fix(android): share public legal URLs with cloud builds

mobile-uni/scripts/configure-android-privacy.mjs

@@ -1,5 +1,6 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
+import { loadEnv } from 'vite';
 import { renderAndroidPrivacy } from './app-legal-config.mjs';
 
 const projectRoot = resolve(import.meta.dirname, '..');
@@ -13,8 +14,13 @@ const argumentValue = (name) => {
   return process.argv.find((argument) => argument.startsWith(prefix))?.slice(prefix.length);
 };
 
-const termsUrl = argumentValue('terms-url') || process.env.VITE_APP_TERMS_URL;
-const privacyUrl = argumentValue('privacy-url') || process.env.VITE_APP_PRIVACY_URL;
+const publicBuildEnv = loadEnv(process.env.NODE_ENV || 'production', projectRoot, 'VITE_');
+const termsUrl = argumentValue('terms-url')
+  || process.env.VITE_APP_TERMS_URL
+  || publicBuildEnv.VITE_APP_TERMS_URL;
+const privacyUrl = argumentValue('privacy-url')
+  || process.env.VITE_APP_PRIVACY_URL
+  || publicBuildEnv.VITE_APP_PRIVACY_URL;
 
 try {
   const rendered = renderAndroidPrivacy(

mobile-uni/scripts/verify-android-apk.ps1

@@ -13,11 +13,38 @@ $ErrorActionPreference = 'Stop'
 $scriptDirectory = Split-Path -Parent $MyInvocation.MyCommand.Path
 $projectRoot = Split-Path -Parent $scriptDirectory
 
+function Get-ProjectEnvValue {
+    param([string]$Name)
+
+    $publicEnvPath = Join-Path $projectRoot '.env'
+    if (-not (Test-Path -LiteralPath $publicEnvPath -PathType Leaf)) {
+        return ''
+    }
+    $prefix = "$Name="
+    foreach ($line in Get-Content -LiteralPath $publicEnvPath) {
+        $trimmed = $line.Trim()
+        if ($trimmed.StartsWith($prefix, [StringComparison]::Ordinal)) {
+            return $trimmed.Substring($prefix.Length).Trim().Trim('"').Trim("'")
+        }
+    }
+    return ''
+}
+
 if ([string]::IsNullOrWhiteSpace($ExpectedTermsUrl)) {
-    $ExpectedTermsUrl = $env:VITE_APP_TERMS_URL
+    $ExpectedTermsUrl = if (-not [string]::IsNullOrWhiteSpace($env:VITE_APP_TERMS_URL)) {
+        $env:VITE_APP_TERMS_URL
+    }
+    else {
+        Get-ProjectEnvValue -Name 'VITE_APP_TERMS_URL'
+    }
 }
 if ([string]::IsNullOrWhiteSpace($ExpectedPrivacyUrl)) {
-    $ExpectedPrivacyUrl = $env:VITE_APP_PRIVACY_URL
+    $ExpectedPrivacyUrl = if (-not [string]::IsNullOrWhiteSpace($env:VITE_APP_PRIVACY_URL)) {
+        $env:VITE_APP_PRIVACY_URL
+    }
+    else {
+        Get-ProjectEnvValue -Name 'VITE_APP_PRIVACY_URL'
+    }
 }
 if (
     [string]::IsNullOrWhiteSpace($ExpectedTermsUrl) -xor
@@ -25,6 +52,17 @@ if (
 ) {
     throw 'ExpectedTermsUrl and ExpectedPrivacyUrl must be provided together.'
 }
+$uncheckedConsentMessage = -join @(
+    [char]0x8BF7,
+    [char]0x5148,
+    [char]0x9605,
+    [char]0x8BFB,
+    [char]0x5E76,
+    [char]0x52FE,
+    [char]0x9009,
+    [char]0x540C,
+    [char]0x610F
+)
 
 if ([string]::IsNullOrWhiteSpace($ApkPath)) {
     $ApkPath = Join-Path $projectRoot 'dist\debug\android_debug.apk'
@@ -163,14 +201,20 @@ try {
         if ($legalAppServiceFiles.Count -ne 1) {
             throw "Expected exactly one App service for login legal-link verification, found $($legalAppServiceFiles.Count)."
         }
-        $legalAppService = Get-Content -Raw -Encoding UTF8 -LiteralPath $legalAppServiceFiles[0]
+        $legalAppServicePath = if ($legalAppServiceFiles[0] -is [IO.FileInfo]) {
+            $legalAppServiceFiles[0].FullName
+        }
+        else {
+            [string]$legalAppServiceFiles[0]
+        }
+        $legalAppService = Get-Content -Raw -Encoding UTF8 -LiteralPath $legalAppServicePath
         if (-not $legalAppService.Contains($ExpectedTermsUrl)) {
             throw 'Packaged login flow is missing the expected service agreement URL.'
         }
         if (-not $legalAppService.Contains($ExpectedPrivacyUrl)) {
             throw 'Packaged login flow is missing the expected privacy policy URL.'
         }
-        if (-not $legalAppService.Contains('请先阅读并勾选同意')) {
+        if (-not $legalAppService.Contains($uncheckedConsentMessage)) {
             throw 'Packaged login flow is missing the unchecked-consent failure message.'
         }
     }

mobile-uni/scripts/verify-app-assets.mjs

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
+import { loadEnv } from 'vite';
 import {
   validateAndroidPrivacyDocument,
   validateLegalUrlPair
@@ -12,6 +13,7 @@ const requireLegalConsent = process.argv.includes('--require-legal-consent');
 const checkLegalUrls = process.argv.includes('--check-legal-urls');
 const failures = [];
 let releaseLegalUrls;
+const publicBuildEnv = loadEnv(process.env.NODE_ENV || 'production', projectRoot, 'VITE_');
 
 const fail = (message) => failures.push(message);
 const compiledAppRoot = resolve(projectRoot, 'dist/build/app');
@@ -260,8 +262,8 @@ if (requireLegalConsent) {
   }
   try {
     releaseLegalUrls = validateLegalUrlPair(
-      process.env.VITE_APP_TERMS_URL,
-      process.env.VITE_APP_PRIVACY_URL
+      process.env.VITE_APP_TERMS_URL || publicBuildEnv.VITE_APP_TERMS_URL,
+      process.env.VITE_APP_PRIVACY_URL || publicBuildEnv.VITE_APP_PRIVACY_URL
     );
   } catch (error) {
     fail(`release build legal URL environment is invalid: ${error instanceof Error ? error.message : String(error)}`);