ruby_native 0.11.1 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c596379ed0170d7784e8273e1ac3c10023ebc6115a7d8a7d1edb2633f7325449
-  data.tar.gz: b966e8aeb40899fa32ff8f34f85dffc031b073f0637cf1917083f43ce504e06a
+  metadata.gz: 9febf470fc9b33fbbfe136f4d7dc916f002ce532707281a65c1d9733cab09559
+  data.tar.gz: 9789db1959e99b53cc8a5d40dcf8a093032553569c854bcfcb5d54fa3610f54f
 SHA512:
-  metadata.gz: fbddcd87a18dc14cd8eacdf1b4456c6cacc41c2f26c76e3dc0d6d2383b8c40a76de274901d3456d2ee40a79f56edd3b17d0a9510918e7a67adc9d6fa675f57d3
-  data.tar.gz: 1d9bbb26a648e42952fd11de6d63cb65286d8247e5c847fbd2007760de213ed371f5ff6a61372f582a9cfe75b26fb10f8b11f6c5187187f415af4c511021a748
+  metadata.gz: c94d0798d18f68e60d599cb59aa3296fffecb307cf907a1f0519efe61387be1c8255d46f50938c5e1f3541d3795dee4030f45a52a806aa1d19138a5e76eed964
+  data.tar.gz: 0a4387e5123e7e372521bc4eefefbbaf940d321ba09bf8e5f216471ace3f81f731f98d6f7df759fb380064b72cf96b887a4b72b433815124f503e969866f355c

data/README.md

@@ -1,6 +1,6 @@
 # ruby_native
 
-[Ruby Native](https://rubynative.com) turns a Rails app into an iOS app, with Android in public beta. This gem is the Rails-side integration: view helpers, a YAML config file, endpoints auto-mounted at `/native`, and a CLI for previewing and deploying builds. Full docs, including the complete helper reference and config schema, live at [rubynative.com/docs](https://rubynative.com/docs).
+[Ruby Native](https://rubynative.com) turns a Rails app into iOS and Android apps. This gem is the Rails-side integration: view helpers, a YAML config file, endpoints auto-mounted at `/native`, and a CLI for previewing and deploying builds. Full docs, including the complete helper reference and config schema, live at [rubynative.com/docs](https://rubynative.com/docs).
 
 ## Installation
 

data/app/controllers/ruby_native/auth/start_controller.rb

@@ -9,9 +9,15 @@ module RubyNative
           return
         end
 
+        @callback_scheme = params[:callback_scheme].to_s
+
+        unless @callback_scheme.match?(OAuthMiddleware::CALLBACK_SCHEME)
+          head :bad_request
+          return
+        end
+
         oauth_paths = RubyNative.config&.dig(:auth, :oauth_paths) || []
         @oauth_path = oauth_paths.find { |p| p.end_with?(@provider) } || "/auth/#{@provider}"
-        @callback_scheme = params[:callback_scheme]
       end
     end
   end

data/app/controllers/ruby_native/iap/restores_controller.rb

@@ -7,37 +7,86 @@ module RubyNative
       skip_forgery_protection
 
       def create
-        customer_id = params[:customer_id]
-        return head :bad_request if customer_id.blank?
+        return head :bad_request if params[:customer_id].blank?
 
         transactions = Array(params[:signed_transactions])
         return head :bad_request if transactions.empty?
 
