@moifort/stack 0.0.0-stage → 0.1.0

package/templates/ios/infra/ios.tf

@@ -0,0 +1,28 @@
+resource "google_firebase_apple_app" "ios" {
+  provider     = google-beta
+  project      = google_project.this.project_id
+  display_name = "{{APP_NAME}} iOS"
+  bundle_id    = "{{BUNDLE_ID}}"
+  team_id      = var.apple_team_id
+
+  depends_on = [google_firebase_project.this]
+}
+
+data "google_firebase_apple_app_config" "ios" {
+  provider = google-beta
+  project  = google_project.this.project_id
+  app_id   = google_firebase_apple_app.ios.app_id
+}
+
+# Written next to the app for a local build; gitignored. CI rebuilds it from the
+# IOS_GOOGLE_SERVICE_INFO_PLIST secret.
+resource "local_file" "google_service_info_plist" {
+  filename        = "${path.root}/../ios/{{APP_NAME}}/GoogleService-Info.plist"
+  content_base64  = data.google_firebase_apple_app_config.ios.config_file_contents
+  file_permission = "0644"
+}
+
+output "ios_app_id" {
+  value       = google_firebase_apple_app.ios.app_id
+  description = "Firebase iOS app id"
+}

package/templates/ios/ios/ExportOptions.plist

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- App Store Connect distribution with a dedicated (non-managed) certificate.
+         Manual signing avoids Xcode cloud signing, which cannot use managed
+         distribution certificates from a fresh CI machine. -->
+    <key>method</key>
+    <string>app-store-connect</string>
+    <key>teamID</key>
+    <string>{{APPLE_TEAM_ID}}</string>
+    <key>signingStyle</key>
+    <string>manual</string>
+    <key>signingCertificate</key>
+    <string>Apple Distribution</string>
+    <key>provisioningProfiles</key>
+    <dict>
+        <key>{{BUNDLE_ID}}</key>
+        <string>{{APP_NAME}} App Store</string>
+    </dict>
+    <key>uploadSymbols</key>
+    <true/>
+    <key>destination</key>
+    <string>export</string>
+</dict>
+</plist>

package/templates/ios/ios/apollo-codegen-config.json

@@ -0,0 +1,16 @@
+{
+  "schemaNamespace": "{{APP_NAME}}GraphQL",
+  "input": {
+    "schemaSearchPaths": ["../shared/schema.graphql"],
+    "operationSearchPaths": ["{{APP_NAME}}/Features/**/GraphQL/*.graphql"]
+  },
+  "output": {
+    "schemaTypes": {
+      "path": "{{APP_NAME}}/Generated/GraphQL",
+      "moduleType": { "embeddedInTarget": { "name": "{{APP_NAME}}" } }
+    },
+    "operations": { "inSchemaModule": {} },
+    "testMocks": { "none": {} }
+  },
+  "options": { "markTypesNonisolated": true }
+}

