300 lines
12 KiB
JavaScript
300 lines
12 KiB
JavaScript
import { readFileSync, existsSync, readdirSync } from 'node:fs';
|
|
import { relative, resolve } from 'node:path';
|
|
import {
|
|
validateAndroidPrivacyDocument,
|
|
validateLegalUrlPair
|
|
} from './app-legal-config.mjs';
|
|
|
|
const projectRoot = resolve(import.meta.dirname, '..');
|
|
const manifestPath = resolve(projectRoot, 'src/manifest.json');
|
|
const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
|
|
const requirePrivacy = process.argv.includes('--require-privacy');
|
|
const checkLegalUrls = process.argv.includes('--check-legal-urls');
|
|
const failures = [];
|
|
let releaseLegalUrls;
|
|
|
|
const fail = (message) => failures.push(message);
|
|
const compiledAppRoot = resolve(projectRoot, 'dist/build/app');
|
|
const releaseTextExtensions = new Set(['.css', '.html', '.js', '.json', '.txt', '.xml']);
|
|
const releaseSensitiveFilePattern = /(^|[\\/])(?:\.env(?:\.|$)|id_rsa$)|\.(?:jks|keystore|p12|pfx|pem)$/i;
|
|
const releaseSensitiveContentPatterns = [
|
|
['private key', /BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY/],
|
|
['cloud access key', /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/],
|
|
['GitHub token', /\b(?:ghp_|github_pat_)[A-Za-z0-9_]{20,}\b/],
|
|
['model API key', /\bsk-[A-Za-z0-9_-]{20,}\b/],
|
|
['mobile number', /(?<!\d)1[3-9]\d{9}(?!\d)/],
|
|
['fixed test SMS code', /测试验证码.{0,24}\b\d{4,8}\b/]
|
|
];
|
|
|
|
const compiledTextFiles = (root) => {
|
|
if (!existsSync(root)) return [];
|
|
const result = [];
|
|
const visit = (directory) => {
|
|
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
|
const absolutePath = resolve(directory, entry.name);
|
|
if (entry.isDirectory()) {
|
|
visit(absolutePath);
|
|
} else if (releaseTextExtensions.has(entry.name.slice(entry.name.lastIndexOf('.')).toLowerCase())) {
|
|
result.push(absolutePath);
|
|
}
|
|
}
|
|
};
|
|
visit(root);
|
|
return result;
|
|
};
|
|
|
|
const scanCompiledAppForSensitiveValues = () => {
|
|
if (!existsSync(compiledAppRoot)) {
|
|
fail('compiled App resource directory is missing; run build:app before release verification');
|
|
return;
|
|
}
|
|
const allFiles = [];
|
|
const visit = (directory) => {
|
|
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
|
const absolutePath = resolve(directory, entry.name);
|
|
if (entry.isDirectory()) visit(absolutePath);
|
|
else allFiles.push(absolutePath);
|
|
}
|
|
};
|
|
visit(compiledAppRoot);
|
|
for (const file of allFiles) {
|
|
const relativePath = relative(compiledAppRoot, file);
|
|
if (releaseSensitiveFilePattern.test(relativePath)) {
|
|
fail(`compiled App contains a sensitive file: ${relativePath}`);
|
|
}
|
|
}
|
|
for (const file of compiledTextFiles(compiledAppRoot)) {
|
|
const content = readFileSync(file, 'utf8');
|
|
for (const [label, pattern] of releaseSensitiveContentPatterns) {
|
|
if (pattern.test(content)) {
|
|
fail(`compiled App contains a possible ${label}: ${relative(compiledAppRoot, file)}`);
|
|
}
|
|
}
|
|
}
|
|
};
|
|
const readPng = (relativePath) => {
|
|
if (typeof relativePath !== 'string' || !relativePath) {
|
|
fail('manifest is missing an App asset path');
