ruby_everywhere 0.3.0 → 0.5.0

data/lib/everywhere/icon.rb

@@ -37,6 +37,83 @@ module Everywhere
     ICO_SIZES   = [16, 32, 48, 64, 128, 256].freeze
     LINUX_SIZES = [16, 32, 48, 64, 128, 256, 512].freeze
 
+    # The adaptive icon's foreground layer, one entry per density bucket (mdpi
+    # is 1x, the rest step 1.5/2/3/4x) of the 108dp layer. No legacy
+    # mipmap-<dpi>/ic_launcher.png companions: the shell's minSdk is 28, so
+    # every device that can install the app resolves @mipmap/ic_launcher to the
+    # anydpi-v26 adaptive icon and could never load them.
+    ANDROID_ADAPTIVE_SIZES = {
+      "mdpi" => 108, "hdpi" => 162, "xhdpi" => 216, "xxhdpi" => 324, "xxxhdpi" => 432
+    }.freeze
+
+    # Adaptive-icon safe-zone geometry, as a fraction of the 108dp layer.
+    #
+    # The launcher masks both layers to a shape *it* chooses and can parallax
+    # them, so only the centre 72dp is ever guaranteed visible — the outer 18dp
+    # on each side is headroom. The most aggressive stock mask is the circle
+    # inscribed in that 72dp viewport, and Google's keyline pulls the safe zone
+    # one step further in, to a 66dp circle. So a logo goes *inside* that
+    # circle, bounding box and all: side = 66/sqrt(2) = 46.7dp, i.e. 0.432 of
+    # the layer. Scaling a logo to the 72dp viewport instead is the usual
+    # mistake — it looks correct in a square preview and loses every corner on
+    # the round-mask launchers most devices ship with.
+    ADAPTIVE_ART = (66.0 / Math.sqrt(2)) / 108.0
+
+    # Alpha at or below this is background, not artwork — it survives PNG
+    # export slop and antialiased edges without counting them as content.
+    CONTENT_ALPHA = 8
+
+    # Opaque fraction of the source above which it is treated as full-bleed art
+    # rather than a logo. `config.icon` is one shared icon.png feeding macOS,
+    # iOS *and* Android, and the iOS path wants it opaque corner to corner, so
+    # in practice it usually is. Insetting that into the safe zone would render
+    # the source's own baked background as a shrunken tile floating inside the
+    # launcher's background colour — two nested backgrounds and a tiny logo.
+    #
+    # 0.95 sits in an empty gap. Shaped-but-full-bleed sources stay above it: a
+    # Big Sur squircle keeps ~99% of its bounding square, a 22%-rounded rect
+    # ~97%. Anything with a deliberate margin falls far below — even a mere 5%
+    # border leaves 81%. Nothing real lands near the line.
+    FULL_BLEED_COVERAGE = 0.95
+
+    # Both launcher aliases resolve to the same layers; ic_launcher_round exists
+    # only because the manifest's android:roundIcon asks for it by name. The
+    # layers are @mipmap, not the template placeholder's @drawable, because
+    # what gets stamped is a raster per density rather than one vector.
+    ANDROID_ADAPTIVE_ICON_XML = <<~XML
+      <?xml version="1.0" encoding="utf-8"?>
+      <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+          <background android:drawable="@color/ic_launcher_background" />
+          <foreground android:drawable="@mipmap/ic_launcher_foreground" />
+      </adaptive-icon>
+    XML
+
+    # Android 13+ themed ("Material You") icons tint the monochrome layer's
+    # *alpha* and throw its colour away, so the layer is only worth emitting
+    # when the alpha is already a silhouette — i.e. the inset branch, where the
+    # source arrived as a logo on transparency. Full-bleed art would tint as a
+    # solid filled square, which is worse than the launcher's own fallback, so
+    # that branch ships the icon without a monochrome layer and lets the
+    # fallback happen.
+    ANDROID_THEMED_ADAPTIVE_ICON_XML = <<~XML
+      <?xml version="1.0" encoding="utf-8"?>
+      <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+          <background android:drawable="@color/ic_launcher_background" />
+          <foreground android:drawable="@mipmap/ic_launcher_foreground" />
+          <monochrome android:drawable="@mipmap/ic_launcher_foreground" />
+      </adaptive-icon>
+    XML
+
+    # The background layer is a colour, not a bitmap: it has to survive being
+    # scaled and shifted by the launcher's parallax, which a PNG can't do
+    # without banding or seams at the edges.
+    ANDROID_BACKGROUND_XML = <<~XML
+      <?xml version="1.0" encoding="utf-8"?>
+      <resources>
+          <color name="ic_launcher_background">%s</color>
+      </resources>
+    XML
+
     # Modern (Xcode 14+) single-size asset catalog entry: one 1024px universal
     # image, iOS derives every size itself.
     IOS_APPICON_CONTENTS = <<~JSON
@@ -112,6 +189,48 @@ module Everywhere
       true
     end
 