package/templates/ios/ios/project.yml

@@ -0,0 +1,94 @@
+# The Xcode project is generated from this file: `bun run ios:project` (XcodeGen).
+# Never add a file through Xcode's UI: folders are synchronised, so a new file on
+# disk is in the target. Edit this file for settings, packages and targets.
+name: "{{APP_NAME}}"
+options:
+  bundleIdPrefix: com.polyforms
+  deploymentTarget:
+    iOS: "26.0"
+  defaultConfig: Debug
+  developmentLanguage: en
+
+settings:
+  base:
+    SWIFT_VERSION: "6.0"
+    SWIFT_STRICT_CONCURRENCY: complete
+    DEVELOPMENT_TEAM: "{{APPLE_TEAM_ID}}"
+    MARKETING_VERSION: "1.0"
+    CURRENT_PROJECT_VERSION: 1
+    DEVELOPMENT_LANGUAGE: en
+    LOCALIZATION_PREFERS_STRING_CATALOGS: YES
+    SWIFT_EMIT_LOC_STRINGS: YES
+
+packages:
+  Apollo:
+    url: https://github.com/apollographql/apollo-ios.git
+    from: "2.2.0"
+  Firebase:
+    url: https://github.com/firebase/firebase-ios-sdk.git
+    from: "13.0.0"
+  Sentry:
+    url: https://github.com/getsentry/sentry-cocoa.git
+    from: "9.0.0"
+
+targets:
+  "{{APP_NAME}}":
+    type: application
+    platform: iOS
+    sources:
+      - path: "{{APP_NAME}}"
+        type: syncedFolder
+    dependencies:
+      - package: Apollo
+        product: Apollo
+      - package: Firebase
+        product: FirebaseCore
+      - package: Firebase
+        product: FirebaseAuth
+      - package: Sentry
+        product: Sentry
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: "{{BUNDLE_ID}}"
+        INFOPLIST_FILE: "{{APP_NAME}}/Info.plist"
+        GENERATE_INFOPLIST_FILE: YES
+        INFOPLIST_KEY_CFBundleDisplayName: "{{APP_NAME}}"
+        INFOPLIST_KEY_UISupportedInterfaceOrientations: UIInterfaceOrientationPortrait
+        INFOPLIST_KEY_ITSAppUsesNonExemptEncryption: NO
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+        CODE_SIGN_ENTITLEMENTS: "{{APP_NAME}}/{{APP_NAME}}.entitlements"
+        CODE_SIGN_STYLE: Automatic
+      configs:
+        Release:
+          # The archive signs manually with the distribution certificate and the
+          # App Store profile the upload workflow installs.
+          CODE_SIGN_STYLE: Manual
+          CODE_SIGN_IDENTITY: Apple Distribution
+          PROVISIONING_PROFILE_SPECIFIER: "{{APP_NAME}} App Store"
+
+  "{{APP_NAME}}Tests":
+    type: bundle.unit-test
+    platform: iOS
+    sources:
+      - path: "{{APP_NAME}}Tests"
+        type: syncedFolder
+    dependencies:
+      - target: "{{APP_NAME}}"
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: "{{BUNDLE_ID}}.tests"
+        GENERATE_INFOPLIST_FILE: YES
+        TEST_HOST: "$(BUILT_PRODUCTS_DIR)/{{APP_NAME}}.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/{{APP_NAME}}"
+        BUNDLE_LOADER: "$(TEST_HOST)"
+
+schemes:
+  "{{APP_NAME}}":
+    build:
+      targets:
+        "{{APP_NAME}}": all
+        "{{APP_NAME}}Tests": [test]
+    test:
+      targets:
+        - "{{APP_NAME}}Tests"
+    archive:
+      config: Release

package/templates/ios/ios/{{APP_NAME}}/App.swift

@@ -0,0 +1,46 @@
+import FirebaseCore
+import Sentry
+import SwiftUI
+
+@main
+struct App: SwiftUI.App {
+    init() {
+        FirebaseApp.configure()
+        #if DEBUG
+        // Points Auth at the local emulator and signs in, only when the UI test
+        // launch arguments are there. A normal Debug run is untouched.
+        UITestEnvironment.bootstrapIfNeeded()
+        #endif
+        startSentry()
+    }
+
+    var body: some Scene {
+        WindowGroup {
+            AuthRoot()
+        }
+    }
+
+    private func startSentry() {
+        #if DEBUG
+        // Debug builds (Xcode, simulator) never start Sentry, so their noise stays
+        // out of the production project. Archived builds report.
+        #else
+        let dsn = Secrets.sentryDsn
+        if dsn.isEmpty { return }
+
+        SentrySDK.start { options in
+            options.dsn = dsn
+            // Errors are never sampled, only performance traces are.
+            options.tracesSampleRate = 0.1
+            options.enableAutoSessionTracking = true
+            options.enableTimeToFullDisplayTracing = true
+            // MetricKit hands over the system's own diagnostics: hangs, and the
+            // watchdog kills with the stack they happened on.
+            options.enableMetricKit = true
+            // Trace headers on our GraphQL calls only, so an app error and the
+            // backend error that caused it land in one trace.
+            options.tracePropagationTargets = [APIClient.shared.baseURL.absoluteString]
+        }
+        #endif
+    }
+}

package/templates/ios/ios/{{APP_NAME}}/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,14 @@
+{
+  "images" : [
+    {
+      "filename" : "AppIcon.png",
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

package/templates/ios/ios/{{APP_NAME}}/Assets.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

package/templates/ios/ios/{{APP_NAME}}/Assets.xcassets/LaunchBackground.colorset/Contents.json

