feat(target): verify an explicit --appId matches the command's platform

The server accepts a bundle or native package for any app the account
owns and never learns which platform it was built for, so `bundle
--platform ios --appId <android app> --name v3` used to publish an iOS
bundle into the Android app and bind it to Android packages. resolveAppId
now looks the app up (GET /app/:id) whenever an explicit appId meets a
known platform and fails before any expensive work when they disagree;
a foreign or missing id fails there too instead of after the build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JCaS35vZG4DCtmM24MYaVR

Author: sunnylqm

src/app.ts

@@ -77,6 +77,22 @@ export async function getSelectedApp(
   };
 }
 
+/**
+ * Fail fast when an explicit `--appId` names an app of another platform.
+ * The server accepts a bundle for any app the account owns and never sees
+ * the platform it was built for, so this is the only place the mistake can
+ * be caught before it reaches devices. A missing or foreign app fails here
+ * too (403/404) instead of after the expensive work.
+ */
+async function assertAppPlatform(appId: string, platform: Platform) {
+  const app = (await get(`/app/${appId}`)) as { platform?: Platform };
+  if (app.platform && app.platform !== platform) {
+    throw new Error(
+      t('appPlatformMismatch', { appId, appPlatform: app.platform, platform }),
+    );
+  }
+}
+
 /**
  * Resolve the app an operation targets: an explicit `--appId` wins, otherwise
  * the app selected for the platform in `--config` (default: update.json).
@@ -89,7 +105,11 @@ export async function resolveAppId(
     assertPlatform(options.platform);
   }
   if (options.appId) {
-    return String(options.appId);
+    const appId = String(options.appId);
+    if (options.platform) {
+      await assertAppPlatform(appId, options.platform);
+    }
+    return appId;
   }
   const platform = await getPlatform(options.platform || undefined);
   return (await getSelectedApp(platform, options.config)).appId;

src/locales/en.ts

@@ -29,6 +29,8 @@ export default {
     'App Key mismatch! Current IPA: {{appKeyInPkg}}, current {{- source}}: {{appKey}}',
   appName: 'App Name',
   appNameQuestion: 'App Name:',
+  appPlatformMismatch:
+    'App {{appId}} is a {{appPlatform}} app, but this command targets {{platform}}',
   appNotSelected:
     'App not selected. run `cresc selectApp --platform {{platform}}` first!',
   appUploadSuccess:

src/locales/zh.ts

@@ -27,6 +27,8 @@ export default {
     'appKey不匹配！当前ipa: {{appKeyInPkg}}, 当前{{- source}}: {{appKey}}',
   appName: '应用名称',
   appNameQuestion: '应用名称:',
+  appPlatformMismatch:
+    '应用 {{appId}} 是 {{appPlatform}} 平台的应用，但当前命令的平台是 {{platform}}',
   appNotSelected:
     '尚未选择应用。请先运行 `pushy selectApp --platform {{platform}}` 来选择应用',
   appUploadSuccess:

tests/target-context.test.ts

@@ -59,11 +59,19 @@ describe('resolveAppId', () => {
     readFileSpy = spyOn(fs.promises, 'readFile').mockRejectedValue(
       new Error('config should not be read'),
     );
+    const getSpy = spyOn(api, 'get').mockRejectedValue(
+      new Error('no platform given, so no lookup'),
+    );
 
-    await expect(
-      resolveAppId({ appId: '777', config: 'configs/prod.json' }),
-    ).resolves.toBe('777');
-    expect(readFileSpy).not.toHaveBeenCalled();
+    try {
+      await expect(
+        resolveAppId({ appId: '777', config: 'configs/prod.json' }),
+      ).resolves.toBe('777');
+      expect(readFileSpy).not.toHaveBeenCalled();
+      expect(getSpy).not.toHaveBeenCalled();
+    } finally {
+      getSpy.mockRestore();
+    }
   });
 
   test('still validates the platform next to an explicit appId', async () => {
@@ -72,6 +80,51 @@ describe('resolveAppId', () => {
     ).rejects.toThrow();
   });
 
