@scalebun-release/react-native 2.5.0

package/android/src/main/java/com/scalebun/rn/ota/SlotManager.kt

@@ -0,0 +1,578 @@
+package com.scalebun.rn.ota
+
+import android.util.Log
+import org.json.JSONObject
+import java.io.File
+import java.io.FileInputStream
+import java.io.FileOutputStream
+import java.security.MessageDigest
+import java.util.UUID
+
+/**
+ * Pure Kotlin slot manager for OTA bundles — no React Native dependency.
+ *
+ * Implements the three-slot layout from docs/ota-native-design.md:
+ *   {filesDir}/scalebun_ota/
+ *   ├── current/   — active bundle (loaded at app launch)
+ *   ├── next/      — staged downloaded bundle
+ *   ├── previous/  — rollback target
+ *   └── boot_marker — boot guard file
+ *
+ * Atomicity via rename(): all slot transitions use File.renameTo() which is
+ * atomic on the same filesystem (true for both Android's internal storage and
+ * iOS's Application Support directory).
+ */
+class SlotManager(private val filesDir: File) {
+
+    companion object {
+        private const val TAG = "ScaleBunOta"
+        private const val OTA_DIR = "scalebun_ota"
+        private const val BUNDLE_FILENAME = "bundle.jsbundle"
+        private const val META_FILENAME = "meta.json"
+        private const val BOOT_MARKER_FILENAME = "boot_marker"
+
+        /**
+         * Launches a freshly-applied bundle gets to call markHealthy() before the
+         * guard treats it as crash-looping. 2 = one retry: a single unlucky boot
+         * (OOM kill, user swipe-away during startup) does not cost the update,
+         * but a bundle that genuinely cannot start is gone by the second launch.
+         */
+        private const val MAX_BOOT_ATTEMPTS = 2
+        private const val REVERT_RECORD_FILENAME = "last_revert.json"
+
+        /**
+         * Serialises the three operations that MOVE slot directories.
+         *
+         * stage() ends with "remove next/, rename tmp -> next/" while apply() is doing
+         * "move current/ -> previous/, move next/ -> current/". Run concurrently, one
+         * renames a directory out from under the other and apply() throws — and its
+         * recovery only restores when previous/ exists AND current/ is gone, so any
+         * other interleaving leaves NO current/ slot. The device then has no bundle to
+         * load. A host that syncs on screen mount and again on foreground reproduces
+         * this in seconds; on 2026-09-21 it cost two devices that could only be
+         * recovered by reinstalling.
+         *
+         * Class-level, not per-instance: the manager is constructed in more than one
+         * place, so an instance lock would let two managers race the same directories.
+         * Recursive/reentrant so a future caller that already holds it cannot deadlock.
+         */
+        private val SLOT_LOCK = Any()
+    }
+
+    private val otaRoot: File get() = File(filesDir, OTA_DIR)
+    private val currentSlot: File get() = File(otaRoot, "current")
+    private val nextSlot: File get() = File(otaRoot, "next")
+    private val previousSlot: File get() = File(otaRoot, "previous")
+    private val bootMarker: File get() = File(otaRoot, BOOT_MARKER_FILENAME)
+    private val revertRecord: File get() = File(otaRoot, REVERT_RECORD_FILENAME)
+    private val sequenceFile: File get() = File(otaRoot, "highest_sequence")
+
+    /**
+     * Record that the next launch is a restart WE asked for.
+     *
+     * Consumed once by the boot guard so an intentional restart does not spend
+     * one of the bundle's two boot attempts. No-op when no boot marker is
+     * present, which is the normal steady state.
+     */
+    fun markIntentionalRestart() {
+        try {
+            if (!bootMarker.exists()) return
+            val json = JSONObject(bootMarker.readText())
+            json.put("intentionalRestart", true)
+            bootMarker.writeText(json.toString())
+            FileOutputStream(bootMarker, true).use { it.fd.sync() }
+        } catch (e: Exception) {
+            // Best effort: failing to record intent only costs a boot attempt,
+            // which is strictly better than failing the restart itself.
