ruby_everywhere 0.1.15 → 0.2.0

data/support/mobile/ios/App/Bridge/BiometricsComponent.swift

@@ -0,0 +1,276 @@
+import Foundation
+import HotwireNative
+import LocalAuthentication
+import Security
+
+/// Bridge component backing `everywhere--biometrics`. Handles `query`
+/// (availability + biometry type), `authenticate` (Face ID / Touch ID
+/// prompt, optionally falling back to the device passcode), and the
+/// `credential*` events (a biometric-protected keychain secret powering
+/// "sign in with Face ID"), replying `{available, biometry, status}`,
+/// `{authenticated, error?}`, and `{stored|token|enrolled|cleared, error?}`.
+///
+/// Biometrics must be declared in everywhere.yml — that's what stamps
+/// NSFaceIDUsageDescription, and evaluating a Face ID policy without it
+/// crashes the app — so undeclared use short-circuits before any system API.
+///
+/// This proves presence to the PAGE only (gate a screen, confirm an action);
+/// it is not authentication the server can trust.
+final class BiometricsComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--biometrics" }
+
+    override func onReceive(message: Message) {
+        let declared = EverywhereConfig.shared.declaresPermission("biometrics")
+
+        switch message.event {
+        case "query":
+            declared ? query(message)
+                     : reply(message, QueryReply(available: false, biometry: "none", status: "undeclared"))
+        case "authenticate":
+            declared ? authenticate(message)
+                     : reply(message, AuthReply(authenticated: false, error: "undeclared"))
+        case "credentialStore", "credentialGet", "credentialStatus", "credentialClear":
+            declared ? credential(message)
+                     : reply(message, CredentialReply(error: "undeclared"))
+        default:
+            break
+        }
+    }
+
+    private func query(_ message: Message) {
+        let context = LAContext()
+        var error: NSError?
+        let available = context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error)
+        // biometryType is only valid after canEvaluatePolicy; it still reports
+        // the hardware's type when the check fails (e.g. nothing enrolled).
+        reply(message, QueryReply(
+            available: available,
+            biometry: biometryName(context.biometryType),
+            status: available ? "available" : describe(error)))
+    }
+
+    private func authenticate(_ message: Message) {
+        let data: Payload? = message.data()
+        let policy: LAPolicy = data?.allowPasscode == true
+            ? .deviceOwnerAuthentication
+            : .deviceOwnerAuthenticationWithBiometrics
+        let reason = (data?.reason?.trimmingCharacters(in: .whitespacesAndNewlines)).flatMap { $0.isEmpty ? nil : $0 }
+            ?? "Confirm it's you."
+
+        let context = LAContext()
+        var error: NSError?
+        guard context.canEvaluatePolicy(policy, error: &error) else {
+            return reply(message, AuthReply(authenticated: false, error: describe(error)))
+        }
+
+        context.evaluatePolicy(policy, localizedReason: reason) { [weak self] success, error in
+            self?.reply(message, AuthReply(authenticated: success, error: success ? nil : self?.describe(error as NSError?)))
+        }
+    }
+
+    // MARK: Keychain credential (the "sign in with Face ID" token)
+    //
+    // A server-issued secret stored with SecAccessControl(.biometryCurrentSet):
+    // reading it IS the Face ID prompt, and iOS invalidates the item whenever
+    // biometric enrollment changes (a newly added face/finger kills it).
+    // Keychain calls that show UI block their thread, so everything runs off
+    // the main queue and replies through the nonisolated helper.
+
+    private func credential(_ message: Message) {
+        let event = message.event
+        let data: Payload? = message.data()
+
+        DispatchQueue.global(qos: .userInitiated).async { [weak self] in
+            guard let self else { return }
+            switch event {
+            case "credentialStore":
+                self.reply(message, self.storeCredential(data?.token, reason: data?.reason ?? "Enable biometric sign-in"))
+            case "credentialGet":
+                self.reply(message, self.readCredential(reason: data?.reason ?? "Sign in"))
+            case "credentialStatus":
+                self.reply(message, self.credentialStatus())
+            default: // credentialClear
+                self.reply(message, self.clearCredential())
+            }
+        }
+    }
+
+    private nonisolated static let credentialService =
+        (Bundle.main.bundleIdentifier ?? "com.rubyeverywhere.app") + ".biometric-login"
+
+    private nonisolated var credentialQuery: [String: Any] {
+        [kSecClass as String: kSecClassGenericPassword,
+         kSecAttrService as String: Self.credentialService,
+         kSecAttrAccount as String: "login"]
+    }
+
+    /// Blocking biometric check on the calling (background) queue. Returns the
+    /// authenticated context on success — pass it into a keychain read so
+    /// hardware shows exactly one prompt — or the error string on failure.
+    /// Real devices enforce the item ACL regardless; the Simulator doesn't
+    /// honor keychain ACLs, so this explicit pass is what keeps sim and
+    /// device behavior aligned.
+    private nonisolated func biometricCheck(reason: String) -> (context: LAContext?, error: String?) {
+        let context = LAContext()
+        context.localizedReason = reason
+
+        var authError: NSError?
+        guard context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &authError) else {
+            return (nil, describe(authError))
+        }
+
+        let gate = DispatchSemaphore(value: 0)
+        var passed = false
+        var evalError: NSError?
+        context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { ok, error in
