react-native-update 10.59.1 → 10.60.0

package/ios/RCTPushy/RCTPushyCommon.h

@@ -0,0 +1,34 @@
+// Internal to the RCTPushy pod and Foundation-only: what every translation
+// unit shares, including RCTPushyConfiguration.mm and RCTPushyDownloader.mm,
+// which compile without React Native (the purge-restore test host builds
+// RCTPushyConfiguration.mm on its own). Not a public header.
+#pragma once
+
+#import <Foundation/Foundation.h>
+
+// Shared across the pod's translation units, never exported from a dynamic
+// framework.
+#ifndef PUSHY_HIDDEN
+#define PUSHY_HIDDEN __attribute__((visibility("hidden")))
+#endif
+
+// Every NSError this pod creates: the domain, and the userInfo key carrying
+// the stable cross-platform code (cpp/patch_core/error_codes.h).
+static NSString *const RCTPushyErrorDomain = @"cn.reactnative.pushy";
+static NSString *const RCTPushyErrorCodeKey = @"PushyErrorCode";
+
+// Text produced by scripts/encode-native-text.ts, decoded with
+// pushy::text::Reveal (cpp/patch_core/obscured_text.h). Keeps service
+// addresses, paths and protocol strings out of static string scans of the
+// binary; not a secret.
+PUSHY_HIDDEN NSString *RCTPushyRevealText(const char *hex);
+
+// Whether following a redirect from `from` to `to` would leave https for
+// plaintext http. Every https request (check and artifact) refuses that
+// downgrade before the redirected request is sent.
+PUSHY_HIDDEN BOOL RCTPushyIsHttpsDowngrade(NSURL *from, NSURL *to);
+
+// Removes a downloaded archive together with its resume sidecar
+// (RCTPushyResumeSidecarPath): nothing may survive to vouch for bytes that
+// are gone.
+PUSHY_HIDDEN void RCTPushyDiscardArchive(NSString *path);

package/ios/RCTPushy/RCTPushyConfiguration.h

@@ -3,11 +3,3 @@
 // Validates and snapshots host options without changing any update state.
 FOUNDATION_EXPORT NSString * _Nullable RCTPushyNormalizeConfiguration(
     NSDictionary * _Nonnull options, NSError * _Nullable * _Nullable error);
-
-// Decodes text produced by scripts/encode-native-text.ts (byte i XORed with
-// (0x5A + 0x1D * i) & 0xFF), keeping service addresses and paths out of static
-// string scans of the binary. Not a secret.
-FOUNDATION_EXPORT NSString * _Nonnull RCTPushyRevealText(const char * _Nonnull hex);
-
-// Request path appended to an endpoint base.
-FOUNDATION_EXPORT NSString * _Nonnull RCTPushyQueryPath(void);

package/ios/RCTPushy/RCTPushyConfiguration.mm

@@ -1,130 +1,49 @@
 #import "RCTPushyConfiguration.h"
-
-// Read through a volatile so the optimizer cannot fold the decode of a constant
-// argument back into a plain string in the binary.
-static volatile unsigned char PushyTextKeyBase = 0x5A;
+#import "RCTPushyCommon.h"
+#include "../../cpp/patch_core/error_codes.h"
+#include "../../cpp/patch_core/obscured_text.h"
+#include "../../cpp/update_flow_core/native_config.h"
 
