fix: make release artifacts fully offline

lib/core/backup/backup_crypto.dart

@@ -3,11 +3,11 @@ import 'dart:convert';
 import 'dart:typed_data';
 
 import 'package:on_time_front/core/backup/backup_password.dart';
-import 'package:sodium_libs/sodium_libs_sumo.dart';
+import 'package:sodium/sodium_sumo.dart';
 
 class BackupCrypto {
   BackupCrypto({Future<SodiumSumo> Function()? sodiumLoader})
-    : _sodiumLoader = sodiumLoader ?? SodiumSumoInit.init;
+    : _sodiumLoader = sodiumLoader ?? (() async => SodiumSumoInit.init());
 
   static const _magic = 'ONTIMEBK';
   static const formatVersion = 1;
@@ -150,9 +150,9 @@ class BackupCrypto {
     final signedPassword = Int8List.fromList(
       password.utf8Bytes.map((byte) => byte > 127 ? byte - 256 : byte).toList(),
     );
-    return sodium.runIsolated((isolated, _, _) {
-      return isolated.crypto.pwhash(
-        outLen: isolated.crypto.secretStream.keyBytes,
+    return sodium.runIsolated((_, _) {
+      return sodium.crypto.pwhash(
+        outLen: sodium.crypto.secretStream.keyBytes,
         password: signedPassword,
         salt: salt,
         opsLimit: opsLimit,

linux/flutter/generated_plugin_registrant.cc

@@ -8,7 +8,6 @@
 
 #include <file_selector_linux/file_selector_plugin.h>
 #include <flutter_secure_storage_linux/flutter_secure_storage_linux_plugin.h>
-#include <sodium_libs/sodium_libs_plugin.h>
 #include <sqlcipher_flutter_libs/sqlite3_flutter_libs_plugin.h>
 
 void fl_register_plugins(FlPluginRegistry* registry) {
@@ -18,9 +17,6 @@ void fl_register_plugins(FlPluginRegistry* registry) {
   g_autoptr(FlPluginRegistrar) flutter_secure_storage_linux_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "FlutterSecureStorageLinuxPlugin");
   flutter_secure_storage_linux_plugin_register_with_registrar(flutter_secure_storage_linux_registrar);
-  g_autoptr(FlPluginRegistrar) sodium_libs_registrar =
-      fl_plugin_registry_get_registrar_for_plugin(registry, "SodiumLibsPlugin");
-  sodium_libs_plugin_register_with_registrar(sodium_libs_registrar);
   g_autoptr(FlPluginRegistrar) sqlcipher_flutter_libs_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "Sqlite3FlutterLibsPlugin");
   sqlite3_flutter_libs_plugin_register_with_registrar(sqlcipher_flutter_libs_registrar);

linux/flutter/generated_plugins.cmake

@@ -5,7 +5,6 @@
 list(APPEND FLUTTER_PLUGIN_LIST
   file_selector_linux
   flutter_secure_storage_linux
-  sodium_libs
   sqlcipher_flutter_libs
 )
 

macos/Flutter/GeneratedPluginRegistrant.swift

@@ -11,7 +11,6 @@ import flutter_secure_storage_darwin
 import package_info_plus
 import path_provider_foundation
 import shared_preferences_foundation
-import sodium_libs
 import sqlcipher_flutter_libs
 
 func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
@@ -21,6 +20,5 @@ func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
   FPPPackageInfoPlusPlugin.register(with: registry.registrar(forPlugin: "FPPPackageInfoPlusPlugin"))
   PathProviderPlugin.register(with: registry.registrar(forPlugin: "PathProviderPlugin"))
   SharedPreferencesPlugin.register(with: registry.registrar(forPlugin: "SharedPreferencesPlugin"))
-  SodiumLibsPlugin.register(with: registry.registrar(forPlugin: "SodiumLibsPlugin"))
   Sqlite3FlutterLibsPlugin.register(with: registry.registrar(forPlugin: "Sqlite3FlutterLibsPlugin"))
 }

