react-native-update 10.52.3 → 10.53.1

package/android/build.gradle

@@ -125,10 +125,10 @@ android {
             }
         }
     }
-    compileSdkVersion safeExtGet('compileSdkVersion', 28)
-    buildToolsVersion safeExtGet('buildToolsVersion', '28.0.3')
+    compileSdkVersion safeExtGet('compileSdkVersion', 31)
+    buildToolsVersion safeExtGet('buildToolsVersion', '31.0.0')
     defaultConfig {
-        minSdkVersion safeExtGet('minSdkVersion', 16)
+        minSdkVersion safeExtGet('minSdkVersion', 21)
         targetSdkVersion safeExtGet('targetSdkVersion', 27)
         versionCode 1
         versionName "1.81.4"

package/android/src/main/AndroidManifest.xml

@@ -2,14 +2,8 @@
     package="cn.reactnative.modules.update">
     <application>
         <meta-data android:name="pushy_build_time" android:value="@string/pushy_build_time" />
-        <provider
-            android:name=".PushyFileProvider"
-            android:authorities="${applicationId}.pushy.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-            android:name="android.support.FILE_PROVIDER_PATHS"
-            android:resource="@xml/pushy_file_paths" />
-        </provider>
+        <receiver
+            android:name="cn.reactnative.modules.update.PackageInstallerStatusReceiver"
+            android:exported="false" />
     </application>
 </manifest>

package/android/src/main/AndroidManifestNew.xml

@@ -1,14 +1,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <application>
         <meta-data android:name="pushy_build_time" android:value="@string/pushy_build_time" />
-        <provider
-            android:name=".PushyFileProvider"
-            android:authorities="${applicationId}.pushy.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-            android:name="android.support.FILE_PROVIDER_PATHS"
-            android:resource="@xml/pushy_file_paths" />
-        </provider>
+        <receiver
+            android:name="cn.reactnative.modules.update.PackageInstallerStatusReceiver"
+            android:exported="false" />
     </application>
 </manifest>

