ruby_native 0.14.2 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50767dda7ff4152200308b0a1fedfe0718a37f2dc44d30a826c2a5002931b466
-  data.tar.gz: 389fca631075081cd61d842992cf656ce86869d49b1edce7dd4fcf00b21893df
+  metadata.gz: e8d87be28530140900677b188eb358c7a1dedaa5966760494cd714d58f988017
+  data.tar.gz: 6b2842f30c59244680a0b6a853d9c43617c33dda0cb1232089159fdc06fbf757
 SHA512:
-  metadata.gz: 8c6e2010a14b01628306fc6be5c22168a1f6077276d98ccaed5c96c271c9cdf9b8cf101719a2458cfb1fe844211ef3fc1845ebc7eb8b02a5a0ed168bbe59b4da
-  data.tar.gz: 53f833324974af66b48e44caec11ba90b259cb40e32a0ff670b37b92ca02f887f20ebe18a415fa731f390ae9a344647e43580173c9c27250dea86d7060bc46fc
+  metadata.gz: 79c71e7a97da93357aa8e927a41dbdd5742919dcfd9bdfddc7b2d0e215c37489bacfd6b3cdf77b2b1b86e13f0a081777830c732d0ebbacc52398a8026609ff05
+  data.tar.gz: 1d5946a4083783f961363b05e61f3e3c62909d60c90108cc4e67594149a559fa62810507dd4720ea67fb9cb7e6c2a8c0e7198ed0593b0d7fdea140afc1145476

data/lib/generators/ruby_native/templates/ruby_native.yml

@@ -69,6 +69,9 @@ appearance:
   #     foreground_color: "#FFFFFF"
   #   tab_bar:
   #     background_color: "#1E293B"
+  #     # Icon and label color. Defaults to the theme's, with tint_color on the
+  #     # selected tab. Set this and unselected tabs dim to 60% of it.
+  #     foreground_color: "#FFFFFF"
 
   # Show a launch splash while the first screen loads. It holds your launch icon
   # and background_color in frame, with a spinner, until the web content paints.

data/lib/ruby_native/helper.rb

@@ -230,6 +230,13 @@ module RubyNative
       tag.div(data: { native_overscroll_top: top, native_overscroll_bottom: bottom || top }, hidden: true)
     end
 
+    # Hides the iOS keyboard toolbar (the previous/next/Done bar) on this page.
+    # Page-level: the toolbar belongs to the web view, not to individual fields.
+    def native_keyboard_tag(toolbar: false)
+      return "".html_safe if toolbar
+      tag.div(data: { native_keyboard_toolbar: false }, hidden: true)
+    end
+
     def native_haptic_data(feedback = :success, **data)
       feedback = feedback.to_s
       feedback = "success" if feedback.empty?

data/lib/ruby_native/oauth_middleware.rb

@@ -18,7 +18,7 @@ module RubyNative
       request = ActionDispatch::Request.new(env)
       on_oauth_path = oauth_path?(request)
       started_native_oauth = on_oauth_path && request.params["ruby_native"] == "1"
-      callback_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
+      param_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
 
       status, headers, body = @app.call(env)
 
@@ -26,27 +26,27 @@ module RubyNative
         relax_cookie_samesite!(headers)
       end
 
-      if started_native_oauth && callback_scheme.present? && redirect?(status)
+      if started_native_oauth && param_scheme.present? && redirect?(status)
         Rails.logger.debug { "[RubyNative] OAuth started for #{request.path}, setting tracking cookie" }
-        set_cookie(headers, callback_scheme)
+        set_cookie(headers, param_scheme)
       end
 
-      stored_scheme = permitted_scheme(read_cookie(request))
+      # On a start request the param names the app asking right now, so a stale
+      # cookie from another app on the same domain must never win.
+      callback_scheme = started_native_oauth ? param_scheme : permitted_scheme(read_cookie(request))
 
