Add ability to upload releaes without forking gh

Author: marcprux

Sources/FairExpo/ADPManifest.swift

@@ -2,16 +2,19 @@ import Foundation
 
 /// https://developer.apple.com/documentation/marketplacekit/ingesting-an-alternative-distribution-package#Process-the-manifest-file
 public struct ADPManifest: Codable, Equatable {
-    public var distributionPackageRevision: Int // 1
-    public var appleItemId: String // "10738181399"
-    public var bundleId: String // "com.megabytemart.backyardbirds"
-    public var shortVersionString: String // "1.5"
-    public var bundleVersion: String // "1"
-    public var appleVersionId: String // "2000013060"
+    public var manifestSchemaVersion: String? // "1.0"
+    public var distributionPackageRevision: Int // 1, 2 for subsequent manifest delivery with deltas…
+    public var appleItemId: String // "6740916318"
+    public var bundleId: String // "org.appfair.app.SkipNotes"
+    public var shortVersionString: String // "0.8.7"
+    public var bundleVersion: String // "44"
+    public var appleVersionId: String // "879184094"
     public var platforms: [String] // [ "ios" ]
     public var minimumSystemVersions: [String: String] // { "ios": "17.2" }
     public var requiredDeviceCapabilities: [String] // ["arm64"]
     //public var appInstallDeterminants: [Any] // unsure what this data type should be
+    public var hasMessagesExtension: Bool?
+    public var isLaunchProhibited: Bool?
     public var variants: [Variant]
     public var deltas: [Delta]
 
@@ -31,8 +34,8 @@ public struct ADPManifest: Codable, Equatable {
 
         public struct SourceVariant: Codable, Equatable {
             public var installTargets: [[String: String]] // [ { "device": "iPhone14,5", "os": "17.4" }, … ]
-            public var appleVersionId: String // "2000011760"
-            public var version: String // "1.1"
+            public var appleVersionId: String // "878080263"
+            public var version: String // "0.8.5"
         }
     }
 

Sources/FairExpo/AppStoreConnectAPI.swift

@@ -264,6 +264,48 @@ public struct AppStoreConnectEndpoint : EndpointService {
         }
     }
 
+    public struct ADPVariantRequest : APIRequest {
+        public typealias Response = DownloadResponse
+        let variantID: UUID
+
+        public init(variantID: UUID) {
+            self.variantID = variantID
+        }
+
+        public func queryURL(for service: AppStoreConnectEndpoint) -> URL {
+            service.endpointBase.appending(components: "alternativeDistributionPackageVariants", variantID.uuidString.lowercased())
+        }
+    }
+
+    public struct ADPDeltaRequest : APIRequest {
+        public typealias Response = DownloadResponse
+        let deltaID: UUID
+
+        public init(deltaID: UUID) {
+            self.deltaID = deltaID
+        }
+        
+        public func queryURL(for service: AppStoreConnectEndpoint) -> URL {
+            service.endpointBase.appending(components: "alternativeDistributionPackageDeltas", deltaID.uuidString.lowercased())
+        }
+    }
+
+    /// A response for either the variants or deltas
+    public struct DownloadResponse : Codable {
+        public let data: DownloadData?
+
+        public struct DownloadData : Codable {
+            public let type: String // "alternativeDistributionPackageVariants" or "alternativeDistributionPackageDeltas"
+            public let id: UUID // "219750db-80c2-4c75-aecc-fa67835f384d"
+            public let attributes: Attributes
+            public struct Attributes : Codable {
+                public let url: URL // "<Apple_CDN_base_URL>/mzpse.7668245576990498917.ipa?accessKey=<access_key>"
+                public let urlExpirationDate: Date
+                public let alternativeDistributionKeyBlob: String // "<key_blob_base64_encoded_string>"
+            }
+        }
+    }
+
     public struct Relationship : Codable {
         public var links: Links
     }
@@ -284,6 +326,160 @@ public struct AppStoreConnectEndpoint : EndpointService {
     }
 }
 
