@dynamic-labs-sdk/client 1.6.0 → 1.8.0

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewHostOpenTest.kt

@@ -0,0 +1,347 @@
+package xyz.dynamic.client.webview
+
+import android.app.Activity
+import android.net.Uri
+import android.webkit.WebSettings
+import android.webkit.WebView
+import androidx.webkit.JavaScriptReplyProxy
+import androidx.webkit.ProfileStore
+import androidx.webkit.WebMessageCompat
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.JavaOnlyMap
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import io.mockk.CapturingSlot
+import io.mockk.Runs
+import io.mockk.every
+import io.mockk.just
+import io.mockk.mockk
+import io.mockk.mockkStatic
+import io.mockk.slot
+import io.mockk.unmockkAll
+import io.mockk.verify
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.Robolectric
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.Shadows.shadowOf
+import org.robolectric.annotation.Config
+
+// Exercises the open() happy path that constructs a real (Robolectric-shadowed)
+// WebView. The androidx.webkit statics (WebViewCompat / WebViewFeature /
+// ProfileStore) are mocked because they delegate to the device's System WebView
+// provider, which does not exist off-device — so the tests assert that the host
+// CALLS them correctly (origin-scoped bridge, document-start glue, per-instance
+// profile) and applies the secure WebSettings, rather than exercising the
+// provider itself. WEB_MESSAGE_LISTENER is reported supported so open() proceeds.
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class DynamicWebViewHostOpenTest {
+
+    private lateinit var activity: Activity
+    private lateinit var reactContext: ReactApplicationContext
+
+    private lateinit var webSlot: CapturingSlot<WebView>
+    private lateinit var originRulesSlot: CapturingSlot<Set<String>>
+    private lateinit var listenerSlot: CapturingSlot<WebViewCompat.WebMessageListener>
+
+    @Before
+    fun setUp() {
+        activity = Robolectric.buildActivity(Activity::class.java).setup().get()
+        reactContext = mockk(relaxed = true)
+        every { reactContext.currentActivity } returns activity
+        // Run UI-queue work inline so onBridgeMessage delivery is synchronous.
+        // (The http-error-race tests re-stub this to capture instead.)
+        every { reactContext.runOnUiQueueThread(any()) } answers { firstArg<Runnable>().run() }
+
+        mockkStatic(Arguments::class)
+        every { Arguments.createMap() } answers { JavaOnlyMap() }
+
+        mockkStatic(WebViewFeature::class)
+        // Default: only the (required) bridge feature is available. Document-start
+        // scripts and multi-profile default off; individual tests opt in.
+        every { WebViewFeature.isFeatureSupported(any()) } returns false
+        every {
+            WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)
+        } returns true
+
+        mockkStatic(WebViewCompat::class)
+        webSlot = slot()
+        originRulesSlot = slot()
+        listenerSlot = slot()
+        every {
+            WebViewCompat.addWebMessageListener(
+                capture(webSlot),
+                any(),
+                capture(originRulesSlot),
+                capture(listenerSlot),
+            )
+        } just Runs
+        every {
+            WebViewCompat.addDocumentStartJavaScript(any(), any(), any())
+        } returns mockk(relaxed = true)
+        every { WebViewCompat.setProfile(any(), any()) } just Runs
+    }
+
+    @After
+    fun tearDown() {
+        unmockkAll()
+    }
+
+    private fun host(
+        instanceId: String = "instance-1",
+        onMessage: (Any?) -> Unit = {},
+        onRelease: () -> Unit = {},
+    ) = DynamicWebViewHost(reactContext, instanceId, onMessage, onRelease)
+
+    private fun openHost(
+        url: String = "https://app.dynamicauth.com/waas-v1/env",
+        instanceId: String = "instance-1",
+        onMessage: (Any?) -> Unit = {},
+    ): Pair<DynamicWebViewHost, Promise> {
+        val subject = host(instanceId = instanceId, onMessage = onMessage)
+        val promise = mockk<Promise>(relaxed = true)
+        subject.open(url, promise)
+        return subject to promise
+    }
+
+    // region secure WebSettings
+
+    @Test
+    fun open_appliesSecureWebSettings() {
+        openHost()
+        val s = webSlot.captured.settings
+
+        assertTrue(s.javaScriptEnabled)
+        assertTrue(s.domStorageEnabled)
+        assertFalse(s.allowFileAccess)
+        assertFalse(s.allowContentAccess)
+        @Suppress("DEPRECATION")
+        assertFalse(s.allowFileAccessFromFileURLs)
+        @Suppress("DEPRECATION")
+        assertFalse(s.allowUniversalAccessFromFileURLs)
+        assertEquals(WebSettings.MIXED_CONTENT_NEVER_ALLOW, s.mixedContentMode)
+        assertFalse(s.javaScriptCanOpenWindowsAutomatically)
+        // Multi-window is enabled so onCreateWindow fires (CVE-2020-6506
+        // mitigation: contains iframe window requests instead of letting them
+        // navigate the top frame).
