Publish current app and server

2026-08-02 22:10:19 +12:00
parent a265636139
commit 1ed180c739
203 changed files with 23933 additions and 2788 deletions
@@ -1,8 +1,13 @@
 package api

 import (
+	"archive/zip"
+	"crypto/sha256"
 	"crypto/subtle"
+	_ "embed"
+	"encoding/hex"
 	"fmt"
+	"html/template"
 	"io"
 	"net/http"
 	"os"
@@ -15,6 +20,11 @@ import (

 const maxReleaseSize = 250 << 20

+//go:embed install.html
+var installPageSource string
+
+var installPage = template.Must(template.New("install").Parse(installPageSource))
+
 var (
 	releaseVersionPattern  = regexp.MustCompile(`^\d+\.\d+\.\d+$`)
 	releaseFilenamePattern = regexp.MustCompile(`^memby-\d+\.\d+\.\d+\.apk$`)
@@ -51,6 +61,11 @@ func (s *Server) handleReleasePublish(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "version must look like 0.1.54")
 		return
 	}
+	mandatory, validMandatory := parseMandatoryRelease(r.FormValue("mandatory"))
+	if !validMandatory {
+		writeError(w, http.StatusBadRequest, "mandatory must be true or false")
+		return
+	}

 	current := s.updatePolicy.get()
 	if current.LatestVersion != "" &&
@@ -80,35 +95,67 @@ func (s *Server) handleReleasePublish(w http.ResponseWriter, r *http.Request) {
 	tempName := temp.Name()
 	defer os.Remove(tempName)

-	written, copyErr := io.Copy(temp, source)
+	digest := sha256.New()
+	written, copyErr := io.Copy(io.MultiWriter(temp, digest), source)
+	syncErr := temp.Sync()
 	closeErr := temp.Close()
 	if copyErr != nil || closeErr != nil || written < 4 {
 		writeError(w, http.StatusBadRequest, "could not store APK")
 		return
 	}
-
-	// APKs are ZIP archives. This catches accidentally uploaded logs or HTML error pages
-	// before they become an update every TV is invited to install.
-	stored, err := os.Open(tempName)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, "could not verify APK")
+	if syncErr != nil {
+		writeError(w, http.StatusInternalServerError, "could not safely store APK")
 		return
 	}
-	var magic [4]byte
-	_, readErr := io.ReadFull(stored, magic[:])
-	stored.Close()
-	if readErr != nil || string(magic[:2]) != "PK" {
+	actualSHA256 := hex.EncodeToString(digest.Sum(nil))
+	if expected := strings.ToLower(strings.TrimSpace(r.FormValue("sha256"))); expected != "" &&
+		(expected != actualSHA256 || len(expected) != sha256.Size*2) {
+		writeError(w, http.StatusBadRequest, "APK checksum does not match")
+		return
+	}
+
+	// Parse the archive, rather than checking only its first two bytes. AndroidManifest.xml
+	// is compulsory in an APK; this rejects truncated ZIPs and renamed logs/HTML.
+	archive, err := zip.OpenReader(tempName)
+	if err != nil {
 		writeError(w, http.StatusBadRequest, "uploaded file is not an APK")
 		return
 	}
+	hasManifest := false
+	for _, entry := range archive.File {
+		if entry.Name == "AndroidManifest.xml" {
+			hasManifest = true
+			break
+		}
+	}
+	archive.Close()
+	if !hasManifest {
+		writeError(w, http.StatusBadRequest, "uploaded APK has no Android manifest")
+		return
+	}