|
|
return undefined;
|
|
}
|
|
const path = [
|
|
resolve(projectRoot, 'src', relativePath),
|
|
resolve(projectRoot, relativePath)
|
|
].find(existsSync);
|
|
if (!path) {
|
|
fail(`missing asset: ${relativePath}`);
|
|
return undefined;
|
|
}
|
|
const header = readFileSync(path).subarray(0, 29);
|
|
const isPng = header.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
|
|
if (!isPng || header.toString('ascii', 12, 16) !== 'IHDR') {
|
|
fail(`invalid PNG: ${relativePath}`);
|
|
return undefined;
|
|
}
|
|
return {
|
|
width: header.readUInt32BE(16),
|
|
height: header.readUInt32BE(20),
|
|
colorType: header[25]
|
|
};
|
|
};
|
|
|
|
const expectPng = (relativePath, width, height, opaque = false) => {
|
|
const png = readPng(relativePath);
|
|
if (!png) return;
|
|
if (png.width !== width || png.height !== height) {
|
|
fail(`unexpected dimensions for ${relativePath}: got ${png.width}x${png.height}, expected ${width}x${height}`);
|
|
}
|
|
if (opaque && (png.colorType === 4 || png.colorType === 6)) {
|
|
fail(`iOS App icon must not contain alpha: ${relativePath}`);
|
|
}
|
|
};
|
|
|
|
const app = manifest['app-plus'];
|
|
const distribute = app?.distribute;
|
|
const icons = distribute?.icons;
|
|
const splashscreen = distribute?.splashscreen;
|
|
const android = distribute?.android;
|
|
const modules = app?.modules;
|
|
|
|
if (!Array.isArray(app?.screenOrientation) || !app.screenOrientation.includes('portrait-primary')) {
|
|
fail('app-plus.screenOrientation must include portrait-primary');
|
|
}
|
|
if (splashscreen?.useOriginalMsgbox !== true) {
|
|
fail('app-plus.distribute.splashscreen.useOriginalMsgbox must enable the native privacy prompt');
|
|
}
|
|
if (app?.ssl?.untrustedca !== 'refuse') {
|
|
fail('app-plus.ssl.untrustedca must remain refuse');
|
|
}
|
|
if (!/^\d+\.\d+\.\d+$/.test(String(manifest.versionName || ''))) {
|
|
fail('versionName must use semantic numeric form such as 0.1.6');
|
|
}
|
|
if (!/^[1-9]\d*$/.test(String(manifest.versionCode || ''))) {
|
|
fail('versionCode must be a positive integer');
|
|
}
|
|
if (android?.packagename !== 'com.yincheng.wygj') {
|
|
fail('Android package name must remain com.yincheng.wygj');
|
|
}
|
|
if (android?.targetSdkVersion !== 35) {
|
|
fail('Android targetSdkVersion must be 35 for the August 1 test package');
|
|
}
|
|
const expectedAndroidAbis = ['arm64-v8a', 'armeabi-v7a'];
|
|
const actualAndroidAbis = Array.isArray(android?.abiFilters)
|
|
? [...android.abiFilters].sort()
|
|
: [];
|
|
if (JSON.stringify(actualAndroidAbis) !== JSON.stringify(expectedAndroidAbis)) {
|
|
fail('Android abiFilters must include exactly armeabi-v7a and arm64-v8a');
|
|
}
|
|
if (android?.permissionExternalStorage?.request !== 'none') {
|
|
fail('Android external storage permission must not be requested at startup');
|
|
}
|
|
if (android?.permissionPhoneState?.request !== 'none') {
|
|
fail('Android phone state permission must not be requested at startup');
|
|
}
|
|
if (!Object.hasOwn(modules || {}, 'Camera') || !Object.hasOwn(modules || {}, 'Record')) {
|
|
fail('App modules must include Camera and Record for user-triggered media features');
|
|
}
|
|
