src/plugin/plugin_installer.cpp

/*
 * Copyright (c) 2025 Huawei Device Co., Ltd.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include "plugin_installer.h"

#include <fcntl.h>

#include "app_log_tag_wrapper.h"
#include "app_provision_info_manager.h"
#include "bundle_mgr_service.h"
#include "bundle_util.h"
#include "hitrace_meter.h"
#include "installd_client.h"
#include "ipc_skeleton.h"
#include "json_util.h"
#include "scope_guard.h"

namespace OHOS {
namespace AppExecFwk {
using namespace OHOS::Security;
namespace {
constexpr const char* COMPILE_SDK_TYPE_OPEN_HARMONY = "OpenHarmony";
constexpr const char* DEBUG_APP_IDENTIFIER = "DEBUG_LIB_ID";
constexpr const char* PLUGINS = "plugins";
constexpr const char* LIBS_TMP = "libs_tmp";
constexpr const char* PERMISSION_KEY = "ohos.permission.kernel.SUPPORT_PLUGIN";
constexpr const char* PLUGIN_ID = "pluginDistributionIDs";
constexpr const char* PLUGIN_ID_SEPARATOR = "|";
constexpr const char* REMOVE_TMP_SUFFIX = "_removed";
}

PluginInstaller::PluginInstaller()
    : bundleInstallChecker_(std::make_unique<BundleInstallChecker>())
{
    APP_LOGD("create PluginInstaller instance");
}

PluginInstaller::~PluginInstaller()
{
    APP_LOGD("destroy PluginInstaller instance");
    BundleUtil::DeleteTempDirs(toDeleteTempHspPath_);
    toDeleteTempHspPath_.clear();
}

ErrCode PluginInstaller::InstallPlugin(const std::string &hostBundleName,
    const std::vector<std::string> &pluginFilePaths, const InstallPluginParam &installPluginParam)
{
    HITRACE_METER_NAME(HITRACE_TAG_APP, __PRETTY_FUNCTION__);
    LOG_NOFUNC_I(BMS_TAG_INSTALLER, "begin to install plugin");

    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (!dataMgr) {
        APP_LOGE("Get dataMgr shared_ptr nullptr");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    // check userId
    if (installPluginParam.userId < Constants::DEFAULT_USERID) {
        APP_LOGE("userId(%{public}d) invalid", installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    if (!dataMgr->HasUserId(installPluginParam.userId)) {
        APP_LOGE("user %{public}d not exist", installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    auto &mtx = dataMgr->GetBundleMutex(hostBundleName);
    std::lock_guard lock {mtx};
    // check host application exist in userId
    InnerBundleInfo hostBundleInfo;
    if (!dataMgr->FetchInnerBundleInfo(hostBundleName, hostBundleInfo)) {
        APP_LOGE("hostBundleName:%{public}s get bundle info failed", hostBundleName.c_str());
        return ERR_APPEXECFWK_HOST_APPLICATION_NOT_FOUND;
    }
    if (!hostBundleInfo.HasInnerBundleUserInfo(installPluginParam.userId)) {
        APP_LOGE("HostBundleName: %{public}s not installed in user %{public}d",
            hostBundleName.c_str(), installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    // check host application permission
    ErrCode result = ERR_OK;
    result = CheckSupportPluginPermission(hostBundleInfo);
    CHECK_RESULT(result, "check host application permission failed %{public}d");
    userId_ = installPluginParam.userId;
    // parse hsp file
    result = ParseFiles(pluginFilePaths, installPluginParam);
    CHECK_RESULT(result, "parse file failed %{public}d");
    bundleNameWithTime_ = bundleName_ + "." + std::to_string(BundleUtil::GetCurrentTimeNs());
    // check host application and plugin
    result = CheckPluginId(hostBundleName);
    CHECK_RESULT(result, "check pluginId failed %{public}d");

    result = ProcessPluginInstall(hostBundleInfo);
    CHECK_RESULT(result, "process plugin install failed %{public}d");

    LOG_NOFUNC_I(BMS_TAG_INSTALLER, "install plugin finished");
    return ERR_OK;
}

ErrCode PluginInstaller::UninstallPlugin(const std::string &hostBundleName, const std::string &pluginBundleName,
    const InstallPluginParam &installPluginParam)
{
    HITRACE_METER_NAME(HITRACE_TAG_APP, __PRETTY_FUNCTION__);
    LOG_NOFUNC_I(BMS_TAG_INSTALLER, "begin to uninstall plugin");

