@capgo/capacitor-inappbrowser 8.23.0 → 8.24.0

package/dist/plugin.js

@@ -158,6 +158,408 @@ var capacitorInAppBrowser = (function (exports, core) {
         return resolution.url;
     }
 
+    const HTML_ATTRIBUTE_ESCAPES = { '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
+    const escapeHtmlAttribute = (value) => value.replace(/[&"<>]/g, (c) => HTML_ATTRIBUTE_ESCAPES[c]);
+    const OPENING_HEAD_TAG = /<head(?:\s[^>]*)?>/i;
+    const NATIVE_BRIDGE_SCRIPT = "(function(){window.addEventListener('message',function(e){if(e.source===window.parent){window.dispatchEvent(new CustomEvent('messageFromNative',{detail:e.data}));}});})();";
+    const formatDoctype = (doctype) => {
+        if (!doctype) {
+            return '';
+        }
+        if (doctype.publicId) {
+            const system = doctype.systemId ? ` "${doctype.systemId}"` : '';
+            return `<!DOCTYPE ${doctype.name} PUBLIC "${doctype.publicId}"${system}>`;
+        }
+        if (doctype.systemId) {
+            return `<!DOCTYPE ${doctype.name} SYSTEM "${doctype.systemId}">`;
+        }
+        return `<!DOCTYPE ${doctype.name}>`;
+    };
+    const serializeParsedHtml = (doc) => formatDoctype(doc.doctype) + doc.documentElement.outerHTML;
+    const TRUSTED_TYPES_POLICY_NAME = 'capgo-inappbrowser';
+    const TRUSTED_TYPES_POLICY_BLOCKED_MESSAGE = "InAppBrowser could not create the Trusted Types policy 'capgo-inappbrowser'. " +
+        'Add capgo-inappbrowser to the host app Content-Security-Policy trusted-types directive.';
+    let trustedHtmlPolicy;
+    const getTrustedHtmlPolicy = () => {
+        var _a;
+        if (trustedHtmlPolicy !== undefined) {
+            return trustedHtmlPolicy;
+        }
+        const trustedTypes = (_a = globalThis.window) === null || _a === void 0 ? void 0 : _a.trustedTypes;
+        if (!trustedTypes) {
+            trustedHtmlPolicy = null;
+            return null;
+        }
+        try {
+            trustedHtmlPolicy = trustedTypes.createPolicy(TRUSTED_TYPES_POLICY_NAME, {
+                createHTML: (value) => value,
+            });
+            return trustedHtmlPolicy;
+        }
+        catch (_b) {
+            throw new Error(TRUSTED_TYPES_POLICY_BLOCKED_MESSAGE);
+        }
+    };
+    const createTrustedHtml = (html) => {
+        const policy = getTrustedHtmlPolicy();
+        return policy ? policy.createHTML(html) : html;
+    };
+    const trustedHtmlToString = (html) => (typeof html === 'string' ? html : String(html));
+    const injectNativeBridge = (html) => {
+        if (typeof DOMParser !== 'undefined') {
+            const doc = new DOMParser().parseFromString(createTrustedHtml(html), 'text/html');
+            const script = doc.createElement('script');
+            script.textContent = NATIVE_BRIDGE_SCRIPT;
+            if (doc.body) {
+                doc.body.appendChild(script);
+                return serializeParsedHtml(doc);
+            }
+        }
+        return `${html}<script>${NATIVE_BRIDGE_SCRIPT}</script>`;
+    };
+    /** Whether a webview message origin may replace the postMessage target (full origin string). */
+    function mayAdoptPostMessageOrigin(openedUrl, messageOrigin) {
+        try {
+            const opened = new URL(openedUrl);
+            const incoming = new URL(messageOrigin);
+            if (opened.protocol !== incoming.protocol) {
+                return false;
+            }
+            if (opened.port !== incoming.port) {
+                return false;
+            }
+            if (opened.origin === incoming.origin) {
+                return true;
+            }
+            const openedHost = opened.hostname;
+            const incomingHost = incoming.hostname;
+            return incomingHost === openedHost || incomingHost.endsWith(`.${openedHost}`);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    /**
+     * Wraps fetched HTML in a sandboxed iframe (opaque origin, no allow-same-origin) so the remote page
+     * cannot read the app's storage or DOM even though the wrapper is a Blob created by the app origin.
