afterpresets 0.2.0 → 0.3.0

package/native-runtime/src/crypto.cpp

@@ -0,0 +1,225 @@
+#include "crypto.hpp"
+
+#include <cstdio>
+#include <cstring>
+
+extern "C" {
+#include "monocypher-ed25519.h"
+}
+
+namespace apn {
+
+namespace {
+
+constexpr uint32_t K[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
+
+inline uint32_t rotr(uint32_t x, int n) { return (x >> n) | (x << (32 - n)); }
+
+// Ed25519 SubjectPublicKeyInfo prefix: SEQUENCE { SEQUENCE { OID 1.3.101.112 } BIT STRING (33) }.
+constexpr uint8_t SPKI_PREFIX[12] = {0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00};
+
+std::string trim(const std::string &s) {
+    size_t a = 0, b = s.size();
+    while (a < b && (s[a] == ' ' || s[a] == '\t' || s[a] == '\r' || s[a] == '\n')) a++;
+    while (b > a && (s[b - 1] == ' ' || s[b - 1] == '\t' || s[b - 1] == '\r' || s[b - 1] == '\n')) b--;
+    return s.substr(a, b - a);
+}
+
+std::optional<PublicKey> key_from_der(const std::vector<uint8_t> &der) {
+    PublicKey key{};
+    if (der.size() == 32) {
+        std::memcpy(key.data(), der.data(), 32);
+        return key;
+    }
+    if (der.size() == 44 && std::memcmp(der.data(), SPKI_PREFIX, sizeof SPKI_PREFIX) == 0) {
+        std::memcpy(key.data(), der.data() + 12, 32);
+        return key;
+    }
+    return std::nullopt;
+}
+
+std::optional<PublicKey> key_from_pem(const std::string &pem) {
+    const std::string begin = "-----BEGIN PUBLIC KEY-----";
+    const std::string end = "-----END PUBLIC KEY-----";
+    size_t a = pem.find(begin);
+    size_t b = pem.find(end);
+    if (a == std::string::npos || b == std::string::npos || b < a) return std::nullopt;
+    auto der = base64_decode(pem.substr(a + begin.size(), b - a - begin.size()));
+    if (!der) return std::nullopt;
+    return key_from_der(*der);
+}
+
+}  // namespace
+
+Sha256::Sha256() {
+    static constexpr uint32_t init[8] = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+                                         0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+    std::memcpy(h_, init, sizeof h_);
+}
+
+void Sha256::block(const uint8_t *p) {
+    uint32_t w[64];
+    for (int i = 0; i < 16; i++) {
+        w[i] = (uint32_t)p[i * 4] << 24 | (uint32_t)p[i * 4 + 1] << 16 | (uint32_t)p[i * 4 + 2] << 8 | p[i * 4 + 3];
+    }
+    for (int i = 16; i < 64; i++) {
+        uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3);
+        uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10);
+        w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+    }
+    uint32_t a = h_[0], b = h_[1], c = h_[2], d = h_[3], e = h_[4], f = h_[5], g = h_[6], h = h_[7];
+    for (int i = 0; i < 64; i++) {
+        uint32_t S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+        uint32_t ch = (e & f) ^ (~e & g);
+        uint32_t t1 = h + S1 + ch + K[i] + w[i];
+        uint32_t S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+        uint32_t maj = (a & b) ^ (a & c) ^ (b & c);
+        uint32_t t2 = S0 + maj;
+        h = g; g = f; f = e; e = d + t1; d = c; c = b; b = a; a = t1 + t2;
+    }
+    h_[0] += a; h_[1] += b; h_[2] += c; h_[3] += d; h_[4] += e; h_[5] += f; h_[6] += g; h_[7] += h;
+}
+
+void Sha256::update(const void *data, size_t size) {
+    const uint8_t *p = static_cast<const uint8_t *>(data);
+    total_ += size;
+    if (buf_len_) {
+        size_t take = 64 - buf_len_ < size ? 64 - buf_len_ : size;
+        std::memcpy(buf_ + buf_len_, p, take);
+        buf_len_ += take; p += take; size -= take;
+        if (buf_len_ == 64) { block(buf_); buf_len_ = 0; }
+    }
+    while (size >= 64) { block(p); p += 64; size -= 64; }
+    if (size) { std::memcpy(buf_, p, size); buf_len_ = size; }
+}
+
+std::array<uint8_t, 32> Sha256::digest() {
+    uint64_t bits = total_ * 8;
+    uint8_t pad = 0x80;
+    update(&pad, 1);
+    uint8_t zero = 0;
+    while (buf_len_ != 56) update(&zero, 1);
+    uint8_t len[8];
+    for (int i = 0; i < 8; i++) len[i] = (uint8_t)(bits >> (56 - 8 * i));
+    update(len, 8);