    ErrCode result = ERR_OK;
    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (!dataMgr) {
        APP_LOGE("Get dataMgr shared_ptr nullptr");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    // check userId
    if (installPluginParam.userId < Constants::DEFAULT_USERID) {
        APP_LOGE("userId(%{public}d) invalid", installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    if (!dataMgr->HasUserId(installPluginParam.userId)) {
        APP_LOGE("user %{public}d not exist", installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    auto &mtx = dataMgr->GetBundleMutex(hostBundleName);
    std::lock_guard lock {mtx};
    // check host application exist in userId
    InnerBundleInfo hostBundleInfo;
    if (!dataMgr->FetchInnerBundleInfo(hostBundleName, hostBundleInfo)) {
        APP_LOGE("hostBundleName:%{public}s get bundle info failed", hostBundleName.c_str());
        return ERR_APPEXECFWK_HOST_APPLICATION_NOT_FOUND;
    }
    if (!hostBundleInfo.HasInnerBundleUserInfo(installPluginParam.userId)) {
        APP_LOGE("HostBundleName: %{public}s not installed in user %{public}d",
            hostBundleName.c_str(), installPluginParam.userId);
        return ERR_APPEXECFWK_USER_NOT_EXIST;
    }
    // check plugin exist in host application
    isPluginExist_ = dataMgr->GetPluginBundleInfo(hostBundleName, pluginBundleName,
        oldPluginInfo_, installPluginParam.userId);
    if (!isPluginExist_) {
        APP_LOGE("plugin: %{public}s not installed in host application:%{public}s user %{public}d",
            pluginBundleName.c_str(), hostBundleName.c_str(), installPluginParam.userId);
        return ERR_APPEXECFWK_PLUGIN_NOT_FOUND;
    }
    userId_ = installPluginParam.userId;
    bundleName_ = pluginBundleName;
    result = ProcessPluginUninstall(hostBundleInfo);
    CHECK_RESULT(result, "process plugin install failed %{public}d");

    LOG_NOFUNC_I(BMS_TAG_INSTALLER, "uninstall plugin finish");
    return ERR_OK;
}

ErrCode PluginInstaller::ParseFiles(const std::vector<std::string> &pluginFilePaths,
    const InstallPluginParam &installPluginParam)
{
    APP_LOGD("parsing plugin bundle files, path : %{private}s",
        GetJsonStrFromInfo(pluginFilePaths).c_str());
    ErrCode result = ERR_OK;

    // check file paths
    std::vector<std::string> inBundlePaths;
    result = BundleUtil::CheckFilePath(pluginFilePaths, inBundlePaths);
    CHECK_RESULT(result, "hsp files check failed %{public}d");

    // copy the haps to the dir which cannot be accessed from caller
    result = CopyHspToSecurityDir(inBundlePaths, installPluginParam);
    CHECK_RESULT(result, "copy file failed %{public}d");

    // check number and type of the hsp and sig files
    std::vector<std::string> bundlePaths;
    result = ObtainHspFileAndSignatureFilePath(inBundlePaths, bundlePaths, signatureFileDir_);
    CHECK_RESULT(result, "obtain hsp file path or signature file path failed due to %{public}d");

    // check syscap
    result = bundleInstallChecker_->CheckSysCap(bundlePaths);
    bool isSysCapValid = (result == ERR_OK);
    if (!isSysCapValid) {
        APP_LOGI("hap syscap check failed %{public}d", result);
    }
    // verify signature info for all haps
    std::vector<Security::Verify::HapVerifyResult> hapVerifyResults;
    result = bundleInstallChecker_->CheckMultipleHapsSignInfo(bundlePaths, hapVerifyResults);
    CHECK_RESULT(result, "hap files check signature info failed %{public}d");

    // parse bundle infos
    InstallCheckParam checkParam;
    checkParam.needSendEvent = false;
    result = bundleInstallChecker_->ParseHapFiles(bundlePaths, checkParam, hapVerifyResults, parsedBundles_);
    if (result != ERR_OK) {
        APP_LOGE("parse haps file failed %{public}d", result);
        return ERR_APPEXECFWK_PLUGIN_PARSER_ERROR;
    }
    // check install permission
    result = bundleInstallChecker_->CheckInstallPermission(checkParam, hapVerifyResults);
    CHECK_RESULT(result, "check install permission failed %{public}d");

    // check hsp install condition
    result = bundleInstallChecker_->CheckHspInstallCondition(hapVerifyResults);
    CHECK_RESULT(result, "check hsp install condition failed %{public}d");

    // check device type
    if (!isSysCapValid) {
        result = bundleInstallChecker_->CheckDeviceType(parsedBundles_);
        if (result != ERR_OK) {
            APP_LOGE("check device type failed %{public}d", result);
            return ERR_APPEXECFWK_INSTALL_SYSCAP_FAILED_AND_DEVICE_TYPE_ERROR;
        }
    }

    // check label info
    result = CheckPluginAppLabelInfo();
    CHECK_RESULT(result, "check plugin label info failed %{public}d");

    // delivery sign profile to code signature
    result = DeliveryProfileToCodeSign(hapVerifyResults);
    CHECK_RESULT(result, "delivery sign profile failed %{public}d");

    // check native file
    result = bundleInstallChecker_->CheckMultiNativeFile(parsedBundles_);
    CHECK_RESULT(result, "native so is incompatible in all haps %{public}d");