-        transactions.each do |signed_transaction|
-          transaction = decode_and_verify_jws(signed_transaction)
-
-          event = Event.new(
-            type: "subscription.created",
-            status: "active",
-            owner_token: customer_id,
-            product_id: transaction["productId"],
-            original_transaction_id: transaction["originalTransactionId"],
-            transaction_id: transaction["transactionId"],
-            purchase_date: parse_timestamp(transaction["purchaseDate"]),
-            expires_date: parse_timestamp(transaction["expiresDate"]),
-            environment: transaction["environment"]&.downcase,
-            notification_uuid: SecureRandom.uuid,
-            success_path: params[:success_path]
-          )
-
-          RubyNative.fire_subscription_callbacks(event)
-        end
+        transactions.each { |signed_transaction| restore(decode_and_verify_jws(signed_transaction)) }
 
         head :ok
       rescue VerificationError, JWT::DecodeError => e
         Rails.logger.warn "[RubyNative] Restore verification failed: #{e.message}"
         head :unprocessable_entity
       end
+
+      private
+
+      # The account being restored to comes from the purchase intent the
+      # transaction was made against, never from `customer_id` in the request. A
+      # signed transaction is only proof that Apple sold it, not proof of who is
+      # asking, so honoring a caller-supplied id let one purchased subscription
+      # be replayed to grant entitlement to any number of accounts.
+      def restore(transaction)
+        transaction_id = transaction["transactionId"]
+        intent = PurchaseIntent.find_by(uuid: transaction["appAccountToken"])
+
+        unless intent
+          Rails.logger.warn "[RubyNative] Ignoring restored transaction #{transaction_id.inspect}: " \
+            "no purchase intent matches its appAccountToken"
+          return
+        end
+
+        if params[:customer_id] != intent.customer_id
+          Rails.logger.warn "[RubyNative] Restoring transaction #{transaction_id.inspect} to " \
+            "#{intent.customer_id.inspect} from its purchase intent, not the requested " \
+            "#{params[:customer_id].inspect}"
+        end
+
+        # Apple reissues a transaction id on every renewal, so a restore of the
+        # same one is a repeat and must not fire the callback again.
+        return if dedup_available? && intent.restored_transaction_id == transaction_id
+
+        intent.update!(intent_attributes(transaction))
+
+        event = Event.new(
+          type: "subscription.created",
+          status: "active",
+          owner_token: intent.customer_id,
+          product_id: transaction["productId"],
+          original_transaction_id: transaction["originalTransactionId"],
+          transaction_id: transaction_id,
+          purchase_date: parse_timestamp(transaction["purchaseDate"]),
+          expires_date: parse_timestamp(transaction["expiresDate"]),
+          environment: transaction["environment"]&.downcase,
+          notification_uuid: SecureRandom.uuid,
+          success_path: params[:success_path]
+        )
+
+        RubyNative.fire_subscription_callbacks(event)
+      end
+
+      # A restore is the recovery path for a purchase whose completion POST never
+      # landed, so it settles the intent too. An unrecognized environment is
+      # dropped rather than raising on the enum.
+      def intent_attributes(transaction)
+        attributes = {status: :completed}
+        environment = transaction["environment"]&.downcase
+        attributes[:environment] = environment if PurchaseIntent.environments.key?(environment)
+        attributes[:restored_transaction_id] = transaction["transactionId"] if dedup_available?
+        attributes
+      end
+
+      # Deduping needs a column that arrives in a migration, and an app can be on
+      # this version of the gem before it has been run. Restoring to the right
+      # account is the part that matters and needs no column, so a missing one
+      # costs the repeat-callback guard and nothing else -- which is how restore
+      # behaved before the column existed anyway. Writing to it regardless would
+      # raise, and the app reports a restore as successful without reading the
+      # response, so the customer would be told "Restored!" over a 500.
+      def dedup_available?
+        PurchaseIntent.column_names.include?("restored_transaction_id")
+      end
     end
   end
 end

data/lib/generators/ruby_native/iap_generator.rb

@@ -8,13 +8,28 @@ module RubyNative
 
       source_root File.expand_path("templates", __dir__)
 
+      # Must increment within a single run, or the second migration below collides
+      # with the first on a bare `Time.now` timestamp.
       def self.next_migration_number(dirname)
-        Time.now.utc.strftime("%Y%m%d%H%M%S")
+        ActiveRecord::Migration.next_migration_number(current_migration_number(dirname) + 1)
       end
 
