catalyst-core 1.1.0 → 1.2.0-canary.2

package/test/native/appIcon.test.ts

@@ -0,0 +1,124 @@
+import fs from "fs"
+import os from "os"
+import path from "path"
+import { afterEach, describe, expect, it } from "vitest"
+
+import { checkAppIcon, readPngInfo } from "../../src/native/appIcon.js"
+
+const temps: string[] = []
+afterEach(() => {
+    for (const dir of temps.splice(0)) fs.rmSync(dir, { recursive: true, force: true })
+})
+
+function chunk(type: string, data: Buffer = Buffer.alloc(0)) {
+    const length = Buffer.alloc(4)
+    length.writeUInt32BE(data.length)
+    // The reader never checks CRCs, so a zero CRC keeps the fixture simple.
+    return Buffer.concat([length, Buffer.from(type, "ascii"), data, Buffer.alloc(4)])
+}
+
+/** A structurally valid PNG header: signature, IHDR, optional chunks, IDAT, IEND. */
+function png(width: number, height: number, colorType: number, extra: Buffer[] = []) {
+    const ihdr = Buffer.alloc(13)
+    ihdr.writeUInt32BE(width, 0)
+    ihdr.writeUInt32BE(height, 4)
+    ihdr[8] = 8
+    ihdr[9] = colorType
+    return Buffer.concat([
+        Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+        chunk("IHDR", ihdr),
+        ...extra,
+        chunk("IDAT", Buffer.from([0, 1, 2, 3])),
+        chunk("IEND"),
+    ])
+}
+
+function iconFile(buffer: Buffer) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "catalyst-app-icon-"))
+    temps.push(dir)
+    const file = path.join(dir, "icon.png")
+    fs.writeFileSync(file, buffer)
+    return file
+}
+
+function thrown(fn: () => unknown): any {
+    try {
+        fn()
+    } catch (error) {
+        return error
+    }
+    throw new Error("expected a throw")
+}
+
+describe("readPngInfo", () => {
+    it("reads size and colour type from IHDR", () => {
+        expect(readPngInfo(png(1024, 1024, 2))).toEqual({
+            width: 1024,
+            height: 1024,
+            bitDepth: 8,
+            colorType: 2,
+            hasAlpha: false,
+        })
+    })
+
+    it("reports alpha for grey+alpha, RGBA and a tRNS chunk", () => {
+        expect(readPngInfo(png(1024, 1024, 4))?.hasAlpha).toBe(true)
+        expect(readPngInfo(png(1024, 1024, 6))?.hasAlpha).toBe(true)
+        expect(
+            readPngInfo(png(1024, 1024, 3, [chunk("PLTE", Buffer.alloc(6)), chunk("tRNS", Buffer.from([0]))]))
+                ?.hasAlpha
+        ).toBe(true)
+    })
+
+    it("ignores a tRNS-looking chunk after the image data", () => {
+        const buffer = png(1024, 1024, 2)
+        const late = Buffer.concat([
+            buffer.subarray(0, buffer.length - 12),
+            chunk("tRNS", Buffer.from([0])),
+            chunk("IEND"),
+        ])
+        expect(readPngInfo(late)?.hasAlpha).toBe(false)
+    })
+
+    it("returns null for anything that is not a PNG", () => {
+        expect(readPngInfo(Buffer.from("not a png at all, just some text bytes"))).toBeNull()
+        expect(readPngInfo(Buffer.alloc(0))).toBeNull()
+    })
+})
+
+describe("checkAppIcon", () => {
+    it("accepts a square opaque icon of 1024 or more", () => {
+        expect(checkAppIcon(iconFile(png(2048, 2048, 2)), { platform: "ios", release: true }).width).toBe(
+            2048
+        )
+    })
+
+    it("fails a non-square or small icon with the platform's code", () => {
+        expect(thrown(() => checkAppIcon(iconFile(png(1024, 512, 2)), { platform: "android" })).code).toBe(
+            "ANDROID-010"
+        )
+        const small = thrown(() => checkAppIcon(iconFile(png(512, 512, 2)), { platform: "ios" }))
+        expect(small.code).toBe("IOS-005")
+        expect(small.message).toContain("at least 1024x1024")
+        expect(
+            thrown(() => checkAppIcon(iconFile(Buffer.from("GIF89a....")), { platform: "ios" })).code
+        ).toBe("IOS-005")
+    })
+
+    it("warns about alpha in debug and on Android release", () => {
+        const logs: Array<[string, string?]> = []
+        const log = (message: string, type?: string) => logs.push([message, type])