+     * A <base href> pointing at the final response URL keeps relative URLs resolving against the target.
+     * The wrapper relays messages from the app (its opener) into the sandboxed frame.
+     */
+    const buildIsolatedDocument = (html, baseHref) => {
+        const baseTag = `<base href="${escapeHtmlAttribute(baseHref)}">`;
+        let inner = OPENING_HEAD_TAG.test(html)
+            ? html.replace(OPENING_HEAD_TAG, (tag) => `${tag}${baseTag}`)
+            : `${baseTag}${html}`;
+        inner = injectNativeBridge(inner);
+        const srcdoc = trustedHtmlToString(createTrustedHtml(inner));
+        const sandbox = 'allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation';
+        const relay = "(function(){var f=document.getElementById('capgo-iab-frame');" +
+            "window.addEventListener('message',function(e){if(e.source===window.opener&&f&&f.contentWindow){f.contentWindow.postMessage(e.data,'*');}});})();";
+        return ('<!doctype html><html><head><meta charset="utf-8">' +
+            '<style>html,body,iframe{margin:0;padding:0;border:0;width:100%;height:100%;display:block}</style></head>' +
+            `<body><iframe id="capgo-iab-frame" sandbox="${sandbox}" referrerpolicy="no-referrer" srcdoc="${escapeHtmlAttribute(srcdoc)}"></iframe>` +
+            `<script>${relay}</script></body></html>`);
+    };
+    class InAppBrowserWeb extends core.WebPlugin {
+        constructor() {
+            super();
+            this.webViews = new Map();
+            this.webViewCounter = 0;
+            this.handleWindowMessage = (event) => {
+                const match = Array.from(this.webViews.entries()).find(([, entry]) => this.isFromWebView(entry, event.source));
+                if (!match) {
+                    return;
+                }
+                const [id, entry] = match;
+                if (entry.window === event.source &&
+                    event.origin &&
+                    event.origin !== 'null' &&
+                    mayAdoptPostMessageOrigin(entry.url, event.origin)) {
+                    entry.origin = event.origin;
+                }
+                let data = event.data;
+                if (typeof data === 'string') {
+                    try {
+                        data = JSON.parse(data);
+                    }
+                    catch (_a) {
+                        this.notifyListeners('messageFromWebview', { id, rawMessage: event.data });
+                        return;
+                    }
+                }
+                if (data && typeof data === 'object' && !Array.isArray(data)) {
+                    this.notifyListeners('messageFromWebview', Object.assign(Object.assign({}, data), { id }));
+                }
+                else if (typeof event.data === 'string') {
+                    this.notifyListeners('messageFromWebview', { id, rawMessage: event.data });
+                }
+            };
+            if (globalThis.window !== undefined) {
+                globalThis.window.addEventListener('message', this.handleWindowMessage);
+            }
+        }
+        isFromWebView(entry, source) {
+            if (!source) {
+                return false;
+            }
+            if (entry.window === source) {
+                return true;
+            }
+            if (!entry.objectUrl) {
+                return false;
+            }
+            try {
+                const frame = entry.window.document.getElementById('capgo-iab-frame');
+                return (frame === null || frame === void 0 ? void 0 : frame.contentWindow) === source;
+            }
+            catch (_a) {
+                return false;
+            }
+        }
+        watchClosed(id) {
+            const entry = this.webViews.get(id);
+            if (!(entry === null || entry === void 0 ? void 0 : entry.window.closed)) {
+                return;
+            }
+            globalThis.clearInterval(entry.timer);
+            if (entry.objectUrl) {
+                URL.revokeObjectURL(entry.objectUrl);
+            }
+            this.webViews.delete(id);
+            this.notifyListeners('closeEvent', { id, url: entry.url });
+        }
+        resolveWebViewEntry(id) {
+            if (id) {
+                const entry = this.webViews.get(id);
+                if (entry && !entry.window.closed) {
