akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/native/android/src/com/akanjs/runtime/AkanNativeApplication.kt

@@ -0,0 +1,189 @@
+package com.akanjs.runtime
+
+import android.app.Application
+import android.content.Context
+import android.content.Intent
+import android.util.Base64
+import java.io.File
+import java.security.SecureRandom
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+import org.json.JSONObject
+
+/**
+ * The App scope (docs/architecture.md §3.7): what lives as long as the process. Activities come and
+ * go while the process stays (back pressed and the app opened again, recreate()), so nothing that
+ * must happen once per launch belongs to one. Registered as the manifest's application class.
+ *
+ * The process can also start without an activity (a notification alarm, boot), so the web bundle is
+ * chosen when the first activity asks for it, not in onCreate.
+ */
+class AkanNativeApplication : Application() {
+    override fun onCreate() {
+        super.onCreate()
+        AkanNativeApp.context = applicationContext
+        Thread { AkanNativeApp.cleanSessionFiles(applicationContext) }.start()
+    }
+}
+
+object AkanNativeApp {
+    internal lateinit var context: Context
+
+    /** Tells processes apart in the self-test ($host.info): an activity made again keeps this one. */
+    val instance: String = UUID.randomUUID().toString()
+
+    var bundleSelections = 0
+        private set
+
+    /** Activities made in this process. */
+    var windows = 0
+        internal set
+
+    private var bundleChosen = false
+
+    /**
+     * The web bundle to serve (UP-2), null for the APK's own. Chosen once per process: an activity
+     * made again must not count as a new launch of an unconfirmed bundle and roll it back. Later it
+     * is whatever apply() or a rollback made active.
+     */
+    fun bundleRoot(): File? {
+        if (!bundleChosen) {
+            bundleChosen = true
+            if (AkanNativeFeatures.UPDATES) {
+                AkanNativeUpdates.init(context)
+                AkanNativeUpdates.launch()
+            }
+            bundleSelections++
+        }
+        if (!AkanNativeFeatures.UPDATES) return null
+        return AkanNativeUpdates.active?.let { AkanNativeUpdates.bundleDirectory(it.bundle) }
+    }
+
+    // ---------------------------------------------------------------- FileRefs (PL-7)
+
+    private val files = ConcurrentHashMap<String, Pair<File, String>>()
+    private val random = SecureRandom()
+
+    /** Serves [file] at /__akan_native/file/<id> for the rest of the process. The id cannot be guessed. */
+    fun registerFile(file: File, mime: String): JSONObject {
+        val bytes = ByteArray(12).also(random::nextBytes)
+        // ASCII letters and digits only: the route accepts no other id (AkanNativeKernel.isFileRefId).
+        val ext = file.name.substringAfterLast('.', "").filter { it in AkanNativeContract.ID_FILE_REF.extChars }.take(AkanNativeContract.ID_FILE_REF.extMax)
+        val id = Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_PADDING or Base64.NO_WRAP) + if (ext.isEmpty()) "" else ".$ext"
+        files[id] = file to mime
+        return JSONObject().put("url", "/__akan_native/file/$id").put("mime", mime).put("size", file.length())
+    }
+
+    fun file(id: String): Pair<File, String>? = files[id]
+
+    /**
+     * Stops serving a FileRef (\$bridge.release). A file in one of akan-native's session folders is akan-native's
+     * own copy (a photo, a picked document) and is deleted; other files belong to the user and stay.
+     */
+    fun releaseFile(id: String): Boolean {
+        val (file, _) = files.remove(id) ?: return false
+        val path = file.canonicalPath
+        if (SESSION_DIRS.any { path.startsWith(File(context.cacheDir, it).canonicalPath + File.separator) }) file.delete()
+        return true
+    }
+
+    /** How many FileRefs are served (K13). */
+    val fileCount: Int get() = files.size
+
+    /** cacheDir folders whose files akan-native writes for FileRefs: camera captures, picked documents. */
+    val SESSION_DIRS = listOf(AkanNativeFileProvider.DIR, "akan-native-picked")
+
+    /**
+     * At process start: files an earlier process served are unreachable now (FileRefs live in memory).
