native-update 1.4.9 → 3.1.0

package/dist/esm/web.js

@@ -1,6 +1,11 @@
 import { WebPlugin } from '@capacitor/core';
 import { SyncStatus, BundleStatus, UpdateErrorCode } from './definitions';
 import { ConfigManager } from './core/config';
+import { Logger } from './core/logger';
+// Module-level logger so we never leak sensitive headers / tokens
+// through raw console.* calls. The Logger sanitises payloads (paths,
+// keys, secrets) and respects the runtime log-level switch.
+const logger = new Logger('NativeUpdateWeb');
 export class NativeUpdateWeb extends WebPlugin {
     constructor() {
         super();
@@ -17,6 +22,10 @@ export class NativeUpdateWeb extends WebPlugin {
         };
         this.backgroundCheckInterval = null;
         this.isConfigured = false;
+        // Single-slot cache of the most recently downloaded bundle's bytes so a
+        // follow-up validateUpdate() on the same URL doesn't re-download the
+        // whole bundle just to hash it. Overwritten on each download().
+        this.downloadedBundleBytes = null;
         this.configManager = ConfigManager.getInstance();
         this.loadStoredData();
         this.incrementLaunchCount();
@@ -84,8 +93,7 @@ export class NativeUpdateWeb extends WebPlugin {
         }
     }
     async download(options) {
-        var _a;
-        // Validate URL
+        var _a, _b;
         if (!options.url.startsWith('https://') &&
             ((_a = this.config.security) === null || _a === void 0 ? void 0 : _a.enforceHttps) !== false) {
             throw this.createError(UpdateErrorCode.INSECURE_URL, 'Download URL must use HTTPS');
@@ -96,44 +104,82 @@ export class NativeUpdateWeb extends WebPlugin {
             version: options.version,
             path: options.url,
             downloadTime: Date.now(),
-            size: 0, // Would be calculated during actual download
+            size: 0,
             status: BundleStatus.DOWNLOADING,
             checksum: options.checksum,
             signature: options.signature,
             verified: false,
         };
         this.bundles.set(bundleId, bundle);
-        // Simulate download progress
-        for (let i = 0; i <= 100; i += 10) {
-            await this.notifyListeners('downloadProgress', {
-                percent: i,
-                bytesDownloaded: i * 1000,
-                totalBytes: 10000,
-                bundleId,
-            });
-            await new Promise((resolve) => setTimeout(resolve, 100));
+        // Actually fetch the bundle so we hash REAL bytes, not the bundleId
+        // string. This was a P0: validateChecksum used to receive `bundleId`
+        // and silently fail (or pass) regardless of the bundle contents.
+        let bundleBytes;
+        try {
+            const response = await fetch(options.url);
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            const reader = (_b = response.body) === null || _b === void 0 ? void 0 : _b.getReader();
+            const contentLength = Number(response.headers.get('content-length') || 0);
+            if (reader) {
+                const chunks = [];
+                let received = 0;
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    chunks.push(value);
+                    received += value.length;
+                    if (contentLength > 0) {
+                        await this.notifyListeners('downloadProgress', {
+                            percent: Math.round((received / contentLength) * 100),
+                            bytesDownloaded: received,
+                            totalBytes: contentLength,
+                            bundleId,
+                        });
+                    }
+                }
+                const combined = new Uint8Array(received);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    combined.set(chunk, offset);
+                    offset += chunk.length;
+                }
+                bundleBytes = combined.buffer;
+            }
+            else {
+                bundleBytes = await response.arrayBuffer();
+            }
+        }
+        catch (error) {
+            bundle.status = BundleStatus.FAILED;
+            this.bundles.delete(bundleId);
+            throw this.createError(UpdateErrorCode.NETWORK_ERROR, `Failed to download bundle: ${error.message}`);
         }
-        // Verify bundle integrity if checksum/signature provided
-        let verified = true;
+        bundle.size = bundleBytes.byteLength;
+        let verified = false;
         if (options.checksum) {
-            const checksumValid = await this.validateChecksum(bundleId, options.checksum);
+            const checksumValid = await this.validateChecksum(bundleBytes, options.checksum);
             if (!checksumValid) {
                 bundle.status = BundleStatus.FAILED;
                 this.bundles.delete(bundleId);
                 throw this.createError(UpdateErrorCode.CHECKSUM_ERROR, 'Bundle checksum verification failed');
             }
+            verified = true;
         }
