react-native-instantpay-code-push 1.2.7 → 2.0.0

package/README.md

@@ -126,7 +126,7 @@ class MainApplication : Application(), ReactApplication {
 Open modify your ```AppDelegate.swift:```
 
 ```
-import IpayCodePush //👈 import this package
+import InstantpayCodePush //👈 import this package
 
 @main
 class AppDelegate: RCTAppDelegate {
@@ -137,7 +137,7 @@ class AppDelegate: RCTAppDelegate {
             RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index")
         #else
             Bundle.main.url(forResource: "main", withExtension: "jsbundle") //❌ remove this
-            IpayCodePush.bundleURL()  //👈 add this
+            InstantpayCodePush.bundleURL()  //👈 add this
         #endif
     }
 

package/ios/IpayCodePush/Private/IpayCodePushImpl.swift

@@ -170,7 +170,46 @@ import React
                 }
                 fileUrl = url
             }
+            
+            //Verify Bundle Url Signature
+            let decryptSignatureData = SignatureVerifier.decryptSignatureUrl(bundleUrl: fileUrlString)
+            
+            if (decryptSignatureData == nil){
+                let error = NSError(domain: "IpayCodePush", code: 0,
+                                    userInfo: [NSLocalizedDescriptionKey: "Invalid 'fileUrl' Signature: \(String(describing: fileUrl))"])
+                reject("INVALID_URL_SIGNATURE", error.localizedDescription, error)
+                return
+            }
+            
+            // Convert String → Data
+            if let jsonData = decryptSignatureData!.data(using: .utf8) {
+
+                do {
+                    let json = try JSONSerialization.jsonObject(
+                        with: jsonData,
+                        options: []
+                    )
 
+                    if let dictionary = json as? [String: Any] {
+                        
+                        guard let url = URL(string: dictionary["bundleUrl"] as! String) else {
+                            let error = NSError(domain: "IpayCodePush", code: 0,
+                                               userInfo: [NSLocalizedDescriptionKey: "Invalid bundle 'fileUrl' provided: \(dictionary["bundleUrl"] as! String)"])
+                            reject("INVALID_FILE_URL", error.localizedDescription, error)
+                            return
+                        }
+                        fileUrl = url
+                    }
+                } catch {
+                    let error = NSError(domain: "IpayCodePush", code: 0,
+                                        userInfo: [NSLocalizedDescriptionKey: "JSON parse error: Signature"])
+                    reject("INVALID_URL_SIGNATURE", error.localizedDescription, error)
+                    return
+                }
+            }
+            
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "Bundle Url signature is valid : \(String(describing: fileUrl))")
+            
             // Extract fileHash if provided
             let fileHash = data["fileHash"] as? String
 

package/ios/IpayCodePush/Private/SignatureVerifier.swift

@@ -7,6 +7,8 @@
 
 import Foundation
 import Security
+import CommonCrypto
+import LocalAuthentication
 
 /// Prefix for signed file hash format.
 private let SIGNED_HASH_PREFIX = "sig:"
@@ -451,7 +453,127 @@ public class SignatureVerifier {
             return nil
         }
 
-        return data.base64EncodedString()
+        //return data.base64EncodedString()
+        
+        // 🔥 Wrap PKCS1 key into SPKI format
+        let spkiHeader: [UInt8] = [
+            0x30, 0x82, 0x01, 0x22,
+            0x30, 0x0D,
+            0x06, 0x09,
+            0x2A, 0x86, 0x48, 0x86,
+            0xF7, 0x0D, 0x01, 0x01,
+            0x01, 0x05, 0x00,
+            0x03, 0x82, 0x01, 0x0F,
+            0x00
+        ]
+
+        var spkiData = Data(spkiHeader)
+        spkiData.append(data)
+
+        return spkiData.base64EncodedString()
+    }
+    
+    // MARK: - Hybrid Decrypt (RSA + AES)
+    
+    /**
+     * Decrypt signature from bundle Url.
+     * @param bundleUrl The signed url
+     * @return plan Url to downlaod Bundle
+     */
+    public static func decryptSignatureUrl(bundleUrl: String) -> String? {
+        
+        IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "Signed Bundle URL: \(bundleUrl)")
+        
+        var queryParameters: [String: String] = [:]
+
+        // 1. Create a URL object from the string.
+        if let url = URL(string: bundleUrl),
+           // 2. Create a URLComponents object from the URL.
+           let urlComponents = URLComponents(url: url, resolvingAgainstBaseURL: false),
+           // 3. Access the array of URLQueryItem objects.
+           let queryItems = urlComponents.queryItems {
+            
+            // 4. Iterate through the query items and populate the dictionary.
+            for item in queryItems {
+                queryParameters[item.name] = item.value
+            }
+        }
+        
+        IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "Parsed URL: \(queryParameters)")
+        
+        if(queryParameters.isEmpty){
+            return nil
+        }
+        
+        let signatureData = queryParameters["signatureData"]!
+        
+        let encryptedKey = queryParameters["itemData"]!
+        
+        let rawIv = queryParameters["raw"]!
+        
+        guard let privateKey = getPrivateKey() else {
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "Private key not found to decrypt")
+            return nil
+        }
+        
+        //Decode Base64
+        guard let encryptedKeyData = Data(base64Encoded: encryptedKey),
+              let ivData = Data(base64Encoded: rawIv),
+              let encryptedData = Data(base64Encoded: signatureData)
+        else {
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "Base64 decode failed in decryptSignatureUrl")
+            return nil
+        }
+        
+        //RSA Decrypt AES Key (PKCS1)
+        var error: Unmanaged<CFError>?
+        guard let aesKeyData = SecKeyCreateDecryptedData(
+            privateKey,
+            .rsaEncryptionPKCS1,
+            encryptedKeyData as CFData,
+            &error
+        ) as Data? else {
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "RSA decrypt failed: \(error?.takeRetainedValue() as Any)")
+            return nil
+        }
+        
+        //AES-256-CBC Decrypt
+        guard aesKeyData.count == 32 else {
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "AES key must be 32 bytes (256-bit)")
+            return nil
+        }
+        
+        var outLength = Int(0)
+        let outputData = NSMutableData(length: encryptedData.count + kCCBlockSizeAES128)!
+
+        let status = encryptedData.withUnsafeBytes { encryptedBytes in
+            aesKeyData.withUnsafeBytes { keyBytes in
+                ivData.withUnsafeBytes { ivBytes in
+
+                    CCCrypt(
+                        CCOperation(kCCDecrypt),
+                        CCAlgorithm(kCCAlgorithmAES),
+                        CCOptions(kCCOptionPKCS7Padding),
+                        keyBytes.baseAddress,
+                        aesKeyData.count,
+                        ivBytes.baseAddress,
+                        encryptedBytes.baseAddress,
+                        encryptedData.count,
+                        outputData.mutableBytes,
+                        outputData.length,
+                        &outLength
+                    )
+                }
+            }
+        }
+
+        if status == kCCSuccess {
+            outputData.length = outLength
+            return String(data: outputData as Data, encoding: .utf8)
+        } else {
+            IpayCodePushHelper.logPrint(classTag: CLASS_TAG, log: "AES decrypt failed: \(status)")
+            return nil
+        }
     }
     
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-instantpay-code-push",
-  "version": "1.2.7",
+  "version": "2.0.0",
   "description": "React Native plugin for the CodePush service",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",