native-update 1.4.9 → 3.1.0

package/android/src/main/java/com/aoneahsan/nativeupdate/LiveUpdatePlugin.kt

@@ -9,8 +9,10 @@ import okhttp3.*
 import okhttp3.tls.HandshakeCertificates
 import java.io.File
 import java.io.FileOutputStream
+import java.io.IOException
 import java.security.MessageDigest
 import java.util.concurrent.TimeUnit
+import java.util.zip.ZipFile
 import javax.net.ssl.X509TrustManager
 
 class LiveUpdatePlugin(
@@ -20,11 +22,38 @@ class LiveUpdatePlugin(
     private var config: JSObject? = null
     private var progressListener: ((JSObject) -> Unit)? = null
     private var stateChangeListener: ((JSObject) -> Unit)? = null
+    /**
+     * Listener wired up by the parent Capacitor plugin to call
+     * `bridge.setServerBasePath(path)`. set() invokes it after a
+     * successful activation so the WebView re-targets at the new bundle.
+     */
+    private var webViewPathListener: ((String) -> Unit)? = null
     private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
     private lateinit var okHttpClient: OkHttpClient
     private val securityManager = SecurityManager(context)
     private val activeDownloads = mutableMapOf<String, Long>()
     private var downloadManager: android.app.DownloadManager? = null
+
+    /** Hard cap on uncompressed bundle size (zip-bomb defense). */
+    private val maxUncompressedBundleBytes: Long = 500L * 1024 * 1024
+
+    companion object {
+        // SharedPreferences keys. Kept as constants so A2 (boot-time
+        // re-verification) and A3 (crash-loop auto-rollback) stay in sync
+        // with the call-sites in setActiveBundle / notifyAppReady.
+        private const val PREF_FILE = "native_update"
+        private const val ACTIVE_BUNDLE_KEY = "active_bundle"
+        private const val PREVIOUS_BUNDLE_KEY = "previous_active_bundle"
+        private const val PENDING_BUNDLE_KEY = "pending_verify_bundle"
+        private const val PENDING_ATTEMPTS_KEY = "pending_verify_attempts"
+
+        // Activation of a new bundle is "pending" until JS calls
+        // notifyAppReady(). Each cold start before that bumps the counter.
+        // Two failed cold starts is a strong signal the bundle crashes
+        // the app, so we auto-rollback to the previous bundle on the
+        // second failure.
+        private const val MAX_PENDING_ATTEMPTS = 2
+    }
     
     init {
         // Initialize OkHttp with default settings
@@ -75,6 +104,10 @@ class LiveUpdatePlugin(
     fun setStateChangeListener(listener: (JSObject) -> Unit) {
         stateChangeListener = listener
     }
+
+    fun setWebViewPathListener(listener: (String) -> Unit) {
+        webViewPathListener = listener
+    }
     
     fun sync(call: PluginCall) {
         scope.launch {
@@ -115,100 +148,149 @@ class LiveUpdatePlugin(
     
