@vantran-se/openchamber-web 1.24.4 → 2.0.2

package/server/lib/package-manager.js

@@ -11,12 +11,10 @@ const __dirname = path.dirname(__filename);
 
 const PACKAGE_NAME = '@vantran-se/openchamber-web';
 const PACKAGE_PATH_SEGMENTS = PACKAGE_NAME.split('/');
-const PACKAGE_REGISTRY_URL = 'https://registry.npmjs.org';
-const UPSTREAM_NPM_REGISTRY_URL = 'https://registry.npmjs.org/@openchamber%2Fweb';
+const NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME.replace('/', '%2F')}`;
+const GITHUB_RELEASES_URL = 'https://github.com/openchamber/openchamber/releases';
+const GITHUB_RELEASES_API_URL = 'https://api.github.com/repos/openchamber/openchamber/releases';
 const FORK_RELEASES_URL = 'https://github.com/vantran-se/openchamber/releases';
-const FORK_LATEST_RELEASE_API_URL = 'https://api.github.com/repos/vantran-se/openchamber/releases/latest';
-const UPSTREAM_RELEASES_URL = 'https://github.com/openchamber/openchamber/releases';
-const UPSTREAM_RELEASES_API_URL = 'https://api.github.com/repos/openchamber/openchamber/releases';
 let cachedDetectedPm = null;
 
 function getSpawnSyncBaseOptions() {
@@ -99,7 +97,7 @@ async function resolveAndroidApkUrl(version, candidateUrl) {
   }
 
   try {
-    const response = await fetch(`${UPSTREAM_RELEASES_API_URL}/tags/v${version}`, {
+    const response = await fetch(`${GITHUB_RELEASES_API_URL}/tags/v${version}`, {
       headers: {
         Accept: 'application/vnd.github+json',
         'User-Agent': 'openchamber-update-check',
@@ -161,7 +159,7 @@ async function checkForUpdatesFromApi(currentVersion, options = {}) {
     const versionComparison = compareVersions(data.latestVersion, currentVersion);
     if (versionComparison < 0) return null;
 
-    const releaseUrl = `${UPSTREAM_RELEASES_URL}/tag/v${data.latestVersion}`;
+    const releaseUrl = `${GITHUB_RELEASES_URL}/tag/v${data.latestVersion}`;
     const downloadUrl = typeof data.downloadUrl === 'string'
       ? data.downloadUrl
       : typeof data.download?.url === 'string'
@@ -661,13 +659,27 @@ export function getUpdateCommand(pm = detectPackageManager()) {
   const pmCommand = quoteCommand(resolvePackageManagerCommand(pm));
   switch (pm) {
     case 'pnpm':
-      return `${pmCommand} add -g ${PACKAGE_NAME}@latest --registry=${PACKAGE_REGISTRY_URL}`;
+      return `${pmCommand} add -g ${PACKAGE_NAME}@latest`;
     case 'yarn':
-      return `${pmCommand} global add ${PACKAGE_NAME}@latest --registry ${PACKAGE_REGISTRY_URL}`;
+      return `${pmCommand} global add ${PACKAGE_NAME}@latest`;
     case 'bun':
-      return `${pmCommand} add -g ${PACKAGE_NAME}@latest --registry=${PACKAGE_REGISTRY_URL}`;
+      return `${pmCommand} add -g ${PACKAGE_NAME}@latest`;
     default:
-      return `${pmCommand} install -g ${PACKAGE_NAME}@latest --registry=${PACKAGE_REGISTRY_URL}`;
+      return `${pmCommand} install -g ${PACKAGE_NAME}@latest`;
+  }
+}
+
+function getUpdateInvocation(pm = detectPackageManager()) {
+  const command = resolvePackageManagerCommand(pm);
+  switch (pm) {
+    case 'pnpm':
+      return { command, args: ['add', '-g', `${PACKAGE_NAME}@latest`] };
+    case 'yarn':
+      return { command, args: ['global', 'add', `${PACKAGE_NAME}@latest`] };
+    case 'bun':
+      return { command, args: ['add', '-g', `${PACKAGE_NAME}@latest`] };
+    default:
+      return { command, args: ['install', '-g', `${PACKAGE_NAME}@latest`] };
   }
 }
 
