@craft-native/ios 0.0.244 → 0.0.245

package/dist/index.d.ts

@@ -253,6 +253,14 @@ export interface CraftConfig {
      * `craft.secureStorage.getSync('auth.token')`. Turns on secure storage.
      */
     shareStorage?: Record<string, string>;
+    /**
+     * The secure-storage key the signed-in account's token lives under
+     * (default `auth.token`). `craft.session` follows it: a change of it, made
+     * by any native screen or by the page through a `shareStorage` key, is
+     * `SESSION_CHANGED { key, token, previous }` on every native screen and a
+     * `craftsession` event on the page.
+     */
+    sessionTokenKey?: string;
     /**
      * Crash and error reporting to bughq (CraftCrashReporter.swift): crashes
      * and hangs (signal handlers, NSException, MetricKit), uncaught JavaScript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/ios",
-  "version": "0.0.244",
+  "version": "0.0.245",
   "homepage": "https://github.com/craft-native/craft/tree/main/packages/ios#readme",
   "repository": {
     "type": "git",

package/templates/CraftApp.swift

@@ -1619,6 +1619,10 @@ struct CraftConfig: Codable {
     /// Hybrid: web-storage keys the page's own code writes, mirrored into the
     /// Keychain under another name for native screens (`{"auth_token": "auth.token"}`).
     var shareStorage: [String: String]? = nil
+    /// The secure-storage key the signed-in account's token lives under
+    /// (`auth.token` unless set): `craft.session` follows it, and a change of
+    /// it is `SESSION_CHANGED` on every screen (CraftSession).
+    var sessionTokenKey: String? = nil
     /// The bundle route of the app script: a screen-less script that runs for
     /// the app's whole life and hears the app's events (CraftHybrid.swift).
     var nativeApp: String? = nil

package/templates/CraftHybrid.swift

@@ -488,12 +488,16 @@ final class CraftHybrid: NSObject {
     func pageScript() -> String {
         let routeList = (config.nativeScreens ?? [:]).map { ["pattern": $0.key, "screen": $0.value] }
         let share = Array((config.shareStorage ?? [:]).keys).sorted()
+        // The page's key for the sign-in token, when it shares one.
+        let tokenKey = CraftSession.tokenKey(config)
+        let session = (config.shareStorage ?? [:]).filter { $0.value == tokenKey }.map(\.key).sorted().first
         func json(_ value: Any) -> String {
             (try? JSONSerialization.data(withJSONObject: value)).flatMap { String(data: $0, encoding: .utf8) } ?? "[]"
         }
         return Self.pageScriptTemplate
             .replacingOccurrences(of: "__CRAFT_HYBRID_ROUTES__", with: json(routeList))
             .replacingOccurrences(of: "__CRAFT_HYBRID_SHARE__", with: json(share))
+            .replacingOccurrences(of: "__CRAFT_HYBRID_SESSION__", with: session.map { json([$0]) } ?? "[]")
     }
 
     // CRAFT_HYBRID_PAGE_SCRIPT_START
@@ -691,13 +695,46 @@ final class CraftHybrid: NSObject {
 
       // Web storage the config shares with native screens (`shareStorage`).
       var shared = {};
-      function share(key) {
+      // The page's key for the sign-in token (`sessionTokenKey`), if shared.
+      var SESSION = (__CRAFT_HYBRID_SESSION__)[0] || null;
+      var sessionListeners = [];
+      function stored(key) {
         var value = null;
         try { value = window.sessionStorage.getItem(key); } catch (e) {}
         try { if (value === null) value = window.localStorage.getItem(key); } catch (e) {}
+        return value;
+      }
+      function sessionToken(value) { return typeof value === 'string' && value !== '' ? value : null; }
+      function share(key) {
+        var value = stored(key);
         if (shared[key] === value) return;
+        var known = Object.prototype.hasOwnProperty.call(shared, key);
+        var before = shared[key];
         shared[key] = value;
         post({ type: 'shareStorage', key: key, value: value });
+        // A sign-in, sign-out or another account, made here or on a native
+        // screen: `craftsession { key, token, previous }` and craft.session.
+        if (key === SESSION && known && sessionToken(before) !== sessionToken(value)) {
+          var change = { key: key, token: sessionToken(value), previous: sessionToken(before) };
+          sessionListeners.slice().forEach(function (callback) {
+            try { callback(change.token, change.previous); } catch (e) { console.error(e); }
+          });
+          try { window.dispatchEvent(new CustomEvent('craftsession', { detail: change })); } catch (e) {}
+        }
+      }
+      if (SESSION && window.craft && !window.craft.session) {
+        window.craft.session = {
+          key: SESSION,
+          token: function () { return sessionToken(stored(SESSION)); },
+          onChange: function (callback) {
+            if (typeof callback !== 'function') throw new TypeError('craft.session.onChange needs a function');
+            sessionListeners.push(callback);
+            return function () {
+              var index = sessionListeners.indexOf(callback);
+              if (index >= 0) sessionListeners.splice(index, 1);
+            };
+          }
+        };
       }
       if (SHARE.length && window.Storage) {
         var proto = window.Storage.prototype;
@@ -808,7 +845,9 @@ final class CraftHybrid: NSObject {
             guard let nativeKey = config.shareStorage?[key] else { return }
             // The page's own write, or its echo of one a native screen made.
             pendingShared.removeValue(forKey: key)
-            CraftHybridKeychain.set(nativeKey, value: value)
+            // The page's sign-in or sign-out moves the account for every
+            // screen; an echo writes what is already there and moves nothing.
+            CraftSession.observe(key: nativeKey, config: config) { CraftHybridKeychain.set(nativeKey, value: value) }
         case .navigated(let path, let direction, let depth, let byHost):
             pagePath = path
             pageDepth = depth