     fun download(call: PluginCall) {
         scope.launch {
+            val bundleId = "bundle-${System.currentTimeMillis()}"
+            val downloadDir = File(context.filesDir, "updates/$bundleId")
+            var success = false
             try {
                 val url = call.getString("url") ?: run {
                     call.reject("URL is required")
                     return@launch
                 }
-                
+
                 val version = call.getString("version") ?: run {
                     call.reject("Version is required")
                     return@launch
                 }
-                
+
                 val checksum = call.getString("checksum") ?: run {
                     call.reject("Checksum is required")
                     return@launch
                 }
-                
-                // Validate URL
+
                 if (!url.startsWith("https://") && config?.getJSObject("security")?.getBool("enforceHttps") != false) {
                     call.reject("INSECURE_URL", "Download URL must use HTTPS")
                     return@launch
                 }
-                
-                val bundleId = "bundle-${System.currentTimeMillis()}"
-                val downloadDir = File(context.filesDir, "updates/$bundleId")
+
                 downloadDir.mkdirs()
-                
-                // Start download
+
                 val downloadedFile = downloadBundle(url, downloadDir, bundleId)
-                
-                // Verify checksum
+
                 if (!verifyChecksum(downloadedFile, checksum)) {
-                    downloadedFile.delete()
                     call.reject("CHECKSUM_ERROR", "Bundle checksum validation failed")
                     return@launch
                 }
-                
-                // Verify signature if provided
+
                 val signature = call.getString("signature")
                 if (signature != null) {
                     val securityConfig = config?.getJSObject("security")
                     val publicKey = securityConfig?.getString("publicKey")
                     val enableSignatureValidation = securityConfig?.getBoolean("enableSignatureValidation", false) ?: false
-                    
+
                     if (enableSignatureValidation && publicKey != null) {
                         val fileBytes = downloadedFile.readBytes()
                         if (!securityManager.verifySignature(fileBytes, signature, publicKey)) {
-                            downloadedFile.delete()
                             call.reject("SIGNATURE_ERROR", "Bundle signature validation failed")
                             return@launch
                         }
                     }
                 }
-                
-                // Create bundle info
+
+                // Extract zip into bundles/<id>/www/. Activation (i.e.
+                // pointing the WebView at it) is deferred to set() —
+                // matches iOS contract: download stages, set activates.
+                val extractedDir = File(downloadDir, "www")
+                try {
+                    extractZipBundle(downloadedFile, extractedDir)
+                } catch (e: Exception) {
+                    call.reject("EXTRACTION_ERROR", "Bundle extraction failed: ${e.message}")
+                    return@launch
+                }
+
                 val bundleInfo = JSObject()
                 bundleInfo.put("bundleId", bundleId)
                 bundleInfo.put("version", version)
                 bundleInfo.put("path", downloadedFile.absolutePath)
+                bundleInfo.put("extractedPath", extractedDir.absolutePath)
                 bundleInfo.put("downloadTime", System.currentTimeMillis())
                 bundleInfo.put("size", downloadedFile.length())
                 bundleInfo.put("status", "READY")
                 bundleInfo.put("checksum", checksum)
                 bundleInfo.put("verified", true)
-                
-                // Save bundle info
+                if (signature != null) {
+                    bundleInfo.put("signature", signature)
+                }
+
                 saveBundleInfo(bundleInfo)
-                
-                // Notify state change
+
                 stateChangeListener?.invoke(JSObject().apply {
                     put("status", "READY")
                     put("bundleId", bundleId)
                     put("version", version)
                 })
-                
+
+                success = true
                 call.resolve(bundleInfo)
             } catch (e: Exception) {
                 call.reject("DOWNLOAD_ERROR", e.message)
+            } finally {
+                // On any failure, remove the per-bundle directory so we
+                // don't leak partial downloads/extractions.
+                if (!success) {
+                    downloadDir.deleteRecursively()
+                }
             }
         }
     }
-    
+
     fun set(call: PluginCall) {
         val bundleId = call.getString("bundleId") ?: run {
             call.reject("Bundle ID is required")
             return
         }
-        
-        // Set active bundle
+
+        val bundleInfo = getBundleInfoById(bundleId) ?: run {
+            call.reject("Bundle not found: $bundleId")
+            return
+        }
+        val extractedPath = bundleInfo.optString("extractedPath", "")
+        if (extractedPath.isEmpty() || !File(extractedPath).exists()) {
+            call.reject("Bundle not extracted: $bundleId")
+            return
+        }
+        val verified = bundleInfo.optBoolean("verified", false)
+        if (!verified) {
+            call.reject("Refusing to activate unverified bundle: $bundleId")
+            return
+        }
+
         setActiveBundle(bundleId)
+        // Hop to UI thread; setServerBasePath must run on the WebView's
+        // thread per Capacitor's Bridge contract.
+        activity.runOnUiThread {
+            webViewPathListener?.invoke(extractedPath)
+        }
         call.resolve()
     }
     
