@livx.cc/appwrap 0.61.19 → 0.61.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.61.19",
+  "version": "0.61.21",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/bridge-origin.ts

@@ -0,0 +1,39 @@
+import { SHELL_CONFIG } from './config';
+import { effectiveServerUrl } from './server-url';
+
+/**
+ * Bridge origin gate. The shell's WebView can show ANY page (a link, a redirect, a page the app opens), and
+ * every page in it can post to the `appwrap` channel — so without a gate a foreign page reads the app's
+ * keychain (`storage.secure`), files, cookies, contacts… The APP's own origin keeps the full bridge:
+ * the bundled `app://localhost`, the server loader's origin (incl. an allowlisted env override), and
+ * `appBoundDomains`. Any other origin (or an unknown one) gets only FOREIGN_ALLOWED: UI feedback and
+ * permission-prompted features that expose no stored app data.
+ */
+const FOREIGN_ALLOWED = [
+  'app.handshake', 'app.environment', 'device.info', 'network.status',
+  'haptics.', 'toast.', 'keyboard.', 'ui.', 'screen.', 'scanner.', 'push.', 'share.share',
+];
+
+/** `scheme://host[:port]` of a URL, lowercased, default ports dropped; '' if unparseable. */
+export function originOf(url: string | null | undefined): string {
+  const m = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i.exec(String(url || ''));
+  if (!m) return '';
+  const scheme = m[1].toLowerCase();
+  const host = (m[2].split('@').pop() || '').toLowerCase();
+  const dflt = scheme === 'https' ? ':443' : scheme === 'http' ? ':80' : '';
+  return `${scheme}://${dflt && host.endsWith(dflt) ? host.slice(0, -dflt.length) : host}`;
+}
+
+/** Is `origin` the app's own (full bridge)? Fail-closed: an empty/unknown origin is foreign. */
+export function isTrustedOrigin(origin: string | null | undefined): boolean {
+  const o = originOf(origin);
+  if (!o) return false;
+  if (o === 'app://localhost' || (SHELL_CONFIG.loader === 'file' && o === 'file://')) return true;
+  if (SHELL_CONFIG.loader === 'server' && o === originOf(effectiveServerUrl())) return true;
+  return (SHELL_CONFIG.appBoundDomains ?? []).some((h) => o === `https://${String(h).toLowerCase()}`);
+}
+
+/** May a page of `origin` call `method`? */
+export function bridgeAllows(origin: string | null | undefined, method: string): boolean {
+  return isTrustedOrigin(origin) || FOREIGN_ALLOWED.some((a) => (a.endsWith('.') ? method.startsWith(a) : method === a));
+}

package/runtime/app/shell/bridge.ts

@@ -1,5 +1,6 @@
 import { isAndroid, isIOS } from '@nativescript/core';
 import { CustomWebView } from './custom-webview';
+import { bridgeAllows } from './bridge-origin';
 
 // params: any — the bridge payload is an untyped JSON object decoded from the WebView; each handler
 // narrows it to its own param shape at the call site.
@@ -39,7 +40,7 @@ export class Bridge {
    */
   attach(webView: CustomWebView): void {
     this.webView = webView;
-    webView.onAppwrapMessage = (json) => this.onMessage(json);
+    webView.onAppwrapMessage = (json, origin) => this.onMessage(json, origin);
   }
 
   detach(): void {
@@ -68,7 +69,8 @@ export class Bridge {
    * renderer would silently stall the retry loop and we would be back to the 60s lie. */
   static responseAttemptTimeoutMs = 3_000;
 
-  private async onMessage(json: string): Promise<void> {
+  /** `origin` = the calling frame's origin, from the transport (never from the page's own payload). */
+  private async onMessage(json: string, origin: string): Promise<void> {
     let req: RequestEnvelope;
     try {
       req = JSON.parse(json);
@@ -78,6 +80,11 @@ export class Bridge {
     }
     if (req.kind !== 'request' || !req.id || !req.method) return;
 
