ruby_everywhere 0.3.0 → 0.4.0

data/support/mobile/android/app/src/main/assets/json/path-configuration.json

@@ -0,0 +1,19 @@
+{
+  "settings": {},
+  "rules": [
+    {
+      "patterns": [".*"],
+      "properties": {
+        "context": "default",
+        "pull_to_refresh_enabled": true
+      }
+    },
+    {
+      "patterns": ["/new$", "/edit$"],
+      "properties": {
+        "context": "modal",
+        "pull_to_refresh_enabled": false
+      }
+    }
+  ]
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/AuthFlow.kt

@@ -0,0 +1,268 @@
+package com.rubyeverywhere.shell
+
+import android.content.ActivityNotFoundException
+import android.content.Intent
+import android.content.pm.ApplicationInfo
+import android.net.Uri
+import android.util.Log
+import androidx.activity.ComponentActivity
+import androidx.browser.customtabs.CustomTabsIntent
+import androidx.core.net.toUri
+import androidx.lifecycle.DefaultLifecycleObserver
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.LifecycleOwner
+
+/**
+ * Third-party sign-in (Sign in with Apple / Google / GitHub / anything the app
+ * routes through `auth.oauth_paths`), run in a Chrome Custom Tab rather than the
+ * app's own web view.
+ *
+ * Not a stylistic choice: Google rejects OAuth from an embedded WebView outright
+ * (`disallowed_useragent`), and the others degrade badly there — no password
+ * manager, none of the user's existing provider session, 2FA fighting a keyboard
+ * the page doesn't control. A Custom Tab is the user's real browser, sharing its
+ * cookie jar, so a signed-in user usually taps once. It is the Android analogue
+ * of iOS's `ASWebAuthenticationSession` (support/mobile/ios/App/AuthFlow.swift),
+ * and the gem side of the flow is untouched — nothing below knows a provider
+ * from a hole in the ground:
+ *
+ *   1. open  /everywhere/auth/start?to=…&return_to=…   (in the browser)
+ *   2. the app's own OAuth runs and lands somewhere signed in
+ *   3. Everywhere::AuthHandoff seals that cookie jar into a one-time token and
+ *      redirects to  <scheme>://auth?token=…
+ *   4. that deep link arrives here; MainActivity spends the token at
+ *      /everywhere/auth/handoff in the web view, which replays the jar there
+ *
+ * A singleton rather than a per-Activity object because the flow outlives the
+ * Activity that started it: the callback is a deep link, and Android is free to
+ * destroy and recreate MainActivity while the browser is up.
+ *
+ * ### Two honest differences from iOS
+ *
+ * **The callback is weaker.** iOS delivers the redirect *to the session that
+ * started it*, so no other app can claim it. A custom scheme on Android is
+ * first-come-first-served, and a malicious app registering the same one could
+ * receive the token. That is the standard Android OAuth exposure, and the
+ * mitigations are the ones the gem already ships: the handoff token is
+ * single-use (`AuthToken.decrypt(once: true)`) and short-lived, so a stolen one
+ * is a race rather than a durable credential. App Links (`autoVerify`) would
+ * close it properly; they can't, because the callback URL shape is shared with
+ * iOS.
+ *
+ * **Cancellation is inferred, not reported.** A Custom Tab hands back no result.
+ * Backing out of it simply resumes the Activity, so a resume while a flow is
+ * still pending *is* the cancellation — the AppAuth pattern. Same outcome as
+ * iOS: the user stays exactly where they started and nothing is shown.
+ */
+object AuthFlow {
+
+    /** Mirrors iOS's `Result<String, AuthFlow.Failure>`. */
+    sealed interface Result {
+        data class Success(val token: String) : Result
+
+        /** The user dismissed the browser. Not an error worth showing them. */
+        data object Canceled : Result
+
+        /** No browser, or a callback that carried nothing to spend. */
+        data class Failed(val message: String) : Result
+    }
+
+    private const val TAG = "EverywhereAuth"
+
+    private var completion: ((Result) -> Unit)? = null
+    private var observer: Watcher? = null
+
+    /**
+     * Set by [cancel] and cleared by the next callback or [start]. Without it a
+     * flow the app deliberately abandoned — an instance switch, a sign-out from
+     * another surface — could still sign the user back in through the orphan
+     * path below when its redirect eventually lands.
+     */
+    private var abandoned = false
+
+    val isRunning: Boolean
+        get() = completion != null
+
+    /**
+     * Open the provider sign-in in the browser. Nothing is loaded in the web
+     * view: the whole point is that this URL never touches it.