-      def copy_migration
+      # Re-running this generator on an app that already has the first migration
+      # reports it identical and creates only what is missing, so it doubles as
+      # the upgrade path.
+      #
+      # That rests on `create_ruby_native_purchase_intents.rb` never changing.
+      # Rails compares the template against the copy the app already has, and
+      # only calls it identical when they match byte for byte; edit one character
+      # and it reports a conflict instead, which raises and aborts the run before
+      # the migrations added after it are copied. So an app upgrading would get
+      # none of them. Add a new template alongside it rather than editing it --
+      # `iap_generator_test.rb` fails if that file is touched.
+      def copy_migrations
         migration_template "create_ruby_native_purchase_intents.rb",
           "db/migrate/create_ruby_native_purchase_intents.rb"
+        migration_template "add_restored_transaction_id_to_ruby_native_purchase_intents.rb",
+          "db/migrate/add_restored_transaction_id_to_ruby_native_purchase_intents.rb"
       end
 
       def print_next_steps

data/lib/generators/ruby_native/install_generator.rb

@@ -40,6 +40,7 @@ module RubyNative
         say "       <meta name=\"viewport\" content=\"width=device-width,initial-scale=1,viewport-fit=cover\">"
         say "  4. Add to your layout <body>:"
         say "       <%= native_tabs_tag %>"
+        say "       <%= native_identity_tag(current_user&.id) %>"
         say "  5. Preview on your device:"
         say "       bundle exec ruby_native preview"
         say ""

data/lib/generators/ruby_native/templates/add_restored_transaction_id_to_ruby_native_purchase_intents.rb

@@ -0,0 +1,5 @@
+class AddRestoredTransactionIdToRubyNativePurchaseIntents < ActiveRecord::Migration[7.1]
+  def change
+    add_column :ruby_native_purchase_intents, :restored_transaction_id, :string
+  end
+end

data/lib/ruby_native/cli/deploy.rb

@@ -79,17 +79,22 @@ module RubyNative
       end
 
       def fetch_latest_build(app_id)
-        uri = URI("#{HOST}/api/v1/apps/#{app_id}/builds/latest")
+        # Platform-scoped, or --android --if-needed compares against the
+        # latest iOS build and skips a build Android never got.
+        uri = URI("#{HOST}/api/v1/apps/#{app_id}/builds/latest?platform=#{@platform}")
         req = Net::HTTP::Get.new(uri)
         req["Authorization"] = "Token #{Credentials.token}"
 
         response = make_request(uri, req)
 
         case response
-        when Net::HTTPSuccess
-          JSON.parse(response.body)
+        # Before HTTPSuccess, its superclass: a 204 has no body to parse, and
+        # matching Success first crashed --if-needed before an app's first
+        # successful build.
         when Net::HTTPNoContent
           nil
+        when Net::HTTPSuccess
+          JSON.parse(response.body)
         when Net::HTTPUnauthorized
           raise TokenExpiredError
         else

data/lib/ruby_native/cli/login.rb

@@ -1,3 +1,4 @@
+require "digest"
 require "securerandom"
 require "net/http"
 require "uri"
@@ -13,14 +14,18 @@ module RubyNative
       end
 
       def run
-        code = SecureRandom.hex(20)
-        url = "#{HOST}/cli/session/new?code=#{code}"
+        # Only the hash goes through the browser. Claiming the token needs this
+        # verifier, which never leaves the machine, so a copy of the authorize
+        # URL is not enough for anyone else to collect the session.
+        verifier = SecureRandom.hex(32)
+        challenge = Digest::SHA256.hexdigest(verifier)
+        url = "#{HOST}/cli/session/new?challenge=#{challenge}"
 
         puts "Opening browser to authorize..."
         open_browser(url)
         puts "Waiting for authorization..."
 