+     * Only files older than an hour go: a camera capture written while the process was dead still
+     * belongs to the activity result that a restored activity is about to receive (plugins.md C6).
+     */
+    internal fun cleanSessionFiles(context: Context, now: Long = System.currentTimeMillis()) {
+        for (name in SESSION_DIRS) {
+            File(context.cacheDir, name).listFiles()?.forEach { if (now - it.lastModified() > 3_600_000) it.deleteRecursively() }
+        }
+    }
+}
+
+/**
+ * Links the app was opened with (plugins.md S4, C2). The launch URL is the one the process started
+ * with and never changes (getLaunchUrl gives the same answer to every page). Every URL, the launch
+ * URL included, is also delivered once as an event: to the listeners, or to the first one that
+ * subscribes. Side effects belong there, so a reloaded page does not handle a link twice.
+ */
+object AkanNativeLinks {
+    var launchUrl: String? = null
+        private set
+    private var launched = false
+    /** Every link, retained until a listener takes it (AkanNativeRetained, the shared C2 rule). */
+    private val events = AkanNativeRetained<String>()
+
+    /**
+     * The link of a VIEW intent, if it is one this app handles. The launcher activity is exported,
+     * so another app can send it an explicit VIEW intent with any data, past the manifest's intent
+     * filters; only links the filters (deepLinks.schemes) accept count. An intent relaunched from
+     * the recents screen carries the old link (react-native IntentModule skips those too).
+     */
+    fun urlOf(context: Context, intent: Intent?): String? {
+        val data = intent?.takeIf { it.action == Intent.ACTION_VIEW && it.flags and Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY == 0 }?.data ?: return null
+        val view = Intent(Intent.ACTION_VIEW, data).addCategory(Intent.CATEGORY_BROWSABLE).setPackage(context.packageName)
+        return if (context.packageManager.queryIntentActivities(view, 0).isEmpty()) null else intent.dataString
+    }
+
+    /** An activity was created, with the link that started it (null when it was only recreated). */
+    fun connected(url: String?) {
+        if (!launched) {
+            launched = true
+            launchUrl = url
+        }
+        if (url != null) open(url)
+    }
+
+    private val owners = HashMap<Any, Any>()
+
+    /**
+     * Listeners return false when they are gone (a plugin of an activity that ended). [owner] is the
+     * window (the plugin's activity): its listeners go when it is destroyed.
+     */
+    fun listen(key: Any, owner: Any, listener: (String) -> Boolean) {
+        owners[key] = owner
+        events.listen(key, listener)
+    }
+
+    fun unlisten(key: Any) {
+        owners.remove(key)
+        events.unlisten(key)
+    }
+
+    /** A window ended: its listeners go (every page registration has an owner). */
+    fun removeAll(owner: Any) {
+        for (key in owners.filterValues { it === owner }.keys) unlisten(key)
+    }
+
+    val listenerCount: Int get() = events.listenerCount
+
+    fun open(url: String) = events.emit(url, retain = true)
+}
+
+/**
+ * What the shell hands to the system (L0) and how often: the page's links and the opener share one
+ * limit of EXTERNAL_OPENS_PER_SECOND, so a page cannot flood the device with other apps.
+ */
+object AkanNativeExternal {
+    /** security.shell.externalSchemes from shell.json (set by the activity). */
+    @Volatile
+    var extra: List<String> = emptyList()
+
+    /** http, https, mailto, tel and the app's own additions (never the forbidden ones). */
+    val schemes: List<String> get() = AkanNativeKernel.externalSchemes(extra)
+
+    private var last = 0L
+
+    /** Whether an open may happen now; counts it when it may. */
+    @Synchronized
+    fun allowed(now: Long = android.os.SystemClock.elapsedRealtime()): Boolean {
+        if (last != 0L && now - last < 1000L / AkanNativeContract.EXTERNAL_OPENS_PER_SECOND) return false
+        last = now
+        return true
+    }
+}

package/vendor/@akanjs/native/native/android/src/com/akanjs/runtime/AkanNativeAssetServer.kt

@@ -0,0 +1,225 @@
+package com.akanjs.runtime
+
+import android.content.res.AssetManager
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import java.io.ByteArrayInputStream
+import java.io.FileInputStream
+import java.io.FilterInputStream
+import java.io.IOException
+import java.io.InputStream
+
+/**
+ * Serves https://app.localhost/ from APK assets/app/ (docs/architecture.md §5).