+    std::array<uint8_t, 32> out{};
+    for (int i = 0; i < 8; i++) {
+        out[i * 4] = (uint8_t)(h_[i] >> 24); out[i * 4 + 1] = (uint8_t)(h_[i] >> 16);
+        out[i * 4 + 2] = (uint8_t)(h_[i] >> 8); out[i * 4 + 3] = (uint8_t)h_[i];
+    }
+    return out;
+}
+
+std::string Sha256::hex_digest() {
+    auto d = digest();
+    return to_hex(d.data(), d.size());
+}
+
+std::string sha256_hex(const std::string &data) {
+    Sha256 h;
+    h.update(data);
+    return h.hex_digest();
+}
+
+std::optional<std::string> sha256_file_hex(const std::string &path) {
+    FILE *f = std::fopen(path.c_str(), "rb");
+    if (!f) return std::nullopt;
+    Sha256 h;
+    std::vector<uint8_t> buf(1 << 16);
+    size_t n;
+    while ((n = std::fread(buf.data(), 1, buf.size(), f)) > 0) h.update(buf.data(), n);
+    bool failed = std::ferror(f) != 0;
+    std::fclose(f);
+    if (failed) return std::nullopt;
+    return h.hex_digest();
+}
+
+std::string to_hex(const uint8_t *data, size_t size) {
+    static const char digits[] = "0123456789abcdef";
+    std::string out(size * 2, '0');
+    for (size_t i = 0; i < size; i++) {
+        out[i * 2] = digits[data[i] >> 4];
+        out[i * 2 + 1] = digits[data[i] & 15];
+    }
+    return out;
+}
+
+std::string base64_encode(const uint8_t *data, size_t size) {
+    static const char tbl[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    std::string out;
+    out.reserve((size + 2) / 3 * 4);
+    for (size_t i = 0; i < size; i += 3) {
+        uint32_t v = (uint32_t)data[i] << 16;
+        if (i + 1 < size) v |= (uint32_t)data[i + 1] << 8;
+        if (i + 2 < size) v |= data[i + 2];
+        out += tbl[(v >> 18) & 63];
+        out += tbl[(v >> 12) & 63];
+        out += i + 1 < size ? tbl[(v >> 6) & 63] : '=';
+        out += i + 2 < size ? tbl[v & 63] : '=';
+    }
+    return out;
+}
+
+std::optional<std::vector<uint8_t>> base64_decode(const std::string &text) {
+    std::vector<uint8_t> out;
+    uint32_t acc = 0;
+    int bits = 0;
+    size_t symbols = 0;
+    bool padding = false;
+    for (char c : text) {
+        int v;
+        if (c >= 'A' && c <= 'Z') v = c - 'A';
+        else if (c >= 'a' && c <= 'z') v = c - 'a' + 26;
+        else if (c >= '0' && c <= '9') v = c - '0' + 52;
+        else if (c == '+' || c == '-') v = 62;
+        else if (c == '/' || c == '_') v = 63;
+        else if (c == '=') { padding = true; continue; }
+        else if (c == ' ' || c == '\n' || c == '\r' || c == '\t') continue;
+        else return std::nullopt;
+        if (padding) return std::nullopt;  // data after '='
+        acc = (acc << 6) | (uint32_t)v;
+        bits += 6;
+        symbols++;
+        if (bits >= 8) {
+            bits -= 8;
+            out.push_back((uint8_t)(acc >> bits));
+        }
+    }
+    if (symbols % 4 == 1) return std::nullopt;
+    return out;
+}
+
+std::optional<PublicKey> parse_public_key(const std::string &value) {
+    std::string text = trim(value);
+    if (text.empty()) return std::nullopt;
+    if (text.find("-----BEGIN") != std::string::npos) return key_from_pem(text);
+    auto decoded = base64_decode(text);
+    if (!decoded) return std::nullopt;
+    std::string as_text(decoded->begin(), decoded->end());
+    if (as_text.find("-----BEGIN") != std::string::npos) return key_from_pem(as_text);
+    return key_from_der(*decoded);
+}
+
+bool ed25519_verify(const PublicKey &key, const std::string &message, const std::string &signature_b64) {
+    auto sig = base64_decode(signature_b64);
+    if (!sig || sig->size() != 64) return false;
+    return crypto_ed25519_check(sig->data(), key.data(), reinterpret_cast<const uint8_t *>(message.data()),
+                                message.size()) == 0;
+}
+
+bool equal_ct(const std::string &a, const std::string &b) {
+    if (a.size() != b.size()) return false;
+    unsigned char diff = 0;
+    for (size_t i = 0; i < a.size(); i++) diff |= (unsigned char)(a[i] ^ b[i]);
+    return diff == 0;
+}
+
+}  // namespace apn