+            passed = ok
+            evalError = error as NSError?
+            gate.signal()
+        }
+        gate.wait()
+        return passed ? (context, nil) : (nil, describe(evalError))
+    }
+
+    /// Storing runs the check too: writes don't trigger the ACL, but enabling
+    /// a sign-in credential is a security change — confirm it's the owner.
+    private nonisolated func storeCredential(_ token: String?, reason: String) -> CredentialReply {
+        guard let token, !token.isEmpty, let data = token.data(using: .utf8) else {
+            return CredentialReply(stored: false, error: "failed")
+        }
+
+        if let error = biometricCheck(reason: reason).error {
+            return CredentialReply(stored: false, error: error)
+        }
+
+        SecItemDelete(credentialQuery as CFDictionary)
+
+        // WhenUnlocked (not WhenPasscodeSet): real devices can't enroll
+        // biometrics without a passcode, so protection is equivalent — but
+        // WhenPasscodeSet makes SecItemAdd fail on passcode-less simulators.
+        // .biometryCurrentSet is the actual gate either way.
+        var accessError: Unmanaged<CFError>?
+        guard let access = SecAccessControlCreateWithFlags(
+            nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .biometryCurrentSet, &accessError)
+        else { return CredentialReply(stored: false, error: "notAvailable") }
+
+        var attrs = credentialQuery
+        attrs[kSecValueData as String] = data
+        attrs[kSecAttrAccessControl as String] = access
+
+        let status = SecItemAdd(attrs as CFDictionary, nil)
+        return status == errSecSuccess
+            ? CredentialReply(stored: true)
+            : CredentialReply(stored: false, error: keychainError(status), code: status)
+    }
+
+    private nonisolated func readCredential(reason: String) -> CredentialReply {
+        let check = biometricCheck(reason: reason)
+        guard let context = check.context else {
+            return CredentialReply(error: check.error ?? "failed")
+        }
+
+        var query = credentialQuery
+        query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationContext as String] = context
+
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        guard status == errSecSuccess, let data = result as? Data,
+              let token = String(data: data, encoding: .utf8)
+        else { return CredentialReply(error: keychainError(status), code: status) }
+
+        return CredentialReply(token: token)
+    }
+
+    /// Whether a credential exists, without triggering Face ID:
+    /// interactionNotAllowed means "it's there but needs auth" — enrolled.
+    private nonisolated func credentialStatus() -> CredentialReply {
+        let context = LAContext()
+        context.interactionNotAllowed = true
+
+        var query = credentialQuery
+        query[kSecUseAuthenticationContext as String] = context
+
+        let status = SecItemCopyMatching(query as CFDictionary, nil)
+        return CredentialReply(enrolled: status == errSecSuccess || status == errSecInteractionNotAllowed)
+    }
+
+    private nonisolated func clearCredential() -> CredentialReply {
+        let status = SecItemDelete(credentialQuery as CFDictionary)
+        let cleared = status == errSecSuccess || status == errSecItemNotFound
+        return CredentialReply(cleared: cleared, error: cleared ? nil : keychainError(status))
+    }
+
+    private nonisolated func keychainError(_ status: OSStatus) -> String {
+        switch status {
+        case errSecUserCanceled: "canceled"
+        case errSecItemNotFound: "notEnrolled"
+        case errSecAuthFailed: "failed"
+        default: "failed"
+        }
+    }
+
+    /// Replies on the exact message that asked (same rationale as
+    /// PermissionsComponent: concurrent messages for one event make
+    /// `reply(to: event)` target only the last-received message).
+    /// nonisolated so LAContext's background completion can call it directly;
+    /// the actual reply still hops to the main actor.
+    private nonisolated func reply(_ message: Message, _ payload: Encodable) {
+        Task { @MainActor in
+            self.reply(with: message.replacing(data: payload))
+        }
+    }
+
+    private func biometryName(_ type: LABiometryType) -> String {
+        switch type {
+        case .faceID: return "faceID"
+        case .touchID: return "touchID"
+        default:
+            if #available(iOS 17.0, *), type == .opticID { return "opticID" }
+            return "none"
+        }
+    }
+
+    private nonisolated func describe(_ error: NSError?) -> String {
+        guard let error, error.domain == LAErrorDomain,
+              let code = LAError.Code(rawValue: error.code)
+        else { return "failed" }
+
+        switch code {
+        case .userCancel, .systemCancel, .appCancel: return "canceled"
+        case .userFallback: return "fallback"
+        case .biometryLockout: return "lockout"
+        case .biometryNotEnrolled: return "notEnrolled"
+        case .biometryNotAvailable: return "notAvailable"
+        case .passcodeNotSet: return "passcodeNotSet"
+        default: return "failed"
+        }
+    }
+
+    private struct Payload: Decodable {
+        let reason: String?
+        let allowPasscode: Bool?
+        let token: String?
+    }
+
+    private struct QueryReply: Encodable {
+        let available: Bool
+        let biometry: String
+        let status: String
+    }
+
+    private struct AuthReply: Encodable {
+        let authenticated: Bool
+        let error: String?
+    }
+
+    private struct CredentialReply: Encodable {
+        var stored: Bool? = nil
+        var token: String? = nil
+        var enrolled: Bool? = nil
+        var cleared: Bool? = nil
+        var error: String? = nil
+        /// Raw OSStatus on keychain failures — diagnosis, not API.
+        var code: Int32? = nil
+    }
+}

