aza/AzA march 2026/aza_update_core.py

# -*- coding: utf-8 -*-
"""
AZA Desktop — gemeinsame Versions- und Update-Logik (Controller, Updater, Office).

Phase 1: Manifest lesen, Version vergleichen, SHA256, Backup/Rollback vorbereiten.
Kein stilles Auto-Update, keine Aenderung von Benutzerdaten in %%APPDATA%%\\AzA.
"""

from __future__ import annotations

import hashlib
import json
import os
import re
import shutil
import sys
import tempfile
import zipfile
from datetime import datetime, timezone
from pathlib import Path
from typing import Any, Callable

try:
    import requests
except ImportError:  # pragma: no cover
    requests = None  # type: ignore

# Neues Update-Manifest (Ziel) + bestehende Endpunkte (Kompatibilitaet).
UPDATE_CHANNEL_MANIFEST_URL = "https://api.aza-medwork.ch/downloads/updates/manifest.json"
UPDATE_MANIFEST_URLS = (
    UPDATE_CHANNEL_MANIFEST_URL,
    "https://api.aza-medwork.ch/download/version.json",
    "https://api.aza-medwork.ch/release/version.json",
)
LOCAL_TEST_MANIFEST_NAME = "test_update_manifest.json"

_BUILD_STAMP_RE = re.compile(r"^\d{8}_\d{6}$")
_VERSION_JSON_NAME = "version.json"
_test_install_dir_override: Path | None = None


def configure_test_install_dir(path: str | Path | None) -> None:
    """Isolierter Test-Installationsordner — nie den Projektroot ueberschreiben."""
    global _test_install_dir_override
    if path is None or not str(path).strip():
        _test_install_dir_override = None
        return
    _test_install_dir_override = Path(path).resolve()


def get_test_install_dir() -> Path | None:
    if _test_install_dir_override is not None:
        return _test_install_dir_override
    env = (os.environ.get("AZA_UPDATE_TEST_INSTALL_DIR") or "").strip()
    if env:
        return Path(env).resolve()
    return None


def get_install_dir() -> Path:
    test_dir = get_test_install_dir()
    if test_dir is not None:
        return test_dir
    return get_project_root()


def get_project_root() -> Path:
    """Installations- bzw. Projektroot (EXE-Verzeichnis oder Skriptordner)."""
    if getattr(sys, "frozen", False):
        return Path(sys.executable).resolve().parent
    return Path(__file__).resolve().parent


def get_user_data_root() -> Path:
    """Benutzerdaten — darf bei Updates nie geloescht werden."""
    appdata = os.environ.get("APPDATA") or os.environ.get("LOCALAPPDATA") or ""
    if appdata:
        return Path(appdata) / "AzA"
    return Path.home() / "AppData" / "Roaming" / "AzA"


def get_update_backup_root() -> Path:
    """Rollback-Speicher: im Testmodus unter dem Test-Installationsordner."""
    test_dir = get_test_install_dir()
    if test_dir is not None:
        base = test_dir / "_update_backups"
        try:
            base.mkdir(parents=True, exist_ok=True)
        except OSError:
            pass
        return base
    program_data = os.environ.get("PROGRAMDATA") or ""
    if program_data:
        base = Path(program_data) / "AzA" / "update_backups"
    else:
        base = get_user_data_root() / "update_backups"
    try:
        base.mkdir(parents=True, exist_ok=True)
    except OSError:
        pass
    return base


def find_local_version_file() -> Path | None:
    root = get_install_dir()
    direct = root / _VERSION_JSON_NAME
    if direct.is_file():
        return direct
    if get_test_install_dir() is not None:
        return None
    release = get_project_root() / "release" / _VERSION_JSON_NAME
    if release.is_file():
        return release
    return None


def _parse_semver_tuple(v: str) -> tuple[int, ...]:
    v = str(v or "").strip()
    if not v:
        return tuple()
    parts: list[int] = []
    for seg in v.split("."):
        seg = seg.strip()
        m = re.match(r"^(\d+)", seg)
        parts.append(int(m.group(1)) if m else 0)
    return tuple(parts)