const declaredAndroidPermissions = Array.isArray(android?.permissions)
|
|
? android.permissions.join('\n')
|
|
: '';
|
|
for (const permission of ['android.permission.RECORD_AUDIO', 'android.permission.MODIFY_AUDIO_SETTINGS']) {
|
|
if (!declaredAndroidPermissions.includes(permission)) {
|
|
fail(`Android permissions must include ${permission}`);
|
|
}
|
|
}
|
|
|
|
const androidIcons = [
|
|
['hdpi', 72], ['xhdpi', 96], ['xxhdpi', 144], ['xxxhdpi', 192]
|
|
];
|
|
for (const [density, size] of androidIcons) {
|
|
expectPng(icons?.android?.[density], size, size);
|
|
}
|
|
|
|
const iosIconPaths = [
|
|
[icons?.ios?.appstore, 1024],
|
|
[icons?.ios?.iphone?.['app@2x'], 120], [icons?.ios?.iphone?.['app@3x'], 180],
|
|
[icons?.ios?.iphone?.['spotlight@2x'], 80], [icons?.ios?.iphone?.['spotlight@3x'], 120],
|
|
[icons?.ios?.iphone?.['settings@2x'], 58], [icons?.ios?.iphone?.['settings@3x'], 87],
|
|
[icons?.ios?.iphone?.['notification@2x'], 40], [icons?.ios?.iphone?.['notification@3x'], 60],
|
|
[icons?.ios?.ipad?.app, 76], [icons?.ios?.ipad?.['app@2x'], 152], [icons?.ios?.ipad?.['proapp@2x'], 167],
|
|
[icons?.ios?.ipad?.spotlight, 40], [icons?.ios?.ipad?.['spotlight@2x'], 80],
|
|
[icons?.ios?.ipad?.settings, 29], [icons?.ios?.ipad?.['settings@2x'], 58],
|
|
[icons?.ios?.ipad?.notification, 20], [icons?.ios?.ipad?.['notification@2x'], 40]
|
|
];
|
|
for (const [relativePath, size] of iosIconPaths) expectPng(relativePath, size, size, true);
|
|
|
|
const splashPaths = [
|
|
[splashscreen?.android?.hdpi, 480, 762], [splashscreen?.android?.xhdpi, 720, 1242], [splashscreen?.android?.xxhdpi, 1080, 1882],
|
|
[splashscreen?.ios?.iphone?.retina40, 640, 1136], [splashscreen?.ios?.iphone?.retina47, 750, 1334],
|
|
[splashscreen?.ios?.iphone?.retina55, 1242, 2208], [splashscreen?.ios?.iphone?.iphonex, 1125, 2436],
|
|
[splashscreen?.ios?.iphone?.['portrait-896h@2x'], 828, 1792], [splashscreen?.ios?.iphone?.['portrait-896h@3x'], 1242, 2688],
|
|
[splashscreen?.ios?.ipad?.portrait7, 768, 1024], [splashscreen?.ios?.ipad?.['portrait-retina7'], 1536, 2048],
|
|
[splashscreen?.ios?.ipad?.['portrait-1112h@2x'], 1668, 2224], [splashscreen?.ios?.ipad?.['portrait-1194h@2x'], 1668, 2388],
|
|
[splashscreen?.ios?.ipad?.['portrait-1366h@2x'], 2048, 2732]
|
|
];
|
|
for (const [relativePath, width, height] of splashPaths) expectPng(relativePath, width, height);
|
|
|
|
const privacyPath = resolve(projectRoot, 'src/androidPrivacy.json');
|
|
const compiledPrivacyPath = resolve(projectRoot, 'dist/build/app/androidPrivacy.json');
|
|
if (requirePrivacy) {
|
|
if (String(process.env.VITE_DEV_SMS_HINT_ENABLED || '').toLowerCase() === 'true') {
|
|
fail('VITE_DEV_SMS_HINT_ENABLED must be disabled for release builds');
|
|
}
|
|
if (String(process.env.VITE_DEV_SMS_HINT_VALUE || '').trim()) {
|
|
fail('VITE_DEV_SMS_HINT_VALUE must not be present for release builds');
|
|
}
|
|
try {
|
|
releaseLegalUrls = validateLegalUrlPair(
|
|
process.env.VITE_APP_TERMS_URL,
|
|
process.env.VITE_APP_PRIVACY_URL
|
|
);
|
|
} catch (error) {
|
|
fail(`release build legal URL environment is invalid: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
|
|
if (!existsSync(privacyPath)) {
