@ethora/chat-component-rn 26.4.2 → 26.5.1

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 All notable changes to `@ethora/chat-component-rn` are listed here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project doesn't follow strict semver yet — version corresponds to the `package.json` field.
 
+## [26.05.01]
+
+### Added
+
+- **`scripts/ensure-emulator.js`** — runs before `expo run:android` (wired into the `android` npm script). If `adb devices` shows nothing connected, resolves `ANDROID_HOME` (env or platform default), picks the first AVD from `emulator -list-avds` (or honours `ETHORA_AVD`), launches it detached, and polls `adb shell getprop sys.boot_completed` until it returns `1` (max 2 min). Eliminates the opaque "No Android connected device found, and no emulators could be started automatically" error that bit first-time developers even when they had AVDs configured. Surfaces clear next-step guidance when `ANDROID_HOME` / platform-tools / emulator / AVDs are missing. ~50 ms overhead on the happy path (device already attached).
+
+### Changed
+
+- **iOS / Android npm scripts no longer pass `--no-install`.** The previous `--no-install` flag (added then reverted in this release cycle) had the side-effect of skipping `pod install` during `expo run:ios`, which then broke xcodebuild with "The sandbox is not in sync with the Podfile.lock". The actual root cause of the original yarn-install failure was that `yarn.lock` was checked in alongside `package-lock.json`, so expo defaulted to yarn even though the project is npm-managed. Removing `yarn.lock` (see below) restores normal flow without needing `--no-install`.
+- **README's "Build + run" recipe** updated to reflect the npm-only flow + brief note explaining why `yarn.lock` is intentionally absent.
+
+### Removed
+
+- **`yarn.lock`** — the project is npm-managed (`package-lock.json` is the canonical lockfile, README uses `npm install`, no `packageManager` field in `package.json`). Removing the legacy `yarn.lock` lets `expo run:*` default to npm for its post-prebuild reinstall step. Future contributors should not re-introduce it.
+- **`src/api.config.ts`** — was an orphan duplicate of the repo-root `api.config.ts`, with no importer in the source tree. It was being included in the npm tarball via the package.json `files: [src, ...]` entry, so every consumer was downloading the legacy bundled BASE-app JWT and a hardcoded dev test user (see "Fixed" below for the policy story). Deleted outright since nothing depended on it.
+- **`web/src/api.config.js`** — same orphan-duplicate story as `src/api.config.ts`. Module resolution prefers the `.ts` sibling; nothing imported the `.js` variant.
+
+### Fixed (product-code-policy sweep)
+
+Removed compiled-in Ethora endpoints, dev-team test credentials, and customer names from the source tree.
+
+- **`src/networking/apiClient.ts`** — dropped the dangling import from `../../api.config` (the repo-root file isn't even in the published tarball, so this import would have errored at install time for any consumer). `DEFAULT_BASE_URL` cleared to `''`; `currentAppToken` initialised to `''`. Consumers must now pass `baseUrl` via `<Chat config>` or call `setBaseURL(baseUrl, appToken)` before any REST call.
+
+  > **Behaviour change**: previously `<Chat>` defaulted to `api.chat.ethora.com/v1` when no `baseUrl` was passed in props. From this release that is no longer the case. If you relied on the implicit cloud default, add `baseUrl: 'https://api.chat.ethora.com/v1'` (or your own host) to your `<Chat config>` block. The README's "Default backend endpoints" section is left in place as a reference for the canonical values.
+
+- **`api.config.ts`** (repo root) — appToken / defaultUser / defRoom replaced with `PLACEHOLDER_*` values. Shape preserved so the optional `defaultUser` smoke path in `App.tsx` still compiles after a local edit.
+- **`src/components/MainComponents/LoginWrapper.tsx`** — hardcoded fallback email / password in `loginUserFunction` replaced with empty strings. `loginEmail` now fails cleanly on empty creds (hits catch, returns null) when the consumer hasn't passed `user.email` / `user.password` — same end behaviour, minus the leaked dev credentials.
+- **`web/src/api.config.ts`** — same placeholder treatment as the repo-root file.
+- **`web/src/App.tsx` + `web/src/AppLoginChats.tsx`** — hardcoded `api.chat.ethora.com` plus a `BASE_CONFIG` app id cleared to empty strings. Removed commented-out roomJID literals that referenced a customer subdomain.
+- **`web/src/AppLoginChatsNpm.tsx`** — replaced hardcoded customer dev-environment endpoints with empty strings and rewrote the comment referencing a Slack thread in neutral language ("typical host-integrator flow where an external auth system mints the Ethora user JWT and the chat UI is dropped in beneath it"). The file's dev-recipe value is preserved; its purpose is documented by its shape, not by the specific endpoint.
+- **`AppLoginChatsRn.tsx` `DEFAULT_CREDS`** — `baseUrl` / `xmppHost` / `xmppDevServer` / `conference` cleared to empty strings; the Setup tab opens blank for runtime configuration. (The `@ethora/setup` CLI patches these defaults from an `~/.ethora/profiles.json` profile when it clones the testbed for you.)
+- **`__tests__/appLoginChatsRn.test.tsx`** — the JWT-save flow test now types a `baseUrl` explicitly into the Setup form (was previously relying on the hardcoded default to assert ReduxWrapper's baseUrl).
+
+### Fixed (storage-key migration)
+
+- **`src/services/pushSubscriptionService.ts`** — `SUBSCRIBED_ROOMS_KEY` renamed to `'ethora_subscribed_rooms'`. To avoid orphaning existing subscriptions on any installed app, `loadSubscribedRoomsFromStorage` now reads the new key first; if it's empty and the legacy key has data, the value is copied across and the legacy key is deleted (wrapped in try/catch so a migration failure can't block the load). `reset()` defensively clears both keys. The legacy-key constant and the migration block can be removed in the next major release.
+
 ## [26.04.02]
 
