volumeAvailableCapacityForImportantUsageKey])
+        return values?.volumeAvailableCapacityForImportantUsage ?? Int64.max
+    }
+
+    /// Blocks until finished, so call it away from the main thread. Continues from what `target`
+    /// already holds, because on a poor connection a large file might otherwise never finish. A
+    /// network failure keeps the file for that reason. Any other failure deletes it. It counts as
+    /// good only once the whole file matches the signed hash, so a partial or wrong file can
+    /// never be mistaken for a good one.
+    ///
+    /// - Parameter onProgress: receives bytes received so far and the total.
+    func download(
+        url: String,
+        manifest: VerifiedManifest,
+        target: URL,
+        onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
+    ) throws {
+        do {
+            try downloadToFile(url: url, manifest: manifest, target: target, onProgress: onProgress)
+        } catch {
+            if (error as? RovqError)?.code != .downloadFailed {
+                try? FileManager.default.removeItem(at: target)
+            }
+            throw error
+        }
+    }
+
+    private func downloadToFile(
+        url: String,
+        manifest: VerifiedManifest,
+        target: URL,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        guard let parsed = URL(string: url), let scheme = parsed.scheme?.lowercased() else {
+            throw RovqError(.downloadFailed, "Malformed download URL")
+        }
+        if scheme != "https" && !allowInsecureURLs {
+            throw RovqError(.insecureURL, "Download URL must use HTTPS")
+        }
+
+        var digest = SHA256()
+        let existing = try readExisting(target: target, manifest: manifest, digest: &digest)
+        // Extracting needs room too, and its size is unknown until then, so this asks for the
+        // package twice. A package can still expand further, and extraction reports that.
+        let needed = manifest.packageSize - existing + manifest.packageSize
+        if freeSpace(target.deletingLastPathComponent()) < needed {
+            throw RovqError(.storageFailed, "Not enough free space for this update")
+        }
+        if existing == manifest.packageSize {
+            try verifyHash(digest, manifest: manifest)
+            return
+        }
+        if existing == 0, !FileManager.default.createFile(atPath: target.path, contents: nil) {
+            throw RovqError(.storageFailed, "Could not create the file")
+        }
+        guard let output = try? FileHandle(forWritingTo: target) else {
+            throw RovqError(.storageFailed, "Could not create the file")
+        }
+        defer { try? output.close() }
+
+        let delegate = DownloadDelegate(
+            expectedSize: manifest.packageSize,
+            existing: existing,
+            digest: digest,
+            output: output,
+            onProgress: onProgress
+        )
+        var request = URLRequest(url: parsed)
+        if existing > 0 { request.setValue("bytes=\(existing)-", forHTTPHeaderField: "Range") }
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.timeoutIntervalForRequest = requestTimeout
+        let session = URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil)
+        session.dataTask(with: request).resume()
+        delegate.finished.wait()
+        session.finishTasksAndInvalidate()
+
+        if delegate.discardFile { try? FileManager.default.removeItem(at: target) }
+        if let failure = delegate.failure { throw failure }
+
+        do {
+            // Forces the bytes to disk, so power loss cannot leave a file that looks complete.
+            try output.synchronize()
+        } catch {
+            throw RovqError(.storageFailed, "Could not write the file")
+        }
+        // A lost connection can look like a normal end of file, so a short download counts as
+        // a network failure, which is worth retrying.
+        if delegate.received < manifest.packageSize {
+            throw RovqError(.downloadFailed, "The download ended early")
+        }
+        try verifyHash(delegate.digest, manifest: manifest)
+    }
+
+    /// Returns how many bytes are already there, after adding them to `digest`.
+    private func readExisting(target: URL, manifest: VerifiedManifest, digest: inout SHA256) throws -> Int64 {
+        let files = FileManager.default
+        guard files.fileExists(atPath: target.path),
+            let size = (try? files.attributesOfItem(atPath: target.path))?[.size] as? Int64
+        else { return 0 }
+        if size > manifest.packageSize {
+            try? files.removeItem(at: target)
+            return 0
+        }
+        guard let input = try? FileHandle(forReadingFrom: target) else { return 0 }
+        defer { try? input.close() }
+        while let chunk = try? input.read(upToCount: 64 * 1024), !chunk.isEmpty {
+            digest.update(data: chunk)
+        }
+        return size
+    }
+
+    private func verifyHash(_ digest: SHA256, manifest: VerifiedManifest) throws {
+        let hash = digest.finalize().map { String(format: "%02x", $0) }.joined()
+        if hash != manifest.packageHash {
+            throw RovqError(.hashMismatch, "Download does not match the signed hash")
+        }
+    }
+}
+
+/// Handles the bytes as they arrive, which allows stopping as soon as something is wrong.
+private final class DownloadDelegate: NSObject, URLSessionDataDelegate {
+    let finished = DispatchSemaphore(value: 0)
+    private(set) var failure: RovqError?
+    private(set) var received: Int64
+    private(set) var digest: SHA256
+    /// True when appending to the existing file could only produce a wrong file.
+    private(set) var discardFile = false
+    private let existing: Int64
+    private let expectedSize: Int64
+    private let output: FileHandle
+    private let onProgress: (Int64, Int64) -> Void
+
+    init(
+        expectedSize: Int64,
+        existing: Int64,
+        digest: SHA256,
+        output: FileHandle,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) {
+        self.expectedSize = expectedSize
+        self.existing = existing
+        self.received = existing
+        self.digest = digest
+        self.output = output
+        self.onProgress = onProgress
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        dataTask: URLSessionDataTask,
+        didReceive response: URLResponse,
+        completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
+    ) {
+        let http = response as? HTTPURLResponse
+        let status = http?.statusCode ?? 0
+        do {
+            if existing > 0 && status == 206 {
+                let range = http?.value(forHTTPHeaderField: "Content-Range") ?? ""
+                guard range.hasPrefix("bytes \(existing)-") else {
+                    discardFile = true
+                    failure = RovqError(.downloadFailed, "The server continued from the wrong place")
+                    completionHandler(.cancel)
+                    return
+                }
+                try output.seekToEnd()
+                completionHandler(.allow)
+            } else if status == 200 {
+                // The server sent the whole file, whether or not a part was asked for.
+                digest = SHA256()
+                received = 0
+                try output.truncate(atOffset: 0)
+                completionHandler(.allow)
+            } else {
+                if status == 416 { discardFile = true }
+                failure = RovqError(.downloadFailed, "Server answered \(status)")
+                completionHandler(.cancel)
+            }
+        } catch {
+            failure = RovqError(.storageFailed, "Could not write the file")
+            completionHandler(.cancel)
+        }
+    }
+
+    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
+        guard failure == nil else { return }
+        received += Int64(data.count)
+        // Stops at once, so a wrong server cannot fill the disk.
+        if received > expectedSize {
+            failure = RovqError(.sizeMismatch, "Download is larger than the signed size")
+            dataTask.cancel()
+            return
+        }
+        digest.update(data: data)
+        do {
+            try output.write(contentsOf: data)
+        } catch {
+            failure = RovqError(.storageFailed, "Could not write the file")
+            dataTask.cancel()
+            return
+        }
+        onProgress(received, expectedSize)
+    }
+
+    func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
+        if failure == nil, let error {
+            failure = RovqError(.downloadFailed, "Connection lost: \(error.localizedDescription)")
+        }
+        finished.signal()
+    }
+}

