refactor: add loop protection for OTA redeployment and update error handling

Author: YogendraShelke

android/src/main/java/com/mendix/mendixnative/react/ota/NativeOtaModule.kt

@@ -19,6 +19,7 @@ const val OTA_ZIP_FILE_MISSING = "OTA_ZIP_FILE_MISSING"
 const val OTA_UNZIP_DIR_EXISTS = "OTA_UNZIP_DIR_EXISTS"
 const val OTA_DEPLOYMENT_FAILED = "OTA_DEPLOYMENT_FAILED"
 const val OTA_DOWNLOAD_FAILED = "OTA_DOWNLOAD_FAILED"
+const val OTA_ALREADY_DEPLOYED = "OTA_ALREADY_DEPLOYED"
 
 const val MANIFEST_OTA_DEPLOYMENT_ID_KEY = "otaDeploymentID"
 const val MANIFEST_RELATIVE_BUNDLE_PATH_KEY = "relativeBundlePath"
@@ -141,6 +142,30 @@ class NativeOtaModule(
 
     Log.i(TAG, "Deploying ota with id: $otaDeploymentID")
 
+    // Loop protection: refuse to redeploy a deployment that is already the active one.
+    // Redeploying and reloading into an already-active deployment restarts the app into
+    // the same bundle, causing an infinite download -> deploy -> reload loop. This happens
+    // when the served OTA bundle's embedded deploymentID never matches the server-advertised
+    // deploymentID (e.g. a bundle served as an OTA update but built for a different deployment).
+    // Rejecting here makes the JS OTA flow skip the reload, so the app keeps running the
+    // currently deployed bundle instead of looping.
+    if (oldManifest != null &&
+      oldManifest.otaDeploymentID == otaDeploymentID &&
+      File(
+        resolveAbsolutePathRelativeToOtaDir(
+          reactApplicationContext,
+          oldManifest.relativeBundlePath
+        )
+      ).exists()
+    ) {
+      zipFile.delete()
+      return reject(
+        promise,
+        OTA_ALREADY_DEPLOYED,
+        "Deployment $otaDeploymentID is already active. Skipping redeploy to prevent a reload loop."
+      )
+    }
+
     if (!zipFile.exists()) {
       return reject(promise, OTA_ZIP_FILE_MISSING, "OTA package does not exist")
     }

ios/Modules/JSBundleFileProvider/OtaJSBundleFileProvider.swift

@@ -54,10 +54,6 @@ extension OtaJSBundleFileProvider: JSBundleFileProviderProtocol {
             return nil
         }
 
-        guard let encodedPath = bundlePath.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) else {
-            return nil
-        }
-        
-        return URL(string: encodedPath)
+        return URL(fileURLWithPath: bundlePath)
     }
 }

ios/Modules/MxConfiguration/MxConfigProxy.swift

@@ -8,12 +8,12 @@ public class MxConfigProxy: NSObject {
     public var filesDirectoryName: String
     public var warningsFilter: String
     public var otaManifestPath: String
-    public var isDeveloperApp: NSNumber
+    public var isDeveloperApp: Bool
     public var nativeDependencies: [String: Any]
     public var nativeBinaryVersion: NSNumber
     public var appSessionId: String?
 
-    init(runtimeUrl: String, appName: String?, databaseName: String, filesDirectoryName: String, warningsFilter: String, otaManifestPath: String, isDeveloperApp: NSNumber, nativeDependencies: [String : Any], nativeBinaryVersion: NSNumber, appSessionId: String?) {
+    init(runtimeUrl: String, appName: String?, databaseName: String, filesDirectoryName: String, warningsFilter: String, otaManifestPath: String, isDeveloperApp: Bool, nativeDependencies: [String : Any], nativeBinaryVersion: NSNumber, appSessionId: String?) {
         self.runtimeUrl = runtimeUrl
         self.appName = appName
         self.databaseName = databaseName
@@ -45,7 +45,7 @@ public class MxConfigProxy: NSObject {
             filesDirectoryName: MxConfiguration.filesDirectoryName,
             warningsFilter: MxConfiguration.warningsFilter.stringValue,
             otaManifestPath: OtaHelpers.getOtaManifestFilepath(),
-            isDeveloperApp: NSNumber(booleanLiteral: MxConfiguration.isDeveloperApp),
+            isDeveloperApp: MxConfiguration.isDeveloperApp,
             nativeDependencies: OtaHelpers.getNativeDependencies(),
             nativeBinaryVersion: NSNumber(integerLiteral: MxConfiguration.nativeBinaryVersion),
             appSessionId: MxConfiguration.appSessionId

ios/Modules/NativeDownloadHandler/NativeDownloadHandler.swift

@@ -58,6 +58,22 @@ extension NativeDownloadHandler: URLSessionDownloadDelegate {
     func urlSession(_ session: URLSession, downloadTask: URLSessionDownloadTask, didFinishDownloadingTo location: URL) {
         let fileManager = FileManager.default
 
