Drive OTA manifest bundle from a feature flag and rename endpoint to /native

Move the hardcoded per-platform bundle config into the native_ota_bundles
feature flag (JSON) so it can vary per environment and be set in tests.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aapeliv

app/backend/src/couchers/servicers/bugs.py

@@ -22,38 +22,12 @@
 
 _start_time = time.monotonic()
 
-# --- Hardcoded OTA manifest scaffolding (cut 1: validate protocol + transport) ---
-# These point at a real staging bundle staged with ota-stage.mjs and uploaded to
-# the CDN. They are filled in after that export; until then the client accepts the
-# manifest framing but the bundle download 404s (which still proves the endpoint).
-# Per-user selection, signing, and the release registry come later.
-_OTA_BASE_URL = "https://couchers-dev-assets.s3.amazonaws.com/ota/prod-test"
-
-# Per-platform hardcoded update. `id` must differ from the build's embedded update
-# id or the client no-ops; `runtimeVersion` is echoed from the request so the
-# fingerprint always matches during validation.
-_OTA_BUNDLES: dict[str, dict[str, Any]] = {
-    "ios": {
-        "id": "00000000-0000-0000-0000-000000000000",
-        "launch_asset": {"key": "PLACEHOLDER", "url": f"{_OTA_BASE_URL}/ios/bundle.hbc"},
-        "assets": [],
-    },
-    "android": {
-        "id": "00000000-0000-0000-0000-000000000000",
-        "launch_asset": {"key": "PLACEHOLDER", "url": f"{_OTA_BASE_URL}/android/bundle.hbc"},
-        "assets": [],
-    },
-}
-
-# Boundary baked into both the body and the content-type, matching ota-stage.mjs.
 _OTA_BOUNDARY = "COUCHERS_OTA_BOUNDARY"
 
 
 def _ota_multipart_body(field_name: str, content: dict[str, Any]) -> bytes:
-    # Protocol-v1 multipart/mixed: the `manifest` (or `directive`) part + an
-    # `extensions` part, with the exact CRLF framing the dev client verified
-    # on-device (ota-serve.mjs). field_name is "manifest" for an update or
-    # "directive" for a noUpdateAvailable/rollBackToEmbedded directive.
+    # Expo Updates protocol v1 multipart/mixed framing. field_name is "manifest" for
+    # an update or "directive" for a noUpdateAvailable/rollBackToEmbedded directive.
     def part(name: str, body: str, content_type: str) -> str:
         return (
             f"--{_OTA_BOUNDARY}\r\n"
@@ -149,17 +123,15 @@ def header(name: str) -> str:
             value = context.headers.get(name, "")
             return value.decode() if isinstance(value, bytes) else value
 
-        # The Expo Updates client requires these response headers or it rejects the
-        # manifest before fetching. Envoy forwards initial metadata as HTTP response
-        # headers (same path as set-cookie).
+        # Expo rejects the manifest without these; Envoy forwards them as HTTP response headers.
         context.set_response_headers([("expo-protocol-version", "1"), ("expo-sfv-version", "0")])
 
         platform = header("expo-platform") or "ios"
         runtime_version = header("expo-runtime-version")
 
-        bundle = _OTA_BUNDLES.get(platform)
+        bundles: dict[str, Any] = context.get_object_value("native_ota_bundles", {})
+        bundle = bundles.get(platform)
         if bundle is None or runtime_version == "":
-            # Unknown platform or no fingerprint: tell the client to keep its bundle.
             directive = {"type": "noUpdateAvailable"}
             return httpbody_pb2.HttpBody(
                 content_type=f"multipart/mixed; boundary={_OTA_BOUNDARY}",
@@ -175,7 +147,7 @@ def header(name: str) -> str:
                 "contentType": "application/javascript",
                 "url": bundle["launch_asset"]["url"],
             },
-            "assets": bundle["assets"],
+            "assets": bundle.get("assets", []),
             "metadata": {},
             "extra": {"expoClient": {}},
         }

app/backend/src/tests/test_bugs.py

@@ -403,7 +403,22 @@ def _multipart_part_json(body, name):
     return json.loads(body[start:end])
 