package/android/src/main/java/cn/reactnative/modules/update/ApkInstaller.java

@@ -0,0 +1,280 @@
+package cn.reactnative.modules.update;
+
+import android.Manifest;
+import android.app.PendingIntent;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageInfo;
+import android.content.pm.PackageInstaller;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Process;
+import android.provider.Settings;
+import android.util.Log;
+import com.facebook.react.bridge.Promise;
+import com.facebook.react.bridge.ReactApplicationContext;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.OutputStream;
+import java.util.concurrent.ConcurrentHashMap;
+
+final class ApkInstaller {
+    private static final int COPY_BUFFER_SIZE = 64 * 1024;
+    private static final String SESSION_ID_EXTRA =
+        "cn.reactnative.modules.update.extra.PACKAGE_INSTALLER_SESSION_ID";
+    private static final ConcurrentHashMap<Integer, Promise> pendingPromises =
+        new ConcurrentHashMap<Integer, Promise>();
+
+    private ApkInstaller() {
+    }
+
+    /**
+     * Everything in here runs inside the module call, where a thrown exception
+     * would take the whole app down instead of rejecting the promise. A missing
+     * REQUEST_INSTALL_PACKAGES declaration must surface as a rejection the JS
+     * layer can report — never as a crash — so no failure is allowed to escape.
+     */
+    static boolean ensureInstallPermission(
+        ReactApplicationContext reactContext,
+        Promise promise
+    ) {
+        try {
+            return checkInstallPermission(reactContext, promise);
+        } catch (Throwable error) {
+            promise.reject(
+                ErrorCodes.APK_INSTALL_PERMISSION_REQUIRED,
+                "Unable to verify the install-packages permission",
+                error
+            );
+            return false;
+        }
+    }
+
+    private static boolean checkInstallPermission(
+        ReactApplicationContext reactContext,
+        Promise promise
+    ) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) {
+            promise.reject(
+                ErrorCodes.UNSUPPORTED_PLATFORM,
+                "APK installation requires Android 5.0 or newer"
+            );
+            return false;
+        }
+
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
+            return true;
+        }
+
+        PackageManager packageManager = reactContext.getPackageManager();
+        // canRequestPackageInstalls() itself throws SecurityException when the
+        // permission is not declared, so the manifest check has to come first.
+        if (!declaresInstallPermission(reactContext, packageManager)) {
+            promise.reject(
+                ErrorCodes.APK_INSTALL_PERMISSION_REQUIRED,
+                "Declare android.permission.REQUEST_INSTALL_PACKAGES in AndroidManifest.xml"
+            );
+            return false;
+        }
+
+        try {
+            if (packageManager.canRequestPackageInstalls()) {
+                return true;
+            }
+
+            Intent settingsIntent = new Intent(
+                Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES,
+                Uri.parse("package:" + reactContext.getPackageName())
+            );
+            settingsIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            reactContext.startActivity(settingsIntent);
+            promise.reject(
+                ErrorCodes.APK_INSTALL_PERMISSION_REQUIRED,
+                "Allow this app to install unknown apps in system settings, then retry"
+            );
+        } catch (Throwable error) {
+            promise.reject(
+                ErrorCodes.APK_INSTALL_PERMISSION_REQUIRED,
+                "Unable to open the unknown app sources settings",
+                error
+            );
+        }
+        return false;
+    }
+
+    private static boolean declaresInstallPermission(
+        Context context,
+        PackageManager packageManager
+    ) {
+        try {
+            PackageInfo packageInfo = packageManager.getPackageInfo(
+                context.getPackageName(),
+                PackageManager.GET_PERMISSIONS
+            );
+            String[] requestedPermissions = packageInfo.requestedPermissions;
+            if (requestedPermissions == null) {
+                return false;
+            }
+            for (String permission : requestedPermissions) {
+                if (Manifest.permission.REQUEST_INSTALL_PACKAGES.equals(permission)) {
+                    return true;
+                }
+            }
+        } catch (Throwable error) {
+            // A package manager that cannot answer is treated as "not declared":
+            // the caller rejects with a code the app can act on.
+            Log.e(UpdateContext.TAG, "Unable to inspect requested permissions", error);
+        }
+        return false;
+    }
+
+    static void install(
+        ReactApplicationContext reactContext,
+        File apkFile,
+        String sourceUrl,
+        Promise promise
+    ) {
+        PackageInstaller packageInstaller = null;
+        int sessionId = -1;
+        boolean committed = false;
+        try {
+            if (!apkFile.isFile() || apkFile.length() <= 0) {
+                promise.reject(ErrorCodes.APK_INSTALL_FAILED, "Downloaded APK is empty or missing");
+                return;
+            }
+
+            packageInstaller = reactContext.getPackageManager().getPackageInstaller();
+            PackageInstaller.SessionParams sessionParams = new PackageInstaller.SessionParams(
+                PackageInstaller.SessionParams.MODE_FULL_INSTALL