package/templates/CraftNativeActions.swift

@@ -205,11 +205,21 @@ enum CraftNativeActions {
                 complete(requestToken, failure("CAPABILITY_DISABLED", "Secure storage is disabled"), completion)
                 return
             }
-            sync = secureStorage(method: method, args: args)
-            // A key the web page shares (`shareStorage`): the page gets it too,
-            // so a sign-in on a native screen signs the page in.
-            if case .success = sync, ["set", "remove", "delete"].contains(method), let key = args.first as? String {
-                CraftHybrid.shared.nativeWroteShared(nativeKey: key, value: method == "set" ? args.count > 1 ? args[1] as? String : nil : nil)
+            let write = { () -> Result<Any, CraftNativeActionError> in
+                let result = secureStorage(method: method, args: args)
+                // A key the web page shares (`shareStorage`): the page gets it too,
+                // so a sign-in on a native screen signs the page in.
+                if case .success = result, ["set", "remove", "delete"].contains(method), let key = args.first as? String {
+                    CraftHybrid.shared.nativeWroteShared(nativeKey: key, value: method == "set" ? args.count > 1 ? args[1] as? String : nil : nil)
+                }
+                return result
+            }
+            // A write that moves the sign-in token is the account's change:
+            // every screen hears it (CraftSession). Reads skip the check.
+            if ["set", "remove", "delete", "clear"].contains(method) {
+                sync = CraftSession.observe(key: method == "clear" ? nil : args.first as? String, config: config, write)
+            } else {
+                sync = write()
             }
         case ("Biometrics", "isAvailable"):
             sync = config.enableBiometric ? .success(biometricContext().canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil)) : failure("CAPABILITY_DISABLED", "Biometric authentication is disabled")
@@ -1423,6 +1433,54 @@ extension CraftNativeActions {
     }
 }
 
+/// The signed-in account: the token kept in secure storage under
+/// `sessionTokenKey` (default `auth.token`). Whoever moves it, a native
+/// screen's `craft.secureStorage`, the page's own sign-in through a
+/// `shareStorage` key, or a sign-out's clear, posts `changed` once with
+/// `key`, `token` and `previous` (NSNull when signed out), after the Keychain
+/// holds the new value. Each native screen hands it to its script as
+/// `SESSION_CHANGED` and to `craft.session.onChange` (CraftNativeScreen).
+enum CraftSession {
+    static let changed = Notification.Name("craftSessionChanged")
+    static let defaultKey = "auth.token"
+    /// One write and its before and after at a time, so two quick writes
+    /// from different queues are two changes, never one reported twice.
+    private static let lock = NSLock()
+
+    static func tokenKey(_ config: CraftConfig) -> String {
+        guard let key = config.sessionTokenKey, !key.isEmpty else { return defaultKey }
+        return key
+    }
+
+    /// The token now, as `craft.secureStorage.getSync` reads it; nil when
+    /// signed out (an empty token is no account either).
+    static func token(_ config: CraftConfig) -> String? {
+        guard config.enableSecureStorage,
+              let value = CraftNativeActions.webSecureValue(forKey: tokenKey(config)), !value.isEmpty else { return nil }
+        return value
+    }
+
+    /// Run `write`, and post `changed` when it moved the token. `key` is the
+    /// key written; nil for a clear, which can remove every key.
+    static func observe<T>(key: String?, config: CraftConfig, _ write: () -> T) -> T {
+        let name = tokenKey(config)
+        guard key == nil || key == name else { return write() }
+        lock.lock()
+        let before = token(config)
+        let result = write()
+        let after = token(config)
+        lock.unlock()
+        if before != after { post(key: name, token: after, previous: before) }
+        return result
+    }
+
+    static func post(key: String, token: String?, previous: String?) {
+        let info: [String: Any] = ["key": key, "token": token ?? NSNull(), "previous": previous ?? NSNull()]
+        let send = { NotificationCenter.default.post(name: changed, object: nil, userInfo: info) }
+        if Thread.isMainThread { send() } else { DispatchQueue.main.async(execute: send) }
+    }
+}
+
 /// Last-known data for a screen's first frame: one JSON file per name in
 /// `Application Support/craft-snapshots/<name>.json`. A web page writes them
 /// (`snapshots.set` in the mobile API) and a native screen reads them

