@capgo/capacitor-inappbrowser 8.13.3 → 8.13.4

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/SafeAreaInsetsSupport.java

@@ -97,18 +97,19 @@ final class SafeAreaInsetsSupport {
 
     /**
      * Bottom padding to apply to the WebView container (a SwipeRefreshLayout, which honours its own
-     * padding but ignores child margins). Combines the resolved safe bottom inset with a compensation
-     * term: on Android 15+ the AppBarLayout is pushed down by the status-bar height, which shifts the
-     * container's bottom edge off-screen by that same amount, so it must be added back as padding
-     * regardless of the safe-margin option.
+     * padding but ignores child margins). Takes the larger of the safe bottom inset and the keyboard
+     * (IME) inset via {@link #resolveBottomMargin}, then adds a compensation term: on Android 15+ the
+     * AppBarLayout is pushed down by the status-bar height, which shifts the container's bottom edge
+     * off-screen by that same amount, so it must be added back as padding regardless of the options.
      */
     static int resolveContainerBottomPadding(
         boolean enabledSafeBottomMargin,
         int safeBottomInset,
+        int imeBottom,
         boolean appBarHandlesTopInset,
         int statusBarTop
     ) {
-        int base = enabledSafeBottomMargin ? Math.max(0, safeBottomInset) : 0;
+        int base = resolveBottomMargin(enabledSafeBottomMargin, safeBottomInset, imeBottom);
         int appBarCompensation = appBarHandlesTopInset ? Math.max(0, statusBarTop) : 0;
         return base + appBarCompensation;
     }
@@ -130,4 +131,14 @@ final class SafeAreaInsetsSupport {
 
         return Math.max(0, statusBarTop);
     }
+
+    /**
+     * Whether the WebView container must be inset for the bottom system bar. On Android 15+ the dialog
+     * is forced edge-to-edge (decorFitsSystemWindows=false), so the window always draws under the
+     * navigation bar and insetting is mandatory to keep bottom content on-screen, regardless of the
+     * enabledSafeBottomMargin opt-in that older versions honour.
+     */
+    static boolean shouldInsetBottomForContainer(boolean enabledSafeBottomMargin, boolean isEdgeToEdge) {
+        return enabledSafeBottomMargin || isEdgeToEdge;
+    }
 }

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/WebViewDialog.java

@@ -3227,6 +3227,8 @@ public class WebViewDialog extends Dialog implements ProxyResponseRouting.ProxyR
         Insets systemGestures = windowInsets != null ? windowInsets.getInsets(WindowInsetsCompat.Type.systemGestures()) : Insets.NONE;
         Insets mandatoryGestures =
             windowInsets != null ? windowInsets.getInsets(WindowInsetsCompat.Type.mandatorySystemGestures()) : Insets.NONE;
+        Insets ime = windowInsets != null ? windowInsets.getInsets(WindowInsetsCompat.Type.ime()) : Insets.NONE;
+        boolean keyboardVisible = windowInsets != null && windowInsets.isVisible(WindowInsetsCompat.Type.ime());
 
         boolean isAndroid15Plus = Build.VERSION.SDK_INT >= 35;
         View toolbarView = findViewById(R.id.tool_bar);
@@ -3237,8 +3239,10 @@ public class WebViewDialog extends Dialog implements ProxyResponseRouting.ProxyR
             toolbarView.getVisibility() == View.VISIBLE &&
             toolbarView.getParent() instanceof com.google.android.material.appbar.AppBarLayout;
 
