@crossbind/core-app-host 0.0.0-bootstrap.0 → 2.0.0-beta.65

package/cpp/src/app.cpp

@@ -0,0 +1,40 @@
+#include "app.h"
+
+#include <cstdio>
+#include <cstdlib>
+
+namespace crossbind::app {
+
+const char *devUrl() {
+#ifdef CROSSBIND_APP_DEV
+    return std::getenv("CROSSBIND_APP_URL");
+#else
+    // A release build loads its own page, whatever starts it.
+    return nullptr;
+#endif
+}
+
+Core &start(const char *devUrl) {
+    const std::string resources = resourceDir();
+    Core &core = *new Core(resources + "/page");
+    core.cors = devUrl != nullptr;
+    std::string bootError;
+    try {
+        bootError = core.boot(readFile(resources + "/host.hbc"), "host.hbc", resources + "/data");
+    } catch (const std::exception &error) {
+        bootError = error.what();
+    }
+    if (!bootError.empty()) {
+        std::fprintf(stderr, "crossbind: the app's module failed to start: %s\n", bootError.c_str());
+        quit(core, 1);
+    }
+    return core;
+}
+
+void quit(Core &core, int status) {
+    core.stop();
+    std::fflush(nullptr);
+    std::_Exit(status);
+}
+
+}  // namespace crossbind::app

package/cpp/src/app.h

@@ -0,0 +1,21 @@
+#pragma once
+
+// What an app does around its webview, whatever makes its window: the module starts from the app's files, and the
+// webview gets the page's token, the module's channel, the page's console and the navigation lock.
+#include "host_core.h"
+
+namespace crossbind::app {
+
+// The page a debug app opens instead of its own: the dev server's, which CROSSBIND_APP_URL names. Null in a release app.
+const char *devUrl();
+// Starts the module from the app's files, or ends the app with the reason.
+Core &start(const char *devUrl);
+// Ends the app without running destructors: bindings keep JSI values in globals, which must not be destroyed after the
+// runtime they belong to.
+[[noreturn]] void quit(Core &core, int status);
+// Readies a webview for the page, and returns the URL it opens first. An Android app's activity does this in Java.
+std::string attach(Core &core, void *webView, const char *devUrl);
+// The scheme and authority of a URL: the origin a webview names a page by.
+std::string originOf(const std::string &url);
+
+}  // namespace crossbind::app

package/cpp/src/attach.cpp

@@ -0,0 +1,40 @@
+#include "app.h"
+
+#include <algorithm>
+#include <cstdlib>
+
+namespace crossbind::app {
+
+namespace {
+
+constexpr const char *APP_ORIGIN = "crossbind://app";
+constexpr const char *APP_URL = "crossbind://app/";
+constexpr const char *REFUSED = "[1,{\"name\":\"Error\",\"message\":\"crossbind: a page from this origin may not call the app's module\"}]";
+
+}  // namespace
+
+std::string originOf(const std::string &url) {
+    const auto scheme = url.find("://");
+    if (scheme == std::string::npos) return url;
+    return url.substr(0, url.find_first_of("/?#", scheme + 3));
+}
+
+std::string attach(Core &core, void *webView, const char *devUrl) {
+    std::vector<std::string> origins{APP_ORIGIN};
+    if (devUrl) origins.push_back(originOf(devUrl));
+    // Only the top frame gets the token every message and crossbind:// call carries: a frame of another origin, or a
+    // sandboxed one, cannot read it.
+    addTopFrameScript(webView, "Object.defineProperty(globalThis, '__crossbind_token', { value: '" + core.token() + "' });");
+    installReplyChannel(webView, "crossbind", [&core, origins](std::string origin, std::string message, ReplyFn reply) {
+        if (!origin.empty() && std::find(origins.begin(), origins.end(), origin) == origins.end()) {
+            reply(REFUSED);
+            return;
+        }
+        core.receive(std::move(message), std::move(reply));
+    });
+    if (devUrl || std::getenv("CROSSBIND_APP_CONSOLE")) forwardConsole(webView);
+    restrictNavigation(webView, origins, [&core] { core.reset(); });
+    return devUrl ? devUrl : APP_URL;
+}
+
+}  // namespace crossbind::app