+        checkAppIcon(iconFile(png(1024, 1024, 6)), { platform: "ios", log })
+        checkAppIcon(iconFile(png(1024, 1024, 6)), { platform: "android", release: true, log })
+        expect(logs).toHaveLength(2)
+        expect(logs.every(([, type]) => type === "warning")).toBe(true)
+    })
+
+    it("fails alpha for an iOS release", () => {
+        const error = thrown(() =>
+            checkAppIcon(iconFile(png(1024, 1024, 6)), { platform: "ios", release: true })
+        )
+        expect(error.code).toBe("IOS-006")
+        expect(error.docUrl).toMatch(/errors\/IOS\/IOS-006\.md$/)
+    })
+})

package/test/native/credentials.test.ts

@@ -0,0 +1,241 @@
+import { execFileSync } from "child_process"
+import fs from "fs"
+import os from "os"
+import path from "path"
+import crypto from "crypto"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import zlib from "zlib"
+
+import { EventEmitter } from "events"
+import {
+    MAX_CREDENTIALS_SECRET_BYTES,
+    cleanupOnSignal,
+    credentialsEnvName,
+    maskSecret,
+    packCredentials,
+    resolveCredentials,
+    unpackCredentials,
+} from "../../src/native/credentials.js"
+import { runExportCredentials } from "../../src/native/exportCredentials.js"
+
+const temps: string[] = []
+function tempDir() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "catalyst-credentials-test-"))
+    temps.push(dir)
+    return dir
+}
+afterEach(() => {
+    vi.restoreAllMocks()
+    for (const dir of temps.splice(0)) fs.rmSync(dir, { recursive: true, force: true })
+})
+
+/** An app with fake (throwaway) Android credentials. */
+function appWithCredentials() {
+    const cwd = tempDir()
+    const dir = path.join(cwd, "credentials", "android")
+    fs.mkdirSync(dir, { recursive: true })
+    fs.writeFileSync(path.join(dir, "upload.p12"), "fake-keystore-bytes")
+    fs.writeFileSync(path.join(dir, "keystore.properties"), "storePassword=not-a-real-password\n")
+    return cwd
+}
+
+function thrown(fn: () => unknown): any {
+    try {
+        fn()
+    } catch (error) {
+        return error
+    }
+    throw new Error("expected a throw")
+}
+
+describe("credentials", () => {
+    it("names one secret per platform", () => {
+        expect(credentialsEnvName("android")).toBe("CATALYST_ANDROID_CREDENTIALS")
+        expect(credentialsEnvName("ios")).toBe("CATALYST_IOS_CREDENTIALS")
+    })
+
+    it("round-trips the folder through the secret value", () => {
+        const value = packCredentials("android", { cwd: appWithCredentials() })
+        expect(value).toMatch(/^[A-Za-z0-9+/]+=*$/)
+        const ci = tempDir()
+        const resolved = resolveCredentials("android", {
+            cwd: ci,
+            env: { CATALYST_ANDROID_CREDENTIALS: value },
+        })
+        try {
+            expect(resolved.source).toBe("env")
+            expect(resolved.dir.startsWith(ci)).toBe(false)
+            expect(fs.readFileSync(path.join(resolved.dir, "upload.p12"), "utf8")).toBe("fake-keystore-bytes")
+            expect(fs.existsSync(path.join(ci, "credentials"))).toBe(false)
+        } finally {
+            resolved.cleanup()
+        }
+        expect(fs.existsSync(resolved.dir)).toBe(false)
+    })
+
+    it("removes the unpacked secret when the build is interrupted", () => {
+        const value = packCredentials("android", { cwd: appWithCredentials() })
+        const signals = new EventEmitter()
+        const exits: number[] = []
+        const resolved = resolveCredentials("android", {
+            cwd: tempDir(),
+            env: { CATALYST_ANDROID_CREDENTIALS: value },
+            signals,
+            exit: (code: number) => exits.push(code),
+        })
+        expect(signals.listenerCount("SIGINT")).toBe(1)
+        signals.emit("SIGINT", "SIGINT")
+        expect(fs.existsSync(resolved.dir)).toBe(false)
+        expect(exits).toEqual([130])
+        expect(signals.listenerCount("SIGINT") + signals.listenerCount("SIGTERM")).toBe(0)
+
+        // A normal cleanup removes the handlers as well.
