@rovq/react-native 0.0.0-stage → 0.1.0

package/ios/Engine/SafePackageExtractor.swift

@@ -0,0 +1,107 @@
+import Foundation
+
+/// Extracts a package without trusting it, even though its signature was already verified.
+/// If a signing key ever leaks, this keeps an attacker inside the package folder, so the
+/// files of the app itself stay out of reach.
+struct SafePackageExtractor {
+    /// - Parameter destination: an empty folder that only this extraction uses.
+    func extract(packageFile: URL, destination: URL) throws {
+        do {
+            let reader = try ZipReader(url: packageFile)
+            try extractEntries(reader, destination: destination)
+        } catch let error as ZipError {
+            throw invalid(error.message)
+        }
+    }
+
+    private func extractEntries(_ reader: ZipReader, destination: URL) throws {
+        let root = destination.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+        var seen = Set<String>()
+        var hasBundle = false
+        var totalSize: Int64 = 0
+
+        if reader.entries.count > PackageRules.maxEntries { throw invalid("Too many files") }
+
+        for entry in reader.entries {
+            if entry.isFolder { throw invalid("Folder entries are not allowed") }
+            if let problem = PackageRules.findPathProblem(entry.name) {
+                throw invalid("The file \(entry.name) \(problem)")
+            }
+            if !seen.insert(PackageRules.pathIdentity(entry.name)).inserted {
+                throw invalid("The file \(entry.name) appears more than once")
+            }
+
+            let target = destination.appendingPathComponent(entry.name)
+            // A second, independent check: whatever the rules allow, the real path must stay
+            // inside the folder.
+            let parent = target.deletingLastPathComponent()
+            try createFolder(parent)
+            let resolved = parent.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+            if !resolved.hasPrefix(root) { throw invalid("The file \(entry.name) leaves the folder") }
+
+            let written = try write(
+                entry,
+                from: reader,
+                to: target,
+                allowance: PackageRules.maxTotalSize - totalSize
+            )
+            totalSize += written
+            if entry.name == PackageRules.bundleFileName {
+                if written == 0 { throw invalid("The bundle file is empty") }
+                hasBundle = true
+            }
+        }
+        if !hasBundle { throw invalid("The bundle file is missing") }
+    }
+
+    private func write(
+        _ entry: ZipEntry,
+        from reader: ZipReader,
+        to target: URL,
+        allowance: Int64
+    ) throws -> Int64 {
+        guard FileManager.default.createFile(atPath: target.path, contents: nil) else {
+            throw RovqError(.storageFailed, "Could not create \(entry.name)")
+        }
+        let output: FileHandle
+        do {
+            output = try FileHandle(forWritingTo: target)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create \(entry.name)")
+        }
+        defer { try? output.close() }
+
+        let written: Int64
+        do {
+            written = try reader.extract(entry, allowance: allowance) { chunk in
+                do {
+                    try output.write(contentsOf: chunk)
+                } catch {
+                    throw RovqError(.storageFailed, "Could not write \(entry.name)")
+                }
+            }
+            // Forces the bytes to disk, because the release becomes active by renaming its
+            // folder, and that rename must not outrun the data.
+            try output.synchronize()
+        } catch let error as RovqError {
+            throw error
+        } catch let error as ZipError {
+            throw error
+        } catch {
+            throw RovqError(.storageFailed, "Could not write \(entry.name)")
+        }
+        return written
+    }
+
+    private func createFolder(_ url: URL) throws {
+        do {
+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create \(url.lastPathComponent)")
+        }
+    }
+
+    private func invalid(_ message: String) -> RovqError {
+        RovqError(.invalidPackage, message)
+    }
+}