+extension AppStoreConnectEndpoint {
+    public struct ADPDownloadError : LocalizedError {
+        public var errorDescription: String?
+    }
+
+    /// Look up the ADP ID for the given app version ID
+    public func fetchADPId(forVersionID versionID: String) async throws -> String {
+        // version id was specified; fetch the version endpoint and get the adpid from it
+        let versions = try await self.request(AlternativeDistributionPackage(id: versionID))
+
+        guard let versionsData = versions.data else {
+            throw ADPDownloadError(errorDescription: "Response did not contain any data payload")
+        }
+
+        if versionsData.type != "alternativeDistributionPackages" {
+            throw ADPDownloadError(errorDescription: "Response did not contain an alternative distribution package")
+        }
+
+        return versionsData.id
+    }
+
+    /// Given either an ADP ID or a version ID, return either the ADP ID itself or else resolve the version ID's ADP ID and return that
+    public func resolveADPID(from adpID: String?, versionID: String?) async throws -> String {
+        if let adpID {
+            // we specified the ADP ID directly, so just use that
+            return adpID
+        }
+        guard let versionID else {
+            throw ADPDownloadError(errorDescription: "Either --appid or --versionid must be specified")
+        }
+
+        let adpID = try await self.fetchADPId(forVersionID: versionID)
+        return adpID
+    }
+
+    /// Downloads all the assets from an Alternative Distribution Package to the speficied directory
+    /// - Parameters:
+    ///   - adpid: either the ADP ID or the version ID must be specified
+    ///   - versionid: either the ADP ID or the version ID must be specified
+    ///   - directory: the base directory to download the package
+    ///   - logger: an optional logger for an Encodable
+    /// - Returns: a map from relative file paths to absolute locations
+    public func downloadADP(adpid: String, directory: String?, logger: ((String?) -> ())?) async throws -> (ADPManifest, [String: URL]) {
+
+        var downloaded: [String: URL] = [:]
+
+        let adpVersions = try await self.request(AlternativeDistributionVersions(adpID: adpid))
+
+        // TODO: wait for completed?
+        guard let adpVersionsData = adpVersions.data else {
+            throw ADPDownloadError(errorDescription: "No data in response")
+        }
+
+        guard let completedADPVersion = adpVersionsData.first(where: { $0.attributes.state == "COMPLETED" }) else {
+            throw ADPDownloadError(errorDescription: "No completed version found for this ADP: \(adpVersionsData.map(\.attributes.state).joined(separator: ", "))")
+        }
+
+        guard let manifestSignatureZipURL = completedADPVersion.attributes.url else {
+            throw ADPDownloadError(errorDescription: "No download URL found for ADP")
+        }
+
+        // download the URL and unzip manifest.json and signature to the directory
+        let (downloadFile, response) = try await URLSession.shared.downloadFile(for: URLRequest(url: manifestSignatureZipURL, cachePolicy: .returnCacheDataElseLoad))
+        try response.validateHTTPCode()
+        defer { try? FileManager.default.removeItem(at: downloadFile) }
+
+        //let adpReleaseID = completedADPVersion.id
+        let expandPath = URL(fileURLWithPath: directory ?? FileManager.default.currentDirectoryPath).appendingPathComponent(adpid, isDirectory: true)
+
+        if expandPath.pathIsDirectory {
+            try FileManager.default.trash(url: expandPath)
+        }
+        try FileManager.default.unzipItem(at: downloadFile, to: expandPath)
+
+        let signaturePath = expandPath.appendingPathComponent("signature", isDirectory: false)
+        if !signaturePath.pathIsRegularFile {
+            throw ADPDownloadError(errorDescription: "signature file not found in ADP package at \(expandPath.path)")
+        }
+        downloaded[signaturePath.lastPathComponent] = signaturePath
+
+        let manifestPath = expandPath.appendingPathComponent("manifest.json", isDirectory: false)
