@dynamic-labs-sdk/client 1.8.1 → 1.9.0

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewClientTest.kt

@@ -1,196 +0,0 @@
-package xyz.dynamic.client.webview
-
-import android.net.Uri
-import android.webkit.WebResourceError
-import android.webkit.WebResourceRequest
-import android.webkit.WebResourceResponse
-import android.webkit.WebView
-import androidx.webkit.WebViewFeature
-import io.mockk.every
-import io.mockk.mockk
-import io.mockk.mockkStatic
-import io.mockk.unmockkAll
-import io.mockk.verify
-import org.junit.After
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-// Exercises the WebViewClient → host delegation in isolation: the host is a
-// MockK mock so no Activity/WebView runtime is needed. Runs under Robolectric
-// because DynamicWebViewClient extends the framework WebViewClient (whose
-// android.jar stub constructor throws off-device) and the tests parse Uris.
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class DynamicWebViewClientTest {
-
-    private lateinit var host: DynamicWebViewHost
-    private lateinit var client: DynamicWebViewClient
-
-    @Before
-    fun setUp() {
-        host = mockk(relaxed = true)
-        client = DynamicWebViewClient(host)
-        // WebViewFeature is a static facade over the device WebView; stub it so
-        // the tests are deterministic. Default: document-start scripts
-        // unsupported (so onPageStarted falls back to injecting the bridge).
-        mockkStatic(WebViewFeature::class)
-        every { WebViewFeature.isFeatureSupported(any()) } returns false
-    }
-
-    @After
-    fun tearDown() {
-        unmockkAll()
-    }
-
-    // region navigation pinning
-
-    private fun mainFrameRequestTo(target: String): WebResourceRequest =
-        mockk {
-            every { isForMainFrame } returns true
-            every { url } returns Uri.parse(target)
-        }
-
-    @Test
-    fun shouldOverrideUrlLoading_blocksCrossOriginMainFrameNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-
-        val handled = client.shouldOverrideUrlLoading(
-            null,
-            mainFrameRequestTo("https://evil.example.com/phish"),
-        )
-
-        // true == "we handled it" == the WebView does NOT perform the navigation.
-        assertTrue(handled)
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_allowsSameOriginMainFrameNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-
-        val handled = client.shouldOverrideUrlLoading(
-            null,
-            mainFrameRequestTo("https://app.dynamicauth.com/waas-v1/abc"),
-        )
-
-        assertFalse(handled)
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_ignoresSubframeNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-        val request = mockk<WebResourceRequest> {
-            every { isForMainFrame } returns false
-            every { url } returns Uri.parse("https://evil.example.com/x")
-        }
-
-        // Subframe loads are left to the WebView regardless of origin.
-        assertFalse(client.shouldOverrideUrlLoading(null, request))
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_allowsWhenOriginNotYetPinned() {
-        every { host.expectedOrigin } returns null
-
-        assertFalse(
-            client.shouldOverrideUrlLoading(
-                null,
-                mainFrameRequestTo("https://anything.example.com"),
-            ),
-        )
-    }
-
-    // endregion
-
-    // region bridge-glue injection
-
-    @Test
-    fun onPageStarted_injectsBridgeScriptWhenDocumentStartUnsupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
-        } returns false
-        val view = mockk<WebView>(relaxed = true)
-
-        client.onPageStarted(view, "https://app.dynamicauth.com", null)
-
-        verify { view.evaluateJavascript(BRIDGE_USER_SCRIPT, null) }
-    }
-
-    @Test
-    fun onPageStarted_skipsInjectionWhenDocumentStartSupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
-        } returns true
-        val view = mockk<WebView>(relaxed = true)
-
-        client.onPageStarted(view, "https://app.dynamicauth.com", null)
-
-        verify(exactly = 0) { view.evaluateJavascript(any(), any()) }
-    }
-
-    // endregion
-
-    // region error / lifecycle routing
-
-    @Test
-    fun onPageCommitVisible_notifiesHost() {
-        client.onPageCommitVisible(null, "https://app.dynamicauth.com")
-        verify { host.onCommitVisible() }
-    }
-
-    @Test
-    fun onReceivedError_mainFrame_reportsNavigationFailed() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val error = mockk<WebResourceError> { every { description } returns "net::ERR_FAILED" }
-
-        client.onReceivedError(null, request, error)
-
-        verify { host.onNavigationFailed("net::ERR_FAILED") }
-    }
-
-    @Test
-    fun onReceivedError_subFrame_isIgnored() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns false }
-        val error = mockk<WebResourceError>(relaxed = true)
-
-        client.onReceivedError(null, request, error)
-
-        verify(exactly = 0) { host.onNavigationFailed(any()) }
-    }
-
-    @Test
-    fun onReceivedHttpError_mainFrame4xx_reportsHttpError() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val response = mockk<WebResourceResponse> { every { statusCode } returns 404 }
-
-        client.onReceivedHttpError(null, request, response)
-
-        verify { host.onHttpError(404) }
-    }
-
-    @Test
-    fun onReceivedHttpError_below400_isIgnored() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val response = mockk<WebResourceResponse> { every { statusCode } returns 302 }
-
-        client.onReceivedHttpError(null, request, response)
-
-        verify(exactly = 0) { host.onHttpError(any()) }
-    }
-
-    @Test
-    fun onRenderProcessGone_notifiesHostAndHandlesCrash() {
-        val handled = client.onRenderProcessGone(null, null)
-
-        // Returning true tells the framework the crash is handled, preventing a
-        // host-process crash.