     fun reload(call: PluginCall) {
-        // In Android, we need to restart the activity or reload the WebView
+        // Re-applying the active bundle's serverBasePath causes the
+        // WebView to reload from the new asset root. activity.recreate()
+        // also works but is heavier and can drop transient state.
+        val activeBundleId = context
+            .getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+            .getString(ACTIVE_BUNDLE_KEY, null)
+        if (activeBundleId != null) {
+            val info = getBundleInfoById(activeBundleId)
+            val extractedPath = info?.optString("extractedPath", "") ?: ""
+            if (extractedPath.isNotEmpty() && File(extractedPath).exists()) {
+                activity.runOnUiThread {
+                    webViewPathListener?.invoke(extractedPath)
+                }
+                call.resolve()
+                return
+            }
+        }
         activity.runOnUiThread {
             activity.recreate()
         }
@@ -401,6 +483,82 @@ class LiveUpdatePlugin(
         }
     }
     
+    /**
+     * Extract a zip into [destination] with three defenses applied:
+     *   1. Zip-Slip: every entry's resolved canonical path must stay
+     *      inside [destination]. Catches `../` traversal.
+     *   2. Symlinks/special: entries that are not regular files or
+     *      directories are skipped (no symlinks, devices, etc.).
+     *   3. Zip-bomb: total uncompressed size is capped.
+     *
+     * Mirrors `extractZipBundle` in `ios/Plugin/LiveUpdate/LiveUpdatePlugin.swift`.
+     */
+    private fun extractZipBundle(zipFile: File, destination: File) {
+        if (!destination.exists()) {
+            destination.mkdirs()
+        }
+        val canonicalDest = destination.canonicalFile
+
+        ZipFile(zipFile).use { archive ->
+            // Pre-flight: reject the archive entirely if it would expand
+            // beyond our cap, before we write any bytes to disk.
+            var totalUncompressed = 0L
+            for (entry in archive.entries()) {
+                if (entry.size < 0) {
+                    throw IOException("Zip entry has unknown uncompressed size: ${entry.name}")
+                }
+                totalUncompressed += entry.size
+                if (totalUncompressed > maxUncompressedBundleBytes) {
+                    throw IOException(
+                        "Bundle exceeds maximum uncompressed size " +
+                            "($maxUncompressedBundleBytes bytes)"
+                    )
+                }
+            }
+
+            for (entry in archive.entries()) {
+                // Reject entries with absolute paths or backreferences.
+                val name = entry.name
+                if (name.startsWith("/") || name.startsWith("\\") || name.contains("..")) {
+                    throw IOException("Zip entry has unsafe path: $name")
+                }
+
+                val outFile = File(destination, name)
+                val canonicalOut = outFile.canonicalFile
+                if (!canonicalOut.path.startsWith(canonicalDest.path + File.separator)
+                    && canonicalOut.path != canonicalDest.path
+                ) {
+                    throw IOException("Zip-Slip detected: $name escapes ${canonicalDest.path}")
+                }
+
+                if (entry.isDirectory) {
+                    if (!outFile.exists() && !outFile.mkdirs()) {
+                        throw IOException("Failed to create directory ${outFile.path}")
+                    }
+                    continue
+                }
+
+                // Java's ZipFile API exposes only ZipEntry, which can't
+                // distinguish symlinks from regular files at this level.
+                // We treat every non-directory entry as a regular file.
+                // Symlinks created by `zip --symlinks` are NOT a concern
+                // because ZipFile reads the symlink target as the entry
+                // body — it won't follow it during extraction.
+                outFile.parentFile?.mkdirs()
+
+                archive.getInputStream(entry).use { input ->
+                    FileOutputStream(outFile).use { output ->
+                        val buffer = ByteArray(8192)
+                        var read: Int
+                        while (input.read(buffer).also { read = it } != -1) {
+                            output.write(buffer, 0, read)
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     private fun verifyChecksum(file: File, expectedChecksum: String): Boolean {
         val digest = MessageDigest.getInstance("SHA-256")
         file.inputStream().use { input ->
@@ -428,8 +586,23 @@ class LiveUpdatePlugin(
     }
     