package/ios/Engine/UpdateInstaller.swift

@@ -0,0 +1,126 @@
+import Foundation
+
+/// What the server offered. None of this is trusted until the manifest has been verified.
+public struct OfferedUpdate: Equatable {
+    public let manifest: String
+    public let signature: String
+    public let keyId: String
+    public let downloadURL: String
+
+    public init(manifest: String, signature: String, keyId: String, downloadURL: String) {
+        self.manifest = manifest
+        self.signature = signature
+        self.keyId = keyId
+        self.downloadURL = downloadURL
+    }
+}
+
+/// A verified release, fully extracted in its own folder.
+public struct InstalledRelease: Equatable {
+    public let manifest: VerifiedManifest
+    public let folder: URL
+    public let bundleFile: URL
+}
+
+/// Takes an offered update to a verified folder on disk, without activating it.
+///
+/// Each release gets its own folder, which keeps the design the same as Android, and makes
+/// the final rename what decides that a release is complete.
+public final class UpdateInstaller {
+    private let updatesFolder: URL
+    private let workFolder: URL
+    // Outside the work folder, because a partial download must survive a failure or a restart.
+    private let partialFolder: URL
+    private let verifier: ManifestVerifier
+    private let downloader: PackageDownloader
+    private let extractor = SafePackageExtractor()
+    private let lock = NSLock()
+
+    /// - Parameter rootFolder: a folder only the engine uses, inside the app's private storage.
+    public init(rootFolder: URL, verifier: ManifestVerifier, downloader: PackageDownloader) {
+        updatesFolder = rootFolder.appendingPathComponent("updates")
+        workFolder = rootFolder.appendingPathComponent("work")
+        partialFolder = rootFolder.appendingPathComponent("partial")
+        self.verifier = verifier
+        self.downloader = downloader
+    }
+
+    /// - Parameter highestSequence: the highest sequence this device has accepted in this stream.
+    /// - Throws: `RovqError` if any step fails. Nothing is left behind in that case.
+    public func install(
+        offer: OfferedUpdate,
+        highestSequence: Int64,
+        onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
+    ) throws -> InstalledRelease {
+        lock.lock()
+        defer { lock.unlock() }
+
+        // Verified first, so an unsigned update causes no network traffic or disk use.
+        let manifest = try verifier.verify(
+            manifest: offer.manifest,
+            signature: offer.signature,
+            keyId: offer.keyId,
+            highestSequence: highestSequence
+        )
+
+        let folder = updatesFolder.appendingPathComponent(manifest.releaseId, isDirectory: true)
+        // Folders appear only through the atomic rename below, so one that exists is complete.
+        var isFolder: ObjCBool = false
+        if !FileManager.default.fileExists(atPath: folder.path, isDirectory: &isFolder) || !isFolder.boolValue {
+            try installFiles(offer: offer, manifest: manifest, folder: folder, onProgress: onProgress)
+        }
+        return InstalledRelease(
+            manifest: manifest,
+            folder: folder,
+            bundleFile: folder.appendingPathComponent(PackageRules.bundleFileName)
+        )
+    }
+
+    private func installFiles(
+        offer: OfferedUpdate,
+        manifest: VerifiedManifest,
+        folder: URL,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        let files = FileManager.default
+        // Removes anything an earlier run left when the app was killed or the phone lost power.
+        try? files.removeItem(at: workFolder)
+        let extracted = workFolder.appendingPathComponent("extracted", isDirectory: true)
+        do {
+            try files.createDirectory(at: extracted, withIntermediateDirectories: true)
+            try files.createDirectory(at: updatesFolder, withIntermediateDirectories: true)
+            try files.createDirectory(at: partialFolder, withIntermediateDirectories: true)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create the engine folders")
+        }
+        defer { try? files.removeItem(at: workFolder) }
+
+        let packageFile = partialFolder.appendingPathComponent("\(manifest.packageHash).zip")
+        // Only the current offer is worth finishing.
+        for file in (try? files.contentsOfDirectory(at: partialFolder, includingPropertiesForKeys: nil)) ?? []
+        where file.lastPathComponent != packageFile.lastPathComponent {
+            try? files.removeItem(at: file)
+        }
+        do {
+            try downloader.download(
+                url: offer.downloadURL,
+                manifest: manifest,
+                target: packageFile,
+                onProgress: onProgress
+            )
+            try extractor.extract(packageFile: packageFile, destination: extracted)
+            do {
+                try files.moveItem(at: extracted, to: folder)
+            } catch {
+                throw RovqError(.storageFailed, "Could not move the release into place")
+            }
+            try? files.removeItem(at: packageFile)
+        } catch {
+            // A file that failed anything but the network is not worth continuing from.
+            if (error as? RovqError)?.code != .downloadFailed {
+                try? files.removeItem(at: packageFile)
+            }
+            throw error
+        }
+    }
+}

