:HIGH: feature/ARCBLOOD-4352 support CDN authorization via content key and bypass key [MEDIUM]

.gitignore

@@ -1,6 +1,8 @@
 *.iml
 local.properties
 build
+.DS_Store
+**/.DS_Store
 # Created by https://www.gitignore.io
 
 ### Android ###

build.gradle

@@ -6,7 +6,7 @@ buildscript {
 		mavenCentral()
 	}
 	dependencies {
-		classpath 'com.android.tools.build:gradle:8.13.0'
+		classpath 'com.android.tools.build:gradle:8.13.2'
 
 		// NOTE: Do not place your application dependencies here; they belong
 		// in the individual module build.gradle files
@@ -26,10 +26,10 @@ allprojects {
 
 		maven {
 			credentials {
-				username "$ANDROID_INTERNAL_PUBLISHING_USERNAME"
-				password "$ANDROID_INTERNAL_PUBLISHING_PASSWORD"
+				username "aws"
+				password System.env.CODEARTIFACT_AUTH_TOKEN
 			}
-			url "$ANDROID_INTERNAL_PUBLISHING_URL"
+			url 'https://threesidedcube-android-735275294014.d.codeartifact.us-east-1.amazonaws.com/maven/3SidedCube-Android/'
 		}
 	}
 }

example/build.gradle

@@ -3,10 +3,10 @@ import com.cube.storm.content.BundleDownloadStrategy
 buildscript {
 	repositories {
 		maven {
-			url "$ANDROID_INTERNAL_PUBLISHING_URL"
+			url 'https://threesidedcube-android-735275294014.d.codeartifact.us-east-1.amazonaws.com/maven/3SidedCube-Android/'
 			credentials {
-				username "$ANDROID_INTERNAL_PUBLISHING_USERNAME"
-				password "$ANDROID_INTERNAL_PUBLISHING_PASSWORD"
+				username "aws"
+				password System.env.CODEARTIFACT_AUTH_TOKEN
 			}
 		}
 	}

gradle.properties

@@ -1,4 +1,4 @@
-VERSION_NAME=3.0.0
+VERSION_NAME=3.0.1-rc2
 GROUP=com.3sidedcube.storm
 
 POM_NAME=LightningContent
@@ -16,4 +16,4 @@ POM_LICENSE_DIST=repo
 POM_DEVELOPER_ID=scruffyfox
 POM_DEVELOPER_NAME=Callum Taylor
 android.useAndroidX=true
-android.enableJetifier=true
+android.enableJetifier=true

gradle/publishing.gradle

@@ -31,9 +31,9 @@ allprojects {
 	}
 }
 
-ext.PUBLISHING_URL = properties.get('ANDROID_INTERNAL_PUBLISHING_URL', '')
-ext.PUBLISHING_USERNAME = properties.get('ANDROID_INTERNAL_PUBLISHING_USERNAME', '')
-ext.PUBLISHING_PASSWORD = properties.get('ANDROID_INTERNAL_PUBLISHING_PASSWORD', '')
+ext.PUBLISHING_URL = 'https://threesidedcube-android-735275294014.d.codeartifact.us-east-1.amazonaws.com/maven/3SidedCube-Android/'
+ext.PUBLISHING_USERNAME = "aws"
+ext.PUBLISHING_PASSWORD = System.env.CODEARTIFACT_AUTH_TOKEN
 
 afterEvaluate { project ->
 	publishing {

library/src/main/java/com/cube/storm/ContentSettings.java

@@ -178,6 +178,11 @@ public static ContentSettings getInstance()
 	 */
 	@Getter @Setter private String authorizationToken;
 
+	/**
+	 * Content key to use when downloading updates/bundles from the CDN
+	 */
+	@Getter @Setter @Nullable private String contentKey;
+
 	/**
 	 * The builder class for {@link com.cube.storm.ContentSettings}. Use this to create a new {@link com.cube.storm.ContentSettings} instance
 	 * with the customised properties specific for your project.
@@ -324,6 +329,19 @@ public Builder authorizationToken(@NonNull String token)
 			return this;
 		}
 
+		/**
+		 * Set the content key header to be used when downloading updates/bundles from the CDN
+		 *
+		 * @param contentKey The content key
+		 *
+		 * @return The {@link com.cube.storm.ContentSettings.Builder} instance for chaining
+		 */
+		public Builder contentKey(@Nullable String contentKey)
+		{
+			construct.contentKey = contentKey;
+			return this;
+		}
+
 		/**
 		 * Set the content URL to download bundles from
 		 *

library/src/main/java/com/cube/storm/content/lib/manager/DefaultUpdateManager.java

@@ -251,6 +251,12 @@ public void downloadUpdates(String endpoint, Observer<UpdateContentProgress> obs
 						.get()
 						.header("Connection", "close");
 