+        assertTrue(s.supportMultipleWindows())
+    }
+
+    // onCreateWindow must deny every window request (popups / target=_blank /
+    // window.open), so the enabled multi-window support never actually opens one.
+    @Test
+    fun open_deniesWindowCreation() {
+        openHost()
+        val chromeClient = shadowOf(webSlot.captured).webChromeClient
+        assertFalse(chromeClient.onCreateWindow(webSlot.captured, false, false, null))
+    }
+
+    // endregion
+
+    // region origin-scoped bridge + navigation target
+
+    @Test
+    fun open_registersWebMessageListenerScopedToNormalizedOrigin() {
+        openHost(url = "https://app.dynamicauth.com:443/waas-v1/env")
+        // Default https port normalized away → matches the page's origin.
+        assertEquals(setOf("https://app.dynamicauth.com"), originRulesSlot.captured)
+    }
+
+    @Test
+    fun open_loadsTheValidatedUrl() {
+        openHost(url = "https://app.dynamicauth.com/waas-v1/xyz")
+        assertEquals(
+            "https://app.dynamicauth.com/waas-v1/xyz",
+            shadowOf(webSlot.captured).lastLoadedUrl,
+        )
+    }
+
+    @Test
+    fun open_injectsDocumentStartScriptScopedToOriginWhenSupported() {
+        every {
+            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
+        } returns true
+
+        openHost(url = "https://app.dynamicauth.com/x")
+
+        verify {
+            WebViewCompat.addDocumentStartJavaScript(
+                any(),
+                BRIDGE_USER_SCRIPT,
+                setOf("https://app.dynamicauth.com"),
+            )
+        }
+    }
+
+    @Test
+    fun open_skipsDocumentStartScriptWhenUnsupported() {
+        openHost()
+        verify(exactly = 0) {
+            WebViewCompat.addDocumentStartJavaScript(any(), any(), any())
+        }
+    }
+
+    // endregion
+
+    // region per-instance profile (storage isolation)
+
+    @Test
+    fun open_assignsPerInstanceProfileWhenMultiProfileSupported() {
+        every {
+            WebViewFeature.isFeatureSupported(WebViewFeature.MULTI_PROFILE)
+        } returns true
+        val store = mockk<ProfileStore>(relaxed = true)
+        mockkStatic(ProfileStore::class)
+        every { ProfileStore.getInstance() } returns store
+
+        openHost(instanceId = "abc")
+
+        verify { store.getOrCreateProfile("dynamic-waas-abc") }
+        verify { WebViewCompat.setProfile(any(), "dynamic-waas-abc") }
+    }
+
+    @Test
+    fun open_skipsProfileWhenMultiProfileUnsupported() {
+        openHost()
+        verify(exactly = 0) { WebViewCompat.setProfile(any(), any()) }
+    }
+
+    // endregion
+
+    // region http-error vs commit race (#8)
+
+    @Test
+    fun httpErrorClaimsPromiseEvenWhenCommitFiresFirst() {
+        val deferred = slot<Runnable>()
+        // Capture the deferred resolve instead of running it inline.
+        every { reactContext.runOnUiQueueThread(capture(deferred)) } just Runs
+        val (subject, promise) = openHost()
+
+        subject.onCommitVisible() // schedules the deferred resolve
+        subject.onHttpError(503) // synchronously claims the pending promise
+        deferred.captured.run() // deferred resolve runs last — but promise is gone
+
+        verify { promise.reject("webview_http_error", "HTTP 503", any<WritableMap>()) }
+        verify(exactly = 0) { promise.resolve(any()) }
+    }
+
+    @Test
+    fun httpErrorBeforeCommit_reportsHttpError() {
+        val deferred = slot<Runnable>()
+        every { reactContext.runOnUiQueueThread(capture(deferred)) } just Runs
+        val (subject, promise) = openHost()
+
+        subject.onHttpError(404)
+        subject.onCommitVisible()
+        if (deferred.isCaptured) deferred.captured.run()
+
+        verify { promise.reject("webview_http_error", "HTTP 404", any<WritableMap>()) }
+        verify(exactly = 0) { promise.resolve(any()) }
+    }
+
+    @Test
+    fun commitVisibleResolvesWhenNoHttpError() {
+        val (subject, promise) = openHost()
+        subject.onCommitVisible()
+        verify { promise.resolve(null) }
+    }
+
+    // endregion
+
+    // region sendMessage via reply proxy (#9)
+
+    @Test
+    fun sendMessage_postsJsonViaReplyProxyVerbatimIncludingLineSeparators() {
+        val (subject, _) = openHost()
+
+        // The page opens the reply channel by posting first; invoke the captured
+        // listener to deliver a replyProxy to the host.