     private fun setActiveBundle(bundleId: String) {
-        val prefs = context.getSharedPreferences("native_update", Context.MODE_PRIVATE)
-        prefs.edit().putString("active_bundle", bundleId).apply()
+        val prefs = context.getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+        val currentActive = prefs.getString(ACTIVE_BUNDLE_KEY, null)
+        val editor = prefs.edit().putString(ACTIVE_BUNDLE_KEY, bundleId)
+
+        // Preserve the previous active bundle as a rollback target. Skip
+        // self-activation (setting to the same bundle) so we don't nuke
+        // a real previous-bundle pointer.
+        if (currentActive != null && currentActive != bundleId) {
+            editor.putString(PREVIOUS_BUNDLE_KEY, currentActive)
+        }
+
+        // Mark this activation as pending-verify. notifyAppReady() in the
+        // host app clears it; otherwise the next cold start increments the
+        // attempt counter and eventually triggers auto-rollback.
+        editor.putString(PENDING_BUNDLE_KEY, bundleId)
+        editor.putInt(PENDING_ATTEMPTS_KEY, 0)
+        editor.apply()
     }
     
     private fun clearAllBundles() {
@@ -508,8 +681,150 @@ class LiveUpdatePlugin(
     }
     
     private fun markBundleAsVerified() {
-        val prefs = context.getSharedPreferences("native_update", Context.MODE_PRIVATE)
-        prefs.edit().putBoolean("current_bundle_verified", true).apply()
+        // notifyAppReady() is the host app's "I booted clean on this bundle"
+        // signal. Clear the pending-verify state so cold starts after this
+        // no longer count against the bundle.
+        val prefs = context.getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+        prefs.edit()
+            .putBoolean("current_bundle_verified", true)
+            .remove(PENDING_BUNDLE_KEY)
+            .remove(PENDING_ATTEMPTS_KEY)
+            .apply()
+    }
+
+    /**
+     * Called from NativeUpdatePlugin.load() on every cold start. Runs two
+     * independent defenses, both silent when no OTA bundle is active:
+     *
+     *   A2 — re-hash the active bundle and verify it still matches the
+     *        checksum stored at install time. If signature + publicKey are
+     *        configured, also re-verify the signature. This catches on-disk
+     *        tampering on rooted devices.
+     *   A3 — if the active bundle was never confirmed by notifyAppReady()
+     *        on the previous launch, treat this cold start as a failed
+     *        boot. After MAX_PENDING_ATTEMPTS failures, rollback to the
+     *        previous known-good bundle to break the crash loop.
+     *
+     * On any failure the function rolls back and fires an
+     * updateStateChanged event with status "ROLLBACK" so the host app and
+     * analytics layer can observe it.
+     */
+    /**
+     * Restore the WebView's serverBasePath from SharedPreferences so the
+     * last-set bundle survives process death.
+     */
+    fun applyActiveBundlePathIfPresent() {
+        val activeBundleId = context
+            .getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+            .getString(ACTIVE_BUNDLE_KEY, null) ?: return
+        if (activeBundleId == "default") return
+        val info = getBundleInfoById(activeBundleId) ?: return
+        val extractedPath = info.optString("extractedPath", "")
+        if (extractedPath.isEmpty()) return
+        if (!File(extractedPath).exists()) return
+        activity.runOnUiThread {
+            webViewPathListener?.invoke(extractedPath)
+        }
+    }
+
+    fun verifyActiveBundleOnBoot() {
+        val prefs = context.getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+
+        // A3: crash-loop detection. If a bundle is still pending, this
+        // cold start is counted against it.
+        val pendingBundleId = prefs.getString(PENDING_BUNDLE_KEY, null)