def _semver_pad(a: tuple[int, ...], b: tuple[int, ...]) -> tuple[tuple[int, ...], tuple[int, ...]]:
    n = max(len(a), len(b))
    return a + (0,) * (n - len(a)), b + (0,) * (n - len(b))


def semver_gt(ver_a: str, ver_b: str) -> bool:
    ta, tb = _parse_semver_tuple(ver_a), _parse_semver_tuple(ver_b)
    if not ta or not tb:
        return False
    aa, bb = _semver_pad(ta, tb)
    return aa > bb


def semver_eq(ver_a: str, ver_b: str) -> bool:
    ta, tb = _parse_semver_tuple(ver_a), _parse_semver_tuple(ver_b)
    if not ta and not tb:
        return str(ver_a).strip() == str(ver_b).strip()
    aa, bb = _semver_pad(ta, tb)
    return aa == bb


def build_gt(remote: str, local: str) -> bool:
    r, l = (remote or "").strip(), (local or "").strip()
    if not r or not l:
        return False
    if _BUILD_STAMP_RE.match(r) and _BUILD_STAMP_RE.match(l):
        return r > l
    return r > l


def _fallback_version_from_code() -> dict[str, Any]:
    version = "0.0.0"
    channel = "stable"
    build = ""
    try:
        from aza_version import APP_VERSION, APP_CHANNEL

        version = str(APP_VERSION).strip() or version
        channel = str(APP_CHANNEL).strip() or channel
    except Exception:
        pass
    if not build:
        try:
            from _build_info import BUILD_TIMESTAMP

            build = str(BUILD_TIMESTAMP or "").strip()
        except Exception:
            pass
    return {
        "version": version,
        "build": build,
        "channel": channel,
        "app": "AZA Desktop",
    }


def load_local_version() -> dict[str, Any]:
    """Liest version.json; Fallback aza_version.py + _build_info.py."""
    vf = find_local_version_file()
    if vf is not None:
        try:
            data = json.loads(vf.read_text(encoding="utf-8"))
            if isinstance(data, dict):
                if get_test_install_dir() is not None:
                    base = {
                        "version": "0.0.0",
                        "build": "",
                        "channel": "stable",
                        "app": "AZA Desktop",
                    }
                    base.update({k: v for k, v in data.items() if v is not None})
                    return base
                out = _fallback_version_from_code()
                out.update({k: v for k, v in data.items() if v is not None})
                return out
        except Exception:
            pass
    if get_test_install_dir() is not None:
        return {
            "version": "0.0.0",
            "build": "",
            "channel": "stable",
            "app": "AZA Desktop",
        }
    return _fallback_version_from_code()


def save_local_version(data: dict[str, Any]) -> Path:
    """Schreibt version.json neben der Installation."""
    root = get_install_dir()
    target = root / _VERSION_JSON_NAME
    payload = dict(load_local_version())
    payload.update(data)
    target.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
    return target


def format_version_label(data: dict[str, Any] | None = None) -> str:
    info = data or load_local_version()
    ver = str(info.get("version") or "?").strip()
    build = str(info.get("build") or "").strip()
    if build:
        return f"v{ver} · {build}"
    return f"v{ver}"


def _normalize_notes(data: dict[str, Any]) -> list[str]:
    raw = data.get("notes_de")
    if raw is None:
        raw = data.get("notes")
    if raw is None:
        raw = data.get("release_notes")
    if isinstance(raw, str):
        return [raw.strip()] if raw.strip() else []
    if isinstance(raw, list):
        return [str(x).strip() for x in raw if str(x).strip()]
    return []


def _remote_version_fields(data: dict[str, Any]) -> tuple[str, str, str]:
    version = str(
        data.get("latest_version") or data.get("version") or ""
    ).strip()
    build = str(data.get("latest_build") or data.get("build") or "").strip()
    channel = str(data.get("channel") or "stable").strip()
    return version, build, channel


def _min_required(data: dict[str, Any]) -> str:
    for key in ("min_supported_version", "minimum_supported_version", "min_required_version"):
        v = data.get(key)
        if v is not None and str(v).strip():
            return str(v).strip()
    return ""


def _log_internal(msg: str) -> None:
    print(f"[AZA Update] {msg}")


def resolve_startup_manifest_sources() -> list[str]:
    """
    Quellen fuer die Start-Updatepruefung (kein Legacy-Installer-Manifest).

