ruby_native 0.11.2 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17263e207966bb624e15f4fc93399c2cfb28b15d9810cffa563cfa24b5a8b725
-  data.tar.gz: 6e7b9c3de16b19ef85ec7a614b207cf22e5d39f1517e5d9467950d315586660b
+  metadata.gz: b7e336fc49236887320d23ecfc7718229370029d7a2b7981df2e888fd427e853
+  data.tar.gz: 16ca5ee3894370636c36193591a135c3829c3a9bb1449065994e04fc09be6b47
 SHA512:
-  metadata.gz: a9574b90d18f99866ee2d2c291475aeac0f4c7e57f8b15ea2c8cdc0aaa312818e2d7f5e1e5fa421e313e3f5214d36a314c975d56146b8d329660aed07aaab20c
-  data.tar.gz: 3c2da4697edaa56eb5194531352282c5c28aa1fa6c3c4edbd83d6a74da1f5d9a751e7175799244ad207741c73ecc4ba29a55a061cdcf563412bee7d9d21203fb
+  metadata.gz: 8039052ae6fe99f9a429564c534b9b78b1df59c5cfa9a4b0157dd3b606244d609666b360242ff25b2a9931511262bb933f0e1b668c6570ade89413dd4c058009
+  data.tar.gz: 5b3b966610654c7f0625b2ffdb4aa42f4cb0ecccf773f06a2795faea962b6e54db0324d246959a3436083c907e1cc6b8f208275718fb598ceef74f4d42e04afd

data/README.md

@@ -1,6 +1,6 @@
 # ruby_native
 
-[Ruby Native](https://rubynative.com) turns a Rails app into an iOS app, with Android in public beta. This gem is the Rails-side integration: view helpers, a YAML config file, endpoints auto-mounted at `/native`, and a CLI for previewing and deploying builds. Full docs, including the complete helper reference and config schema, live at [rubynative.com/docs](https://rubynative.com/docs).
+[Ruby Native](https://rubynative.com) turns a Rails app into iOS and Android apps. This gem is the Rails-side integration: view helpers, a YAML config file, endpoints auto-mounted at `/native`, and a CLI for previewing and deploying builds. Full docs, including the complete helper reference and config schema, live at [rubynative.com/docs](https://rubynative.com/docs).
 
 ## Installation
 

data/app/controllers/ruby_native/auth/start_controller.rb

@@ -9,9 +9,15 @@ module RubyNative
           return
         end
 
+        @callback_scheme = params[:callback_scheme].to_s
+
+        unless @callback_scheme.match?(OAuthMiddleware::CALLBACK_SCHEME)
+          head :bad_request
+          return
+        end
+
         oauth_paths = RubyNative.config&.dig(:auth, :oauth_paths) || []
         @oauth_path = oauth_paths.find { |p| p.end_with?(@provider) } || "/auth/#{@provider}"
-        @callback_scheme = params[:callback_scheme]
       end
     end
   end

data/app/controllers/ruby_native/iap/restores_controller.rb

@@ -7,37 +7,86 @@ module RubyNative
       skip_forgery_protection
 
       def create
-        customer_id = params[:customer_id]
-        return head :bad_request if customer_id.blank?
+        return head :bad_request if params[:customer_id].blank?
 
         transactions = Array(params[:signed_transactions])
         return head :bad_request if transactions.empty?
 
-        transactions.each do |signed_transaction|
-          transaction = decode_and_verify_jws(signed_transaction)
-
-          event = Event.new(
-            type: "subscription.created",
-            status: "active",
-            owner_token: customer_id,
-            product_id: transaction["productId"],
-            original_transaction_id: transaction["originalTransactionId"],
-            transaction_id: transaction["transactionId"],
-            purchase_date: parse_timestamp(transaction["purchaseDate"]),
-            expires_date: parse_timestamp(transaction["expiresDate"]),
-            environment: transaction["environment"]&.downcase,
-            notification_uuid: SecureRandom.uuid,
-            success_path: params[:success_path]
-          )
-
-          RubyNative.fire_subscription_callbacks(event)
-        end
+        transactions.each { |signed_transaction| restore(decode_and_verify_jws(signed_transaction)) }
 