         if (options.signature) {
-            const signatureValid = await this.validateSignature(bundleId, options.signature);
+            const signatureValid = await this.validateSignature(bundleBytes, options.signature);
             if (!signatureValid) {
                 bundle.status = BundleStatus.FAILED;
                 this.bundles.delete(bundleId);
                 throw this.createError(UpdateErrorCode.SIGNATURE_ERROR, 'Bundle signature verification failed');
             }
+            verified = true;
         }
-        // Update bundle status
         bundle.status = BundleStatus.READY;
         bundle.verified = verified;
+        this.downloadedBundleBytes = { path: options.url, bytes: bundleBytes };
         this.saveStoredData();
         await this.notifyListeners('updateStateChanged', {
             status: bundle.status,
@@ -146,24 +192,25 @@ export class NativeUpdateWeb extends WebPlugin {
         if (!this.bundles.has(bundle.bundleId)) {
             throw this.createError(UpdateErrorCode.UNKNOWN_ERROR, 'Bundle not found');
         }
+        const stored = this.bundles.get(bundle.bundleId);
+        if (!stored.verified) {
+            throw this.createError(UpdateErrorCode.SIGNATURE_ERROR, `Refusing to activate unverified bundle ${bundle.bundleId}`);
+        }
         const previousBundle = this.currentBundle;
-        this.currentBundle = bundle;
+        this.currentBundle = stored;
         this.currentBundle.status = BundleStatus.ACTIVE;
-        // Update previous bundle status
         if (previousBundle) {
             previousBundle.status = BundleStatus.READY;
         }
         this.saveStoredData();
     }
     async reload() {
-        // console.log('Web: Reloading application...');
         // In web, we can reload the page
         if (typeof window !== 'undefined') {
             window.location.reload();
         }
     }
     async reset() {
-        // console.log('Web: Resetting to original bundle...');
         this.currentBundle = null;
         this.bundles.clear();
         this.saveStoredData();
@@ -197,7 +244,6 @@ export class NativeUpdateWeb extends WebPlugin {
         this.saveStoredData();
     }
     async notifyAppReady() {
-        // console.log('Web: App ready notification received');
         if (this.currentBundle) {
             this.currentBundle.verified = true;
             this.saveStoredData();
@@ -226,25 +272,49 @@ export class NativeUpdateWeb extends WebPlugin {
         this.config.liveUpdate.channel = channel;
         this.saveConfiguration();
     }
+    /**
+     * @deprecated since v2. See NativeUpdatePluginWeb.setUpdateUrl in plugin.ts.
+     * Update URL is locked after initialize(); this method is a no-op.
+     */
     async setUpdateUrl(url) {
+        void url;
+        logger.warn('setUpdateUrl() is deprecated and ignored. Update URL is locked after initialize().');
+        return;
+    }
+    async validateUpdate(options) {
         var _a;
-        if (!url.startsWith('https://') &&
-            ((_a = this.config.security) === null || _a === void 0 ? void 0 : _a.enforceHttps) !== false) {
-            throw this.createError(UpdateErrorCode.INSECURE_URL, 'Update URL must use HTTPS');
+        // bundlePath on web is the bundle URL (we don't persist bytes locally
+        // here). Reuse the bytes from the last download() when the URL matches;
+        // only re-fetch when validating a bundle we never downloaded.
+        let bundleBytes;
+        if (((_a = this.downloadedBundleBytes) === null || _a === void 0 ? void 0 : _a.path) === options.bundlePath) {
+            bundleBytes = this.downloadedBundleBytes.bytes;
         }
-        if (!this.config.liveUpdate) {
-            this.config.liveUpdate = {};
+        else {
+            try {
+                const response = await fetch(options.bundlePath);
+                if (!response.ok) {
+                    return {
+                        isValid: false,
+                        error: `Failed to fetch bundle for validation: HTTP ${response.status}`,
+                    };
+                }
+                bundleBytes = await response.arrayBuffer();
+            }
+            catch (error) {
+                return {
+                    isValid: false,
+                    error: `Failed to fetch bundle for validation: ${error.message}`,
+                };
+            }
         }
-        this.config.liveUpdate.serverUrl = url;
-        this.saveConfiguration();
-    }
-    async validateUpdate(options) {
-        // Simulate validation
-        const checksumValid = await this.validateChecksum(options.bundlePath, options.checksum);
+        const checksumValid = await this.validateChecksum(bundleBytes, options.checksum);
         const signatureValid = options.signature
-            ? await this.validateSignature(options.bundlePath, options.signature)
+            ? await this.validateSignature(bundleBytes, options.signature)
+            : true;
+        const sizeValid = options.maxSize
