@frockbot/plugin-auth 0.3.14 → 0.3.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-auth",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "private": false,
   "type": "module",
   "exports": {
@@ -21,14 +21,15 @@
   },
   "dependencies": {
     "@better-auth/electron": "1.7.2",
-    "@frockbot/client-core": "0.3.14",
-    "@frockbot/kernel-contracts": "0.3.14",
+    "@capacitor/core": "8.5.0",
+    "@frockbot/client-core": "0.3.16",
+    "@frockbot/kernel-contracts": "0.3.16",
     "better-auth": "1.7.2",
     "cordis": "4.0.0-rc.8",
     "vue": "3.5.41"
   },
   "devDependencies": {
-    "@frockbot/plugin-testkit": "0.3.14",
+    "@frockbot/plugin-testkit": "0.3.16",
     "@types/bun": "1.4.0",
     "@types/node": "26.2.0",
     "typescript": "npm:typescript-native-bridge@6.0.3-bridge.16.tsgo.7.0.2",

package/src/client/AuthGate.vue

@@ -3,6 +3,10 @@ import { authSessionClientKey } from "../shared.js";
 import { computed, inject, onBeforeUnmount, onMounted, ref } from "vue";
 import { hostedAuthClient } from "./browser.js";
 import { developmentLoginUrl, isLoopbackHost } from "./development-login";
+import {
+  isAndroidNativeShell,
+  requestNativeGoogleCredential,
+} from "./native-google.js";
 
 const providedSession = inject(authSessionClientKey);
 if (!providedSession) throw new Error("auth session client was not provided");
@@ -17,6 +21,7 @@ const user = computed(() =>
 );
 const loading = computed(() => session.projection.value.status === "loading");
 const isDesktop = computed(() => Boolean(window.frockbotDesktop));
+const isAndroid = isAndroidNativeShell();
 const isLocalDevelopment = computed(() =>
   isLoopbackHost(window.location.hostname),
 );
@@ -77,6 +82,23 @@ async function signIn(): Promise<void> {
       await window.requestAuth();
       return;
     }
+    if (isAndroid) {
+      const credential = await requestNativeGoogleCredential();
+      const result = await hostedAuthClient.signIn.social({
+        provider: "google",
+        idToken: {
+          token: credential.idToken,
+          nonce: credential.nonce,
+        },
+      });
+      if (result.error) {
+        throw new Error(
+          "FrockBot could not verify the Google sign-in. Please try again.",
+        );
+      }
+      window.location.reload();
+      return;
+    }
     const query = electronAuthQuery();
     const callbackURL = new URL("/", window.location.origin);
     if (query) {
@@ -138,7 +160,13 @@ onBeforeUnmount(() => {
       <div class="auth-mark" aria-hidden="true">⌁</div>
       <p class="auth-eyebrow">FrockBot</p>
       <h1 id="auth-title">Welcome back</h1>
-      <p class="auth-copy">Sign in with your browser to continue.</p>
+      <p class="auth-copy">
+        {{
+          isAndroid
+            ? "Sign in to continue."
+            : "Sign in with your browser to continue."
+        }}
+      </p>
       <div v-if="loading" class="auth-loading" aria-live="polite">
         Checking your session…
       </div>
@@ -159,7 +187,13 @@ onBeforeUnmount(() => {
           @click="signIn"
         >
           <span class="google-g" aria-hidden="true">G</span>
-          {{ signingIn ? "Waiting for browser…" : "Continue with Google" }}
+          {{
+            signingIn
+              ? isAndroid
+                ? "Signing in…"
+                : "Waiting for browser…"
+              : "Continue with Google"
+          }}
         </button>
       </div>
       <p v-if="error" class="auth-error" role="alert">{{ error }}</p>

package/src/client/native-google.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import {
+  isAndroidNativeShell,
+  requestNativeGoogleCredential,
+} from "./native-google.ts";
+
+describe("native Google sign-in", () => {
+  test("detects only the native Android bridge", () => {
+    expect(
+      isAndroidNativeShell({
+        isNativePlatform: () => true,
+        getPlatform: () => "android",
+      }),
+    ).toBe(true);
+    expect(
+      isAndroidNativeShell({
+        isNativePlatform: () => true,
+        getPlatform: () => "ios",
+      }),
+    ).toBe(false);
+    expect(
+      isAndroidNativeShell({
+        isNativePlatform: () => false,
+        getPlatform: () => "web",
+      }),
+    ).toBe(false);
+  });
+
+  test("decodes the bounded native credential", async () => {
+    await expect(
+      requestNativeGoogleCredential({
+        signIn: () =>
+          Promise.resolve({ idToken: "header.payload.signature", nonce: "n" }),
+      }),
+    ).resolves.toEqual({
+      idToken: "header.payload.signature",
+      nonce: "n",
+    });
+  });
+
+  test("rejects malformed native responses", async () => {
+    await expect(
+      requestNativeGoogleCredential({
+        signIn: () => Promise.resolve({ idToken: "token" }),
+      }),
+    ).rejects.toThrow("Google returned an invalid sign-in response.");
+  });
+});

package/src/client/native-google.ts

@@ -0,0 +1,52 @@
+import { Capacitor, registerPlugin } from "@capacitor/core";
+
+const MAX_ID_TOKEN_LENGTH = 16_384;
+const MAX_NONCE_LENGTH = 512;
+
+interface NativePlatform {
+  isNativePlatform(): boolean;
+  getPlatform(): string;
+}
+
+export interface NativeGoogleCredential {
+  idToken: string;
+  nonce: string;
+}
+
+export interface NativeGoogleAuthPlugin {
+  signIn(): Promise<unknown>;
+}
+
+const nativeGoogleAuth =
+  registerPlugin<NativeGoogleAuthPlugin>("FrockBotGoogleAuth");
+
+export function isAndroidNativeShell(
+  platform: NativePlatform = Capacitor,
+): boolean {
+  return platform.isNativePlatform() && platform.getPlatform() === "android";
+}
+
+export async function requestNativeGoogleCredential(
+  plugin: NativeGoogleAuthPlugin = nativeGoogleAuth,
+): Promise<NativeGoogleCredential> {
+  const result = await plugin.signIn();
+  if (typeof result !== "object" || result === null || Array.isArray(result)) {
+    throw new Error("Google returned an invalid sign-in response.");
+  }
+  const keys = Object.keys(result);
+  const value = result as Record<string, unknown>;
+  if (
+    keys.length !== 2 ||
+    !keys.includes("idToken") ||
+    !keys.includes("nonce") ||
+    typeof value.idToken !== "string" ||
+    !value.idToken ||
+    value.idToken.length > MAX_ID_TOKEN_LENGTH ||
+    typeof value.nonce !== "string" ||
+    !value.nonce ||
+    value.nonce.length > MAX_NONCE_LENGTH
+  ) {
+    throw new Error("Google returned an invalid sign-in response.");
+  }
+  return { idToken: value.idToken, nonce: value.nonce };
+}