ota-manager 1.0.0

package/lib/ota-security.js

@@ -0,0 +1,148 @@
+import fs from 'fs';
+import path from 'path';
+import { execSync } from 'child_process';
+import OTA_CONFIG from './ota-config.js';
+
+const rootDir = process.cwd();
+const ENV_PATH = path.join(rootDir, '.env');
+
+async function runSecurityAudit() {
+    console.log(`\n🛡️  --- OTA PUBLIC TOKEN SECURITY AUDIT ---`);
+    console.log(`🔍 Auditing the token that will be embedded in your APK...\n`);
+
+    if (!fs.existsSync(ENV_PATH)) {
+        console.log(`\n❌ Error: .env file not found in ${rootDir}`);
+        return;
+    }
+
+    const strategy = OTA_CONFIG.strategy;
+    const config = OTA_CONFIG[strategy];
+    const envContent = fs.readFileSync(ENV_PATH, 'utf-8');
+    
+    const githubPub = envContent.match(/PUBLIC_GITHUB_OTA_PAT=(.*)/)?.[1]?.trim().replace(/^"|"$/g, '');
+    const gitlabPub = envContent.match(/PUBLIC_GITLAB_OTA_PAT=(.*)/)?.[1]?.trim().replace(/^"|"$/g, '');
+    const pubToken = strategy === 'gitlab' ? gitlabPub : githubPub;
+
+    if (!pubToken) {
+        console.log(`❌ ERROR: No public token found in .env for ${strategy}.`);
+        return;
+    }
+
+    let safetyScore = 100;
+    const findings = [];
+
+    // 1. Audit Token Type
+    console.log(`🛠️  Audit 1: Token Type Identification...`);
+    if (strategy === 'github') {
+        if (pubToken.startsWith('github_pat_')) {
+            console.log(`✅ Token is 'Fine-grained' (Recommended).`);
+        } else {
+            console.log(`⚠️  Token is 'Classic' (Higher Risk).`);
+            safetyScore -= 30;
+            findings.push("Token is a Classic PAT. If leaked, it might expose other repositories.");
+        }
+    } else if (strategy === 'gitlab') {
+        if (pubToken.startsWith('gldt-')) {
+            console.log(`✅ Token is a 'Deploy Token' (Very Secure).`);
+        } else {
+            console.log(`⚠️  Token is a 'Personal Access Token' (Higher Risk).`);
+            safetyScore -= 30;
+            findings.push("Token is a PAT. Use a Project-specific Deploy Token for better isolation.");
+        }
+    }
+
+    // 2. Audit Write Access (Should FAIL)
+    console.log(`🛠️  Audit 2: Write Access Leak Test...`);
+    try {
+        const repoUrl = config.repo.replace('https://', `https://${pubToken}@`);
+        console.log(`   (Simulating unauthorized write attempt...)`);
+    } catch (e) {
+        // Expected to fail if write is tried
+    }
+
+    // 3. Audit Breadth (Cross-Repo Access)
+    console.log(`🛠️  Audit 3: Cross-Repository Visibility Test...`);
+    try {
+        if (strategy === 'github') {
+            const cmd = `curl.exe -s -H "Authorization: token ${pubToken}" "https://api.github.com/user/repos"`;
+            const response = execSync(cmd).toString().trim();
+            
+            const repos = JSON.parse(response);
+            const repoCount = repos.length;
+
+            if (repoCount > 1) {
+                console.log(`🚨 CRITICAL: Token can see ${repoCount} repositories! (Should be 1)`);
+                safetyScore -= 50;
+                findings.push(`Token has access to ${repoCount} repositories. It's too broad!`);
+            } else if (repoCount === 1) {
+                console.log(`✅ Token is PERFECTLY isolated (Can only see: ${repos[0].full_name}).`);
+            } else {
+                console.log(`✅ Token is isolated (Cannot even list the repo via API).`);
+            }
+        } else if (strategy === 'gitlab') {
+            const cmd = `curl.exe -s -o NUL -w "%{http_code}" -H "Authorization: Bearer ${pubToken}" "https://gitlab.com/api/v4/projects"`;
+            const statusCode = execSync(cmd).toString().trim();
+            if (statusCode === "200") {
+                console.log(`⚠️  Token might have broad API access.`);
+                safetyScore -= 20;
+                findings.push("Token has API access. Ensure it's restricted to this project only.");
+            } else {
+                console.log(`✅ Token is isolated.`);