 NSString *RCTPushyRevealText(const char *hex) {
-    size_t length = strlen(hex) / 2;
-    NSMutableString *text = [NSMutableString stringWithCapacity:length];
-    unsigned char base = PushyTextKeyBase;
-    for (size_t i = 0; i < length; i++) {
-        char pair[3] = {hex[i * 2], hex[i * 2 + 1], 0};
-        unsigned char byte = (unsigned char)strtoul(pair, NULL, 16);
-        [text appendFormat:@"%c", (char)(byte ^ (unsigned char)(base + 0x1D * i))];
-    }
-    return text;
-}
-
-NSString *RCTPushyQueryPath(void) {
-    static NSString *path;
-    static dispatch_once_t once;
-    dispatch_once(&once, ^{
-        path = RCTPushyRevealText("7514fcd4ad805d55263e08fc99");
-    });
-    return path;
-}
-
-static void PushyConfigInvalid(NSString *message) {
-    @throw [NSException exceptionWithName:NSInvalidArgumentException
-        reason:[@"Invalid native configuration: " stringByAppendingString:message]
-        userInfo:nil];
-}
-
-static NSString *PushyConfigString(id value, NSString *name, BOOL allowEmpty) {
-    if (![value isKindOfClass:NSString.class]
-        || (!allowEmpty && [[value stringByTrimmingCharactersInSet:
-            NSCharacterSet.whitespaceAndNewlineCharacterSet] length] == 0)) {
-        PushyConfigInvalid([NSString stringWithFormat:@"%@ must be a string%@",
-            name, allowEmpty ? @"" : @" and must not be blank"]);
-    }
-    return value;
-}
-
-static NSArray *PushyConfigUrls(id value, NSString *name, BOOL base) {
-    if (![value isKindOfClass:NSArray.class] || (base && [value count] == 0)) {
-        PushyConfigInvalid([NSString stringWithFormat:@"%@ must be %@ array",
-            name, base ? @"a non-empty" : @"an"]);
-    }
-    NSMutableArray *result = [NSMutableArray array];
-    NSRegularExpression *authority = [NSRegularExpression regularExpressionWithPattern:
-        @"^https?://(\\[[0-9a-fA-F:]+\\]|[a-zA-Z0-9.-]+)(:[0-9]+)?([/?#]|$)"
-        options:0 error:nil];
-    for (id item in value) {
-        NSString *url = [PushyConfigString(item, name, NO) stringByTrimmingCharactersInSet:
-            NSCharacterSet.whitespaceAndNewlineCharacterSet];
-        if ([authority firstMatchInString:url options:0 range:NSMakeRange(0, url.length)] == nil
-            || [url rangeOfCharacterFromSet:NSCharacterSet.whitespaceAndNewlineCharacterSet].location != NSNotFound
-            || [url containsString:@"\\"]
-            || (base && ([url containsString:@"?"] || [url containsString:@"#"]))) {
-            PushyConfigInvalid([NSString stringWithFormat:
-                @"%@ requires absolute HTTP(S) URLs without credentials%@",
-                name, base ? @", queries or fragments" : @""]);
-        }
-        if (base) {
-            while ([url hasSuffix:@"/"]) {
-                url = [url substringToIndex:url.length - 1];
-            }
-        }
-        if (![result containsObject:url]) {
-            [result addObject:url];
-        }
-    }
-    return result;
+    // The texts are ASCII (scripts/encode-native-text.ts).
+    std::string text = pushy::text::Reveal(hex);
+    return [[NSString alloc] initWithBytes:text.data()
+                                    length:text.size()
+                                  encoding:NSUTF8StringEncoding] ?: @"";
 }
 