@@ -687,9 +699,9 @@ export function getCurrentVersion() {
 /**
  * Fetch latest version from npm registry
  */
-async function getLatestUpstreamVersion() {
+async function getLatestVersion() {
   try {
-    const response = await fetch(UPSTREAM_NPM_REGISTRY_URL, {
+    const response = await fetch(NPM_REGISTRY_URL, {
       headers: { Accept: 'application/json' },
       signal: AbortSignal.timeout(10000),
     });
@@ -700,34 +712,7 @@ async function getLatestUpstreamVersion() {
 
     const data = await response.json();
     return data['dist-tags']?.latest || null;
-  } catch {
-    return null;
-  }
-}
-
-async function getLatestForkRelease() {
-  try {
-    const response = await fetch(FORK_LATEST_RELEASE_API_URL, {
-      headers: {
-        Accept: 'application/vnd.github+json',
-        'User-Agent': 'openchamber-update-check',
-      },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!response.ok) return null;
-
-    const release = await response.json();
-    const tagName = String(release?.tag_name || '');
-    const versionMatch = tagName.match(/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/);
-    if (!versionMatch) return null;
-
-    const releaseBody = String(release?.body || '').trim();
-    return {
-      version: versionMatch[1],
-      body: releaseBody || undefined,
-      releaseUrl: `${FORK_RELEASES_URL}/tag/v${versionMatch[1]}`,
-    };
-  } catch {
+  } catch (error) {
     return null;
   }
 }
@@ -778,39 +763,40 @@ export async function checkForUpdates(options = {}) {
   const appType = normalizeAppType(options.appType);
   const platform = normalizePlatform(options.platform);
 
-  if (appType !== 'web' && currentVersion !== 'unknown') {
+  if (currentVersion !== 'unknown') {
     const remote = await checkForUpdatesFromApi(currentVersion, options);
     if (remote) {
-      return {
-        ...remote,
-        packageManager: pm,
-        updateCommand: 'openchamber update',
-      };
-    }
-  }
+      if (appType !== 'web') {
+        return {
+          ...remote,
+          packageManager: pm,
+          updateCommand: 'openchamber update',
+        };
+      }
+
+      const latestVersion = await getLatestVersion();
+      if (!latestVersion) {
+        return {
+          available: false,
+          currentVersion,
+          error: 'Unable to determine versions',
+        };
+      }
 
-  if (appType === 'web') {
-    const release = await getLatestForkRelease();
-    if (!release || currentVersion === 'unknown') {
+      const available = compareVersions(latestVersion, currentVersion) > 0;
       return {
-        available: false,
+        available,
+        version: latestVersion,
         currentVersion,
-        error: 'Unable to determine versions',
+        body: available && remote.version === latestVersion ? remote.body : undefined,
+        releaseUrl: `${FORK_RELEASES_URL}/tag/v${latestVersion}`,
+        packageManager: pm,
+        updateCommand: 'openchamber update',
       };
     }
-
-    return {
-      available: compareVersions(release.version, currentVersion) > 0,
-      version: release.version,
-      currentVersion,
-      body: release.body,
-      releaseUrl: release.releaseUrl,
-      packageManager: pm,
-      updateCommand: 'openchamber update',
-    };
   }
 
-  const latestVersion = await getLatestUpstreamVersion();
+  const latestVersion = await getLatestVersion();
 
   if (!latestVersion || currentVersion === 'unknown') {
     return {
@@ -835,9 +821,10 @@ export async function checkForUpdates(options = {}) {
     version: latestVersion,
     currentVersion,
     body: changelog,
-    releaseUrl: `${UPSTREAM_RELEASES_URL}/tag/v${latestVersion}`,
+    releaseUrl: `${FORK_RELEASES_URL}/tag/v${latestVersion}`,
     downloadUrl,
     packageManager: pm,
+    // Show our CLI command, not raw package manager command
     updateCommand: 'openchamber update',
   };
 }
@@ -847,14 +834,14 @@ export async function checkForUpdates(options = {}) {
  */
 export function executeUpdate(pm = detectPackageManager(), options = {}) {
   const command = getUpdateCommand(pm);
+  const invocation = getUpdateInvocation(pm);
   if (!options?.silent) {
     console.log(`Updating ${PACKAGE_NAME} using ${pm}...`);
     console.log(`Running: ${command}`);
   }
 