+            Log.w(TAG, "Could not record intentional restart", e)
+        }
+    }
+
+    /**
+     * Highest CONFIRMED release sequence (anti-downgrade floor, docs §15). Only
+     * updated once a bundle is marked healthy, so a failed/rolled-back higher
+     * sequence never raises the floor and never blocks a legitimate re-install.
+     */
+    fun highestConfirmedSequence(): Long =
+        try { sequenceFile.readText().trim().toLong() } catch (_: Exception) { 0L }
+
+    private fun confirmCurrentSequence() {
+        val seq = readMeta(currentSlot)?.optLong("releaseSequence", -1L) ?: -1L
+        if (seq >= 0 && seq > highestConfirmedSequence()) {
+            runCatching { otaRoot.mkdirs(); sequenceFile.writeText(seq.toString()) }
+        }
+    }
+
+    /**
+     * Returns the absolute path to the active JS bundle, or null if no OTA
+     * bundle is installed (→ use the default Metro/RN bundle).
+     */
+    fun currentBundlePath(): File? {
+        val bundle = File(currentSlot, BUNDLE_FILENAME)
+        if (!bundle.exists()) return null
+
+        // Integrity re-check on execution.
+        //
+        // The signature and hash are verified when a bundle is STAGED. That
+        // protects the download path, but it says nothing about the bytes still
+        // being the ones we installed: on a rooted device, anything able to write
+        // into app-private storage can replace current/bundle after the fact and
+        // the old `exists()` check would happily execute it.
+        //
+        // meta.json already records the sha256 the slot manager installed, so the
+        // comparison costs one hash of the active bundle per process — not per
+        // call, hence the cache. On mismatch we refuse the slot and return null,
+        // which makes the caller fall back to the bundle compiled into the APK.
+        // Failing closed to a known-good baseline is the only safe answer here.
+        verifiedBundlePath?.let { return if (it.exists()) it else null }
+        if (integrityFailed) return null
+
+        val expected = readMeta(currentSlot)?.optString("sha256", "").orEmpty()
+        if (expected.isEmpty()) {
+            // Pre-integrity install, or metadata lost. Nothing to compare against;
+            // do not invent a failure for a bundle that may be perfectly good.
+            Log.w(TAG, "current/ has no recorded sha256 — skipping integrity re-check")
+            verifiedBundlePath = bundle
+            return bundle
+        }
+
+        val actual = try {
+            sha256(bundle)
+        } catch (e: Exception) {
+            Log.e(TAG, "Integrity re-check could not hash current/ — refusing the slot", e)
+            integrityFailed = true
+            return null
+        }
+
+        if (!constantTimeEquals(actual, expected)) {
+            Log.e(
+                TAG,
+                "INTEGRITY FAILURE — current/ bundle does not match the sha256 recorded " +
+                    "at install (expected=${expected.take(12)}… actual=${actual.take(12)}…). " +
+                    "The bundle was modified after installation. Falling back to the " +
+                    "binary baseline and clearing the slot.",
+            )
+            integrityFailed = true
+            runCatching { currentSlot.deleteRecursively() }
+            return null
+        }
+
+        verifiedBundlePath = bundle
+        return bundle
+    }
+
+    /** Per-process memo so the active bundle is hashed once, not on every call. */
+    private var verifiedBundlePath: File? = null
+    private var integrityFailed = false
+
+    /** Length-independent comparison, so a mismatch leaks nothing through timing. */
+    private fun constantTimeEquals(a: String, b: String): Boolean {
+        if (a.length != b.length) return false
+        var diff = 0
+        for (i in a.indices) diff = diff or (a[i].code xor b[i].code)
+        return diff == 0
+    }
+
+    /**
+     * Stage a downloaded bundle into the 'next' slot.
+     *
+     * 1. Write to _tmp_{uuid}/
+     * 2. Compute SHA-256 and compare to expected hash
+     * 3. Atomic rename to next/ (after deleting old next/ if present)
+     *
+     * Returns true on success, false on hash mismatch or I/O error.