data/support/mobile/ios/App/Bridge/HapticsComponent.swift

@@ -0,0 +1,47 @@
+import Foundation
+import HotwireNative
+import UIKit
+
+/// Bridge component backing `everywhere--haptics`: plays impact, notification,
+/// and selection feedback for `Everywhere.haptics.*` calls from the page.
+final class HapticsComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--haptics" }
+
+    override func onReceive(message: Message) {
+        switch message.event {
+        case "impact":
+            let style: Payload? = message.data()
+            UIImpactFeedbackGenerator(style: impactStyle(style?.style)).impactOccurred()
+        case "notification":
+            let type: Payload? = message.data()
+            UINotificationFeedbackGenerator().notificationOccurred(notificationType(type?.type))
+        case "selection":
+            UISelectionFeedbackGenerator().selectionChanged()
+        default:
+            break
+        }
+    }
+
+    private func impactStyle(_ name: String?) -> UIImpactFeedbackGenerator.FeedbackStyle {
+        switch name {
+        case "light": .light
+        case "heavy": .heavy
+        case "soft": .soft
+        case "rigid": .rigid
+        default: .medium
+        }
+    }
+
+    private func notificationType(_ name: String?) -> UINotificationFeedbackGenerator.FeedbackType {
+        switch name {
+        case "warning": .warning
+        case "error": .error
+        default: .success
+        }
+    }
+
+    private struct Payload: Decodable {
+        let style: String?
+        let type: String?
+    }
+}

