entracte_lib/

updater.rs

use crate::scheduler::UpdateChannel;
use serde::Serialize;
use tauri::AppHandle;
use tauri_plugin_updater::UpdaterExt;

/// Signed manifest for the stable line. GitHub's `releases/latest`
/// resolves to the newest **non-prerelease** release, which is what keeps
/// betas out of it.
pub const STABLE_ENDPOINT: &str =
    "https://github.com/drmowinckels/entracte/releases/latest/download/latest.json";

/// Signed manifest for the beta line, published to a rolling
/// `channel-beta` release. It cannot use `releases/latest`: beta releases
/// are marked prerelease (so they never hijack the stable pointer), and
/// `releases/latest` skips prereleases — pointing the beta channel there
/// would resolve to the stable manifest, which is how #238 broke the
/// update check when every release was a prerelease.
pub const BETA_ENDPOINT: &str =
    "https://github.com/drmowinckels/entracte/releases/download/channel-beta/latest.json";

/// The channel's manifest URL, parsed into a `Url`.
///
/// Split out from [`check_channel`] so the parse and its error mapping
/// are unit-testable; what remains in `check_channel` is live-runtime
/// glue (`updater_builder`, a network fetch) with no mockable surface.
pub fn channel_endpoint_url(channel: UpdateChannel) -> Result<tauri::Url, String> {
    channel_endpoint(channel)
        .parse()
        .map_err(|e| format!("invalid updater endpoint for {channel:?}: {e}"))
}

/// The manifest URL a channel reads from.
///
/// This is the *entire* mechanism separating the two lines. The version
/// comparator cannot assist: semver ranks a prerelease above the stable
/// release it precedes (`0.1.1-beta.1 > 0.1.0`), so a beta manifest
/// reaching a stable install would be offered and installed. Keeping
/// betas out of `releases/latest` — by marking those releases prerelease
/// in `release.yml` — is therefore load-bearing, not cosmetic.
pub fn channel_endpoint(channel: UpdateChannel) -> &'static str {
    match channel {
        UpdateChannel::Stable => STABLE_ENDPOINT,
        UpdateChannel::Beta => BETA_ENDPOINT,
    }
}

/// Result of checking the updater endpoint for a newer Entracte build.
///
/// `has_update` is true when the signed `latest.json` manifest at the
/// configured endpoint advertises a strictly greater version than the
/// running build (the plugin's default SemVer comparator). `release_url`
/// is populated only when an update is available; the renderer
/// deep-links to the release page from the About tab in that case.
#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
pub struct UpdateInfo {
    pub current: String,
    pub latest: String,
    pub has_update: bool,
    pub release_url: Option<String>,
}

/// Subset of `tauri_plugin_updater::Update` that the result-mapping
/// logic actually consumes. Extracted so the mapping can be unit-tested
/// without a live Tauri runtime.
#[derive(Debug, Clone)]
pub struct UpdatePayload {
    pub version: String,
    pub current_version: String,
}

/// Pure mapping from "running version + optional plugin result" to the
/// renderer-facing `UpdateInfo`. Hardcoded `v` prefix on the release
/// URL matches the release tagging convention (`v0.0.1`, `v0.1.0`, …)
/// documented in CONTRIBUTING.md. Untag-prefixed releases would break
/// the deep-link — change here and in the workflow together if the
/// convention ever shifts.
pub fn build_update_info(running_version: String, update: Option<UpdatePayload>) -> UpdateInfo {
    match update {
        Some(u) => UpdateInfo {
            has_update: true,
            release_url: Some(format!(
                "https://github.com/drmowinckels/entracte/releases/tag/v{}",
                u.version
            )),
            current: u.current_version,
            latest: u.version,
        },
        None => UpdateInfo {
            has_update: false,
            release_url: None,
            current: running_version.clone(),
            latest: running_version,
        },
    }
}