+     */
+    fun stage(sourcePath: File, expectedSha256: String, meta: JSONObject): Boolean =
+        synchronized(SLOT_LOCK) { stageLocked(sourcePath, expectedSha256, meta) }
+
+    private fun stageLocked(
+        sourcePath: File,
+        expectedSha256: String,
+        meta: JSONObject,
+    ): Boolean {
+        try {
+            otaRoot.mkdirs()
+
+            // Clean up any orphaned temp dirs
+            cleanupTempDirs()
+
+            val tmpDir = File(otaRoot, "_tmp_${UUID.randomUUID()}")
+            tmpDir.mkdirs()
+
+            val tmpBundle = File(tmpDir, BUNDLE_FILENAME)
+            sourcePath.copyTo(tmpBundle, overwrite = true)
+            // FIX #6: fsync the bundle before rename — design doc requires it.
+            // Without this, a power cut during rename could promote a torn file.
+            FileOutputStream(tmpBundle, true).use { it.fd.sync() }
+
+            // Verify SHA-256
+            val actualSha256 = sha256(tmpBundle)
+            if (actualSha256 != expectedSha256) {
+                Log.w(TAG, "SHA-256 mismatch: expected=$expectedSha256 actual=$actualSha256")
+                tmpDir.deleteRecursively()
+                return false
+            }
+
+            // Write meta.json
+            val tmpMeta = File(tmpDir, META_FILENAME)
+            tmpMeta.writeText(meta.toString())
+            // fsync meta.json too
+            FileOutputStream(tmpMeta, true).use { it.fd.sync() }
+
+            // Atomic rename: delete old next, rename tmp → next
+            nextSlot.deleteRecursively()
+            if (!tmpDir.renameTo(nextSlot)) {
+                Log.e(TAG, "Failed to rename $tmpDir to $nextSlot")
+                tmpDir.deleteRecursively()
+                return false
+            }
+
+            Log.i(TAG, "Staged bundle (sha256=${actualSha256.take(12)}…) to next/")
+            return true
+        } catch (e: Exception) {
+            Log.e(TAG, "stage() failed", e)
+            return false
+        }
+    }
+
+    /**
+     * Apply: promote next → current (and current → previous).
+     * Sets the boot guard marker. Returns true on success.
+     */
+    fun apply(): Boolean = synchronized(SLOT_LOCK) { applyLocked() }
+
+    private fun applyLocked(): Boolean {
+        try {
+            if (!nextSlot.exists()) {
+                Log.w(TAG, "apply() called but next/ does not exist")
+                return false
+            }
+
+            // 1. Delete previous/ if it exists
+            previousSlot.deleteRecursively()
+
+            // 2. current → previous
+            if (currentSlot.exists()) {
+                if (!currentSlot.renameTo(previousSlot)) {
+                    Log.e(TAG, "Failed to rename current → previous")
+                    return false
+                }
+            }
+
+            // 3. next → current
+            if (!nextSlot.renameTo(currentSlot)) {
+                Log.e(TAG, "Failed to rename next → current")
+                // Attempt recovery: previous → current
+                if (previousSlot.exists()) {
+                    previousSlot.renameTo(currentSlot)
+                }
+                return false
+            }
+
+            // 4. Write boot_marker
+            writeBootMarker()
+
+            Log.i(TAG, "Applied update — current/ now active")
+            return true
+        } catch (e: Exception) {
+            Log.e(TAG, "apply() failed", e)
+            return false
+        }
+    }
+
+    /**
+     * Mark the current bundle as healthy — clears the boot guard marker.
+     */
+    fun markHealthy() {
+        if (bootMarker.exists()) {
+            bootMarker.delete()
+            Log.i(TAG, "Boot marker cleared — bundle marked healthy")
+        }
+        // A bundle is only trusted for anti-downgrade once it has run healthily.
+        confirmCurrentSequence()
+    }
+
+    /**
+     * Revert to previous slot (boot-guard triggered or manual rollback).