+        if !manifestPath.pathIsRegularFile {
+            throw ADPDownloadError(errorDescription: "manifest.json file not found in ADP package at \(expandPath.path)")
+        }
+        downloaded[manifestPath.lastPathComponent] = manifestPath
+
+        let manifest = try JSONDecoder().decode(ADPManifest.self, from: Data(contentsOf: manifestPath))
+        //try logger?(manifest)
+
+        func downloadAsset(from sourceURL: URL, to destinationPath: String, checksum: String?) async throws {
+            // TODO: retry options
+            let (downloadDeltaFile, response) = try await URLSession.shared.downloadFile(for: URLRequest(url: sourceURL, cachePolicy: .returnCacheDataElseLoad))
+            try response.validateHTTPCode()
+            let destination = expandPath.appending(path: destinationPath)
+            try FileManager.default.moveItem(at: downloadDeltaFile, to: destination)
+            if let checksum {
+                // validate the checksum if it is specified
+                let fileChecksum = try Data(contentsOf: destination, options: .mappedIfSafe).sha256().hex()
+                if checksum.lowercased() != fileChecksum.lowercased() {
+                    throw ADPDownloadError(errorDescription: "Checksum of downloaded file \(fileChecksum) does not match expected value \(checksum) at: \(destination.path)")
+                }
+            }
+            downloaded[destinationPath] = destination
+        }
+
+        // Store the app data at an expected path
+        // https://developer.apple.com/documentation/marketplacekit/ingesting-an-alternative-distribution-package#Store-the-app-data-at-an-expected-path
+
+        // download each of the variants
+        // https://developer.apple.com/documentation/marketplacekit/ingesting-an-alternative-distribution-package#Download-app-variants
+        // GET https://api.appstoreconnect.apple.com/alternativeDistributionPackageVariants/219750db-80c2-4c75-aecc-fa67835f384d
+
+        let variantsFolder = expandPath.appendingPathComponent("variant", isDirectory: true)
+        try FileManager.default.createDirectory(at: variantsFolder, withIntermediateDirectories: false)
+        guard let variantsRelationship = completedADPVersion.relationships["variants"] else {
+            throw ADPDownloadError(errorDescription: "No variants found for ADP")
+        }
+        _ = variantsRelationship // TODO: cross-reference variants result with manifest variants to validate
+        for variantInfo in manifest.variants {
+            logger?("downloading variant: \(variantInfo.assetPath)")
+            let variantResponse = try await self.request(ADPVariantRequest(variantID: variantInfo.publicId))
+
+            guard let variantResponseData = variantResponse.data else {
+                throw ADPDownloadError(errorDescription: "No data returned from API")
+            }
+            let variantChecksums = variantInfo.variantDetails.hashes.first(where: { $0.algorithm == "sha256" })?.encryptedChunkDigests
+            try await downloadAsset(from: variantResponseData.attributes.url, to: variantInfo.assetPath, checksum: variantChecksums?.count == 1 ? variantChecksums?.first : nil)
+        }
+
+
+        // download each of the deltas (optional; might not be included in the initial reported version)
+        // “When App Store Connect sends a new app version notification, it sends an app distribution package that includes the variants first, followed by another for deltas, if any are available for the app. Deltas arrive an unspecified amount of time after the app’s variants. You don’t need to wait for deltas to arrive before serving the new app to devices. Rather, App Store Connect sends variants first to expedite the app’s availability for customers.”
+        // https://developer.apple.com/documentation/marketplacekit/ingesting-an-alternative-distribution-package#Download-app-deltas
+
+        let deltasFolder = expandPath.appendingPathComponent("delta", isDirectory: true)
+        try FileManager.default.createDirectory(at: deltasFolder, withIntermediateDirectories: false)
+        guard let deltasRelationship = completedADPVersion.relationships["deltas"] else {