pubspec.lock

@@ -168,6 +168,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.1.2"
+  code_assets:
+    dependency: transitive
+    description:
+      name: code_assets
+      sha256: bf394f466ba9205f1812a0433b392d6af280f155f56651eda7c18cc32ed493b8
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
   code_builder:
     dependency: transitive
     description:
@@ -580,6 +588,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.3.2"
+  hooks:
+    dependency: transitive
+    description:
+      name: hooks
+      sha256: "9a62a50b50b769a737bc0a8ff381f333529df3ab746b2f6b02e83760231455ba"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.2"
   html:
     dependency: transitive
     description:
@@ -936,10 +952,10 @@ packages:
     dependency: transitive
     description:
       name: posix
-      sha256: "185ef7606574f789b40f289c233efa52e96dead518aed988e040a10737febb07"
+      sha256: bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e
       url: "https://pub.dev"
     source: hosted
-    version: "6.5.0"
+    version: "6.5.2"
   provider:
     dependency: transitive
     description:
@@ -972,6 +988,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "4.1.0"
+  record_use:
+    dependency: transitive
+    description:
+      name: record_use
+      sha256: "2551bd8eecfe95d14ae75f6021ad0248be5c27f138c2ec12fcb52b500b3ba1ed"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.0"
   rxdart:
     dependency: "direct main"
     description:
@@ -1069,18 +1093,10 @@ packages:
     dependency: "direct main"
     description:
       name: sodium
-      sha256: "515b86c186f4caca49051caf858d878ca7cc4ff4542411e9febb50654eac8a62"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.4.6"
-  sodium_libs:
-    dependency: "direct main"
-    description:
-      name: sodium_libs
-      sha256: f3f9c516b4183226b7a08ca43a765ebc9e02cfd92e46e8a6cc490f98ffe73052
+      sha256: "3d8bec7acb3bd958309e431a840f1eded82f508d57461ecd2920d399b802b38a"
       url: "https://pub.dev"
     source: hosted
-    version: "3.4.6+4"
+    version: "4.0.4"
   source_gen:
     dependency: transitive
     description:
@@ -1161,14 +1177,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.4.1"
-  synchronized:
-    dependency: transitive
-    description:
-      name: synchronized
-      sha256: "3a7b5d17422dd0f8d5c6c14feaa5a1c65638b9455f871a96f08437562c046931"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.4.1+2"
   table_calendar:
     dependency: "direct main"
     description:

pubspec.yaml

@@ -71,8 +71,7 @@ dependencies:
   path: ^1.9.1
   path_provider: ^2.1.5
   file_selector: ^1.0.4
-  sodium_libs: 3.4.6+4
-  sodium: 3.4.6
+  sodium: 4.0.4
   unorm_dart: ^0.3.2
 
 

test/helpers/sodium_test_loader.dart

@@ -1,14 +1,3 @@
-import 'dart:ffi';
-import 'dart:io';
-
 import 'package:sodium/sodium_sumo.dart';
 
-Future<SodiumSumo> loadSodiumForTest() {
-  final library = switch (Platform.operatingSystem) {
-    'macos' => '/opt/homebrew/lib/libsodium.dylib',
-    'linux' => 'libsodium.so',
-    'windows' => 'libsodium.dll',
-    _ => throw UnsupportedError('Unsupported unit-test platform.'),
-  };
-  return SodiumSumoInit.init(() => DynamicLibrary.open(library));
-}
+Future<SodiumSumo> loadSodiumForTest() async => SodiumSumoInit.init();

test/local_only_boundary_test.dart

@@ -40,4 +40,31 @@ void main() {
       ),
     );
   });
+
+  test('web remote bootstrap resources violate the local-only boundary', () {
+    final root = Directory.systemTemp.createTempSync(
+      'ontime_web_local_only_boundary_',
+    );
+    addTearDown(() => root.deleteSync(recursive: true));
+
+    Directory('${root.path}/lib').createSync(recursive: true);
+    File(
+      '${root.path}/pubspec.yaml',
+    ).writeAsStringSync('name: local_only_fixture\ndependencies:\n');
+    final manifest = File(
+      '${root.path}/android/app/src/main/AndroidManifest.xml',
+    );
+    manifest.parent.createSync(recursive: true);
+    manifest.writeAsStringSync('<manifest />');
+    final webIndex = File('${root.path}/web/index.html');
+    webIndex.parent.createSync(recursive: true);
+    webIndex.writeAsStringSync(
+      '<script src="https://accounts.example.test/client.js"></script>',
+    );
+
+    expect(
+      validateLocalOnlyBoundary(root),
+      contains('web/index.html contains remote runtime marker src="https://'),
+    );
+  });
 }

tool/check_local_only_boundary.dart

@@ -71,6 +71,37 @@ List<String> validateLocalOnlyBoundary(Directory root) {
     }
   }
 