    Prioritaet:
    1) AZA_UPDATE_MANIFEST_URL (URL oder lokaler Pfad)
    2) test_update_manifest.json bei AZA_UPDATE_TEST_MANIFEST=1
    3) oeffentlicher Update-Kanal /downloads/updates/manifest.json
    """
    sources: list[str] = []
    env_url = (os.environ.get("AZA_UPDATE_MANIFEST_URL") or "").strip()
    if env_url:
        sources.append(env_url)

    use_test = (os.environ.get("AZA_UPDATE_TEST_MANIFEST") or "").strip().lower() in (
        "1",
        "true",
        "yes",
    )
    test_path = get_project_root() / LOCAL_TEST_MANIFEST_NAME
    if use_test and test_path.is_file():
        sources.append(str(test_path.resolve()))

    if UPDATE_CHANNEL_MANIFEST_URL not in sources:
        sources.append(UPDATE_CHANNEL_MANIFEST_URL)
    return sources


def _load_manifest_json_text(text: str, *, source: str) -> dict[str, Any] | None:
    try:
        data = json.loads(text)
    except ValueError:
        _log_internal(f"invalid_json source={source}")
        return None
    if not isinstance(data, dict):
        _log_internal(f"invalid_manifest_shape source={source}")
        return None
    data["_manifest_url"] = source
    return data


def load_manifest_from_source(source: str) -> tuple[dict[str, Any] | None, str | None]:
    """Laedt Manifest von HTTP(S)-URL oder lokaler Datei."""
    src = (source or "").strip()
    if not src:
        return None, "empty_source"

    if src.lower().startswith("file://"):
        src = src[7:]
        if sys.platform == "win32" and src.startswith("/") and len(src) > 2 and src[2] == ":":
            src = src[1:]

    path = Path(src)
    if path.is_file() or (not src.lower().startswith("http") and path.exists()):
        try:
            text = path.read_text(encoding="utf-8-sig")
            data = _load_manifest_json_text(text, source=str(path.resolve()))
            return (data, None) if data else (None, "invalid_json")
        except OSError as exc:
            return None, f"file_read={type(exc).__name__}"

    if requests is None:
        return None, "requests_not_installed"

    try:
        r = requests.get(src, timeout=8.0)
        if r.status_code == 404:
            return None, f"http_status=404 url={src}"
        if r.status_code != 200:
            return None, f"http_status={r.status_code} url={src}"
        text = r.content.decode("utf-8-sig")
        data = _load_manifest_json_text(text, source=src)
        return (data, None) if data else (None, "invalid_json")
    except Exception as exc:
        return None, f"exc={type(exc).__name__} url={src}"


def fetch_startup_manifest(
    *,
    sources: list[str] | None = None,
) -> tuple[dict[str, Any] | None, str | None]:
    """Nur Update-Kanal — kein Fallback auf Installer-version.json."""
    last: str | None = None
    for source in sources or resolve_startup_manifest_sources():
        data, err = load_manifest_from_source(source)
        if data:
            return data, None
        last = err
        if err and "404" in err:
            _log_internal(f"Update manifest not available ({err})")
    return None, last or "no_manifest"


