Badge
2 | 3 |
8 |
9 | Use the following HTML badge to share your app.
10 |
2 |
18 |
19 |
--------------------------------------------------------------------------------
/web/src/app/publish/publish.component.html:
--------------------------------------------------------------------------------
1 | 
9 | 
14 | 8 |
App info
9 |-
10 |
- Version code: {{ app.version_code }} 11 |
- Version name: {{ app.version_name }} 12 |
{{ fileinput.value.replace("C:\\fakepath\\", "") }}
10 |8 |
App info
9 |-
10 |
- Version code: {{ app.version_code }} 11 |
- Version name: {{ app.version_name }} 12 |
29 |
Submitted app info
30 |-
31 |
- Version code: {{ submitted_app.version_code }} 32 |
- Version name: {{ submitted_app.version_name }} 33 |
44 |
Review issues
45 |-
46 |
{{ issue }}
47 |
Submitted update info
49 |-
50 |
- Version code: {{ update.version_code }} 51 |
- Version name: {{ update.version_name }} 52 |
8 |
Review issues
9 |-
10 |
{{ issue }}
11 | - None 12 |
28 |
Review issues
29 |-
30 |
{{ issue }}
31 | - None 32 |
Update info
34 |-
35 |
- Version code: {{ update.version_code }} 36 |
- Version name: {{ update.version_name }} 37 |
35 | 36 | 67 | -------------------------------------------------------------------------------- /devconsole/quality/reject_tests.go: -------------------------------------------------------------------------------- 1 | package quality 2 | 3 | import ( 4 | "errors" 5 | "fmt" 6 | "path" 7 | 8 | "github.com/accrescent/apkstat" 9 | "golang.org/x/mod/semver" 10 | 11 | "github.com/accrescent/devconsole/data" 12 | pb "github.com/accrescent/devconsole/pb" 13 | ) 14 | 15 | func RunRejectTests( 16 | metadata *pb.BuildApksResult, 17 | apk *apk.APK, 18 | sdkException *data.SdkException, 19 | uploadType UploadType, 20 | ) error { 21 | manifest := apk.Manifest() 22 | 23 | // Version name (for later URL path construction) 24 | if "/"+manifest.VersionName != path.Clean("/"+manifest.VersionName) { 25 | return errors.New("invalid version name") 26 | } 27 | 28 | // Bundletool version used to generate APK set 29 | bundletoolVersion := metadata.GetBundletool().GetVersion() 30 | if semver.Compare("v"+bundletoolVersion, "v"+MIN_BUNDLETOOL_VERSION) == -1 { 31 | return fmt.Errorf( 32 | "APK set generated with bundletool %s but mininum supported version is %s", 33 | bundletoolVersion, 34 | MIN_BUNDLETOOL_VERSION, 35 | ) 36 | } 37 | 38 | targetSDK := manifest.UsesSDK.TargetSDKVersion 39 | 40 | // Target SDK 41 | switch { 42 | case targetSDK == nil: 43 | return errors.New("Required field 'targetSdk' not found") 44 | case uploadType == NewApp && *targetSDK < MIN_TARGET_SDK_NEW_APP: 45 | return fmt.Errorf( 46 | "App target SDK is %d but the minimum is %d", 47 | *targetSDK, MIN_TARGET_SDK_NEW_APP, 48 | ) 49 | case uploadType == Update: 50 | switch { 51 | case sdkException != nil && *targetSDK >= sdkException.MinTargetSdk: 52 | break 53 | case *targetSDK < MIN_TARGET_SDK_UPDATE: 54 | return fmt.Errorf( 55 | "App target SDK is %d but the minimum is %d", 56 | *targetSDK, MIN_TARGET_SDK_UPDATE, 57 | ) 58 | } 59 | } 60 | 61 | // android:debuggable 62 | if manifest.Application.Debuggable != nil && *manifest.Application.Debuggable { 63 | return errors.New("android:debuggable should not be set to true") 64 | } 65 | 66 | // android:testOnly 67 | if manifest.Application.TestOnly != nil && *manifest.Application.TestOnly { 68 | return errors.New("android:testOnly should not be set to true") 69 | } 70 | 71 | // android:usesCleartextTraffic 72 | usesCleartextTraffic := manifest.Application.UsesCleartextTraffic 73 | if usesCleartextTraffic != nil && *usesCleartextTraffic { 74 | return