@cappitolian/http-local-server-swifter 0.0.18 → 0.0.20

package/ios/Sources/HttpLocalServerSwifterPlugin/HttpLocalServerSwifter.swift

@@ -25,45 +25,49 @@ public protocol HttpLocalServerSwifterDelegate: AnyObject {
     }
 
     @objc public func connect(_ call: CAPPluginCall) {
-        // Trigger the Local Network permission dialog before doing any network work.
-        // iOS only shows the dialog once; subsequent calls are no-ops.
-        // We fire it here so the prompt appears at a predictable moment for the user.
-        networkPermission.requestPermissionIfNeeded()
-
-        // Move execution to a background thread immediately.
-        DispatchQueue.global(qos: .userInitiated).async { [weak self] in
+        // Check Local Network permission first via NWBrowser callback.
+        // iOS only shows the system dialog once — subsequent calls return the stored decision.
+        // We must do this BEFORE starting the server because Swifter uses plain TCP sockets
+        // which iOS never blocks — the denial only surfaces through Bonjour/mDNS errors,
+        // not through server.start() failures.
+        networkPermission.checkPermission { [weak self] status in
             guard let self = self else { return }
 
-            self.disconnect()
-            let server = HttpServer()
-            self.webServer = server
-
-            // Use middleware to catch ALL requests and avoid route misses.
-            server.middleware.append { [weak self] request in
-                if request.method == "OPTIONS" {
-                    return self?.corsResponse() ?? .raw(204, "No Content", nil, nil)
-                }
-                return self?.processRequest(request) ?? .raw(500, "Internal Server Error", nil, nil)
+            if status == .denied {
+                print("❌ SWIFTER: Local Network permission denied by user")
+                call.reject("LOCAL_NETWORK_PERMISSION_DENIED")
+                return
             }
 
-            do {
-                try server.start(self.defaultPort, forceIPv4: true)
-                let ip = Self.getWiFiAddress() ?? "127.0.0.1"
+            // .granted or .unknown — proceed with server startup.
+            // .unknown means iOS didn't respond within the timeout (simulator, already granted, etc.)
+            DispatchQueue.global(qos: .userInitiated).async { [weak self] in
+                guard let self = self else { return }
+
+                self.disconnect()
+                let server = HttpServer()
+                self.webServer = server
+
+                // Use middleware to catch ALL requests and avoid route misses.
+                server.middleware.append { [weak self] request in
+                    if request.method == "OPTIONS" {
+                        return self?.corsResponse() ?? .raw(204, "No Content", nil, nil)
+                    }
+                    return self?.processRequest(request) ?? .raw(500, "Internal Server Error", nil, nil)
+                }
 
-                print("🚀 SWIFTER: Server running on http://\(ip):\(self.defaultPort)")
+                do {
+                    try server.start(self.defaultPort, forceIPv4: true)
+                    let ip = Self.getWiFiAddress() ?? "127.0.0.1"
 
-                call.resolve([
-                    "ip": ip,
-                    "port": Int(self.defaultPort)
-                ])
-            } catch {
-                print("❌ SWIFTER ERROR: \(error)")
+                    print("🚀 SWIFTER: Server running on http://\(ip):\(self.defaultPort)")
 
-                // Check if the failure is caused by a denied Local Network permission
-                // and surface a specific error code so the JS layer can handle it distinctly.
-                if self.networkPermission.isPermissionDenied(error) {
-                    call.reject("LOCAL_NETWORK_PERMISSION_DENIED")
-                } else {
+                    call.resolve([
+                        "ip": ip,
+                        "port": Int(self.defaultPort)
+                    ])
+                } catch {
+                    print("❌ SWIFTER ERROR: \(error)")
                     call.reject("Could not start server")
                 }
             }

package/ios/Sources/HttpLocalServerSwifterPlugin/LocalNetworkPermission.swift

@@ -4,69 +4,113 @@ import UIKit
 
 /// Handles Local Network permission lifecycle on iOS.
 ///
-/// iOS does not provide a direct API to query Local Network permission status.
-/// The only available approach is:
-///   1. Trigger the system dialog once by starting a NWBrowser with a Bonjour service.
-///   2. Infer denial from DNS/network errors (kDNSServiceErr_PolicyDenied = -65570).
-///   3. Redirect the user to Settings if denied — re-requesting programmatically is not possible.
+/// IMPORTANT: iOS Local Network permission does NOT block TCP sockets.
+/// It only blocks mDNS/Bonjour service discovery. This means Swifter's
+/// server.start() will always succeed regardless of permission status.
+///
+/// Detection strategy:
+///   - Send a UDP probe to the mDNS multicast address (224.0.0.251:5353).
+///   - This triggers the system permission dialog without requiring any
+///     NSBonjourServices entry in Info.plist.
+///   - NWBrowser was avoided because it requires the browsed service type
+///     to be declared in NSBonjourServices, causing false NoAuth(-65555)
+///     failures even when the permission is actually granted.
 @objc public class LocalNetworkPermission: NSObject {
 
-    // MARK: - Constants
+    // MARK: - Types
+
+    public enum PermissionStatus {
+        case granted
+        case denied
+        case unknown
+    }
+
+    // MARK: - Private state
 
-    /// kDNSServiceErr_PolicyDenied — returned by the system when Local Network access is denied.
-    private static let policyDeniedErrorCode = -65570
+    private var connection: NWConnection?
 