package/native-runtime/src/crypto.hpp

@@ -0,0 +1,51 @@
+// SHA-256, hex, base64 and Ed25519 verification (Monocypher) for ap_native.
+#pragma once
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace apn {
+
+class Sha256 {
+public:
+    Sha256();
+    void update(const void *data, size_t size);
+    void update(const std::string &s) { update(s.data(), s.size()); }
+    std::array<uint8_t, 32> digest();  // finalizes; the object must not be reused
+    std::string hex_digest();
+
+private:
+    void block(const uint8_t *p);
+    uint32_t h_[8];
+    uint8_t buf_[64];
+    size_t buf_len_ = 0;
+    uint64_t total_ = 0;
+};
+
+std::string sha256_hex(const std::string &data);
+// Streams a file. nullopt when it cannot be read.
+std::optional<std::string> sha256_file_hex(const std::string &path);
+
+std::string to_hex(const uint8_t *data, size_t size);
+std::string base64_encode(const uint8_t *data, size_t size);
+// Standard or URL-safe alphabet, optional padding, whitespace ignored.
+// nullopt on any other character or impossible length.
+std::optional<std::vector<uint8_t>> base64_decode(const std::string &text);
+
+using PublicKey = std::array<uint8_t, 32>;
+
+// Accepts the same forms as the JS runtime's publicKeyPem(): PEM text, base64
+// of a PEM, base64 of the SPKI DER; plus base64 of the raw 32-byte key.
+std::optional<PublicKey> parse_public_key(const std::string &value);
+
+// Ed25519 (RFC 8032, pure) verification of a base64 signature over message.
+bool ed25519_verify(const PublicKey &key, const std::string &message, const std::string &signature_b64);
+
+// Constant-time-ish comparison for hex digests.
+bool equal_ct(const std::string &a, const std::string &b);
+
+}  // namespace apn