+            throw ADPDownloadError(errorDescription: "No deltas found for ADP")
+        }
+        _ = deltasRelationship // TODO: cross-reference deltas result with manifest deltas to validate
+        for deltaInfo in manifest.deltas {
+            logger?("downloading delta: \(deltaInfo.assetPath)")
+            let deltaResponse = try await self.request(ADPDeltaRequest(deltaID: deltaInfo.publicId))
+            guard let deltaResponseData = deltaResponse.data else {
+                throw ADPDownloadError(errorDescription: "No data in response")
+            }
+            let deltaChecksums = deltaInfo.deltaDetails.hashes.first(where: { $0.algorithm == "sha256" })?.encryptedChunkDigests
+            try await downloadAsset(from: deltaResponseData.attributes.url, to: deltaInfo.assetPath, checksum: deltaChecksums?.count == 1 ? deltaChecksums?.first : nil)
+        }
+
+        return (manifest, downloaded)
+    }
+}
+
 private extension Data {
     func base64URLEncodedString() -> String {
         return self.base64EncodedString()
@@ -292,87 +488,3 @@ private extension Data {
             .replacingOccurrences(of: "=", with: "")
     }
 }
-
-
-//// MARK: - Configuration
-//let issuerID = "<YOUR_ISSUER_ID>"
-//let keyID = "<YOUR_KEY_ID>"
-//let privateKeyPath = "apple_key.p8"
-//
-//// MARK: - JWT Generation
-//func loadPrivateKey(from path: String) -> P256.Signing.PrivateKey? {
-//    guard let pemString = try? String(contentsOfFile: path),
-//          let keyData = extractKeyData(from: pemString) else {
-//        print("Failed to load or parse .p8 file")
-//        return nil
-//    }
-//
-//    return try? P256.Signing.PrivateKey(rawRepresentation: keyData)
-//}
-//
-//func extractKeyData(from pem: String) -> Data? {
-//    let lines = pem.components(separatedBy: .newlines)
-//    let base64Key = lines
-//        .filter { !$0.contains("BEGIN") && !$0.contains("END") }
-//        .joined()
-//    return Data(base64Encoded: base64Key)
-//}
-//
-//func generateJWT(using privateKey: P256.Signing.PrivateKey) -> String? {
-//    let header = ["alg": "ES256", "kid": keyID]
-//    let iat = Int(Date().timeIntervalSince1970)
-//    let exp = iat + 1200 // 20 minutes
-//    let payload: [String: Any] = ["iss": issuerID, "iat": iat, "exp": exp, "aud": "appstoreconnect-v1"]
-//
-//    guard let headerData = try? JSONSerialization.data(withJSONObject: header),
-//          let payloadData = try? JSONSerialization.data(withJSONObject: payload) else {
-//        return nil
-//    }
-//
-//    let headerBase64 = headerData.base64URLEncodedString()
-//    let payloadBase64 = payloadData.base64URLEncodedString()
-//    let signingInput = "\(headerBase64).\(payloadBase64)"
-//
-//    let signature = try? privateKey.signature(for: Data(signingInput.utf8))
-//    let signatureBase64 = signature?.derRepresentation.base64URLEncodedString()
-//
-//    return [headerBase64, payloadBase64, signatureBase64].compactMap { $0 }.joined(separator: ".")
-//}
-//
-//// MARK: - API Request
-//func fetchApps(jwt: String) {
-//    let url = URL(string: "https://api.appstoreconnect.apple.com/v1/apps")!
-//    var request = URLRequest(url: url)
-//    request.setValue("Bearer \(jwt)", forHTTPHeaderField: "Authorization")
-//
-//    let task = URLSession.shared.dataTask(with: request) { data, response, error in
-//        if let error = error {
-//            print("Request error: \(error)")
-//            return
-//        }
-//
-//        guard let data = data,
-//              let json = try? JSONSerialization.jsonObject(with: data, options: []) else {
-//            print("Failed to parse response")
-//            return
-//        }
-//
-//        print("Apps response:\n\(json)")
-//    }
-//
-//    task.resume()
-//}
-//
-
-
-//
-//func xxx() throws {
-//    // MARK: - Main
-//    if let privateKey = loadPrivateKey(from: privateKeyPath),
-//       let jwt = generateJWT(using: privateKey) {
-//        fetchApps(jwt: jwt)
-//        RunLoop.main.run() // Keep CLI alive for async request
-//    } else {
-//        print("Failed to generate JWT")
-//    }
-//}