-        token = poll_for_token(code)
+        token = poll_for_token(verifier)
 
         if token
           Credentials.save(token)
@@ -44,8 +49,8 @@ module RubyNative
         end
       end
 
-      def poll_for_token(code)
-        uri = URI("#{HOST}/cli/session/poll?code=#{code}")
+      def poll_for_token(verifier)
+        uri = URI("#{HOST}/cli/session/poll?verifier=#{verifier}")
         attempts = 0
         max_attempts = 60
 

data/lib/ruby_native/cli/preview.rb

@@ -165,25 +165,20 @@ module RubyNative
         require "rqrcode"
 
         qr = RQRCode::QRCode.new(url, level: :l)
-        modules = qr.modules
-        size = modules.length
-        quiet_h = 4
-        quiet_v = 2
-
-        dark = "██"
-        light = "  "
 
+        # Painted as background colors, not block glyphs: a glyph takes the terminal's
+        # foreground color, which prints the code inverted on a dark theme, and Android
+        # (unlike iOS) will not decode an inverted code. Truecolor rather than any
+        # palette index, because terminals remap both the 16 basic colors and the 256
+        # cube, which is how "white" came out as a mid-gray in one terminal and as
+        # orange in another. 24-bit RGB is a literal value with no lookup, so the
+        # contrast and the polarity are the same everywhere.
         puts ""
-        (0...(size + quiet_v * 2)).each do |r|
-          line = +""
-          (0...(size + quiet_h * 2)).each do |c|
-            mr = r - quiet_v
-            mc = c - quiet_h
-            inside = mr >= 0 && mr < size && mc >= 0 && mc < size
-            line << (inside && modules[mr][mc] ? dark : light)
-          end
-          puts line
-        end
+        print qr.as_ansi(
+          light: "\e[48;2;255;255;255m",
+          dark: "\e[48;2;0;0;0m",
+          quiet_zone_size: 4
+        )
         puts ""
         puts url
         puts ""

data/lib/ruby_native/helper.rb

@@ -26,6 +26,18 @@ module RubyNative
       tag.div(data: { native_push: true }, hidden: true)
     end
 
+    def native_identity_tag(value)
+      tag.div(data: { native_identity: native_identity_token(value) }, hidden: true)
+    end
+
+    # HMAC, not a bare digest: a digest of a small integer id space is enumerable,
+    # so the DOM would effectively still carry the id it was meant to hide.
+    def native_identity_token(value)
+      parts = Array(value).compact
+      return "" if parts.empty?
+      OpenSSL::HMAC.hexdigest("SHA256", Rails.application.secret_key_base, parts.join(":"))[0, 16]
+    end
+
     def native_back_button_tag(text = nil, **options)
       options[:class] = [options[:class], "native-back-button"].compact.join(" ")
       default_content = tag.svg(
@@ -85,6 +97,89 @@ module RubyNative
       tag.div(data: data, hidden: true)
     end
 