+    # Write the Android launcher icon under `res_dir`: an adaptive icon's
+    # foreground layer per density, the solid-colour background resource, and
+    # the anydpi-v26 <adaptive-icon> pair that binds them (ic_launcher and the
+    # ic_launcher_round alias the manifest names). How large the artwork lands,
+    # and whether it can carry a themed-icon layer, both follow from what the
+    # source turns out to be — see android_art. `background` is an [r, g, b]
+    # triple as Icon.hex_rgb returns, default white. Returns true, or false if
+    # the source PNG can't be read — same contract as write_ios_appiconset, so
+    # the builder can warn and ship the placeholder.
+    def write_android_mipmaps(source, res_dir, background: nil)
+      raster = Raster.decode_png(source) or return false
+
+      rgb = Array(background || [255, 255, 255])[0, 3]
+      art, full_bleed = android_art(raster)
+
+      ANDROID_ADAPTIVE_SIZES.each do |density, layer|
+        dir = File.join(res_dir, "mipmap-#{density}")
+        FileUtils.mkdir_p(dir)
+
+        # The foreground keeps its alpha — the launcher composites it over the
+        # background layer, and its mask needs the surround empty to cut into.
+        foreground = if full_bleed
+                       filling(art, layer)
+                     else
+                       centred(art, layer, (layer * ADAPTIVE_ART).round)
+                     end
+        foreground.write_png(File.join(dir, "ic_launcher_foreground.png"))
+      end
+
+      xml = full_bleed ? ANDROID_ADAPTIVE_ICON_XML : ANDROID_THEMED_ADAPTIVE_ICON_XML
+      anydpi = File.join(res_dir, "mipmap-anydpi-v26")
+      FileUtils.mkdir_p(anydpi)
+      File.write(File.join(anydpi, "ic_launcher.xml"), xml)
+      File.write(File.join(anydpi, "ic_launcher_round.xml"), xml)
+
+      values = File.join(res_dir, "values")
+      FileUtils.mkdir_p(values)
+      File.write(File.join(values, "ic_launcher_background.xml"),
+                 format(ANDROID_BACKGROUND_XML, format("#%02X%02X%02X", *rgb)))
+      true
+    end
+
     # Build a macOS .icns from an already-shaped master PNG (ideally 1024px).
     # Returns true on success.
     def write_icns(master_png, dest)
@@ -167,6 +286,83 @@ module Everywhere
       m.captures.map { |c| c.to_i(16) }
     end
 