data/support/mobile/ios/App/Bridge/NotificationComponent.swift

@@ -0,0 +1,56 @@
+import Foundation
+import HotwireNative
+import UserNotifications
+
+/// Bridge component backing the `everywhere--notification` web component.
+/// Handles `notify` events by requesting authorization (if needed) and
+/// delivering an immediate local notification, then replies `{delivered: Bool}`.
+final class NotificationComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--notification" }
+
+    override func onReceive(message: Message) {
+        guard message.event == "notify" else { return }
+        guard let data: NotifyMessage = message.data() else {
+            reply(to: "notify", with: NotifyReply(delivered: false))
+            return
+        }
+        deliver(data)
+    }
+
+    private func deliver(_ data: NotifyMessage) {
+        let center = UNUserNotificationCenter.current()
+        center.requestAuthorization(options: [.alert, .sound, .badge]) { [weak self] granted, _ in
+            guard granted else {
+                self?.replyOnMain(delivered: false)
+                return
+            }
+
+            let content = UNMutableNotificationContent()
+            content.title = data.title
+            if let body = data.body {
+                content.body = body
+            }
+            content.sound = .default
+
+            let request = UNNotificationRequest(identifier: UUID().uuidString, content: content, trigger: nil)
+            center.add(request) { error in
+                self?.replyOnMain(delivered: error == nil)
+            }
+        }
+    }
+
+    private nonisolated func replyOnMain(delivered: Bool) {
+        Task { @MainActor in
+            self.reply(to: "notify", with: NotifyReply(delivered: delivered))
+        }
+    }
+
+    private struct NotifyMessage: Decodable {
+        let title: String
+        let body: String?
+    }
+
+    private struct NotifyReply: Encodable {
+        let delivered: Bool
+    }
+}