package/templates/CraftNativeScreen.swift

@@ -4855,6 +4855,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         let appURL = Self.jsonString(config.devServerURL ?? "")
         let appVersion = Self.jsonString(info?["CFBundleShortVersionString"] as? String ?? "")
         let appBuild = Self.jsonString(info?["CFBundleVersion"] as? String ?? "")
+        let sessionTokenKey = Self.jsonString(CraftSession.tokenKey(config))
         jsContext.evaluateScript("""
             // JavaScriptCore has no DOM window, but browser-safe SDK bridges
             // address the host through `window.craft`. Keep native screens
@@ -4873,6 +4874,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                 appURL: \(appURL),
                 appVersion: \(appVersion),
                 appBuild: \(appBuild),
+                sessionTokenKey: \(sessionTokenKey),
                 postMessage: function(message) { craftNativePostMessage(message); },
                 onMessage: function(callback) { globalThis.__stxNativeCallback = callback; }
             };
@@ -5274,6 +5276,33 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                         return value === undefined ? null : value;
                     }
                 });
+                // The signed-in account (CraftSession): the token under
+                // `sessionTokenKey`, and each change of it, which the host
+                // reports through `__craftSessionChanged` after the Keychain
+                // holds it, beside the `SESSION_CHANGED` bridge message.
+                var sessionListeners = [];
+                var sessionKey = globalThis.__stxNativeBridge && __stxNativeBridge.sessionTokenKey || 'auth.token';
+                function sessionToken() {
+                    var value = craftNativeSecureGet(String(sessionKey));
+                    return typeof value === 'string' && value !== '' ? value : null;
+                }
+                globalThis.__craftSessionChanged = function(token, previous) {
+                    sessionListeners.slice().forEach(function(callback) {
+                        try { callback(token, previous); } catch (error) { console.error('[session] ' + (error && error.stack || error)); }
+                    });
+                };
+                keep('session', {
+                    key: sessionKey,
+                    token: sessionToken,
+                    onChange: function(callback) {
+                        if (typeof callback !== 'function') throw new TypeError('craft.session.onChange needs a function');
+                        sessionListeners.push(callback);
+                        return function() {
+                            var index = sessionListeners.indexOf(callback);
+                            if (index >= 0) sessionListeners.splice(index, 1);
+                        };
+                    }
+                });
                 keep('navigation', {
                     setOptions: function(options) { craftNativeSetOptions(JSON.stringify(options || {})); }
                 });
@@ -5739,6 +5768,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
             guard let name = notification.userInfo?["name"] as? String else { return }
             self?.send(type: "SNAPSHOT_CHANGED", payload: ["name": name])
         })
+        if config.enableSecureStorage {
+            // A sign-in, sign-out or another account, made on any screen or
+            // the page (CraftSession): `SESSION_CHANGED { key, token,
+            // previous }` for the runtime, then craft.session's listeners.
+            lifecycleObservers.append(NotificationCenter.default.addObserver(
+                forName: CraftSession.changed,
+                object: nil,
+                queue: .main
+            ) { [weak self] notification in
+                guard let self, let info = notification.userInfo, let key = info["key"] as? String else { return }
+                let token = info["token"] as? String
+                let previous = info["previous"] as? String
+                self.send(type: "SESSION_CHANGED", payload: ["key": key, "token": token ?? NSNull(), "previous": previous ?? NSNull()])
+                self.jsContext.objectForKeyedSubscript("__craftSessionChanged")?.call(withArguments: [token ?? NSNull(), previous ?? NSNull()])
+            })
+        }
         if config.enablePushNotifications {
             // A new device token (iOS hands one out after a reinstall or a
             // restore): every screen's `craft.push.onToken` hears it.