+    if (!bridgeAllows(origin, req.method)) {
+      console.warn(`Bridge: ${req.method} denied for foreign origin ${origin || '(unknown)'}`);
+      this.respond(req.id, undefined, { code: 'FORBIDDEN', message: `${req.method} is not available to ${origin || 'this page'}` });
+      return;
+    }
     const handler = this.handlers.get(req.method);
     if (!handler) {
       this.respond(req.id, undefined, { code: 'UNSUPPORTED', message: `No handler for ${req.method}` });

package/runtime/app/shell/config.ts

@@ -84,7 +84,7 @@ export const SHELL_CONFIG = {
    * present AND not `enabled:false`); when false the menu action, banner, and boot override are all
    * inert. `envs` = declared presets; `allowPattern` = anchored regex gating "Other" (default-deny
    * when ''). Stamped by `appwrap init`/`sync` — see `stampShellConfig`. */
-  envSwitcher: { enabled: false, envs: [] as { label: string; url: string }[], allowPattern: '' },
+  envSwitcher: { enabled: false, envs: [] as { label: string; url: string }[], allowPattern: '', params: [] as { key: string; label: string; options: string[]; optionsUrl: string; optionsPath: string; defaultValue?: string }[] },
   /** TCC-gated web APIs this build DECLARED (active modules + the config's `permissions{}`) — what the
    * document-start capability guard exposes to the page. NOT the same question as "is the Info.plist
    * usage string present": the plist also carries the webview baseline (NSCameraUsageDescription is

package/runtime/app/shell/custom-webview.android.ts

@@ -49,14 +49,15 @@ function getChromeClientClass(): any {
   chromeClientClass = (android.webkit.WebChromeClient as any).extend({
     onJsPrompt(
       view: android.webkit.WebView,
-      _url: string,
+      url: string,
       message: string,
       _defaultValue: string,
       result: android.webkit.JsPromptResult
     ): boolean {
       if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
         result.confirm('');
-        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
+        // `url` = the page that called prompt() (the bridge gates on its origin).
+        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length), url);
         return true;
       }
       return false; // genuine page prompt — default handling
@@ -91,7 +92,7 @@ function getChromeClientClass(): any {
  */
 export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
 
   /**
    * A TLS handshake this view REFUSED (onReceivedSslError → handler.cancel()), pending attribution to the

package/runtime/app/shell/custom-webview.ios.ts

@@ -38,7 +38,9 @@ class AppwrapScriptHandler extends NSObject implements WKScriptMessageHandler {
     const body = message.body;
     // Envelopes always travel as JSON strings (protocol v1)
     if (view?.onAppwrapMessage && typeof body === 'string') {
-      view.onAppwrapMessage(body);
+      // The CALLING frame's origin (WebKit-reported, not page-controlled) — the bridge gates on it.
+      const so = message.frameInfo?.securityOrigin;
+      view.onAppwrapMessage(body, so ? `${so.protocol}://${so.host}${so.port ? `:${so.port}` : ''}` : '');
     } else {
       // Nothing to dispatch to (bridge detached / view gone) or a non-string body ⇒ this request is
       // DROPPED and can never be answered — the caller's watchdog will report a false TIMEOUT for it.
@@ -195,7 +197,7 @@ export class CustomWebView extends WebView {
   }
 
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
   private _scriptHandler!: AppwrapScriptHandler; // retained — WKUserContentController holds it weakly
   private _logHandler!: AppwrapLogHandler; // retained — debug console-forwarding handler
   private _schemeHandler!: WKURLSchemeHandler;

package/runtime/app/shell/custom-webview.ts

@@ -7,7 +7,7 @@ import { WebView } from '@nativescript/core';
  */
 export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
 
   /** Pause/resume the render + JS-timer pipeline on app background/foreground. Platform-specific
    * (see custom-webview.android.ts); no-op on iOS, which suspends rAF on its own. */

package/runtime/app/shell/env-switcher.ts

@@ -5,6 +5,7 @@ import { OVERRIDE_KEY, effectiveServerUrl, isUrlAllowed } from './server-url';
 import { bridge } from './bridge';
 import { refreshEnvBanner } from './env-banner';
 import { refreshEnvKeepAwake } from './env-keepawake';
+import { paramMenuLabel, showParamPicker, urlParamDefs } from './url-params';
 