+        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
+        val handshake = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"ready\"}" }
+        listenerSlot.captured.onPostMessage(
+            webSlot.captured,
+            handshake,
+            Uri.parse("https://app.dynamicauth.com"),
+            true,
+            proxy,
+        )
+
+        // A dApp-controlled string containing U+2028 must round-trip verbatim —
+        // the old evaluateJavascript('...') path missed U+2028/U+2029 and would
+        // have broken out of the JS string literal.
+        val payload = JavaOnlyMap().apply {
+            putString("type", "signMessage")
+            putString("message", "approve\u2028tx")
+        }
+        subject.sendMessage(payload)
+
+        val sent = slot<String>()
+        verify { proxy.postMessage(capture(sent)) }
+        assertTrue(sent.captured.contains("\u2028"))
+        assertTrue(sent.captured.contains("signMessage"))
+    }
+
+    @Test
+    fun sendMessage_buffersBeforeReplyChannelThenFlushesInOrder() {
+        val (subject, _) = openHost()
+
+        // Host sends before the page has posted (no replyProxy yet): both must
+        // be buffered, not dropped.
+        subject.sendMessage(JavaOnlyMap().apply { putString("seq", "first") })
+        subject.sendMessage(JavaOnlyMap().apply { putString("seq", "second") })
+
+        // Page opens the reply channel → buffered messages flush in order.
+        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
+        val handshake = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"ready\"}" }
+        listenerSlot.captured.onPostMessage(
+            webSlot.captured,
+            handshake,
+            Uri.parse("https://app.dynamicauth.com"),
+            true,
+            proxy,
+        )
+
+        // The capturing list accumulates invocations in call order.
+        val sent = mutableListOf<String>()
+        verify(exactly = 2) { proxy.postMessage(capture(sent)) }
+        assertEquals(2, sent.size)
+        assertTrue(sent[0].contains("first"))
+        assertTrue(sent[1].contains("second"))
+    }
+
+    @Test
+    fun sendMessage_doesNotCrashWhenReplyChannelNeverOpens() {
+        val (subject, _) = openHost()
+        // No listener callback ever → message stays buffered, no crash.
+        subject.sendMessage(JavaOnlyMap().apply { putString("type", "early") })
+    }
+
+    @Test
+    fun bridgeListener_dropsNonMainFrameMessages() {
+        var delivered: Any? = "UNSET"
+        val (subject, _) = openHost(onMessage = { delivered = it })
+        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
+        val message = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"x\"}" }
+
+        listenerSlot.captured.onPostMessage(
+            webSlot.captured,
+            message,
+            Uri.parse("https://app.dynamicauth.com"),
+            false, // not main frame
+            proxy,
+        )
+
+        assertEquals("UNSET", delivered)
+    }
+
+    // endregion
+}

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewHostTest.kt

@@ -0,0 +1,171 @@
+package xyz.dynamic.client.webview
+
+import android.app.Activity
+import androidx.webkit.WebViewFeature
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.JavaOnlyArray
+import com.facebook.react.bridge.JavaOnlyMap
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableMap
+import io.mockk.every
+import io.mockk.mockk
+import io.mockk.mockkStatic
+import io.mockk.unmockkAll
+import io.mockk.verify
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+// Runs under Robolectric for the android.* types. Arguments.createMap()/
+// createArray() are JNI-backed (WritableNativeMap) and can't run off-device, so
+// they are stubbed to return the pure-Java JavaOnlyMap/JavaOnlyArray — the
+// canonical RN unit-test stand-ins for ReadableMap/WritableMap.