/// Ask `tauri-plugin-updater` whether a newer build is available.
///
/// Delegates to `app.updater()?.check()`, which fetches the signed
/// manifest from `plugins.updater.endpoints` (configured in
/// `tauri.conf.json`), verifies its signature against the bundled
/// `plugins.updater.pubkey`, and compares versions with the plugin's
/// SemVer default. Errors stringify the underlying plugin / transport
/// failure for display in the About tab.
#[tauri::command]
pub async fn check_for_update(
    app: AppHandle,
    scheduler: tauri::State<'_, crate::scheduler::Scheduler>,
) -> Result<UpdateInfo, String> {
    check_channel(app, active_channel(&scheduler).await).await
}

/// The channel the running profile is set to.
///
/// Extracted from [`check_for_update`] so that "the check follows the
/// saved channel, not a hardcoded one" is an actually tested claim —
/// the command itself cannot be unit-tested, because `updater_builder`
/// panics without the updater plugin and a real check would hit the
/// network.
pub async fn active_channel(scheduler: &crate::scheduler::Scheduler) -> UpdateChannel {
    scheduler.settings.lock().await.update_channel
}

/// Channel-aware check, split out so the startup path can reuse it
/// without going through the IPC layer.
pub async fn check_channel(app: AppHandle, channel: UpdateChannel) -> Result<UpdateInfo, String> {
    let current = app.package_info().version.to_string();
    let endpoints = vec![channel_endpoint_url(channel)?];
    let builder = app.updater_builder().endpoints(endpoints);
    let updater = builder.map_err(|e| e.to_string())?.build();
    let updater = updater.map_err(|e| e.to_string())?;
    let payload = updater
        .check()
        .await
        .map_err(|e| e.to_string())?
        .map(|u| UpdatePayload {
            version: u.version.clone(),
            current_version: u.current_version.clone(),
        });
    Ok(build_update_info(current, payload))
}

/// Title + body for the "update available" desktop notification, or `None`
/// when there's nothing to announce (already on the latest build). Pure so the
/// copy and the no-update guard are unit-tested without a live updater or the
/// notification plugin.
pub fn update_notification(info: &UpdateInfo) -> Option<(String, String)> {
    if !info.has_update {
        return None;
    }
    Some((
        "Update available".to_string(),
        format!(
            "Entracte {} is available (you have {}). Open Preferences \u{2192} About to update.",
            info.latest, info.current
        ),
    ))
}

/// Opt-in startup auto-check (the `auto_check_updates` setting). Checks the
/// updater endpoint once in the background and posts a non-intrusive desktop
/// notification if a newer build is available. Silent on no-update and on any
/// error — being offline must never nag — and never blocks startup. Split on
/// `cfg(test)` (mirrors `overlay::spawn_render_watchdog`) so the test/coverage
/// build neither spawns a task nor fires a real OS notification; the decision
/// logic lives in the pure, tested `update_notification`.
#[cfg(not(test))]
pub fn spawn_startup_check(app: AppHandle, settings: &crate::scheduler::Settings) {
    if !settings.auto_check_updates {
        return;
    }
    let channel = settings.update_channel;
    tauri::async_runtime::spawn(async move {
        match check_channel(app.clone(), channel).await {
            Ok(info) => {
                if let Some((title, body)) = update_notification(&info) {
                    use tauri_plugin_notification::NotificationExt;
                    let _ = app.notification().builder().title(title).body(body).show();
                }
            }
            Err(e) => log::debug!("updater: startup check skipped: {e}"),
        }
    });
}

#[cfg(test)]
pub fn spawn_startup_check(_app: AppHandle, _settings: &crate::scheduler::Settings) {}

#[cfg(test)]
mod tests {
    use super::*;

