ruby_native 0.14.3 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20484032681be68def5c45552a5ac02502f3f3eaf63e69b7cc5fffbd785177cc
-  data.tar.gz: d6e34e9592f9ec3f4a14ad739c1f468c5f81d75784411742e2cd317a3c57a093
+  metadata.gz: e8d87be28530140900677b188eb358c7a1dedaa5966760494cd714d58f988017
+  data.tar.gz: 6b2842f30c59244680a0b6a853d9c43617c33dda0cb1232089159fdc06fbf757
 SHA512:
-  metadata.gz: e34b666cebd831fc7ed1946090dc68562807a1bbc524f86781af3b56f46f318394104e745270ab7914778ccf471caeb495b92912fa62152760b7bcf1d1d0e912
-  data.tar.gz: 5de7b5d12c50b1bb6c48bbdf333847da2b4ae0b20730beb4c3f3bd7059b1dc3d1225ec1e34f9afe0dbf167b3f76aa04d46aed1e9395f6985e16ddcf4e8a0cbcb
+  metadata.gz: 79c71e7a97da93357aa8e927a41dbdd5742919dcfd9bdfddc7b2d0e215c37489bacfd6b3cdf77b2b1b86e13f0a081777830c732d0ebbacc52398a8026609ff05
+  data.tar.gz: 1d5946a4083783f961363b05e61f3e3c62909d60c90108cc4e67594149a559fa62810507dd4720ea67fb9cb7e6c2a8c0e7198ed0593b0d7fdea140afc1145476

data/lib/ruby_native/helper.rb

@@ -230,6 +230,13 @@ module RubyNative
       tag.div(data: { native_overscroll_top: top, native_overscroll_bottom: bottom || top }, hidden: true)
     end
 
+    # Hides the iOS keyboard toolbar (the previous/next/Done bar) on this page.
+    # Page-level: the toolbar belongs to the web view, not to individual fields.
+    def native_keyboard_tag(toolbar: false)
+      return "".html_safe if toolbar
+      tag.div(data: { native_keyboard_toolbar: false }, hidden: true)
+    end
+
     def native_haptic_data(feedback = :success, **data)
       feedback = feedback.to_s
       feedback = "success" if feedback.empty?

data/lib/ruby_native/oauth_middleware.rb

@@ -18,7 +18,7 @@ module RubyNative
       request = ActionDispatch::Request.new(env)
       on_oauth_path = oauth_path?(request)
       started_native_oauth = on_oauth_path && request.params["ruby_native"] == "1"
-      callback_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
+      param_scheme = permitted_scheme(request.params["callback_scheme"]) if started_native_oauth
 
       status, headers, body = @app.call(env)
 
@@ -26,27 +26,27 @@ module RubyNative
         relax_cookie_samesite!(headers)
       end
 
-      if started_native_oauth && callback_scheme.present? && redirect?(status)
+      if started_native_oauth && param_scheme.present? && redirect?(status)
         Rails.logger.debug { "[RubyNative] OAuth started for #{request.path}, setting tracking cookie" }
-        set_cookie(headers, callback_scheme)
+        set_cookie(headers, param_scheme)
       end
 
-      stored_scheme = permitted_scheme(read_cookie(request))
+      # On a start request the param names the app asking right now, so a stale
+      # cookie from another app on the same domain must never win.
+      callback_scheme = started_native_oauth ? param_scheme : permitted_scheme(read_cookie(request))
 
-      if stored_scheme && redirect?(status)
+      if callback_scheme && redirect?(status)
         location = headers["location"] || headers["Location"]
 
         if auth_failure?(location)
           Rails.logger.info { "[RubyNative] OAuth failed, redirecting to native app" }
-          delete_cookie(headers)
-          return redirect_to_native(stored_scheme, error: true)
+          return redirect_to_native(callback_scheme, error: true)
         end
 
         if internal_redirect?(request, location)
           token = build_token(headers, location)
           Rails.logger.info { "[RubyNative] OAuth succeeded, redirecting to native app" }
-          delete_cookie(headers)
-          return redirect_to_native(stored_scheme, token: token)
+          return redirect_to_native(callback_scheme, token: token)
         end
       end
 
@@ -116,8 +116,14 @@ module RubyNative
       nil
     end
 
-    def delete_cookie(headers)
-      Rack::Utils.delete_set_cookie_header!(headers, COOKIE_NAME, path: "/")
+    # Attributes must match set_cookie or browsers keep the original cookie.
+    def expire_cookie(headers)
+      headers["set-cookie"] = Rack::Utils.delete_set_cookie_header(COOKIE_NAME, {
+        path: "/",
+        httponly: true,
+        secure: true,
+        same_site: :none
+      })
     end
 
     def verifier
@@ -133,16 +139,12 @@ module RubyNative
     # breaks OmniAuth's state verification. Relax existing cookies
     # to SameSite=None so the session cookie survives Apple's callback.
     def relax_cookie_samesite!(headers)
-      raw = headers["set-cookie"]
-      return unless raw
-
-      cookies = raw.is_a?(Array) ? raw : raw.split("\n")
-      headers["set-cookie"] = cookies.map { |cookie|
+      SetCookieHeader.rewrite!(headers) do |cookie|
         next cookie unless cookie.match?(/SameSite=Lax/i)
         cookie.gsub(/SameSite=Lax/i, "SameSite=None").then { |c|
           c.include?("Secure") ? c : "#{c}; Secure"
         }
-      }.join("\n")
+      end
     end
 
     def redirect?(status)
@@ -165,23 +167,22 @@ module RubyNative
     end
 
     def build_token(headers, redirect_url)
-      raw_cookies = headers["set-cookie"] || headers["Set-Cookie"]
-      cookies = case raw_cookies
-      when String then raw_cookies.split("\n")
-      when Array then raw_cookies
-      else []
-      end
+      # Restoring the tracking cookie into the app's cookie jar would hijack the
+      # next in-app redirect, so it never rides along in the token.
+      cookies = SetCookieHeader.read(headers).reject { |c| c.start_with?("#{COOKIE_NAME}=") }
 
       redirect_url = "/" if auth_start_path?(redirect_url)
 