+                    return { id, entry };
+                }
+                return undefined;
+            }
+            const match = Array.from(this.webViews.entries())
+                .reverse()
+                .find(([, entry]) => !entry.window.closed);
+            if (!match) {
+                return undefined;
+            }
+            return { id: match[0], entry: match[1] };
+        }
+        resolveTargetOrigin(url) {
+            var _a, _b;
+            try {
+                return new URL(url).origin;
+            }
+            catch (_c) {
+                return (_b = (_a = globalThis.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : 'null';
+            }
+        }
+        hasHeaders(headers) {
+            return headers != null && Object.keys(headers).length > 0;
+        }
+        navigateOpenedWindow(id, win, url, headers) {
+            if (!this.hasHeaders(headers)) {
+                win.location.href = url;
+                return;
+            }
+            void (async () => {
+                var _a, _b;
+                try {
+                    const response = await fetch(url, { headers });
+                    if (!response.ok) {
+                        throw new Error(`Request failed with status ${response.status}`);
+                    }
+                    const html = await response.text();
+                    const parsed = new URL(response.url || url, (_b = (_a = globalThis.location) === null || _a === void 0 ? void 0 : _a.href) !== null && _b !== void 0 ? _b : 'https://localhost/');
+                    const baseHref = `${parsed.origin}${parsed.pathname}${parsed.search}`;
+                    const blob = new Blob([buildIsolatedDocument(html, baseHref)], { type: 'text/html;charset=utf-8' });
+                    const objectUrl = URL.createObjectURL(blob);
+                    const entry = this.webViews.get(id);
+                    if (!entry || win.closed) {
+                        URL.revokeObjectURL(objectUrl);
+                        return;
+                    }
+                    entry.objectUrl = objectUrl;
+                    win.location.href = objectUrl;
+                }
+                catch (error) {
+                    console.error('[InAppBrowser] Failed to load web view with headers', error);
+                    win.close();
+                    this.watchClosed(id);
+                }
+            })();
+        }
+        clearAllCookies() {
+            console.log('clearAllCookies');
+            return Promise.resolve();
+        }
+        clearCache() {
+            console.log('clearCache');
+            return Promise.resolve();
+        }
+        clearAllBrowsingData() {
+            console.log('clearAllBrowsingData');
+            return Promise.resolve();
+        }
+        open(options) {
+            const opened = globalThis.open('', '_blank');
+            if (!opened) {
+                return Promise.reject(new Error('Popup blocked'));
+            }
+            opened.opener = null;
+            opened.location.href = options.url;
+            return Promise.resolve();
+        }
+        clearCookies(options) {
+            console.log('cleanCookies', options);
+            return Promise.resolve();
+        }
+        getCookies(options) {
+            return Promise.resolve(options);
+        }
+        openWebView(options) {
+            var _a, _b, _c;
+            if (options.fullscreen) {
+                return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+            }
+            const { popup = false, width, height } = (_a = options.web) !== null && _a !== void 0 ? _a : {};
+            const features = popup
+                ? ['popup=yes', width ? `width=${width}` : '', height ? `height=${height}` : ''].filter(Boolean).join(',')
+                : '';
+            const opened = globalThis.open('', '_blank', features);
+            if (!opened) {
+                return Promise.reject(new Error('Popup blocked'));
+            }
+            const id = `web-${++this.webViewCounter}`;
+            const timer = globalThis.setInterval(() => this.watchClosed(id), 500);
+            // Header loads render inside an app-origin wrapper document, so messages target the app origin there.