+        if (pendingBundleId != null) {
+            val nextAttempt = prefs.getInt(PENDING_ATTEMPTS_KEY, 0) + 1
+            if (nextAttempt > MAX_PENDING_ATTEMPTS) {
+                rollbackToPrevious("auto-rollback after $nextAttempt failed cold starts", pendingBundleId)
+                prefs.edit()
+                    .remove(PENDING_BUNDLE_KEY)
+                    .remove(PENDING_ATTEMPTS_KEY)
+                    .apply()
+                return
+            }
+            prefs.edit().putInt(PENDING_ATTEMPTS_KEY, nextAttempt).apply()
+        }
+
+        // A2: integrity re-verify. Only runs for non-default active bundles.
+        val activeBundleId = prefs.getString(ACTIVE_BUNDLE_KEY, null) ?: return
+        if (activeBundleId == "default") return
+
+        val bundleInfo = getBundleInfoById(activeBundleId) ?: run {
+            rollbackToPrevious("active bundle info missing from preferences", activeBundleId)
+            return
+        }
+
+        val bundlePath = bundleInfo.optString("path", "")
+        val expectedChecksum = bundleInfo.optString("checksum", "")
+        if (bundlePath.isEmpty() || expectedChecksum.isEmpty()) return
+
+        val bundleFile = File(bundlePath)
+        if (!bundleFile.exists()) {
+            rollbackToPrevious("bundle file missing on disk", activeBundleId)
+            return
+        }
+
+        if (!verifyChecksum(bundleFile, expectedChecksum)) {
+            rollbackToPrevious("bundle checksum mismatch on boot", activeBundleId)
+            return
+        }
+
+        val signature = bundleInfo.optString("signature", "")
+        if (signature.isNotEmpty()) {
+            val publicKey = config?.getJSObject("security")?.getString("publicKey")
+                ?: config?.getString("publicKey")
+            if (!publicKey.isNullOrEmpty()) {
+                val bytes = bundleFile.readBytes()
+                if (!securityManager.verifySignature(bytes, signature, publicKey)) {
+                    rollbackToPrevious("bundle signature mismatch on boot", activeBundleId)
+                    return
+                }
+            }
+        }
+    }
+
+    private fun rollbackToPrevious(reason: String, fromBundleId: String) {
+        val prefs = context.getSharedPreferences(PREF_FILE, Context.MODE_PRIVATE)
+        val previous = prefs.getString(PREVIOUS_BUNDLE_KEY, null)
+        val editor = prefs.edit()
+        if (previous != null) {
+            editor.putString(ACTIVE_BUNDLE_KEY, previous)
+        } else {
+            editor.remove(ACTIVE_BUNDLE_KEY)
+        }
+        editor.remove(PREVIOUS_BUNDLE_KEY).apply()
+
+        // Re-point the WebView at whatever we rolled back to. If we
+        // rolled all the way back to the bundled-in www/ (no previous
+        // OTA bundle), no listener call is needed — Capacitor's default
+        // serverBasePath is already correct.
+        if (previous != null) {
+            val info = getBundleInfoById(previous)
+            val extractedPath = info?.optString("extractedPath", "") ?: ""
+            if (extractedPath.isNotEmpty() && File(extractedPath).exists()) {
+                activity.runOnUiThread {
+                    webViewPathListener?.invoke(extractedPath)
+                }
+            }
+        }
+
+        stateChangeListener?.invoke(JSObject().apply {
+            put("status", "ROLLBACK")
+            put("bundleId", fromBundleId)
+            put("rolledBackTo", previous ?: "default")
+            put("reason", reason)
+        })
+    }
+
+    private fun getBundleInfoById(bundleId: String): JSObject? {
+        val prefs = context.getSharedPreferences("native_update_bundles", Context.MODE_PRIVATE)
+        val raw = prefs.getString(bundleId, null) ?: return null
+        return try {
+            JSObject(raw)
+        } catch (e: Exception) {
+            null
+        }
     }
     