         head :ok
       rescue VerificationError, JWT::DecodeError => e
         Rails.logger.warn "[RubyNative] Restore verification failed: #{e.message}"
         head :unprocessable_entity
       end
+
+      private
+
+      # The account being restored to comes from the purchase intent the
+      # transaction was made against, never from `customer_id` in the request. A
+      # signed transaction is only proof that Apple sold it, not proof of who is
+      # asking, so honoring a caller-supplied id let one purchased subscription
+      # be replayed to grant entitlement to any number of accounts.
+      def restore(transaction)
+        transaction_id = transaction["transactionId"]
+        intent = PurchaseIntent.find_by(uuid: transaction["appAccountToken"])
+
+        unless intent
+          Rails.logger.warn "[RubyNative] Ignoring restored transaction #{transaction_id.inspect}: " \
+            "no purchase intent matches its appAccountToken"
+          return
+        end
+
+        if params[:customer_id] != intent.customer_id
+          Rails.logger.warn "[RubyNative] Restoring transaction #{transaction_id.inspect} to " \
+            "#{intent.customer_id.inspect} from its purchase intent, not the requested " \
+            "#{params[:customer_id].inspect}"
+        end
+
+        # Apple reissues a transaction id on every renewal, so a restore of the
+        # same one is a repeat and must not fire the callback again.
+        return if dedup_available? && intent.restored_transaction_id == transaction_id
+
+        intent.update!(intent_attributes(transaction))
+
+        event = Event.new(
+          type: "subscription.created",
+          status: "active",
+          owner_token: intent.customer_id,
+          product_id: transaction["productId"],
+          original_transaction_id: transaction["originalTransactionId"],
+          transaction_id: transaction_id,
+          purchase_date: parse_timestamp(transaction["purchaseDate"]),
+          expires_date: parse_timestamp(transaction["expiresDate"]),
+          environment: transaction["environment"]&.downcase,
+          notification_uuid: SecureRandom.uuid,
+          success_path: params[:success_path]
+        )
+
+        RubyNative.fire_subscription_callbacks(event)
+      end
+
+      # A restore is the recovery path for a purchase whose completion POST never
+      # landed, so it settles the intent too. An unrecognized environment is
+      # dropped rather than raising on the enum.
+      def intent_attributes(transaction)
+        attributes = {status: :completed}
+        environment = transaction["environment"]&.downcase
+        attributes[:environment] = environment if PurchaseIntent.environments.key?(environment)
+        attributes[:restored_transaction_id] = transaction["transactionId"] if dedup_available?
+        attributes
+      end
+
+      # Deduping needs a column that arrives in a migration, and an app can be on
+      # this version of the gem before it has been run. Restoring to the right
+      # account is the part that matters and needs no column, so a missing one
+      # costs the repeat-callback guard and nothing else -- which is how restore
+      # behaved before the column existed anyway. Writing to it regardless would
+      # raise, and the app reports a restore as successful without reading the
+      # response, so the customer would be told "Restored!" over a 500.
+      def dedup_available?
+        PurchaseIntent.column_names.include?("restored_transaction_id")
+      end
     end
   end
 end

data/lib/generators/ruby_native/iap_generator.rb

@@ -8,13 +8,28 @@ module RubyNative
 
       source_root File.expand_path("templates", __dir__)
 
+      # Must increment within a single run, or the second migration below collides
+      # with the first on a bare `Time.now` timestamp.
       def self.next_migration_number(dirname)
-        Time.now.utc.strftime("%Y%m%d%H%M%S")
+        ActiveRecord::Migration.next_migration_number(current_migration_number(dirname) + 1)
       end
 
-      def copy_migration
+      # Re-running this generator on an app that already has the first migration
+      # reports it identical and creates only what is missing, so it doubles as
+      # the upgrade path.
+      #
+      # That rests on `create_ruby_native_purchase_intents.rb` never changing.
+      # Rails compares the template against the copy the app already has, and
+      # only calls it identical when they match byte for byte; edit one character
+      # and it reports a conflict instead, which raises and aborts the run before
+      # the migrations added after it are copied. So an app upgrading would get
+      # none of them. Add a new template alongside it rather than editing it --
+      # `iap_generator_test.rb` fails if that file is touched.
+      def copy_migrations
         migration_template "create_ruby_native_purchase_intents.rb",
           "db/migrate/create_ruby_native_purchase_intents.rb"
+        migration_template "add_restored_transaction_id_to_ruby_native_purchase_intents.rb",
+          "db/migrate/add_restored_transaction_id_to_ruby_native_purchase_intents.rb"
       end
 
       def print_next_steps

data/lib/generators/ruby_native/install_generator.rb

@@ -40,6 +40,7 @@ module RubyNative
         say "       <meta name=\"viewport\" content=\"width=device-width,initial-scale=1,viewport-fit=cover\">"
         say "  4. Add to your layout <body>:"
         say "       <%= native_tabs_tag %>"
+        say "       <%= native_identity_tag(current_user&.id) %>"
         say "  5. Preview on your device:"
         say "       bundle exec ruby_native preview"
         say ""

data/lib/generators/ruby_native/templates/add_restored_transaction_id_to_ruby_native_purchase_intents.rb