 /**
  * Runtime env-switcher — re-point a `loader:'server'` shell between declared environments (prod / lab /
@@ -164,6 +165,8 @@ export async function showEnvSwitcher(): Promise<void> {
     const allowOther = !!SHELL_CONFIG.envSwitcher?.allowPattern;
     const actions = envs.map((e) => (e.url === active ? `${e.label} ✓` : e.label));
     if (allowOther) actions.push('Other…');
+    const params = urlParamDefs().map((p) => ({ p, label: paramMenuLabel(p) }));
+    actions.push(...params.map((x) => x.label));
     actions.push('Reset to default');
 
     const choice = await Dialogs.action({
@@ -176,6 +179,8 @@ export async function showEnvSwitcher(): Promise<void> {
 
     if (choice === 'Reset to default') return void (await applySwitch(null, 'default'));
     if (choice === 'Other…') return void (await promptOther());
+    const param = params.find((x) => x.label === choice);
+    if (param) return void (await showParamPicker(param.p, reloadToEffective));
 
     const label = choice.replace(/ ✓$/, '');
     const env = envs.find((e) => e.label === label);

package/runtime/app/shell/server-url.ts

@@ -58,6 +58,42 @@ export function isOverrideAllowed(url: string): boolean {
  * override against the same allowlist the switcher uses — the native menu isn't the only writer of the
  * key (any page JS can write it via `kit.storage.set`), so the read side must not trust it blindly. */
 export function effectiveServerUrl(): string {
+  return withUrlParams(effectiveBaseUrl());
+}
+
+/** Persisted values for the config-declared URL params (`envSwitcher.params`), `{ key: value }`. */
+export const URL_PARAMS_KEY = 'kit:urlParams';
+
+/** The persisted URL-param selections, filtered to keys DECLARED in `envSwitcher.params` (a page can write
+ * the key via `kit.storage`, so undeclared keys / non-string values are dropped). {} when disabled. */
+export function storedUrlParams(): Record<string, string> {
+  const declared = new Set((SHELL_CONFIG.envSwitcher?.params ?? []).map((p) => p.key));
+  if (SHELL_CONFIG.loader !== 'server' || !SHELL_CONFIG.envSwitcher?.enabled || !declared.size) return {};
+  try {
+    const raw = JSON.parse(ApplicationSettings.getString(URL_PARAMS_KEY, '') || '{}');
+    const out: Record<string, string> = {};
+    for (const [k, v] of Object.entries(raw ?? {})) if (declared.has(k) && typeof v === 'string' && v) out[k] = v;
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+/** Apply the stored URL params to a load URL (a key already in the URL is REPLACED, not duplicated). */
+export function withUrlParams(url: string): string {
+  const params = Object.entries(storedUrlParams());
+  if (!params.length) return url;
+  try {
+    const u = new URL(url);
+    for (const [k, v] of params) u.searchParams.set(k, v);
+    return u.toString();
+  } catch {
+    return url; // unparseable base — load it untouched rather than corrupt it
+  }
+}
+
+/** The env base URL (override or build default) WITHOUT the URL params — what option sources resolve against. */
+export function effectiveBaseUrl(): string {
   if (SHELL_CONFIG.loader !== 'server') return SHELL_CONFIG.serverUrl;
   if (SHELL_CONFIG.envSwitcher?.enabled) {
     try {

