@ethora/chat-component-rn 26.6.13 → 26.7.2

package/CHANGELOG.md

@@ -5,6 +5,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this pr
 
 ## [Unreleased]
 
+### Added
+
+- **`config.logout` — built-in "Sign out" item in the room-list header menu.** `{ enabled, label?, confirm?, onBeforeLogout?, onAfterLogout? }`. Rendered last (after New Chat / Profile / Settings) with a logout icon tinted `colors.primary`; hidden unless `enabled: true`, so existing menus are unchanged. Tap flow: close drawer → native confirm (`confirm` defaults to `true`; pass an object to customise title/message/button copy, `false` to skip) → `await onBeforeLogout?.()` (return `false` to cancel) → `await logoutService.performLogout()` (full teardown: XMPP, redux, persisted slices, AsyncStorage, REST cache) → `await onAfterLogout?.()` for the host's own session/navigation logout. Host callback errors are caught and logged via `console.warn` — a throwing `onBeforeLogout` cancels, a throwing `onAfterLogout` is swallowed after the teardown has landed. Documented in README ("Logging out") and `instructions.md`. Tests in `headerRoomListMenuLogout.test.tsx`.
+- **`useLogout` is now exported from the package root** (previously only `logoutService`), so a host can build its own button with the same awaitable teardown.
+
+### Fixed
+
+- **iOS: attach-sheet rows (Take photo / Photo or video / Document) did nothing, and the next tap threw `PickingInProgressException: Different document picking in progress`.** The picker handler was invoked from the exit-animation completion callback in the same tick as `setMounted(false)` — but that only *starts* RN `<Modal>`'s native dismiss, so the sheet's UIViewController was still on screen when `expo-image-picker` / `expo-document-picker` called `currentViewController().present(picker)`. UIKit silently dropped the present, the promise never resolved, and expo-document-picker kept its `pickingContext` stuck. `AttachSheet` now fires the pending handler from `<Modal onDismiss>` on iOS (the only signal that the view controller is really gone); Android, where `onDismiss` never fires, keeps running it from the animation callback. The handler is nulled before invocation so it runs at most once, and an interrupted animation (`finished: false`) still does nothing. Tests in `attachSheetPendingHandler.test.tsx`. On iOS, picker rows also skip the sheet's slide-down (the modal is hidden immediately, so `onDismiss` arrives ~50 ms after the tap instead of ~300 ms); Cancel and backdrop taps keep the animated close. The old 350 ms iOS `setTimeout` in `SendInput.handleFileSelection` that tried to paper over the same race is removed — the Document picker now opens as soon as the sheet is gone instead of noticeably later.
+
+### Security
+
+- **Chat tokens, the XMPP password, and message history are no longer stored in plaintext AsyncStorage.** All four bearer credentials on `User` (REST access + refresh token, XMPP password, secure-media fileToken) now go through the platform Keychain (iOS) / Keystore-backed EncryptedSharedPreferences (Android) via the optional `expo-secure-store` peer dependency, instead of sitting in AsyncStorage's plain SQLite/plist storage. The persisted message-history and room-list cache (`roomStore/persistence.ts`) is now AES-256-CBC encrypted at rest, with the symmetric key itself held in that same secure store — envelope encryption, since bulk history is too large (and unbounded) for direct Keychain storage. `expo-secure-store` is optional (mirrors `expo-video`/`expo-audio` etc.): a host that hasn't added it falls back to namespaced-but-still-unencrypted AsyncStorage with one logged warning, so nothing breaks for existing consumers, but the secure path is what ships by default for any host on the standard Expo dependency set.
+  - New `helpers/secureStoreRuntime.ts` (lazy `expo-secure-store` bridge, same pattern as `livekitRuntime.ts`), `helpers/secureKeyValue.ts` (get/set/remove with the AsyncStorage fallback), `helpers/secureUserStorage.ts` (splits `User` into a secret-free AsyncStorage profile + four Keychain-backed secret keys behind the same `{get,set,remove}` shape the old `asyncLocalStorage<User>(ETHORA_USER)` had, so every call site — `chatSettingsSlice`, `authRefresh`, `resolveInitBeforeLoadUser`, `xmppProvider`, `ensureScopedChatCache`, `useLogout`, the testbed's `Login.tsx` — swapped in without changing behavior), `helpers/persistCrypto.ts` (AES-256-CBC envelope encryption for the bulk cache, random IV per write via `react-native-get-random-values`, key generated once and cached).
+  - A pre-encryption plaintext cache from an older install decrypts to `null` (not a crash) and is treated as an empty cache — the app just re-hydrates from the server, same as any cold start.
+  - Verified on-device (iOS Simulator, real `expo-secure-store` linked via CocoaPods, not the jest mock): no fallback warning logged through a full login → XMPP connect → room list → message render cycle; the raw `@ethora/chat-component-user` AsyncStorage blob has all four secret fields as empty strings with no JWT-shaped substring anywhere in it; the raw `@ethora/persist:rooms` blob is a genuine `{v,iv,ct}` AES envelope containing none of the actual on-screen message text; logout leaves only the non-secret tenant-scope key on disk. 18 new unit tests (`secureStorage.test.ts`) plus updated coverage in `authRefresh.test.ts`, `resolveInitBeforeLoadUser.test.ts`, and both `persistence*.test.ts` suites (760 total, all green); `tsc` clean; real `bob build` (the exact step `npm publish`'s `prepack` runs) succeeds.
+
 The repo itself now lives on **Expo SDK 57 (RN 0.86.2, React 19.2.8, New Architecture)** — until now the SDK was only *compatible* with 57 (peer ranges verified in 26.6.3) while developing and testing against 54. Published peer ranges are unchanged, so SDK 54 consumers are unaffected; both lines are now proven by the CI consumer-smoke matrix.
 