@@ -0,0 +1,5 @@
+class AddRestoredTransactionIdToRubyNativePurchaseIntents < ActiveRecord::Migration[7.1]
+  def change
+    add_column :ruby_native_purchase_intents, :restored_transaction_id, :string
+  end
+end

data/lib/ruby_native/cli/deploy.rb

@@ -79,17 +79,22 @@ module RubyNative
       end
 
       def fetch_latest_build(app_id)
-        uri = URI("#{HOST}/api/v1/apps/#{app_id}/builds/latest")
+        # Platform-scoped, or --android --if-needed compares against the
+        # latest iOS build and skips a build Android never got.
+        uri = URI("#{HOST}/api/v1/apps/#{app_id}/builds/latest?platform=#{@platform}")
         req = Net::HTTP::Get.new(uri)
         req["Authorization"] = "Token #{Credentials.token}"
 
         response = make_request(uri, req)
 
         case response
-        when Net::HTTPSuccess
-          JSON.parse(response.body)
+        # Before HTTPSuccess, its superclass: a 204 has no body to parse, and
+        # matching Success first crashed --if-needed before an app's first
+        # successful build.
         when Net::HTTPNoContent
           nil
+        when Net::HTTPSuccess
+          JSON.parse(response.body)
         when Net::HTTPUnauthorized
           raise TokenExpiredError
         else

data/lib/ruby_native/cli/login.rb

@@ -1,3 +1,4 @@
+require "digest"
 require "securerandom"
 require "net/http"
 require "uri"
@@ -13,14 +14,18 @@ module RubyNative
       end
 
       def run
-        code = SecureRandom.hex(20)
-        url = "#{HOST}/cli/session/new?code=#{code}"
+        # Only the hash goes through the browser. Claiming the token needs this
+        # verifier, which never leaves the machine, so a copy of the authorize
+        # URL is not enough for anyone else to collect the session.
+        verifier = SecureRandom.hex(32)
+        challenge = Digest::SHA256.hexdigest(verifier)
+        url = "#{HOST}/cli/session/new?challenge=#{challenge}"
 
         puts "Opening browser to authorize..."
         open_browser(url)
         puts "Waiting for authorization..."
 
-        token = poll_for_token(code)
+        token = poll_for_token(verifier)
 
         if token
           Credentials.save(token)
@@ -44,8 +49,8 @@ module RubyNative
         end
       end
 
-      def poll_for_token(code)
-        uri = URI("#{HOST}/cli/session/poll?code=#{code}")
+      def poll_for_token(verifier)
+        uri = URI("#{HOST}/cli/session/poll?verifier=#{verifier}")
         attempts = 0
         max_attempts = 60
 

data/lib/ruby_native/cli/preview.rb

@@ -34,8 +34,22 @@ module RubyNative
 
         puts "Rails server is reachable at #{@upstream}, but #{CONFIG_PATH} returned #{response.code}."
         puts ""
-        puts "Make sure the ruby_native gem is installed and mounted:"
-        puts "  https://rubynative.com/docs/install"
+
+        # 404 is what an unmounted engine returns; any other code means the app
+        # answered, so the mount is not the thing to go re-verify.
+        case response
+        when Net::HTTPNotFound
+          puts "Make sure the ruby_native gem is installed and mounted:"
+          puts "  https://rubynative.com/docs/setup"
+        when Net::HTTPRedirection
+          puts "Something redirected the request to #{response["location"]}."
+          puts "Look for a force_ssl setting or a before_action that catches this path."
+        else
+          puts "Your Rails app returned an error. Open #{@upstream} in a browser and fix"
+          puts "what it reports, then try again. Pending migrations are a common cause:"
+          puts ""
+          puts "  bin/rails db:migrate"
+        end
         exit 1
       rescue Errno::ECONNREFUSED
         if @url
@@ -165,25 +179,20 @@ module RubyNative
         require "rqrcode"
 
         qr = RQRCode::QRCode.new(url, level: :l)
-        modules = qr.modules
-        size = modules.length
-        quiet_h = 4
-        quiet_v = 2
-
-        dark = "██"
-        light = "  "
 