@@ -0,0 +1,38 @@
+{
+  "colors" : [
+    {
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0.860",
+          "green" : "0.930",
+          "red" : "0.960"
+        }
+      },
+      "idiom" : "universal"
+    },
+    {
+      "appearances" : [
+        {
+          "appearance" : "luminosity",
+          "value" : "dark"
+        }
+      ],
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0.080",
+          "green" : "0.090",
+          "red" : "0.110"
+        }
+      },
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

package/templates/ios/ios/{{APP_NAME}}/ContentView.swift

@@ -0,0 +1,17 @@
+import SwiftUI
+
+/// The app once signed in and onboarded: the tabs. Each tab is a feature's
+/// Screen; a new feature adds its tab here.
+struct ContentView: View {
+    var body: some View {
+        TabView {
+            Tab("Accueil", systemImage: "house") {
+                HomeScreen()
+            }
+        }
+    }
+}
+
+#Preview {
+    ContentView()
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Auth/AppleNonce.swift

@@ -0,0 +1,33 @@
+import CryptoKit
+import Foundation
+
+/// Helpers for the Sign in with Apple nonce required by Firebase Auth.
+enum AppleNonce {
+    /// 32-character URL-safe nonce (uppercase letters, digits, hyphen, underscore).
+    static func random(length: Int = 32) -> String {
+        precondition(length > 0)
+        let charset: [Character] = Array(
+            "0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvwxyz-._"
+        )
+        var result = ""
+        var remaining = length
+        while remaining > 0 {
+            var random: UInt8 = 0
+            let status = SecRandomCopyBytes(kSecRandomDefault, 1, &random)
+            guard status == errSecSuccess else { continue }
+            if random < charset.count {
+                result.append(charset[Int(random)])
+                remaining -= 1
+            }
+        }
+        return result
+    }
+
+    /// SHA-256 hex digest used as the value sent to Apple.
+    static func sha256(_ input: String) -> String {
+        SHA256
+            .hash(data: Data(input.utf8))
+            .compactMap { String(format: "%02x", $0) }
+            .joined()
+    }
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Auth/AuthRoot.swift

@@ -0,0 +1,74 @@
+import FirebaseCore
+import SwiftUI
+
+/// Top-level gate: the blocking update screen when the backend no longer supports
+/// this build; otherwise the login when no Firebase user is signed in; once signed
+/// in, the onboarding until it is completed, then the app.
+struct AuthRoot: View {
+    @State private var session = AuthSession()
+    @State private var gate = OnboardingGate()
+    @State private var supportGate = AppSupportGate()
+    @Environment(\.scenePhase) private var scenePhase
+
+    var body: some View {
+        Group {
+            if case .updateRequired(let appStoreURL) = supportGate.state {
+                UpdateRequiredView(appStoreURL: appStoreURL)
+            } else if isShowcase || session.user != nil {
+                signedIn
+            } else {
+                LoginScreen()
+            }
+        }
+        .environment(session)
+        .environment(\.accountFirstName, gate.firstName)
+        .task {
+            guard !isShowcase else { return }
+            await supportGate.check()
+        }
+        .onChange(of: scenePhase) { _, phase in
+            if phase == .active, !isShowcase { Task { await supportGate.check() } }
+        }
+        .task(id: session.user?.uid) {
+            if session.user != nil || isShowcase {
+                await gate.refresh()
+            } else {
+                gate.reset()
+            }
+        }
+    }
+
+    /// The App Store captures: signed in as the showcase user, without Apple.
+    private var isShowcase: Bool {
+        #if DEBUG
+        Showcase.isOn
+        #else
+        false
+        #endif
+    }
+
+    @ViewBuilder
+    private var signedIn: some View {
+        switch gate.state {
+        case .loading:
+            StartupLoadingView()
+        case .required:
+            OnboardingScreen(onCompleted: { gate.markCompleted(firstName: $0) })
+        case .ready:
+            ContentView()
+        case .failed(let message):
+            ContentUnavailableView {
+                Label("Connexion impossible", systemImage: "wifi.exclamationmark")
+            } description: {
+                Text(message)
+            } actions: {
+                AsyncButton("Réessayer") { await gate.refresh() }
+            }
+        }
+    }
+}
+
+#Preview {
+    if FirebaseApp.app() == nil { FirebaseApp.configure() }
+    return AuthRoot()
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Auth/AuthSession.swift