    // check enterprise bundle
    /* At this place, hapVerifyResults cannot be empty and unnecessary to check it */
    isEnterpriseBundle_ = bundleInstallChecker_->CheckEnterpriseBundle(hapVerifyResults[0]);
    appIdentifier_ = (hapVerifyResults[0].GetProvisionInfo().type == Security::Verify::ProvisionType::DEBUG) ?
        DEBUG_APP_IDENTIFIER : hapVerifyResults[0].GetProvisionInfo().bundleInfo.appIdentifier;
    compileSdkType_ = parsedBundles_.empty() ? COMPILE_SDK_TYPE_OPEN_HARMONY :
        (parsedBundles_.begin()->second).GetBaseApplicationInfo().compileSdkType;
    if (!ParsePluginId(hapVerifyResults[0].GetProvisionInfo().appServiceCapabilities, pluginIds_)) {
        APP_LOGE("parse plugin id failed");
        return ERR_APPEXECFWK_PLUGIN_INSTALL_PARSE_PLUGINID_ERROR;
    }
    return result;
}

ErrCode PluginInstaller::MkdirIfNotExist(const std::string &dir)
{
    bool isDirExist = false;
    ErrCode result = InstalldClient::GetInstance()->IsExistDir(dir, isDirExist);
    CHECK_RESULT(result, "check if dir exist failed %{public}d");
    if (!isDirExist) {
        result = InstalldClient::GetInstance()->CreateBundleDir(dir);
        CHECK_RESULT(result, "create dir failed %{public}d");
    }
    return result;
}

ErrCode PluginInstaller::CopyHspToSecurityDir(std::vector<std::string> &bundlePaths,
    const InstallPluginParam &installPluginParam)
{
    for (size_t index = 0; index < bundlePaths.size(); ++index) {
        auto destination = BundleUtil::CopyFileToSecurityDir(bundlePaths[index], DirType::STREAM_INSTALL_DIR,
            toDeleteTempHspPath_, installPluginParam.IsRenameInstall());
        if (destination.empty()) {
            APP_LOGE("copy file %{public}s to security dir failed", bundlePaths[index].c_str());
            return ERR_APPEXECFWK_INSTALL_COPY_HAP_FAILED;
        }
        bundlePaths[index] = destination;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::ObtainHspFileAndSignatureFilePath(const std::vector<std::string> &inBundlePaths,
    std::vector<std::string> &bundlePaths, std::string &signatureFilePath)
{
    if (inBundlePaths.empty()) {
        APP_LOGE("number of files in single shared lib path is illegal");
        return ERR_APPEXECFWK_INSTALL_FILE_PATH_INVALID;
    }
    if (inBundlePaths.size() == 1) {
        if (!BundleUtil::EndWith(inBundlePaths[0], ServiceConstants::HSP_FILE_SUFFIX)) {
            APP_LOGE("invalid file in plugin bundle dir");
            return ERR_APPEXECFWK_INSTALL_FILE_PATH_INVALID;
        }
        bundlePaths.emplace_back(inBundlePaths[0]);
        return ERR_OK;
    }
    int32_t numberOfHsp = 0;
    int32_t numberOfSignatureFile = 0;
    for (const auto &path : inBundlePaths) {
        if ((path.find(ServiceConstants::HSP_FILE_SUFFIX) == std::string::npos) &&
            (path.find(ServiceConstants::CODE_SIGNATURE_FILE_SUFFIX) == std::string::npos)) {
            APP_LOGE("only hsp or sig file can be contained in shared bundle dir");
            return ERR_APPEXECFWK_INSTALL_FILE_PATH_INVALID;
        }
        if (BundleUtil::EndWith(path, ServiceConstants::HSP_FILE_SUFFIX)) {
            numberOfHsp++;
            bundlePaths.emplace_back(path);
        }
        if (BundleUtil::EndWith(path, ServiceConstants::CODE_SIGNATURE_FILE_SUFFIX)) {
            numberOfSignatureFile++;
            signatureFilePath = path;
        }
    }
    APP_LOGD("signatureFilePath is %{public}s", signatureFilePath.c_str());
    return ERR_OK;
}

ErrCode PluginInstaller::ProcessNativeLibrary(
    const std::string &bundlePath,
    const std::string &moduleDir,
    const std::string &moduleName,
    const std::string &pluginBundleDir,
    InnerBundleInfo &newInfo)
{
    std::string cpuAbi;
    if (!newInfo.FetchNativeSoAttrs(moduleName, cpuAbi, nativeLibraryPath_)) {
        return ERR_OK;
    }
    isCompressNativeLibs_ = newInfo.IsCompressNativeLibs(moduleName);
    if (isCompressNativeLibs_) {
        if (nativeLibraryPath_.empty()) {
            APP_LOGW("nativeLibraryPath is empty");
            return ERR_OK;
        }
        std::string soPath = pluginBundleDir + ServiceConstants::PATH_SEPARATOR + nativeLibraryPath_;
        APP_LOGD("tempSoPath=%{public}s,cpuAbi=%{public}s, bundlePath=%{public}s",
            soPath.c_str(), cpuAbi.c_str(), bundlePath.c_str());