package/runtime/app/shell/url-params.ts

@@ -0,0 +1,86 @@
+import { ApplicationSettings, Dialogs, Http } from '@nativescript/core';
+import { SHELL_CONFIG } from './config';
+import { URL_PARAMS_KEY, effectiveBaseUrl, storedUrlParams } from './server-url';
+
+/**
+ * Config-driven URL-param menu for the env-switcher (`envSwitcher.params`). Each declared param adds a
+ * "<Label>: <current>" entry to the Switch Environment sheet; picking a value persists it (`kit:urlParams`)
+ * and reloads the WebView with `?<key>=<value>` appended (see `withUrlParams` in server-url.ts). The first
+ * option, "default", means "no param" — or `?<key>=<defaultValue>` when the param declares one. Same gate as the env-switcher itself — no separate trust surface.
+ *
+ * Options come from a static `options` list and/or `optionsUrl` — a JSON GET resolved against the ACTIVE
+ * env's base URL (so a relative path follows an env switch). `optionsPath` (dot path) selects the value
+ * inside the response; an array yields its string items, an object yields its keys.
+ */
+
+export type UrlParamDef = (typeof SHELL_CONFIG.envSwitcher.params)[number];
+
+export const DEFAULT_OPTION = 'default';
+
+export function urlParamDefs(): UrlParamDef[] {
+  return SHELL_CONFIG.envSwitcher?.params ?? [];
+}
+
+/** Menu entry label for a param, e.g. "Segment: senior". */
+export function paramMenuLabel(p: UrlParamDef): string {
+  return `${p.label || p.key}: ${currentOption(p)}`;
+}
+
+/** The menu option currently selected — a stored `defaultValue` reads back as "default". */
+export function currentOption(p: UrlParamDef): string {
+  const v = storedUrlParams()[p.key];
+  return !v || v === p.defaultValue ? DEFAULT_OPTION : v;
+}
+
+/** Extract string options from a JSON response: walk `path`, then array → strings, object → keys. */
+export function extractOptions(json: unknown, path = ''): string[] {
+  let v: any = json;
+  for (const k of path.split('.').filter(Boolean)) v = v?.[k];
+  const list = Array.isArray(v) ? v : v && typeof v === 'object' ? Object.keys(v) : [];
+  return list.filter((s): s is string => typeof s === 'string' && !!s);
+}
+
+/** Resolve the param's options: "default" + static options + fetched options (deduped). A failed fetch
+ * is logged and falls back to the static list — the menu still opens. */
+export async function loadParamOptions(p: UrlParamDef): Promise<string[]> {
+  const opts = (p.options ?? []).filter((o) => o !== p.defaultValue);
+  if (p.optionsUrl) {
+    const url = new URL(p.optionsUrl, effectiveBaseUrl()).toString();
+    try {
+      const res = await Http.request({ url, method: 'GET', timeout: 8000 });
+      if (res.statusCode < 200 || res.statusCode >= 300) throw new Error(`HTTP ${res.statusCode}`);
+      opts.push(...extractOptions(res.content?.toJSON(), p.optionsPath));
+    } catch (e: any) {
+      console.warn(`AppWrap: url-param "${p.key}" options fetch failed (${url}): ${e?.message ?? e}`);
+    }
+  }
+  return [...new Set([DEFAULT_OPTION, ...opts])];
+}
+
+/** Persist one param pick. "default" (or '') stores the param's `defaultValue` when declared — an explicit
+ * reset sent to the page (e.g. `?segment=default`) — else clears it so the param is omitted. Only an
+ * explicit pick is ever sent; an untouched app never gets the defaultValue appended. */
+export function setUrlParam(p: UrlParamDef, value: string): void {
+  const next = { ...storedUrlParams() };
+  const v = !value || value === DEFAULT_OPTION ? p.defaultValue ?? '' : value;
+  if (v) next[p.key] = v;
+  else delete next[p.key];
+  ApplicationSettings.setString(URL_PARAMS_KEY, JSON.stringify(next));
+}
+
+/** Action sheet for one param; on a changed pick, persist + `reload()`. */
+export async function showParamPicker(p: UrlParamDef, reload: () => void): Promise<void> {
+  const current = currentOption(p);
+  const options = await loadParamOptions(p);
+  const choice = await Dialogs.action({
+    title: p.label || p.key,
+    message: `Current: ${current}`,
+    cancelButtonText: 'Cancel',
+    actions: options.map((o) => (o === current ? `${o} ✓` : o)),
+  });
+  if (!choice || choice === 'Cancel') return;
+  const value = choice.replace(/ ✓$/, '');
+  if (value === current) return;
+  setUrlParam(p, value);
+  reload();
+}