-  const result = spawnSync(command, {
+  const result = spawnSync(invocation.command, invocation.args, {
     stdio: 'inherit',
-    shell: true,
     ...getSpawnSyncBaseOptions(),
   });
 

package/server/lib/package-manager.test.js

@@ -1,5 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { spawnSync } from 'node:child_process';
 
+// Mock child_process to prevent real spawnSync calls that would hang in tests
 vi.mock('node:child_process', () => ({
   spawn: vi.fn(),
   spawnSync: vi.fn(() => ({ status: 0, stdout: '/usr/local/bin', stderr: '' })),
@@ -13,22 +15,46 @@ const {
   getUpdateCommand,
 } = await import('./package-manager.js');
 
+/** Helper: create a fetch mock that routes by URL pattern */
 function createFetchMock() {
   const handlers = new Map();
-  const mock = vi.fn((url) => {
-    const urlString = String(url);
+
+  const mock = vi.fn((url, options) => {
+    const urlStr = typeof url === 'string' ? url : url.toString();
+
     for (const [pattern, response] of handlers) {
-      if (urlString.includes(pattern)) return Promise.resolve(response);
+      if (urlStr.includes(pattern)) {
+        return Promise.resolve(response);
+      }
     }
-    return Promise.reject(new Error(`Unexpected fetch call: ${urlString}`));
+
+    return Promise.reject(new Error(`Unexpected fetch call: ${urlStr}`));
   });
+
   mock.when = (pattern, response) => {
     handlers.set(pattern, response);
     return mock;
   };
+
   return mock;
 }
 
+describe('fork package update command', () => {
+  it('targets the published fork without a runtime environment override', () => {
+    expect(getUpdateCommand('npm')).toBe('npm install -g @vantran-se/openchamber-web@latest');
+  });
+
+  it('executes the package manager without a shell', () => {
+    spawnSync.mockClear();
+    executeUpdate('npm', { silent: true });
+    expect(spawnSync).toHaveBeenCalledWith(
+      'npm',
+      ['install', '-g', '@vantran-se/openchamber-web@latest'],
+      expect.not.objectContaining({ shell: true }),
+    );
+  });
+});
+
 describe('checkForUpdates', () => {
   let fetchMock;
   let originalFetch;
@@ -43,86 +69,97 @@ describe('checkForUpdates', () => {
     globalThis.fetch = originalFetch;
   });
 
-  it('uses the latest fork release for web updates', async () => {
-    fetchMock.when('api.github.com/repos/vantran-se/openchamber/releases/latest', {
-      ok: true,
-      json: async () => ({
-        tag_name: 'v1.22.1',
-        body: 'Fork release notes',
-      }),
-    });
-
-    const result = await checkForUpdates({ currentVersion: '1.22.0' });
+  // --- Scenario: API says update available, npm confirms ---
 
-    expect(result).toMatchObject({
-      available: true,
-      version: '1.22.1',
-      currentVersion: '1.22.0',
-      body: 'Fork release notes',
-      releaseUrl: 'https://github.com/vantran-se/openchamber/releases/tag/v1.22.1',
-      updateCommand: 'openchamber update',
-    });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('reports no web update when the fork release matches the installed version', async () => {
-    fetchMock.when('api.github.com/repos/vantran-se/openchamber/releases/latest', {
-      ok: true,
-      json: async () => ({ tag_name: 'v1.22.0' }),
-    });
+  it('returns available=true when both API and npm confirm a newer version', async () => {
+    fetchMock
+      .when('api.openchamber.dev', {
+        ok: true,
+        json: async () => ({
+          latestVersion: '1.10.0',
+          updateAvailable: true,
+          releaseNotes: '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+        }),
+      })
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.10.0' },
+        }),
+      })
+      .when('raw.githubusercontent.com', {
+        ok: true,
+        text: async () => '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+      });
 
-    const result = await checkForUpdates({ currentVersion: '1.22.0' });
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
 
-    expect(result.available).toBe(false);
-    expect(result.version).toBe('1.22.0');
+    expect(result.available).toBe(true);
+    expect(result.version).toBe('1.10.0');
+    expect(result.currentVersion).toBe('1.9.10');
   });
 
