@capgo/capacitor-passkey 8.2.0

package/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "@capgo/capacitor-passkey",
+  "version": "8.2.0",
+  "description": "Capacitor passkey plugin with a WebAuthn-style shim for Capacitor apps.",
+  "main": "dist/plugin.cjs.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "unpkg": "dist/plugin.js",
+  "exports": {
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/plugin.cjs.js",
+      "default": "./dist/esm/index.js"
+    },
+    "./auto": {
+      "types": "./dist/esm/auto.d.ts",
+      "import": "./dist/esm/auto.js",
+      "default": "./dist/esm/auto.js"
+    }
+  },
+  "files": [
+    "android/src/main/",
+    "android/build.gradle",
+    "dist/",
+    "ios/Sources",
+    "ios/Tests",
+    "Package.swift",
+    "CapgoCapacitorPasskey.podspec",
+    "scripts/configure-native.js"
+  ],
+  "author": "Martin Donadieu <martin@capgo.app>",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cap-go/capacitor-passkey.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Cap-go/capacitor-passkey/issues"
+  },
+  "homepage": "https://capgo.app/docs/plugins/passkey/",
+  "keywords": [
+    "capacitor",
+    "passkey",
+    "webauthn",
+    "credential-manager",
+    "authentication"
+  ],
+  "scripts": {
+    "capacitor:sync:after": "node scripts/configure-native.js",
+    "capacitor:update:after": "node scripts/configure-native.js",
+    "verify": "bun run verify:ios && bun run verify:android && bun run verify:web",
+    "verify:ios": "xcodebuild -scheme CapgoCapacitorPasskey -destination generic/platform=iOS",
+    "verify:android": "cd android && ./gradlew clean build test && cd ..",
+    "verify:web": "bun run build",
+    "lint": "bun run eslint && bun run prettier -- --check && bun run swiftlint -- lint",
+    "fmt": "bun run eslint -- --fix && bun run prettier -- --write && bun run swiftlint -- --fix --format",
+    "eslint": "eslint . --ext .ts",
+    "prettier": "prettier-pretty-check \"**/*.{css,html,ts,js,java}\" --plugin=prettier-plugin-java",
+    "swiftlint": "node-swiftlint",
+    "docgen": "docgen --api CapacitorPasskeyPlugin --output-readme README.md --output-json dist/docs.json",
+    "build": "bun run clean && bun run docgen && tsc && rollup -c rollup.config.mjs",
+    "clean": "rimraf ./dist",
+    "watch": "tsc --watch",
+    "prepublishOnly": "bun run build",
+    "check:wiring": "node scripts/check-capacitor-plugin-wiring.mjs"
+  },
+  "devDependencies": {
+    "@capacitor/android": "^8.0.0",
+    "@capacitor/cli": "^8.0.0",
+    "@capacitor/core": "^8.0.0",
+    "@capacitor/docgen": "^0.3.1",
+    "@capacitor/ios": "^8.0.0",
+    "@ionic/eslint-config": "^0.4.0",
+    "@ionic/prettier-config": "^4.0.0",
+    "@ionic/swiftlint-config": "^2.0.0",
+    "@types/node": "^24.10.1",
+    "eslint": "^8.57.1",
+    "eslint-plugin-import": "^2.31.0",
+    "husky": "^9.1.7",
+    "prettier": "^3.6.2",
+    "prettier-pretty-check": "^0.2.0",
+    "prettier-plugin-java": "^2.7.7",
+    "rimraf": "^6.1.0",
+    "rollup": "^4.53.2",
+    "swiftlint": "^2.0.0",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@capacitor/core": ">=8.0.0"
+  },
+  "prettier": "@ionic/prettier-config",
+  "swiftlint": "@ionic/swiftlint-config",
+  "eslintConfig": {
+    "extends": "@ionic/eslint-config/recommended"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  }
+}

package/scripts/configure-native.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT_DIR = process.env.CAPACITOR_ROOT_DIR;
+const PLATFORM = process.env.CAPACITOR_PLATFORM_NAME;
+const CONFIG_JSON = process.env.CAPACITOR_CONFIG;
+const ANDROID_META_BLOCK = `        <!-- CapacitorPasskey auto-configuration -->\n        <meta-data\n            android:name="asset_statements"\n            android:resource="@string/capacitor_passkey_asset_statements" />`;
+
+function log(message) {