+     *
+     * `reason` is persisted so JS can report WHY the device is no longer on the
+     * bundle it installed. Without it an auto-revert was invisible to the
+     * dashboard: `bootGuardReverted` was read by the orchestrator and written by
+     * nobody, so every crash-guard rollback recorded zero rollbacks.
+     */
+    @JvmOverloads
+    fun revert(reason: String? = null): Boolean = synchronized(SLOT_LOCK) { revertLocked(reason) }
+
+    private fun revertLocked(reason: String? = null): Boolean {
+        try {
+            if (reason != null) {
+                runCatching {
+                    otaRoot.mkdirs()
+                    // Stamp WHICH bundle is being reverted away from, read before
+                    // current/ is deleted below. Without it JS had nothing to name:
+                    // slot meta carries no bundleId and the previous slot is gone by
+                    // the time JS looks, so every AUTO_ROLLBACK reported bundleId
+                    // "unknown" and the server dropped it as unresolvable — leaving
+                    // the crash guard's own rollback signal permanently at zero.
+                    val failingSha = readMeta(currentSlot)?.optString("sha256", "").orEmpty()
+                    revertRecord.writeText(
+                        JSONObject()
+                            .put("reason", reason)
+                            .put("at", System.currentTimeMillis())
+                            .apply { if (failingSha.isNotEmpty()) put("sha256", failingSha) }
+                            .toString(),
+                    )
+                }
+            }
+            if (!previousSlot.exists()) {
+                Log.w(TAG, "No previous/ to revert to — clearing current/")
+                currentSlot.deleteRecursively()
+                bootMarker.delete()
+                nextSlot.deleteRecursively()
+                return true // Will fall through to Metro bundle
+            }
+
+            // 1. Delete current/ (may be corrupt)
+            currentSlot.deleteRecursively()
+
+            // 2. previous → current
+            if (!previousSlot.renameTo(currentSlot)) {
+                Log.e(TAG, "Failed to rename previous → current")
+                return false
+            }
+
+            // 3. Delete marker
+            bootMarker.delete()
+
+            // 4. Delete stale next/
+            nextSlot.deleteRecursively()
+
+            Log.i(TAG, "Reverted to previous bundle")
+            return true
+        } catch (e: Exception) {
+            Log.e(TAG, "revert() failed", e)
+            return false
+        }
+    }
+
+    /**
+     * Boot guard check — called BEFORE JS loads.
+     *
+     * If the boot marker exists and current/meta.json doesn't match the
+     * marker's bundleId, the bundle is corrupt → auto-revert.
+     */
+    fun checkBootGuard() {
+        if (!bootMarker.exists()) return
+
+        try {
+            val markerJson = JSONObject(bootMarker.readText())
+            // Read the marker's sha256, falling back to the legacy `bundleId`
+            // field so a marker written by a previous build is still readable.
+            val markerId = markerJson.optString("sha256", "")
+                .ifEmpty { markerJson.optString("bundleId", "") }
+
+            val metaFile = File(currentSlot, META_FILENAME)
+            if (!metaFile.exists()) {
+                Log.w(TAG, "Boot marker present but no current/meta.json — auto-reverting")
+                revert(reason = "missing_meta")
+                return
+            }
+
+            val currentMeta = JSONObject(metaFile.readText())
+            val currentId = currentMeta.optString("sha256", "")
+
+            // Both sides must be non-empty for the comparison to mean anything.
+            // Treating "" == "" as a match is what made this check vacuous
+            // before; treating "" != "x" as corruption would revert every
+            // bundle staged by an older build. So: compare only when we have
+            // two real values, and say so plainly when we do not.
+            if (markerId.isEmpty() || currentId.isEmpty()) {
+                Log.w(
+                    TAG,
+                    "Boot guard cannot verify this bundle — marker or meta has no sha256. " +
+                        "Leaving it in place; restage with a current SDK to re-enable the check.",
+                )
+                return
+            }
+            if (currentId != markerId) {
+                Log.w(TAG, "Boot marker sha256 mismatch — auto-reverting")
+                revert(reason = "hash_mismatch")
+                return
+            }
+
+            // ── Crash-loop revert ────────────────────────────────────────────
+            // Matching hashes mean the bundle is INTACT, which says nothing
+            // about whether it RUNS. A bundle that throws at JS init installs
+            // cleanly, matches every boot, and never reaches markHealthy() — so
+            // a hash-only guard let it crash-loop forever, bricking the app
+            // until reinstall. That is the exact failure an OTA boot guard
+            // exists to prevent.