+     *
+     * @param startUrl the gem's /everywhere/auth/start, already carrying `to`
+     *   and `return_to` (EverywhereConfig.authStartUrl)
+     * @param scheme the app's callback scheme, from everywhere.yml `auth.scheme`
+     */
+    fun start(
+        activity: ComponentActivity,
+        startUrl: String,
+        scheme: String,
+        completion: (Result) -> Unit
+    ) {
+        // A second tap while the browser is up must not restart the flow: the
+        // first one is still going to come back through our scheme.
+        if (isRunning) return
+
+        if (scheme.isEmpty()) {
+            completion(Result.Failed("no auth scheme is declared in everywhere.yml"))
+            return
+        }
+
+        if (activity.isDebuggable) Log.d(TAG, "authFlow: $startUrl")
+
+        abandoned = false
+        this.completion = completion
+        watch(activity)
+
+        val intent = CustomTabsIntent.Builder()
+            .setShowTitle(true)
+            .setShareState(CustomTabsIntent.SHARE_STATE_OFF)
+            .build()
+
+        // The browser tab must not outlive the flow. Without this the callback
+        // deep link brings the app forward but leaves the sign-in page sitting
+        // in the task, so the first Back press drops the freshly signed-in user
+        // back onto the provider's "you're already signed in" screen.
+        intent.intent.addFlags(Intent.FLAG_ACTIVITY_NO_HISTORY)
+
+        try {
+            intent.launchUrl(activity, startUrl.toUri())
+        } catch (e: ActivityNotFoundException) {
+            // CustomTabsIntent degrades to a plain ACTION_VIEW when no browser
+            // supports Custom Tabs, so reaching here means there is nothing on
+            // the device that can open an http URL at all.
+            Log.e(TAG, "authFlow: no browser available", e)
+            settle(Result.Failed("no browser is available to sign in with"))
+        }
+    }
+
+    /**
+     * Feed every incoming deep link through here. Returns true when the URI was
+     * our sign-in callback, so the caller knows not to treat it as a link into
+     * app content.
+     */
+    fun handleCallback(uri: Uri): Boolean {
+        val scheme = EverywhereConfig.shared.authScheme
+        if (scheme.isNullOrEmpty() || !uri.scheme.equals(scheme, ignoreCase = true)) return false
+
+        // Claim it before the resume that follows can read the pending flow as
+        // a cancellation.
+        val pending = completion
+        stopWatching()
+        completion = null
+
+        // The host is `auth` today (AuthHandoff#close), but iOS accepts any host
+        // its scheme returns through, and so do we — the token is the contract.
+        val token = runCatching { uri.getQueryParameter("token") }.getOrNull()
+        if (token.isNullOrBlank()) {
+            Log.w(TAG, "authFlow: the callback carried no token")
+            abandoned = false
+            pending?.invoke(Result.Failed("the sign-in callback carried no token"))
+            return true
+        }
+
+        if (pending != null) {
+            abandoned = false
+            pending(Result.Success(token))
+            return true
+        }
+
+        // Orphaned: the Activity that started the flow was destroyed (a rotation
+        // while the browser was up), or the callback cold-launched the process.
+        // The token is still perfectly good and the user still expects to end up
+        // signed in, so spend it through the normal visit path. What is lost
+        // versus the live path is only the immediate config refetch — the
+        // auth-gated tabs catch up on the next foreground.
+        if (abandoned) {
+            abandoned = false
+            Log.i(TAG, "authFlow: ignoring a callback for an abandoned flow")
+            return true
+        }
+
+        Log.i(TAG, "authFlow: completing an orphaned callback through a native visit")
+        EverywhereEvents.emit(
+            EverywhereEvents.Event.NativeVisit(EverywhereConfig.shared.authHandoffUrl(token))
+        )
+        return true
+    }
+
+    /**
+     * Abandon a flow that's still out — used when the app resets underneath it
+     * (an instance switch, a sign-out from another surface), where whatever it
+     * returns would be answering a question the app no longer has.
+     *
+     * Unlike iOS this cannot close the browser: a Custom Tab belongs to the
+     * browser, not to us. It stops us acting on the return, and stops the
+     * resume that follows from being reported as a cancellation.
+     */
+    fun cancel() {
+        if (!isRunning) return
+        abandoned = true
+        stopWatching()
+        completion = null
+    }
+
+    // ------------------------------------------------------------------------
+    // Cancellation detection
+    // ------------------------------------------------------------------------
+
+    private fun watch(activity: ComponentActivity) {
+        stopWatching()
+        Watcher(activity).also {
+            observer = it
+            activity.lifecycle.addObserver(it)
+        }
+    }
+
+    private fun stopWatching() {
+        observer?.detach()
+        observer = null
+    }
+
+    private fun settle(result: Result) {
+        val pending = completion ?: return
+        stopWatching()
+        completion = null
+        pending(result)
+    }
+
+    /**
+     * Watches the Activity that launched the browser. `leftForBrowser` is what
+     * makes this reliable: [start] runs while the Activity is resumed, so
+     * without it the very next resume — the one that follows our own launch —
+     * would read as a cancellation.