package/runtime/tests/bridge-origin.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, mock, test } from 'bun:test';
+
+// Same superset @nativescript/core mock as the other runtime tests (shared module cache).
+mock.module('@nativescript/core', () => ({
+  Http: { request: async () => ({ content: null }) },
+  isIOS: false, isAndroid: false, WebView: class {},
+  ApplicationSettings: { getString: (_k: string, d = '') => d, setString: () => {}, remove: () => {} },
+  Dialogs: { confirm: async () => true, action: async () => '', alert: async () => undefined, prompt: async () => ({ result: false, text: '' }) },
+  Utils: { dispatchToMainThread: (fn: () => void) => fn() },
+  Application: { on: () => {}, suspendEvent: 's', resumeEvent: 'r', orientationChangedEvent: 'o', android: {} },
+  Connectivity: { startMonitoring: () => {} },
+}));
+
+const { SHELL_CONFIG } = await import('../app/shell/config');
+const { Bridge } = await import('../app/shell/bridge');
+const { bridgeAllows, originOf } = await import('../app/shell/bridge-origin');
+
+/** A request from a page of `origin`; resolves with the response envelope the bridge delivers. */
+async function call(method: string, origin: string) {
+  const b = new Bridge();
+  const view: any = { onAppwrapMessage: null };
+  b.attach(view);
+  b.register(method, () => 'secret');
+  let out: any;
+  b.evalJs = async (js: string) => { out = JSON.parse(JSON.parse(js.slice(js.indexOf('(') + 1, js.lastIndexOf(')')))); };
+  view.onAppwrapMessage(JSON.stringify({ v: 1, id: 'k', kind: 'request', method }), origin);
+  await new Promise((r) => setTimeout(r, 20));
+  return out;
+}
+
+describe('Bridge origin gate — a foreign page must not reach the app’s stored data', () => {
+  test('the app origin keeps the full bridge', async () => {
+    expect((await call('storage.secure.get', 'app://localhost')).result).toBe('secret');
+  });
+
+  test('a foreign page (a LAN/Tailscale server) is FORBIDDEN storage.secure, fs, webview cookies', async () => {
+    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'clipboard.read', 'share.files']) {
+      const r = await call(m, 'http://192.168.1.5:7707');
+      expect(r.result).toBeUndefined();
+      expect(r.error.code).toBe('FORBIDDEN');
+    }
+  });
+
+  test('an unknown origin fails closed', async () => {
+    expect((await call('storage.secure.get', '')).error.code).toBe('FORBIDDEN');
+  });
+
+  test('a foreign page keeps UI feedback + permission-prompted features', () => {
+    for (const m of ['haptics.impact', 'keyboard.hide', 'share.share', 'ui.statusBar.setStyle', 'push.register', 'app.handshake'])
+      expect(bridgeAllows('https://evil.example', m)).toBe(true);
+  });
+
+  test('server loader: its own origin (default port, any path) is trusted; a lookalike is not', () => {
+    const prev = { loader: SHELL_CONFIG.loader, serverUrl: SHELL_CONFIG.serverUrl };
+    Object.assign(SHELL_CONFIG, { loader: 'server', serverUrl: 'https://app.example.com/start?x=1' });
+    try {
+      expect(bridgeAllows('https://app.example.com:443', 'storage.secure.get')).toBe(true);
+      expect(bridgeAllows('https://app.example.com.evil.io', 'storage.secure.get')).toBe(false);
+      expect(bridgeAllows('http://app.example.com', 'storage.secure.get')).toBe(false);
+    } finally { Object.assign(SHELL_CONFIG, prev); }
+  });
+
+  test('originOf normalises', () => {
+    expect(originOf('HTTP://U:p@Host:80/a?b#c')).toBe('http://host');
+    expect(originOf('app://localhost/index.html')).toBe('app://localhost');
+    expect(originOf('not a url')).toBe('');
+  });
+});