+  final webIndex = File('${root.path}/web/index.html');
+  if (webIndex.existsSync()) {
+    final content = webIndex.readAsStringSync().toLowerCase();
+    for (final marker in const [
+      'src="http://',
+      'src="https://',
+      "src='http://",
+      "src='https://",
+      'firebase-messaging-sw.js',
+      'google-signin-client_id',
+      'sqlite3wasmuri',
+    ]) {
+      if (content.contains(marker)) {
+        failures.add('web/index.html contains remote runtime marker $marker');
+      }
+    }
+  }
+
+  if (File('${root.path}/web/firebase-messaging-sw.js').existsSync()) {
+    failures.add('web/firebase-messaging-sw.js remains in the product bundle');
+  }
+
+  final webBootstrap = File('${root.path}/web/flutter_bootstrap.js');
+  if (Directory('${root.path}/web').existsSync() &&
+      (!webBootstrap.existsSync() ||
+          !RegExp(
+            r'''canvasKitBaseUrl\s*:\s*['"]canvaskit/['"]''',
+          ).hasMatch(webBootstrap.readAsStringSync()))) {
+    failures.add('web/flutter_bootstrap.js does not pin CanvasKit locally');
+  }
+
   return failures;
 }
 

web/flutter_bootstrap.js

@@ -0,0 +1,11 @@
+{{flutter_js}}
+{{flutter_build_config}}
+
+_flutter.loader.load({
+  serviceWorkerSettings: {
+    serviceWorkerVersion: {{flutter_service_worker_version}},
+  },
+  config: {
+    canvasKitBaseUrl: 'canvaskit/',
+  },
+});

web/index.html

@@ -24,20 +24,13 @@
     <meta name="theme-color" content="transparent">
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
 
-
-    <meta name="google-signin-client_id"
-        content="456571312261-5kuf2r6i5i7lqjr7qealv06sdgkn3hcp.apps.googleusercontent.com">
-    <meta name="use_fedcm_for_prompt" content="true">
-
-
     <!-- iOS meta tags & icons -->
     <meta name="mobile-web-app-capable" content="yes">
     <meta name="apple-mobile-web-app-capable" content="yes">
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
     <meta name="apple-mobile-web-app-title" content="OnTime" />
     <link rel="apple-touch-icon" href="icons/Icon-192.png" />
 
-
     <!-- Favicon -->
     <link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
     <link rel="icon" href="favicon.ico" type="image/x-icon">
@@ -54,20 +47,10 @@
         }
     </style>
 
-
-
+    <script src="sodium.js"></script>
 </head>
 
 <body>
-    <script>
-        window.sqlite3WasmUri = "https://unpkg.com/sql.js@1.8.0/dist/sql-wasm.wasm";
-        if ('serviceWorker' in navigator) {
-            window.addEventListener('load', function () {
-                navigator.serviceWorker.register('firebase-messaging-sw.js');
-            });
-        }
-    </script>
-    <script src="https://accounts.google.com/gsi/client" async></script>
     <script src="functions.js"></script>
     <script src="flutter_bootstrap.js" async></script>
 </body>

windows/flutter/generated_plugin_registrant.cc

@@ -9,7 +9,6 @@
 #include <file_selector_windows/file_selector_windows.h>
 #include <flutter_secure_storage_windows/flutter_secure_storage_windows_plugin.h>
 #include <permission_handler_windows/permission_handler_windows_plugin.h>
-#include <sodium_libs/sodium_libs_plugin_c_api.h>
 #include <sqlcipher_flutter_libs/sqlite3_flutter_libs_plugin.h>
 
 void RegisterPlugins(flutter::PluginRegistry* registry) {
@@ -19,8 +18,6 @@ void RegisterPlugins(flutter::PluginRegistry* registry) {
       registry->GetRegistrarForPlugin("FlutterSecureStorageWindowsPlugin"));
   PermissionHandlerWindowsPluginRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("PermissionHandlerWindowsPlugin"));
-  SodiumLibsPluginCApiRegisterWithRegistrar(
-      registry->GetRegistrarForPlugin("SodiumLibsPluginCApi"));
   Sqlite3FlutterLibsPluginRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("Sqlite3FlutterLibsPlugin"));
 }

windows/flutter/generated_plugins.cmake

@@ -6,7 +6,6 @@ list(APPEND FLUTTER_PLUGIN_LIST
   file_selector_windows
   flutter_secure_storage_windows
   permission_handler_windows
-  sodium_libs
   sqlcipher_flutter_libs
 )