+            //
+            // The marker is therefore also a boot-attempt counter: every launch
+            // that starts with the marker still present increments it. Reaching
+            // the limit means the bundle has been given MAX_BOOT_ATTEMPTS
+            // chances to call markHealthy() and never did → revert.
+            // A DELIBERATE restart is not a failed boot.
+            //
+            // The counter cannot tell "the bundle crashed on startup" from "the
+            // app restarted itself on purpose" — both simply arrive with the
+            // marker still present. So an update that installs and then restarts
+            // to activate spends one of its two lives immediately, and any second
+            // restart inside the healthy window spends the other and reverts a
+            // bundle that was never broken. Observed live: six full 19MB
+            // downloads and five reverts before one cycle happened to survive.
+            //
+            // restart() records its intent here first. That boot is expected, so
+            // it is not counted; the flag is one-shot, so a crash on the very
+            // next launch still counts and a genuinely broken bundle still goes.
+            if (markerJson.optBoolean("intentionalRestart", false)) {
+                markerJson.remove("intentionalRestart")
+                bootMarker.writeText(markerJson.toString())
+                FileOutputStream(bootMarker, true).use { it.fd.sync() }
+                Log.i(TAG, "Boot guard: expected restart, not counted as a failed boot")
+                return
+            }
+            val attempts = markerJson.optInt("bootAttempts", 0) + 1
+            if (attempts >= MAX_BOOT_ATTEMPTS) {
+                Log.w(
+                    TAG,
+                    "Bundle failed to become healthy in $attempts launch(es) — auto-reverting",
+                )
+                revert(reason = "boot_crash_guard")
+                return
+            }
+            markerJson.put("bootAttempts", attempts)
+            bootMarker.writeText(markerJson.toString())
+            FileOutputStream(bootMarker, true).use { it.fd.sync() }
+            Log.i(TAG, "Boot guard: attempt $attempts/$MAX_BOOT_ATTEMPTS for this bundle")
+        } catch (e: Exception) {
+            Log.e(TAG, "checkBootGuard() failed — reverting to be safe", e)
+            revert(reason = "boot_guard_error")
+        }
+    }
+
+    /**
+     * Returns the current slot state as a JSON object.
+     */
+    fun slotState(): JSONObject {
+        val state = JSONObject()
+        state.put("current", readMeta(currentSlot))
+        state.put("next", readMeta(nextSlot))
+        state.put("previous", readMeta(previousSlot))
+        state.put("bootMarkerPresent", bootMarker.exists())
+        // Consume-on-read: the orchestrator turns this into an AUTO_ROLLBACK
+        // event exactly once, then the record is gone. Leaving it in place would
+        // re-report the same rollback on every subsequent launch.
+        if (revertRecord.exists()) {
+            runCatching {
+                val rec = JSONObject(revertRecord.readText())
+                state.put("bootGuardReverted", true)
+                state.put("bootGuardRevertReason", rec.optString("reason", "boot_crash_guard"))
+                state.put("bootGuardRevertedAt", rec.optLong("at", 0L))
+                // The bundle reverted AWAY from. JS joins it back to a bundle id
+                // through its install record so the rollback can be reported.
+                val sha = rec.optString("sha256", "")
+                if (sha.isNotEmpty()) state.put("bootGuardRevertedSha256", sha)
+            }
+            revertRecord.delete()
+        }
+        return state
+    }
+
+    // ── Private helpers ─────────────────────────────────────────────────────
+
+    private fun writeBootMarker() {
+        val meta = readMeta(currentSlot)
+        if (meta != null) {
+            val marker = JSONObject()
+            // Identify the bundle by its SHA-256, not by `bundleId`.