-  it('does not offer a prerelease over the matching stable version', async () => {
-    fetchMock.when('api.github.com/repos/vantran-se/openchamber/releases/latest', {
-      ok: true,
-      json: async () => ({ tag_name: 'v1.22.0-beta.1' }),
-    });
+  // --- Scenario (THE FIX): API says update available, npm does NOT have it ---
 
-    const result = await checkForUpdates({ currentVersion: '1.22.0' });
+  it('returns available=false when API claims update but npm has same version', async () => {
+    fetchMock
+      .when('api.openchamber.dev', {
+        ok: true,
+        json: async () => ({
+          latestVersion: '1.10.0',
+          updateAvailable: true,
+          releaseNotes: '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+        }),
+      })
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.9.10' },
+        }),
+      });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
 
     expect(result.available).toBe(false);
   });
 
-  it('fails explicitly when the fork release cannot be resolved', async () => {
-    fetchMock.when('api.github.com/repos/vantran-se/openchamber/releases/latest', {
-      ok: false,
-      status: 404,
-    });
+  it('returns available=false when npm only has a prerelease of the current version', async () => {
+    fetchMock
+      .when('api.openchamber.dev', Promise.reject(new Error('Network error')))
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.10.0-beta.1' },
+        }),
+      });
 
-    const result = await checkForUpdates({ currentVersion: '1.22.0' });
+    const result = await checkForUpdates({ currentVersion: '1.10.0' });
 
-    expect(result).toMatchObject({
-      available: false,
-      currentVersion: '1.22.0',
-      error: 'Unable to determine versions',
-    });
+    expect(result.available).toBe(false);
   });
 
-  it('keeps the central update API for desktop runtimes', async () => {
-    fetchMock.when('api.openchamber.dev', {
-      ok: true,
-      json: async () => ({
-        latestVersion: '1.22.1',
-        updateAvailable: true,
-        releaseNotes: 'Desktop release notes',
-      }),
-    });
+  it('accepts electron desktop update claims without npm cross-checking', async () => {
+    fetchMock
+      .when('api.openchamber.dev', {
+        ok: true,
+        json: async () => ({
+          latestVersion: '1.10.0',
+          updateAvailable: true,
+          releaseNotes: '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+        }),
+      });
 
     const result = await checkForUpdates({
       appType: 'desktop-electron',
-      currentVersion: '1.22.0',
+      currentVersion: '1.9.10',
       installId: '4f4dfead-9688-4c4f-97d7-4607fbbfc3ab',
       platform: 'windows',
       arch: 'arm64',
     });
 
     expect(result.available).toBe(true);
-    expect(result.version).toBe('1.22.1');
+    expect(result.version).toBe('1.10.0');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toMatchObject({
       installId: '4f4dfead-9688-4c4f-97d7-4607fbbfc3ab',
       platform: 'windows',
@@ -130,23 +167,31 @@ describe('checkForUpdates', () => {
     });
   });
 
-  it('resolves an Android APK asset for mobile updates', async () => {
+  it('resolves an Android APK asset when the update API returns an AAB', async () => {
     fetchMock
       .when('api.openchamber.dev', {
         ok: true,
         json: async () => ({
-          latestVersion: '1.22.1',
+          latestVersion: '1.10.0',
           updateAvailable: true,
-          downloadUrl: 'https://github.com/openchamber/openchamber/releases/download/v1.22.1/OpenChamber-1.22.1-42-android.aab',
+          downloadUrl: 'https://github.com/openchamber/openchamber/releases/download/v1.10.0/OpenChamber-1.10.0-42-android.aab',
         }),
       })
-      .when('api.github.com/repos/openchamber/openchamber/releases/tags/v1.22.1', {
+      .when('api.github.com/repos/openchamber/openchamber/releases/tags/v1.10.0', {
         ok: true,
         json: async () => ({
           assets: [
             {
-              name: 'OpenChamber-1.22.1-42-android.apk',
-              browser_download_url: 'https://downloads.example/OpenChamber-1.22.1-42-android.apk',
+              name: 'OpenChamber-1.10.0-42-android.aab',
+              browser_download_url: 'https://downloads.example/OpenChamber-1.10.0-42-android.aab',
+            },
+            {
+              name: 'app-release.apk',
+              browser_download_url: 'https://downloads.example/app-release.apk',
+            },
+            {
+              name: 'OpenChamber-1.10.0-42-android.apk',
+              browser_download_url: 'https://downloads.example/OpenChamber-1.10.0-42-android.apk',
             },
           ],
         }),
@@ -155,18 +200,139 @@ describe('checkForUpdates', () => {
     const result = await checkForUpdates({
       appType: 'mobile-capacitor',
       platform: 'android',
-      currentVersion: '1.22.0',
+      currentVersion: '1.9.10',
     });
 