+            ? bundleBytes.byteLength <= options.maxSize
             : true;
-        const sizeValid = options.maxSize ? true : true; // Would check actual size
         const isValid = checksumValid && signatureValid && sizeValid;
         return {
             isValid,
@@ -349,7 +419,6 @@ export class NativeUpdateWeb extends WebPlugin {
      * App Update Methods
      */
     async getAppUpdateInfo() {
-        // console.log('Web: App updates not supported on web platform');
         return {
             updateAvailable: false,
             currentVersion: '1.0.0',
@@ -381,6 +450,7 @@ export class NativeUpdateWeb extends WebPlugin {
      * App Review Methods
      */
     async requestReview() {
+        var _a;
         const canRequest = await this.canRequestReview();
         if (!canRequest.canRequest) {
             return {
@@ -388,10 +458,9 @@ export class NativeUpdateWeb extends WebPlugin {
                 error: canRequest.reason,
             };
         }
-        // console.log('Web: Showing review request fallback');
         // Update last request time
         this.lastReviewRequest = Date.now();
-        localStorage.setItem('native-update-last-review', this.lastReviewRequest.toString());
+        (_a = this.getLocalStorage()) === null || _a === void 0 ? void 0 : _a.setItem('native-update-last-review', this.lastReviewRequest.toString());
         // In web, we could show a custom modal or redirect to a review page
         // Note: Web platform cannot display native in-app review dialogs
         // We can offer a fallback redirect, but `displayed` reflects native capability
@@ -447,7 +516,6 @@ export class NativeUpdateWeb extends WebPlugin {
      * Background Update Methods
      */
     async enableBackgroundUpdates(config) {
-        // console.log('Web: Enabling background updates', config);
         if (!this.config.backgroundUpdate) {
             this.config.backgroundUpdate = config;
         }
@@ -464,7 +532,6 @@ export class NativeUpdateWeb extends WebPlugin {
         this.saveConfiguration();
     }
     async disableBackgroundUpdates() {
-        // console.log('Web: Disabling background updates');
         if (this.backgroundCheckInterval) {
             clearInterval(this.backgroundCheckInterval);
             this.backgroundCheckInterval = null;
@@ -481,7 +548,6 @@ export class NativeUpdateWeb extends WebPlugin {
         return Object.assign({}, this.backgroundUpdateStatus);
     }
     async scheduleBackgroundCheck(interval) {
-        // console.log('Web: Scheduling background check with interval', interval);
         if (this.backgroundCheckInterval) {
             clearInterval(this.backgroundCheckInterval);
         }
@@ -494,7 +560,6 @@ export class NativeUpdateWeb extends WebPlugin {
         this.backgroundUpdateStatus.nextCheckTime = Date.now() + interval;
     }
     async triggerBackgroundCheck() {
-        // console.log('Web: Triggering background check');
         if (!this.backgroundUpdateStatus.enabled) {
             return {
                 success: false,
@@ -546,7 +611,6 @@ export class NativeUpdateWeb extends WebPlugin {
         }
     }
     async setNotificationPreferences(preferences) {
-        // console.log('Web: Setting notification preferences', preferences);
         if (!this.config.backgroundUpdate) {
             this.config.backgroundUpdate = {};
         }
@@ -625,7 +689,7 @@ export class NativeUpdateWeb extends WebPlugin {
             return true;
         }
         catch (error) {
-            console.error('Web: Failed to send notification', error);
+            logger.error('Failed to send notification', error);
             return false;
         }
     }
@@ -657,8 +721,7 @@ export class NativeUpdateWeb extends WebPlugin {
      */
     async validateChecksum(data, expectedChecksum) {
         if (!expectedChecksum) {
-            // If no checksum provided, skip validation
-            return true;
+            throw new Error('Checksum is required but was not provided');
         }
         try {
             let dataBuffer;
@@ -677,7 +740,7 @@ export class NativeUpdateWeb extends WebPlugin {
             // Compare checksums (case-insensitive)
             const isValid = hashHex.toLowerCase() === expectedChecksum.toLowerCase();
             if (!isValid) {
-                console.warn('Checksum validation failed', {
+                logger.warn('Checksum validation failed', {
                     expected: expectedChecksum.toLowerCase(),
                     actual: hashHex.toLowerCase(),
                 });
@@ -685,28 +748,34 @@ export class NativeUpdateWeb extends WebPlugin {
             return isValid;
         }
         catch (error) {
-            console.error('Checksum validation error:', error);
+            logger.error('Checksum validation error', error);
             return false;
         }
     }
     /**
-     * Validate digital signature using RSA-PSS or ECDSA
+     * Validate digital signature using RSA-PSS or ECDSA.