+    # How this source wants to be scaled onto a launcher layer. Returns
+    # [art, full_bleed] — either the raster untouched, to be scaled edge to
+    # edge because it is art designed to be cropped by the mask, or the source
+    # cropped to its opaque bounding box, to be inset into the safe zone.
+    #
+    # Cropping matters for the inset branch: scaling the whole canvas would let
+    # the source's own transparent padding eat into the 66dp circle and land
+    # the logo smaller than the safe zone actually allows. A source with no
+    # content at all is nothing to measure, so it takes the full-bleed path.
+    def android_art(raster)
+      bounds, coverage = content_bounds(raster)
+      return [raster, true] if bounds.nil? || coverage >= FULL_BLEED_COVERAGE
+
+      [crop(raster, *bounds), false]
+    end
+
+    # [[x0, y0, x1, y1], coverage] for the pixels above CONTENT_ALPHA — the
+    # half-open bounding box of the artwork and the fraction of the canvas it
+    # actually paints. [nil, 0.0] when the raster is entirely transparent.
+    def content_bounds(raster)
+      x0 = raster.width
+      y0 = raster.height
+      x1 = 0
+      y1 = 0
+      opaque = 0
+
+      raster.height.times do |y|
+        base = y * raster.width
+        raster.width.times do |x|
+          next if raster.pixels.getbyte(((base + x) * 4) + 3) <= CONTENT_ALPHA
+
+          opaque += 1
+          x0 = x if x < x0
+          x1 = x + 1 if x >= x1
+          y0 = y if y < y0
+          y1 = y + 1 if y >= y1
+        end
+      end
+
+      return [nil, 0.0] if opaque.zero?
+
+      [[x0, y0, x1, y1], opaque.to_f / (raster.width * raster.height)]
+    end
+
+    # The [x0, y0, x1, y1) region of `raster` as a new raster.
+    def crop(raster, x0, y0, x1, y1)
+      w = x1 - x0
+      h = y1 - y0
+      out = String.new(capacity: w * h * 4)
+      h.times { |y| out << raster.pixels.byteslice(((((y0 + y) * raster.width) + x0) * 4), w * 4) }
+      Raster.new(w, h, out)
+    end
+
+    # `raster` scaled to cover a `canvas`x`canvas` square and centre-cropped to
+    # it — no transparent border anywhere. Full-bleed art is meant to be
+    # cropped, so a non-square source loses its overhang rather than exposing
+    # bands of background the launcher's mask would read as a mistake.
+    def filling(raster, canvas)
+      fill = [canvas.to_f / raster.width, canvas.to_f / raster.height].max
+      sw = [(raster.width * fill).ceil, canvas].max
+      sh = [(raster.height * fill).ceil, canvas].max
+      crop(raster.resample(sw, sh), (sw - canvas) / 2, (sh - canvas) / 2,
+           ((sw - canvas) / 2) + canvas, ((sh - canvas) / 2) + canvas)
+    end
+
+    # `raster` scaled to fit a `box`-sized square (aspect preserved, never
+    # stretched) and centred on a transparent `canvas`x`canvas` raster.
+    def centred(raster, canvas, box)
+      fit = [box.to_f / raster.width, box.to_f / raster.height].min
+      sw = (raster.width * fit).round.clamp(1, box)
+      sh = (raster.height * fit).round.clamp(1, box)
+
+      out = Raster.transparent(canvas, canvas)
+      out.paste!(raster.resample(sw, sh), (canvas - sw) / 2, (canvas - sh) / 2)
+      out
+    end
+
     # PNG bytes of `master` at `size`x`size` (no-op resample when already sized).
     def sized_png(master, size)
       (size == master.width && size == master.height ? master : master.resample(size, size)).encode_png