-      if stored_scheme && redirect?(status)
+      if callback_scheme && redirect?(status)
         location = headers["location"] || headers["Location"]
 
         if auth_failure?(location)
           Rails.logger.info { "[RubyNative] OAuth failed, redirecting to native app" }
-          delete_cookie(headers)
-          return redirect_to_native(stored_scheme, error: true)
+          return redirect_to_native(callback_scheme, error: true)
         end
 
         if internal_redirect?(request, location)
           token = build_token(headers, location)
           Rails.logger.info { "[RubyNative] OAuth succeeded, redirecting to native app" }
-          delete_cookie(headers)
-          return redirect_to_native(stored_scheme, token: token)
+          return redirect_to_native(callback_scheme, token: token)
         end
       end
 
@@ -116,8 +116,14 @@ module RubyNative
       nil
     end
 
-    def delete_cookie(headers)
-      Rack::Utils.delete_set_cookie_header!(headers, COOKIE_NAME, path: "/")
+    # Attributes must match set_cookie or browsers keep the original cookie.
+    def expire_cookie(headers)
+      headers["set-cookie"] = Rack::Utils.delete_set_cookie_header(COOKIE_NAME, {
+        path: "/",
+        httponly: true,
+        secure: true,
+        same_site: :none
+      })
     end
 
     def verifier
@@ -133,16 +139,12 @@ module RubyNative
     # breaks OmniAuth's state verification. Relax existing cookies
     # to SameSite=None so the session cookie survives Apple's callback.
     def relax_cookie_samesite!(headers)
-      raw = headers["set-cookie"]
-      return unless raw
-
-      cookies = raw.is_a?(Array) ? raw : raw.split("\n")
-      headers["set-cookie"] = cookies.map { |cookie|
+      SetCookieHeader.rewrite!(headers) do |cookie|
         next cookie unless cookie.match?(/SameSite=Lax/i)
         cookie.gsub(/SameSite=Lax/i, "SameSite=None").then { |c|
           c.include?("Secure") ? c : "#{c}; Secure"
         }
-      }.join("\n")
+      end
     end
 
     def redirect?(status)
@@ -165,23 +167,22 @@ module RubyNative
     end
 
     def build_token(headers, redirect_url)
-      raw_cookies = headers["set-cookie"] || headers["Set-Cookie"]
-      cookies = case raw_cookies
-      when String then raw_cookies.split("\n")
-      when Array then raw_cookies
-      else []
-      end
+      # Restoring the tracking cookie into the app's cookie jar would hijack the
+      # next in-app redirect, so it never rides along in the token.
+      cookies = SetCookieHeader.read(headers).reject { |c| c.start_with?("#{COOKIE_NAME}=") }
 
       redirect_url = "/" if auth_start_path?(redirect_url)
 
-      Rails.logger.info { "[RubyNative] Captured #{cookies.size} cookies for token (raw type: #{raw_cookies.class})" }
+      Rails.logger.info { "[RubyNative] Captured #{cookies.size} cookies for token" }
 
       self.class.build_token(cookies: cookies, redirect_url: redirect_url)
     end
 
     def redirect_to_native(callback_scheme, token: nil, error: false)
       query = error ? "error=true" : "token=#{CGI.escape(token)}"
-      [302, {"location" => "#{callback_scheme}://auth/callback?#{query}"}, [""]]
+      headers = {"location" => "#{callback_scheme}://auth/callback?#{query}"}
+      expire_cookie(headers)
+      [302, headers, [""]]
     end
 
     def auth_start_path?(url)