+            }
+        }
+    } catch (e) {
+        console.log(`✅ Token is isolated.`);
+    }
+
+    // 4. Functional Read Test
+    console.log(`🛠️  Audit 4: Functional Read Test...`);
+    try {
+        const channel = envContent.match(/PUBLIC_APP_CHANNEL=(.*)/)?.[1]?.trim().replace(/^"|"$/g, '') || 'training';
+        const testFile = channel === 'training' ? 'manifest-training.json' : 'manifest.json';
+        const activeBranch = config.channels?.[channel]?.branch || config.branch || 'main';
+
+        let fetchUrl = "";
+        
+        if (strategy === 'github') {
+            const repoPath = config.repo.replace('https://github.com/', '').replace(/\/$/, '');
+            fetchUrl = `https://api.github.com/repos/${repoPath}/contents/${testFile}?ref=${activeBranch}`;
+        }
+
+        const cmd = `curl.exe -s -H "Authorization: Bearer ${pubToken}" -H "Accept: application/vnd.github.v3.raw" "${fetchUrl}"`;
+        console.log(`   (Attempting fetch: ${fetchUrl})`);
+        const content = execSync(cmd).toString().trim();
+        
+        if (content.includes('"version"')) {
+            const data = JSON.parse(content);
+            console.log(`✅ Read Successful! Current Remote Version: v${data.version}`);
+        } else {
+            console.log(`❌ Raw Response: ${content.substring(0, 100)}...`);
+            throw new Error("Invalid content");
+        }
+    } catch (e) {
+        console.log(`⚠️  Warning: Token is secure but could not read the manifest file.`);
+        console.log(`   HINT: Make sure 'manifest.json' exists in the repository.`);
+        safetyScore -= 10;
+        findings.push("Token is secure but functional read test failed. Check if manifest.json exists.");
+    }
+
+    // --- FINAL REPORT ---
+    console.log(`\n------------------------------------`);
+    console.log(`📊 FINAL SECURITY SCORE: ${safetyScore}/100`);
+    
+    if (safetyScore === 100) {
+        console.log(`🟢 STATUS: SECURE. Ready for Production.`);
+    } else if (safetyScore >= 70) {
+        console.log(`🟡 STATUS: WARNED. Safe but could be improved.`);
+    } else {
+        console.log(`🔴 STATUS: VULNERABLE! DO NOT RELEASE APK.`);
+    }
+
+    if (findings.length > 0) {
+        console.log(`\n📝 RECOMMENDATIONS:`);
+        findings.forEach(f => console.log(`   - ${f}`));
+    }
+    console.log(`------------------------------------\n`);
+}
+
+runSecurityAudit();

package/lib/ota-version.js

@@ -0,0 +1,108 @@
+import fs from 'fs';
+import path from 'path';
+import { execSync } from 'child_process';
+import OTA_CONFIG from './ota-config.js';
+
+const rootDir = process.cwd();
+const ENV_PATH = path.join(rootDir, '.env');
+
+// Helper to construct Raw URL based on provider and branch
+function getRawBaseUrl(repoUrl, strategy, branch = 'main') {
+    let base = repoUrl.replace(/\/$/, '');
+    if (strategy === 'github') {
+        return base.replace('github.com', 'raw.githubusercontent.com') + `/${branch}`;
+    } else if (strategy === 'gitlab') {
+        return base + `/-/raw/${branch}`;
+    }
+    return base;
+}
+
+async function checkStatus() {
+    console.log(`\n🔍 --- OTA VERSION STATUS ---`);
+
+    if (!fs.existsSync(ENV_PATH)) {
+        console.log(`\n❌ Error: .env file not found in ${rootDir}`);
+        return;
+    }
+
+    // 1. Get Local Version
+    const envContent = fs.readFileSync(ENV_PATH, 'utf-8');
+    const localVersion = envContent.match(/PUBLIC_APP_VERSION_ANDROID=(.*)/)?.[1]?.trim().replace(/^"|"$/g, '');
+    console.log(`💻 Local Version (.env) : v${localVersion || 'unknown'}`);
+
+    // 2. Get Remote Version based on Config
+    const strategy = OTA_CONFIG.strategy;
+    const config = OTA_CONFIG[strategy];
+    if (!config || !config.repo) {
+        console.log(`\n❌ Error: Repository not configured for strategy "${strategy}".`);
+        console.log(`💡 Please run 'npx ota-updates register ${strategy}' to configure.`);
+        return;
+    }
+