data/lib/everywhere/line_pump.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Turns the raw byte stream off a pty master into whole lines.
+  #
+  # `every dev` relays the dev server and the desktop shell itself so it can tag
+  # each line with its source. That relay has to be line-oriented — a half-line
+  # written to the terminal would leave the cursor mid-row and the dock repaints
+  # from column 1 — but a pty hands over arbitrary chunks, so this buffers.
+  #
+  # Two pty-specific quirks it exists to absorb:
+  #
+  #   * ONLCR. The slave's line discipline turns every LF into CRLF, so lines
+  #     arrive as "text\r\n". The trailing CR is an artifact, not content.
+  #   * In-place rewrites. cargo (and anything with a progress bar) redraws a
+  #     row by writing CR and the new text without a newline. What the terminal
+  #     would have shown is whatever followed the LAST CR, so that is what gets
+  #     emitted — one settled line instead of thirty flickering ones.
+  #
+  # Pure: feed it strings, get lines back. No IO, no threads, no clock beyond
+  # the idle deadline the caller passes in.
+  class LinePump
+    # How long a partial line may sit unterminated before it is emitted anyway.
+    # Without this a progress bar that never writes a newline — or a prompt like
+    # "Overwrite? [Yn]" — would be invisible for as long as it mattered.
+    IDLE_FLUSH = 0.2
+
+    def initialize(idle_flush: IDLE_FLUSH, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+      # Bytes in, text out. A pty hands over BINARY, and a chunk boundary can
+      # land in the middle of a multi-byte character, so buffering and splitting
+      # happen on bytes — UTF-8 is self-synchronizing, so a newline is never
+      # inside a character — and each settled line is transcoded on the way out.
+      @buffer = String.new(encoding: Encoding::BINARY)
+      @idle_flush = idle_flush
+      @clock = clock
+      @touched = nil
+    end
+
+    # Feed a chunk; returns the complete lines it produced (without newlines).
+    def <<(chunk)
+      @buffer << chunk.b
+      @touched = @clock.call
+      lines = []
+      while (index = @buffer.index("\n"))
+        raw = @buffer.slice!(0, index + 1)
+        line = settle(raw.chomp("\n"))
+        lines << line if line
+      end
+      lines
+    end
+
+    # Emit a still-unterminated partial line once it has gone quiet. Call this
+    # from the relay loop whenever a read times out.
+    def flush_idle
+      return [] if @buffer.empty?
+      return [] if @touched && (@clock.call - @touched) < @idle_flush
+
+      lines = drain
+      @touched = @clock.call
+      lines
+    end
+
+    # Emit whatever is left, terminated or not. For end-of-stream.
+    def drain
+      return [] if @buffer.empty?
+
+      line = settle(@buffer)
+      @buffer = +""
+      line ? [line] : []
+    end
+
+    def pending? = !@buffer.empty?
+
+    private
+
+    # chomp the ONLCR artifact first, THEN collapse an in-place rewrite —
+    # order matters. Doing it the other way round reads "bar\r" as a rewrite to
+    # the empty string and swallows the line.
+    #
+    # scrub, not just force_encoding: a build tool can emit a stray byte that is
+    # not valid UTF-8, and a String that claims an encoding it doesn't satisfy
+    # raises the moment anything tries to concatenate a tag onto it.
+    def settle(raw)
+      line = raw.chomp("\r")
+      line = line[(line.rindex("\r") + 1)..] if line.include?("\r")
+      line.dup.force_encoding(Encoding::UTF_8).scrub
+    end
+  end
+end

data/lib/everywhere/log_filter.rb

@@ -30,6 +30,8 @@ module Everywhere
       when :notarize   then notarize(line)
       when :tebako     then tebako(line)
       when :xcodebuild then xcodebuild(line)
+      when :gradle     then gradle(line)
+      when :cargo      then cargo(line)
       end
     end
 