-    // MARK: - Permission trigger
+    // MARK: - Permission check
 
-    /// Triggers the Local Network permission dialog by briefly starting a Bonjour browser.
+    /// Probes the local network to trigger the permission dialog and detect the result.
     ///
-    /// - Important: iOS shows this dialog only once. On subsequent calls it is a no-op.
-    ///   Call this before starting the HTTP server so the dialog appears in a controlled moment,
-    ///   not mid-request when the user least expects it.
-    public func requestPermissionIfNeeded() {
-        let parameters = NWParameters()
-        parameters.includePeerToPeer = true
-
-        let browser = NWBrowser(
-            for: .bonjour(type: "_http._tcp", domain: "local."),
-            using: parameters
-        )
-
-        browser.start(queue: .main)
-
-        // We only need to fire the dialog — cancel shortly after.
-        DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-            browser.cancel()
+    /// Sends a UDP packet to the mDNS multicast address. iOS intercepts this at the
+    /// network layer and either allows it (granted) or blocks it with a policy error (denied).
+    ///
+    /// - Parameter completion: Called on the main thread with the permission status.
+    ///   `.granted` / `.denied` once iOS responds, or `.unknown` on timeout
+    ///   (simulator, permission already granted and cached by the OS, etc.).
+    ///
+    /// - Note: iOS shows the dialog only once. Subsequent calls return the cached decision.
+    public func checkPermission(completion: @escaping (PermissionStatus) -> Void) {
+        // mDNS multicast address — probing this triggers the Local Network permission dialog.
+        // This approach does NOT require NSBonjourServices in Info.plist.
+        let host = NWEndpoint.Host("224.0.0.251")
+        let port = NWEndpoint.Port(rawValue: 5353)!
+
+        let conn = NWConnection(host: host, port: port, using: .udp)
+        self.connection = conn
+
+        var completed = false
+
+        // Timeout fallback — treat unresolved state as unknown and allow server startup.
+        // This covers: simulator, permission already granted (OS may skip the callback),
+        // and edge cases where iOS doesn't fire stateUpdateHandler promptly.
+        let timeout = DispatchWorkItem { [weak self] in
+            guard !completed else { return }
+            completed = true
+            self?.connection?.cancel()
+            self?.connection = nil
+            DispatchQueue.main.async { completion(.unknown) }
         }
-    }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 3.0, execute: timeout)
 
-    // MARK: - Error detection
+        conn.stateUpdateHandler = { [weak self] state in
+            guard !completed else { return }
 
-    /// Returns `true` if the given error indicates the user denied Local Network permission.
-    ///
-    /// - Parameter error: Any `Error` thrown during server start or network operations.
-    public func isPermissionDenied(_ error: Error) -> Bool {
-        let nsError = error as NSError
-        return nsError.code == Self.policyDeniedErrorCode
-    }
+            switch state {
+            case .ready:
+                // UDP connection reached the network layer — permission is granted.
+                completed = true
+                timeout.cancel()
+                self?.connection?.cancel()
+                self?.connection = nil
+                DispatchQueue.main.async { completion(.granted) }
 
-    /// Returns `true` if an error string representation contains known denial markers.
-    ///
-    /// Useful when the original `Error` object is unavailable and only a string is at hand
-    /// (e.g. errors arriving from JavaScript or serialized logs).
-    public func isPermissionDeniedString(_ errorString: String) -> Bool {
-        let lower = errorString.lowercased()
-        return lower.contains("policydenied")
-            || lower.contains("-65570")
-            || lower.contains("policy denied")
+            case .waiting(let error):
+                // .waiting with a policy error = permission denied.
+                // Other .waiting errors (no route, offline) are transient — keep waiting.
+                if Self.isPolicyDenied(error) {
+                    completed = true
+                    timeout.cancel()
+                    self?.connection?.cancel()
+                    self?.connection = nil
+                    DispatchQueue.main.async { completion(.denied) }
+                }
+
+            case .failed(let error):
+                let status: PermissionStatus = Self.isPolicyDenied(error) ? .denied : .unknown
+                completed = true
+                timeout.cancel()
+                self?.connection?.cancel()
+                self?.connection = nil
+                DispatchQueue.main.async { completion(status) }
+
+            case .cancelled:
+                break // Expected — we cancelled it ourselves above
+
+            default:
+                break // .setup, .preparing — keep waiting
+            }
+        }
+
+        conn.start(queue: .main)
     }
 
     // MARK: - Recovery
 
     /// Opens the app's page in iOS Settings so the user can manually grant Local Network access.
     ///
-    /// - Note: This is the only recovery path available. iOS does not allow re-prompting
-    ///   after the user denies the permission.
+    /// - Note: This is the only recovery path available after the user denies the permission.
     /// - Warning: On iOS 17, the user may need to restart the device after granting
     ///   the permission for it to take effect. This is a known iOS 17 bug.
     public func openAppSettings() {
@@ -76,4 +120,19 @@ import UIKit
             UIApplication.shared.open(url)
         }
     }
+
+    // MARK: - Private helpers
+
+    /// Returns true if the NWError indicates a Local Network policy denial.
+    ///
+    /// Known denial error codes:
+    ///   - kDNSServiceErr_PolicyDenied = -65570
+    ///   - kDNSServiceErr_NoAuth       = -65555
+    private static func isPolicyDenied(_ error: NWError) -> Bool {
+        let nsError = error as NSError
+        if nsError.code == -65570 || nsError.code == -65555 { return true }
+
+        let desc = error.localizedDescription.lowercased()
+        return desc.contains("policy") || desc.contains("denied") || desc.contains("noauth")
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cappitolian/http-local-server-swifter",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "description": "Runs a local HTTP server on your device, accessible over LAN. Supports connect, disconnect, GET, and POST methods with IP and port discovery.",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",