errors.New("android:usesCleartextTraffic should not be set to true") 75 | } 76 | 77 | return nil 78 | } 79 | -------------------------------------------------------------------------------- /web/src/polyfills.ts: -------------------------------------------------------------------------------- 1 | /** 2 | * This file includes polyfills needed by Angular and is loaded before the app. 3 | * You can add your own extra polyfills to this file. 4 | * 5 | * This file is divided into 2 sections: 6 | * 1. Browser polyfills. These are applied before loading ZoneJS and are sorted by browsers. 7 | * 2. Application imports. Files imported after ZoneJS that should be loaded before your main 8 | * file. 9 | * 10 | * The current setup is for so-called "evergreen" browsers; the last versions of browsers that 11 | * automatically update themselves. This includes recent versions of Safari, Chrome (including 12 | * Opera), Edge on the desktop, and iOS and Chrome on mobile. 13 | * 14 | * Learn more in https://angular.io/guide/browser-support 15 | */ 16 | 17 | /*************************************************************************************************** 18 | * BROWSER POLYFILLS 19 | */ 20 | 21 | /** 22 | * By default, zone.js will patch all possible macroTask and DomEvents 23 | * user can disable parts of macroTask/DomEvents patch by setting following flags 24 | * because those flags need to be set before `zone.js` being loaded, and webpack 25 | * will put import in the top of bundle, so user need to create a separate file 26 | * in this directory (for example: zone-flags.ts), and put the following flags 27 | * into that file, and then add the following code before importing zone.js. 28 | * import './zone-flags'; 29 | * 30 | * The flags allowed in zone-flags.ts are listed here. 31 | * 32 | * The following flags will work for all browsers. 33 | * 34 | * (window as any).__Zone_disable_requestAnimationFrame = true; // disable patch requestAnimationFrame 35 | * (window as any).__Zone_disable_on_property = true; // disable patch onProperty such as onclick 36 | * (window as any).__zone_symbol__UNPATCHED_EVENTS = ['scroll', 'mousemove']; // disable patch specified eventNames 37 | * 38 | * in IE/Edge developer tools, the addEventListener will also be wrapped by zone.js 39 | * with the following flag, it will bypass `zone.js` patch for IE/Edge 40 | * 41 | * (window as any).__Zone_enable_cross_context_check = true; 42 | * 43 | */ 44 | 45 | /*************************************************************************************************** 46 | * Zone JS is required by default for Angular itself. 47 | */ 48 | import 'zone.js'; // Included with Angular CLI. 49 | 50 | 51 | /*************************************************************************************************** 52 | * APPLICATION IMPORTS 53 | */ 54 | -------------------------------------------------------------------------------- /nginx/dev.conf: -------------------------------------------------------------------------------- 1 | user nginx; 2 | worker_processes auto; 3 | 4 | events { 5 | worker_connections 4096; 6 | } 7 | 8 | http { 9 | include mime.types; 10 | default_type application/octet-stream; 11 | 12 | charset utf-8; 13 | 14 | sendfile on; 15 | sendfile_max_chunk 512k; 16 | tcp_nopush on; 17 | keepalive_timeout 3m; 18 | server_tokens off; 19 | msie_padding off; 20 | 21 | client_max_body_size 1k; 22 | client_body_buffer_size 1k; 23 | client_header_buffer_size 1k; 24 | large_client_header_buffers 4 4k; 25 | http2_recv_buffer_size 128k; 26 | 27 | client_body_timeout 30s; 28 | client_header_timeout 30s; 29 | send_timeout 30s; 