-        assertTrue(handled)
-        verify { host.onRenderProcessGone() }
-    }
-
-    // endregion
-}

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewHostOpenTest.kt

@@ -1,347 +0,0 @@
-package xyz.dynamic.client.webview
-
-import android.app.Activity
-import android.net.Uri
-import android.webkit.WebSettings
-import android.webkit.WebView
-import androidx.webkit.JavaScriptReplyProxy
-import androidx.webkit.ProfileStore
-import androidx.webkit.WebMessageCompat
-import androidx.webkit.WebViewCompat
-import androidx.webkit.WebViewFeature
-import com.facebook.react.bridge.Arguments
-import com.facebook.react.bridge.JavaOnlyMap
-import com.facebook.react.bridge.Promise
-import com.facebook.react.bridge.ReactApplicationContext
-import com.facebook.react.bridge.WritableMap
-import io.mockk.CapturingSlot
-import io.mockk.Runs
-import io.mockk.every
-import io.mockk.just
-import io.mockk.mockk
-import io.mockk.mockkStatic
-import io.mockk.slot
-import io.mockk.unmockkAll
-import io.mockk.verify
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.Robolectric
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.Shadows.shadowOf
-import org.robolectric.annotation.Config
-
-// Exercises the open() happy path that constructs a real (Robolectric-shadowed)
-// WebView. The androidx.webkit statics (WebViewCompat / WebViewFeature /
-// ProfileStore) are mocked because they delegate to the device's System WebView
-// provider, which does not exist off-device — so the tests assert that the host
-// CALLS them correctly (origin-scoped bridge, document-start glue, per-instance
-// profile) and applies the secure WebSettings, rather than exercising the
-// provider itself. WEB_MESSAGE_LISTENER is reported supported so open() proceeds.
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class DynamicWebViewHostOpenTest {
-
-    private lateinit var activity: Activity
-    private lateinit var reactContext: ReactApplicationContext
-
-    private lateinit var webSlot: CapturingSlot<WebView>
-    private lateinit var originRulesSlot: CapturingSlot<Set<String>>
-    private lateinit var listenerSlot: CapturingSlot<WebViewCompat.WebMessageListener>
-
-    @Before
-    fun setUp() {
-        activity = Robolectric.buildActivity(Activity::class.java).setup().get()
-        reactContext = mockk(relaxed = true)
-        every { reactContext.currentActivity } returns activity
-        // Run UI-queue work inline so onBridgeMessage delivery is synchronous.
-        // (The http-error-race tests re-stub this to capture instead.)
-        every { reactContext.runOnUiQueueThread(any()) } answers { firstArg<Runnable>().run() }
-
-        mockkStatic(Arguments::class)
-        every { Arguments.createMap() } answers { JavaOnlyMap() }
-
-        mockkStatic(WebViewFeature::class)
-        // Default: only the (required) bridge feature is available. Document-start
-        // scripts and multi-profile default off; individual tests opt in.