+     */
+    private class Watcher(activity: ComponentActivity) : DefaultLifecycleObserver {
+        private var lifecycle: Lifecycle? = activity.lifecycle
+        private var leftForBrowser = false
+
+        fun detach() {
+            lifecycle?.removeObserver(this)
+            lifecycle = null
+        }
+
+        override fun onPause(owner: LifecycleOwner) {
+            leftForBrowser = true
+        }
+
+        override fun onResume(owner: LifecycleOwner) {
+            if (!leftForBrowser) return
+            AuthFlow.settle(Result.Canceled)
+        }
+
+        /**
+         * The Activity is gone (a rotation while the browser was up), so its
+         * completion closes over a destroyed screen and must not be called.
+         * The flow itself isn't over — the redirect is still coming — and
+         * [handleCallback]'s orphan path is what finishes it.
+         */
+        override fun onDestroy(owner: LifecycleOwner) {
+            detach()
+            if (AuthFlow.observer === this) {
+                AuthFlow.observer = null
+                AuthFlow.completion = null
+            }
+        }
+    }
+
+    private val ComponentActivity.isDebuggable: Boolean
+        get() = applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE != 0
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereApplication.kt

@@ -0,0 +1,178 @@
+package com.rubyeverywhere.shell
+
+import android.app.Application
+import android.webkit.CookieManager
+import androidx.core.net.toUri
+import com.rubyeverywhere.shell.bridge.BiometricsComponent
+import com.rubyeverywhere.shell.bridge.HapticsComponent
+import com.rubyeverywhere.shell.bridge.MenuComponent
+import com.rubyeverywhere.shell.bridge.NotificationComponent
+import com.rubyeverywhere.shell.bridge.PermissionsComponent
+import com.rubyeverywhere.shell.bridge.StorageComponent
+import com.rubyeverywhere.shell.bridge.WebControlChannel
+import com.rubyeverywhere.shell.extensions.EverywhereExtensions
+import dev.hotwire.core.bridge.BridgeComponentFactory
+import dev.hotwire.core.bridge.KotlinXJsonConverter
+import dev.hotwire.core.config.Hotwire
+import dev.hotwire.core.logging.HotwireLogLevel
+import dev.hotwire.core.turbo.config.PathConfiguration
+import dev.hotwire.core.turbo.visit.VisitProposal
+import dev.hotwire.core.turbo.webview.HotwireWebView
+import dev.hotwire.navigation.activities.HotwireActivity
+import dev.hotwire.navigation.config.defaultFragmentDestination
+import dev.hotwire.navigation.config.registerBridgeComponents
+import dev.hotwire.navigation.config.registerFragmentDestinations
+import dev.hotwire.navigation.config.registerRouteDecisionHandlers
+import dev.hotwire.navigation.navigator.NavigatorConfiguration
+import dev.hotwire.navigation.routing.AppNavigationRouteDecisionHandler
+import dev.hotwire.navigation.routing.BrowserTabRouteDecisionHandler
+import dev.hotwire.navigation.routing.Router
+import dev.hotwire.navigation.routing.SystemNavigationRouteDecisionHandler
+
+/**
+ * Everything that must be true before the first Activity exists: the parsed
+ * config, the framework's global configuration, the bridge, and the first read
+ * of the path configuration.
+ *
+ * The Android counterpart of iOS's AppDelegate.configureHotwire, with one
+ * difference worth stating: on Android the path configuration is loaded here
+ * rather than from the Activity, because `MainActivity.navigatorConfigurations()`
+ * is read during its `super.onCreate` and needs the tabs to already exist. The
+ * bundled copy loads synchronously, so they do.
+ */
+class EverywhereApplication : Application() {
+
+    override fun onCreate() {
+        super.onCreate()
+
+        EverywhereConfig.initialize(this)
+        configureHotwire()
+        loadPathConfiguration()
+    }
+
+    private fun configureHotwire() {
+        val config = EverywhereConfig.shared
+
+        Hotwire.defaultFragmentDestination = WebFragment::class
+
+        Hotwire.registerFragmentDestinations(
+            WebFragment::class,
+            WebBottomSheetFragment::class,
+            // App-provided native screens (everywhere.yml native.android.screens).