+				String contentKey = ContentSettings.getInstance().getContentKey();
+				if (!TextUtils.isEmpty(contentKey))
+				{
+					request.header("x-content-key", contentKey);
+				}
+
 				// Get the response
 				Call call = redirectingHttpClient.newCall(request.build());
 				call.enqueue(new GZIPTarCacheConnectionInfoCallback(ContentSettings.getInstance().getStoragePath() + "/delta")

plugin/build.gradle

@@ -28,8 +28,8 @@ dependencies {
 POM_NAME='LightningContentGradlePlugin'
 POM_ARTIFACT_ID='content-gradle-plugin'
 POM_PACKAGING='jar'
-// 2.0.0: migrated to the AndroidComponents variant API. Requires AGP 7.2+ (supports AGP 9.x).
-VERSION_NAME="2.0.0"
+// 2.0.1: adds StormExtension.bypassKey, sent as the x-bypass-key header on the build-time bundle download request.
+VERSION_NAME="2.0.1-rc2"
 
 java {
     sourceCompatibility = JavaVersion.VERSION_17
@@ -45,9 +45,9 @@ allprojects {
     }
 }
 
-ext.PUBLISHING_URL = properties.get('ANDROID_INTERNAL_PUBLISHING_URL', '')
-ext.PUBLISHING_USERNAME = properties.get('ANDROID_INTERNAL_PUBLISHING_USERNAME', '')
-ext.PUBLISHING_PASSWORD = properties.get('ANDROID_INTERNAL_PUBLISHING_PASSWORD', '')
+ext.PUBLISHING_URL = 'https://threesidedcube-android-735275294014.d.codeartifact.us-east-1.amazonaws.com/maven/3SidedCube-Android/'
+ext.PUBLISHING_USERNAME = "aws"
+ext.PUBLISHING_PASSWORD = System.env.CODEARTIFACT_AUTH_TOKEN
 
 afterEvaluate { project ->
     publishing {

plugin/src/main/groovy/com/cube/storm/content/StormExtension.groovy

@@ -9,6 +9,11 @@ class StormExtension {
     String bundleEnvironment = ""
     String authUsername = ""
     String authPassword = ""
+    /**
+     * Static key sent as the x-bypass-key header on the build-time bundle download request, for
+     * CDN edge gating that isn't tied to a running app (so Firebase AppCheck doesn't apply here).
+     */
+    String bypassKey = ""
     Date bundleTimestamp = null
     Boolean obeyLandmark = null
 
@@ -48,7 +53,8 @@ class StormExtension {
                 obeyLandmark: this.obeyLandmark == null ? other.obeyLandmark : this.obeyLandmark,
                 bundleDownloadStrategy: this.bundleDownloadStrategy == null ? other.bundleDownloadStrategy : this.bundleDownloadStrategy,
                 authUsername: this.authUsername.isEmpty() ? other.authUsername : this.authUsername,
-                authPassword: this.authPassword.isEmpty() ? other.authPassword : this.authPassword
+                authPassword: this.authPassword.isEmpty() ? other.authPassword : this.authPassword,
+                bypassKey: this.bypassKey.isEmpty() ? other.bypassKey : this.bypassKey
         )
     }
 
@@ -58,6 +64,6 @@ class StormExtension {
 
     public String toString()
     {
-        return "Storm(apiBase=${apiBase}, apiVersion=${apiVersion}, appId=${appId}, orgId=${orgId}, orgName=${orgName}, bundleEnv=${bundleEnvironment}, bundleTimestamp=${bundleTimestamp}, obeyLandmark=${obeyLandmark}, bundleDownloadStrategy=${bundleDownloadStrategy}, authUsername=${authUsername}, authPassword=${authPassword}, url=${url})"
+        return "Storm(apiBase=${apiBase}, apiVersion=${apiVersion}, appId=${appId}, orgId=${orgId}, orgName=${orgName}, bundleEnv=${bundleEnvironment}, bundleTimestamp=${bundleTimestamp}, obeyLandmark=${obeyLandmark}, bundleDownloadStrategy=${bundleDownloadStrategy}, authUsername=${authUsername}, authPassword=${authPassword}, bypassKey=${bypassKey.isEmpty() ? "" : "***"}, url=${url})"
     }
 }

plugin/src/main/groovy/com/cube/storm/content/StormPlugin.groovy

@@ -122,6 +122,7 @@ class StormPlugin implements Plugin<Project> {
 			boolean requiresAuth = mergedStormConfig.requiresAuth()
 			String url = mergedStormConfig.url
 			String authUsername = mergedStormConfig.authUsername
+			String bypassKey = mergedStormConfig.bypassKey
 
 			String sanitisedUrl = url.replaceAll("[\\\\/:*?\"<>|]", "_")
 			def archiveFile = project.layout.buildDirectory.file("storm/${sanitisedUrl}/bundle.tar.gz")
@@ -173,6 +174,9 @@ class StormPlugin implements Plugin<Project> {
 						println "Setting auth token for user ${authUsername}: ${authToken}"
 						downloadTaskRef.header "Authorization", authToken
 					}
+					if (!bypassKey.isEmpty()) {
+						downloadTaskRef.header "x-bypass-key", bypassKey
+					}
 				}
 				src url
 				dest archiveFile.get().asFile