ruby_native 0.10.2 → 0.10.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eeb4ed38a0ee884b79aaeb774bec27382d5bf7e307662b4eceed42e2b1a3f777
-  data.tar.gz: b31cc3f05419442051575f57edf5455fcf85ccfabc88f8e157205527dd8a3543
+  metadata.gz: 11134b359aea27fdb4c56dcb1be88afcf67f559c93a20aca5981e8334a3f846a
+  data.tar.gz: cf256c05608448a70d7dee2a17a34fe86969092661987f9aac66b2c490836978
 SHA512:
-  metadata.gz: 9757938c4a6cbec3f634efda968f66269e68d3af1a37b212c0d6ca7d89f528848df57bcb02e944b4b52618868a1d0f320d516c568d5da7d76f2137c6e08453eb
-  data.tar.gz: 53d8ce59aaa8bccd090e79dc2c346b627b25b5cfb7a30345d022eee6141c39797a1698f3a25eab88c6264ce419a2523dce8c61d020bfcb203c0356032a6841f5
+  metadata.gz: 73e486bafbd03240d4d0afc6f9dc95d255d9e0a10c60318dc2e2dcb7f9cbdb3f8c9f05f518e6cc0efce7828ff61c7fd29443d997a84a28a0cce4cdce0dbe2f3a
+  data.tar.gz: 4fca6ff54256e1c6debcd38490471f248cac3b626122727972fc0cb7435c9691d97488c0a8ccdb60805faa3ee04ae83f77744474c5f44c445f5e5eb620ab602e

data/app/controllers/ruby_native/aasa_controller.rb

@@ -12,7 +12,7 @@ module RubyNative
       render json: {
         applinks: {
           details: [
-            { appIDs: [ app_id ], components: [ { "/": "*" } ] }
+            { appIDs: [ app_id ], components: oauth_exclusions + [ { "/": "*" } ] }
           ]
         },
         webcredentials: {
@@ -20,5 +20,22 @@ module RubyNative
         }
       }
     end
+
+    private
+
+    # OAuth redirects must stay inside ASWebAuthenticationSession. With the
+    # catch-all component alone, iOS treats the provider's redirect back to
+    # the app's domain (e.g. /users/auth/google_oauth2/callback) as a
+    # universal link, breaks out of the auth session, and native sign-in
+    # fails. Excluding the configured OAuth paths keeps the OAuth round-trip
+    # inside the session. The trailing `*` matches across `/`, so a start
+    # path also covers its `/callback` child. Components are evaluated in
+    # order and the first match wins, so exclusions go before the catch-all.
+    # See https://github.com/ruby-native/gem/issues/59.
+    def oauth_exclusions
+      Array(RubyNative.config&.dig(:auth, :oauth_paths)).map do |path|
+        { "/": "#{path}*", exclude: true }
+      end
+    end
   end
 end

data/lib/generators/ruby_native/templates/ruby_native.yml

@@ -74,7 +74,8 @@ tabs:
 #   team_id: ABCD123456
 
 # Enable OAuth. Each path triggers a native ASWebAuthenticationSession
-# on iOS instead of an in-app web view.
+# on iOS instead of an in-app web view. List only the authorize path for each
+# provider, not its callback; the callback is handled automatically.
 # https://rubynative.com/docs/oauth
 # auth:
 #   oauth_paths:

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.10.2"
+  VERSION = "0.10.3"
 end

data/lib/ruby_native.rb

@@ -41,6 +41,7 @@ module RubyNative
     self.config[:app] ||= {}
     self.config[:app][:entry_path] ||= self.config.dig(:tabs, 0, :path) || "/"
     self.config[:auth] ||= {}
+    normalize_oauth_paths
     backfill_tab_icons
   end
 
@@ -57,4 +58,24 @@ module RubyNative
       tab[:icon] ||= icons[:ios] || icons[:android]
     end
   end
+
+  # `auth.oauth_paths` must list only OAuth authorize paths, never their
+  # callbacks. The native app treats every listed path as a sign-in trigger and
+  # derives the provider from the last path segment, so a callback entry like
+  # "/auth/google/callback" would launch a bogus flow for a provider named
+  # "callback" and send sign-in into a loop. The callback round-trip is handled
+  # automatically by OAuthMiddleware's tracking cookie, so it never needs
+  # listing. Drop any entry that is the "/callback" child of another listed
+  # path and warn, so a copied-in callback can't break native sign-in.
+  def self.normalize_oauth_paths
+    paths = Array(self.config.dig(:auth, :oauth_paths))
+    callbacks = paths.select { |path| paths.any? { |start| path == "#{start}/callback" } }
+    return if callbacks.empty?
+
+    Rails.logger.warn(
+      "[RubyNative] Ignoring OAuth callback path(s) in config/ruby_native.yml " \
+      "(#{callbacks.join(", ")}). List only the authorize path; callbacks are handled automatically."
+    )
+    self.config[:auth][:oauth_paths] = paths - callbacks
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.10.2
+  version: 0.10.3
 platform: ruby
 authors:
 - Joe Masilotti