        auto result = InstalldClient::GetInstance()->ExtractModuleFiles(bundlePath, moduleDir, soPath, cpuAbi);
        CHECK_RESULT(result, "extract module files failed %{public}d");
        // verify hap or hsp code signature for compressed so files
        result = VerifyCodeSignatureForNativeFiles(
            bundlePath, cpuAbi, soPath, signatureFileDir_, newInfo.IsPreInstallApp());
        CHECK_RESULT(result, "fail to VerifyCodeSignature, error is %{public}d");
        cpuAbi_ = cpuAbi;
        soPath_ = soPath;
    } else {
        std::vector<std::string> fileNames;
        auto result = InstalldClient::GetInstance()->GetNativeLibraryFileNames(bundlePath, cpuAbi, fileNames);
        CHECK_RESULT(result, "fail to GetNativeLibraryFileNames, error is %{public}d");
        newInfo.SetNativeLibraryFileNames(moduleName, fileNames);
    }
    return ERR_OK;
}

ErrCode PluginInstaller::VerifyCodeSignatureForNativeFiles(const std::string &bundlePath,
    const std::string &cpuAbi, const std::string &targetSoPath, const std::string &signatureFileDir,
    bool isPreInstalledBundle) const
{
    if (!isPreInstalledBundle) {
        APP_LOGD("not pre-install app, skip verify code signature for native files");
        return ERR_OK;
    }
    APP_LOGD("begin to verify code signature for hsp native files");
    bool isCompileSdkOpenHarmony = (compileSdkType_ == COMPILE_SDK_TYPE_OPEN_HARMONY);
    CodeSignatureParam codeSignatureParam;
    codeSignatureParam.modulePath = bundlePath;
    codeSignatureParam.cpuAbi = cpuAbi;
    codeSignatureParam.targetSoPath = targetSoPath;
    codeSignatureParam.signatureFileDir = signatureFileDir;
    codeSignatureParam.isEnterpriseBundle = isEnterpriseBundle_;
    codeSignatureParam.appIdentifier = appIdentifier_;
    codeSignatureParam.isCompileSdkOpenHarmony = isCompileSdkOpenHarmony;
    codeSignatureParam.isPreInstalledBundle = isPreInstalledBundle;
    codeSignatureParam.isCompressNativeLibrary = isCompressNativeLibs_;
    if (InstalldClient::GetInstance()->VerifyCodeSignature(codeSignatureParam) != ERR_OK) {
        return ERR_BUNDLEMANAGER_INSTALL_CODE_SIGNATURE_FAILED;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::VerifyCodeSignatureForHsp(const std::string &hspPath,
    const std::string &appIdentifier, bool isEnterpriseBundle, bool isCompileSdkOpenHarmony) const
{
    APP_LOGD("begin to verify code signature for hsp");
    CodeSignatureParam codeSignatureParam;
    codeSignatureParam.modulePath = hspPath;
    codeSignatureParam.cpuAbi = cpuAbi_;
    codeSignatureParam.targetSoPath = soPath_;
    codeSignatureParam.appIdentifier = appIdentifier;
    codeSignatureParam.signatureFileDir = signatureFileDir_;
    codeSignatureParam.isEnterpriseBundle = isEnterpriseBundle;
    codeSignatureParam.isCompileSdkOpenHarmony = isCompileSdkOpenHarmony;
    codeSignatureParam.isPreInstalledBundle = false;
    if (InstalldClient::GetInstance()->VerifyCodeSignatureForHap(codeSignatureParam) != ERR_OK) {
        return ERR_BUNDLEMANAGER_INSTALL_CODE_SIGNATURE_FAILED;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::DeliveryProfileToCodeSign(
    std::vector<Security::Verify::HapVerifyResult> &hapVerifyResults) const
{
    if (hapVerifyResults.empty()) {
        APP_LOGE("no sign info in the all haps");
        return ERR_APPEXECFWK_INSTALL_FAILED_INCOMPATIBLE_SIGNATURE;
    }

    Security::Verify::ProvisionInfo provisionInfo = hapVerifyResults[0].GetProvisionInfo();
    if (provisionInfo.distributionType == Security::Verify::AppDistType::ENTERPRISE ||
        provisionInfo.distributionType == Security::Verify::AppDistType::ENTERPRISE_NORMAL ||
        provisionInfo.distributionType == Security::Verify::AppDistType::ENTERPRISE_MDM ||
        provisionInfo.type == Security::Verify::ProvisionType::DEBUG) {
        if (provisionInfo.profileBlockLength == 0 || provisionInfo.profileBlock == nullptr) {
            APP_LOGE("invalid sign profile");
            return ERR_APPEXECFWK_INSTALL_FAILED_INCOMPATIBLE_SIGNATURE;
        }
        return InstalldClient::GetInstance()->DeliverySignProfile(provisionInfo.bundleInfo.bundleName,
            provisionInfo.profileBlockLength, provisionInfo.profileBlock.get());
    }
    return ERR_OK;
}