+        # Painted as background colors, not block glyphs: a glyph takes the terminal's
+        # foreground color, which prints the code inverted on a dark theme, and Android
+        # (unlike iOS) will not decode an inverted code. Truecolor rather than any
+        # palette index, because terminals remap both the 16 basic colors and the 256
+        # cube, which is how "white" came out as a mid-gray in one terminal and as
+        # orange in another. 24-bit RGB is a literal value with no lookup, so the
+        # contrast and the polarity are the same everywhere.
         puts ""
-        (0...(size + quiet_v * 2)).each do |r|
-          line = +""
-          (0...(size + quiet_h * 2)).each do |c|
-            mr = r - quiet_v
-            mc = c - quiet_h
-            inside = mr >= 0 && mr < size && mc >= 0 && mc < size
-            line << (inside && modules[mr][mc] ? dark : light)
-          end
-          puts line
-        end
+        print qr.as_ansi(
+          light: "\e[48;2;255;255;255m",
+          dark: "\e[48;2;0;0;0m",
+          quiet_zone_size: 4
+        )
         puts ""
         puts url
         puts ""

data/lib/ruby_native/helper.rb

@@ -26,6 +26,18 @@ module RubyNative
       tag.div(data: { native_push: true }, hidden: true)
     end
 
+    def native_identity_tag(value)
+      tag.div(data: { native_identity: native_identity_token(value) }, hidden: true)
+    end
+
+    # HMAC, not a bare digest: a digest of a small integer id space is enumerable,
+    # so the DOM would effectively still carry the id it was meant to hide.
+    def native_identity_token(value)
+      parts = Array(value).compact
+      return "" if parts.empty?
+      OpenSSL::HMAC.hexdigest("SHA256", Rails.application.secret_key_base, parts.join(":"))[0, 16]
+    end
+
     def native_back_button_tag(text = nil, **options)
       options[:class] = [options[:class], "native-back-button"].compact.join(" ")
       default_content = tag.svg(
@@ -209,6 +221,48 @@ module RubyNative
       tag.div(data: { native_review: true }, hidden: true)
     end
 
+    TOAST_APPEARANCES = %w[inverted system].freeze
+
+    # Shows a transient native toast above all app chrome, including the nav
+    # bar. The signal is consumed the moment it fires, so a cached page
+    # restored by back navigation cannot re-toast. Renders nothing visible on
+    # the web; keep your web-styled flash for browsers.
+    #
+    #   <%= native_toast_tag flash[:notice] %>
+    #
+    # A blank message renders nothing, so the flash one-liner needs no guard.
+    # Icons follow the same `icon:`/`icons:` rules as the navbar; the default
+    # is a per-platform checkmark and `icon: false` hides it. `appearance:` is
+    # :inverted (flips the theme so the toast always pops) or :system (matches
+    # it).
+    def native_toast_tag(message, icon: nil, icons: nil, duration: 4, appearance: :inverted)
+      return "".html_safe if message.blank?
+
+      appearance = appearance.to_s
+      unless TOAST_APPEARANCES.include?(appearance)
+        raise ArgumentError,
+          "appearance must be #{TOAST_APPEARANCES.map { |a| ":#{a}" }.join(" or ")}, " \
+          "got #{appearance.inspect}"
+      end
+
+      # An absent icon attribute means "use the default" to the shell (the JS
+      # API omits it), so `icon: false` emits an empty value to mean "none".
+      platform = try(:native_platform)
+      resolved = if icon == false
+        ""
+      else
+        RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: platform) ||
+          (platform == "android" ? "check_circle" : "checkmark.circle.fill")
+      end
+
+      data = { native_toast: "", native_toast_message: message }
+      data[:native_toast_icon] = resolved
+      data[:native_toast_duration] = duration
+      data[:native_toast_appearance] = appearance
+
+      tag.div(data: data, hidden: true)
+    end
+
     # Picks the right icon name for the current native platform. Accepts the
     # single `icon:` form (applied to every platform) and/or the `icons:` hash
     # form (`{ ios: "...", android: "..." }`). When both are given, a matching
@@ -295,8 +349,9 @@ module RubyNative
       # web side) so it works even where embedded web views don't support
       # `navigator.share`. Icons follow the same rules as the other navbar
       # buttons: `icon:` applies to every platform and `icons:` ({ ios:,
-      # android: }) overrides per platform.
-      def share_button(url: nil, title: "Share", icon: "square.and.arrow.up", icons: nil, position: :trailing)
+      # android: }) overrides per platform. Android defaults to the Material
+      # `share` glyph; the SF Symbol default renders as missing there.
+      def share_button(url: nil, title: "Share", icon: "square.and.arrow.up", icons: { android: "share" }, position: :trailing)
         resolved = RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: @context.try(:native_platform))
         data = { native_button: "", native_share: "" }
         data[:native_title] = title if title
@@ -352,7 +407,7 @@ module RubyNative
       # opens the platform share sheet for `url:` (defaults to the current
       # page on the web side). Icons follow the same `icon:`/`icons:` rules
       # as the other menu items.
-      def share_item(title = "Share", url: nil, icon: "square.and.arrow.up", icons: nil, selected: false)
+      def share_item(title = "Share", url: nil, icon: "square.and.arrow.up", icons: { android: "share" }, selected: false)
         resolved = RubyNative::Helper.resolve_icon(icon: icon, icons: icons, platform: @context.try(:native_platform))
         data = { native_menu_item: "", native_title: title, native_share: "" }
         data[:native_share_url] = url if url