+    # No :root. Landing a page as the tab root — dropping what is behind it —
+    # is a distinct operation from replacing the current entry, and no shell
+    # implements it: every one of them mapped :root onto replace, which unwinds
+    # nothing. Offering the word without the behavior is worse than not
+    # offering it, so it is out until a shell can honor it.
+    ACTIONS = %w[push replace].freeze
+
+    # Validates a push/replace landing value. Returns the value as a string,
+    # raises otherwise.
+    def self.validate_action(value, label: "action")
+      value = value.to_s
+      unless ACTIONS.include?(value)
+        raise ArgumentError,
+          "#{label} must be :push or :replace, got #{value.inspect}"
+      end
+      value
+    end
+
+    # The landing intents a page can declare about itself. Only :root so far.
+    # :modal is the obvious second member (both shells hardcode a /new + /edit
+    # rule today that no app can reach), which is why this is a vocabulary
+    # rather than a boolean tag.
+    PRESENTATION_INTENTS = %w[root].freeze
+
+    # Declares that this page is a root: it lands with nothing behind it, and no
+    # back affordance, wherever it lands.
+    #
+    #   <%= native_presentation_tag :root %>
+    #
+    # Emits the fact on two channels, because the shells need it at two
+    # different moments and neither channel reaches both:
+    #
+    # 1. A `data-native-presentation` element, reported with every other signal
+    #    once the page has rendered. This is what Normal Mode reads, and Normal
+    #    Mode can act on it late: it has no push stack, so suppressing back is
+    #    not a navigation and nothing refetches.
+    #
+    # 2. A `Native-Presentation` response header. Advanced Mode has to decide
+    #    before the navigation commits, or it pushes and then visibly corrects
+    #    itself. On a form submission Turbo has already fetched the destination
+    #    by the time it proposes the visit, so the header is readable at
+    #    `turbo:before-fetch-response` — before the proposal — and the header is
+    #    the only part of that response readable synchronously, since the body
+    #    arrives as a promise that consuming would take from Turbo.
+    #
+    # Nothing is declared at the origin. Both channels ride the response for the
+    # page itself, so a redirect chain carries the intent to wherever it actually
+    # lands rather than to wherever the link pointed.
+    #
+    # In Advanced Mode this takes effect before the navigation commits when the
+    # page arrives from a form submission, because that is the only case where
+    # Turbo has already fetched the destination by the time it proposes the
+    # visit. A link tap, a deep link and a cold boot are proposed before anything
+    # is fetched, so those fall back to the element and the shell corrects after
+    # the page renders. Normal Mode always uses the element.
+    #
+    # Do not call this inside a `cache` block. On a cache hit the element comes
+    # back from the cache and the header is never set, which silently leaves
+    # Advanced Mode with only the slower path.
+    def native_presentation_tag(presentation)
+      value = presentation.to_s
+      unless PRESENTATION_INTENTS.include?(value)
+        raise ArgumentError,
+          "native_presentation_tag must be #{PRESENTATION_INTENTS.map { |i| ":#{i}" }.join(" or ")}, " \
+          "got #{value.inspect}"
+      end
+
+      # `respond_to?` rather than a nil check alone: ActionView forwards it to
+      # the controller for the delegated methods, so a view rendered without one
+      # answers false here instead of raising a DelegationError.
+      if respond_to?(:response) && response
+        if Rails.env.development? && response.committed?
+          Rails.logger.warn(
+            "[ruby_native] native_presentation_tag rendered after the response was committed, " \
+            "so Advanced Mode will not see it before the navigation commits."
+          )
+        end
+        response.headers["Native-Presentation"] = value
+      end
+
+      tag.div(data: { native_presentation: value }, hidden: true)
+    end
+
     def native_navbar_tag(title = nil, pull_to_refresh: true, &block)
       builder = NavbarBuilder.new(self)
       capture(builder, &block) if block
@@ -212,8 +307,9 @@ module RubyNative
       # web side) so it works even where embedded web views don't support
       # `navigator.share`. Icons follow the same rules as the other navbar
       # buttons: `icon:` applies to every platform and `icons:` ({ ios:,
-      # android: }) overrides per platform.
-      def share_button(url: nil, title: "Share", icon: "square.and.arrow.up", icons: nil, position: :trailing)
+      # android: }) overrides per platform. Android defaults to the Material
+      # `share` glyph; the SF Symbol default renders as missing there.
+      def share_button(url: nil, title: "Share", icon: "square.and.arrow.up", icons: { android: "share" }, position: :trailing)
         resolved = RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: @context.try(:native_platform))
         data = { native_button: "", native_share: "" }
         data[:native_title] = title if title
@@ -254,13 +350,14 @@ module RubyNative
         @items = []
       end
 