+            //
+            // `stageBundle` writes a meta.json containing only `sha256` and
+            // `installedAt` — it is never told the bundleId. So this used to
+            // record an empty string, checkBootGuard() then compared that empty
+            // string against another empty string read from the same absent
+            // field, they were always equal, and the corruption check could
+            // never fire. The guard's most important comparison was a no-op.
+            //
+            // sha256 is the field that is actually present, and it is a
+            // strictly better identity for this purpose anyway: it detects a
+            // bundle whose CONTENT changed, not merely one whose id differs.
+            marker.put("sha256", meta.optString("sha256"))
+            marker.put("appliedAt", System.currentTimeMillis())
+            otaRoot.mkdirs()
+            bootMarker.writeText(marker.toString())
+            FileOutputStream(bootMarker, true).use { it.fd.sync() }
+        }
+    }
+
+    /** The installed bundle as a SIGNED patch base. See [readSignedBase]. */
+    class SignedBase(
+        val bytes: ByteArray,
+        val sha256: String,
+        val bundleId: String?,
+        val releaseSequence: Long,
+    )
+
+    /**
+     * The current bundle as a base for a SIGNED patch — or null when it cannot be one.
+     *
+     * A patch's own bytes are unsigned; what makes the rebuilt bundle trustworthy is that its hash
+     * equals the SIGNED release's. That only holds if the base is what we think it is, so the base
+     * has to be proven too:
+     *  - it came through the signed path: its meta carries `releaseSequence`, which only
+     *    verifyAndStageRelease writes. A bundle installed by the unsigned path never qualifies.
+     *  - its bytes still hash to the sha256 recorded when it was verified — computed on the SAME
+     *    buffer that is returned, so the bytes hashed are exactly the bytes patched (no re-read,
+     *    no window to swap the file between check and use).
+     *  - it is read under [SLOT_LOCK]: stage/apply/revert move these directories, and reading the
+     *    slot while another thread swaps it is the race that bricked two devices on 2026-09-21.
+     */
+    fun readSignedBase(): SignedBase? = synchronized(SLOT_LOCK) {
+        val meta = readMeta(currentSlot) ?: return@synchronized null
+        val sequence = meta.optLong("releaseSequence", -1L)
+        if (sequence < 0) return@synchronized null
+        val recorded = meta.optString("sha256", "")
+        if (recorded.isEmpty()) return@synchronized null
+        val file = File(currentSlot, BUNDLE_FILENAME)
+        if (!file.exists()) return@synchronized null
+        val bytes = file.readBytes()
+        val digest = MessageDigest.getInstance("SHA-256").digest(bytes)
+        val actual = digest.joinToString("") { "%02x".format(it) }
+        if (!actual.equals(recorded, ignoreCase = true)) {
+            Log.w(TAG, "readSignedBase: current bundle no longer matches its recorded hash")
+            return@synchronized null
+        }
+        SignedBase(bytes, actual, meta.optString("bundleId", "").ifEmpty { null }, sequence)
+    }
+
+    private fun readMeta(slot: File): JSONObject? {
+        val metaFile = File(slot, META_FILENAME)
+        if (!metaFile.exists()) return null
+        return try {
+            JSONObject(metaFile.readText())
+        } catch (e: Exception) {
+            null
+        }
+    }
+
+    private fun cleanupTempDirs() {
+        otaRoot.listFiles()?.filter { it.isDirectory && it.name.startsWith("_tmp_") }
+            ?.forEach {
+                Log.d(TAG, "Cleaning up orphaned temp dir: ${it.name}")
+                it.deleteRecursively()
+            }
+    }
+
+    private fun sha256(file: File): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        FileInputStream(file).use { fis ->
+            val buffer = ByteArray(8192)
+            var bytesRead = fis.read(buffer)
+            while (bytesRead != -1) {
+                digest.update(buffer, 0, bytesRead)
+                bytesRead = fis.read(buffer)
+            }
+        }
+        return digest.digest().joinToString("") { "%02x".format(it) }
+    }
+}