eoas 3.0.3 → 3.0.4

package/dist/commands/generate-certs.js

@@ -7,6 +7,7 @@ const fs_extra_1 = require("fs-extra");
 const path_1 = tslib_1.__importDefault(require("path"));
 const log_1 = tslib_1.__importDefault(require("../lib/log"));
 const prompts_1 = require("../lib/prompts");
+const utils_1 = require("../lib/utils");
 class GenerateCerts extends core_1.Command {
     static args = {};
     static description = 'Generate private & public certificates for code signing';
@@ -78,6 +79,9 @@ class GenerateCerts extends core_1.Command {
         });
         const keyPairPEM = (0, code_signing_certificates_1.convertKeyPairToPEM)(keyPair);
         const certificatePEM = (0, code_signing_certificates_1.convertCertificateToCertificatePEM)(certificate);
+        // Before the key touches the disk, so there is no window where it exists
+        // uncovered by the ignore rule.
+        (0, utils_1.ensurePrivateKeyIgnored)(process.cwd());
         await Promise.all([
             (0, fs_extra_1.writeFile)(path_1.default.join(keyOutput, 'public-key.pem'), keyPairPEM.publicKeyPEM),
             (0, fs_extra_1.writeFile)(path_1.default.join(keyOutput, 'private-key.pem'), keyPairPEM.privateKeyPEM),
@@ -85,6 +89,8 @@ class GenerateCerts extends core_1.Command {
         ]);
         log_1.default.succeed(`Generated public and private keys output in ${keyOutputDir}. Please follow the documentation to securely store them and do not commit them to your repository.`);
         log_1.default.succeed(`Generated code signing certificate output in ${certificateOutputDir}.`);
+        log_1.default.warn('⚠️ private-key.pem is used by your OTA server to sign updates. Never commit it and do not keep it inside your app project: configure it on your server (or in a secret store), then remove it from this machine.');
+        log_1.default.warn('Your team does not need this key for local development: run the dev server with DISABLE_CODE_SIGNING=true. See the "Local development" section of the documentation.');
     }
 }
 exports.default = GenerateCerts;

package/dist/commands/init.js

@@ -41,7 +41,7 @@ class Init extends core_1.Command {
             message: 'Enter the URL of your update server (ex: https://customota.com)',
             name: 'updateUrl',
             type: 'text',
-            initial: (0, expoConfig_1.getExpoConfigUpdateUrl)(config),
+            initial: ((0, expoConfig_1.getExpoConfigUpdateUrl)(config) || '').replace(/\/manifest$/, ''),
             validate: v => {
                 return !!v && (0, utils_1.isValidUpdateUrl)(v);
             },
@@ -95,13 +95,15 @@ class Init extends core_1.Command {
                 }
             },
         });
+        // The code signing fields are guarded so the dev server can run without the
+        // private key: DISABLE_CODE_SIGNING=true expo start --dev-client. The strings
+        // are emitted as raw expressions by createOrModifyExpoConfigAsync.
         const newUpdateConfig = {
             url: manifestEndpoint,
-            codeSigningMetadata: {
-                keyid: 'main',
-                alg: 'rsa-v1_5-sha256',
-            },
-            codeSigningCertificate: codeSigningCertificatePath,
+            codeSigningMetadata: "process.env.DISABLE_CODE_SIGNING ? undefined : { keyid: 'main', alg: 'rsa-v1_5-sha256' }",
+            codeSigningCertificate: `process.env.DISABLE_CODE_SIGNING ? undefined : '${codeSigningCertificatePath
+                .replace(/\\/g, '\\\\')
+                .replace(/'/g, "\\'")}'`,
             enabled: true,
             requestHeaders: {
                 'expo-channel-name': 'process.env.RELEASE_CHANNEL',
@@ -119,6 +121,7 @@ class Init extends core_1.Command {
             updateConfigSpinner.fail('Failed to update Expo config');
             log_1.default.error(e);
         }
+        (0, utils_1.ensurePrivateKeyIgnored)(projectDir);
     }
 }
 exports.default = Init;