30 | 31 | http2_max_concurrent_streams 32; 32 | limit_conn_status 429; 33 | limit_conn_zone $binary_remote_addr zone=addr:10m; 34 | limit_conn addr 256; 35 | 36 | ssl_protocols TLSv1.2 TLSv1.3; 37 | ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256; 38 | ssl_prefer_server_ciphers on; 39 | ssl_conf_command Options PrioritizeChaCha; 40 | 41 | ssl_certificate /etc/nginx/certs/cert.pem; 42 | ssl_certificate_key /etc/nginx/certs/key.pem; 43 | 44 | ssl_session_cache shared:SSL:10m; 45 | ssl_session_timeout 1d; 46 | ssl_buffer_size 4k; 47 | 48 | log_format main '$remote_addr - $remote_user [$time_local] ' 49 | '"$request_method $scheme://$host$request_uri $server_protocol" $status $body_bytes_sent ' 50 | '"$http_referer" "$http_user_agent"'; 51 | access_log /var/log/nginx/access.log main buffer=64k flush=1m; 52 | error_log syslog:server=unix:/dev/log,nohostname; 53 | log_not_found off; 54 | 55 | gzip_proxied any; 56 | gzip_vary on; 57 | 58 | # Static files & reverse proxy to web application 59 | server { 60 | listen 443 ssl http2; 61 | listen [::]:443 ssl http2; 62 | server_name localhost; 63 | root /usr/share/nginx/html; 64 | include security.conf; 65 | 66 | index index.html; 67 | 68 | location = "/api/logout" { 69 | proxy_pass http://console:8080; 70 | } 71 | 72 | location = "/auth/github" { 73 | proxy_pass http://console:8080; 74 | } 75 | 76 | location /api/apps { 77 | client_max_body_size 128M; 78 | proxy_pass http://console:8080; 79 | } 80 | 81 | location ^~ /api/ { 82 | proxy_pass http://console:8080; 83 | } 84 | 85 | location / { 86 | proxy_pass http://web; 87 | } 88 | } 89 | } 90 | -------------------------------------------------------------------------------- /devconsole/data/db.go: -------------------------------------------------------------------------------- 1 | package data 2 | 3 | import ( 4 | "golang.org/x/oauth2" 5 | 6 | "github.com/accrescent/devconsole/config" 7 | ) 8 | 9 | type DB interface { 10 | Open(dsn string) error 11 | Initialize() error 12 | LoadConfig() (*oauth2.Config, *config.Config, error) 13 | Close() error 14 | 15 | CreateSession(ghID int64, accessToken string) (id string, err error) 16 | GetSessionInfo(id string) (ghId int64, accessToken string, err error) 17 | DeleteExpiredSessions() error 18 | DeleteSession(id string) error 19 | 20 | CanUserRegister(ghID int64) (bool, error) 21 | CreateUser(ghID int64, email string) error 22 | GetUserPermissions(appID string, ghID int64) (update bool, err error) 23 | GetUserRoles(ghID int64) (registered bool, reviewer bool, err error) 24 | 25 | CreateReviewer(ghID int64, email string) error 26 | 27 | CreateApp( 28 | app AppWithIssues, 29 | ghID int64, 30 | appFileHandle string, 31 | iconFileHandle string, 32 | iconHash string, 33 | ) error 34 | GetAppInfo(appID string) (versionCode int32, err error) 35 | GetApprovedApps() ([]App, error) 36 | GetApps(ghID int64) ([]App, error) 37 | GetPendingApps(reviewerGhID int64) ([]AppWithIssues, error) 38 | GetStagingAppInfo(appID string, ghID int64) (appHandle string, iconHandle string, err error) 39 | GetSubmittedAppInfo( 40 | appID string, 41 | ) ( 42 | app App, 43 | ghID int64, 44 | iconID int, 45 | issueGroupID *int, 46 | appHandle string, 47 | iconHandle string, 48 | err error, 49 | ) 50 | GetSubmittedApps(ghID int64) ([]App, error) 51 | ApproveApp(appID string) error 52 | PublishApp(appID string) error 53 | SubmitApp(appID string, label string, ghID int64) error 54 | DeleteSubmittedApp(appID string) error 55 | 56 | CreateUpdate(app AppWithIssues, ghID int64, fileHandle string) error 57 | GetSubmittedUpdates(ghID int64) ([]AppWithIssues, error) 