+ * The route decision is a port of packages/cli/src/lib/routes.ts. Called on Chromium
+ * background threads, possibly concurrently.
+ *
+ * akan-native dev --hmr (debuggable builds with shell.json `devServer`): every path outside /__akan_native/ is
+ * fetched from the dev gateway (packages/cli/src/lib/hmr.ts; the CLI runs `adb reverse`, and the
+ * dev network security config allows cleartext to 127.0.0.1) and answered on https://app.localhost,
+ * so the bridge, storage and CSP see the usual origin. Without the gateway the bundled files are served.
+ * A request with a body never arrives here (WebResourceRequest has none): the dev page sends those to
+ * the gateway itself (devShim relayBodies).
+ */
+class AkanNativeAssetServer(
+    private val assets: AssetManager,
+    private val bridge: AkanNativeBridge,
+    private val initScript: () -> String,
+) {
+    /** A downloaded web bundle to serve instead of the APK's assets/app (UP-2, AkanNativeUpdates). */
+    @Volatile
+    var root: java.io.File? = null
+
+    /** akan-native dev --hmr: e.g. "http://127.0.0.1:52011", where pages come from (null: the bundled files). */
+    @Volatile
+    var devServer: String? = null
+
+    @Volatile
+    private var devWarned = false
+
+    companion object {
+        const val HOST = "app.localhost"
+        const val ORIGIN = "https://$HOST"
+        private val NONCE = Regex("[0-9a-f]{16,64}")
+        private const val ROOT = "app"
+
+        // WebResourceResponse rejects an empty reason phrase and 3xx codes (verified).
+        private val REASON = mapOf(
+            200 to "OK", 204 to "No Content", 206 to "Partial Content", 400 to "Bad Request",
+            403 to "Forbidden", 404 to "Not Found", 405 to "Method Not Allowed",
+            416 to "Range Not Satisfiable", 500 to "Internal Server Error", 502 to "Bad Gateway",
+        )
+
+        private val DEV_SERVER = Regex("http://(127\\.0\\.0\\.1|localhost):[0-9]{1,5}")
+        /**
+         * Request headers not passed to the gateway: hop-by-hop, its own host, validators (it never answers 304,
+         * which WebResourceResponse rejects) and Accept-Encoding (HttpURLConnection only unpacks what it asked
+         * for). Everything else goes, Authorization included, so the page's API calls work through it.
+         */
+        private val DEV_SKIP = setOf("host", "connection", "keep-alive", "content-length", "accept-encoding", "if-none-match", "if-modified-since")
+        /** Framing headers of the gateway's reply; the stream is handed over as it is. */
+        private val DEV_DROP = setOf("connection", "keep-alive", "transfer-encoding", "content-length", "content-encoding", "content-type")
+
+        /** shell.json `devServer`: plain http to the loopback interface only. */
+        fun devServerOrNull(text: String?): String? = text?.trimEnd('/')?.takeIf { DEV_SERVER.matches(it) }
+
+        /** The charset a response of this type carries (text types: UTF-8, AkanNativeKernel.assetMime). */
+        fun encodingOf(mime: String): String? = if (mime.startsWith("text/") || mime in AkanNativeContract.MIME_UTF8) "utf-8" else null
+    }
+
+    private fun exists(relative: String): Boolean {
+        root?.let { return java.io.File(it, relative).isFile }
+        return try {
+            assets.open("$ROOT/$relative", AssetManager.ACCESS_STREAMING).close()
+            true
+        } catch (e: IOException) {
+            false
+        }
+    }
+
+    fun intercept(request: WebResourceRequest): WebResourceResponse? {
+        val url = request.url
+        if (url.scheme != "https" || url.host != HOST) return null // real network
+        if (request.method != "GET" && request.method != "HEAD") return error(405)
+        val dev = devServer
+        // The app's /__akan_native/* paths are never its top-level document (a FileRef holding HTML would run
+        // with the bridge, N1). shouldOverrideUrlLoading does not see every navigation (loadUrl,
+        // history), so the server refuses them too. Frames and fetches have isForMainFrame false.