package/dist/lib/expoConfig.d.ts

@@ -23,5 +23,5 @@ export declare function getPublicExpoConfigAsync(projectDir: string, opts?: Expo
 export declare function getExpoConfigUpdateUrl(config: ExpoConfig): string | undefined;
 export declare function getExpoAppId(config: ExpoConfig): string | undefined;
 export declare function requireExpoAppId(config: ExpoConfig): string;
-export declare function createOrModifyExpoConfigAsync(projectDir: string, exp: Partial<ExpoConfig>): Promise<void>;
+export declare function createOrModifyExpoConfigAsync(projectDir: string, exp: Record<string, any>): Promise<void>;
 export declare function resolveServerUrl(config: ExpoConfig): Promise<string>;

package/dist/lib/expoConfig.js

@@ -31,7 +31,13 @@ async function getExpoConfigInternalAsync(projectDir, opts = {}) {
             const runner = (0, packageRunner_1.resolvePackageRunner)(opts.packageRunner, projectDir);
             const [runnerCommand, runnerArgs] = (0, packageRunner_1.splitPackageRunner)(runner);
             try {
-                const { stdout } = await (0, spawn_async_1.default)(runnerCommand, [...runnerArgs, 'expo', 'config', '--json', ...(opts.isPublicConfig ? ['--type', 'public'] : [])], {
+                const { stdout } = await (0, spawn_async_1.default)(runnerCommand, [
+                    ...runnerArgs,
+                    'expo',
+                    'config',
+                    '--json',
+                    ...(opts.isPublicConfig ? ['--type', 'public'] : []),
+                ], {
                     cwd: projectDir,
                     env: {
                         ...process.env,
@@ -132,6 +138,10 @@ function requireExpoAppId(config) {
     return appId;
 }
 exports.requireExpoAppId = requireExpoAppId;
+// exp is a config fragment. String values starting with 'process.env.' are
+// emitted as raw JavaScript expressions rather than string literals, so callers
+// can write env-dependent values like
+// "process.env.DISABLE_CODE_SIGNING ? undefined : './certs/certificate.pem'".
 async function createOrModifyExpoConfigAsync(projectDir, exp) {
     try {
         ensureExpoConfigExists(projectDir);
@@ -148,37 +158,22 @@ async function createOrModifyExpoConfigAsync(projectDir, exp) {
             // eslint-disable-next-line node/no-sync
             fs_extra_1.default.writeFileSync(configPathJS, newConfigContent);
         }
-        else if (hasJsConfig) {
+        else {
+            const configPath = hasJsConfig ? configPathJS : configPathTS;
             // eslint-disable-next-line node/no-sync
-            const existingCode = fs_extra_1.default.readFileSync(configPathJS, 'utf8');
-            const j = jscodeshift_1.default;
+            const existingCode = fs_extra_1.default.readFileSync(configPath, 'utf8');
+            const j = configPath.endsWith('.ts') ? jscodeshift_1.default.withParser('ts') : jscodeshift_1.default;
             const ast = j(existingCode);
-            ast.find(j.ArrowFunctionExpression).forEach(path => {
-                if (path.value.body &&
-                    j.BlockStatement.check(path.value.body) &&
-                    path.value.body.body.length > 0) {
-                    const returnStatement = path.value.body.body.find(node => j.ReturnStatement.check(node));
-                    if (returnStatement &&
-                        j.ReturnStatement.check(returnStatement) &&
-                        returnStatement.argument) {
-                        const configObject = returnStatement.argument;
-                        if (j.ObjectExpression.check(configObject)) {
-                            updateObjectExpression(j, configObject, exp);
-                        }
-                    }
-                }
-            });
+            if (!updateExportedConfigObject(j, ast, exp)) {
+                throw new Error(`Could not find the exported config object in ${path_1.default.basename(configPath)}.`);
+            }
             const updatedCode = ast.toSource({
                 quote: 'auto',
                 trailingComma: true,
                 reuseWhitespace: true,
             });
             // eslint-disable-next-line node/no-sync
-            fs_extra_1.default.writeFileSync(configPathJS, updatedCode);
-        }
-        else if (configPathTS) {
-            log_1.default.warn('TypeScript support is not yet implemented.');
-            throw new Error('TypeScript support is not yet implemented.');
+            fs_extra_1.default.writeFileSync(configPath, updatedCode);
         }
     }
     catch (e) {
@@ -192,12 +187,65 @@ async function createOrModifyExpoConfigAsync(projectDir, exp) {
     }
 }
 exports.createOrModifyExpoConfigAsync = createOrModifyExpoConfigAsync;
+// Finds the object literal the dynamic config exports (export default or
