@capgo/capacitor-inappbrowser 8.23.0 → 8.24.1

package/dist/plugin.cjs.js

@@ -159,6 +159,408 @@ function resolveLegacyNativeWebViewUrl(url, platform, localConfig) {
     return resolution.url;
 }
 
+const HTML_ATTRIBUTE_ESCAPES = { '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
+const escapeHtmlAttribute = (value) => value.replace(/[&"<>]/g, (c) => HTML_ATTRIBUTE_ESCAPES[c]);
+const OPENING_HEAD_TAG = /<head(?:\s[^>]*)?>/i;
+const NATIVE_BRIDGE_SCRIPT = "(function(){window.addEventListener('message',function(e){if(e.source===window.parent){window.dispatchEvent(new CustomEvent('messageFromNative',{detail:e.data}));}});})();";
+const formatDoctype = (doctype) => {
+    if (!doctype) {
+        return '';
+    }
+    if (doctype.publicId) {
+        const system = doctype.systemId ? ` "${doctype.systemId}"` : '';
+        return `<!DOCTYPE ${doctype.name} PUBLIC "${doctype.publicId}"${system}>`;
+    }
+    if (doctype.systemId) {
+        return `<!DOCTYPE ${doctype.name} SYSTEM "${doctype.systemId}">`;
+    }
+    return `<!DOCTYPE ${doctype.name}>`;
+};
+const serializeParsedHtml = (doc) => formatDoctype(doc.doctype) + doc.documentElement.outerHTML;
+const TRUSTED_TYPES_POLICY_NAME = 'capgo-inappbrowser';
+const TRUSTED_TYPES_POLICY_BLOCKED_MESSAGE = "InAppBrowser could not create the Trusted Types policy 'capgo-inappbrowser'. " +
+    'Add capgo-inappbrowser to the host app Content-Security-Policy trusted-types directive.';
+let trustedHtmlPolicy;
+const getTrustedHtmlPolicy = () => {
+    var _a;
+    if (trustedHtmlPolicy !== undefined) {
+        return trustedHtmlPolicy;
+    }
+    const trustedTypes = (_a = globalThis.window) === null || _a === void 0 ? void 0 : _a.trustedTypes;
+    if (!trustedTypes) {
+        trustedHtmlPolicy = null;
+        return null;
+    }
+    try {
+        trustedHtmlPolicy = trustedTypes.createPolicy(TRUSTED_TYPES_POLICY_NAME, {
+            createHTML: (value) => value,
+        });
+        return trustedHtmlPolicy;
+    }
+    catch (_b) {
+        throw new Error(TRUSTED_TYPES_POLICY_BLOCKED_MESSAGE);
+    }
+};
+const createTrustedHtml = (html) => {
+    const policy = getTrustedHtmlPolicy();
+    return policy ? policy.createHTML(html) : html;
+};
+const trustedHtmlToString = (html) => (typeof html === 'string' ? html : String(html));
+const injectNativeBridge = (html) => {
+    if (typeof DOMParser !== 'undefined') {
+        const doc = new DOMParser().parseFromString(createTrustedHtml(html), 'text/html');
+        const script = doc.createElement('script');
+        script.textContent = NATIVE_BRIDGE_SCRIPT;
+        if (doc.body) {
+            doc.body.appendChild(script);
+            return serializeParsedHtml(doc);
+        }
+    }
+    return `${html}<script>${NATIVE_BRIDGE_SCRIPT}</script>`;
+};
+/** Whether a webview message origin may replace the postMessage target (full origin string). */
+function mayAdoptPostMessageOrigin(openedUrl, messageOrigin) {
+    try {
+        const opened = new URL(openedUrl);
+        const incoming = new URL(messageOrigin);
+        if (opened.protocol !== incoming.protocol) {
+            return false;
+        }
+        if (opened.port !== incoming.port) {
+            return false;
+        }
+        if (opened.origin === incoming.origin) {
+            return true;
+        }
+        const openedHost = opened.hostname;
+        const incomingHost = incoming.hostname;
+        return incomingHost === openedHost || incomingHost.endsWith(`.${openedHost}`);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Wraps fetched HTML in a sandboxed iframe (opaque origin, no allow-same-origin) so the remote page
+ * cannot read the app's storage or DOM even though the wrapper is a Blob created by the app origin.