+     *
+     * Fails closed: if the host app configured a public key or
+     * requireSignature, a missing signature throws. Silent-pass was a P0 gap.
+     *
      * @param data - The data that was signed (as string path or ArrayBuffer)
      * @param signature - The signature to verify (base64 encoded)
      */
     async validateSignature(data, signature) {
-        var _a;
+        var _a, _b;
+        const publicKeyPem = ((_a = this.config.liveUpdate) === null || _a === void 0 ? void 0 : _a.publicKey) ||
+            this.config.publicKey;
+        const requireSignature = ((_b = this.config.liveUpdate) === null || _b === void 0 ? void 0 : _b.requireSignature) ||
+            this.config.requireSignature === true;
+        const signatureRequired = !!publicKeyPem || requireSignature;
         if (!signature) {
-            // If no signature provided, skip validation
+            if (signatureRequired) {
+                throw new Error('Signature is required but was not provided');
+            }
             return true;
         }
-        // Get public key from config (can be in liveUpdate.publicKey or top-level config)
-        const publicKeyPem = ((_a = this.config.liveUpdate) === null || _a === void 0 ? void 0 : _a.publicKey) ||
-            this.config.publicKey;
         if (!publicKeyPem) {
-            // If no public key configured, skip signature validation
-            console.warn('No public key configured for signature validation');
-            return true;
+            throw new Error('Public key not configured for signature validation');
         }
         try {
             let dataBuffer;
@@ -726,12 +795,12 @@ export class NativeUpdateWeb extends WebPlugin {
                 saltLength: 32,
             }, publicKey, signatureBuffer, dataBuffer);
             if (!isValid) {
-                console.warn('Signature validation failed');
+                logger.warn('Signature validation failed');
             }
             return isValid;
         }
         catch (error) {
-            console.error('Signature validation error:', error);
+            logger.error('Signature validation error', error);
             // Try ECDSA as fallback
             return this.validateSignatureECDSA(data, signature);
         }
@@ -744,7 +813,10 @@ export class NativeUpdateWeb extends WebPlugin {
         const publicKeyPem = ((_a = this.config.liveUpdate) === null || _a === void 0 ? void 0 : _a.publicKey) ||
             this.config.publicKey;
         if (!publicKeyPem) {
-            return true;
+            // ECDSA is only reached as a fallback from validateSignature, which
+            // already confirmed a key is configured. Reaching here without one
+            // is a logic error — fail closed rather than silently passing.
+            return false;
         }
         try {
             let dataBuffer;
@@ -763,7 +835,7 @@ export class NativeUpdateWeb extends WebPlugin {
             return isValid;
         }
         catch (error) {
-            console.error('ECDSA signature validation error:', error);
+            logger.error('ECDSA signature validation error', error);
             return false;
         }
     }
@@ -796,55 +868,109 @@ export class NativeUpdateWeb extends WebPlugin {
             namedCurve: 'P-256',
         }, false, ['verify']);
     }
+    /**
+     * Safe localStorage accessor. Returns `null` in environments where
+     * `localStorage` isn't available — SSR, Node-only test runners that
+     * stub `window` without storage, or sandboxed iframes. All callers
+     * MUST tolerate a `null` return and skip persistence.
+     */
+    getLocalStorage() {
+        try {
+            if (typeof window === 'undefined')
+                return null;
+            if (typeof window.localStorage === 'undefined')
+                return null;
+            return window.localStorage;
+        }
+        catch (_a) {
+            // Some browsers throw on localStorage access in private mode.
+            return null;
+        }
+    }
     loadStoredData() {
-        // Load configuration
-        const storedConfig = localStorage.getItem('native-update-config');
+        const storage = this.getLocalStorage();
+        if (!storage)
+            return;
+        // Load configuration — note that any previously-persisted copy was
+        // pre-v2 and may contain an apiKey/publicKey in plaintext. We still
+        // read it to preserve non-sensitive state (channel, etc.) but secrets
+        // are stripped on save; an old cache wipes itself on first save.