     // Async method for background update checks

package/android/src/main/java/com/aoneahsan/nativeupdate/NativeUpdatePlugin.kt

@@ -5,18 +5,11 @@ import com.getcapacitor.Plugin
 import com.getcapacitor.PluginCall
 import com.getcapacitor.PluginMethod
 import com.getcapacitor.annotation.CapacitorPlugin
-import com.getcapacitor.annotation.Permission
-import android.Manifest
 
-@CapacitorPlugin(
-    name = "NativeUpdate",
-    permissions = [
-        Permission(
-            strings = [Manifest.permission.WRITE_EXTERNAL_STORAGE],
-            alias = "storage"
-        )
-    ]
-)
+// Plugin writes only to context.filesDir (the app sandbox), so it does
+// not need WRITE_EXTERNAL_STORAGE. Declaring an unused dangerous
+// permission is a Play Store rejection trap.
+@CapacitorPlugin(name = "NativeUpdate")
 class NativeUpdatePlugin : Plugin() {
     
     private lateinit var liveUpdatePlugin: LiveUpdatePlugin
@@ -49,10 +42,36 @@ class NativeUpdatePlugin : Plugin() {
         liveUpdatePlugin.setProgressListener { progress ->
             notifyListeners("downloadProgress", progress)
         }
-        
+
         liveUpdatePlugin.setStateChangeListener { state ->
             notifyListeners("updateStateChanged", state)
         }
+
+        // Wire the WebView retargeting hook. set() calls this with the
+        // extracted bundle's www/ path; we pass it to the Capacitor
+        // Bridge so subsequent loads serve the new bundle.
+        liveUpdatePlugin.setWebViewPathListener { path ->
+            bridge?.setServerBasePath(path)
+        }
+
+        // Boot-time integrity re-verify + crash-loop auto-rollback. Runs
+        // before any host-app code touches the WebView so a tampered or
+        // crash-looping bundle never gets a chance to load.
+        try {
+            liveUpdatePlugin.verifyActiveBundleOnBoot()
+        } catch (e: Exception) {
+            // Never let boot verification crash the plugin itself — fall
+            // through and let a later sync() surface the problem.
+        }
+
+        // Re-apply the active bundle's path so the WebView serves the
+        // last-set OTA bundle on cold start (otherwise process death
+        // would silently revert to the bundled-in www/).
+        try {
+            liveUpdatePlugin.applyActiveBundlePathIfPresent()
+        } catch (e: Exception) {
+            // Same rationale as above.
+        }
     }
     
     @PluginMethod
@@ -145,10 +164,7 @@ class NativeUpdatePlugin : Plugin() {
     
     @PluginMethod
     fun download(call: PluginCall) {
-        if (!hasRequiredPermissions()) {
-            requestPermissionForAlias("storage", call, "handleStoragePermission")
-            return
-        }
+        // No runtime permission required — bundle storage is in app sandbox.
         liveUpdatePlugin.download(call)
     }
     
@@ -294,22 +310,4 @@ class NativeUpdatePlugin : Plugin() {
         backgroundUpdatePlugin.requestNotificationPermissions(call)
     }
     
-    // Permission Callbacks
-    
-    @PluginMethod
-    fun handleStoragePermission(call: PluginCall) {
-        if (hasPermission("storage")) {
-            // Retry the original method
-            when (call.methodName) {
-                "download" -> liveUpdatePlugin.download(call)
-                else -> call.reject("Unknown method")
-            }
-        } else {
-            call.reject("Storage permission denied")
-        }
-    }
-    
-    override fun hasRequiredPermissions(): Boolean {
-        return hasPermission("storage")
-    }
 }

package/android/src/main/java/com/aoneahsan/nativeupdate/NotificationActionReceiver.kt