    /// The shipped version lives in five files. A drift between them
    /// surfaces as a phantom "update available": the updater compares the
    /// running build's version against the latest GitHub tag, so a build
    /// that reports an older number than it was released as will offer
    /// itself an update forever.
    ///
    /// This exists because `docs/developer/releases.md` documented only
    /// two of the five, so following it would have left `Cargo.toml`,
    /// `Cargo.lock` and `package-lock.json` behind. `Cargo.lock` is not
    /// checked here — cargo rewrites it from `Cargo.toml` on the next
    /// build, so it cannot drift independently.
    #[test]
    fn shipped_version_agrees_across_every_manifest() {
        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
        let want = env!("CARGO_PKG_VERSION");

        let read = |rel: &str| -> serde_json::Value {
            let path = root.join(rel);
            let raw = std::fs::read_to_string(&path)
                .unwrap_or_else(|e| panic!("reading {}: {e}", path.display()));
            serde_json::from_str(&raw).unwrap_or_else(|e| panic!("parsing {}: {e}", path.display()))
        };

        let tauri_conf = read("tauri.conf.json");
        assert_eq!(
            tauri_conf["version"].as_str(),
            Some(want),
            "tauri.conf.json drifted from Cargo.toml ({want})"
        );

        let pkg = read("../package.json");
        assert_eq!(
            pkg["version"].as_str(),
            Some(want),
            "package.json drifted from Cargo.toml ({want})"
        );

        let lock = read("../package-lock.json");
        assert_eq!(
            lock["version"].as_str(),
            Some(want),
            "package-lock.json root version drifted from Cargo.toml ({want})"
        );
        assert_eq!(
            lock["packages"][""]["version"].as_str(),
            Some(want),
            "package-lock.json packages[\"\"] version drifted from Cargo.toml ({want})"
        );
    }

    #[tokio::test]
    async fn active_channel_reads_the_saved_setting() {
        use crate::scheduler::UpdateChannel;
        for want in [UpdateChannel::Stable, UpdateChannel::Beta] {
            let settings = crate::scheduler::Settings {
                update_channel: want,
                ..Default::default()
            };
            let (_dir, sched) = crate::test_support::test_scheduler(settings);
            assert_eq!(
                active_channel(&sched).await,
                want,
                "the update check must follow the saved channel"
            );
        }
    }

    #[test]
    fn channel_endpoint_url_parses_for_every_channel() {
        for channel in [UpdateChannel::Stable, UpdateChannel::Beta] {
            let url = channel_endpoint_url(channel)
                .unwrap_or_else(|e| panic!("{channel:?} endpoint should parse: {e}"));
            assert_eq!(url.scheme(), "https", "{channel:?} must be https");
            assert_eq!(url.as_str(), channel_endpoint(channel));
        }
    }

    #[test]
    fn channel_endpoint_maps_each_channel_to_its_own_manifest() {
        assert_eq!(channel_endpoint(UpdateChannel::Stable), STABLE_ENDPOINT);
        assert_eq!(channel_endpoint(UpdateChannel::Beta), BETA_ENDPOINT);
        assert_ne!(
            channel_endpoint(UpdateChannel::Stable),
            channel_endpoint(UpdateChannel::Beta),
            "the two channels must not share a manifest"
        );
    }

    #[test]
    fn only_the_stable_channel_uses_the_releases_latest_pointer() {
        // This is the invariant that keeps betas off stable installs, and
        // it cannot be delegated to the version comparator: semver ranks
        // `0.1.1-beta.1` ABOVE `0.1.0`, so a beta manifest read by a
        // stable install would be offered and installed. Separation is
        // purely a function of which URL each channel reads.
        assert!(
            channel_endpoint(UpdateChannel::Stable).contains("/releases/latest/"),
            "stable reads GitHub's latest pointer, which skips prereleases"
        );
        assert!(
            !channel_endpoint(UpdateChannel::Beta).contains("/releases/latest/"),
            "beta must NOT read the latest pointer — it skips prereleases, so \
             the beta channel would silently resolve to the stable manifest (#238)"
        );
    }