+// Validation and defaults are the shared core's (flowcore::NormalizeConfiguration,
+// also used by Android and Harmony); this only bridges the dictionary.
 NSString *RCTPushyNormalizeConfiguration(NSDictionary *options, NSError **error) {
-    @try {
-        if (![options isKindOfClass:NSDictionary.class]) {
-            PushyConfigInvalid(@"expected an object");
-        }
-        NSArray *keys = @[@"appKey", @"endpoints", @"queryUrls", @"afterDownload",
-                           @"disabled", @"packageVersion", @"rnu", @"rn"];
-        for (id key in options) {
-            if (![keys containsObject:key]) {
-                PushyConfigInvalid([NSString stringWithFormat:@"unknown option %@", key]);
-            }
-        }
-        NSString *appKey = PushyConfigString(options[@"appKey"], @"appKey", NO);
-        BOOL customEndpoints = options[@"endpoints"] != nil;
-        NSArray *endpoints = PushyConfigUrls(customEndpoints ? options[@"endpoints"]
-            : @[RCTPushyRevealText("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5b3d5b9817b592947e5cdefbc8a7e"),
-                RCTPushyRevealText("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5f0daac9c644a620ae88ca1ad93")],
-            @"endpoints", YES);
-        NSArray *queryUrls = PushyConfigUrls(options[@"queryUrls"] ?: (customEndpoints ? @[]
-            : @[RCTPushyRevealText("3203e0c1bdd1270a253608fcd3fd9362476817f4f0d5a1996342631be3c2a3a9d779552507fdcde8928a6f512f5ce2ccbdc869404d2f1de79daa826d562c0913eec4fa9b7d4426"),
-                RCTPushyRevealText("3203e0c1bdd1270a213b12b7dca09468462e12f3b0d5bd813d482446f4c6a1be8e79552507fdcda68cd06e5c3710e480a4867048483e55e0c2ab8d7d43030d1ce9c3b183214e2601f2f0d5b782601e2719e8ca")]),
-            @"queryUrls", NO);
-        NSString *afterDownload = options[@"afterDownload"]
-            ? PushyConfigString(options[@"afterDownload"], @"afterDownload", NO) : @"none";
-        NSString *nextLaunch = RCTPushyRevealText("2912e0ffab8e6c70323b1dedd3");
-        if (![@[@"none", nextLaunch] containsObject:afterDownload]) {
-            PushyConfigInvalid([@"afterDownload must be none or " stringByAppendingString:nextLaunch]);
+    // Anything NSJSONSerialization cannot write is not a JSON object; the core
+    // reports it as such.
+    std::string optionsJson;
+    if ([options isKindOfClass:NSDictionary.class]
+        && [NSJSONSerialization isValidJSONObject:options]) {
+        NSData *data = [NSJSONSerialization dataWithJSONObject:options options:0 error:NULL];
+        if (data != nil) {
+            optionsJson.assign(static_cast<const char *>(data.bytes), data.length);
         }
-        id disabled = options[@"disabled"] ?: @NO;
-        if (![disabled isKindOfClass:NSNumber.class] || CFGetTypeID((__bridge CFTypeRef)disabled) != CFBooleanGetTypeID()) {
-            PushyConfigInvalid(@"disabled must be a boolean");
-        }
-        NSMutableDictionary *result = [@{
-            @"appKey": appKey, @"endpoints": endpoints, @"queryUrls": queryUrls,
-            @"afterDownload": afterDownload, @"disabled": disabled,
-            @"rnu": options[@"rnu"] ? PushyConfigString(options[@"rnu"], @"rnu", YES) : @"",
-            @"rn": options[@"rn"] ? PushyConfigString(options[@"rn"], @"rn", YES) : @""
-        } mutableCopy];
-        if (options[@"packageVersion"] != nil) {
-            result[@"packageVersion"] = PushyConfigString(options[@"packageVersion"], @"packageVersion", NO);
-        }
-        // Stable ordering makes repeated identical configure calls idempotent.
-        NSData *data = [NSJSONSerialization dataWithJSONObject:result
-            options:NSJSONWritingSortedKeys error:error];
-        return data == nil ? nil : [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-    } @catch (NSException *exception) {
-        if (error != NULL) {
-            *error = [NSError errorWithDomain:@"cn.reactnative.pushy" code:1 userInfo:@{
-                NSLocalizedDescriptionKey: exception.reason ?: @"Invalid native configuration",
-                @"PushyErrorCode": @"INVALID_OPTIONS"
-            }];
-        }
-        return nil;
     }
+    std::string config;
+    std::string message;
+    if (flowcore::NormalizeConfiguration(optionsJson, &config, &message)) {
+        NSString *result = [[NSString alloc] initWithBytes:config.data()
+                                                    length:config.size()
+                                                  encoding:NSUTF8StringEncoding];
+        if (result != nil) {
+            return result;
+        }
+        message = "Invalid native configuration: not UTF-8";
+    }
+    if (error != NULL) {
+        *error = [NSError errorWithDomain:RCTPushyErrorDomain code:1 userInfo:@{
+            NSLocalizedDescriptionKey: [[NSString alloc] initWithBytes:message.data()
+                                                                length:message.size()
+                                                              encoding:NSUTF8StringEncoding]
+                ?: @"Invalid native configuration",
+            RCTPushyErrorCodeKey: @(pushy::error_codes::kInvalidOptions)
+        }];
+    }
+    return nil;
 }

package/ios/RCTPushy/RCTPushyDownloader.mm

@@ -1,8 +1,7 @@
 #import "RCTPushyDownloader.h"
+#import "RCTPushyCommon.h"
 #include "../../cpp/patch_core/archive_limits.h"
 
-static NSString *const RCTPushyDownloaderErrorDomain = @"cn.reactnative.pushy";
-
 // Cross-launch resumable download (NATIVE_CHECKUPDATE_DESIGN §11.4): a data
 // task streams the archive straight into savePath (a download task's
 // temporary file is discarded on failure, which made every partial byte
@@ -36,6 +35,16 @@ static void RCTPushyDeleteResumeSidecar(NSString *savePath) {
                                                error:nil];
 }
 