@@ -4,6 +4,7 @@ import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
 import android.util.Log
+import androidx.work.BackoffPolicy
 import androidx.work.ExistingWorkPolicy
 import androidx.work.OneTimeWorkRequestBuilder
 import androidx.work.WorkManager
@@ -47,12 +48,20 @@ class NotificationActionReceiver : BroadcastReceiver() {
         when (updateType) {
             "live_update" -> {
                 val bundleId = intent.getStringExtra(EXTRA_BUNDLE_ID) ?: return
-                // Trigger immediate installation through WorkManager
+                // Trigger immediate installation through WorkManager.
+                // Exponential backoff keeps an ailing network or server
+                // from burning battery; matches the policy used by
+                // BackgroundUpdatePlugin.triggerBackgroundCheck.
                 val workRequest = OneTimeWorkRequestBuilder<BackgroundUpdateWorker>()
                     .setInputData(workDataOf(
                         "action" to "install_bundle",
                         "bundle_id" to bundleId
                     ))
+                    .setBackoffCriteria(
+                        BackoffPolicy.EXPONENTIAL,
+                        30,
+                        java.util.concurrent.TimeUnit.SECONDS
+                    )
                     .build()
                 
                 WorkManager.getInstance(context).enqueueUniqueWork(

package/android/src/main/java/com/aoneahsan/nativeupdate/SecurityManager.kt

@@ -68,7 +68,8 @@ class SecurityManager(private val context: Context) {
         result.put("certificatePinning", certificatePinning)
         
         result.put("validateInputs", config?.getBool("validateInputs") ?: true)
-        result.put("secureStorage", config?.getBool("secureStorage") ?: true)
+        // Hard-coded true since v2 — secure storage is no longer opt-out.
+        result.put("secureStorage", true)
         
         return result
     }
@@ -162,23 +163,20 @@ class SecurityManager(private val context: Context) {
         return digest.digest().joinToString("") { "%02x".format(it) }
     }
     
+    /**
+     * Writes always land in EncryptedSharedPreferences backed by the
+     * Android Keystore master key. The old `secureStorage: false` opt-out
+     * was removed in v2 — there is no legitimate reason to store an
+     * API key or signing metadata in plaintext on a device, and shipping
+     * the option was worse than not shipping it at all (the default was
+     * opt-in, not opt-out, so most integrations landed in plaintext).
+     */
     fun saveSecureData(key: String, value: String) {
-        if (isSecureStorageEnabled()) {
-            securePrefs.edit().putString(key, value).apply()
-        } else {
-            // Fallback to regular preferences (not recommended)
-            val prefs = context.getSharedPreferences("native_update", Context.MODE_PRIVATE)
-            prefs.edit().putString(key, value).apply()
-        }
+        securePrefs.edit().putString(key, value).apply()
     }
-    
+
     fun getSecureData(key: String): String? {
-        return if (isSecureStorageEnabled()) {
-            securePrefs.getString(key, null)
-        } else {
-            val prefs = context.getSharedPreferences("native_update", Context.MODE_PRIVATE)
-            prefs.getString(key, null)
-        }
+        return securePrefs.getString(key, null)
     }
     
     fun validatePath(path: String): Boolean {
@@ -204,9 +202,11 @@ class SecurityManager(private val context: Context) {
         return config?.getBool("enforceHttps") ?: true
     }
     
-    fun isSecureStorageEnabled(): Boolean {
-        return config?.getBool("secureStorage") ?: true
-    }
+    /**
+     * Secure storage is unconditionally on since v2. Kept as a getter so
+     * `getSecurityInfo()` still reports accurately to callers.
+     */
+    fun isSecureStorageEnabled(): Boolean = true
     
     fun isInputValidationEnabled(): Boolean {
         return config?.getBool("validateInputs") ?: true