 ### Added

package/README.md

@@ -285,6 +285,12 @@ The first `expo run:*` will `expo prebuild` to generate `ios/` and
 `android/` from `app.json`. Both directories are gitignored — the
 source of truth is `app.json` + the config plugins it lists.
 
+This repo uses **npm** (not yarn). `package-lock.json` is the
+canonical lockfile and `yarn.lock` is intentionally absent so
+`expo run:*` defaults to `npm install` for its post-prebuild
+reinstall step. If you prefer yarn for your own work, that's fine —
+just don't commit a `yarn.lock` back into the repo.
+
 ### Known first-run gotchas
 
 - **iOS `pod install` fails on system Ruby**: the Gemfile resolves

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethora/chat-component-rn",
-  "version": "26.04.02",
+  "version": "26.05.01",
   "description": "Drop-in XMPP chat component for React Native / Expo. <Chat config={...}/> and you're done.",
   "main": "index.js",
   "react-native": "src/main.ts",
@@ -42,7 +42,7 @@
   "scripts": {
     "postinstall": "patch-package",
     "start": "expo start",
-    "android": "expo run:android; node scripts/fix-prebuild-deps.js",
+    "android": "node scripts/ensure-emulator.js && (expo run:android; node scripts/fix-prebuild-deps.js)",
     "ios": "expo run:ios; node scripts/fix-prebuild-deps.js",
     "web": "expo start --web",
     "prebuild": "expo prebuild; node scripts/fix-prebuild-deps.js",

package/src/components/MainComponents/LoginWrapper.tsx

@@ -24,9 +24,12 @@ const LoginWrapper: React.FC<LoginWrapperProps> = ({...props}) => {
 
   const loginUserFunction = useCallback(async () => {
     try {
+      // Per product-code-policy: no compiled-in dev credentials. If the
+      // consumer didn't pass `user.email` / `user.password`, the call
+      // below fails on empty strings, hits catch, and returns null.
       const authData = await loginEmail(
-        props?.user?.email || 'yukiraze9@gmail.com',
-        props?.user?.password || 'Qwerty123',
+        props?.user?.email || '',
+        props?.user?.password || '',
       );
 
       return {

package/src/networking/apiClient.ts

@@ -2,13 +2,16 @@ import axios from 'axios';
 import { store } from '../roomStore';
 
 import { logout, refreshTokens } from '../roomStore/chatSettingsSlice';
-import { appToken as defaultAppToken } from '../../api.config';
 import { installAxiosCapture } from '../utils/devLogger';
 