ErrCode PluginInstaller::CheckPluginId(const std::string &hostBundleName)
{
    if (pluginIds_.empty()) {
        APP_LOGE("plugin id is empty");
        return ERR_APPEXECFWK_PLUGIN_INSTALL_CHECK_PLUGINID_ERROR;
    }
    auto appProvisionInfoMgr = DelayedSingleton<AppProvisionInfoManager>::GetInstance();
    if (!appProvisionInfoMgr) {
        APP_LOGE("appProvisionInfoMgr is nullptr");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    AppProvisionInfo hostAppProvisionInfo;
    if (!appProvisionInfoMgr->GetAppProvisionInfo(hostBundleName, hostAppProvisionInfo)) {
        APP_LOGW("bundleName:%{public}s GetAppProvisionInfo failed", hostBundleName.c_str());
        return ERR_BUNDLE_MANAGER_INTERNAL_ERROR;
    }
    std::vector<std::string> hostPluginIds;
    if (!ParsePluginId(hostAppProvisionInfo.appServiceCapabilities, hostPluginIds)) {
        APP_LOGE("parse host application plugin id failed");
        return ERR_APPEXECFWK_PLUGIN_INSTALL_PARSE_PLUGINID_ERROR;
    }
    if (hostPluginIds.empty()) {
        APP_LOGE("host application plugin id is empty");
        return ERR_APPEXECFWK_PLUGIN_INSTALL_CHECK_PLUGINID_ERROR;
    }
    std::unordered_set<std::string> pluginIdSet(hostPluginIds.begin(), hostPluginIds.end());
    for (const auto &item : pluginIds_) {
        if (pluginIdSet.find(item) != pluginIdSet.end()) {
            return ERR_OK;
        }
    }
    APP_LOGD("check plugin id success");
    return ERR_APPEXECFWK_PLUGIN_INSTALL_CHECK_PLUGINID_ERROR;
}

bool PluginInstaller::ParsePluginId(const std::string &appServiceCapabilities,
    std::vector<std::string> &pluginIds)
{
    if (appServiceCapabilities.empty()) {
        APP_LOGE("appServiceCapabilities is empty");
        return false;
    }
    auto appServiceCapabilityMap = BundleUtil::ParseMapFromJson(appServiceCapabilities);
    for (auto &item : appServiceCapabilityMap) {
        if (item.first == PERMISSION_KEY) {
            auto pluginIdMap = BundleUtil::ParseMapFromJson(item.second);
            if (pluginIdMap.find(PLUGIN_ID) == pluginIdMap.end()) {
                APP_LOGE("pluginDistributionIDs not found in appServiceCapability");
                return false;
            }
            OHOS::SplitStr(pluginIdMap.at(PLUGIN_ID), PLUGIN_ID_SEPARATOR, pluginIds);
            return true;
        }
    }
    APP_LOGE("support plugin permission not found in appServiceCapability");
    return false;
}

ErrCode PluginInstaller::CheckSupportPluginPermission(const InnerBundleInfo &hostBundleInfo)
{
    std::vector<RequestPermission> reqPermissions = hostBundleInfo.GetAllRequestPermissions();
    auto it = std::find_if(reqPermissions.begin(), reqPermissions.end(), [](const RequestPermission &permission) {
        return permission.name == ServiceConstants::PERMISSION_SUPPORT_PLUGIN;
    });
    if (it == reqPermissions.end()) {
        APP_LOGE("bundleName:%{public}s check support permission failed", hostBundleInfo.GetBundleName().c_str());
        return ERR_APPEXECFWK_SUPPORT_PLUGIN_PERMISSION_ERROR;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::CheckPluginAppLabelInfo()
{
    if (parsedBundles_.empty()) {
        APP_LOGE("parsedBundles is empty");
        return ERR_OK;
    }
    bundleName_ = parsedBundles_.begin()->second.GetBundleName();