@@ -153,6 +155,115 @@ module Everywhere
       end
     end
 
+    # --- gradle (Android shell) -----------------------------------------------
+    #
+    # Gradle is the quiet one: a cold build is ~120 lines, ~83 of them
+    # "> Task :app:…". So this filter isn't fighting volume like the two above —
+    # it exists because of two specific noises that make a healthy build look
+    # broken. Gradle 9 ends every build with a four-line "incompatible with
+    # Gradle 10" deprecation banner earned by the Android Gradle Plugin, not by
+    # anything the user wrote; and hotwire-native-android 1.3.0 compiled with
+    # Kotlin 2.3.0 emits exactly 7 `w:` warnings from navigation-fragments
+    # (deprecated overrides, getParcelableArrayList, KT-73255) that no app can
+    # act on. Both are suppressed here and both stay in the on-disk log.
+    #
+    # The line that decides a warning's fate is its path: app-authored Kotlin is
+    # stamped into extensions/, and that's the only code the user can fix.
+    MILESTONES = {
+      /:process\w*Manifest\b/ => "merging manifests",
+      /:merge\w*Resources\b/ => "merging resources",
+      /:merge\w*Assets\b/ => "bundling assets",
+      /:compile\w*Kotlin\b/ => "compiling Kotlin",
+      /:compile\w*JavaWithJavac\b/ => "compiling Java",
+      /:package\w+\b/ => "packaging APK"
+    }.freeze
+
+    # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
+    def gradle(line)
+      short = UI.short_path(line)
+      case line
+      # Kotlin/javac/AAPT failures, and Gradle's own failure block.
+      when /\Ae: /, /\berror:/i, /\AFAILURE: /, /\A\* What went wrong:/, /\ABUILD FAILED/
+        "    #{UI.red(short)}"
+      when /\Aw: /
+        return "    #{UI.yellow(short)}" if line.include?("/extensions/")
+
+        once(:shell_warning) { UI.note_line("Kotlin warnings from the shell template — see the full log") }
+      when /\ABUILD SUCCESSFUL(?: in (.+))?/
+        UI.note_line("build succeeded#{Regexp.last_match(1) && " (#{Regexp.last_match(1)})"}",
+                     marker: "✓", color: :green)
+      when /\A\d+ actionable tasks?:/
+        UI.note_line(line)
+
+      # First-run downloads are the whole reason a cold build takes minutes.
+      when /\ADownloading https:\/\/services\.gradle\.org/
+        once(:gradle_dist) { UI.note_line("downloading Gradle (first run only)") }
+      when /\AStarting a Gradle Daemon/
+        once(:daemon) { UI.note_line("starting the Gradle daemon") }
+
+      # ~83 task lines. Milestones once each; the rest, including everything
+      # already up to date, is background.
+      when /\A> Task (\S+)/
+        task = Regexp.last_match(1)
+        return :drop if line.match?(/(UP-TO-DATE|FROM-CACHE|NO-SOURCE|SKIPPED)\s*\z/)
+
+        label = MILESTONES.find { |pattern, _| task.match?(pattern) }&.last or return :drop
+
+        once("task-#{label}") { UI.note_line(label) }
+
+      # Gradle 9's deprecation banner and its follow-on lines, the incubating
+      # problems report, the daemon's welcome, and any progress redraw that
+      # survives --console=plain.
+      when /Deprecated Gradle features were used in this build/,
+           /--warning-mode all/,
+           /\AFor more information[, ].*docs\.gradle\.org/,
+           /\A\[Incubating\] Problems report/,
+           /\AWelcome to Gradle /,
+           /\A<[=\-]+>/,
+           /\A> (Configure|Starting|Loading|Calculating|IDLE)/
+        :drop
+      else
+        nil # unrecognized -> caller shows it dimmed
+      end
+    end
+    # rubocop:enable Metrics/CyclomaticComplexity, Metrics/MethodLength
+
+    # --- `every dev`'s desktop shell (cargo) ----------------------------------
+
+    # A cold `cargo run` compiles ~300 crates, one "Compiling foo v0.1.0" line
+    # each, plus a progress bar it redraws several times a second. None of that
+    # is actionable while you're waiting on your own app — but warnings, errors
+    # and the moment the shell actually starts very much are.
+    #
+    # Unlike xcodebuild and Gradle (which we run with --console=plain), cargo is
+    # talking to a pty here and colors everything, so its status lines start
+    # with SGR codes and carry OSC-8 hyperlinks. Match on the stripped text;
+    # print the original, since that color is cargo's and worth keeping.
+    #
+    # The fall-through returns the line verbatim rather than nil, so it is NOT
+    # dimmed as background detail: once the shell is up, everything arriving on
+    # this stream is the app's own output, and the body of a Rust compile error
+    # is exactly what you need to read in full.
+    def cargo(line)
+      plain = UI.strip_ansi(line)
+      case plain
+      when /\A\s*error(\[E\d+\])?[:\[]/
+        "    #{UI.red(UI.short_path(plain))}"
+      when /\A\s*warning: /
+        "    #{UI.yellow(UI.short_path(plain))}"
+      when /\A\s*Compiling /
+        once(:compiling) { UI.note_line("compiling the desktop shell (first run is slow)") }
+      when /\A\s*(Downloaded|Downloading|Updating|Building \[|Blocking|Locking)/
+        :drop
+      when /\A\s*Finished\b/
+        UI.note_line("desktop shell compiled", marker: "✓", color: :green)
+      when /\A\s*Running\b/
+        UI.note_line("desktop shell running", marker: "✓", color: :green)
+      else
+        line
+      end
+    end
+
     # Show a line only the first time its key is seen; :drop the repeats. Keeps a
     # long notarization from scrolling a wall of identical "waiting" lines (and
     # notarytool's thrice-echoed submission id from showing three times).