+            const origin = this.hasHeaders(options.headers)
+                ? ((_c = (_b = globalThis.location) === null || _b === void 0 ? void 0 : _b.origin) !== null && _c !== void 0 ? _c : 'null')
+                : this.resolveTargetOrigin(options.url);
+            this.webViews.set(id, { window: opened, url: options.url, timer, origin });
+            this.navigateOpenedWindow(id, opened, options.url, options.headers);
+            return Promise.resolve({ id });
+        }
+        executeScript({ code }) {
+            console.log('code', code);
+            return Promise.resolve(code);
+        }
+        close(options) {
+            const resolved = this.resolveWebViewEntry(options === null || options === void 0 ? void 0 : options.id);
+            if (!resolved) {
+                return Promise.resolve();
+            }
+            resolved.entry.window.close();
+            this.watchClosed(resolved.id);
+            return Promise.resolve();
+        }
+        hide(_options) {
+            console.log('hide', _options);
+            return Promise.resolve();
+        }
+        show(_options) {
+            console.log('show', _options);
+            return Promise.resolve();
+        }
+        sendToBack(_options) {
+            console.log('sendToBack not supported on web', _options);
+            return Promise.resolve();
+        }
+        bringToFront(_options) {
+            console.log('bringToFront not supported on web', _options);
+            return Promise.resolve();
+        }
+        dispatchInputEvent(_options) {
+            console.log('dispatchInputEvent not supported on web', _options);
+            return Promise.resolve();
+        }
+        setUrl(options) {
+            console.log('setUrl', options.url);
+            return Promise.resolve();
+        }
+        reload(options) {
+            console.log('reload', options);
+            return Promise.resolve();
+        }
+        postMessage(options) {
+            const resolved = this.resolveWebViewEntry(options.id);
+            if (resolved) {
+                resolved.entry.window.postMessage(options.detail, resolved.entry.origin);
+            }
+            return Promise.resolve();
+        }
+        takeScreenshot(_options) {
+            console.log('takeScreenshot not supported on web', _options);
+            return Promise.reject(this.unimplemented('Screenshots are not supported on web.'));
+        }
+        goBack() {
+            console.log('goBack');
+            return Promise.resolve();
+        }
+        getPluginVersion() {
+            return Promise.resolve({ version: 'web' });
+        }
+        updateDimensions(_options) {
+            console.log('updateDimensions', _options);
+            return Promise.resolve();
+        }
+        handleProxyRequest(options) {
+            console.log('handleProxyRequest not supported on web', options);
+            return Promise.resolve();
+        }
+        setEnabledSafeTopMargin(_options) {
+            console.log('setEnabledSafeTopMargin not supported on web', _options);
+            return Promise.resolve();
+        }
+        setFullscreen(options) {
+            console.log('setFullscreen not supported on web', options);
+            return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+        }
+        getFullscreen(_options) {
+            console.log('getFullscreen not supported on web', _options);
+            return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+        }
+        setEnabledSafeBottomMargin(_options) {
+            console.log('setEnabledSafeBottomMargin not supported on web', _options);
+            return Promise.resolve();
+        }
+        async openSecureWindow(options) {
+            const w = 600;
+            const h = 550;
+            const settings = [
+                ['width', w],
+                ['height', h],
+                ['left', screen.width / 2 - w / 2],
+                ['top', screen.height / 2 - h / 2],
+            ]
+                .map((x) => x.join('='))
+                .join(',');
+            const popup = globalThis.open(options.authEndpoint, 'Authorization', settings);
+            if (!popup) {
+                throw new Error('Failed to open secure window');
+            }
+            if (typeof popup.focus === 'function') {
+                popup.focus();
+            }
+            return new Promise((resolve, reject) => {
+                const bc = new BroadcastChannel(options.broadcastChannelName || 'oauth-channel');
+                bc.addEventListener('message', (event) => {
+                    if (event.data.startsWith(options.redirectUri)) {
+                        bc.close();
+                        resolve({ redirectedUri: event.data });
+                    }
+                    else {
+                        bc.close();
+                        reject(new Error('Redirect URI does not match, expected ' + options.redirectUri + ' but got ' + event.data));
+                    }
+                });
+                setTimeout(() => {
+                    bc.close();
+                    reject(new Error('The sign-in flow timed out'));
+                }, 5 * 60000);
+            });
+        }
+    }
+
     exports.BackgroundColor = void 0;
     (function (BackgroundColor) {
         BackgroundColor["WHITE"] = "white";
@@ -236,8 +638,12 @@ var capacitorInAppBrowser = (function (exports, core) {
             'Ensure @capgo/capacitor-inappbrowser native code is installed.');
         return CAPGO_PLUGIN_NAME;
     }
+    let webImplementation;
     const inAppBrowserImplementations = {
-        web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.InAppBrowserWeb()),
+        // Imported statically so the first openWebView() reaches window.open without awaiting a chunk load,
+        // which can outlast the browser's user-activation window and get the popup blocked.
+        // Memoized so concurrent first calls share one instance (one id counter and window map).