58 | GetUpdateInfo( 59 | appID string, 60 | versionCode int, 61 | ) (firstVersion int, versionName string, fileHandle string, issueGroupID *int, err error) 62 | GetUpdates(reviewerGhID int64) ([]AppWithIssues, error) 63 | GetStagingUpdateInfo( 64 | appID string, 65 | versionCode int32, 66 | ghID int64, 67 | ) ( 68 | label string, 69 | versionName string, 70 | fileHandle string, 71 | issueGroupID *int, 72 | needsReview bool, 73 | err error, 74 | ) 75 | ApproveUpdate(appID string, versionCode int, versionName string, issueGroupID *int) error 76 | SubmitUpdate(app App, fileHandle string, issueGroupID *int, needsReview bool) error 77 | DeleteSubmittedUpdate(appID string, versionCode int) error 78 | 79 | GetSdkException(appID string) (*SdkException, error) 80 | } 81 | -------------------------------------------------------------------------------- /ansible/templates/nginx/reposerver.conf.j2: -------------------------------------------------------------------------------- 1 | worker_processes auto; 2 | worker_rlimit_nofile 16384; 3 | 4 | events { 5 | worker_connections 4096; 6 | } 7 | 8 | http { 9 | include mime.types; 10 | default_type application/octet-stream; 11 | 12 | charset utf-8; 13 | 14 | sendfile on; 15 | sendfile_max_chunk 512k; 16 | tcp_nopush on; 17 | keepalive_timeout 3m; 18 | server_tokens off; 19 | msie_padding off; 20 | 21 | client_max_body_size 1k; 22 | client_body_buffer_size 1k; 23 | client_header_buffer_size 1k; 24 | large_client_header_buffers 4 4k; 25 | http2_recv_buffer_size 128k; 26 | 27 | client_body_timeout 30s; 28 | client_header_timeout 30s; 29 | send_timeout 30s; 30 | 31 | http2_max_concurrent_streams 32; 32 | 33 | ssl_protocols TLSv1.2 TLSv1.3; 34 | ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256; 35 | ssl_prefer_server_ciphers on; 36 | ssl_conf_command Options PrioritizeChaCha; 37 | 38 | ssl_certificate /etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem; 39 | ssl_certificate_key /etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem; 40 | 41 | ssl_session_cache shared:SSL:10m; 42 | ssl_session_timeout 1d; 43 | ssl_buffer_size 4k; 44 | 45 | log_format main '$remote_addr - $remote_user [$time_local] ' 46 | '"$request_method $scheme://$host$request_uri $server_protocol" $status $body_bytes_sent ' 47 | '"$http_referer" "$http_user_agent"'; 48 | access_log syslog:server=unix:/dev/log,nohostname main; 49 | error_log syslog:server=unix:/dev/log,nohostname; 50 | log_not_found off; 51 | 52 | gzip_proxied any; 53 | gzip_vary on; 54 | 55 | if_modified_since before; 56 | 57 | aio threads; 58 | aio_write on; 59 | 60 | upstream backend { 61 | server [::1]:8080 max_conns=1024 fail_timeout=1s; 62 | } 63 | 64 | server { 65 | listen 80; 66 | listen [::]:80; 67 | server_name {{ inventory_hostname }}; 68 | 69 | root /var/empty; 70 | 71 | return 301 https://$host$request_uri; 72 | } 73 | 74 | server { 75 | listen 443 ssl http2; 76 | listen [::]:443 ssl http2; 77 | server_name {{ inventory_hostname }}; 78 | 79 | include security.conf; 80 | add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; sandbox; base-uri 'none';" always; 81 | 82 | gzip_static on; 83 | 84 | location /.well-known/acme-challenge/ { 85 | root /srv/certbot; 86 | } 87 | 88 | location /api/apps { 89 | client_max_body_size 128M; 90 | proxy_pass http://backend; 91 | } 92 | 93 | location / { 94 | root /srv/{{ inventory_hostname }}; 95 | } 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /devconsole/app.