+ * A <base href> pointing at the final response URL keeps relative URLs resolving against the target.
+ * The wrapper relays messages from the app (its opener) into the sandboxed frame.
+ */
+const buildIsolatedDocument = (html, baseHref) => {
+    const baseTag = `<base href="${escapeHtmlAttribute(baseHref)}">`;
+    let inner = OPENING_HEAD_TAG.test(html)
+        ? html.replace(OPENING_HEAD_TAG, (tag) => `${tag}${baseTag}`)
+        : `${baseTag}${html}`;
+    inner = injectNativeBridge(inner);
+    const srcdoc = trustedHtmlToString(createTrustedHtml(inner));
+    const sandbox = 'allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation';
+    const relay = "(function(){var f=document.getElementById('capgo-iab-frame');" +
+        "window.addEventListener('message',function(e){if(e.source===window.opener&&f&&f.contentWindow){f.contentWindow.postMessage(e.data,'*');}});})();";
+    return ('<!doctype html><html><head><meta charset="utf-8">' +
+        '<style>html,body,iframe{margin:0;padding:0;border:0;width:100%;height:100%;display:block}</style></head>' +
+        `<body><iframe id="capgo-iab-frame" sandbox="${sandbox}" referrerpolicy="no-referrer" srcdoc="${escapeHtmlAttribute(srcdoc)}"></iframe>` +
+        `<script>${relay}</script></body></html>`);
+};
+class InAppBrowserWeb extends core.WebPlugin {
+    constructor() {
+        super();
+        this.webViews = new Map();
+        this.webViewCounter = 0;
+        this.handleWindowMessage = (event) => {
+            const match = Array.from(this.webViews.entries()).find(([, entry]) => this.isFromWebView(entry, event.source));
+            if (!match) {
+                return;
+            }
+            const [id, entry] = match;
+            if (entry.window === event.source &&
+                event.origin &&
+                event.origin !== 'null' &&
+                mayAdoptPostMessageOrigin(entry.url, event.origin)) {
+                entry.origin = event.origin;
+            }
+            let data = event.data;
+            if (typeof data === 'string') {
+                try {
+                    data = JSON.parse(data);
+                }
+                catch (_a) {
+                    this.notifyListeners('messageFromWebview', { id, rawMessage: event.data });
+                    return;
+                }
+            }
+            if (data && typeof data === 'object' && !Array.isArray(data)) {
+                this.notifyListeners('messageFromWebview', Object.assign(Object.assign({}, data), { id }));
+            }
+            else if (typeof event.data === 'string') {
+                this.notifyListeners('messageFromWebview', { id, rawMessage: event.data });
+            }
+        };
+        if (globalThis.window !== undefined) {
+            globalThis.window.addEventListener('message', this.handleWindowMessage);
+        }
+    }
+    isFromWebView(entry, source) {
+        if (!source) {
+            return false;
+        }
+        if (entry.window === source) {
+            return true;
+        }
+        if (!entry.objectUrl) {
+            return false;
+        }
+        try {
+            const frame = entry.window.document.getElementById('capgo-iab-frame');
+            return (frame === null || frame === void 0 ? void 0 : frame.contentWindow) === source;
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    watchClosed(id) {
+        const entry = this.webViews.get(id);
+        if (!(entry === null || entry === void 0 ? void 0 : entry.window.closed)) {
+            return;
+        }
+        globalThis.clearInterval(entry.timer);
+        if (entry.objectUrl) {
+            URL.revokeObjectURL(entry.objectUrl);
+        }
+        this.webViews.delete(id);
+        this.notifyListeners('closeEvent', { id, url: entry.url });
+    }
+    resolveWebViewEntry(id) {
+        if (id) {
+            const entry = this.webViews.get(id);