data/lib/everywhere/native_helper.rb

@@ -2,6 +2,7 @@
 
 require "erb"
 require "json"
+require_relative "config"
 
 module Everywhere
   # Server-side view helpers mirroring the JS bridge's platform detection, so
@@ -9,27 +10,50 @@ module Everywhere
   # does on the client:
   #
   #   <%= link_to "Install the app", … unless native_app? %>
-  #   <div class="<%= "native-inset" if native_app? %>">
+  #   <div class="<%= "native-inset" if mobile_app? %>">
   #   <% if native_version && native_version >= Gem::Version.new("1.2") %>
   #
   # Detection is by User-Agent: the RubyEverywhere shells prepend
   # "RubyEverywhere/<version> (<os>)" to Hotwire Native's own
   # "Hotwire Native iOS/Android" marker. Included into all Rails views by
   # Everywhere::Engine.
+  #
+  # Pick the narrowest one that's true of what you're branching on. `native_app?`
+  # means "not a browser tab" and covers the desktop shell; `mobile_app?` means
+  # a phone, with a tab bar and safe-area insets; `desktop_app?` means a window,
+  # with a title bar and a menu bar. Safe-area padding is mobile_app?; hiding a
+  # web nav in favour of native chrome is usually mobile_app? too — the desktop
+  # shell has no native navigation to replace it with.
   module NativeHelper
-    # True inside any RubyEverywhere native shell (iOS or Android).
+    # True inside any RubyEverywhere native shell — iOS, Android or desktop.
+    # Mirrors the bridge's `Everywhere.native`.
     def native_app?
       !native_platform.nil?
     end
 
-    # :ios, :android, or nil in a plain browser. Reads Hotwire Native's UA
+    # :ios, :android, :desktop, or nil in a plain browser. Reads the shell's UA
     # marker, so it's correct even before the JS bridge has booted.
     def native_platform
-      ua = _everywhere_user_agent or return nil
-      return :ios if ua.include?("Hotwire Native iOS")
-      return :android if ua.include?("Hotwire Native Android")
+      Everywhere.native_platform_of(_everywhere_user_agent)
+    end
 
-      nil
+    # True in the Tauri desktop shell. Use it for window chrome — reserving room
+    # for an overlay title bar, say — and for anything that assumes a pointer
+    # and a resizable window.
+    def desktop_app?
+      native_platform == :desktop
+    end
+
+    # True in the iOS or Android shell, and the one to reach for when the
+    # affordance is a phone's: safe-area insets, the native tab bar, biometrics,
+    # the OAuth handoff. Mirrors the bridge's `Everywhere.platform === "mobile"`.
+    def mobile_app?
+      !mobile_platform.nil?
+    end
+
+    # :ios, :android, or nil (including in the desktop shell).
+    def mobile_platform
+      Everywhere.mobile_platform_of(_everywhere_user_agent)
     end
 
     # The shell's version as a Gem::Version (from the "RubyEverywhere/<ver>"
@@ -52,8 +76,11 @@ module Everywhere
     #   redirect_to everywhere_auth_redirect(after_authentication_url)
     #
     # `to` may be a full URL or a path; only the same-origin path is forwarded.
+    # mobile_app?, not native_app?: the reset page exists to rebuild a phone
+    # shell's web views and re-fetch its tab bar. The desktop shell has neither,
+    # so a plain redirect is both correct and what it already did.
     def everywhere_auth_redirect(to)
-      return to unless native_app? && respond_to?(:everywhere_reset_path)
+      return to unless mobile_app? && respond_to?(:everywhere_reset_path)
 
       path = to.to_s.sub(%r{\Ahttps?://[^/]+}, "")
       path = "/" if path.empty? || !path.start_with?("/")
@@ -107,7 +134,10 @@ module Everywhere
                                   wrapper_class: nil, locked_class: nil,
                                   message_class: nil, unlock_class: nil, &block)
       content = respond_to?(:capture) ? capture(&block) : block.call
-      return content unless native_app?
+      # mobile_app?: there's no Face ID on the desktop shell, so emitting the
+      # locked wrapper there would hide the content behind an unlock nothing can
+      # satisfy. Browsers and the desktop shell render it plainly.
+      return content unless mobile_app?
 