    #[test]
    fn beta_endpoint_targets_the_rolling_channel_release() {
        // The beta manifest lives on a fixed, rolling tag rather than a
        // versioned one, so the URL compiled into the binary keeps
        // resolving as new betas ship.
        assert!(channel_endpoint(UpdateChannel::Beta).contains("/releases/download/channel-beta/"));
        assert!(channel_endpoint(UpdateChannel::Beta).ends_with("/latest.json"));
    }

    #[test]
    fn both_endpoints_are_parseable_urls() {
        // `check_channel` parses these into `Url`; a typo here would fail
        // at runtime on every check rather than at compile time.
        for channel in [UpdateChannel::Stable, UpdateChannel::Beta] {
            let raw = channel_endpoint(channel);
            assert!(
                raw.parse::<tauri::Url>().is_ok(),
                "{channel:?} endpoint is not a valid URL: {raw}"
            );
            assert!(
                raw.starts_with("https://"),
                "{channel:?} endpoint must be https"
            );
        }
    }

    #[test]
    fn notification_announces_an_available_update_with_both_versions() {
        let info = build_update_info(
            "0.0.8".to_string(),
            Some(UpdatePayload {
                version: "0.0.9".to_string(),
                current_version: "0.0.8".to_string(),
            }),
        );
        let (title, body) = update_notification(&info).expect("an update should be announced");
        assert!(title.contains("Update"));
        assert!(body.contains("0.0.9"), "body names the new version: {body}");
        assert!(
            body.contains("0.0.8"),
            "body names the current version: {body}"
        );
    }

    #[test]
    fn no_notification_when_already_on_the_latest_build() {
        let info = build_update_info("0.0.8".to_string(), None);
        assert!(update_notification(&info).is_none());
    }

    #[test]
    fn no_update_clones_running_version_into_both_current_and_latest() {
        let info = build_update_info("0.0.1".to_string(), None);
        assert_eq!(
            info,
            UpdateInfo {
                current: "0.0.1".to_string(),
                latest: "0.0.1".to_string(),
                has_update: false,
                release_url: None,
            }
        );
    }

    #[test]
    fn update_available_yields_v_prefixed_release_url() {
        let info = build_update_info(
            "0.0.1".to_string(),
            Some(UpdatePayload {
                version: "0.0.2".to_string(),
                current_version: "0.0.1".to_string(),
            }),
        );
        assert!(info.has_update);
        assert_eq!(info.current, "0.0.1");
        assert_eq!(info.latest, "0.0.2");
        assert_eq!(
            info.release_url.as_deref(),
            Some("https://github.com/drmowinckels/entracte/releases/tag/v0.0.2"),
        );
    }

    #[test]
    fn update_with_pre_release_tag_keeps_full_version_in_url() {
        let info = build_update_info(
            "0.0.1".to_string(),
            Some(UpdatePayload {
                version: "0.1.0-rc1".to_string(),
                current_version: "0.0.1".to_string(),
            }),
        );
        assert_eq!(
            info.release_url.as_deref(),
            Some("https://github.com/drmowinckels/entracte/releases/tag/v0.1.0-rc1"),
        );
        assert_eq!(info.latest, "0.1.0-rc1");
    }

    #[test]
    fn no_update_ignores_passed_payload_when_none() {
        // The running version is used in both `current` and `latest`
        // even if the caller previously held a stale UpdatePayload —
        // None is the single source of truth for "no update".
        let info = build_update_info("1.2.3".to_string(), None);
        assert_eq!(info.current, "1.2.3");
        assert_eq!(info.latest, "1.2.3");
        assert!(info.release_url.is_none());
    }

    #[test]
    fn update_available_takes_current_version_from_plugin_not_running_arg() {
        // The plugin reports its own view of the running version in
        // `current_version`; we trust that over our `running_version`
        // arg when an update is reported, so a mismatch surfaces the
        // plugin's value (debug visibility into version skew).
        let info = build_update_info(
            "0.0.1-local".to_string(),
            Some(UpdatePayload {
                version: "0.0.2".to_string(),
                current_version: "0.0.1".to_string(),
            }),
        );
        assert_eq!(info.current, "0.0.1");
    }
}