+void RCTPushyDiscardArchive(NSString *path) {
+    [[NSFileManager defaultManager] removeItemAtPath:path error:nil];
+    RCTPushyDeleteResumeSidecar(path);
+}
+
+BOOL RCTPushyIsHttpsDowngrade(NSURL *from, NSURL *to) {
+    return [[from.scheme lowercaseString] isEqualToString:@"https"]
+        && [[to.scheme lowercaseString] isEqualToString:@"http"];
+}
+
 long long RCTPushyFileSize(NSString *path) {
     NSDictionary *attributes =
         [[NSFileManager defaultManager] attributesOfItemAtPath:path error:nil];
@@ -174,7 +183,7 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
 {
     NSURL *url = [NSURL URLWithString:self.urlString];
     if (url == nil) {
-        [self completeWithError:[NSError errorWithDomain:RCTPushyDownloaderErrorDomain
+        [self completeWithError:[NSError errorWithDomain:RCTPushyErrorDomain
                                                     code:-1
                                                 userInfo:@{
                                                     NSLocalizedDescriptionKey: @"invalid download url",
@@ -263,13 +272,8 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
     }
 }
 
-- (void)completeWithError:(NSError *)error
+- (void)closeFileHandle
 {
-    if (self.finished) {
-        return;
-    }
-    self.finished = YES;
-
     if (self.fileHandle != nil) {
         @try {
             [self.fileHandle closeFile];
@@ -277,9 +281,18 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
         }
         self.fileHandle = nil;
     }
+}
+
+- (void)completeWithError:(NSError *)error
+{
+    if (self.finished) {
+        return;
+    }
+    self.finished = YES;
+
+    [self closeFileHandle];
     if (self.discardPartial) {
-        [[NSFileManager defaultManager] removeItemAtPath:self.savePath error:nil];
-        RCTPushyDeleteResumeSidecar(self.savePath);
+        RCTPushyDiscardArchive(self.savePath);
     }
 
     void (^completionHandler)(NSString *, NSError *) = self.completionHandler;
@@ -297,7 +310,7 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
 
 - (void)failWithDescription:(NSString *)description code:(NSInteger)code
 {
-    self.fileError = [NSError errorWithDomain:RCTPushyDownloaderErrorDomain
+    self.fileError = [NSError errorWithDomain:RCTPushyErrorDomain
                                          code:code
                                      userInfo:@{NSLocalizedDescriptionKey: description}];
 }
@@ -317,15 +330,8 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
     self.encodedBody = NO;
     self.lastReportedPercentage = 0;
     self.lastReportedBytes = 0;
-    if (self.fileHandle != nil) {
-        @try {
-            [self.fileHandle closeFile];
-        } @catch (NSException *exception) {
-        }
-        self.fileHandle = nil;
-    }
-    [[NSFileManager defaultManager] removeItemAtPath:self.savePath error:nil];
-    RCTPushyDeleteResumeSidecar(self.savePath);
+    [self closeFileHandle];
+    RCTPushyDiscardArchive(self.savePath);
     [self.session finishTasksAndInvalidate];
     self.session = nil;
     [self startTransfer];
@@ -346,9 +352,7 @@ willPerformHTTPRedirection:(NSHTTPURLResponse *)response
         completionHandler(nil);
         return;
     }
-    NSString *originalScheme = [[NSURL URLWithString:self.urlString].scheme lowercaseString];
-    NSString *nextScheme = [request.URL.scheme lowercaseString];
-    if ([originalScheme isEqualToString:@"https"] && [nextScheme isEqualToString:@"http"]) {
+    if (RCTPushyIsHttpsDowngrade([NSURL URLWithString:self.urlString], request.URL)) {
         [self failWithDescription:[NSString stringWithFormat:
             @"https download redirected to plaintext http: %@", request.URL.absoluteString]
                              code:-1];
@@ -523,19 +527,18 @@ didReceiveResponse:(NSURLResponse *)response
         [dataTask cancel];
         return;
     }
-    if (self.expectedTotal <= 0
-        && self.receivedBytes + (long long)data.length > self.freeSpaceReservedUntil) {
-        // Unknown/encoded length: the response-time check could only
-        // reserve the margin, so probe before any write that would run past
-        // the bytes reserved so far, each probe reserving at least the next
-        // PROBE bytes (more when one callback carries a larger buffer) — no
-        // write can ever eat into the margin. The archive cap alone (512
-        // MiB) is far more than the margin protects. The partial stays: a
-        // later attempt may find the space.
-        long long reserve = MAX(pushy::archive_limits::kUnknownLengthFreeSpaceProbeBytes,
-                                (long long)data.length);
-        self.freeSpaceReservedUntil = self.receivedBytes + reserve;
-        NSString *shortfall = RCTPushyFreeSpaceShortfall(self.savePath, reserve);
+    // Unknown/encoded length: the response-time check could only reserve the
+    // margin, so the disk is probed before any write that would run past the
+    // bytes reserved so far (archive_limits::PlanUnknownLengthFreeSpaceProbe)
+    // — no write can ever eat into the margin. The partial stays: a later
+    // attempt may find the space.
+    pushy::archive_limits::FreeSpaceProbe plan =
+        pushy::archive_limits::PlanUnknownLengthFreeSpaceProbe(
+            self.expectedTotal, self.receivedBytes, (long long)data.length,
+            self.freeSpaceReservedUntil);
+    self.freeSpaceReservedUntil = plan.reserved_until;
+    if (plan.probe) {
+        NSString *shortfall = RCTPushyFreeSpaceShortfall(self.savePath, plan.reserve);
         if (shortfall != nil) {
             [self failWithDescription:shortfall code:-1];
             [dataTask cancel];