    ErrCode ret = bundleInstallChecker_->CheckAppLabelInfo(parsedBundles_);
    if (ret != ERR_OK) {
        APP_LOGE("check plugin app label info failed");
        return ERR_APPEXECFWK_PLUGIN_CHECK_APP_LABEL_ERROR;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::ProcessPluginInstall(const InnerBundleInfo &hostBundleInfo)
{
    if (parsedBundles_.empty()) {
        APP_LOGD("no bundle to install");
        return ERR_OK;
    }
    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (!dataMgr) {
        APP_LOGE("Get dataMgr shared_ptr nullptr");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    ErrCode result = ERR_OK;
    std::string pluginDir;
    result = CheckPluginDir(hostBundleInfo.GetBundleName(), pluginDir);
    CHECK_RESULT(result, "plugin dir check failed %{public}d");
    isPluginExist_ = dataMgr->GetPluginBundleInfo(hostBundleInfo.GetBundleName(), bundleName_, oldPluginInfo_);
    if (isPluginExist_) {
        if (!CheckAppIdentifier()) {
            return ERR_APPEXECFWK_INSTALL_FAILED_INCONSISTENT_SIGNATURE;
        }
        if (!CheckVersionCodeForUpdate()) {
            return ERR_APPEXECFWK_INSTALL_VERSION_DOWNGRADE;
        }
    }
    ScopeGuard deleteDirGuard([&] { RemovePluginDir(hostBundleInfo);});
    for (auto &item : parsedBundles_) {
        result = ExtractPluginBundles(item.first, item.second, pluginDir);
        CHECK_RESULT(result, "extract plugin bundles failed %{public}d");
    }

    ScopeGuard dataRollBackGuard([&] { PluginRollBack(hostBundleInfo);});
    InnerBundleInfo pluginInfo;
    MergePluginBundleInfo(pluginInfo);
    result = SavePluginInfoToStorage(pluginInfo, hostBundleInfo);
    CHECK_RESULT(result, "save plugin info to storage failed %{public}d");

    RemoveEmptyDirs(pluginDir);
    RemoveOldInstallDir();
    deleteDirGuard.Dismiss();
    dataRollBackGuard.Dismiss();
    APP_LOGD("install plugin bundle successfully: %{public}s", bundleName_.c_str());
    return result;
}

ErrCode PluginInstaller::CheckPluginDir(const std::string &hostBundleName, std::string &pluginDir)
{
    ErrCode result = ERR_OK;
    std::string bundleDir = std::string(Constants::BUNDLE_CODE_DIR) + ServiceConstants::PATH_SEPARATOR + hostBundleName;
    result = MkdirIfNotExist(bundleDir);
    CHECK_RESULT(result, "check bundle dir failed %{public}d");

    pluginDir = bundleDir + ServiceConstants::PATH_SEPARATOR + PLUGINS;
    result = MkdirIfNotExist(pluginDir);
    CHECK_RESULT(result, "check plugin dir failed %{public}d");

    return result;
}

bool PluginInstaller::CheckAppIdentifier() const
{
    auto &newInfo = parsedBundles_.begin()->second;
    if (!newInfo.GetAppIdentifier().empty() &&
        !oldPluginInfo_.appIdentifier.empty() &&
        newInfo.GetAppIdentifier() == oldPluginInfo_.appIdentifier) {
        return true;
    }
    if (oldPluginInfo_.appId == newInfo.GetAppId()) {
        return true;
    }
    APP_LOGE("the appIdentifier or appId of the new bundle is not the same as old one");
    return false;
}

bool PluginInstaller::CheckVersionCodeForUpdate() const
{
    auto &newInfo = parsedBundles_.begin()->second;
    if (newInfo.GetVersionCode() < oldPluginInfo_.versionCode) {
        APP_LOGE("fail to update lower version plugin");
        return false;
    }
    return true;
}

ErrCode PluginInstaller::ExtractPluginBundles(const std::string &bundlePath, InnerBundleInfo &newInfo,
    const std::string &pluginDir)
{
    ErrCode result = ERR_OK;
    std::string pluginBundleDir = pluginDir + ServiceConstants::PATH_SEPARATOR + bundleNameWithTime_;  // pass pluginDir
    result = MkdirIfNotExist(pluginBundleDir);
    CHECK_RESULT(result, "check plugin bundle dir failed %{public}d");
    newInfo.SetAppCodePath(pluginBundleDir);

    auto &moduleName = newInfo.GetInnerModuleInfos().begin()->second.moduleName;
    std::string moduleDir = pluginBundleDir + ServiceConstants::PATH_SEPARATOR + moduleName;
    result = MkdirIfNotExist(moduleDir);
    CHECK_RESULT(result, "check module dir failed %{public}d");

    result = ProcessNativeLibrary(bundlePath, moduleDir, moduleName, pluginBundleDir, newInfo);
    CHECK_RESULT(result, "ProcessNativeLibrary failed %{public}d");

    // save hsp and so files to installation dir
    result = SaveHspToInstallDir(bundlePath, pluginBundleDir, moduleName, newInfo);
    CHECK_RESULT(result, "save hsp file failed %{public}d");

    newInfo.AddModuleSrcDir(moduleDir);
    newInfo.AddModuleResPath(moduleDir);
    return ERR_OK;
}

void PluginInstaller::MergePluginBundleInfo(InnerBundleInfo &pluginBundleInfo)
{
    auto iter = parsedBundles_.begin();
    pluginBundleInfo = iter->second;
    InnerBundleUserInfo newInnerBundleUserInfo;
    newInnerBundleUserInfo.bundleName = bundleName_;
    newInnerBundleUserInfo.bundleUserInfo.userId = userId_;
    pluginBundleInfo.AddInnerBundleUserInfo(newInnerBundleUserInfo);
    iter++;