-        every { WebViewFeature.isFeatureSupported(any()) } returns false
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)
-        } returns true
-
-        mockkStatic(WebViewCompat::class)
-        webSlot = slot()
-        originRulesSlot = slot()
-        listenerSlot = slot()
-        every {
-            WebViewCompat.addWebMessageListener(
-                capture(webSlot),
-                any(),
-                capture(originRulesSlot),
-                capture(listenerSlot),
-            )
-        } just Runs
-        every {
-            WebViewCompat.addDocumentStartJavaScript(any(), any(), any())
-        } returns mockk(relaxed = true)
-        every { WebViewCompat.setProfile(any(), any()) } just Runs
-    }
-
-    @After
-    fun tearDown() {
-        unmockkAll()
-    }
-
-    private fun host(
-        instanceId: String = "instance-1",
-        onMessage: (Any?) -> Unit = {},
-        onRelease: () -> Unit = {},
-    ) = DynamicWebViewHost(reactContext, instanceId, onMessage, onRelease)
-
-    private fun openHost(
-        url: String = "https://app.dynamicauth.com/waas-v1/env",
-        instanceId: String = "instance-1",
-        onMessage: (Any?) -> Unit = {},
-    ): Pair<DynamicWebViewHost, Promise> {
-        val subject = host(instanceId = instanceId, onMessage = onMessage)
-        val promise = mockk<Promise>(relaxed = true)
-        subject.open(url, promise)
-        return subject to promise
-    }
-
-    // region secure WebSettings
-
-    @Test
-    fun open_appliesSecureWebSettings() {
-        openHost()
-        val s = webSlot.captured.settings
-
-        assertTrue(s.javaScriptEnabled)
-        assertTrue(s.domStorageEnabled)
-        assertFalse(s.allowFileAccess)
-        assertFalse(s.allowContentAccess)
-        @Suppress("DEPRECATION")
-        assertFalse(s.allowFileAccessFromFileURLs)
-        @Suppress("DEPRECATION")
-        assertFalse(s.allowUniversalAccessFromFileURLs)
-        assertEquals(WebSettings.MIXED_CONTENT_NEVER_ALLOW, s.mixedContentMode)
-        assertFalse(s.javaScriptCanOpenWindowsAutomatically)
-        // Multi-window is enabled so onCreateWindow fires (CVE-2020-6506
-        // mitigation: contains iframe window requests instead of letting them
-        // navigate the top frame).
-        assertTrue(s.supportMultipleWindows())
-    }
-
-    // onCreateWindow must deny every window request (popups / target=_blank /
-    // window.open), so the enabled multi-window support never actually opens one.
-    @Test
-    fun open_deniesWindowCreation() {
-        openHost()
-        val chromeClient = shadowOf(webSlot.captured).webChromeClient
-        assertFalse(chromeClient.onCreateWindow(webSlot.captured, false, false, null))
-    }
-
-    // endregion
-
-    // region origin-scoped bridge + navigation target
-
-    @Test
-    fun open_registersWebMessageListenerScopedToNormalizedOrigin() {
-        openHost(url = "https://app.dynamicauth.com:443/waas-v1/env")
-        // Default https port normalized away → matches the page's origin.
-        assertEquals(setOf("https://app.dynamicauth.com"), originRulesSlot.captured)
-    }
-
-    @Test
-    fun open_loadsTheValidatedUrl() {
-        openHost(url = "https://app.dynamicauth.com/waas-v1/xyz")
-        assertEquals(
-            "https://app.dynamicauth.com/waas-v1/xyz",
-            shadowOf(webSlot.captured).lastLoadedUrl,
-        )
-    }
-
-    @Test
-    fun open_injectsDocumentStartScriptScopedToOriginWhenSupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
-        } returns true
-
-        openHost(url = "https://app.dynamicauth.com/x")
-
-        verify {
-            WebViewCompat.addDocumentStartJavaScript(
-                any(),
-                BRIDGE_USER_SCRIPT,
-                setOf("https://app.dynamicauth.com"),
-            )
-        }
-    }
-
-    @Test
-    fun open_skipsDocumentStartScriptWhenUnsupported() {
-        openHost()
-        verify(exactly = 0) {
-            WebViewCompat.addDocumentStartJavaScript(any(), any(), any())
-        }
-    }
-
-    // endregion
-
-    // region per-instance profile (storage isolation)
-
-    @Test
-    fun open_assignsPerInstanceProfileWhenMultiProfileSupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.MULTI_PROFILE)
-        } returns true
-        val store = mockk<ProfileStore>(relaxed = true)
-        mockkStatic(ProfileStore::class)
-        every { ProfileStore.getInstance() } returns store
-
-        openHost(instanceId = "abc")
-
-        verify { store.getOrCreateProfile("dynamic-waas-abc") }
-        verify { WebViewCompat.setProfile(any(), "dynamic-waas-abc") }
-    }
-
-    @Test
-    fun open_skipsProfileWhenMultiProfileUnsupported() {
-        openHost()
-        verify(exactly = 0) { WebViewCompat.setProfile(any(), any()) }
-    }
-
-    // endregion
-
-    // region http-error vs commit race (#8)
-
-    @Test
-    fun httpErrorClaimsPromiseEvenWhenCommitFiresFirst() {
-        val deferred = slot<Runnable>()
-        // Capture the deferred resolve instead of running it inline.