package/ios/Engine/UpdateService.swift

@@ -0,0 +1,158 @@
+import Foundation
+
+private let requestTimeout: TimeInterval = 30
+
+/// What the device tells the server when asking for updates.
+public struct CheckRequest: Equatable {
+    public let deploymentKey: String
+    public let deviceId: String
+    public let runtimeVersion: String
+    public let binaryVersion: String
+    public let currentReleaseId: String?
+    public let highestSequence: Int64
+}
+
+/// The server's answer. It is advice only, because `OfferedUpdate` is verified before use.
+public enum CheckResponse: Equatable {
+    case none
+    case rollback
+    case update(OfferedUpdate)
+}
+
+/// A key's signed statement that it must no longer be trusted. The engine verifies it.
+public struct KeyRevocation: Equatable {
+    public let keyId: String
+    public let statement: String
+    public let signature: String
+}
+
+public struct CheckAnswer: Equatable {
+    public let response: CheckResponse
+    public let revocations: [KeyRevocation]
+
+    public init(response: CheckResponse, revocations: [KeyRevocation] = []) {
+        self.response = response
+        self.revocations = revocations
+    }
+}
+
+/// The server API the engine needs, kept separate so tests can replace it.
+public protocol UpdateService {
+    /// - Throws: if the server cannot be reached or answers with an error.
+    func check(_ request: CheckRequest) throws -> CheckAnswer
+
+    /// - Throws: if the events could not be delivered.
+    func report(deploymentKey: String, deviceId: String, events: [QueuedEvent]) throws
+}
+
+public final class HTTPUpdateService: UpdateService {
+    private let apiURL: String
+    private let allowInsecureURLs: Bool
+
+    public init(apiURL: String, allowInsecureURLs: Bool = false) {
+        self.apiURL = apiURL
+        self.allowInsecureURLs = allowInsecureURLs
+    }
+
+    public func check(_ request: CheckRequest) throws -> CheckAnswer {
+        var body: [String: Any] = [
+            "deploymentKey": request.deploymentKey,
+            "deviceId": request.deviceId,
+            "platform": "IOS",
+            "runtimeVersion": request.runtimeVersion,
+            "binaryVersion": request.binaryVersion,
+            "highestSequence": request.highestSequence,
+        ]
+        if let current = request.currentReleaseId { body["currentReleaseId"] = current }
+
+        let response = try post("/device/updates/check", body: body)
+        let revocations = readRevocations(response)
+        switch response["action"] as? String {
+        case "NONE":
+            return CheckAnswer(response: .none, revocations: revocations)
+        case "ROLLBACK":
+            return CheckAnswer(response: .rollback, revocations: revocations)
+        case "UPDATE":
+            guard let update = response["update"] as? [String: Any],
+                let manifest = update["manifest"] as? String,
+                let signature = update["signature"] as? String,
+                let keyId = update["keyId"] as? String,
+                let downloadURL = update["downloadUrl"] as? String
+            else { throw RovqError(.downloadFailed, "The server sent an unreadable response") }
+            return CheckAnswer(
+                response: .update(
+                    OfferedUpdate(manifest: manifest, signature: signature, keyId: keyId, downloadURL: downloadURL)),
+                revocations: revocations
+            )
+        default:
+            throw RovqError(.downloadFailed, "The server sent an unknown action")
+        }
+    }
+
+    private func readRevocations(_ response: [String: Any]) -> [KeyRevocation] {
+        let list = response["revokedKeys"] as? [[String: Any]] ?? []
+        return list.compactMap { item in
+            guard let keyId = item["keyId"] as? String,
+                let statement = item["statement"] as? String,
+                let signature = item["signature"] as? String
+            else { return nil }
+            return KeyRevocation(keyId: keyId, statement: statement, signature: signature)
+        }
+    }
+
+    public func report(deploymentKey: String, deviceId: String, events: [QueuedEvent]) throws {
+        let list: [[String: Any]] = events.map { event in
+            var json: [String: Any] = [
+                "clientEventId": event.clientEventId,
+                "type": event.type,
+                "occurredAt": event.occurredAt,
+            ]
+            if let releaseId = event.releaseId { json["releaseId"] = releaseId }
+            if let errorCode = event.errorCode { json["errorCode"] = errorCode }
+            return json
+        }
+        _ = try post(
+            "/device/events",
+            body: ["deploymentKey": deploymentKey, "deviceId": deviceId, "events": list]
+        )
+    }
+
+    /// Blocks until finished, so call it away from the main thread.
+    private func post(_ path: String, body: [String: Any]) throws -> [String: Any] {
+        let base = apiURL.hasSuffix("/") ? String(apiURL.dropLast()) : apiURL
+        guard let url = URL(string: base + path), let scheme = url.scheme?.lowercased() else {
+            throw RovqError(.downloadFailed, "The API URL is not valid")
+        }
+        if scheme != "https" && !allowInsecureURLs {
+            throw RovqError(.insecureURL, "The API URL must use HTTPS")
+        }
+
+        var request = URLRequest(url: url, timeoutInterval: requestTimeout)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "content-type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        let finished = DispatchSemaphore(value: 0)
+        var answer: Data?
+        var status = 0
+        var failure: Error?
+        let session = URLSession(configuration: .ephemeral)
+        session.dataTask(with: request) { data, response, error in
+            answer = data
+            status = (response as? HTTPURLResponse)?.statusCode ?? 0
+            failure = error
+            finished.signal()
+        }.resume()
+        finished.wait()
+        session.finishTasksAndInvalidate()
+
+        if let failure {
+            throw RovqError(.downloadFailed, failure.localizedDescription)
+        }
+        guard status == 200 else { throw RovqError(.downloadFailed, "The server answered \(status)") }
+        guard let answer, let json = try? JSONSerialization.jsonObject(with: answer) as? [String: Any] else {
+            throw RovqError(.downloadFailed, "The server sent an unreadable response")
+        }
+        return json
+    }
+}