+        // Validate the HTTP status code. URLSession's download task writes the response body
+        // to `location` even for error responses (e.g. 404/500), so without this check an
+        // HTML/JSON error body would be saved as the "downloaded" file and later fail to unzip
+        // with a misleading error. Fail explicitly with the status code instead.
+        if let httpResponse = downloadTask.response as? HTTPURLResponse,
+           !(200...299).contains(httpResponse.statusCode) {
+            let error = NSError(
+                domain: NSURLErrorDomain,
+                code: httpResponse.statusCode,
+                userInfo: [NSLocalizedDescriptionKey: "Download failed with HTTP status \(httpResponse.statusCode)."]
+            )
+            NSLog("%@", formatMessage("Download failed with HTTP status \(httpResponse.statusCode)"))
+            failCallback?(error)
+            return
+        }
+        
         // Check MIME type if specified
         if let expectedMimeType = mimeType,
            let responseMimeType = downloadTask.response?.mimeType,

ios/Modules/NativeOtaModule/NativeOtaModule.swift

@@ -145,6 +145,25 @@ public class NativeOtaModule: NSObject {
 
         let oldManifest = OtaHelpers.readManifestAsDictionary()
 
+        // Loop protection: refuse to redeploy a deployment that is already the active one.
+        // Redeploying and reloading into an already-active deployment restarts the app into
+        // the same bundle, causing an infinite download -> deploy -> reload loop. This happens
+        // when the served OTA bundle's embedded deploymentID never matches the server-advertised
+        // deploymentID (e.g. a bundle served as an OTA update but built for a different deployment).
+        // Rejecting here makes the JS OTA flow skip the reload, so the app keeps running the
+        // currently deployed bundle instead of looping.
+        if let oldManifest = oldManifest,
+           let deployedID = oldManifest[MANIFEST_OTA_DEPLOYMENT_ID_KEY] as? String,
+           deployedID == otaDeploymentID,
+           let deployedBundlePath = oldManifest[MANIFEST_RELATIVE_BUNDLE_PATH_KEY] as? String,
+           FileManager.default.fileExists(atPath: OtaHelpers.resolveAbsolutePathRelativeToOtaDir("/\(deployedBundlePath)")) {
+            let message = "[OTA] Deployment \(otaDeploymentID) is already active. Skipping redeploy to prevent a reload loop."
+            NSLog("%@", message)
+            removeZipFile(zipPath)
+            promise.reject(OTA_ALREADY_DEPLOYED, message, nil)
+            return
+        }
+        
         let fileExists = FileManager.default.fileExists(atPath: zipPath)
         if !fileExists {
             let errorMessage = "[OTA] OTA package does not exist."
@@ -161,9 +180,17 @@ public class NativeOtaModule: NSObject {
 
         let unzipped = SSZipArchive.unzipFile(atPath: zipPath, toDestination: unzipDir, overwrite: false, password: nil, progressHandler: nil)
         if !unzipped {
-            NSLog("[OTA] Unzipping OTA failed")
-            removeZipFile(unzipDir)
-            promise.reject(OTA_DEPLOYMENT_FAILED, "OTA deployment failed.", nil)
+            // Diagnostic: the "OTA package" is not a valid zip. This most often means the
+            // server returned a non-zip response (e.g. an HTML/JSON error body) that was
+            // saved as the download. Log the size and leading bytes so the real cause is visible.
+            let fileSize = (try? FileManager.default.attributesOfItem(atPath: zipPath)[.size] as? Int) ?? nil
+            var preview = ""
+            if let handle = FileManager.default.contents(atPath: zipPath) {
+                preview = String(data: handle.prefix(64), encoding: .utf8) ?? handle.prefix(4).map { String(format: "%02x", $0) }.joined()
+            }
+            NSLog("[OTA] Unzipping OTA failed. Downloaded file size: \(fileSize ?? -1) bytes. Leading bytes: \(preview)")
+            removeZipFile(zipPath)
+            promise.reject(OTA_DEPLOYMENT_FAILED, "OTA deployment failed: downloaded package is not a valid zip.", nil)
             return
         }
 

ios/Modules/NativeOtaModule/OtaConstants.swift

@@ -12,6 +12,7 @@ let OTA_UNZIP_DIR_EXISTS = "OTA_UNZIP_DIR_EXISTS"
 let OTA_DEPLOYMENT_FAILED = "OTA_DEPLOYMENT_FAILED"
 let INVALID_DOWNLOAD_CONFIG = "INVALID_DOWNLOAD_CONFIG"
 let OTA_DOWNLOAD_FAILED = "OTA_DOWNLOAD_FAILED"
+let OTA_ALREADY_DEPLOYED = "OTA_ALREADY_DEPLOYED"
 
 // MARK: - Download Config Keys
 let DOWNLOAD_CONFIG_URL_KEY = "url"