+            );
+            sessionParams.setAppPackageName(reactContext.getPackageName());
+            sessionParams.setSize(apkFile.length());
+            if (sourceUrl != null && !sourceUrl.isEmpty()) {
+                sessionParams.setOriginatingUri(Uri.parse(sourceUrl));
+            }
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+                sessionParams.setOriginatingUid(Process.myUid());
+            }
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                sessionParams.setInstallReason(PackageManager.INSTALL_REASON_USER);
+            }
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+                sessionParams.setRequireUserAction(
+                    PackageInstaller.SessionParams.USER_ACTION_REQUIRED
+                );
+            }
+
+            sessionId = packageInstaller.createSession(sessionParams);
+            try (
+                PackageInstaller.Session session = packageInstaller.openSession(sessionId);
+                FileInputStream input = new FileInputStream(apkFile);
+                OutputStream output = session.openWrite("base.apk", 0, apkFile.length())
+            ) {
+                byte[] buffer = new byte[COPY_BUFFER_SIZE];
+                int count;
+                while ((count = input.read(buffer)) != -1) {
+                    output.write(buffer, 0, count);
+                }
+                session.fsync(output);
+
+                Intent statusIntent = new Intent(
+                    reactContext,
+                    PackageInstallerStatusReceiver.class
+                );
+                statusIntent.putExtra(SESSION_ID_EXTRA, sessionId);
+                int pendingIntentFlags = PendingIntent.FLAG_UPDATE_CURRENT;
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+                    pendingIntentFlags |= PendingIntent.FLAG_MUTABLE;
+                }
+                PendingIntent statusPendingIntent = PendingIntent.getBroadcast(
+                    reactContext,
+                    sessionId,
+                    statusIntent,
+                    pendingIntentFlags
+                );
+                pendingPromises.put(sessionId, promise);
+                session.commit(statusPendingIntent.getIntentSender());
+                committed = true;
+            }
+        } catch (Throwable error) {
+            if (committed) {
+                // The session is already in the system's hands (only session
+                // close failed): the status receiver owns the promise now, so
+                // settling here would be a second, contradictory outcome.
+                Log.w(UpdateContext.TAG, "Install session reported an error after commit", error);
+                return;
+            }
+            if (sessionId != -1) {
+                pendingPromises.remove(sessionId);
+                if (packageInstaller != null) {
+                    try {
+                        packageInstaller.abandonSession(sessionId);
+                    } catch (Throwable abandonError) {
+                        Log.w(UpdateContext.TAG, "Unable to abandon failed install session", abandonError);
+                    }
+                }
+            }
+            promise.reject(ErrorCodes.APK_INSTALL_FAILED, "Unable to stage APK installation", error);
+        }
+    }
+
+    static void handleStatus(Context context, Intent intent) {
+        int sessionId = intent.getIntExtra(SESSION_ID_EXTRA, -1);
+        int status = intent.getIntExtra(
+            PackageInstaller.EXTRA_STATUS,
+            PackageInstaller.STATUS_FAILURE
+        );
+
+        if (status == PackageInstaller.STATUS_PENDING_USER_ACTION) {
+            Intent confirmationIntent = intent.getParcelableExtra(Intent.EXTRA_INTENT);
+            if (confirmationIntent == null) {
+                rejectPending(sessionId, "System installer did not provide a confirmation screen");
+                return;
+            }
+            try {
+                confirmationIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                context.startActivity(confirmationIntent);
+                resolvePending(sessionId);
+            } catch (Throwable error) {
+                rejectPending(sessionId, "Unable to open the system install confirmation", error);
+            }
+            return;
+        }
+
+        if (status == PackageInstaller.STATUS_SUCCESS) {
+            resolvePending(sessionId);
+            return;
+        }
+
+        String statusMessage = intent.getStringExtra(PackageInstaller.EXTRA_STATUS_MESSAGE);
+        rejectPending(
+            sessionId,
+            statusMessage == null ? "Package installation failed" : statusMessage
+        );
+    }
+
+    private static void resolvePending(int sessionId) {
+        Promise promise = pendingPromises.remove(sessionId);
+        if (promise != null) {
+            promise.resolve(null);
+        }
+    }
+
+    private static void rejectPending(int sessionId, String message) {
+        rejectPending(sessionId, message, null);
+    }
+
+    private static void rejectPending(int sessionId, String message, Throwable error) {
+        Promise promise = pendingPromises.remove(sessionId);
+        if (promise != null) {
+            if (error == null) {
+                promise.reject(ErrorCodes.APK_INSTALL_FAILED, message);
+            } else {
+                promise.reject(ErrorCodes.APK_INSTALL_FAILED, message, error);
+            }
+        } else {
+            Log.e(UpdateContext.TAG, message, error);
+        }
+    }
+}