+        const again = resolveCredentials("android", {
+            cwd: tempDir(),
+            env: { CATALYST_ANDROID_CREDENTIALS: value },
+            signals,
+            exit: (code: number) => exits.push(code),
+        })
+        again.cleanup()
+        expect(fs.existsSync(again.dir)).toBe(false)
+        expect(signals.listenerCount("SIGINT") + signals.listenerCount("SIGTERM")).toBe(0)
+    })
+
+    it("lets a later signal handler run its cleanup and exit", () => {
+        const signals = new EventEmitter()
+        const order: string[] = []
+        const exits: number[] = []
+        const exit = (code: number) => exits.push(code)
+        cleanupOnSignal(() => order.push("credentials"), { signals, exit })
+        cleanupOnSignal(() => order.push("keychain"), { signals, exit })
+        signals.emit("SIGTERM", "SIGTERM")
+        expect(order).toEqual(["credentials", "keychain"])
+        expect(exits).toEqual([143])
+    })
+
+    it("prefers the project folder over the secret", () => {
+        const cwd = appWithCredentials()
+        const resolved = resolveCredentials("android", {
+            cwd,
+            env: { CATALYST_ANDROID_CREDENTIALS: "garbage" },
+        })
+        expect(resolved).toMatchObject({ source: "folder", dir: path.join(cwd, "credentials", "android") })
+    })
+
+    it("reports none when there is neither", () => {
+        const cwd = tempDir()
+        expect(resolveCredentials("ios", { cwd, env: {} })).toMatchObject({
+            source: "none",
+            dir: path.join(cwd, "credentials", "ios"),
+        })
+    })
+
+    it("refuses a value that is not a gzipped tar (NATIVE-007)", () => {
+        const error = thrown(() =>
+            resolveCredentials("android", {
+                cwd: tempDir(),
+                env: { CATALYST_ANDROID_CREDENTIALS: "aGVsbG8=" },
+            })
+        )
+        expect(error.code).toBe("NATIVE-007")
+        expect(error.message).toContain("CATALYST_ANDROID_CREDENTIALS")
+    })
+
+    it("refuses gzipped data that is not a tar archive (NATIVE-007)", () => {
+        const value = zlib.gzipSync(Buffer.from("not a tar archive at all\n".repeat(40))).toString("base64")
+        const error = thrown(() =>
+            unpackCredentials(value, tempDir(), { envName: "CATALYST_IOS_CREDENTIALS" })
+        )
+        expect(error.code).toBe("NATIVE-007")
+        expect(error.message).toContain("CATALYST_IOS_CREDENTIALS could not be read as a tar archive")
+    })
+
+    it("names the platforms it knows", () => {
+        expect(() => credentialsEnvName("windows" as any)).toThrow(
+            'Unknown platform "windows": expected android or ios'
+        )
+        expect(() => packCredentials("web" as any, { cwd: tempDir() })).toThrow(/Unknown platform "web"/)
+    })
+
+    it("refuses an archive with paths outside the folder or links", () => {
+        const work = tempDir()
+        fs.mkdirSync(path.join(work, "inner"))
+        fs.symlinkSync("/etc/hosts", path.join(work, "inner", "link"))
+        const archive = execFileSync("tar", ["-czf", "-", "-C", path.join(work, "inner"), "."])
+        expect(thrown(() => unpackCredentials(archive.toString("base64"), tempDir())).code).toBe("NATIVE-007")
+    })
+
+    it("fails to export a missing folder (NATIVE-008)", () => {
+        expect(thrown(() => packCredentials("ios", { cwd: tempDir() })).code).toBe("NATIVE-008")
+    })
+
+    it("fails to export more than 48 KB (NATIVE-009)", () => {
+        const cwd = tempDir()
+        const dir = path.join(cwd, "credentials", "ios")
+        fs.mkdirSync(dir, { recursive: true })
+        // Random bytes do not compress.