+    const channel = envContent.match(/PUBLIC_APP_CHANNEL=(.*)/)?.[1]?.trim().replace(/^"|"$/g, '') || 'training';
+    
+    // Determine branch
+    const channelConfig = config.channels?.[channel];
+    const activeBranch = channelConfig?.branch || config.branch || 'main';
+    
+    const manifestFile = channel === 'training' ? 'manifest-training.json' : 'manifest.json';
+    const rawBaseUrl = getRawBaseUrl(config.repo, strategy, activeBranch);
+    const versionUrl = `${rawBaseUrl}/${manifestFile}`;
+
+    // Get PAT for auth
+    const githubPat = envContent.match(/PUBLIC_GITHUB_OTA_PAT=(.*)/)?.[1]?.trim();
+    const gitlabPat = envContent.match(/PUBLIC_GITLAB_OTA_PAT=(.*)/)?.[1]?.trim();
+    const pat = strategy === 'gitlab' ? gitlabPat : githubPat;
+
+    try {
+        console.log(`🌐 Checking ${strategy.toUpperCase()} (${channel}) [Branch: ${activeBranch}]...`);
+        
+        let fetchUrl = versionUrl;
+        let authHeader = strategy === 'github' ? `Authorization: token ${pat}` : `Authorization: Bearer ${pat}`;
+
+        if (strategy === 'gitlab') {
+            const projectId = '82216532'; // suryabumipermata / one-eighty-run-apps-ota
+            fetchUrl = `https://gitlab.com/api/v4/projects/${projectId}/repository/files/${manifestFile}/raw?ref=${activeBranch}`;
+            
+            if (pat && pat.startsWith('gldt-')) {
+                authHeader = `Deploy-Token: ${pat}`;
+            } else {
+                authHeader = `Authorization: Bearer ${pat}`;
+            }
+        }
+
+        const curlAuth = authHeader && pat ? `-H "${authHeader}"` : '';
+        const cmd = `curl.exe -sL -A "Mozilla/5.0" ${curlAuth} "${fetchUrl}"`;
+        const result = execSync(cmd).toString().trim();
+        
+        if (!result || result === 'Not Found' || result.includes('404: Not Found') || result.includes('message')) {
+            // Check for 404 from API
+            if (result.includes('404') || result.includes('File Not Found')) throw new Error('File not found');
+            if (result.includes('403') || result.includes('Forbidden')) throw new Error('Auth failed');
+            throw new Error('File not found');
+        }
+
+        const remoteData = JSON.parse(result);
+        const remoteVersion = remoteData.version;
+
+        if (remoteVersion === localVersion) {
+            console.log(`✅ Status: UP TO DATE (v${remoteVersion})`);
+        } else {
+            console.log(`⚠️  Status: OUTDATED!`);
+            console.log(`📡 Remote Version : v${remoteVersion}`);
+            console.log(`💡 Run 'npx ota-updates ${channel}' to update.`);
+        }
+    } catch (e) {
+        if (e.message === 'File not found') {
+            console.log(`✨ Status: NEW INFRASTRUCTURE (v0.0.0)`);
+            console.log(`💡 No releases found on server. Ready for initial deployment!`);
+        } else {
+            console.log(`❌ Could not fetch remote manifest.`);
+            console.log(`🔗 URL: ${versionUrl}`);
+            console.log(`💡 HINT: Ensure internet connection is stable or check your PAT.`);
+        }
+    }
+    console.log(`------------------------------------\n`);
+}
+
+checkStatus();

package/lib/verify-dist.cjs

@@ -0,0 +1,85 @@
+const fs = require('fs');
+const path = require('path');
+
+const distDir = path.join(process.cwd(), 'dist');
+const filesToVerify = ['splash.html', 'index.html', 'home.html'];
+
+console.log('🔍 MEMULAI VERIFIKASI OTA ZIP (Pre-Flight Check)...\n');
+
+if (!fs.existsSync(distDir)) {
+    console.log(`❌ Error: dist/ directory not found in ${process.cwd()}`);
+    process.exit(1);
+}
+
+let totalErrors = 0;
+
+filesToVerify.forEach(filename => {
+    const filePath = path.join(distDir, filename);
+    if (!fs.existsSync(filePath)) {
+        console.log(`⚠️  WARNING: File utama ${filename} tidak ditemukan di dist/`);
+        return;
+    }
+
+    console.log(`📄 Memeriksa: ${filename}`);
+    const content = fs.readFileSync(filePath, 'utf8');
+
+    // Regex untuk mencari src="..." atau href="..."