+        if (request.isForMainFrame && AkanNativeKernel.isHostPath(url.encodedPath ?: "/")) return error(403)
+        if (dev != null && !AkanNativeKernel.isHostPath(url.encodedPath ?: "/")) proxy(dev, request)?.let { return it }
+        // Routes, MIME types and ranges are the kernel's (AkanNativeKernel.kt, checked with the shared vectors).
+        return when (val r = AkanNativeKernel.route(url.encodedPath ?: "/", ::exists)) {
+            AkanNativeRoute.Init -> text(200, "text/javascript", initScript())
+            AkanNativeRoute.Hello -> {
+                // Doorbell: the port goes only to the app-origin main frame (postWebMessage targetOrigin).
+                // Only our own documents may ring: a ring replaces the page's port, so a foreign
+                // iframe ringing would otherwise cut the page off.
+                val referer = request.requestHeaders.entries.firstOrNull { it.key.equals("Referer", ignoreCase = true) }?.value ?: ""
+                if (!referer.startsWith("$ORIGIN/")) return error(403)
+                // The page's per-document nonce: the shell posts the port with it (SEC-4, AkanNativeBridge.offerPort).
+                val nonce = request.url.getQueryParameter("n") ?: ""
+                if (!NONCE.matches(nonce)) return error(400)
+                bridge.offerPort(nonce)
+                WebResourceResponse("text/plain", "utf-8", 204, REASON.getValue(204), headers(), ByteArrayInputStream(ByteArray(0)))
+            }
+            is AkanNativeRoute.File -> {
+                val (file, mime) = bridge.file(r.id) ?: return error(404)
+                try {
+                    serve(FileInputStream(file), mime, request, file.length(), fileRef = true)
+                } catch (e: IOException) {
+                    error(404)
+                }
+            }
+            is AkanNativeRoute.Asset -> {
+                val bundle = root
+                if (bundle != null) {
+                    val file = java.io.File(bundle, r.path)
+                    return try {
+                        serve(FileInputStream(file), AkanNativeKernel.fileMime(r.path), request, file.length())
+                    } catch (e: IOException) {
+                        error(404)
+                    }
+                }
+                val stream = try {
+                    assets.open("$ROOT/${r.path}", AssetManager.ACCESS_STREAMING)
+                } catch (e: IOException) {
+                    return error(404)
+                }
+                serve(stream, AkanNativeKernel.fileMime(r.path), request)
+            }
+            AkanNativeRoute.Ipc, AkanNativeRoute.NotFound -> error(404)
+        }
+    }
+
+    /**
+     * 200, or 206 for one "bytes=" range (IN-5, AkanNativeKernel.parseRange: at most MAX_RANGE_BYTES; a
+     * header that is not one supported range is ignored). Do not skip to the range start: WebView
+     * skips the stream itself when the request has a Range header (verified). Only cap it at last+1.
+     */
+    private fun serve(stream: InputStream, mime: String, request: WebResourceRequest, knownLength: Long = -1, fileRef: Boolean = false): WebResourceResponse {
+        val encoding = encodingOf(mime)
+        val range = request.requestHeaders.entries.firstOrNull { it.key.equals("Range", ignoreCase = true) }?.value
+        // A FileRef (a file a plugin registered) is never the app's document: no MIME sniffing, not for
+        // other origins, and anything but plain media opens sandboxed (AkanNativeKernel.fileRefSandboxed; N1).