def _update_files_from_manifest(data: dict[str, Any]) -> list[dict[str, Any]]:
    files = data.get("files")
    if isinstance(files, list) and files:
        out: list[dict[str, Any]] = []
        for item in files:
            if isinstance(item, dict) and item.get("url"):
                out.append(dict(item))
        return out
    download_url = str(data.get("download_url") or "").strip()
    if download_url:
        return [
            {
                "name": Path(download_url).name or "aza_desktop_setup.exe",
                "url": download_url,
                "sha256": str(data.get("sha256") or "").strip(),
                "size_bytes": data.get("size_bytes"),
            }
        ]
    return []


def fetch_remote_manifest(
    *,
    timeout: float = 8.0,
    urls: tuple[str, ...] | None = None,
) -> tuple[dict[str, Any] | None, str | None]:
    """Laedt Manifest (inkl. Legacy-Installer-Endpunkte)."""
    last: str | None = None
    for url in urls or UPDATE_MANIFEST_URLS:
        data, err = load_manifest_from_source(url)
        if data:
            return data, None
        last = err
    return None, last or "no_manifest"


def check_update_from_manifest(manifest_source: str | Path) -> dict[str, Any]:
    """Prueft Update anhand eines expliziten Manifests (lokal oder URL)."""
    local = load_local_version()
    remote, err = load_manifest_from_source(str(manifest_source))
    if err or not remote:
        return {
            "status": "error",
            "message": "Manifest nicht lesbar.",
            "detail": err,
            "local": local,
        }
    return evaluate_update(local, remote)


def check_update_for_startup() -> dict[str, Any]:
    """
    Start-Updatepruefung fuer das schoene Startpanel.

    status:
      - manifest_unavailable  (404/kein Netz — still fuer Benutzer)
      - current
      - update_available
      - channel_mismatch
      - error
    """
    local = load_local_version()
    remote, err = fetch_startup_manifest()
    if err or not remote:
        silent = bool(
            err
            and (
                "404" in err
                or err in ("no_manifest", "requests_not_installed")
                or err.startswith("exc=")
            )
        )
        return {
            "status": "manifest_unavailable" if silent else "error",
            "message": "Update manifest not available" if silent else "Manifest nicht erreichbar.",
            "detail": err,
            "local": local,
        }
    result = evaluate_update(local, remote)
    result["detail"] = err
    return result


def validate_update_install_ready(result: dict[str, Any]) -> tuple[bool, str]:
    """Prueft alle Voraussetzungen vor einer Installation."""
    if result.get("status") != "update_available":
        return False, "Kein Update verfuegbar."

    files = result.get("files") or []
    if not files:
        return False, "Kein Update-Paket im Manifest."

    file_info = files[0]
    url = str(file_info.get("url") or "").strip()
    if not url:
        return False, "Download-URL fehlt."

    sha = str(file_info.get("sha256") or "").strip()
    if not sha:
        return False, "SHA256 fehlt im Manifest."

    latest = str(result.get("latest_version") or "").strip()
    if not latest:
        return False, "Versionsangabe fehlt."

    name = str(file_info.get("name") or Path(url).name or "").strip()
    if name.lower().endswith(".zip"):
        return True, "ok"
    if name.lower().endswith(".exe"):
        return True, "ok"
    return False, "Unbekanntes Update-Format."


def evaluate_update(
    local: dict[str, Any] | None = None,
    remote: dict[str, Any] | None = None,
) -> dict[str, Any]:
    """
    Vergleicht lokal vs. remote.

    status:
      - current
      - update_available
      - below_min_supported
      - channel_mismatch
      - error
    """
    loc = local or load_local_version()
    if remote is None:
        return {
            "status": "error",
            "message": "Kein Remote-Manifest",
            "local": loc,
        }

    local_ver = str(loc.get("version") or "").strip()
    local_build = str(loc.get("build") or "").strip()
    local_channel = str(loc.get("channel") or "stable").strip()

    remote_ver, remote_build, remote_channel = _remote_version_fields(remote)
    if remote_channel != local_channel:
        return {
            "status": "channel_mismatch",
            "message": f"Kanal lokal={local_channel}, remote={remote_channel}",
            "local": loc,
            "remote": remote,
        }