+            if (entry && !entry.window.closed) {
+                return { id, entry };
+            }
+            return undefined;
+        }
+        const match = Array.from(this.webViews.entries())
+            .reverse()
+            .find(([, entry]) => !entry.window.closed);
+        if (!match) {
+            return undefined;
+        }
+        return { id: match[0], entry: match[1] };
+    }
+    resolveTargetOrigin(url) {
+        var _a, _b;
+        try {
+            return new URL(url).origin;
+        }
+        catch (_c) {
+            return (_b = (_a = globalThis.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : 'null';
+        }
+    }
+    hasHeaders(headers) {
+        return headers != null && Object.keys(headers).length > 0;
+    }
+    navigateOpenedWindow(id, win, url, headers) {
+        if (!this.hasHeaders(headers)) {
+            win.location.href = url;
+            return;
+        }
+        void (async () => {
+            var _a, _b;
+            try {
+                const response = await fetch(url, { headers });
+                if (!response.ok) {
+                    throw new Error(`Request failed with status ${response.status}`);
+                }
+                const html = await response.text();
+                const parsed = new URL(response.url || url, (_b = (_a = globalThis.location) === null || _a === void 0 ? void 0 : _a.href) !== null && _b !== void 0 ? _b : 'https://localhost/');
+                const baseHref = `${parsed.origin}${parsed.pathname}${parsed.search}`;
+                const blob = new Blob([buildIsolatedDocument(html, baseHref)], { type: 'text/html;charset=utf-8' });
+                const objectUrl = URL.createObjectURL(blob);
+                const entry = this.webViews.get(id);
+                if (!entry || win.closed) {
+                    URL.revokeObjectURL(objectUrl);
+                    return;
+                }
+                entry.objectUrl = objectUrl;
+                win.location.href = objectUrl;
+            }
+            catch (error) {
+                console.error('[InAppBrowser] Failed to load web view with headers', error);
+                win.close();
+                this.watchClosed(id);
+            }
+        })();
+    }
+    clearAllCookies() {
+        console.log('clearAllCookies');
+        return Promise.resolve();
+    }
+    clearCache() {
+        console.log('clearCache');
+        return Promise.resolve();
+    }
+    clearAllBrowsingData() {
+        console.log('clearAllBrowsingData');
+        return Promise.resolve();
+    }
+    open(options) {
+        const opened = globalThis.open('', '_blank');
+        if (!opened) {
+            return Promise.reject(new Error('Popup blocked'));
+        }
+        opened.opener = null;
+        opened.location.href = options.url;
+        return Promise.resolve();
+    }
+    clearCookies(options) {
+        console.log('cleanCookies', options);
+        return Promise.resolve();
+    }
+    getCookies(options) {
+        return Promise.resolve(options);
+    }
+    openWebView(options) {
+        var _a, _b, _c;
+        if (options.fullscreen) {
+            return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+        }
+        const { popup = false, width, height } = (_a = options.web) !== null && _a !== void 0 ? _a : {};
+        const features = popup
+            ? ['popup=yes', width ? `width=${width}` : '', height ? `height=${height}` : ''].filter(Boolean).join(',')
+            : '';
+        const opened = globalThis.open('', '_blank', features);
+        if (!opened) {
+            return Promise.reject(new Error('Popup blocked'));
+        }
+        const id = `web-${++this.webViewCounter}`;
+        const timer = globalThis.setInterval(() => this.watchClosed(id), 500);
+        // Header loads render inside an app-origin wrapper document, so messages target the app origin there.