 	filename := fmt.Sprintf("memby-%s.apk", version)
 	destination := filepath.Join(s.cfg.ReleaseDir, filename)
-	if err := os.Rename(tempName, destination); err != nil {
-		s.log.Error("release publish rename failed", "error", err)
-		writeError(w, http.StatusInternalServerError, "could not publish APK")
+	newFile := true
+	if existingSHA256, hashErr := fileSHA256(destination); hashErr == nil {
+		if existingSHA256 != actualSHA256 {
+			writeError(w, http.StatusConflict,
+				"that version already exists with different APK contents; publish a new version")
+			return
+		}
+		newFile = false
+	} else if !os.IsNotExist(hashErr) {
+		s.log.Error("existing release could not be verified", "error", hashErr)
+		writeError(w, http.StatusInternalServerError, "could not verify existing release")
 		return
 	}
+	if newFile {
+		if err := os.Rename(tempName, destination); err != nil {
+			s.log.Error("release publish rename failed", "error", err)
+			writeError(w, http.StatusInternalServerError, "could not publish APK")
+			return
+		}
+	}
 	if err := os.Chmod(destination, 0o640); err != nil {
 		s.log.Warn("release permissions could not be tightened", "error", err)
 	}
@@ -117,10 +164,20 @@ func (s *Server) handleReleasePublish(w http.ResponseWriter, r *http.Request) {
 		Enabled:        true,
 		LatestVersion:  version,
 		MinimumVersion: current.MinimumVersion,
-		DownloadURL:    s.cfg.PublicURL + "/updates/" + filename,
+		DownloadURL:    s.cfg.PublicURL + s.signedReleasePath(filename),
+		SHA256:         actualSHA256,
+		SizeBytes:      written,
 		Notes:          strings.TrimSpace(r.FormValue("notes")),
 	}
+	if mandatory {
+		// Setting the floor to the release being published makes every older client
+		// receive a mandatory verdict, which has no dismiss/skip path on the TV.
+		policy.MinimumVersion = version
+	}
 	if err := s.store.SetUpdatePolicy(r.Context(), policy); err != nil {
+		if newFile {
+			_ = os.Remove(destination)
+		}
 		s.log.Error("release policy write failed", "error", err)
 		writeError(w, http.StatusInternalServerError, "APK stored but update policy could not be saved")
 		return
@@ -131,19 +188,181 @@ func (s *Server) handleReleasePublish(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	s.log.Info("release published", "version", version, "bytes", written, "file", filename)
+	s.log.Info("release published", "version", version, "mandatory", mandatory,
+		"bytes", written, "file", filename)
 	writeJSON(w, http.StatusCreated, s.updatePolicy.get())
 }