data/lib/ruby_native/set_cookie_header.rb

@@ -0,0 +1,26 @@
+module RubyNative
+  # Rack 2 carries Set-Cookie as one newline joined String, Rack 3 as an Array
+  # of cookie strings. Rewrites must hand back whichever shape came in.
+  module SetCookieHeader
+    KEYS = ["set-cookie", "Set-Cookie"].freeze
+
+    module_function
+
+    def read(headers)
+      raw = KEYS.map { |key| headers[key] }.compact.first
+      case raw
+      when Array then raw
+      when String then raw.split("\n")
+      else []
+      end
+    end
+
+    def rewrite!(headers, &block)
+      key = KEYS.find { |k| headers[k] }
+      return unless key
+
+      rewritten = read(headers).map(&block)
+      headers[key] = headers[key].is_a?(Array) ? rewritten : rewritten.join("\n")
+    end
+  end
+end

data/lib/ruby_native/tunnel_cookie_middleware.rb

@@ -34,10 +34,9 @@ module RubyNative
     end
 
     def strip_cookie_domain!(headers)
-      raw = headers["set-cookie"]
-      cookies = raw.is_a?(Array) ? raw : raw.split("\n")
-      stripped = cookies.map { |cookie| cookie.gsub(/;\s*domain=[^;]*/i, "") }
-      headers["set-cookie"] = (stripped.length == 1) ? stripped.first : stripped
+      SetCookieHeader.rewrite!(headers) do |cookie|
+        cookie.gsub(/;\s*domain=[^;]*/i, "")
+      end
     end
   end
 end

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.14.2"
+  VERSION = "0.15.0"
 end

data/lib/ruby_native.rb

@@ -4,6 +4,7 @@ require "ruby_native/helper"
 require "ruby_native/native_version"
 require "ruby_native/native_detection"
 require "ruby_native/inertia_support"
+require "ruby_native/set_cookie_header"
 require "ruby_native/oauth_middleware"
 require "ruby_native/tunnel_cookie_middleware"
 require "ruby_native/iap/event"
@@ -181,17 +182,22 @@ module RubyNative
   # "callback" and send sign-in into a loop. The callback round-trip is handled
   # automatically by OAuthMiddleware's tracking cookie, so it never needs
   # listing. Drop any entry that is the "/callback" child of another listed
-  # path and warn, so a copied-in callback can't break native sign-in.
+  # path and warn, so a copied-in callback can't break native sign-in. The value
+  # is always written back as an array: a scalar in YAML fails the whole native
+  # config decode on both platforms.
   def self.normalize_oauth_paths
-    paths = Array(self.config.dig(:auth, :oauth_paths))
-    callbacks = paths.select { |path| paths.any? { |start| path == "#{start}/callback" } }
-    return if callbacks.empty?
+    auth = self.config[:auth]
+    return unless auth.is_a?(Hash) && auth.key?(:oauth_paths)
 
-    Rails.logger.warn(
-      "[RubyNative] Ignoring OAuth callback path(s) in config/ruby_native.yml " \
-      "(#{callbacks.join(", ")}). List only the authorize path; callbacks are handled automatically."
-    )
-    self.config[:auth][:oauth_paths] = paths - callbacks
+    paths = Array(auth[:oauth_paths])
+    callbacks = paths.select { |path| paths.any? { |start| path == "#{start}/callback" } }
+    if callbacks.any?
+      Rails.logger.warn(
+        "[RubyNative] Ignoring OAuth callback path(s) in config/ruby_native.yml " \
+        "(#{callbacks.join(", ")}). List only the authorize path; callbacks are handled automatically."
+      )
+    end
+    auth[:oauth_paths] = paths - callbacks
   end
 
   # Entries are path prefixes: "/pair/" links every URL under it. A leading

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.14.2
+  version: 0.15.0
 platform: ruby
 authors:
 - Joe Masilotti
@@ -109,6 +109,7 @@ files:
 - lib/ruby_native/native_version.rb
 - lib/ruby_native/oauth_middleware.rb
 - lib/ruby_native/screenshots/sign_in_helper.rb
+- lib/ruby_native/set_cookie_header.rb
 - lib/ruby_native/tunnel_cookie_middleware.rb
 - lib/ruby_native/version.rb
 homepage: https://rubynative.com