+        const origin = this.hasHeaders(options.headers)
+            ? ((_c = (_b = globalThis.location) === null || _b === void 0 ? void 0 : _b.origin) !== null && _c !== void 0 ? _c : 'null')
+            : this.resolveTargetOrigin(options.url);
+        this.webViews.set(id, { window: opened, url: options.url, timer, origin });
+        this.navigateOpenedWindow(id, opened, options.url, options.headers);
+        return Promise.resolve({ id });
+    }
+    executeScript({ code }) {
+        console.log('code', code);
+        return Promise.resolve(code);
+    }
+    close(options) {
+        const resolved = this.resolveWebViewEntry(options === null || options === void 0 ? void 0 : options.id);
+        if (!resolved) {
+            return Promise.resolve();
+        }
+        resolved.entry.window.close();
+        this.watchClosed(resolved.id);
+        return Promise.resolve();
+    }
+    hide(_options) {
+        console.log('hide', _options);
+        return Promise.resolve();
+    }
+    show(_options) {
+        console.log('show', _options);
+        return Promise.resolve();
+    }
+    sendToBack(_options) {
+        console.log('sendToBack not supported on web', _options);
+        return Promise.resolve();
+    }
+    bringToFront(_options) {
+        console.log('bringToFront not supported on web', _options);
+        return Promise.resolve();
+    }
+    dispatchInputEvent(_options) {
+        console.log('dispatchInputEvent not supported on web', _options);
+        return Promise.resolve();
+    }
+    setUrl(options) {
+        console.log('setUrl', options.url);
+        return Promise.resolve();
+    }
+    reload(options) {
+        console.log('reload', options);
+        return Promise.resolve();
+    }
+    postMessage(options) {
+        const resolved = this.resolveWebViewEntry(options.id);
+        if (resolved) {
+            resolved.entry.window.postMessage(options.detail, resolved.entry.origin);
+        }
+        return Promise.resolve();
+    }
+    takeScreenshot(_options) {
+        console.log('takeScreenshot not supported on web', _options);
+        return Promise.reject(this.unimplemented('Screenshots are not supported on web.'));
+    }
+    goBack() {
+        console.log('goBack');
+        return Promise.resolve();
+    }
+    getPluginVersion() {
+        return Promise.resolve({ version: 'web' });
+    }
+    updateDimensions(_options) {
+        console.log('updateDimensions', _options);
+        return Promise.resolve();
+    }
+    handleProxyRequest(options) {
+        console.log('handleProxyRequest not supported on web', options);
+        return Promise.resolve();
+    }
+    setEnabledSafeTopMargin(_options) {
+        console.log('setEnabledSafeTopMargin not supported on web', _options);
+        return Promise.resolve();
+    }
+    setFullscreen(options) {
+        console.log('setFullscreen not supported on web', options);
+        return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+    }
+    getFullscreen(_options) {
+        console.log('getFullscreen not supported on web', _options);
+        return Promise.reject(this.unimplemented('Fullscreen is only supported by native openWebView presentations.'));
+    }
+    setEnabledSafeBottomMargin(_options) {
+        console.log('setEnabledSafeBottomMargin not supported on web', _options);
+        return Promise.resolve();
+    }
+    async openSecureWindow(options) {
+        const w = 600;
+        const h = 550;
+        const settings = [
+            ['width', w],
+            ['height', h],
+            ['left', screen.width / 2 - w / 2],
+            ['top', screen.height / 2 - h / 2],
+        ]
+            .map((x) => x.join('='))
+            .join(',');
+        const popup = globalThis.open(options.authEndpoint, 'Authorization', settings);
+        if (!popup) {
+            throw new Error('Failed to open secure window');
+        }
+        if (typeof popup.focus === 'function') {
+            popup.focus();
+        }
+        return new Promise((resolve, reject) => {
+            const bc = new BroadcastChannel(options.broadcastChannelName || 'oauth-channel');
+            bc.addEventListener('message', (event) => {
+                if (event.data.startsWith(options.redirectUri)) {
+                    bc.close();
+                    resolve({ redirectedUri: event.data });
+                }
+                else {
+                    bc.close();
+                    reject(new Error('Redirect URI does not match, expected ' + options.redirectUri + ' but got ' + event.data));
+                }
+            });
+            setTimeout(() => {
+                bc.close();
+                reject(new Error('The sign-in flow timed out'));
+            }, 5 * 60000);
+        });
+    }
+}
+
 exports.BackgroundColor = void 0;
 (function (BackgroundColor) {
     BackgroundColor["WHITE"] = "white";
@@ -237,8 +639,12 @@ function resolvePluginName() {
         'Ensure @capgo/capacitor-inappbrowser native code is installed.');
     return CAPGO_PLUGIN_NAME;
 }
+let webImplementation;
 const inAppBrowserImplementations = {
-    web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.InAppBrowserWeb()),
+    // Imported statically so the first openWebView() reaches window.open without awaiting a chunk load,
+    // which can outlast the browser's user-activation window and get the popup blocked.
+    // Memoized so concurrent first calls share one instance (one id counter and window map).