package/android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -752,7 +752,7 @@ class DownloadTask implements Runnable {
 
         // The task itself succeeded. Run the completion callback outside the
         // try/catch above so an exception thrown by the callback (e.g. a
-        // FileProvider misconfiguration during installApk) is not mistaken for
+        // PackageInstaller failure during APK staging) is not mistaken for
         // a download failure that deletes the successfully downloaded file and
         // settles the promise a second time.
         if (params.listener != null) {

package/android/src/main/java/cn/reactnative/modules/update/ErrorCodes.java

@@ -19,6 +19,8 @@ final class ErrorCodes {
     static final String RESET_FAILED = "RESET_FAILED";
     static final String INVALID_HASH_INFO = "INVALID_HASH_INFO";
     static final String UNSUPPORTED_PLATFORM = "UNSUPPORTED_PLATFORM";
+    static final String APK_INSTALL_PERMISSION_REQUIRED = "APK_INSTALL_PERMISSION_REQUIRED";
+    static final String APK_INSTALL_FAILED = "APK_INSTALL_FAILED";
 
     private ErrorCodes() {
     }

package/android/src/main/java/cn/reactnative/modules/update/PackageInstallerStatusReceiver.java

@@ -0,0 +1,12 @@
+package cn.reactnative.modules.update;
+
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+
+public final class PackageInstallerStatusReceiver extends BroadcastReceiver {
+    @Override
+    public void onReceive(Context context, Intent intent) {
+        ApkInstaller.handleStatus(context, intent);
+    }
+}

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -5,7 +5,6 @@ import android.content.SharedPreferences;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.os.Build;
-import android.os.Environment;
 import android.util.Log;
 import com.facebook.react.ReactInstanceManager;
 import java.io.File;
@@ -281,13 +280,7 @@ public class UpdateContext {
         params.hash = hash;
         params.listener = listener;
 
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N && fileName.equals("update.apk")) {
-            params.targetFile = new File(Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS), "pushy_update.apk");
-
-        } else {
-            params.targetFile = new File(rootDir, fileName);
-
-        }
+        params.targetFile = new File(rootDir, fileName);
 //        params.unzipDirectory = new File(rootDir, hash);
         enqueue(params);
     }

package/android/src/main/java/cn/reactnative/modules/update/UpdateModuleImpl.java

@@ -61,21 +61,31 @@ public class UpdateModuleImpl {
         final ReadableMap options,
         final Promise promise
     ) {
-        String url = options.getString("url");
-        String hash = options.getString("hash");
-        String target = options.getString("target");
-        updateContext.downloadFile(url, hash, target, new UpdateContext.DownloadFileListener() {
-            @Override
-            public void onDownloadCompleted(DownloadTaskParams params) {
-                UpdateModuleSupport.installApk(reactContext, params.targetFile);
-                promise.resolve(null);
+        // A module call runs on the native modules thread: anything thrown here
+        // reaches the bridge's exception handler and kills the app. Every
+        // failure of this path — a missing REQUEST_INSTALL_PACKAGES declaration
+        // above all — has to come back as a promise rejection instead.
+        try {
+            final String url = options.getString("url");
+            String hash = options.getString("hash");
+            String target = options.getString("target");
+            if (!ApkInstaller.ensureInstallPermission(reactContext, promise)) {
+                return;
             }
+            updateContext.downloadFile(url, hash, target, new UpdateContext.DownloadFileListener() {
+                @Override
+                public void onDownloadCompleted(DownloadTaskParams params) {
+                    ApkInstaller.install(reactContext, params.targetFile, url, promise);
+                }
 
-            @Override
-            public void onDownloadFailed(Throwable error) {
-                promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
-            }
-        });
+                @Override
+                public void onDownloadFailed(Throwable error) {
+                    promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                }
+            });
+        } catch (Throwable error) {
+            promise.reject(ErrorCodes.APK_INSTALL_FAILED, error);
+        }
     }
 
     public static void downloadPatchFromPackage(

package/android/src/main/java/cn/reactnative/modules/update/UpdateModuleSupport.java

@@ -1,13 +1,6 @@
 package cn.reactnative.modules.update;
 
-import static androidx.core.content.FileProvider.getUriForFile;
-
-import android.content.Intent;
-import android.net.Uri;
-import android.os.Build;
 import android.util.Log;
-import com.facebook.react.bridge.ReactApplicationContext;
-import java.io.File;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -48,27 +41,4 @@ final class UpdateModuleSupport {
         constants.put("supportedDiffVersion", supportedDiffVersion);
         return constants;
     }
-
-    static void installApk(ReactApplicationContext reactContext, File toInstall) {
-        Uri apkUri;
-        Intent intent;
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
-            apkUri = getUriForFile(
-                reactContext,
-                reactContext.getPackageName() + ".pushy.fileprovider",
-                toInstall
-            );
-            intent = new Intent(Intent.ACTION_INSTALL_PACKAGE);
-            intent.setData(apkUri);
-            intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
-            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-        } else {
-            apkUri = Uri.fromFile(toInstall);
-            intent = new Intent(Intent.ACTION_VIEW);
-            intent.setDataAndType(apkUri, "application/vnd.android.package-archive");
-            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-        }
-
-        reactContext.startActivity(intent);
-    }
 }

package/cpp/patch_core/error_codes.h

@@ -39,6 +39,12 @@ constexpr const char* kInvalidHashInfo = "INVALID_HASH_INFO";
 // The method is not supported on this platform (e.g. downloadAndInstallApk
 // outside Android).
 constexpr const char* kUnsupportedPlatform = "UNSUPPORTED_PLATFORM";
+// Android full-package installation requires the user to trust the app as an
+// install source before PackageInstaller can accept a session.
+constexpr const char* kApkInstallPermissionRequired =
+    "APK_INSTALL_PERMISSION_REQUIRED";
+// PackageInstaller could not create, write, commit, or continue an APK session.
+constexpr const char* kApkInstallFailed = "APK_INSTALL_FAILED";
 