+// module.exports; a function returning it, with expression or block body;
+// optional 'as' casts) and merges exp into it. Returns false when no
+// recognizable shape is found, so the caller can fail loudly instead of
+// writing the file back unchanged.
+function updateExportedConfigObject(j, ast, exp) {
+    const exportedNodes = [];
+    ast.find(j.ExportDefaultDeclaration).forEach(p => exportedNodes.push(p.value.declaration));
+    ast
+        .find(j.AssignmentExpression, {
+        left: { object: { name: 'module' }, property: { name: 'exports' } },
+    })
+        .forEach(p => exportedNodes.push(p.value.right));
+    for (const exportedNode of exportedNodes) {
+        const configObject = resolveConfigObject(j, exportedNode);
+        if (configObject) {
+            updateObjectExpression(j, configObject, exp);
+            return true;
+        }
+    }
+    return false;
+}
+function resolveConfigObject(j, exportedNode) {
+    let node = unwrapExpression(exportedNode);
+    if (j.ArrowFunctionExpression.check(node) ||
+        j.FunctionExpression.check(node) ||
+        j.FunctionDeclaration.check(node)) {
+        if (j.BlockStatement.check(node.body)) {
+            const returnStatement = node.body.body.find((statement) => j.ReturnStatement.check(statement));
+            node = returnStatement?.argument ?? null;
+        }
+        else {
+            node = node.body;
+        }
+        node = node && unwrapExpression(node);
+    }
+    return node && j.ObjectExpression.check(node) ? node : null;
+}
+// Strips TS casts and parentheses: `({ ... } as ExpoConfig)` -> the object.
+function unwrapExpression(node) {
+    let current = node;
+    while (current &&
+        (current.type === 'TSAsExpression' ||
+            current.type === 'TSSatisfiesExpression' ||
+            current.type === 'ParenthesizedExpression')) {
+        current = current.expression;
+    }
+    return current;
+}
 function updateObjectExpression(j, configObject, updates) {
     Object.entries(updates).forEach(([key, value]) => {
-        const existingProperty = configObject.properties.find(prop => {
-            return (prop.type === 'Property' &&
-                ((prop.key.type === 'Identifier' && prop.key.name === key) ||
-                    (prop.key.type === 'StringLiteral' && prop.key.value === key)));
+        // The default parser produces 'Property' nodes, the ts parser 'ObjectProperty'.
+        const existingProperty = configObject.properties.find((prop) => {
+            if (prop.type !== 'Property' && prop.type !== 'ObjectProperty') {
+                return false;
+            }
+            return ((prop.key.type === 'Identifier' && prop.key.name === key) ||
+                ((prop.key.type === 'StringLiteral' || prop.key.type === 'Literal') &&
+                    prop.key.value === key));
         });
         if (existingProperty) {
             configObject.properties = configObject.properties.filter(prop => prop !== existingProperty);
@@ -208,7 +256,10 @@ function updateObjectExpression(j, configObject, updates) {
 }
 function createValueNode(j, value) {
     if (typeof value === 'string' && value.startsWith('process.env.')) {
-        return j.memberExpression(j.memberExpression(j.identifier('process'), j.identifier('env')), j.identifier(value.split('.')[2]));
+        if (/^process\.env\.\w+$/.test(value)) {
+            return j.memberExpression(j.memberExpression(j.identifier('process'), j.identifier('env')), j.identifier(value.split('.')[2]));
+        }
+        return parseExpressionNode(j, value);
     }
     if (typeof value === 'object' && value !== null) {
         return j.objectExpression(Object.entries(value).map(([key, val]) => j.objectProperty(j.stringLiteral(key), createValueNode(j, val)) // Force stringLiteral pour garder les guillemets
@@ -216,8 +267,19 @@ function createValueNode(j, value) {
     }
     return j.literal(value);
 }
+function parseExpressionNode(j, code) {
+    const statement = j(`(${code});`).find(j.ExpressionStatement).nodes()[0];
+    return statement.expression;
+}
+// Raw expressions are swapped for placeholders before JSON.stringify and
+// spliced back verbatim afterwards, so JSON escaping never mangles their
+// contents (backslashes in Windows paths, quotes, ...).
 function stringifyWithEnv(obj) {
-    return JSON.stringify(obj, null, 2).replace(/"process\.env\.(\w+)"/g, 'process.env.$1');
+    const rawExpressions = [];
+    const json = JSON.stringify(obj, (_key, value) => typeof value === 'string' && value.startsWith('process.env.')
+        ? `__RAW_EXPR_${rawExpressions.push(value) - 1}__`
+        : value, 2);
+    return json.replace(/"__RAW_EXPR_(\d+)__"/g, (_match, index) => rawExpressions[Number(index)]);
 }
 async function resolveServerUrl(config) {
     const updateUrl = config.updates?.url;