data/lib/ruby_native/oauth_middleware.rb

@@ -2,6 +2,14 @@ module RubyNative
   class OAuthMiddleware
     COOKIE_NAME = "_ruby_native_oauth"
 
+    # The scheme the native app registers is always "rubynative-" plus its bundle
+    # identifier with dots as dashes, built by OAuthManager.callbackScheme on both
+    # platforms. The scheme arrives as a request param and ends up as the target of
+    # the redirect carrying the session token, so anything that could name a
+    # different origin -- a colon, slash, dot, "@", or percent escape -- is
+    # rejected outright rather than sanitized.
+    CALLBACK_SCHEME = /\Arubynative-[a-z0-9][a-z0-9_-]{0,127}\z/i
+
     def initialize(app)
       @app = app
     end
@@ -10,7 +18,7 @@ module RubyNative
       request = ActionDispatch::Request.new(env)
       on_oauth_path = oauth_path?(request)
       started_native_oauth = on_oauth_path && request.params["ruby_native"] == "1"
-      callback_scheme = request.params["callback_scheme"] if started_native_oauth
+      callback_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
 
       status, headers, body = @app.call(env)
 
@@ -23,7 +31,7 @@ module RubyNative
         set_cookie(headers, callback_scheme)
       end
 
-      stored_scheme = read_cookie(request)
+      stored_scheme = permitted_scheme(read_cookie(request))
 
       if stored_scheme && redirect?(status)
         location = headers["location"] || headers["Location"]
@@ -70,6 +78,20 @@ module RubyNative
 
     private
 
+    # Returns the scheme only when it matches CALLBACK_SCHEME. A rejected scheme
+    # reads as "no native app asked for this", so the flow falls through as an
+    # ordinary web sign-in and no token is ever minted.
+    def permitted_scheme(value)
+      return nil if value.blank?
+      return value if value.match?(CALLBACK_SCHEME)
+
+      Rails.logger.warn do
+        "[RubyNative] Rejected OAuth callback_scheme #{value.to_s.truncate(64).inspect}: " \
+          "expected the app's own rubynative-<bundle-id> scheme"
+      end
+      nil
+    end
+
     def oauth_path?(request)
       oauth_paths.any? { |p| request.path == p }
     end

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.11.2"
+  VERSION = "0.12.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.11.2
+  version: 0.12.1
 platform: ruby
 authors:
 - Joe Masilotti
@@ -86,6 +86,7 @@ files:
 - exe/ruby_native
 - lib/generators/ruby_native/iap_generator.rb
 - lib/generators/ruby_native/install_generator.rb
+- lib/generators/ruby_native/templates/add_restored_transaction_id_to_ruby_native_purchase_intents.rb
 - lib/generators/ruby_native/templates/create_ruby_native_purchase_intents.rb
 - lib/generators/ruby_native/templates/ruby_native.yml
 - lib/ruby_native.rb