+        boolean applyBottomInset = SafeAreaInsetsSupport.shouldInsetBottomForContainer(_options.getEnabledSafeMargin(), isAndroid15Plus);
+
         int statusBarTop = bars.top > 0 ? bars.top : getSystemStatusBarHeight();
-        int fallbackBottomInset = _options.getEnabledSafeMargin() ? getSystemNavigationBarHeight() : 0;
+        int fallbackBottomInset = applyBottomInset ? getSystemNavigationBarHeight() : 0;
         int safeBottomInset = SafeAreaInsetsSupport.resolveSafeBottomInsetWithFallback(
             bars.bottom,
             navigationBars.bottom,
@@ -3249,7 +3253,7 @@ public class WebViewDialog extends Dialog implements ProxyResponseRouting.ProxyR
             navigationBars.left,
             navigationBars.right,
             fallbackBottomInset,
-            _options.getEnabledSafeMargin()
+            applyBottomInset
         );
 
         int padTop = SafeAreaInsetsSupport.resolveContainerTopPadding(
@@ -3258,9 +3262,11 @@ public class WebViewDialog extends Dialog implements ProxyResponseRouting.ProxyR
             statusBarTop,
             appBarHandlesTopInset
         );
+        int imeBottom = SafeAreaInsetsSupport.resolveImeBottomInset(keyboardVisible, ime.bottom, isAndroid15Plus);
         int padBottom = SafeAreaInsetsSupport.resolveContainerBottomPadding(
-            _options.getEnabledSafeMargin(),
+            applyBottomInset,
             safeBottomInset,
+            imeBottom,
             appBarHandlesTopInset,
             statusBarTop
         );

package/ios/Sources/InAppBrowserPlugin/InAppBrowserPlugin.swift

@@ -110,6 +110,42 @@ enum CustomSchemeOpenSupport {
     }
 }
 
+enum SecureWindowRedirectSupport {
+    /// The auth session reports any navigation on the callback scheme, so the redirect is
+    /// identified component-wise. Query items configured in the redirect URI are matched,
+    /// while any extra items (e.g. provider code, state) are ignored, unless they reuse a
+    /// configured name: parsers disagree over which duplicate takes precedence.
+    static func matches(_ callbackURL: URL, redirectUri: String) -> Bool {
+        guard let expected = URLComponents(string: redirectUri),
+              let received = URLComponents(url: callbackURL, resolvingAgainstBaseURL: false),
+              received.scheme?.lowercased() == expected.scheme?.lowercased(),
+              received.percentEncodedUser == expected.percentEncodedUser,
+              received.percentEncodedPassword == expected.percentEncodedPassword,
+              received.percentEncodedHost?.lowercased() == expected.percentEncodedHost?.lowercased(),
+              received.port == expected.port,
+              normalizedPath(received.percentEncodedPath) == normalizedPath(expected.percentEncodedPath) else {
+            return false
+        }
+
+        let expectedItems = expected.percentEncodedQueryItems ?? []
+        let receivedItems = received.percentEncodedQueryItems ?? []
+        let configuredDecodedNames = Set((expected.queryItems ?? []).map(\.name))
+        let configuredReceivedItemCount = (received.queryItems ?? []).filter {
+            configuredDecodedNames.contains($0.name)
+        }.count
+        guard configuredReceivedItemCount == expectedItems.count else {
+            return false
+        }
+        return Set(expectedItems.map(\.name)).allSatisfy { name in
+            receivedItems.filter { $0.name == name } == expectedItems.filter { $0.name == name }
+        }
+    }
+
+    private static func normalizedPath(_ path: String) -> String {
+        path == "/" ? "" : path
+    }
+}
+
 protocol ProxyRequestLocating {
     func hasPendingProxyRequest(_ requestId: String) -> Bool
 }
@@ -376,7 +412,7 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
         case aware = "AWARE"
         case fakeVisible = "FAKE_VISIBLE"
     }
-    private let pluginVersion: String = "8.13.3"
+    private let pluginVersion: String = "8.13.4"
     public let identifier = "CapgoInAppBrowserPlugin"
     public let jsName = "CapgoInAppBrowser"
     public let pluginMethods: [CAPPluginMethod] = [
@@ -1268,7 +1304,7 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
             return
         }
         let titleFontFamily = call.getString("titleFontFamily")
-        let isInspectable = call.getBool("isInspectable", false)
+        let isInspectable = call.getBool("isInspectable", self.bridge?.config.isWebDebuggable ?? false)
         let preventDeeplink = call.getBool("preventDeeplink", false)
         let openBlankTargetInWebView = call.getBool("openBlankTargetInWebView", false)
         let isAnimated = call.getBool("isAnimated", true)
@@ -2637,6 +2673,11 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
             return
         }
 