-// handleReleaseDownload serves immutable, signed APKs. They carry no household secrets,
-// so downloads do not need a TV session and continue working through Android's installer.
-func (s *Server) handleReleaseDownload(w http.ResponseWriter, r *http.Request) {
-	filename := r.PathValue("filename")
-	if !releaseFilenamePattern.MatchString(filename) {
+func parseMandatoryRelease(value string) (mandatory, valid bool) {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "", "0", "false":
+		return false, true
+	case "1", "true":
+		return true, true
+	default:
+		return false, false
+	}
+}
+
+func fileSHA256(path string) (string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	digest := sha256.New()
+	if _, err := io.Copy(digest, file); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(digest.Sum(nil)), nil
+}
+
+type installPageData struct {
+	Authenticated bool
+	Ready         bool
+	Version       string
+	Notes         string
+	DownloadURL   string
+	Size          string
+	Error         string
+	LoginNext     string
+}
+
+func preventDiscovery(w http.ResponseWriter) {
+	// These cover general search engines, crawler-specific implementations and caches.
+	// They are intentionally also applied to APK responses so a discovered download URL
+	// does not appear as a searchable binary result.
+	w.Header().Set("X-Robots-Tag", "noindex, nofollow, noarchive, nosnippet, noimageindex")
+	w.Header().Set("Referrer-Policy", "no-referrer")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+}
+
+func handleRobots(w http.ResponseWriter, _ *http.Request) {
+	preventDiscovery(w)
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=86400")
+	_, _ = io.WriteString(w, "User-agent: *\nDisallow: /\n")
+}
+
+// handleInstallPage is deliberately public: it is the bootstrap path for a television
+// that does not have Memby yet. It exposes only the signed APK and operator-authored
+// release notes, never household or Emby data.
+func (s *Server) handleInstallPage(w http.ResponseWriter, r *http.Request) {
+	s.renderInstallPage(w, r, "", http.StatusOK)
+}
+
+func (s *Server) renderInstallPage(
+	w http.ResponseWriter,
+	r *http.Request,
+	message string,
+	status int,
+) {
+	if len(s.installerSecret()) == 0 {
 		http.NotFound(w, r)
 		return
 	}
+	authenticated := s.validInstallerSession(r)
+	if !authenticated {
+		s.renderAccessLogin(w, r, message, status, "/install")
+		return
+	}
+	policy := s.updatePolicy.get()
+	version := strings.TrimSpace(policy.LatestVersion)
+	filename := fmt.Sprintf("memby-%s.apk", version)
+	info, err := os.Stat(filepath.Join(s.cfg.ReleaseDir, filename))
+	ready := authenticated && releaseVersionPattern.MatchString(version) &&
+		err == nil && !info.IsDir()
+
+	data := installPageData{
+		Authenticated: true,
+		Ready:         ready,
+		Version:       version,
+		Notes:         strings.TrimSpace(policy.Notes),
+		Error:         message,
+	}
+	if ready {
+		data.DownloadURL = "/updates/latest.apk"
+		data.Size = fmt.Sprintf("%.1f MB", float64(info.Size())/(1024*1024))
+	}
+
+	s.writeInstallPage(w, data, status)
+}
+
+func (s *Server) renderAccessLogin(
+	w http.ResponseWriter,
+	r *http.Request,
+	message string,
+	status int,
+	next string,
+) {
+	if len(s.installerSecret()) == 0 {
+		http.NotFound(w, r)
+		return
+	}
+	s.writeInstallPage(w, installPageData{
+		Error:     message,
+		LoginNext: cleanInstallerDestination(next),
+	}, status)
+}
+
+func (s *Server) writeInstallPage(w http.ResponseWriter, data installPageData, status int) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Content-Security-Policy",
+		"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; "+
+			"base-uri 'none'; frame-ancestors 'none'")
+	w.Header().Set("Permissions-Policy",
+		"camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()")
+	preventDiscovery(w)
+	if status == http.StatusOK && data.Authenticated && !data.Ready {
+		status = http.StatusServiceUnavailable
+	}
+	if status != http.StatusOK {
+		w.WriteHeader(status)
+	}
+	if err := installPage.Execute(w, data); err != nil && s.log != nil {
+		s.log.Error("install page render failed", "error", err)
+	}
+}
+
+// handleLatestReleaseDownload gives first-time installers a stable address. Serve the
+// package directly: some Android TV downloaders hand both sides of an HTTP redirect to
+// the package installer, causing a successful install followed by a spurious parse error.
+func (s *Server) handleLatestReleaseDownload(w http.ResponseWriter, r *http.Request) {
+	if !s.validInstallerSession(r) {
+		http.NotFound(w, r)
+		return
+	}
+	version := strings.TrimSpace(s.updatePolicy.get().LatestVersion)
+	if !releaseVersionPattern.MatchString(version) {
+		http.NotFound(w, r)
+		return
+	}
+	filename := fmt.Sprintf("memby-%s.apk", version)
+	if info, err := os.Stat(filepath.Join(s.cfg.ReleaseDir, filename)); err != nil || info.IsDir() {
+		http.NotFound(w, r)
+		return
+	}
+	preventDiscovery(w)
 	w.Header().Set("Content-Type", "application/vnd.android.package-archive")
-	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	w.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`)
+	w.Header().Set("Cache-Control", "private, no-store")
+	http.ServeFile(w, r, filepath.Join(s.cfg.ReleaseDir, filename))
+}
+
+// handleReleaseDownload serves immutable, signed APKs. Access requires either a short
+// browser installer session or the signed release URL returned to an authenticated app.
+func (s *Server) handleReleaseDownload(w http.ResponseWriter, r *http.Request) {
+	filename := r.PathValue("filename")
+	if !releaseFilenamePattern.MatchString(filename) ||
+		!s.allowedReleaseDownload(r, filename) {
+		// A 404 does not confirm whether a guessed version exists.
+		http.NotFound(w, r)
+		return
+	}
+	preventDiscovery(w)
+	w.Header().Set("Content-Type", "application/vnd.android.package-archive")
+	w.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`)
+	w.Header().Set("Cache-Control", "private, no-store")
 	http.ServeFile(w, r, filepath.Join(s.cfg.ReleaseDir, filename))
 }