+  test('an explicit appId of the requested platform is accepted', async () => {
+    const getSpy = spyOn(api, 'get').mockResolvedValue({
+      id: 777,
+      platform: 'ios',
+    });
+
+    try {
+      await expect(
+        resolveAppId({ appId: '777', platform: 'ios' }),
+      ).resolves.toBe('777');
+      expect(getSpy).toHaveBeenCalledWith('/app/777');
+    } finally {
+      getSpy.mockRestore();
+    }
+  });
+
+  test('an explicit appId of another platform is rejected', async () => {
+    const getSpy = spyOn(api, 'get').mockResolvedValue({
+      id: 42,
+      platform: 'android',
+    });
+
+    try {
+      await expect(
+        resolveAppId({ appId: '42', platform: 'ios' }),
+      ).rejects.toThrow(/42.*android.*ios/);
+    } finally {
+      getSpy.mockRestore();
+    }
+  });
+
+  test('a foreign or missing explicit appId fails before any work', async () => {
+    const getSpy = spyOn(api, 'get').mockRejectedValue(
+      new Error('403 Forbidden'),
+    );
+
+    try {
+      await expect(
+        resolveAppId({ appId: '42', platform: 'ios' }),
+      ).rejects.toThrow('403');
+    } finally {
+      getSpy.mockRestore();
+    }
+  });
+
   test('a missing config is reported as app-not-selected', async () => {
     readFileSpy = spyOn(fs.promises, 'readFile').mockRejectedValue(enoent());
 
@@ -193,6 +246,9 @@ describe('bundle target context', () => {
 
   test('an explicit appId skips the config and reaches publish', async () => {
     readFileSpy = spyOn(fs.promises, 'readFile').mockRejectedValue(enoent());
+    restore.push(
+      spyOn(api, 'get').mockResolvedValue({ id: 777, platform: 'ios' }),
+    );
 
     await bundleCommands.bundle({
       options: { platform: 'ios', appId: '777', name: 'v1' },
@@ -209,6 +265,22 @@ describe('bundle target context', () => {
     });
   });
 
+  test('a named bundle for an app of another platform fails before any work', async () => {
+    restore.push(
+      spyOn(api, 'get').mockResolvedValue({ id: 42, platform: 'android' }),
+    );
+
+    await expect(
+      bundleCommands.bundle({
+        options: { platform: 'ios', appId: '42', name: 'v3' },
+      }),
+    ).rejects.toThrow(/android/);
+
+    expect(addGitIgnoreSpy).not.toHaveBeenCalled();
+    expect(runBundleSpy).not.toHaveBeenCalled();
+    expect(publishSpy).not.toHaveBeenCalled();
+  });
+
   test('a named bundle without a selected app fails before any work', async () => {
     readFileSpy = spyOn(fs.promises, 'readFile').mockRejectedValue(enoent());
 

tests/versions.test.ts

@@ -117,10 +117,15 @@ describe('versionCommands.publish', () => {
   let questionSpy: ReturnType<typeof spyOn>;
   let getCommitInfoSpy: ReturnType<typeof spyOn>;
   let updateSpy: ReturnType<typeof spyOn>;
+  let appGetSpy: ReturnType<typeof spyOn>;
 
   beforeEach(() => {
     consoleSpy = spyOn(console, 'log').mockImplementation(() => {});
     getPlatformSpy = spyOn(app, 'getPlatform').mockResolvedValue('android');
+    appGetSpy = spyOn(api, 'get').mockResolvedValue({
+      id: 777,
+      platform: 'android',
+    });
     getSelectedAppSpy = spyOn(app, 'getSelectedApp').mockResolvedValue({
       appId: '100',
       appKey: 'key',
@@ -147,6 +152,7 @@ describe('versionCommands.publish', () => {
     questionSpy.mockRestore();
     getCommitInfoSpy.mockRestore();
     updateSpy.mockRestore();
+    appGetSpy.mockRestore();
   });
 
   test('can bind after publish when called without object receiver', async () => {
@@ -181,6 +187,7 @@ describe('versionCommands.publish', () => {
     });
 
     expect(getSelectedAppSpy).not.toHaveBeenCalled();
+    expect(appGetSpy).toHaveBeenCalledWith('/app/777');
     expect(uploadFileSpy).toHaveBeenCalledWith('bundle.ppk', undefined, '777');
     expect(postSpy).toHaveBeenCalledWith(
       '/app/777/version/create',