+        guard let callbackURLScheme = URL(string: redirectUri)?.scheme else {
+            call.reject("Invalid Redirect URI")
+            return
+        }
+
         // Store the call for later resolution
         self.openSecureWindowCall = call
 
@@ -2644,7 +2685,7 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
 
         // Open the URL in a secure browser window
         DispatchQueue.main.async {
-            let session = ASWebAuthenticationSession(url: url, callbackURLScheme: url.scheme) {
+            let session = ASWebAuthenticationSession(url: url, callbackURLScheme: callbackURLScheme) {
                 callbackURL, error in
 
                 // Clean up the stored call
@@ -2661,7 +2702,7 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
                     return
                 }
 
-                if !callbackURL.absoluteString.hasPrefix(redirectUri) {
+                if !SecureWindowRedirectSupport.matches(callbackURL, redirectUri: redirectUri) {
                     call.reject("Redirect URI does not match, expected " + redirectUri + " but got " + callbackURL.absoluteString)
                     return
                 }

package/ios/Sources/InAppBrowserPlugin/WKWebViewController.swift

@@ -439,6 +439,7 @@ open class WKWebViewController: UIViewController, WKScriptMessageHandler {
     open var httpMethod: String?
     open var httpBody: String?
     open var capBrowserPlugin: CapgoInAppBrowserPlugin?
+    open var isInspectable: Bool = false
     var instanceId: String = ""
     var shareDisclaimer: [String: Any]?
     var shareSubject: String?
@@ -2032,11 +2033,12 @@ open class WKWebViewController: UIViewController, WKScriptMessageHandler {
         }
     }
 
-    open func initWebview(isInspectable: Bool = true) {
+    open func initWebview(isInspectable: Bool = false) {
         if self.isWebViewInitialized {
             return
         }
         self.isWebViewInitialized = true
+        self.isInspectable = isInspectable
         self.startObservingKeyboardViewportChanges()
         self.view.backgroundColor = UIColor.white
 
@@ -2183,9 +2185,7 @@ open class WKWebViewController: UIViewController, WKScriptMessageHandler {
         //        }
 
         if #available(iOS 16.4, *) {
-            webView.isInspectable = true
-        } else {
-            // Fallback on earlier versions
+            webView.isInspectable = isInspectable
         }
 
         // First add the webView to view hierarchy
@@ -2341,7 +2341,7 @@ open class WKWebViewController: UIViewController, WKScriptMessageHandler {
         self.view.backgroundColor = parent.view.backgroundColor
         self.title = parent.title ?? request.url?.host ?? "Popup Window"
         self.navigationItem.title = self.title
-        self.initWebview()
+        self.initWebview(isInspectable: parent.isInspectable)
         return self.capableWebView
     }
 
@@ -3338,6 +3338,19 @@ extension WKWebViewController: WKUIDelegate {
         // This allows websites to access location when opened with openWebView
         decisionHandler(.grant)
     }
+
+    @available(iOS 15.0, *)
+    public func webView(_ webView: WKWebView, requestMediaCapturePermissionFor origin: WKSecurityOrigin, initiatedByFrame frame: WKFrameInfo, type: WKMediaCaptureType, decisionHandler: @escaping (WKPermissionDecision) -> Void) {
+        print("[InAppBrowser] Media capture permission requested for origin: \(origin.host)")
+
+        // Grant media capture permission automatically, matching Capacitor core's
+        // WebViewDelegationHandler. The OS-level camera/microphone permission
+        // (Info.plist usage description + system prompt) still applies — this only
+        // suppresses WebKit's extra per-origin prompt, which is not persisted
+        // across app launches (WebKit bug 220416) and would otherwise re-prompt
+        // users on every cold start.
+        decisionHandler(.grant)
+    }
 }
 
 // MARK: - Host Blocking Utilities

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-inappbrowser",
-  "version": "8.13.3",
+  "version": "8.13.4",
   "description": "Capacitor plugin in app browser",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",