package/cpp/src/darwin/bundle.mm

@@ -0,0 +1,19 @@
+#import <Cocoa/Cocoa.h>
+
+#include "platform.h"
+
+std::string resourceDir() { return NSBundle.mainBundle.resourcePath.UTF8String; }
+
+std::string appName() {
+    NSString *name = [NSBundle.mainBundle objectForInfoDictionaryKey:@"CFBundleName"] ?: NSProcessInfo.processInfo.processName;
+    return name.UTF8String;
+}
+
+void onQuit(std::function<void()> quit) {
+    [NSNotificationCenter.defaultCenter addObserverForName:NSApplicationWillTerminateNotification
+                                                    object:nil
+                                                     queue:nil
+                                                usingBlock:^(NSNotification *) {
+                                                  quit();
+                                                }];
+}

package/cpp/src/darwin/channels.mm

@@ -0,0 +1,196 @@
+#import <WebKit/WebKit.h>
+
+#include "platform.h"
+
+#include <cstdio>
+#include <memory>
+
+namespace {
+
+// Wraps the page's console and reports uncaught errors, in the main frame alone.
+NSString *const CONSOLE_SCRIPT = @"(() => {"
+    "const text = (args) => args.map((arg) => {"
+    "  if (arg instanceof Error) return `${arg.message}\\n${arg.stack}`;"
+    "  if (typeof arg === 'string') return arg;"
+    "  try { return JSON.stringify(arg); } catch { return String(arg); }"
+    "}).join(' ');"
+    "const post = (level, args) => window.webkit.messageHandlers.crossbind_console.postMessage([level, text(args)]);"
+    "for (const level of ['log', 'info', 'warn', 'error', 'debug']) {"
+    "  const original = console[level].bind(console);"
+    "  console[level] = (...args) => { post(level, args); original(...args); };"
+    "}"
+    "addEventListener('error', (event) => post('error', [event.error ?? event.message]));"
+    "addEventListener('unhandledrejection', (event) => post('error', [event.reason]));"
+    "})();";
+
+void onMainThread(void (^block)(void)) {
+    if ([NSThread isMainThread]) {
+        block();
+    } else {
+        dispatch_async(dispatch_get_main_queue(), block);
+    }
+}
+
+}  // namespace
+
+@interface CBReplyChannel : NSObject <WKScriptMessageHandlerWithReply>
+- (instancetype)initWithHandler:(MessageHandler)handler;
+@end
+
+@implementation CBReplyChannel {
+    MessageHandler _handler;
+}
+
+- (instancetype)initWithHandler:(MessageHandler)handler {
+    if ((self = [super init])) _handler = std::move(handler);
+    return self;
+}
+
+- (void)userContentController:(WKUserContentController *)controller
+      didReceiveScriptMessage:(WKScriptMessage *)message
+                 replyHandler:(void (^)(id, NSString *))replyHandler {
+    NSString *body = [message.body isKindOfClass:[NSString class]] ? message.body : @"";
+    WKSecurityOrigin *sender = message.frameInfo.securityOrigin;
+    NSString *origin = [NSString stringWithFormat:@"%@://%@%@", sender.protocol, sender.host,
+                                 sender.port ? [NSString stringWithFormat:@":%ld", static_cast<long>(sender.port)] : @""];
+    void (^reply)(id, NSString *) = [replyHandler copy];
+    _handler(std::string(origin.UTF8String ?: ""), std::string(body.UTF8String ?: ""), [reply](const std::string &text) {
+        // The host answers from its JS thread, which has no autorelease pool of its own.
+        @autoreleasepool {
+            NSString *answer = [[NSString alloc] initWithBytes:text.data() length:text.size() encoding:NSUTF8StringEncoding];
+            onMainThread(^{
+                reply(answer, nil);
+            });
+        }
+    });
+}
+
+@end
+
+@interface CBConsole : NSObject <WKScriptMessageHandler>
+@end
+
+@implementation CBConsole
+
+- (void)userContentController:(WKUserContentController *)controller didReceiveScriptMessage:(WKScriptMessage *)message {
+    NSArray *entry = [message.body isKindOfClass:[NSArray class]] ? message.body : nil;
+    if (entry.count != 2) return;
+    NSString *level = [entry[0] description];
+    std::FILE *out = [level isEqualToString:@"warn"] || [level isEqualToString:@"error"] ? stderr : stdout;
+    std::fprintf(out, "%s\n", [entry[1] description].UTF8String);
+    std::fflush(out);
+}
+
+@end
+
+@interface CBSchemeHandler : NSObject <WKURLSchemeHandler>
+- (instancetype)initWithHandler:(SchemeHandler)handler;
+@end
+
+@implementation CBSchemeHandler {
+    SchemeHandler _handler;
+    NSMutableSet *_stopped;
+}
+
+- (instancetype)initWithHandler:(SchemeHandler)handler {
+    if ((self = [super init])) {
+        _handler = std::move(handler);
+        _stopped = [NSMutableSet set];
+    }
+    return self;
+}
+
+static std::vector<uint8_t> readBody(NSURLRequest *request) {
+    std::vector<uint8_t> body;
+    if (NSData *data = request.HTTPBody) {