package/native-runtime/src/dialog.cpp

@@ -0,0 +1,62 @@
+#include "dialog.hpp"
+
+namespace apn {
+
+DialogModel options_dialog_model(const std::string &title, const LicenseView &license, const UpdateView &update,
+                                 const std::string &notice, const std::string &product_url,
+                                 const std::string &manage_devices_url) {
+    DialogModel m;
+    m.title = title.empty() ? "License" : title;
+    m.message = license.message;
+    if (!license.username.empty() && is_runnable(license.status) && license.status != Status::Disabled) {
+        m.details = "Signed in as " + license.username + ".";
+    }
+    if (!notice.empty()) {
+        if (!m.details.empty()) m.details += "\n\n";
+        m.details += notice + ".";
+    }
+    if (!update.change_log.empty() &&
+        (update.status == UpdStatus::Applied || update.status == UpdStatus::Staged || update.status == UpdStatus::Available)) {
+        std::string log = update.change_log.size() > 1200 ? update.change_log.substr(0, 1200) + "\xE2\x80\xA6" : update.change_log;
+        m.details += "\n\nWhat's new in v" + update.version + ":\n" + log;
+    }
+    auto add = [&](const std::string &label, DialogAction a) { m.buttons.push_back({label, a}); };
+    switch (license.status) {
+        case Status::Disabled:
+            add("OK", DialogAction::Close);
+            break;
+        case Status::SignedOut:
+            add("Sign in\xE2\x80\xA6", DialogAction::SignIn);
+            if (!product_url.empty()) add("Buy\xE2\x80\xA6", DialogAction::OpenProduct);
+            add("Close", DialogAction::Close);
+            break;
+        case Status::SigningIn:
+            add("Open sign-in page", DialogAction::OpenSignInPage);
+            add("Cancel sign-in", DialogAction::CancelSignIn);
+            add("Close", DialogAction::Close);
+            break;
+        case Status::NotOwned:
+        case Status::Refunded:
+            if (!product_url.empty()) add("Buy\xE2\x80\xA6", DialogAction::OpenProduct);
+            add("Use another account", DialogAction::SignOut);
+            add("Close", DialogAction::Close);
+            break;
+        case Status::Active:
+        case Status::OfflineGrace:
+            add("OK", DialogAction::Close);
+            add("Sign out", DialogAction::SignOut);
+            if (!manage_devices_url.empty()) add("Manage devices\xE2\x80\xA6", DialogAction::ManageDevices);
+            break;
+        case Status::Checking:
+        case Status::OfflineExpired:
+        case Status::Error:
+            add("Try again", DialogAction::Retry);
+            add("Sign out", DialogAction::SignOut);
+            add("Close", DialogAction::Close);
+            break;
+    }
+    if (m.buttons.size() > 3) m.buttons.resize(3);
+    return m;
+}
+
+}  // namespace apn

package/native-runtime/src/dialog.hpp

@@ -0,0 +1,35 @@
+// The Options dialog (PF_Cmd_DO_DIALOG): what it shows and which buttons it
+// offers for each license/update state. Pure, so it is unit tested; the
+// platform files only present it (NSAlert / TaskDialog).
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "engine.hpp"
+
+namespace apn {
+
+enum class DialogAction { Close, SignIn, OpenSignInPage, CancelSignIn, SignOut, Retry, OpenProduct, ManageDevices };
+
+struct DialogButton {
+    std::string label;
+    DialogAction action;
+};
+
+struct DialogModel {
+    std::string title;    // the effect's name
+    std::string message;  // first line: the license state
+    std::string details;  // account, update notice, changelog
+    std::vector<DialogButton> buttons;  // first = default; at most 3
+};
+
+DialogModel options_dialog_model(const std::string &title, const LicenseView &license, const UpdateView &update,
+                                 const std::string &notice, const std::string &product_url,
+                                 const std::string &manage_devices_url);
+
+// Shows the dialog modally on the calling (UI) thread; returns the index of the
+// pressed button, or -1 when it could not be shown.
+int platform_show_dialog(const DialogModel &model);
+
+}  // namespace apn