+        val refHeaders: Map<String, String> = if (!fileRef) emptyMap() else buildMap {
+            put("X-Content-Type-Options", "nosniff")
+            put("Cross-Origin-Resource-Policy", "same-origin")
+            if (AkanNativeKernel.fileRefSandboxed(mime)) put("Content-Security-Policy", "sandbox")
+        }
+        val whole = { WebResourceResponse(mime, encoding, 200, "OK", (headers() + refHeaders) + ("Accept-Ranges" to "bytes"), stream) }
+        if (range == null) return whole()
+        val total = if (knownLength >= 0) knownLength else stream.available().toLong()
+        return when (val answer = AkanNativeKernel.parseRange(range, total)) {
+            AkanNativeRangeAnswer.Whole -> whole()
+            AkanNativeRangeAnswer.Unsatisfiable -> {
+                stream.close()
+                WebResourceResponse(mime, encoding, 416, REASON.getValue(416), (headers() + refHeaders) + ("Content-Range" to "bytes */$total"), ByteArrayInputStream(ByteArray(0)))
+            }
+            is AkanNativeRangeAnswer.Part -> {
+                val extra = mapOf(
+                    "Accept-Ranges" to "bytes",
+                    "Content-Range" to "bytes ${answer.first}-${answer.last}/$total",
+                    "Content-Length" to (answer.last - answer.first + 1).toString(),
+                )
+                WebResourceResponse(mime, encoding, 206, REASON.getValue(206), (headers() + refHeaders) + extra, Limited(stream, answer.last + 1))
+            }
+        }
+    }
+
+    /** Caps a stream; skip() counts against the cap because WebView skips through it. */
+    private class Limited(source: InputStream, private var left: Long) : FilterInputStream(source) {
+        override fun read(): Int = if (left <= 0) -1 else super.read().also { if (it >= 0) left-- }
+
+        override fun read(b: ByteArray, off: Int, len: Int): Int {
+            if (left <= 0) return -1
+            val n = super.read(b, off, minOf(len.toLong(), left).toInt())
+            if (n > 0) left -= n
+            return n
+        }
+
+        override fun available(): Int = minOf(super.available().toLong(), left).toInt()
+
+        override fun skip(n: Long): Long = super.skip(minOf(n, left)).also { if (it > 0) left -= it }
+    }
+
+    /** The gateway's answer, or null when it cannot be reached (then the bundled files are served). */
+    private fun proxy(base: String, request: WebResourceRequest): WebResourceResponse? {
+        val url = request.url
+        val target = java.net.URL(base + (url.encodedPath ?: "/") + (url.encodedQuery?.let { "?$it" } ?: ""))
+        val connection = target.openConnection() as java.net.HttpURLConnection
+        return try {
+            connection.requestMethod = request.method
+            connection.connectTimeout = 2000
+            connection.readTimeout = 60_000 // Bun bundles on the first request
+            connection.useCaches = false
+            connection.instanceFollowRedirects = true
+            for ((name, value) in request.requestHeaders) if (name.lowercase() !in DEV_SKIP) connection.setRequestProperty(name, value)
+            val status = connection.responseCode // connects; IOException when nothing listens
+            val type = connection.contentType ?: AkanNativeKernel.assetMime(url.path ?: "")
+            val charset = Regex("charset=\"?([^;\"]+)", RegexOption.IGNORE_CASE).find(type)?.groupValues?.get(1)?.trim()
+            val headers = HashMap<String, String>()
+            for ((name, values) in connection.headerFields) {
+                if (name != null && name.lowercase() !in DEV_DROP) headers[name] = values.joinToString(", ")
+            }
+            val body = (if (status >= 400) connection.errorStream else connection.inputStream) ?: ByteArrayInputStream(ByteArray(0))
+            // WebResourceResponse refuses 3xx codes and an empty reason phrase.
+            val code = if (status in 300..399) 502 else status
+            val reason = connection.responseMessage?.takeIf { it.isNotBlank() && code == status } ?: REASON[code] ?: "OK"
+            WebResourceResponse(type.substringBefore(';').trim(), charset, code, reason, headers, body)
+        } catch (e: IOException) {
+            connection.disconnect()
+            if (!devWarned) {
+                devWarned = true
+                android.util.Log.w(TAG, "dev server $base: ${e.message}; serving the bundled files")
+            }
+            null
+        }
+    }
+
+    private fun headers(): Map<String, String> = mapOf("Cache-Control" to "no-cache")
+
+    private fun text(status: Int, mime: String, body: String) =
+        WebResourceResponse(mime, "utf-8", status, REASON[status] ?: "OK", headers(), ByteArrayInputStream(body.toByteArray(Charsets.UTF_8)))
+
+    private fun error(status: Int) = text(status, "text/plain", "$status ${REASON[status]}")
+}