    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (dataMgr == nullptr) {
        APP_LOGE("Get dataMgr shared_ptr nullptr");
        return;
    }
    for (; iter != parsedBundles_.end(); ++iter) {
        InnerBundleInfo &currentInfo = iter->second;
        dataMgr->AddNewModuleInfo(currentInfo, pluginBundleInfo);
    }
}

ErrCode PluginInstaller::SavePluginInfoToStorage(const InnerBundleInfo &pluginInfo,
    const InnerBundleInfo &hostBundleInfo)
{
    ErrCode result = ERR_OK;
    PluginBundleInfo pluginBundleInfo;
    pluginInfo.GetPluginBundleInfo(bundleNameWithTime_, pluginBundleInfo);

    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (dataMgr == nullptr) {
        APP_LOGE("get dataMgr failed");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    if (isPluginExist_) {
        hostBundleInfo.GetPluginInstalledUser(bundleName_, hasInstalledUsers_);
    }
    std::unordered_set<int32_t> userIds(hasInstalledUsers_);
    userIds.insert(userId_);
    for (const auto &userId : userIds) {
        result = dataMgr->AddPluginInfo(hostBundleInfo, pluginBundleInfo, userId);
        if (result != ERR_OK) {
            APP_LOGE("save pluginInfo to storage failed %{public}d, userId:%{public}d",
                result, userId);
            return result;
        }
    }
    APP_LOGI("save pluginInfo:%{public}s success", bundleName_.c_str());
    return ERR_OK;
}

void PluginInstaller::PluginRollBack(const InnerBundleInfo &hostBundleInfo)
{
    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (dataMgr == nullptr) {
        APP_LOGE("get dataMgr failed");
        return;
    }
    if (!isPluginExist_) {
        //rollback database
        ErrCode err = dataMgr->RemovePluginInfo(hostBundleInfo, bundleName_, userId_);
        if (err != ERR_OK) {
            APP_LOGW("plugin:%{public}s clean PluginInfo failed", bundleName_.c_str());
        }
        return;
    }
    // for update
    for (const auto &userId : hasInstalledUsers_) {
        ErrCode err = dataMgr->AddPluginInfo(hostBundleInfo, oldPluginInfo_, userId);
        if (err != ERR_OK) {
            APP_LOGW("save old pluginInfo failed %{public}d, userId:%{public}d",
                err, userId);
        }
    }
    // current user has not install plugin before update, need to remove
    if (hasInstalledUsers_.find(userId_) == hasInstalledUsers_.end()) {
        ErrCode err = dataMgr->RemovePluginInfo(hostBundleInfo, bundleName_, userId_);
        if (err != ERR_OK) {
            APP_LOGW("plugin:%{public}s clean PluginInfo failed", bundleName_.c_str());
        }
    }
}

ErrCode PluginInstaller::RemovePluginDir(const InnerBundleInfo &hostBundleInfo)
{
    std::string pluginDir = hostBundleInfo.GetAppCodePath() + ServiceConstants::PATH_SEPARATOR + PLUGINS;
    std::string pluginBundleDir = pluginDir + ServiceConstants::PATH_SEPARATOR + bundleNameWithTime_;
    ErrCode err = InstalldClient::GetInstance()->RemoveDir(pluginBundleDir);
    if (err != ERR_OK) {
        APP_LOGW("remove dir of %{public}s failed: %{public}s", bundleName_.c_str(), pluginBundleDir.c_str());
        return err;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::RemovePluginInfo(const InnerBundleInfo &hostBundleInfo)
{
    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (dataMgr == nullptr) {
        APP_LOGE("get dataMgr failed");
        return ERR_APPEXECFWK_NULL_PTR;
    }
    ErrCode err = dataMgr->RemovePluginInfo(hostBundleInfo, bundleName_, userId_);
    if (err != ERR_OK) {
        APP_LOGW("plugin:%{public}s clean PluginInfo failed", bundleName_.c_str());
        return err;
    }
    return ERR_OK;
}

ErrCode PluginInstaller::SaveHspToInstallDir(const std::string &bundlePath,
    const std::string &pluginBundleDir,
    const std::string &moduleName,
    InnerBundleInfo &newInfo)
{
    ErrCode result = ERR_OK;
    std::string hspPath = pluginBundleDir + ServiceConstants::PATH_SEPARATOR + moduleName +
        ServiceConstants::HSP_FILE_SUFFIX;
    if (!signatureFileDir_.empty()) {
        result = InstalldClient::GetInstance()->CopyFile(bundlePath, hspPath, signatureFileDir_);
        CHECK_RESULT(result, "copy hsp to install dir failed %{public}d");
    } else {
        result = InstalldClient::GetInstance()->MoveHapToCodeDir(bundlePath, hspPath);
        CHECK_RESULT(result, "move hsp to install dir failed %{public}d");
        bool isCompileSdkOpenHarmony = (compileSdkType_ == COMPILE_SDK_TYPE_OPEN_HARMONY);
        result = VerifyCodeSignatureForHsp(hspPath, appIdentifier_, isEnterpriseBundle_,
            isCompileSdkOpenHarmony);
    }
    newInfo.SetModuleHapPath(hspPath);