+        body.assign(static_cast<const uint8_t *>(data.bytes), static_cast<const uint8_t *>(data.bytes) + data.length);
+        return body;
+    }
+    NSInputStream *stream = request.HTTPBodyStream;
+    if (!stream) return body;
+    [stream open];
+    uint8_t chunk[65536];
+    for (NSInteger read; (read = [stream read:chunk maxLength:sizeof chunk]) > 0;) {
+        body.insert(body.end(), chunk, chunk + read);
+    }
+    [stream close];
+    return body;
+}
+
+- (void)webView:(WKWebView *)webView startURLSchemeTask:(id<WKURLSchemeTask>)task {
+    NSURLRequest *request = task.request;
+    SchemeRequest incoming;
+    incoming.method = request.HTTPMethod.UTF8String ?: "GET";
+    incoming.path = request.URL.path.UTF8String ?: "";
+    incoming.query = request.URL.query.UTF8String ?: "";
+    incoming.body = readBody(request);
+
+    id<WKURLSchemeTask> held = task;
+    NSURL *url = request.URL;
+    NSMutableSet *stopped = _stopped;
+    _handler(std::move(incoming), [held, url, stopped](SchemeResponse response) {
+        // A call's answer comes from the host's JS thread, which has no autorelease pool of its own.
+        @autoreleasepool {
+            auto *bytes = new std::vector<uint8_t>(std::move(response.body));
+            NSData *data = [[NSData alloc] initWithBytesNoCopy:bytes->data()
+                                                        length:bytes->size()
+                                                   deallocator:^(void *, NSUInteger) { delete bytes; }];
+            NSMutableDictionary *headers = [@{
+                @"Content-Type": [NSString stringWithUTF8String:response.mime.c_str()],
+                @"Content-Length": [NSString stringWithFormat:@"%lu", static_cast<unsigned long>(data.length)],
+            } mutableCopy];
+            for (const auto &[name, value] : response.headers) {
+                headers[[NSString stringWithUTF8String:name.c_str()]] = [NSString stringWithUTF8String:value.c_str()];
+            }
+            NSHTTPURLResponse *http = [[NSHTTPURLResponse alloc] initWithURL:url
+                                                                  statusCode:response.status
+                                                                 HTTPVersion:@"HTTP/1.1"
+                                                                headerFields:headers];
+            onMainThread(^{
+                // The page may have dropped the request meanwhile; WebKit refuses answers to a stopped task.
+                if ([stopped containsObject:held]) {
+                    [stopped removeObject:held];
+                    return;
+                }
+                [held didReceiveResponse:http];
+                [held didReceiveData:data];
+                [held didFinish];
+            });
+        }
+    });
+}
+
+- (void)webView:(WKWebView *)webView stopURLSchemeTask:(id<WKURLSchemeTask>)task {
+    [_stopped addObject:task];
+}
+
+@end
+
+void installReplyChannel(void *webView, const char *name, MessageHandler handler) {
+    WKWebView *view = (__bridge WKWebView *)webView;
+    CBReplyChannel *channel = [[CBReplyChannel alloc] initWithHandler:std::move(handler)];
+    [view.configuration.userContentController addScriptMessageHandlerWithReply:channel
+                                                                  contentWorld:WKContentWorld.pageWorld
+                                                                          name:[NSString stringWithUTF8String:name]];
+}
+
+void forwardConsole(void *webView) {
+    WKUserContentController *controller = ((__bridge WKWebView *)webView).configuration.userContentController;
+    [controller addScriptMessageHandler:[CBConsole new] name:@"crossbind_console"];
+    [controller addUserScript:[[WKUserScript alloc] initWithSource:CONSOLE_SCRIPT
+                                                     injectionTime:WKUserScriptInjectionTimeAtDocumentStart
+                                                  forMainFrameOnly:YES]];
+}
+
+void addTopFrameScript(void *webView, const std::string &source) {
+    WKUserContentController *controller = ((__bridge WKWebView *)webView).configuration.userContentController;
+    [controller addUserScript:[[WKUserScript alloc] initWithSource:[NSString stringWithUTF8String:source.c_str()]
+                                                     injectionTime:WKUserScriptInjectionTimeAtDocumentStart
+                                                  forMainFrameOnly:YES]];
+}
+
+void registerSchemeHandler(void *target, const char *scheme, SchemeHandler handler) {
+    WKWebViewConfiguration *config = (__bridge WKWebViewConfiguration *)target;
+    CBSchemeHandler *schemeHandler = [[CBSchemeHandler alloc] initWithHandler:std::move(handler)];
+    [config setURLSchemeHandler:schemeHandler forURLScheme:[NSString stringWithUTF8String:scheme]];
+}