       attrs = [%(data-everywhere-biometric-lock="#{_everywhere_attr(name)}")]
       attrs << %(data-everywhere-biometric-reason="#{_everywhere_attr(reason)}") if reason

data/lib/everywhere/omniauth.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require_relative "auth_handoff"
+
+module Everywhere
+  # OmniAuth 2 and the native sign-in flow, introduced to each other.
+  #
+  # Since CVE-2015-9284, OmniAuth only starts a provider flow from a POST
+  # carrying a CSRF token (omniauth-rails_csrf_protection). Right for browsers —
+  # and impossible for the native flow, which enters the provider path through
+  # /everywhere/auth/start's redirect: a GET, in a browser session that has no
+  # CSRF token to give. Without help, tapping "Sign in with GitHub" in the app
+  # ends on OmniAuth's failure page.
+  #
+  #   # config/initializers/omniauth.rb, after your provider setup
+  #   require "everywhere/omniauth"
+  #   Everywhere::OmniAuth.protect!
+  #
+  # Browsers keep exactly the validation they had — whatever
+  # request_validation_phase was set to keeps running. The one extra shape
+  # allowed through is the native flow's entry: a top-level, not-cross-site GET
+  # carrying a marker cookie that /everywhere/auth/start sealed seconds ago.
+  # Nobody else can mint that marker (AES-GCM under the app's secret), start
+  # refuses cross-site initiators outright, and the freshness window means a
+  # marker lingering in Safari's jar after a real sign-in stops vouching for
+  # anything almost immediately.
+  module OmniAuth
+    # How long after start seals the marker its GET still reads as the native
+    # flow arriving. The real gap is one redirect — milliseconds — but the
+    # sheet can sit on our page briefly on a slow network; anything past this
+    # is a browser wandering in.
+    ENTRY_WINDOW = 90
+
+    class << self
+      # Wire OmniAuth's global config: allow GET request phases (they're
+      # refused per-request by the validator unless they prove themselves),
+      # and wrap the configured validation phase so everything that isn't the
+      # native entry is judged exactly as before. Safe to call more than once —
+      # re-running replaces the wrapper, never stacks it.
+      def protect!(entry_window: ENTRY_WINDOW)
+        unless defined?(::OmniAuth) && ::OmniAuth.respond_to?(:config)
+          raise "Everywhere::OmniAuth.protect! needs OmniAuth loaded first — " \
+                "call it below your OmniAuth/Devise setup (config/initializers/omniauth.rb)"
+        end
+
+        config = ::OmniAuth.config
+        config.allowed_request_methods = Array(config.allowed_request_methods) | [:get]
+        config.silence_get_warning = true if config.respond_to?(:silence_get_warning=)
+
+        fallback = config.request_validation_phase
+        fallback = fallback.fallback if fallback.is_a?(RequestValidator)
+        config.request_validation_phase = RequestValidator.new(fallback: fallback, entry_window: entry_window)
+      end
+    end
+
+    # OmniAuth request_validation_phase: passes the native flow's entry,
+    # delegates everything else. A nil fallback means the app had no request
+    # validation configured, and it still has none — this never tightens.
+    class RequestValidator
+      attr_reader :fallback
+
+      def initialize(fallback: nil, entry_window: ENTRY_WINDOW)
+        @fallback = fallback
+        @entry_window = entry_window
+      end
+
+      def call(env)
+        return if native_entry?(env)
+
+        @fallback&.call(env)
+      end
+
+      private
+
+      # The one shape the native flow produces: a GET, not from a cross-site
+      # initiator, carrying a marker minted moments ago. POSTs never qualify —
+      # they come from rendered pages that have a CSRF token to present.
+      def native_entry?(env)
+        return false unless env["REQUEST_METHOD"] == "GET"
+        return false if env["HTTP_SEC_FETCH_SITE"] == "cross-site"
+
+        marker = AuthHandoff.marker(env)
+        issued = marker && marker["iat"]
+        !!issued && Time.now.to_i - issued.to_i <= @entry_window
+      end
+    end
+  end
+end