+        fs.writeFileSync(path.join(dir, "big.bin"), crypto.randomBytes(60 * 1024))
+        const error = thrown(() => packCredentials("ios", { cwd }))
+        expect(error.code).toBe("NATIVE-009")
+        expect(MAX_CREDENTIALS_SECRET_BYTES).toBe(48 * 1024)
+    })
+
+    it("masks secrets only under GitHub Actions", () => {
+        const out: string[] = []
+        const write = (text: string) => out.push(text)
+        expect(maskSecret("s3cret", { env: {}, write })).toBe(false)
+        expect(maskSecret("", { env: { GITHUB_ACTIONS: "true" }, write })).toBe(false)
+        expect(maskSecret("50%\nx", { env: { GITHUB_ACTIONS: "true" }, write })).toBe(true)
+        expect(out).toEqual(["::add-mask::50%25%0Ax\n"])
+    })
+
+    it("writes the mask to stdout by default", () => {
+        const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true)
+        expect(maskSecret("abc", { env: { GITHUB_ACTIONS: "true" } })).toBe(true)
+        expect(write).toHaveBeenCalledWith("::add-mask::abc\n")
+    })
+})
+
+describe("catalyst credentials:export", () => {
+    it("prints the value on stdout and where to paste it on stderr", () => {
+        const out: string[] = []
+        const err: string[] = []
+        const code = runExportCredentials({
+            argv: ["android"],
+            cwd: appWithCredentials(),
+            stdout: (text: string) => out.push(text),
+            stderr: (text: string) => err.push(text),
+        })
+        expect(code).toBe(0)
+        expect(out.join("").trim()).toMatch(/^[A-Za-z0-9+/]+=*$/)
+        expect(err.join("")).toContain("CATALYST_ANDROID_CREDENTIALS")
+    })
+
+    it("prints the coded error and exits 1", () => {
+        const err: string[] = []
+        const code = runExportCredentials({
+            argv: ["ios"],
+            cwd: tempDir(),
+            stdout: () => {},
+            stderr: (text: string) => err.push(text),
+        })
+        expect(code).toBe(1)
+        expect(err.join("")).toContain("NATIVE-008")
+    })
+
+    it("writes to the process streams by default", () => {
+        const out = vi.spyOn(process.stdout, "write").mockImplementation(() => true)
+        const err = vi.spyOn(process.stderr, "write").mockImplementation(() => true)
+        expect(runExportCredentials({ argv: ["android"], cwd: appWithCredentials() })).toBe(0)
+        expect(String(out.mock.calls[0][0]).trim()).toMatch(/^[A-Za-z0-9+/]+=*$/)
+        expect(String(err.mock.calls[0][0])).toContain("CATALYST_ANDROID_CREDENTIALS")
+    })
+
+    it("needs a platform", () => {
+        const err: string[] = []
+        expect(runExportCredentials({ argv: [], stdout: () => {}, stderr: (t: string) => err.push(t) })).toBe(
+            1
+        )
+        expect(err.join("")).toContain("<android|ios>")
+    })
+})

package/test/native/interaction.test.ts

@@ -0,0 +1,179 @@
+import { describe, expect, it } from "vitest"
+
+import {
+    askConsent,
+    isInteractive,
+    needsAnswerError,
+    parseNativeArgs,
+    select,
+} from "../../src/native/utils.js"
+
+function thrown(fn: () => unknown): any {
+    try {
+        fn()
+    } catch (error) {
+        return error
+    }
+    throw new Error("expected a throw")
+}
+
+describe("parseNativeArgs", () => {
+    it("reads the five native flags", () => {
+        expect(parseNativeArgs([])).toEqual({
+            release: false,
+            device: false,
+            url: undefined,
+            yes: false,
+            acceptLicenses: false,
+        })
+        expect(
+            parseNativeArgs([
+                "--release",
+                "--device",
+                "--url",
+                "https://shop.acme.com",
+                "--yes",
+                "--accept-licenses",
+            ])
+        ).toEqual({
+            release: true,
+            device: true,
+            url: "https://shop.acme.com",
+            yes: true,
+            acceptLicenses: true,
+        })
+    })
+
+    it("takes --url=<u> too, and ignores other arguments", () => {
+        expect(parseNativeArgs(["--verbose", "--url=https://a.com"])).toMatchObject({ url: "https://a.com" })
+    })
+
+    it("no longer knows the removed flags", () => {
+        expect(parseNativeArgs(["--build-number", "7", "--no-sign"])).not.toHaveProperty("buildNumber")
+        expect(parseNativeArgs(["--no-sign"])).not.toHaveProperty("noSign")
+    })
+
+    it.each([[["--url"]], [["--url", "--release"]], [["--url="]]])(
+        "fails on --url without a value: %j",
+        (argv) => {
+            expect(thrown(() => parseNativeArgs(argv)).code).toBe("NATIVE-004")
+        }
+    )
+})
+