+  console.log(`[CapacitorPasskey] ${message}`);
+}
+
+function warn(message) {
+  console.warn(`[CapacitorPasskey] ${message}`);
+}
+
+function parseConfig() {
+  if (!CONFIG_JSON) {
+    return {
+      autoShim: true,
+      domains: [],
+      origin: undefined,
+    };
+  }
+
+  try {
+    const config = JSON.parse(CONFIG_JSON);
+    const pluginConfig = config?.plugins?.CapacitorPasskey ?? {};
+    const origin = normalizeOrigin(pluginConfig.origin);
+    return {
+      autoShim: pluginConfig.autoShim !== false,
+      domains: collectDomains(pluginConfig.domains, origin),
+      origin,
+    };
+  } catch (error) {
+    warn(`Could not parse CAPACITOR_CONFIG: ${error.message}`);
+    return {
+      autoShim: true,
+      domains: [],
+      origin: undefined,
+    };
+  }
+}
+
+function normalizeOrigin(value) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    return undefined;
+  }
+
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== 'https:') {
+      warn(`Ignoring non-HTTPS origin "${value}". Passkey origin should be HTTPS.`);
+      return undefined;
+    }
+
+    return parsed.origin;
+  } catch {
+    warn(`Ignoring invalid origin "${value}".`);
+    return undefined;
+  }
+}
+
+function normalizeDomain(value) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    return undefined;
+  }
+
+  try {
+    return new URL(value).hostname || undefined;
+  } catch {
+    return value.trim();
+  }
+}
+
+function collectDomains(configuredDomains, origin) {
+  const domains = new Set();
+
+  if (Array.isArray(configuredDomains)) {
+    for (const domain of configuredDomains) {
+      const normalized = normalizeDomain(domain);
+      if (normalized) {
+        domains.add(normalized);
+      }
+    }
+  }
+
+  if (origin) {
+    domains.add(new URL(origin).hostname);
+  }
+
+  return [...domains];
+}
+
+function ensureParentDirectory(filePath) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+}
+
+function escapeXml(value) {
+  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+function writeFileIfChanged(filePath, nextContent) {
+  const previousContent = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : undefined;
+  if (previousContent === nextContent) {
+    return false;
+  }
+
+  ensureParentDirectory(filePath);
+  fs.writeFileSync(filePath, nextContent, 'utf8');
+  return true;
+}
+
+function removeManagedAndroidMetadata(content) {
+  return content.replace(
+    /\n?\s*<!-- CapacitorPasskey auto-configuration -->\n\s*<meta-data\s+android:name="asset_statements"\s+android:resource="@string\/capacitor_passkey_asset_statements"\s*\/>\n?/m,
+    '\n',
+  );
+}
+
+function configureAndroid(rootDir, domains) {
+  const manifestPath = path.join(rootDir, 'android', 'app', 'src', 'main', 'AndroidManifest.xml');
+  const valuesPath = path.join(rootDir, 'android', 'app', 'src', 'main', 'res', 'values', 'capacitor-passkey.xml');
+
+  if (!fs.existsSync(manifestPath)) {
+    log('Skipping Android auto-configuration because AndroidManifest.xml was not found.');
+    return;
+  }
+
+  let manifest = fs.readFileSync(manifestPath, 'utf8');
+  manifest = removeManagedAndroidMetadata(manifest);
+
+  if (domains.length > 0) {
+    if (!manifest.includes('@string/capacitor_passkey_asset_statements')) {
+      manifest = manifest.replace('</application>', `${ANDROID_META_BLOCK}\n    </application>`);
+    }
+
+    const includes = domains.map((domain) => ({
+      include: `https://${domain}/.well-known/assetlinks.json`,
+    }));
+    const xml = `<?xml version="1.0" encoding="utf-8"?>\n<resources>\n    <string name="capacitor_passkey_asset_statements" translatable="false">${escapeXml(JSON.stringify(includes))}</string>\n</resources>\n`;
+
+    const valuesChanged = writeFileIfChanged(valuesPath, xml);
+    const manifestChanged = writeFileIfChanged(manifestPath, manifest);
+
+    if (manifestChanged || valuesChanged) {