data/support/mobile/ios/App/Bridge/PermissionsComponent.swift

@@ -0,0 +1,142 @@
+import AVFoundation
+import CoreLocation
+import Foundation
+import HotwireNative
+import UIKit
+import UserNotifications
+
+/// Bridge component backing `everywhere--permissions`. Handles `query` and
+/// `request` for notifications / camera / location, replying
+/// `{name, status}` with granted | denied | prompt | undeclared | unsupported,
+/// and `openSettings` for the denied dead-end (iOS never re-prompts).
+///
+/// Camera and location must be declared in everywhere.yml — that's what stamps
+/// their Info.plist usage strings, and requesting without one crashes the app —
+/// so undeclared permissions short-circuit to `undeclared` before any system API.
+final class PermissionsComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--permissions" }
+
+    private lazy var location = LocationPermission()
+
+    override func onReceive(message: Message) {
+        switch message.event {
+        case "query", "request":
+            guard let data: Payload = message.data() else { return }
+            handle(message, permission: data.name)
+        case "openSettings":
+            if let url = URL(string: UIApplication.openSettingsURLString) {
+                UIApplication.shared.open(url)
+            }
+        default:
+            break
+        }
+    }
+
+    private func handle(_ message: Message, permission: String) {
+        // Notifications carry no usage string, so they can't crash undeclared.
+        guard permission == "notifications" || EverywhereConfig.shared.declaresPermission(permission) else {
+            return reply(message, permission, "undeclared")
+        }
+
+        let event = message.event
+        switch permission {
+        case "notifications":
+            notifications(event) { [weak self] status in self?.reply(message, permission, status) }
+        case "camera":
+            camera(event) { [weak self] status in self?.reply(message, permission, status) }
+        case "location":
+            location.resolve(event) { [weak self] status in self?.reply(message, permission, status) }
+        default:
+            reply(message, permission, "unsupported")
+        }
+    }
+
+    /// Replies on the exact message that asked. Concurrent messages for the
+    /// same event (every permission row queries on page load at once) make
+    /// `reply(to: event)` unusable — it targets only the last-received message.
+    private func reply(_ message: Message, _ name: String, _ status: String) {
+        Task { @MainActor in
+            self.reply(with: message.replacing(data: StatusReply(name: name, status: status)))
+        }
+    }
+
+    // MARK: Notifications
+
+    private func notifications(_ event: String, completion: @escaping (String) -> Void) {
+        let center = UNUserNotificationCenter.current()
+        center.getNotificationSettings { settings in
+            switch settings.authorizationStatus {
+            case .authorized, .ephemeral:
+                completion("granted")
+            case .denied:
+                completion("denied")
+            default:
+                // .provisional (acquired silently, e.g. for badges) still
+                // counts as promptable — the user has never been asked, and
+                // a full request from it shows the real dialog.
+                guard event == "request" else { return completion("prompt") }
+                center.requestAuthorization(options: [.alert, .sound, .badge]) { granted, _ in
+                    completion(granted ? "granted" : "denied")
+                }
+            }
+        }
+    }
+
+    // MARK: Camera
+
+    private func camera(_ event: String, completion: @escaping (String) -> Void) {
+        switch AVCaptureDevice.authorizationStatus(for: .video) {
+        case .authorized:
+            completion("granted")
+        case .denied, .restricted:
+            completion("denied")
+        default:
+            guard event == "request" else { return completion("prompt") }
+            AVCaptureDevice.requestAccess(for: .video) { granted in
+                completion(granted ? "granted" : "denied")
+            }
+        }
+    }
+
+    private struct Payload: Decodable {
+        let name: String
+    }
+
+    private struct StatusReply: Encodable {
+        let name: String
+        let status: String
+    }
+}
+
+/// When-in-use location authorization. The prompt answers through the
+/// manager's delegate, so the pending completion is held until
+/// `locationManagerDidChangeAuthorization` reports a decision.
+private final class LocationPermission: NSObject, CLLocationManagerDelegate {
+    private lazy var manager = CLLocationManager()
+    private var pending: ((String) -> Void)?
+
+    func resolve(_ event: String, completion: @escaping (String) -> Void) {
+        guard manager.authorizationStatus == .notDetermined else {
+            return completion(describe(manager.authorizationStatus))
+        }
+        guard event == "request" else { return completion("prompt") }
+
+        pending = completion
+        manager.delegate = self
+        manager.requestWhenInUseAuthorization()
+    }
+
+    func locationManagerDidChangeAuthorization(_ manager: CLLocationManager) {
+        guard manager.authorizationStatus != .notDetermined, let pending else { return }
+        self.pending = nil
+        pending(describe(manager.authorizationStatus))
+    }
+
+    private func describe(_ status: CLAuthorizationStatus) -> String {
+        switch status {
+        case .authorizedWhenInUse, .authorizedAlways: "granted"
+        case .denied, .restricted: "denied"
+        default: "prompt"
+        }
+    }
+}