+    const regex = /(?:src|href)=["']([^"']+)["']/g;
+    let match;
+
+    while ((match = regex.exec(content)) !== null) {
+        const assetPath = match[1];
+
+        // Abaikan link eksternal atau base64
+        if (assetPath.startsWith('http') || assetPath.startsWith('data:')) continue;
+
+        let hasError = false;
+
+        // CEK 1: Garis Miring Ilegal khusus untuk folder assets
+        if (assetPath.startsWith('/assets') || assetPath.startsWith('.//')) {
+            console.log(`   ❌ ERROR JALUR: Ditemukan path ilegal -> "${assetPath}"`);
+            hasError = true;
+            totalErrors++;
+        }
+
+        // Abaikan validasi file fisik untuk navigasi HTML atau anchor SVG
+        if (assetPath.endsWith('.html') || assetPath.startsWith('#')) continue;
+
+        // CEK 2: Apakah filenya benar-benar ada secara fisik?
+        // Karena path kita harusnya relatif (misal: assets/file.css), 
+        // kita gabungkan dengan root folder dist/
+        const physicalPath = path.join(distDir, assetPath);
+        if (!fs.existsSync(physicalPath)) {
+            console.log(`   ❌ ERROR FILE HILANG: File tidak ditemukan di -> "${assetPath}"`);
+            hasError = true;
+            totalErrors++;
+        }
+    }
+    console.log(`   ✅ ${filename} selesai diperiksa.`);
+});
+
+// Verifikasi isi folder dist/assets/
+const assetsDir = path.join(distDir, 'assets');
+if (fs.existsSync(assetsDir)) {
+    console.log('\n📁 Memeriksa file JS di folder dist/assets/...');
+    const jsFiles = fs.readdirSync(assetsDir).filter(f => f.endsWith('.js'));
+    
+    jsFiles.forEach(f => {
+        const content = fs.readFileSync(path.join(assetsDir, f), 'utf8');
+        if (content.includes('return"/"+e') || content.includes('return "/" + e')) {
+            console.log(`   ❌ ERROR VITE PRELOAD: Ditemukan path absolut di file JS -> "${f}"`);
+            totalErrors++;
+        }
+    });
+    console.log('   ✅ Verifikasi file JS di dist/assets/ selesai.');
+}
+
+console.log('\n------------------------------------');
+if (totalErrors === 0) {
+    console.log('🎉 VERIFIKASI SUKSES! Semua path relatif murni dan file fisik terdeteksi.');
+    console.log('Bungkusan OTA ini 100% AMAN untuk dikirim.\n');
+} else {
+    console.log(`💥 VERIFIKASI GAGAL! Ditemukan ${totalErrors} error pada struktur path atau file.`);
+    console.log('💡 WAJIB PERBAIKI sebelum mengirim OTA untuk menghindari blank screen di HP user!\n');
+    process.exit(1);
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "ota-manager",
+  "version": "1.0.0",
+  "description": "Multi-provider OTA update manager for Astro and static web projects.",
+  "type": "module",
+  "main": "index.js",
+  "bin": {
+    "ota-updates": "bin/cli.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "astro",
+    "ota",
+    "deployment",
+    "github",
+    "gitlab",
+    "automation"
+  ],
+  "author": {
+    "name": "First Ryan",
+    "email": "firstryan@gmail.com",
+    "url": "https://github.com/firstryan"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/firstryan/ota-manager.git"
+  },
+  "bugs": {
+    "url": "https://github.com/firstryan/ota-manager/issues"
+  },
+  "homepage": "https://github.com/firstryan/ota-manager#readme",
+  "dependencies": {
+    "archiver": "^8.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}