+describe("isInteractive", () => {
+    const tty = { isTTY: true }
+    const pipe = { isTTY: false }
+
+    it("needs both stdin and stdout to be terminals", () => {
+        expect(isInteractive({ stdin: tty, stdout: tty, env: {} })).toBe(true)
+        expect(isInteractive({ stdin: pipe, stdout: tty, env: {} })).toBe(false)
+        expect(isInteractive({ stdin: tty, stdout: pipe, env: {} })).toBe(false)
+    })
+
+    it("is false under CI", () => {
+        expect(isInteractive({ stdin: tty, stdout: tty, env: { CI: "true" } })).toBe(false)
+        expect(isInteractive({ stdin: tty, stdout: tty, env: { CI: "1" } })).toBe(false)
+        expect(isInteractive({ stdin: tty, stdout: tty, env: { CI: "false" } })).toBe(true)
+        expect(isInteractive({ stdin: tty, stdout: tty, env: { CI: "" } })).toBe(true)
+    })
+})
+
+describe("needsAnswerError", () => {
+    it("names the flag", () => {
+        const error = needsAnswerError("Install JDK 17 with Homebrew?", { flag: "--yes" })
+        expect(error.code).toBe("NATIVE-005")
+        expect(error.message).toContain("Install JDK 17 with Homebrew (pass --yes)")
+        expect(error.hint).toContain("--yes")
+    })
+
+    it("says no flag helps when only a person can answer", () => {
+        expect(needsAnswerError("Create an upload key").hint).toContain("not even --yes")
+    })
+})
+
+describe("askConsent", () => {
+    const never = async () => {
+        throw new Error("must not prompt")
+    }
+    const answer = (value: string) => async () => value
+
+    it("--yes answers installs without asking", async () => {
+        await expect(
+            askConsent("install", "Install?", { flags: { yes: true }, isTTY: false, prompt: never })
+        ).resolves.toBe(true)
+    })
+
+    it("--yes never answers licences or key creation", async () => {
+        const licence = await askConsent("licence", "Accept?", { flags: { yes: true }, isTTY: false }).catch(
+            (e) => e
+        )
+        expect(licence.code).toBe("NATIVE-005")
+        expect(licence.message).toContain("--accept-licenses")
+        const key = await askConsent("key", "Create key?", {
+            flags: { yes: true, acceptLicenses: true },
+            isTTY: false,
+        }).catch((e) => e)
+        expect(key.code).toBe("NATIVE-005")
+    })
+
+    it("--accept-licenses answers licences", async () => {
+        await expect(
+            askConsent("licence", "Accept?", { flags: { acceptLicenses: true }, isTTY: false, prompt: never })
+        ).resolves.toBe(true)
+    })
+
+    it("without a terminal or flag, an install fails naming --yes", async () => {
+        const error = await askConsent("install", "Install the SDK?", { isTTY: false }).catch((e) => e)
+        expect(error.code).toBe("NATIVE-005")
+        expect(error.message).toContain("--yes")
+    })
+
+    it("asks in a terminal, and key creation defaults to no", async () => {
+        await expect(askConsent("install", "Install?", { isTTY: true, prompt: answer("n") })).resolves.toBe(
+            false
+        )
+        await expect(askConsent("key", "Create?", { isTTY: true, prompt: answer("yes") })).resolves.toBe(true)
+        let asked = ""
+        await askConsent("key", "Create?", {
+            isTTY: true,
+            prompt: async (question: string, { defaultValue }: any) => {
+                asked = question
+                return defaultValue
+            },
+        })
+        expect(asked).toContain("[y/N]")
+    })
+})
+
+describe("select", () => {
+    const choices = [
+        { label: "Emulator", value: "emulator" },
+        { label: "Pixel 8 (USB)", value: "device" },
+    ]
+
+    it("returns the default without a terminal", async () => {
+        await expect(select("Run on", choices, { defaultValue: "emulator", isTTY: false })).resolves.toBe(
+            "emulator"
+        )
+    })
+
+    it("fails naming the flag without a terminal or default", async () => {
+        const error = await select("Run on", choices, { flag: "--device", isTTY: false }).catch((e) => e)
+        expect(error.code).toBe("NATIVE-005")
+        expect(error.message).toContain("--device")
+    })
+
+    it("asks by number and re-asks on a bad answer", async () => {
+        const answers = ["9", "2"]
+        const out: string[] = []
+        const value = await select("Run on", choices, {
+            isTTY: true,
+            defaultValue: "emulator",
+            prompt: async () => answers.shift() as string,
+            write: (text: string) => out.push(text),
+        })
+        expect(value).toBe("device")
+        expect(out.join("")).toContain("2. Pixel 8 (USB)")
+    })
+})