+        const storedConfig = storage.getItem('native-update-config');
         if (storedConfig) {
             this.config = JSON.parse(storedConfig);
         }
         // Load bundles
-        const storedBundles = localStorage.getItem('native-update-bundles');
+        const storedBundles = storage.getItem('native-update-bundles');
         if (storedBundles) {
             const bundlesArray = JSON.parse(storedBundles);
             bundlesArray.forEach((bundle) => this.bundles.set(bundle.bundleId, bundle));
         }
         // Load current bundle
-        const storedCurrent = localStorage.getItem('native-update-current');
+        const storedCurrent = storage.getItem('native-update-current');
         if (storedCurrent) {
             this.currentBundle = JSON.parse(storedCurrent);
         }
         // Load last review request time
-        const storedLastReview = localStorage.getItem('native-update-last-review');
+        const storedLastReview = storage.getItem('native-update-last-review');
         if (storedLastReview) {
             this.lastReviewRequest = parseInt(storedLastReview, 10);
         }
         // Load launch count
-        const storedLaunchCount = localStorage.getItem('native-update-launch-count');
+        const storedLaunchCount = storage.getItem('native-update-launch-count');
         if (storedLaunchCount) {
             this.launchCount = parseInt(storedLaunchCount, 10);
         }
     }
     saveStoredData() {
-        localStorage.setItem('native-update-bundles', JSON.stringify(Array.from(this.bundles.values())));
+        const storage = this.getLocalStorage();
+        if (!storage)
+            return;
+        storage.setItem('native-update-bundles', JSON.stringify(Array.from(this.bundles.values())));
         if (this.currentBundle) {
-            localStorage.setItem('native-update-current', JSON.stringify(this.currentBundle));
+            storage.setItem('native-update-current', JSON.stringify(this.currentBundle));
+        }
+    }
+    sanitizeConfigForPersistence(raw) {
+        if (!raw || typeof raw !== 'object')
+            return raw;
+        const clone = JSON.parse(JSON.stringify(raw));
+        for (const path of NativeUpdateWeb.SENSITIVE_CONFIG_PATHS) {
+            const segments = path.split('.');
+            let cursor = clone;
+            for (let i = 0; i < segments.length - 1; i++) {
+                const next = cursor === null || cursor === void 0 ? void 0 : cursor[segments[i]];
+                if (next && typeof next === 'object') {
+                    cursor = next;
+                }
+                else {
+                    cursor = undefined;
+                    break;
+                }
+            }
+            if (cursor) {
+                delete cursor[segments[segments.length - 1]];
+            }
         }
+        return clone;
     }
     saveConfiguration() {
-        localStorage.setItem('native-update-config', JSON.stringify(this.config));
+        var _a;
+        (_a = this.getLocalStorage()) === null || _a === void 0 ? void 0 : _a.setItem('native-update-config', JSON.stringify(this.sanitizeConfigForPersistence(this.config)));
     }
     getInstallDate() {
-        const stored = localStorage.getItem('native-update-install-date');
+        const storage = this.getLocalStorage();
+        const stored = storage === null || storage === void 0 ? void 0 : storage.getItem('native-update-install-date');
         if (stored) {
             return parseInt(stored, 10);
         }
         const now = Date.now();
-        localStorage.setItem('native-update-install-date', now.toString());
+        storage === null || storage === void 0 ? void 0 : storage.setItem('native-update-install-date', now.toString());
         return now;
     }
     incrementLaunchCount() {
+        var _a;
         this.launchCount++;
-        localStorage.setItem('native-update-launch-count', this.launchCount.toString());
+        (_a = this.getLocalStorage()) === null || _a === void 0 ? void 0 : _a.setItem('native-update-launch-count', this.launchCount.toString());
     }
     /**
      * Get configured review URL from plugin config
@@ -879,11 +1005,24 @@ export class NativeUpdateWeb extends WebPlugin {
             return `https://play.google.com/store/apps/details?id=${packageName}&showAllReviews=true`;
         }
         // No review URL configured - return null to indicate review not available
-        console.warn('No review URL configured. Set appUpdate.storeUrl.ios, appUpdate.storeUrl.android, ' +
+        logger.warn('No review URL configured. Set appUpdate.storeUrl.ios, appUpdate.storeUrl.android, ' +
             'appReview.webReviewUrl, appStoreId, or packageName in plugin config.');
         return null;
     }
 }
+/**
+ * Strip secrets before persisting config to localStorage. A browser's
+ * localStorage is accessible to any script running in the page (XSS,
+ * compromised deps) — an `apiKey` or `publicKey` sitting there is a
+ * ready-to-use credential. Host apps must pass these on every
+ * `initialize()` call; they are never cached cross-session.
+ */
+NativeUpdateWeb.SENSITIVE_CONFIG_PATHS = [
+    'apiKey',
+    'publicKey',
+    'liveUpdate.publicKey',
+    'liveUpdate.apiKey',
+    'security.publicKey',
+];
 // Alias for backward compatibility with tests
 // Already exported above
-//# sourceMappingURL=web.js.map