package/dist/lib/packageRunner.js

@@ -58,7 +58,9 @@ function detectRunnerFromPackageJson(startDir) {
     while (dir !== root) {
         const pkgPath = path_1.default.join(dir, 'package.json');
         try {
+            // eslint-disable-next-line node/no-sync
             if (fs_extra_1.default.existsSync(pkgPath)) {
+                // eslint-disable-next-line node/no-sync
                 const pkg = fs_extra_1.default.readJsonSync(pkgPath);
                 if (pkg.packageManager) {
                     const name = pkg.packageManager.split('@')[0];

package/dist/lib/utils.d.ts

@@ -1 +1,2 @@
 export declare function isValidUpdateUrl(updateUrl: string): boolean;
+export declare function ensurePrivateKeyIgnored(projectDir: string): void;

package/dist/lib/utils.js

@@ -1,7 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isValidUpdateUrl = void 0;
+exports.ensurePrivateKeyIgnored = exports.isValidUpdateUrl = void 0;
+const tslib_1 = require("tslib");
+const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
+const path_1 = tslib_1.__importDefault(require("path"));
+const log_1 = tslib_1.__importDefault(require("./log"));
 function isValidUpdateUrl(updateUrl) {
     return updateUrl.match(/^https?:\/\/[^/]+$/) !== null;
 }
 exports.isValidUpdateUrl = isValidUpdateUrl;
+// Keeps the code signing private key out of the app repository: appends a bare
+// 'private-key.pem' pattern to the project .gitignore (a pattern without a
+// slash matches at every directory level). Only an existing bare rule counts:
+// comments, negated entries and path-specific rules like certs/private-key.pem
+// do not guarantee project-wide protection. Appending at the end also wins over
+// an earlier negated entry, since the last matching gitignore rule prevails.
+function ensurePrivateKeyIgnored(projectDir) {
+    const gitignorePath = path_1.default.join(projectDir, '.gitignore');
+    try {
+        // eslint-disable-next-line node/no-sync
+        const gitignore = fs_extra_1.default.existsSync(gitignorePath) ? fs_extra_1.default.readFileSync(gitignorePath, 'utf8') : '';
+        const lines = gitignore.split(/\r?\n/).map(line => line.trim());
+        const lastBareRule = lines.lastIndexOf('private-key.pem');
+        const lastNegation = lines.lastIndexOf('!private-key.pem');
+        if (lastBareRule !== -1 && lastBareRule > lastNegation) {
+            return;
+        }
+        const separator = gitignore === '' ? '' : gitignore.endsWith('\n') ? '\n' : '\n\n';
+        // eslint-disable-next-line node/no-sync
+        fs_extra_1.default.appendFileSync(gitignorePath, `${separator}# Code signing private key (server-side secret, never commit it)\nprivate-key.pem\n`);
+        log_1.default.succeed('Added private-key.pem to .gitignore');
+    }
+    catch {
+        log_1.default.warn('Could not update .gitignore. Make sure private-key.pem is never committed to your repository.');
+    }
+}
+exports.ensurePrivateKeyIgnored = ensurePrivateKeyIgnored;

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "eoas",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "main": "index.js",
   "scripts": {
     "build": "tsc --project tsconfig.json",
     "watch": "tsc --project tsconfig.json --watch",
-    "lint": "eslint ."
+    "lint": "eslint .",
+    "test": "vitest run"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -82,7 +83,8 @@
     "eslint-plugin-async-protect": "^3.1.0",
     "eslint-plugin-node": "^11.1.0",
     "ts-node": "10.9.2",
-    "typescript": "5.3.3"
+    "typescript": "5.3.3",
+    "vitest": "^2.1.9"
   },
   "bin": {
     "eoas": "bin/run.js"