package/ios/Engine/PackageRules.swift

@@ -0,0 +1,38 @@
+import Foundation
+
+/// The same rules as packages/package-format/src/format.ts. The file
+/// packages/package-format/test/path-rules.json is checked against both, so a change on one
+/// side fails the tests until the other side matches.
+enum PackageRules {
+    static let bundleFileName = "main.jsbundle"
+    static let maxEntries = 10_000
+    static let maxTotalSize: Int64 = 2 * 1024 * 1024 * 1024
+    private static let maxPathLength = 512
+
+    /// Returns why a path is not allowed, or nil if it is fine.
+    static func findPathProblem(_ path: String) -> String? {
+        // Counted in UTF-16 units, as JavaScript does.
+        if path.isEmpty || path.utf16.count > maxPathLength { return "has an invalid length" }
+        if path.unicodeScalars.contains(where: { $0.value <= 0x1f || $0.value == 0x7f }) {
+            return "contains a control character"
+        }
+        if path.contains("\\") { return "contains a backslash" }
+        if path.hasPrefix("/") || path.range(of: "^[A-Za-z]:", options: .regularExpression) != nil {
+            return "is an absolute path"
+        }
+
+        let segments = path.components(separatedBy: "/")
+        if segments.contains(where: { $0.isEmpty || $0 == "." || $0 == ".." }) {
+            return "contains an empty, \".\" or \"..\" segment"
+        }
+        if path == bundleFileName { return nil }
+        if segments.count < 2 { return "is not the bundle file" }
+        return segments[0] == "assets" ? nil : "is outside the assets folder"
+    }
+
+    /// The same name in another letter case or Unicode form is one file on some file systems.
+    /// The default iOS file system is one of them.
+    static func pathIdentity(_ path: String) -> String {
+        path.precomposedStringWithCanonicalMapping.lowercased()
+    }
+}

package/ios/Engine/ProgressThrottle.swift

@@ -0,0 +1,20 @@
+import Foundation
+
+/// Passes on progress only when the whole percentage changes. A download reports every chunk,
+/// which is thousands of times for a large file, and each one sent to JavaScript has a cost.
+public final class ProgressThrottle {
+    private let onChange: (Int64, Int64) -> Void
+    private var lastPercent: Int64 = -1
+
+    public init(onChange: @escaping (Int64, Int64) -> Void) {
+        self.onChange = onChange
+    }
+
+    public func report(received: Int64, total: Int64) {
+        let percent = received * 100 / total
+        if percent != lastPercent {
+            lastPercent = percent
+            onChange(received, total)
+        }
+    }
+}