 }  // namespace error_codes
 }  // namespace pushy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "10.52.3",
+  "version": "10.53.1",
   "description": "react-native hot update",
   "main": "src/index",
   "types": "src/index.ts",

package/src/client.ts

@@ -26,7 +26,6 @@ import {
   type UpdateErrorCode,
 } from './error';
 import i18n from './i18n';
-import { PermissionsAndroid } from './permissions';
 import {
   resolveServerEventHash,
   resolveServerEventType,
@@ -1302,27 +1301,6 @@ export class Pushy {
       this.throwIfEnabled(err);
       return;
     }
-    if (Platform.Version <= 23) {
-      try {
-        const granted = await PermissionsAndroid.request(
-          PermissionsAndroid.PERMISSIONS.WRITE_EXTERNAL_STORAGE
-        );
-        if (granted !== PermissionsAndroid.RESULTS.GRANTED) {
-          const err = new UpdateError(
-            this.t('error_storage_permission_rejected'),
-            'STORAGE_PERMISSION_REJECTED'
-          );
-          this.emitError(err, 'rejectStoragePermission');
-          this.throwIfEnabled(err);
-          return;
-        }
-      } catch (e: any) {
-        const err = toUpdateError(e, 'STORAGE_PERMISSION_ERROR');
-        this.emitError(err, 'errorStoragePermission');
-        this.throwIfEnabled(err);
-        return;
-      }
-    }
     sharedState.apkStatus = 'downloading';
     this.report({ type: 'downloadingApk' });
     const progressKey = 'downloadingApk';

package/src/error.ts

@@ -34,7 +34,9 @@ export type UpdateErrorCode =
   | 'RESTART_FAILED'
   | 'RESET_FAILED'
   | 'INVALID_HASH_INFO'
-  | 'UNSUPPORTED_PLATFORM';
+  | 'UNSUPPORTED_PLATFORM'
+  | 'APK_INSTALL_PERMISSION_REQUIRED'
+  | 'APK_INSTALL_FAILED';
 
 const KNOWN_CODES = new Set<string>([
   'MODULE_NOT_LOADED',
@@ -58,6 +60,8 @@ const KNOWN_CODES = new Set<string>([
   'RESET_FAILED',
   'INVALID_HASH_INFO',
   'UNSUPPORTED_PLATFORM',
+  'APK_INSTALL_PERMISSION_REQUIRED',
+  'APK_INSTALL_FAILED',
 ]);
 
 /**

package/android/src/main/java/cn/reactnative/modules/update/PushyFileProvider.java

@@ -1,14 +0,0 @@
-package cn.reactnative.modules.update;
-
-import androidx.core.content.FileProvider;
-
-/**
- * Providing a custom {@code FileProvider} prevents manifest {@code <provider>} name collisions.
- *
- * See https://developer.android.com/guide/topics/manifest/provider-element.html for details.
- */
-public class PushyFileProvider extends FileProvider {
-
-    // This class intentionally left blank.
-
-}

package/android/src/main/res/xml/pushy_file_paths.xml

@@ -1,5 +0,0 @@
-<paths xmlns:android="http://schemas.android.com/apk/res/android">
-    <files-path
-        name="pushy"
-        path="." />
-</paths>

package/src/permissions.native.ts

@@ -1 +0,0 @@
-export { PermissionsAndroid } from 'react-native';

package/src/permissions.ts

@@ -1,8 +0,0 @@
-// RN >= 0.87 (generated types) no longer exports the `PermissionsAndroidStatic`
-// interface, so derive the shape from the exported value instead — that spelling
-// works on every RN version we support.
-import type { PermissionsAndroid as RNPermissionsAndroid } from 'react-native';
-import { emptyModule } from './utils';
-
-export const PermissionsAndroid =
-  emptyModule as unknown as typeof RNPermissionsAndroid;