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "context" 5 | "net/http" 6 | 7 | "github.com/gin-gonic/gin" 8 | "golang.org/x/oauth2" 9 | 10 | "github.com/accrescent/devconsole/api" 11 | "github.com/accrescent/devconsole/auth" 12 | "github.com/accrescent/devconsole/config" 13 | "github.com/accrescent/devconsole/data" 14 | "github.com/accrescent/devconsole/middleware" 15 | ) 16 | 17 | type App struct { 18 | server *http.Server 19 | db data.DB 20 | fileStorage data.FileStorage 21 | } 22 | 23 | func NewApp( 24 | db data.DB, 25 | fileStorage data.FileStorage, 26 | oauth2Conf oauth2.Config, 27 | conf config.Config, 28 | ) (*App, error) { 29 | router := gin.New() 30 | router.Use(gin.Logger()) 31 | if err := router.SetTrustedProxies(nil); err != nil { 32 | return nil, err 33 | } 34 | router.Use(middleware.DB(db)) 35 | router.Use(middleware.FileStorage(fileStorage)) 36 | router.Use(middleware.OAuth2Config(oauth2Conf)) 37 | router.Use(middleware.Config(conf)) 38 | 39 | router.GET("/auth/github", auth.GitHub) 40 | router.GET("/api/auth/github/callback", auth.GitHubCallback) 41 | 42 | auth := router.Group("/", middleware.AuthRequired()) 43 | reviewer := auth.Group("/", middleware.ReviewerRequired()) 44 | update := auth.Group("/", middleware.UserCanUpdateRequired()) 45 | auth.GET("/api/emails", api.GetEmails) 46 | reviewer.GET("/api/pending-apps", api.GetPendingApps) 47 | reviewer.GET("/api/pending-apps/:id/apks", api.GetAppAPKs) 48 | reviewer.PATCH("/api/pending-apps/:id", api.ApproveApp) 49 | reviewer.DELETE("/api/pending-apps/:id", api.RejectApp) 50 | reviewer.GET("/api/updates", api.GetUpdates) 51 | reviewer.GET("/api/updates/:id/:version/apks", api.GetUpdateAPKs) 52 | reviewer.PATCH("/api/updates/:id/:version", api.ApproveUpdate) 53 | reviewer.DELETE("/api/updates/:id/:version", api.RejectUpdate) 54 | auth.GET("/api/approved-apps", middleware.SignerRequired(), api.GetApprovedApps) 55 | auth.POST("/api/register", api.Register) 56 | auth.DELETE("/api/session", api.LogOut) 57 | auth.GET("/api/apps", api.GetApps) 58 | auth.POST("/api/apps", api.NewApp) 59 | auth.GET("/api/submitted-apps", api.GetSubmittedApps) 60 | auth.GET("/api/submitted-updates", api.GetSubmittedUpdates) 61 | auth.PATCH("/api/apps/:id", api.SubmitApp) 62 | update.POST("/api/apps/:id/updates", api.NewUpdate) 63 | update.PATCH("/api/apps/:id/:version", api.SubmitUpdate) 64 | auth.POST("/api/apps/:id", middleware.SignerRequired(), api.PublishApp) 65 | 66 | server := &http.Server{ 67 | Addr: ":8080", 68 | Handler: router, 69 | } 70 | 71 | return &App{ 72 | server, 73 | db, 74 | fileStorage, 75 | }, nil 76 | } 77 | 78 | func (a *App) Start() error { 79 | return a.server.ListenAndServe() 80 | } 81 | 82 | func (a *App) Stop(ctx context.Context) error { 83 | if err := a.server.Shutdown(ctx); err != nil { 84 | return err 85 | } 86 | 87 | return a.db.Close() 88 | } 89 | -------------------------------------------------------------------------------- /web/src/app/app.service.ts: -------------------------------------------------------------------------------- 1 | import { Injectable } from '@angular/core'; 2 | import { HttpClient, HttpEvent, HttpRequest } from '@angular/common/http'; 3 | 4 | import { Observable } from 'rxjs'; 5 | 6 | import { App } from './app'; 7 | 8 | @Injectable({ 9 | providedIn: 'root' 10 | }) 11 | export class AppService { 12 | private readonly appsUrl = 'api/apps'; 13 | private readonly submittedAppsUrl = 'api/submitted-apps'; 14 | private readonly submittedUpdatesUrl = 'api/submitted-updates'; 15 | private readonly pendingAppsUrl = 'api/pending-apps'; 16 | private readonly updatesUrl = 'api/updates'; 17 | private readonly approvedAppsUrl = 'api/approved-apps'; 18 | 19 | constructor(private http: HttpClient) {} 20 | 21 | getApps(): Observable