    min_req = _min_required(remote)
    below_min = bool(min_req and semver_gt(min_req, local_ver))
    newer_semver = semver_gt(remote_ver, local_ver)
    same_semver = semver_eq(remote_ver, local_ver)
    build_bump = bool(
        same_semver and remote_build and local_build and build_gt(remote_build, local_build)
    )
    client_ahead = semver_gt(local_ver, remote_ver)

    if client_ahead and not below_min:
        return {
            "status": "current",
            "message": "Lokal ist aktuell oder neuer.",
            "local": loc,
            "remote": remote,
        }

    if below_min or newer_semver or build_bump:
        files = _update_files_from_manifest(remote)
        return {
            "status": "update_available",
            "message": "Update verfuegbar.",
            "local": loc,
            "remote": remote,
            "latest_version": remote_ver,
            "latest_build": remote_build,
            "below_min_supported": below_min,
            "mandatory": bool(remote.get("mandatory")) or below_min,
            "notes": _normalize_notes(remote),
            "files": files,
            "manifest_url": remote.get("_manifest_url"),
        }

    return {
        "status": "current",
        "message": "Kein Update noetig.",
        "local": loc,
        "remote": remote,
    }


def compute_sha256(path: Path, *, chunk_size: int = 1024 * 1024) -> str:
    h = hashlib.sha256()
    with path.open("rb") as f:
        while True:
            chunk = f.read(chunk_size)
            if not chunk:
                break
            h.update(chunk)
    return h.hexdigest().upper()


def verify_sha256(path: Path, expected: str) -> bool:
    exp = str(expected or "").strip().upper()
    if not exp or not path.is_file():
        return False
    return compute_sha256(path) == exp


def _resolve_package_source(url: str) -> Path | None:
    src = (url or "").strip()
    if not src:
        return None
    if src.lower().startswith("file://"):
        src = src[7:]
        if sys.platform == "win32" and src.startswith("/") and len(src) > 2 and src[2] == ":":
            src = src[1:]
    path = Path(src)
    if path.is_file():
        return path.resolve()
    if not src.lower().startswith("http") and path.exists():
        return path.resolve()
    return None


def download_file(
    url: str,
    dest: Path,
    *,
    timeout: float = 120.0,
    progress: Callable[[int, int | None], None] | None = None,
) -> tuple[bool, str]:
    """Laedt eine Datei herunter. Keine Installation."""
    if requests is None:
        return False, "requests_not_installed"
    dest.parent.mkdir(parents=True, exist_ok=True)
    tmp = dest.with_suffix(dest.suffix + ".part")
    try:
        with requests.get(url, stream=True, timeout=timeout) as r:
            if r.status_code != 200:
                return False, f"http_status={r.status_code}"
            total = int(r.headers.get("Content-Length") or 0) or None
            done = 0
            with tmp.open("wb") as f:
                for chunk in r.iter_content(chunk_size=1024 * 256):
                    if not chunk:
                        continue
                    f.write(chunk)
                    done += len(chunk)
                    if progress:
                        progress(done, total)
        tmp.replace(dest)
        return True, "ok"
    except Exception as exc:
        try:
            if tmp.is_file():
                tmp.unlink()
        except OSError:
            pass
        return False, f"{type(exc).__name__}: {exc}"


def create_pre_update_backup(
    install_dir: Path | None = None,
    *,
    extra_names: tuple[str, ...] = (
        "aza_desktop.exe",
        "aza_controller.exe",
        "aza_office.exe",
        "aza_praxis_chat.exe",
        "aza_updater.exe",
        "AZA_EmpfangShell.exe",
        "version.json",
        "BUILD_INFO.txt",
    ),
) -> Path:
    """
    Sichert EXEs und version.json vor einem Update.
    Benutzerdaten in APPDATA werden nicht angetastet.
    """
    src = install_dir or get_install_dir()
    stamp = datetime.now().strftime("%Y%m%d_%H%M%S")
    backup_dir = get_update_backup_root() / stamp
    backup_dir.mkdir(parents=True, exist_ok=True)