+            *EverywhereExtensions.fragmentDestinations.toTypedArray()
+        )
+
+        Hotwire.registerBridgeComponents(
+            BridgeComponentFactory("everywhere--notification", ::NotificationComponent),
+            BridgeComponentFactory("everywhere--haptics", ::HapticsComponent),
+            BridgeComponentFactory("everywhere--permissions", ::PermissionsComponent),
+            BridgeComponentFactory("everywhere--biometrics", ::BiometricsComponent),
+            BridgeComponentFactory("everywhere--storage", ::StorageComponent),
+            BridgeComponentFactory("everywhere--menu", ::MenuComponent),
+            *EverywhereExtensions.bridgeComponents.toTypedArray()
+        )
+
+        // Order matters: ours run before the framework's, and the framework's
+        // first handler claims every same-host URL. A reset or a provider
+        // sign-in has to be recognised before that happens.
+        Hotwire.registerRouteDecisionHandlers(
+            ResetRouteDecisionHandler(),
+            AuthFlowRouteDecisionHandler(),
+            AppNavigationRouteDecisionHandler(),
+            BrowserTabRouteDecisionHandler(),
+            SystemNavigationRouteDecisionHandler()
+        )
+
+        Hotwire.config.jsonConverter = KotlinXJsonConverter()
+        Hotwire.config.applicationUserAgentPrefix = config.userAgentPrefix
+        Hotwire.config.webViewDebuggingEnabled = BuildConfig.DEBUG
+        Hotwire.config.logger.logLevel =
+            if (BuildConfig.DEBUG) HotwireLogLevel.DEBUG else HotwireLogLevel.NONE
+
+        // Android WebView has no user-script API, so the two things iOS does
+        // with WKUserContentController — expose the control channel, and inject
+        // window.__EVERYWHERE_CONFIG__ at document start — are both done inside
+        // WebControlChannel.install, through WebViewCompat, per web view.
+        //
+        // Per web view, not once at launch, because webConfigJson carries the
+        // instance override, and that changes when a picker re-roots the app.
+        Hotwire.config.makeCustomWebView = { context ->
+            HotwireWebView(context, null).also { webView ->
+                WebControlChannel.install(webView, config.webConfigJson)
+            }
+        }
+    }
+
+    /**
+     * Both sources at launch: the bundled copy loads synchronously (instant
+     * tabs, works offline) and the server copy refines it. The server copy is
+     * the auth-gated one, so it is fetched with the WebView's cookies — see
+     * [MainActivity.cookieHeaders] for why that is not automatic.
+     */
+    private fun loadPathConfiguration() {
+        val config = EverywhereConfig.shared
+        val remoteUrl = config.pathConfigurationUrl
+        val cookie = runCatching { CookieManager.getInstance().getCookie(remoteUrl) }.getOrNull()
+
+        Hotwire.loadPathConfiguration(
+            context = this,
+            location = PathConfiguration.Location(
+                assetFilePath = "json/path-configuration.json",
+                remoteFileUrl = remoteUrl
+            ),
+            options = PathConfiguration.LoaderOptions(
+                httpHeaders = if (cookie.isNullOrEmpty()) emptyMap() else mapOf("Cookie" to cookie)
+            )
+        )
+    }
+}
+
+/**
+ * Intercepts `/everywhere/reset` — the URL the gem redirects to after a sign-in
+ * or sign-out — natively, so resetting never depends on the reset page's
+ * JavaScript running. Cancelling the visit leaves the reset to [MainActivity],
+ * which does the whole sequence deterministically.
+ */
+private class ResetRouteDecisionHandler : Router.RouteDecisionHandler {
+    override val name = "everywhere-reset"
+
+    override fun matches(proposal: VisitProposal, configuration: NavigatorConfiguration): Boolean =
+        proposal.location.toUri().path == RESET_PATH
+
+    override fun handle(
+        proposal: VisitProposal,
+        configuration: NavigatorConfiguration,
+        activity: HotwireActivity
+    ): Router.Decision {
+        val to = proposal.location.toUri().getQueryParameter("to")
+        EverywhereEvents.emit(EverywhereEvents.Event.ResetApp(to))
+        return Router.Decision.CANCEL
+    }
+
+    private companion object {
+        const val RESET_PATH = "/everywhere/reset"
+    }
+}
+
+/**
+ * A provider sign-in: hand it to a Custom Tab instead of loading it in the web
+ * view. Cancelling leaves the user on the page they tapped from, which is where
+ * they belong if they close the tab.
+ */
+private class AuthFlowRouteDecisionHandler : Router.RouteDecisionHandler {
+    override val name = "everywhere-auth"
+
+    override fun matches(proposal: VisitProposal, configuration: NavigatorConfiguration): Boolean =
+        EverywhereConfig.shared.authTarget(proposal.location) != null
+
+    override fun handle(
+        proposal: VisitProposal,
+        configuration: NavigatorConfiguration,
+        activity: HotwireActivity
+    ): Router.Decision {
+        EverywhereConfig.shared.authTarget(proposal.location)?.let {
+            EverywhereEvents.emit(EverywhereEvents.Event.AuthFlow(it))
+        }
+        return Router.Decision.CANCEL
+    }
+}