+        web: () => (webImplementation !== null && webImplementation !== void 0 ? webImplementation : (webImplementation = new InAppBrowserWeb())),
     };
     function assertValidBundledAssetPath(url) {
         if (isRelativeBundledPath(url) && containsPathTraversal(url)) {
@@ -379,157 +785,6 @@ var capacitorInAppBrowser = (function (exports, core) {
         });
     };
 
-    class InAppBrowserWeb extends core.WebPlugin {
-        clearAllCookies() {
-            console.log('clearAllCookies');
-            return Promise.resolve();
-        }
-        clearCache() {
-            console.log('clearCache');
-            return Promise.resolve();
-        }
-        clearAllBrowsingData() {
-            console.log('clearAllBrowsingData');
-            return Promise.resolve();
-        }
-        async open(options) {
-            console.log('open', options);
-            return options;
-        }
-        async clearCookies(options) {
-            console.log('cleanCookies', options);
-            return;
-        }
-        async getCookies(options) {
-            // Web implementation to get cookies
-            return options;
-        }
-        async openWebView(options) {
-            if (options.fullscreen) {
-                throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-            }
-            console.log('openWebView', options);
-            return options;
-        }
-        async executeScript({ code }) {
-            console.log('code', code);
-            return code;
-        }
-        async close(options) {
-            console.log('close', options);
-            return;
-        }
-        async hide(options) {
-            console.log('hide', options);
-            return;
-        }
-        async show(options) {
-            console.log('show', options);
-            return;
-        }
-        async sendToBack(options) {
-            console.log('sendToBack not supported on web', options);
-            return;
-        }
-        async bringToFront(options) {
-            console.log('bringToFront not supported on web', options);
-            return;
-        }
-        async dispatchInputEvent(options) {
-            console.log('dispatchInputEvent not supported on web', options);
-            return;
-        }
-        async setUrl(options) {
-            console.log('setUrl', options.url);
-            return;
-        }
-        async reload(options) {
-            console.log('reload', options);
-            return;
-        }
-        async postMessage(options) {
-            console.log('postMessage', options);
-            return options;
-        }
-        async takeScreenshot(options) {
-            console.log('takeScreenshot not supported on web', options);
-            throw this.unimplemented('Screenshots are not supported on web.');
-        }
-        async goBack() {
-            console.log('goBack');
-            return;
-        }
-        async getPluginVersion() {
-            return { version: 'web' };
-        }
-        async updateDimensions(options) {
-            console.log('updateDimensions', options);
-            // Web platform doesn't support dimension control
-            return;
-        }
-        async handleProxyRequest(options) {
-            console.log('handleProxyRequest not supported on web', options);
-            return;
-        }
-        async setEnabledSafeTopMargin(options) {
-            console.log('setEnabledSafeTopMargin not supported on web', options);
-            return;
-        }
-        async setFullscreen(options) {
-            console.log('setFullscreen not supported on web', options);
-            throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-        }
-        async getFullscreen(options) {
-            console.log('getFullscreen not supported on web', options);
-            throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-        }
-        async setEnabledSafeBottomMargin(options) {
-            console.log('setEnabledSafeBottomMargin not supported on web', options);
-            return;
-        }
-        async openSecureWindow(options) {
-            const w = 600;
-            const h = 550;
-            const settings = [
-                ['width', w],
-                ['height', h],
-                ['left', screen.width / 2 - w / 2],
-                ['top', screen.height / 2 - h / 2],
-            ]
-                .map((x) => x.join('='))
-                .join(',');
-            const popup = window.open(options.authEndpoint, 'Authorization', settings);
-            if (!popup) {
-                throw new Error('Failed to open secure window');
-            }
-            if (typeof popup.focus === 'function') {
-                popup.focus();
-            }
-            return new Promise((resolve, reject) => {
-                const bc = new BroadcastChannel(options.broadcastChannelName || 'oauth-channel');
-                bc.addEventListener('message', (event) => {
-                    if (event.data.startsWith(options.redirectUri)) {
-                        bc.close();
-                        resolve({ redirectedUri: event.data });
-                    }
-                    else {
-                        bc.close();
-                        reject(new Error('Redirect URI does not match, expected ' + options.redirectUri + ' but got ' + event.data));
-                    }
-                });
-                setTimeout(() => {
-                    bc.close();
-                    reject(new Error('The sign-in flow timed out'));
-                }, 5 * 60000);
-            });
-        }
-    }
-
-    var web = /*#__PURE__*/Object.freeze({
-        __proto__: null,
-        InAppBrowserWeb: InAppBrowserWeb
-    });
-
     exports.InAppBrowser = InAppBrowser;
     exports.addProxyHandler = addProxyHandler;