    FILE *hspFp = fopen(hspPath.c_str(), "r");
    if (hspFp == nullptr) {
        APP_LOGE("fopen %{public}s failed", hspPath.c_str());
    } else {
        int32_t hspFd = fileno(hspFp);
        if (hspFd < 0) {
            APP_LOGE("open %{public}s failed", hspPath.c_str());
        } else if (fsync(hspFd) != 0) {
            APP_LOGE("fsync %{public}s failed", hspPath.c_str());
        }
        fclose(hspFp);
    }
    CHECK_RESULT(result, "verify code signature failed %{public}d");
    return ERR_OK;
}

void PluginInstaller::RemoveEmptyDirs(const std::string &pluginDir) const
{
    for (auto &item : parsedBundles_) {
        std::string moduleDir = pluginDir + ServiceConstants::PATH_SEPARATOR + bundleNameWithTime_
            + ServiceConstants::PATH_SEPARATOR + item.second.GetCurModuleName();
        bool isEmpty = false;
        InstalldClient::GetInstance()->IsDirEmpty(moduleDir, isEmpty);
        if (isEmpty) {
            APP_LOGD("remove empty dir : %{public}s", moduleDir.c_str());
            RemoveDir(moduleDir);
        }
    }
}

void PluginInstaller::RemoveDir(const std::string &dir) const
{
    auto result = InstalldClient::GetInstance()->RemoveDir(dir);
    if (result != ERR_OK) {
        APP_LOGW("remove dir %{public}s failed, error is %{public}d", dir.c_str(), result);
    }
}

ErrCode PluginInstaller::ProcessPluginUninstall(const InnerBundleInfo &hostBundleInfo)
{
    ErrCode result = ERR_OK;
    bool isMultiUser = hostBundleInfo.HasMultiUserPlugin(bundleName_);
    ScopeGuard removeDataGuard([&] { UninstallRollBack(hostBundleInfo); });
    result = RemovePluginInfo(hostBundleInfo);
    if (result != ERR_OK) {
        APP_LOGE("bundleName:%{public}s remove plugin:%{public}s info failed",
            hostBundleInfo.GetBundleName().c_str(), bundleName_.c_str());
        return ERR_APPEXECFWK_REMOVE_PLUGIN_INFO_ERROR;
    }
    removeDataGuard.Dismiss();
    if (!isMultiUser) {
        std::string pluginBundleDir = GetPluginBundleDir();
        std::string deleteDir = pluginBundleDir + REMOVE_TMP_SUFFIX;
        if (!BundleUtil::RenameFile(pluginBundleDir, deleteDir)) {
            APP_LOGW("rename failed, %{public}s -> %{public}s", pluginBundleDir.c_str(), deleteDir.c_str());
            result = InstalldClient::GetInstance()->RemoveDir(pluginBundleDir);
        } else {
            result = InstalldClient::GetInstance()->RemoveDir(deleteDir);
        }
        if (result != ERR_OK) {
            APP_LOGW("bundleName:%{public}s remove plugin:%{public}s dir failed",
                hostBundleInfo.GetBundleName().c_str(), bundleName_.c_str());
        }
        InstalldClient::GetInstance()->RemoveSignProfile(bundleName_);
    }
    return ERR_OK;
}

std::string PluginInstaller::GetPluginBundleDir()
{
    for (const auto &item : oldPluginInfo_.pluginModuleInfos) {
        if (!item.hapPath.empty()) {
            auto pos = item.hapPath.rfind(ServiceConstants::PATH_SEPARATOR);
            if (pos != std::string::npos) {
                return item.hapPath.substr(0, pos);
            }
        }
    }
    return "";
}

void PluginInstaller::RemoveOldInstallDir()
{
    if (!isPluginExist_) {
        return;
    }
    std::string path = GetPluginBundleDir();
    RemoveDir(path);
    APP_LOGI("remove old install dir:%{public}s", path.c_str());
}

void PluginInstaller::UninstallRollBack(const InnerBundleInfo &hostBundleInfo)
{
    auto dataMgr = DelayedSingleton<BundleMgrService>::GetInstance()->GetDataMgr();
    if (dataMgr == nullptr) {
        APP_LOGE("get dataMgr failed");
        return;
    }
    ErrCode err = dataMgr->AddPluginInfo(hostBundleInfo, oldPluginInfo_, userId_);
    if (err != ERR_OK) {
        APP_LOGW("save old pluginInfo failed %{public}d, userId:%{public}d", err, userId_);
    }
}
} // AppExecFwk
} // OHOS