package/ios/RCTPushy/RCTPushyInstallRecord.mm

@@ -0,0 +1,61 @@
+// Version directories and the completion record: where an install lands and
+// how it is recorded as complete. The record itself (format, atomic write,
+// presence and activation checks) is the shared core's
+// (cpp/patch_core/install_record.h); switchVersion:error: calls its
+// activation check directly.
+#import "RCTPushyInternal.h"
+#include "../../cpp/patch_core/error_codes.h"
+#include "../../cpp/patch_core/install_record.h"
+
+PUSHY_HIDDEN NSString *const BUNDLE_FILE_NAME = @"index.bundlejs";
+
+PUSHY_HIDDEN NSString *PushyVersionDir(NSString *hash) {
+    return [[RCTPushy downloadDir] stringByAppendingPathComponent:hash];
+}
+
+// Two-phase install: everything lands in <hash>.staging first.
+PUSHY_HIDDEN NSString *PushyStagingDir(NSString *hash) {
+    return [PushyVersionDir(hash) stringByAppendingString:@(pushy::install_record::kStagingSuffix)];
+}
+
+// Presence check (launch / dedup paths, no digest work): bundle present and
+// the record is the legacy marker or names this version.
+PUSHY_HIDDEN BOOL PushyHasCompletedVersionAtPath(NSString *versionDir, NSString *hash) {
+    return pushy::install_record::IsComplete(PushyToStdString(versionDir), PushyToStdString(hash),
+                                             PushyToStdString(BUNDLE_FILE_NAME));
+}
+
+// The record's bundleSha256 (crash attribution); @"" when there is none.
+PUSHY_HIDDEN NSString *PushyRecordedBundleSha256(NSString *versionDir) {
+    return PushyFromStdString(
+        pushy::install_record::RecordedBundleSha256(PushyToStdString(versionDir))) ?: @"";
+}
+
+// Second phase of an install: seals <hash>.staging with the completion
+// record (the final bundle's digest is mandatory: a version whose bundle
+// could not be hashed is never recorded as installed) and renames it over
+// <hash> in one atomic step. nil on success. Runs on the file queue. The
+// caller drops the staging directory on failure.
+PUSHY_HIDDEN NSError *PushyPromoteStagingDir(NSString *hash, NSString *artifactSha256) {
+    std::string staging = PushyToStdString(PushyStagingDir(hash));
+    pushy::install_record::SealResult sealed = pushy::install_record::Seal(
+        staging, PushyToStdString(hash), PushyToStdString(BUNDLE_FILE_NAME),
+        PushyToStdString(artifactSha256), std::string());
+    if (!sealed.status.ok) {
+        return PushyErrorWithCode(sealed.file_failure ? pushy::error_codes::kFileOperationFailed
+                                                      : pushy::error_codes::kDeltaFailed,
+                                  PushyFromStdString(sealed.status.message));
+    }
+    NSString *versionDir = PushyVersionDir(hash);
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    if ([fileManager fileExistsAtPath:versionDir]) {
+        [fileManager removeItemAtPath:versionDir error:nil];
+    }
+    pushy::install_record::Status promoted =
+        pushy::install_record::Promote(staging, PushyToStdString(versionDir));
+    if (!promoted.ok) {
+        return PushyErrorWithCode(pushy::error_codes::kFileOperationFailed,
+                                  PushyFromStdString(promoted.message));
+    }
+    return nil;
+}