package/runtime/tests/bridge-response-delivery.test.ts

@@ -22,7 +22,7 @@ function harness(evalImpl: (js: string) => Promise<unknown>) {
   b.attach(view);
   b.evalJs = evalImpl;
   const delivered: any[] = [];
-  const send = (method: string, id = 'k1') => view.onAppwrapMessage(JSON.stringify({ v: 1, id, kind: 'request', method }));
+  const send = (method: string, id = 'k1') => view.onAppwrapMessage(JSON.stringify({ v: 1, id, kind: 'request', method }), 'app://localhost');
   /** Parse an envelope back out of the `window.__appwrapDeliver("…")` script the bridge builds. */
   const parse = (js: string) => JSON.parse(JSON.parse(js.slice(js.indexOf('(') + 1, js.lastIndexOf(')'))));
   return { b, send, delivered, parse };

package/src/cli.ts

@@ -975,6 +975,11 @@ export function stampShellConfig(outDir: string, cfg: AppwrapConfig): void {
     enabled: !!es && es.enabled !== false,
     envs: (es?.envs ?? []).map((e) => ({ label: String(e.label), url: String(e.url) })),
     allowPattern: es?.allowPattern ?? '',
+    params: (es?.params ?? []).map((p) => ({
+      key: String(p.key), label: String(p.label ?? p.key), options: (p.options ?? []).map(String),
+      optionsUrl: String(p.optionsUrl ?? ''), optionsPath: String(p.optionsPath ?? ''),
+      ...(p.defaultValue ? { defaultValue: String(p.defaultValue) } : {}),
+    })),
   };
   const hold = cfg.splashHold;
   const splash = {
@@ -1012,7 +1017,7 @@ export const SHELL_CONFIG = {
   iosKeyboardExtraLift: ${JSON.stringify(cfg.iosKeyboardExtraLift ?? 82)},
   iosHideKeyboardAccessory: ${JSON.stringify(cfg.iosHideKeyboardAccessory ?? false)},
   splash: ${JSON.stringify(splash)} as { hold: boolean; timeoutMs: number; logo: boolean },
-  envSwitcher: ${JSON.stringify(envSwitcher)} as { enabled: boolean; envs: { label: string; url: string }[]; allowPattern: string },
+  envSwitcher: ${JSON.stringify(envSwitcher)} as { enabled: boolean; envs: { label: string; url: string }[]; allowPattern: string; params: { key: string; label: string; options: string[]; optionsUrl: string; optionsPath: string; defaultValue?: string }[] },
   webCaps: ${JSON.stringify(webCaps)} as { camera: boolean; microphone: boolean; geolocation: boolean },
 };
 `;

package/src/config.ts

@@ -38,6 +38,23 @@ export interface EnvSwitcherConfig {
   allowPattern?: string;
   /** Deeplink auto-switch (Phase 2 — not yet implemented). Opt-in. */
   deeplink?: boolean;
+  /** Extra URL query params pickable from the switch menu (same gate). Each adds "<label>: <value>";
+   * a pick persists and reloads with `?<key>=<value>` ("default" = param omitted). */
+  params?: EnvSwitcherParam[];
+}
+
+/** One switchable URL param. Options = static `options` + `optionsUrl` (JSON GET, resolved against the
+ * ACTIVE env's URL, so a relative path follows env switches); `optionsPath` dot-path picks the value —
+ * an array gives its strings, an object gives its keys. */
+export interface EnvSwitcherParam {
+  key: string;
+  label?: string;
+  options?: string[];
+  optionsUrl?: string;
+  optionsPath?: string;
+  /** Value sent when "default" is picked (e.g. 'default' → `?segment=default`, an explicit reset). Absent →
+   * the param is omitted. Only sent after an explicit pick, never on an untouched app. */
+  defaultValue?: string;
 }
 
 /** iOS share-extension direct sync (`shareTarget.directSync`). When configured, the generated