data/support/mobile/ios/App/Bridge/StorageComponent.swift

@@ -0,0 +1,63 @@
+import Foundation
+import HotwireNative
+
+/// Bridge component backing `everywhere--storage`: device-local key/value
+/// settings persisted in UserDefaults for `Everywhere.storage.*`. Values ride
+/// the wire as JSON-encoded strings (the JS side owns encoding/decoding), so
+/// any JSON value round-trips without a typed schema here.
+///
+/// Keys are namespaced under "everywhere.app." so page data can never collide
+/// with the shell's own defaults (dev URL, instance override). Settings, not
+/// secrets: server tokens belong in the keychain via biometrics.credential.
+final class StorageComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--storage" }
+
+    private static let prefix = "everywhere.app."
+
+    override func onReceive(message: Message) {
+        let data: Payload? = message.data()
+        let defaults = UserDefaults.standard
+
+        switch message.event {
+        case "get":
+            guard let key = namespaced(data) else { return reply(message, Reply(ok: false)) }
+            reply(message, Reply(ok: true, value: defaults.string(forKey: key)))
+        case "set":
+            guard let key = namespaced(data), let value = data?.value else {
+                return reply(message, Reply(ok: false))
+            }
+            defaults.set(value, forKey: key)
+            reply(message, Reply(ok: true))
+        case "remove":
+            guard let key = namespaced(data) else { return reply(message, Reply(ok: false)) }
+            defaults.removeObject(forKey: key)
+            reply(message, Reply(ok: true))
+        case "clear":
+            for key in defaults.dictionaryRepresentation().keys where key.hasPrefix(Self.prefix) {
+                defaults.removeObject(forKey: key)
+            }
+            reply(message, Reply(ok: true))
+        default:
+            break
+        }
+    }
+
+    private func namespaced(_ data: Payload?) -> String? {
+        guard let key = data?.key, !key.isEmpty else { return nil }
+        return Self.prefix + key
+    }
+
+    private func reply(_ message: Message, _ payload: Reply) {
+        reply(with: message.replacing(data: payload))
+    }
+
+    private struct Payload: Decodable {
+        let key: String?
+        let value: String?
+    }
+
+    private struct Reply: Encodable {
+        let ok: Bool
+        var value: String? = nil
+    }
+}

data/support/mobile/ios/App/ErrorViewController.swift

@@ -0,0 +1,64 @@
+import UIKit
+
+/// A full-screen error page with a retry button, presented when a visit fails
+/// (e.g. the server is unreachable).
+final class ErrorViewController: UIViewController {
+    private let error: Error
+    private let retryHandler: (() -> Void)?
+
+    init(error: Error, retryHandler: (() -> Void)?) {
+        self.error = error
+        self.retryHandler = retryHandler
+        super.init(nibName: nil, bundle: nil)
+    }
+
+    @available(*, unavailable)
+    required init?(coder: NSCoder) {
+        fatalError("init(coder:) has not been implemented")
+    }
+
+    override func viewDidLoad() {
+        super.viewDidLoad()
+        view.backgroundColor = .systemBackground
+
+        let imageView = UIImageView(image: UIImage(systemName: "wifi.exclamationmark"))
+        imageView.preferredSymbolConfiguration = UIImage.SymbolConfiguration(pointSize: 48, weight: .medium)
+        imageView.tintColor = .secondaryLabel
+        imageView.contentMode = .scaleAspectFit
+
+        let messageLabel = UILabel()
+        messageLabel.text = error.localizedDescription
+        messageLabel.font = .preferredFont(forTextStyle: .body)
+        messageLabel.textColor = .secondaryLabel
+        messageLabel.textAlignment = .center
+        messageLabel.numberOfLines = 0
+
+        var buttonConfiguration = UIButton.Configuration.filled()
+        buttonConfiguration.title = "Retry"
+        buttonConfiguration.buttonSize = .large
+        let retryButton = UIButton(configuration: buttonConfiguration, primaryAction: UIAction { [weak self] _ in
+            self?.retry()
+        })
+        retryButton.isHidden = retryHandler == nil
+
+        let stackView = UIStackView(arrangedSubviews: [imageView, messageLabel, retryButton])
+        stackView.axis = .vertical
+        stackView.alignment = .center
+        stackView.spacing = 16
+        stackView.setCustomSpacing(24, after: messageLabel)
+        stackView.translatesAutoresizingMaskIntoConstraints = false
+
+        view.addSubview(stackView)
+        NSLayoutConstraint.activate([
+            stackView.centerXAnchor.constraint(equalTo: view.centerXAnchor),
+            stackView.centerYAnchor.constraint(equalTo: view.centerYAnchor),
+            stackView.leadingAnchor.constraint(greaterThanOrEqualTo: view.layoutMarginsGuide.leadingAnchor),
+            stackView.trailingAnchor.constraint(lessThanOrEqualTo: view.layoutMarginsGuide.trailingAnchor)
+        ])
+    }
+
+    private func retry() {
+        retryHandler?()
+        dismiss(animated: true)
+    }
+}