package/cpp/src/darwin/navigation.mm

@@ -0,0 +1,69 @@
+#import <TargetConditionals.h>
+#if TARGET_OS_IPHONE
+#import <UIKit/UIKit.h>
+#else
+#import <Cocoa/Cocoa.h>
+#endif
+#import <WebKit/WebKit.h>
+#import <objc/runtime.h>
+
+#include "platform.h"
+
+#include <algorithm>
+
+// A page from another origin in any frame would reach the module's channel and its crossbind:// routes, so the webview
+// never loads one. A link the user follows to such a page opens in the default browser instead.
+@interface CBNavigationLock : NSObject <WKNavigationDelegate> {
+@public
+    std::vector<std::string> origins;
+    std::function<void()> newPage;
+}
+@end
+
+@implementation CBNavigationLock
+
+- (BOOL)allows:(NSURL *)url {
+    NSString *scheme = url.scheme.lowercaseString;
+    if ([scheme isEqualToString:@"about"]) return YES;
+    // A blob URL carries the origin of the page that made it.
+    if ([scheme isEqualToString:@"blob"]) return [self allows:[NSURL URLWithString:url.resourceSpecifier]];
+    std::string origin = std::string(scheme.UTF8String ?: "") + "://" + (url.host.UTF8String ?: "");
+    if (url.port) origin += ":" + std::to_string(url.port.intValue);
+    return std::find(origins.begin(), origins.end(), origin) != origins.end();
+}
+
+- (void)webView:(WKWebView *)webView
+    decidePolicyForNavigationAction:(WKNavigationAction *)action
+                    decisionHandler:(void (^)(WKNavigationActionPolicy))decide {
+    NSURL *url = action.request.URL;
+    if ([self allows:url]) {
+        decide(WKNavigationActionPolicyAllow);
+        return;
+    }
+    const BOOL followed = action.navigationType == WKNavigationTypeLinkActivated || action.targetFrame == nil;
+    if (followed && [@[ @"http", @"https", @"mailto" ] containsObject:url.scheme.lowercaseString]) {
+#if TARGET_OS_IPHONE
+        [UIApplication.sharedApplication openURL:url options:@{} completionHandler:nil];
+#else
+        [NSWorkspace.sharedWorkspace openURL:url];
+#endif
+    }
+    decide(WKNavigationActionPolicyCancel);
+}
+
+- (void)webView:(WKWebView *)webView didCommitNavigation:(WKNavigation *)navigation {
+    newPage();
+}
+
+@end
+
+void restrictNavigation(void *webView, std::vector<std::string> origins, std::function<void()> newPage) {
+    static char key;
+    WKWebView *view = (__bridge WKWebView *)webView;
+    CBNavigationLock *lock = [CBNavigationLock new];
+    lock->origins = std::move(origins);
+    lock->newPage = std::move(newPage);
+    // The webview holds its navigation delegate weakly.
+    objc_setAssociatedObject(view, &key, lock, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
+    view.navigationDelegate = lock;
+}