+    web: () => (webImplementation !== null && webImplementation !== void 0 ? webImplementation : (webImplementation = new InAppBrowserWeb())),
 };
 function assertValidBundledAssetPath(url) {
     if (isRelativeBundledPath(url) && containsPathTraversal(url)) {
@@ -380,157 +786,6 @@ const addProxyHandler = (callback) => {
     });
 };
 
-class InAppBrowserWeb extends core.WebPlugin {
-    clearAllCookies() {
-        console.log('clearAllCookies');
-        return Promise.resolve();
-    }
-    clearCache() {
-        console.log('clearCache');
-        return Promise.resolve();
-    }
-    clearAllBrowsingData() {
-        console.log('clearAllBrowsingData');
-        return Promise.resolve();
-    }
-    async open(options) {
-        console.log('open', options);
-        return options;
-    }
-    async clearCookies(options) {
-        console.log('cleanCookies', options);
-        return;
-    }
-    async getCookies(options) {
-        // Web implementation to get cookies
-        return options;
-    }
-    async openWebView(options) {
-        if (options.fullscreen) {
-            throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-        }
-        console.log('openWebView', options);
-        return options;
-    }
-    async executeScript({ code }) {
-        console.log('code', code);
-        return code;
-    }
-    async close(options) {
-        console.log('close', options);
-        return;
-    }
-    async hide(options) {
-        console.log('hide', options);
-        return;
-    }
-    async show(options) {
-        console.log('show', options);
-        return;
-    }
-    async sendToBack(options) {
-        console.log('sendToBack not supported on web', options);
-        return;
-    }
-    async bringToFront(options) {
-        console.log('bringToFront not supported on web', options);
-        return;
-    }
-    async dispatchInputEvent(options) {
-        console.log('dispatchInputEvent not supported on web', options);
-        return;
-    }
-    async setUrl(options) {
-        console.log('setUrl', options.url);
-        return;
-    }
-    async reload(options) {
-        console.log('reload', options);
-        return;
-    }
-    async postMessage(options) {
-        console.log('postMessage', options);
-        return options;
-    }
-    async takeScreenshot(options) {
-        console.log('takeScreenshot not supported on web', options);
-        throw this.unimplemented('Screenshots are not supported on web.');
-    }
-    async goBack() {
-        console.log('goBack');
-        return;
-    }
-    async getPluginVersion() {
-        return { version: 'web' };
-    }
-    async updateDimensions(options) {
-        console.log('updateDimensions', options);
-        // Web platform doesn't support dimension control
-        return;
-    }
-    async handleProxyRequest(options) {
-        console.log('handleProxyRequest not supported on web', options);
-        return;
-    }
-    async setEnabledSafeTopMargin(options) {
-        console.log('setEnabledSafeTopMargin not supported on web', options);
-        return;
-    }
-    async setFullscreen(options) {
-        console.log('setFullscreen not supported on web', options);
-        throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-    }
-    async getFullscreen(options) {
-        console.log('getFullscreen not supported on web', options);
-        throw this.unimplemented('Fullscreen is only supported by native openWebView presentations.');
-    }
-    async setEnabledSafeBottomMargin(options) {
-        console.log('setEnabledSafeBottomMargin not supported on web', options);
-        return;
-    }
-    async openSecureWindow(options) {
-        const w = 600;
-        const h = 550;
-        const settings = [
-            ['width', w],
-            ['height', h],
-            ['left', screen.width / 2 - w / 2],
-            ['top', screen.height / 2 - h / 2],
-        ]
-            .map((x) => x.join('='))
-            .join(',');
-        const popup = window.open(options.authEndpoint, 'Authorization', settings);
-        if (!popup) {
-            throw new Error('Failed to open secure window');
-        }
-        if (typeof popup.focus === 'function') {
-            popup.focus();
-        }
-        return new Promise((resolve, reject) => {
-            const bc = new BroadcastChannel(options.broadcastChannelName || 'oauth-channel');
-            bc.addEventListener('message', (event) => {
-                if (event.data.startsWith(options.redirectUri)) {
-                    bc.close();
-                    resolve({ redirectedUri: event.data });
-                }
-                else {
-                    bc.close();
-                    reject(new Error('Redirect URI does not match, expected ' + options.redirectUri + ' but got ' + event.data));
-                }
-            });
-            setTimeout(() => {
-                bc.close();
-                reject(new Error('The sign-in flow timed out'));
-            }, 5 * 60000);
-        });
-    }
-}
-
-var web = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    InAppBrowserWeb: InAppBrowserWeb
-});
-
 exports.InAppBrowser = InAppBrowser;
 exports.addProxyHandler = addProxyHandler;
 //# sourceMappingURL=plugin.cjs.js.map