 
-def test_mobile_update_manifest(db):
+_OTA_BUNDLES = {
+    "ios": {
+        "id": "00000000-0000-0000-0000-000000000000",
+        "launch_asset": {"key": "ios-key", "url": "https://cdn.example/ios/bundle.hbc"},
+        "assets": [],
+    },
+    "android": {
+        "id": "00000000-0000-0000-0000-000000000000",
+        "launch_asset": {"key": "android-key", "url": "https://cdn.example/android/bundle.hbc"},
+        "assets": [],
+    },
+}
+
+
+def test_mobile_update_manifest(db, feature_flags):
+    feature_flags.set("native_ota_bundles", _OTA_BUNDLES)
     with real_bugs_session() as (bugs, metadata_interceptor):
         res = bugs.GetMobileUpdateManifest(
             httpbody_pb2.HttpBody(),
@@ -425,7 +440,8 @@ def test_mobile_update_manifest(db):
     assert metadata_interceptor.latest_headers["expo-sfv-version"] == "0"
 
 
-def test_mobile_update_manifest_android(db):
+def test_mobile_update_manifest_android(db, feature_flags):
+    feature_flags.set("native_ota_bundles", _OTA_BUNDLES)
     with real_bugs_session() as (bugs, _metadata_interceptor):
         res = bugs.GetMobileUpdateManifest(
             httpbody_pb2.HttpBody(),

app/proto/bugs.proto

@@ -41,7 +41,7 @@ service Bugs {
   rpc GetMobileUpdateManifest(google.api.HttpBody) returns (google.api.HttpBody) {
     // Serves the Expo Updates protocol (v1) manifest for the mobile app
     option (google.api.http) = {
-      get : "/mobile/ota/manifest"
+      get : "/native/ota/manifest"
     };
   }
 

docs/native-prod-ota.md

@@ -125,12 +125,12 @@ metadata.** `CouchersContext.set_response_headers([...])` queues the headers and
 `_send_cookies()` emits them alongside cookies in the single
 `send_initial_metadata` call (`context.py`). Envoy forwards this initial metadata
 downstream as HTTP response headers — confirmed by curling
-`/mobile/ota/manifest` through the local proxy: the response carries
+`/native/ota/manifest` through the local proxy: the response carries
 `expo-protocol-version: 1` and `expo-sfv-version: 0` (same mechanism that already
 delivers `set-cookie`).
 
 > **Note — the route-scoped Envoy approach does NOT work here.** A `match: { path:
-> "/mobile/ota/manifest" }` route with `response_headers_to_add` never matches,
+> "/native/ota/manifest" }` route with `response_headers_to_add` never matches,
 > because `grpc_json_transcoder` rewrites the request `:path` to the gRPC method
 > path (`/org.couchers.bugs.Bugs/GetMobileUpdateManifest`) *before* route
 > selection, so the request falls through to the catch-all `prefix: "/"` route.
@@ -143,7 +143,7 @@ delivers `set-cookie`).
 
 ```
                  cold start / periodic
-  ┌───────────┐  GET /mobile/ota/manifest        ┌──────────────────────────┐
+  ┌───────────┐  GET /native/ota/manifest        ┌──────────────────────────┐
   │  prod app │ ───────────────────────────────► │ Envoy (grpc_json_         │
   │ expo-     │   headers:                        │ transcoder, auto_mapping) │
   │ updates   │     expo-runtime-version          └────────────┬─────────────┘
@@ -228,7 +228,7 @@ and already Envoy-allowlisted):
 import "google/api/httpbody.proto";
 
 rpc GetMobileUpdateManifest(google.api.HttpBody) returns (google.api.HttpBody) {
-  option (google.api.http) = { get : "/mobile/ota/manifest" };
+  option (google.api.http) = { get : "/native/ota/manifest" };
 }
 ```
 
@@ -397,8 +397,8 @@ In `app.config.js`, **production (and staging) variants** — currently
 `updates = { url: "https://u.expo.dev/fb4fc9aa-…" }`:
 
 - Set `updates.url` to the backend endpoint, e.g.
-  `https://api.couchers.org/mobile/ota/manifest` (staging →
-  `https://dev-api.couchershq.org/mobile/ota/manifest`).
+  `https://api.couchers.org/native/ota/manifest` (staging →
+  `https://dev-api.couchershq.org/native/ota/manifest`).
 - Add `updates.codeSigningCertificate` (committed public PEM) +
   `updates.codeSigningMetadata` (§7).
 - **Do NOT** set `disableAntiBrickingMeasures` — we keep anti-bricking (§2).