    copied: list[str] = []
    names = list(extra_names) + ["app_marker.txt"]
    for name in names:
        p = src / name
        if p.is_file():
            shutil.copy2(p, backup_dir / name)
            copied.append(name)

    runtime = src / "runtime"
    if runtime.is_dir():
        shutil.copytree(runtime, backup_dir / "runtime", dirs_exist_ok=True)
        copied.append("runtime/")

    meta = {
        "created_at": datetime.now(timezone.utc).isoformat(),
        "install_dir": str(src),
        "copied": copied,
    }
    (backup_dir / "backup_meta.json").write_text(
        json.dumps(meta, indent=2, ensure_ascii=False) + "\n",
        encoding="utf-8",
    )
    return backup_dir


def rollback_from_backup(
    backup_dir: Path,
    install_dir: Path | None = None,
) -> tuple[bool, str]:
    """Stellt gesicherte Programmdateien wieder her."""
    if not backup_dir.is_dir():
        return False, "Backup-Ordner nicht gefunden."
    dst = install_dir or get_install_dir()
    restored: list[str] = []
    for item in backup_dir.iterdir():
        if item.name == "backup_meta.json":
            continue
        target = dst / item.name
        try:
            if item.is_dir():
                if target.exists():
                    shutil.rmtree(target)
                shutil.copytree(item, target)
            elif item.is_file():
                shutil.copy2(item, target)
            restored.append(item.name)
        except Exception as exc:
            return False, f"Rollback fehlgeschlagen bei {item.name}: {exc}"
    return True, f"Wiederhergestellt: {', '.join(restored)}"


def list_available_backups() -> list[Path]:
    root = get_update_backup_root()
    if not root.is_dir():
        return []
    dirs = [p for p in root.iterdir() if p.is_dir()]
    return sorted(dirs, reverse=True)


def extract_update_zip(zip_path: Path, target_dir: Path) -> tuple[bool, str]:
    """Entpackt ein Update-ZIP in das Installationsverzeichnis (ohne APPDATA)."""
    if not zip_path.is_file():
        return False, "ZIP nicht gefunden."
    try:
        with zipfile.ZipFile(zip_path, "r") as zf:
            for member in zf.namelist():
                if member.startswith("/") or ".." in Path(member).parts:
                    return False, f"Unsicherer ZIP-Eintrag: {member}"
            zf.extractall(target_dir)
        return True, "ok"
    except Exception as exc:
        return False, f"{type(exc).__name__}: {exc}"


def download_update_package(
    file_info: dict[str, Any],
    *,
    work_dir: Path | None = None,
    progress: Callable[[int, int | None], None] | None = None,
) -> tuple[Path | None, str]:
    """Laedt ein Update-Paket herunter und prueft SHA256."""
    url = str(file_info.get("url") or "").strip()
    if not url:
        return None, "Keine Download-URL."
    name = str(file_info.get("name") or Path(url).name or "aza_update.zip")
    base = work_dir or Path(tempfile.gettempdir()) / "aza_updates"
    base.mkdir(parents=True, exist_ok=True)
    dest = base / name
    local_src = _resolve_package_source(url)
    if local_src is not None:
        try:
            shutil.copy2(local_src, dest)
            ok, msg = True, "ok"
        except Exception as exc:
            return None, f"{type(exc).__name__}: {exc}"
    elif not url.lower().startswith("http"):
        return None, "Paket nicht gefunden."
    else:
        ok, msg = download_file(url, dest, progress=progress)
    if not ok:
        return None, msg
    expected = str(file_info.get("sha256") or "").strip()
    if not expected:
        return None, "SHA256 fehlt — Download abgebrochen."
    if not verify_sha256(dest, expected):
        try:
            dest.unlink()
        except OSError:
            pass
        return None, "SHA256 stimmt nicht ueberein — Download verworfen."
    return dest, "ok"