-const DEFAULT_BASE_URL = 'https://api.chat.ethora.com/v1';
+// Per product-code-policy: no compiled-in Ethora endpoints or tokens.
+// Consumers must call `setBaseURL(baseUrl, appToken)` (or pass
+// `baseUrl` + the token-bearing user / jwt-login config via the
+// top-level `<Chat>` props) before any REST call is issued.
+const DEFAULT_BASE_URL = '';
 
 let currentBaseURL = DEFAULT_BASE_URL;
-let currentAppToken: string = defaultAppToken;
+let currentAppToken: string = '';
 
 const http = axios.create({
   baseURL: currentBaseURL,

package/src/services/pushSubscriptionService.ts

@@ -4,7 +4,11 @@ import AsyncStorage from '@react-native-async-storage/async-storage';
 import { subscribeToPushNotifications } from '../networking/api-requests/push.api';
 import { subscribeToRoomMessages } from '../networking/xmpp/subscribeToRoomMessages.xmpp';
 
-const SUBSCRIBED_ROOMS_KEY = 'preshent_subscribed_rooms';
+const SUBSCRIBED_ROOMS_KEY = 'ethora_subscribed_rooms';
+// Legacy storage key from before the rename. Read on first load and
+// migrated into SUBSCRIBED_ROOMS_KEY so installed apps don't lose
+// their subscriptions. Safe to remove on the next major version.
+const LEGACY_SUBSCRIBED_ROOMS_KEY = 'preshent_subscribed_rooms';
 
 export class PushSubscriptionService {
   private subscribedRooms: Set<string> = new Set();
@@ -16,7 +20,23 @@ export class PushSubscriptionService {
     if (this.isInitialized) {return;}
 
     try {
-      const storedRooms = await AsyncStorage.getItem(SUBSCRIBED_ROOMS_KEY);
+      let storedRooms = await AsyncStorage.getItem(SUBSCRIBED_ROOMS_KEY);
+      if (!storedRooms) {
+        // One-time migration from the legacy key.
+        try {
+          const legacy = await AsyncStorage.getItem(LEGACY_SUBSCRIBED_ROOMS_KEY);
+          if (legacy) {
+            await AsyncStorage.setItem(SUBSCRIBED_ROOMS_KEY, legacy);
+            await AsyncStorage.removeItem(LEGACY_SUBSCRIBED_ROOMS_KEY);
+            storedRooms = legacy;
+          }
+        } catch (migrationError) {
+          console.error(
+            '[PushService] Legacy storage-key migration failed (subscriptions on this device may be lost):',
+            migrationError
+          );
+        }
+      }
       if (storedRooms) {
         const roomsArray = JSON.parse(storedRooms) as string[];
         this.subscribedRooms = new Set(roomsArray);
@@ -126,6 +146,9 @@ export class PushSubscriptionService {
 
     try {
       await AsyncStorage.removeItem(SUBSCRIBED_ROOMS_KEY);
+      // Defensive: also clear the legacy key if it somehow survived
+      // the migration (e.g. migration failed on first load).
+      await AsyncStorage.removeItem(LEGACY_SUBSCRIBED_ROOMS_KEY);
       console.log('[PushService] Subscribed rooms cleared from storage');
     } catch (error) {
       console.error('[PushService] Failed to clear subscribed rooms from storage:', error);