-      Rails.logger.info { "[RubyNative] Captured #{cookies.size} cookies for token (raw type: #{raw_cookies.class})" }
+      Rails.logger.info { "[RubyNative] Captured #{cookies.size} cookies for token" }
 
       self.class.build_token(cookies: cookies, redirect_url: redirect_url)
     end
 
     def redirect_to_native(callback_scheme, token: nil, error: false)
       query = error ? "error=true" : "token=#{CGI.escape(token)}"
-      [302, {"location" => "#{callback_scheme}://auth/callback?#{query}"}, [""]]
+      headers = {"location" => "#{callback_scheme}://auth/callback?#{query}"}
+      expire_cookie(headers)
+      [302, headers, [""]]
     end
 
     def auth_start_path?(url)

data/lib/ruby_native/set_cookie_header.rb

@@ -0,0 +1,26 @@
+module RubyNative
+  # Rack 2 carries Set-Cookie as one newline joined String, Rack 3 as an Array
+  # of cookie strings. Rewrites must hand back whichever shape came in.
+  module SetCookieHeader
+    KEYS = ["set-cookie", "Set-Cookie"].freeze
+
+    module_function
+
+    def read(headers)
+      raw = KEYS.map { |key| headers[key] }.compact.first
+      case raw
+      when Array then raw
+      when String then raw.split("\n")
+      else []
+      end
+    end
+
+    def rewrite!(headers, &block)
+      key = KEYS.find { |k| headers[k] }
+      return unless key
+
+      rewritten = read(headers).map(&block)
+      headers[key] = headers[key].is_a?(Array) ? rewritten : rewritten.join("\n")
+    end
+  end
+end

data/lib/ruby_native/tunnel_cookie_middleware.rb

@@ -34,10 +34,9 @@ module RubyNative
     end
 
     def strip_cookie_domain!(headers)
-      raw = headers["set-cookie"]
-      cookies = raw.is_a?(Array) ? raw : raw.split("\n")
-      stripped = cookies.map { |cookie| cookie.gsub(/;\s*domain=[^;]*/i, "") }
-      headers["set-cookie"] = (stripped.length == 1) ? stripped.first : stripped
+      SetCookieHeader.rewrite!(headers) do |cookie|
+        cookie.gsub(/;\s*domain=[^;]*/i, "")
+      end
     end
   end
 end

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.14.3"
+  VERSION = "0.15.0"
 end

data/lib/ruby_native.rb

@@ -4,6 +4,7 @@ require "ruby_native/helper"
 require "ruby_native/native_version"
 require "ruby_native/native_detection"
 require "ruby_native/inertia_support"
+require "ruby_native/set_cookie_header"
 require "ruby_native/oauth_middleware"
 require "ruby_native/tunnel_cookie_middleware"
 require "ruby_native/iap/event"
@@ -181,17 +182,22 @@ module RubyNative
   # "callback" and send sign-in into a loop. The callback round-trip is handled
   # automatically by OAuthMiddleware's tracking cookie, so it never needs
   # listing. Drop any entry that is the "/callback" child of another listed
-  # path and warn, so a copied-in callback can't break native sign-in.
+  # path and warn, so a copied-in callback can't break native sign-in. The value
+  # is always written back as an array: a scalar in YAML fails the whole native
+  # config decode on both platforms.
   def self.normalize_oauth_paths
-    paths = Array(self.config.dig(:auth, :oauth_paths))
-    callbacks = paths.select { |path| paths.any? { |start| path == "#{start}/callback" } }
-    return if callbacks.empty?
+    auth = self.config[:auth]
+    return unless auth.is_a?(Hash) && auth.key?(:oauth_paths)
 
-    Rails.logger.warn(
-      "[RubyNative] Ignoring OAuth callback path(s) in config/ruby_native.yml " \
-      "(#{callbacks.join(", ")}). List only the authorize path; callbacks are handled automatically."
-    )
-    self.config[:auth][:oauth_paths] = paths - callbacks
+    paths = Array(auth[:oauth_paths])
+    callbacks = paths.select { |path| paths.any? { |start| path == "#{start}/callback" } }
+    if callbacks.any?
+      Rails.logger.warn(
+        "[RubyNative] Ignoring OAuth callback path(s) in config/ruby_native.yml " \
+        "(#{callbacks.join(", ")}). List only the authorize path; callbacks are handled automatically."
+      )
+    end
+    auth[:oauth_paths] = paths - callbacks
   end
 
   # Entries are path prefixes: "/pair/" links every URL under it. A leading

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.14.3
+  version: 0.15.0
 platform: ruby
 authors:
 - Joe Masilotti
@@ -109,6 +109,7 @@ files:
 - lib/ruby_native/native_version.rb
 - lib/ruby_native/oauth_middleware.rb
 - lib/ruby_native/screenshots/sign_in_helper.rb
+- lib/ruby_native/set_cookie_header.rb
 - lib/ruby_native/tunnel_cookie_middleware.rb
 - lib/ruby_native/version.rb
 homepage: https://rubynative.com