+      log(`Updated Android passkey wiring for ${domains.join(', ')}.`);
+    }
+    return;
+  }
+
+  const manifestChanged = writeFileIfChanged(manifestPath, manifest);
+  if (fs.existsSync(valuesPath)) {
+    fs.unlinkSync(valuesPath);
+  }
+
+  if (manifestChanged) {
+    log('Removed Android passkey auto-configuration because no domains are configured.');
+  }
+}
+
+function createEntitlementsPlist() {
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n</dict>\n</plist>\n`;
+}
+
+function replaceEntitlementArray(content, key, values) {
+  const keyPattern = new RegExp(`\\s*<key>${key}</key>\\s*<array>[\\s\\S]*?<\\/array>\\s*`, 'm');
+  const replacement =
+    values.length > 0
+      ? `\n\t<key>${key}</key>\n\t<array>\n${values.map((value) => `\t\t<string>${value}</string>`).join('\n')}\n\t</array>\n`
+      : '\n';
+
+  if (keyPattern.test(content)) {
+    return content.replace(keyPattern, replacement);
+  }
+
+  if (values.length === 0) {
+    return content;
+  }
+
+  return content.replace('</dict>', `${replacement}</dict>`);
+}
+
+function ensureIosEntitlementsReference(projectContent, entitlementsRelativePath) {
+  if (projectContent.includes('CODE_SIGN_ENTITLEMENTS =')) {
+    return projectContent;
+  }
+
+  return projectContent.replace(
+    /(\s*INFOPLIST_FILE = App\/Info\.plist;\n)/g,
+    `\t\t\t\tCODE_SIGN_ENTITLEMENTS = ${entitlementsRelativePath};\n$1`,
+  );
+}
+
+function findExistingEntitlementsPath(projectContent) {
+  const match = projectContent.match(/CODE_SIGN_ENTITLEMENTS = ([^;]+);/);
+  return match?.[1]?.trim();
+}
+
+function configureIOS(rootDir, domains) {
+  const iosProjectRoot = path.join(rootDir, 'ios', 'App');
+  const pbxprojPath = path.join(iosProjectRoot, 'App.xcodeproj', 'project.pbxproj');
+
+  if (!fs.existsSync(pbxprojPath)) {
+    log('Skipping iOS auto-configuration because App.xcodeproj was not found.');
+    return;
+  }
+
+  let projectContent = fs.readFileSync(pbxprojPath, 'utf8');
+  const entitlementsRelativePath = findExistingEntitlementsPath(projectContent) ?? 'App/App.entitlements';
+  const entitlementsPath = path.join(iosProjectRoot, entitlementsRelativePath);
+  const associatedDomains = domains.map((domain) => `webcredentials:${domain}`);
+
+  const originalEntitlements = fs.existsSync(entitlementsPath)
+    ? fs.readFileSync(entitlementsPath, 'utf8')
+    : createEntitlementsPlist();
+  const nextEntitlements = replaceEntitlementArray(
+    originalEntitlements.includes('<dict>') ? originalEntitlements : createEntitlementsPlist(),
+    'com.apple.developer.associated-domains',
+    associatedDomains,
+  );
+  const entitlementsChanged = writeFileIfChanged(entitlementsPath, nextEntitlements);
+
+  projectContent = ensureIosEntitlementsReference(projectContent, entitlementsRelativePath);
+  const projectChanged = writeFileIfChanged(pbxprojPath, projectContent);
+
+  if (entitlementsChanged || projectChanged) {
+    if (domains.length > 0) {
+      log(`Updated iOS associated domains for ${domains.join(', ')}.`);
+    } else {
+      log('Removed iOS associated domains because no passkey domains are configured.');
+    }
+  }
+}
+
+function run() {
+  if (!ROOT_DIR) {
+    warn('CAPACITOR_ROOT_DIR is not set. Skipping automatic native configuration.');
+    return;
+  }
+
+  const config = parseConfig();
+  const shouldConfigureAndroid = !PLATFORM || PLATFORM === 'android';
+  const shouldConfigureIOS = !PLATFORM || PLATFORM === 'ios';
+
+  if (shouldConfigureAndroid) {
+    configureAndroid(ROOT_DIR, config.domains);
+  }
+
+  if (shouldConfigureIOS) {
+    configureIOS(ROOT_DIR, config.domains);
+  }
+
+  if (config.domains.length === 0) {
+    log(
+      'No passkey domains configured. Add plugins.CapacitorPasskey.origin or domains in capacitor.config.* to enable automatic native wiring.',
+    );
+  }
+}
+
+run();