-    expect(result.downloadUrl).toBe('https://downloads.example/OpenChamber-1.22.1-42-android.apk');
+    expect(result.downloadUrl).toBe('https://downloads.example/OpenChamber-1.10.0-42-android.apk');
   });
-});
 
-describe('getUpdateCommand', () => {
-  it('installs the public fork package from npm', () => {
-    expect(getUpdateCommand('npm')).toBe(
-      'npm install -g @vantran-se/openchamber-web@latest --registry=https://registry.npmjs.org',
-    );
+  it('keeps a direct Android APK URL from the update API', async () => {
+    const apkUrl = 'https://github.com/openchamber/openchamber/releases/download/v1.10.0/OpenChamber-1.10.0-42-android.apk';
+    fetchMock.when('api.openchamber.dev', {
+      ok: true,
+      json: async () => ({
+        latestVersion: '1.10.0',
+        updateAvailable: true,
+        downloadUrl: apkUrl,
+      }),
+    });
+
+    const result = await checkForUpdates({
+      appType: 'mobile-capacitor',
+      platform: 'android',
+      currentVersion: '1.9.10',
+    });
+
+    expect(result.downloadUrl).toBe(apkUrl);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns available=false when API claims update but npm is behind', async () => {
+    fetchMock
+      .when('api.openchamber.dev', {
+        ok: true,
+        json: async () => ({
+          latestVersion: '1.10.0',
+          updateAvailable: true,
+          releaseNotes: '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+        }),
+      })
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.9.9' },
+        }),
+      });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(false);
+  });
+
+  // --- Scenario: API says no update, npm agrees ---
+
+  it('returns available=false when API says no update and versions match', async () => {
+    fetchMock.when('api.openchamber.dev', {
+      ok: true,
+      json: async () => ({
+        latestVersion: '1.9.10',
+        updateAvailable: false,
+      }),
+    });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(false);
+  });
+
+  // --- Scenario: API unreachable, npm fallback ---
+
+  it('returns available=true from npm fallback when API is unreachable and npm has newer version', async () => {
+    fetchMock
+      .when('api.openchamber.dev', Promise.reject(new Error('Network error')))
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.10.0' },
+        }),
+      })
+      .when('raw.githubusercontent.com', {
+        ok: true,
+        text: async () => '## [1.10.0] - 2026-05-01\n\n- Great new feature',
+      });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(true);
+    expect(result.version).toBe('1.10.0');
+  });
+
+  it('returns available=false from npm fallback when API is unreachable and versions match', async () => {
+    fetchMock
+      .when('api.openchamber.dev', Promise.reject(new Error('Network error')))
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.9.10' },
+        }),
+      });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(false);
+  });
+
+  // --- Scenario: API returns null (bad response), npm fallback ---
+
+  it('returns available=false when API returns non-ok status and versions match on npm', async () => {
+    fetchMock
+      .when('api.openchamber.dev', {
+        ok: false,
+        status: 500,
+        json: async () => ({}),
+      })
+      .when('registry.npmjs.org', {
+        ok: true,
+        json: async () => ({
+          'dist-tags': { latest: '1.9.10' },
+        }),
+      });
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(false);
+  });
+
+  // --- Scenario: Both API and npm are unreachable ---
+
+  it('returns available=false when both sources are unreachable', async () => {
+    fetchMock
+      .when('api.openchamber.dev', Promise.reject(new Error('Network error')))
+      .when('registry.npmjs.org', Promise.reject(new Error('Registry unreachable')));
+
+    const result = await checkForUpdates({ currentVersion: '1.9.10' });
+
+    expect(result.available).toBe(false);
   });
 });