 ### Changed

package/README.md

@@ -271,6 +271,28 @@ function SignOutButton() {
 }
 ```
 
+### Built-in "Sign out" menu item
+
+Don't want to build your own button? Enable the item in the room-list header menu (the drawer with New Chat / Profile / Settings). It renders last, tinted with `config.colors.primary`, and runs the same awaitable teardown as `useLogout()`:
+
+```tsx
+<Chat
+  config={{
+    logout: {
+      enabled: true,
+      label: 'Sign out',                        // default
+      confirm: { message: 'Sign out of chat?' }, // `true` (default) uses stock copy, `false` skips the dialog
+      onBeforeLogout: async () => {
+        // return false to cancel (e.g. unsaved draft guard)
+      },
+      onAfterLogout: () => navigation.replace('SignIn'), // runs AFTER the full teardown
+    },
+  }}
+/>
+```
+
+Tap flow: close drawer → confirmation (native `Alert`) → `await onBeforeLogout?.()` (`false` cancels) → `await logoutService.performLogout()` → `await onAfterLogout?.()`. The host-side session/navigation logout belongs in `onAfterLogout` — by the time it runs, XMPP is disconnected and every persisted key is gone. Errors thrown by either callback are caught and logged via `console.warn`; a throwing `onBeforeLogout` cancels the logout. With `enabled: false` (or the option omitted) the menu is unchanged.
+
 Why awaitable: the persistence layer debounces writes by 200 ms, and the chat slice removes its persisted user fire-and-forget. If the host navigated / re-mounted `<Chat>` immediately after a non-awaited call, the next bootstrap could occasionally rehydrate stale state ("old chats reappear"). Awaiting the returned promise eliminates that race. The function never rejects — any internal failure is logged via `console.warn`, so a non-awaited call still won't crash the host. For non-React contexts you can call `logoutService.performLogout()` directly (same Promise).
 
 ## Customization flags worth knowing