|
|
fail('src/androidPrivacy.json is required for release; run configure:app-privacy with final legal URLs');
|
|
} else {
|
|
try {
|
|
const privacy = JSON.parse(readFileSync(privacyPath, 'utf8'));
|
|
const privacyLegalUrls = validateAndroidPrivacyDocument(privacy);
|
|
if (
|
|
releaseLegalUrls
|
|
&& (
|
|
privacyLegalUrls.termsUrl !== releaseLegalUrls.termsUrl
|
|
|| privacyLegalUrls.privacyUrl !== releaseLegalUrls.privacyUrl
|
|
)
|
|
) {
|
|
fail('androidPrivacy.json legal links must match VITE_APP_TERMS_URL and VITE_APP_PRIVACY_URL');
|
|
}
|
|
releaseLegalUrls = privacyLegalUrls;
|
|
} catch (error) {
|
|
fail(`androidPrivacy.json is invalid: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
}
|
|
|
|
if (!existsSync(compiledPrivacyPath)) {
|
|
fail('compiled App resource is missing androidPrivacy.json; run build:app after configure:app-privacy');
|
|
} else {
|
|
try {
|
|
const compiledPrivacy = JSON.parse(readFileSync(compiledPrivacyPath, 'utf8'));
|
|
const compiledLegalUrls = validateAndroidPrivacyDocument(compiledPrivacy);
|
|
if (
|
|
releaseLegalUrls
|
|
&& (
|
|
compiledLegalUrls.termsUrl !== releaseLegalUrls.termsUrl
|
|
|| compiledLegalUrls.privacyUrl !== releaseLegalUrls.privacyUrl
|
|
)
|
|
) {
|
|
fail('compiled App androidPrivacy.json must match the source privacy configuration');
|
|
}
|
|
} catch (error) {
|
|
fail(`compiled App androidPrivacy.json is invalid: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
}
|
|
scanCompiledAppForSensitiveValues();
|
|
}
|
|
|
|
const checkRemoteLegalPage = async (url, label, expectedText) => {
|
|
try {
|
|
const response = await fetch(url, {
|
|
method: 'GET',
|
|
redirect: 'follow',
|
|
signal: AbortSignal.timeout(10000),
|
|
headers: { 'user-agent': 'Bangdao-App-Release-Preflight/1.0' }
|
|
});
|
|
if (!response.ok) {
|
|
fail(`${label} returned HTTP ${response.status}`);
|
|
return;
|
|
}
|
|
if (!String(response.url).startsWith('https://')) {
|
|
fail(`${label} redirected away from HTTPS`);
|
|
return;
|
|
}
|
|
const contentType = String(response.headers.get('content-type') || '').toLowerCase();
|
|
if (!contentType.includes('text/html') && !contentType.includes('application/xhtml+xml')) {
|
|
fail(`${label} must return an HTML document`);
|
|
return;
|
|
}
|
|
const body = await response.text();
|
|
if (body.trim().length < 100 || !expectedText.test(body)) {
|
|
fail(`${label} does not contain recognizable final legal content`);
|
|
}
|
|
} catch (error) {
|
|
fail(`${label} is not publicly reachable: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
};
|
|
|
|
if (requirePrivacy && checkLegalUrls && releaseLegalUrls) {
|
|
await Promise.all([
|
|
checkRemoteLegalPage(releaseLegalUrls.termsUrl, 'service agreement URL', /服务协议|用户协议/),
|
|
checkRemoteLegalPage(releaseLegalUrls.privacyUrl, 'privacy policy URL', /隐私政策|个人信息保护/)
|
|
]);
|
|
}
|
|
|
|
if (failures.length) {
|
|
console.error(`App asset verification failed:\n- ${failures.join('\n- ')}`);
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log(`App asset verification passed (${androidIcons.length + iosIconPaths.length} icons, ${splashPaths.length} splash images).`);
|