-      def item(title, href: nil, click: nil, icon: nil, icons: nil, selected: false)
+      def item(title, href: nil, click: nil, icon: nil, icons: nil, selected: false, action: nil)
         resolved = RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: @context.try(:native_platform))
         data = { native_menu_item: "", native_title: title }
         data[:native_href] = href if href
         data[:native_click] = click if click
         data[:native_icon] = resolved if resolved
         data[:native_selected] = "" if selected
+        data[:native_action] = RubyNative::Helper.validate_action(action) if action
         add(@context.tag.div(data: data))
       end
 
@@ -268,7 +365,7 @@ module RubyNative
       # opens the platform share sheet for `url:` (defaults to the current
       # page on the web side). Icons follow the same `icon:`/`icons:` rules
       # as the other menu items.
-      def share_item(title = "Share", url: nil, icon: "square.and.arrow.up", icons: nil, selected: false)
+      def share_item(title = "Share", url: nil, icon: "square.and.arrow.up", icons: { android: "share" }, selected: false)
         resolved = RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: @context.try(:native_platform))
         data = { native_menu_item: "", native_title: title, native_share: "" }
         data[:native_share_url] = url if url

data/lib/ruby_native/oauth_middleware.rb

@@ -2,6 +2,14 @@ module RubyNative
   class OAuthMiddleware
     COOKIE_NAME = "_ruby_native_oauth"
 
+    # The scheme the native app registers is always "rubynative-" plus its bundle
+    # identifier with dots as dashes, built by OAuthManager.callbackScheme on both
+    # platforms. The scheme arrives as a request param and ends up as the target of
+    # the redirect carrying the session token, so anything that could name a
+    # different origin -- a colon, slash, dot, "@", or percent escape -- is
+    # rejected outright rather than sanitized.
+    CALLBACK_SCHEME = /\Arubynative-[a-z0-9][a-z0-9_-]{0,127}\z/i
+
     def initialize(app)
       @app = app
     end
@@ -10,7 +18,7 @@ module RubyNative
       request = ActionDispatch::Request.new(env)
       on_oauth_path = oauth_path?(request)
       started_native_oauth = on_oauth_path && request.params["ruby_native"] == "1"
-      callback_scheme = request.params["callback_scheme"] if started_native_oauth
+      callback_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
 
       status, headers, body = @app.call(env)
 
@@ -23,7 +31,7 @@ module RubyNative
         set_cookie(headers, callback_scheme)
       end
 
-      stored_scheme = read_cookie(request)
+      stored_scheme = permitted_scheme(read_cookie(request))
 
       if stored_scheme && redirect?(status)
         location = headers["location"] || headers["Location"]
@@ -70,6 +78,20 @@ module RubyNative
 
     private
 
+    # Returns the scheme only when it matches CALLBACK_SCHEME. A rejected scheme
+    # reads as "no native app asked for this", so the flow falls through as an
+    # ordinary web sign-in and no token is ever minted.
+    def permitted_scheme(value)
+      return nil if value.blank?
+      return value if value.match?(CALLBACK_SCHEME)
+
+      Rails.logger.warn do
+        "[RubyNative] Rejected OAuth callback_scheme #{value.to_s.truncate(64).inspect}: " \
+          "expected the app's own rubynative-<bundle-id> scheme"
+      end
+      nil
+    end
+
     def oauth_path?(request)
       oauth_paths.any? { |p| request.path == p }
     end

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.11.1"
+  VERSION = "0.12.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.11.1
+  version: 0.12.0
 platform: ruby
 authors:
 - Joe Masilotti
@@ -86,6 +86,7 @@ files:
 - exe/ruby_native
 - lib/generators/ruby_native/iap_generator.rb
 - lib/generators/ruby_native/install_generator.rb
+- lib/generators/ruby_native/templates/add_restored_transaction_id_to_ruby_native_purchase_intents.rb
 - lib/generators/ruby_native/templates/create_ruby_native_purchase_intents.rb
 - lib/generators/ruby_native/templates/ruby_native.yml
 - lib/ruby_native.rb