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class DynamicWebViewHostTest {
+
+    private lateinit var reactContext: ReactApplicationContext
+
+    @Before
+    fun setUp() {
+        mockkStatic(Arguments::class)
+        every { Arguments.createMap() } answers { JavaOnlyMap() }
+        every { Arguments.createArray() } answers { JavaOnlyArray() }
+        reactContext = mockk(relaxed = true)
+    }
+
+    @After
+    fun tearDown() {
+        unmockkAll()
+    }
+
+    private fun host(onMessage: (Any?) -> Unit = {}, onRelease: () -> Unit = {}) =
+        DynamicWebViewHost(reactContext, "instance-1", onMessage, onRelease)
+
+    @Test
+    fun open_withNoForegroundActivity_rejectsAndReleases() {
+        every { reactContext.currentActivity } returns null
+        var released = false
+        val subject = host(onRelease = { released = true })
+        val promise = mockk<Promise>(relaxed = true)
+
+        subject.open("https://app.dynamic.xyz", promise)
+
+        verify {
+            promise.reject(
+                "webview_no_host_view",
+                "No foreground activity available to attach WebView.",
+                any<WritableMap>(),
+            )
+        }
+        assertTrue(released)
+    }
+
+    @Test
+    fun onBridgeMessage_passesNonJsonPayloadThroughUnchanged() {
+        every { reactContext.runOnUiQueueThread(any()) } answers {
+            firstArg<Runnable>().run()
+        }
+        var received: Any? = "UNSET"
+        val subject = host(onMessage = { received = it })
+
+        subject.onBridgeMessage("plain-text")
+
+        assertEquals("plain-text", received)
+    }
+
+    @Test
+    fun onBridgeMessage_marshalsJsonObjectIntoReadableMap() {
+        every { reactContext.runOnUiQueueThread(any()) } answers {
+            firstArg<Runnable>().run()
+        }
+        var received: Any? = null
+        val subject = host(onMessage = { received = it })
+
+        subject.onBridgeMessage("""{"foo":"bar","n":7,"flag":true}""")
+
+        val map = received as ReadableMap
+        assertEquals("bar", map.getString("foo"))
+        assertEquals(7, map.getInt("n"))
+        assertTrue(map.getBoolean("flag"))
+    }
+
+    // region URL validation (https + host pin)
+
+    // A non-https / hostless URL is rejected before any WebView is constructed,
+    // so a relaxed Activity stub (never actually touched on the reject path) is
+    // enough to get past the foreground-activity guard.
+    private fun assertRejectsInvalidUrl(url: String) {
+        every { reactContext.currentActivity } returns mockk<Activity>(relaxed = true)
+        val promise = mockk<Promise>(relaxed = true)
+
+        host().open(url, promise)
+
+        verify {
+            promise.reject("webview_invalid_url", "Invalid URL: $url", any<WritableMap>())
+        }
+    }
+
+    @Test
+    fun open_rejectsHttpScheme() = assertRejectsInvalidUrl("http://app.dynamicauth.com")
+
+    @Test
+    fun open_rejectsFileScheme() = assertRejectsInvalidUrl("file:///etc/passwd")
+
+    @Test
+    fun open_rejectsJavascriptScheme() = assertRejectsInvalidUrl("javascript:alert(1)")
+
+    @Test
+    fun open_rejectsContentScheme() = assertRejectsInvalidUrl("content://com.evil/secret")
+
+    @Test
+    fun open_rejectsAboutScheme() = assertRejectsInvalidUrl("about:blank")
+
+    @Test
+    fun open_rejectsHttpsWithoutHost() = assertRejectsInvalidUrl("https://")
+
+    // endregion
+
+    // region origin pin + fail-closed
+    //
+    // Both reject before any WebView is constructed (the WEB_MESSAGE_LISTENER
+    // check sits between URL validation and WebView creation), so they exercise
+    // originOf() normalization + expectedOrigin assignment without a real WebView.
+
+    @Test
+    fun open_pinsExpectedOriginAndFailsClosedWhenWebMessageListenerUnsupported() {
+        mockkStatic(WebViewFeature::class)
+        every { WebViewFeature.isFeatureSupported(any()) } returns false
+        every { reactContext.currentActivity } returns mockk<Activity>(relaxed = true)
+        val subject = host()
+        val promise = mockk<Promise>(relaxed = true)
+
+        // The explicit default https port (:443) must normalize away so the
+        // pinned origin matches the page's normalized origin / allowedOriginRules.
+        subject.open("https://app.dynamicauth.com:443/waas-v1/env", promise)
+
+        assertEquals("https://app.dynamicauth.com", subject.expectedOrigin)
+        verify { promise.reject("webview_unsupported", any<String>(), any<WritableMap>()) }
+    }
+
+    @Test
+    fun open_pinsExpectedOriginKeepingNonDefaultPort() {
+        mockkStatic(WebViewFeature::class)
+        every { WebViewFeature.isFeatureSupported(any()) } returns false
+        every { reactContext.currentActivity } returns mockk<Activity>(relaxed = true)
+        val subject = host()
+
+        subject.open("https://localhost:8443/waas", mockk(relaxed = true))
+
+        assertEquals("https://localhost:8443", subject.expectedOrigin)
+    }
+
+    // endregion
+}