-        every { reactContext.runOnUiQueueThread(capture(deferred)) } just Runs
-        val (subject, promise) = openHost()
-
-        subject.onCommitVisible() // schedules the deferred resolve
-        subject.onHttpError(503) // synchronously claims the pending promise
-        deferred.captured.run() // deferred resolve runs last — but promise is gone
-
-        verify { promise.reject("webview_http_error", "HTTP 503", any<WritableMap>()) }
-        verify(exactly = 0) { promise.resolve(any()) }
-    }
-
-    @Test
-    fun httpErrorBeforeCommit_reportsHttpError() {
-        val deferred = slot<Runnable>()
-        every { reactContext.runOnUiQueueThread(capture(deferred)) } just Runs
-        val (subject, promise) = openHost()
-
-        subject.onHttpError(404)
-        subject.onCommitVisible()
-        if (deferred.isCaptured) deferred.captured.run()
-
-        verify { promise.reject("webview_http_error", "HTTP 404", any<WritableMap>()) }
-        verify(exactly = 0) { promise.resolve(any()) }
-    }
-
-    @Test
-    fun commitVisibleResolvesWhenNoHttpError() {
-        val (subject, promise) = openHost()
-        subject.onCommitVisible()
-        verify { promise.resolve(null) }
-    }
-
-    // endregion
-
-    // region sendMessage via reply proxy (#9)
-
-    @Test
-    fun sendMessage_postsJsonViaReplyProxyVerbatimIncludingLineSeparators() {
-        val (subject, _) = openHost()
-
-        // The page opens the reply channel by posting first; invoke the captured
-        // listener to deliver a replyProxy to the host.
-        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
-        val handshake = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"ready\"}" }
-        listenerSlot.captured.onPostMessage(
-            webSlot.captured,
-            handshake,
-            Uri.parse("https://app.dynamicauth.com"),
-            true,
-            proxy,
-        )
-
-        // A dApp-controlled string containing U+2028 must round-trip verbatim —
-        // the old evaluateJavascript('...') path missed U+2028/U+2029 and would
-        // have broken out of the JS string literal.
-        val payload = JavaOnlyMap().apply {
-            putString("type", "signMessage")
-            putString("message", "approve\u2028tx")
-        }
-        subject.sendMessage(payload)
-
-        val sent = slot<String>()
-        verify { proxy.postMessage(capture(sent)) }
-        assertTrue(sent.captured.contains("\u2028"))
-        assertTrue(sent.captured.contains("signMessage"))
-    }
-
-    @Test
-    fun sendMessage_buffersBeforeReplyChannelThenFlushesInOrder() {
-        val (subject, _) = openHost()
-
-        // Host sends before the page has posted (no replyProxy yet): both must
-        // be buffered, not dropped.
-        subject.sendMessage(JavaOnlyMap().apply { putString("seq", "first") })
-        subject.sendMessage(JavaOnlyMap().apply { putString("seq", "second") })
-
-        // Page opens the reply channel → buffered messages flush in order.
-        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
-        val handshake = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"ready\"}" }
-        listenerSlot.captured.onPostMessage(
-            webSlot.captured,
-            handshake,
-            Uri.parse("https://app.dynamicauth.com"),
-            true,
-            proxy,
-        )
-
-        // The capturing list accumulates invocations in call order.
-        val sent = mutableListOf<String>()
-        verify(exactly = 2) { proxy.postMessage(capture(sent)) }
-        assertEquals(2, sent.size)
-        assertTrue(sent[0].contains("first"))
-        assertTrue(sent[1].contains("second"))
-    }
-
-    @Test
-    fun sendMessage_doesNotCrashWhenReplyChannelNeverOpens() {
-        val (subject, _) = openHost()
-        // No listener callback ever → message stays buffered, no crash.
-        subject.sendMessage(JavaOnlyMap().apply { putString("type", "early") })
-    }
-
-    @Test
-    fun bridgeListener_dropsNonMainFrameMessages() {
-        var delivered: Any? = "UNSET"
-        val (subject, _) = openHost(onMessage = { delivered = it })
-        val proxy = mockk<JavaScriptReplyProxy>(relaxed = true)
-        val message = mockk<WebMessageCompat> { every { data } returns "{\"type\":\"x\"}" }
-
-        listenerSlot.captured.onPostMessage(
-            webSlot.captured,
-            message,
-            Uri.parse("https://app.dynamicauth.com"),
-            false, // not main frame
-            proxy,
-        )
-
-        assertEquals("UNSET", delivered)
-    }
-
-    // endregion
-}