package/src/api.config.ts

@@ -1,34 +0,0 @@
-//This is a file with appToken for Ethora and examles how objects look like
-
-export const appToken =
-  'JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7ImlzVXNlckRhdGFFbmNyeXB0ZWQiOmZhbHNlLCJwYXJlbnRBcHBJZCI6bnVsbCwiaXNBbGxvd2VkTmV3QXBwQ3JlYXRlIjp0cnVlLCJpc0Jhc2VBcHAiOnRydWUsIl9pZCI6IjY0NmNjOGRjOTZkNGE0ZGM4ZjdiMmYyZCIsImRpc3BsYXlOYW1lIjoiRXRob3JhIiwiZG9tYWluTmFtZSI6ImV0aG9yYSIsImNyZWF0b3JJZCI6IjY0NmNjOGQzOTZkNGE0ZGM4ZjdiMmYyNSIsInVzZXJzQ2FuRnJlZSI6dHJ1ZSwiZGVmYXVsdEFjY2Vzc0Fzc2V0c09wZW4iOnRydWUsImRlZmF1bHRBY2Nlc3NQcm9maWxlT3BlbiI6dHJ1ZSwiYnVuZGxlSWQiOiJjb20uZXRob3JhIiwicHJpbWFyeUNvbG9yIjoiIzAwM0U5QyIsInNlY29uZGFyeUNvbG9yIjoiIzI3NzVFQSIsImNvaW5TeW1ib2wiOiJFVE8iLCJjb2luTmFtZSI6IkV0aG9yYSBDb2luIiwiUkVBQ1RfQVBQX0ZJUkVCQVNFX0FQSV9LRVkiOiJBSXphU3lEUWRrdnZ4S0t4NC1XcmpMUW9ZZjA4R0ZBUmdpX3FPNGciLCJSRUFDVF9BUFBfRklSRUJBU0VfQVVUSF9ET01BSU4iOiJldGhvcmEtNjY4ZTkuZmlyZWJhc2VhcHAuY29tIiwiUkVBQ1RfQVBQX0ZJUkVCQVNFX1BST0pFQ1RfSUQiOiJldGhvcmEtNjY4ZTkiLCJSRUFDVF9BUFBfRklSRUJBU0VfU1RPUkFHRV9CVUNLRVQiOiJldGhvcmEtNjY4ZTkuYXBwc3BvdC5jb20iLCJSRUFDVF9BUFBfRklSRUJBU0VfTUVTU0FHSU5HX1NFTkRFUl9JRCI6Ijk3MjkzMzQ3MDA1NCIsIlJFQUNUX0FQUF9GSVJFQkFTRV9BUFBfSUQiOiIxOjk3MjkzMzQ3MDA1NDp3ZWI6ZDQ2ODJlNzZlZjAyZmQ5YjljZGFhNyIsIlJFQUNUX0FQUF9GSVJFQkFTRV9NRUFTVVJNRU5UX0lEIjoiRy1XSE03WFJaNEM4IiwiUkVBQ1RfQVBQX1NUUklQRV9QVUJMSVNIQUJMRV9LRVkiOiIiLCJSRUFDVF9BUFBfU1RSSVBFX1NFQ1JFVF9LRVkiOiIiLCJjcmVhdGVkQXQiOiIyMDIzLTA1LTIzVDE0OjA4OjI4LjEzNloiLCJ1cGRhdGVkQXQiOiIyMDIzLTA1LTIzVDE0OjA4OjI4LjEzNloiLCJfX3YiOjB9LCJpYXQiOjE2ODQ4NTA5MjV9.-IqNVMsf8GyS9Z-_yuNW7hpSmejajjAy-W0J8TadRIM';
-export const defaultUser = {
-  _id: '65831a646edcd3cee0545757',
-  firstName: 'Raze',
-  lastName: 'Yuki',
-  xmppPassword: 'HDC7qnWI16',
-  walletAddress: '0x6816810a7Fe04FC9b800f9D11564C0e4aEC25D78',
-  token:
-    'JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InVzZXJJZCI6IjY1ODMxYTY0NmVkY2QzY2VlMDU0NTc1NyIsImFwcElkIjoiNjQ2Y2M4ZGM5NmQ0YTRkYzhmN2IyZjJkIn0sImlhdCI6MTcxODI1OTMzNCwiZXhwIjoxNzE4MjYwMjM0fQ.-eG07yKkNL6sAFw_-xwBxjios6XtWF6n1MExphyg4W4',
-  refreshToken:
-    'JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InVzZXJJZCI6IjY1ODMxYTY0NmVkY2QzY2VlMDU0NTc1NyIsImFwcElkIjoiNjQ2Y2M4ZGM5NmQ0YTRkYzhmN2IyZjJkIn0sImlhdCI6MTcxODI1OTMzNCwiZXhwIjoxNzE4ODY0MTM0fQ.Zs7_eLdefD3i6nEO1b_XbFZA_q9SWFKDghj8HqJ2fC0',
-  profileImage:
-    'https://lh3.googleusercontent.com/a/ACg8ocLPzhjmRoDe9ZXawhnZN3nd0eEhrqoKwRicJyM6q2z_=s96-c',
-  isProfileOpen: true,
-  isAssetsOpen: true,
-  referrerId: '',
-  isAllowedNewAppCreate: true,
-  isAgreeWithTerms: false,
-  company: [],
-  appId: '646cc8dc96d4a4dc8f7b2f2d',
-  homeScreen: '',
-  defaultWallet: {
-    walletAddress: '0x6816810a7Fe04FC9b800f9D11564C0e4aEC25D78',
-  },
-  email: 'yukiraze9@gmail.com',
-  username: '',
-};
-
-export const defRoom = {
-  jid: '5f9a4603b2b5bbfa6b228b642127c56d03b778ad594c52b755e605c977303979@conference.xmpp.ethoradev.com',
-};