@@ -0,0 +1,86 @@
+import FirebaseAuth
+import Observation
+import Sentry
+
+/// Single source of truth for the signed-in Firebase user. Lives at app scope;
+/// views that react to sign-in and sign-out observe `user`.
+@MainActor
+@Observable
+final class AuthSession {
+    // Qualified: importing Sentry brings its own `User` into scope.
+    private(set) var user: FirebaseAuth.User?
+    @ObservationIgnored
+    nonisolated(unsafe) private var handle: AuthStateDidChangeListenerHandle?
+    /// The given name Apple handed over at sign-in. Apple sends it only on the
+    /// very first authorization, so it is kept the moment it arrives.
+    private var appleGivenName: String?
+
+    /// The first name to propose in onboarding: Apple's given name when this
+    /// sign-in carried one, else the one Firebase kept in the display name.
+    var suggestedFirstName: String? {
+        if let appleGivenName { return appleGivenName }
+        guard let displayName = user?.displayName, !displayName.isEmpty else { return nil }
+        let givenName = (try? PersonNameComponents(displayName, strategy: .name))?.givenName
+        return givenName?.isEmpty == false ? givenName : nil
+    }
+
+    init() {
+        user = Auth.auth().currentUser
+        report(user)
+        handle = Auth.auth().addStateDidChangeListener { [weak self] _, user in
+            Task { @MainActor in
+                guard let self else { return }
+                // However the session ended (sign-out, account deleted, a dead
+                // session dropped by the API client), the next user starts clean.
+                if self.user != nil, user == nil { self.forgetAccount() }
+                self.user = user
+                self.report(user)
+            }
+        }
+    }
+
+    /// Names the account behind a crash report: the uid only, no email, no name.
+    private func report(_ user: FirebaseAuth.User?) {
+        SentrySDK.setUser(user.map { Sentry.User(userId: $0.uid) })
+    }
+
+    deinit {
+        if let handle { Auth.auth().removeStateDidChangeListener(handle) }
+    }
+
+    func rememberAppleName(_ fullName: PersonNameComponents?) {
+        let givenName = fullName?.givenName?.trimmingCharacters(in: .whitespacesAndNewlines)
+        appleGivenName = givenName?.isEmpty == false ? givenName : nil
+    }
+
+    func signOut() throws {
+        try Auth.auth().signOut()
+    }
+
+    /// Whoever signs in next must not open on this account's data: every cache
+    /// the app keeps on disk is cleared here.
+    private func forgetAccount() {
+        appleGivenName = nil
+        SnapshotCaches.clear()
+    }
+
+    /// Signs out when Firebase no longer knows the signed-in account (deleted,
+    /// disabled): the ID token outlives the account by up to an hour. Returns
+    /// whether it did.
+    @discardableResult
+    nonisolated static func dropSessionIfAccountIsGone() async -> Bool {
+        guard let user = Auth.auth().currentUser else { return false }
+        do {
+            try await user.reload()
+            return false
+        } catch {
+            let nsError = error as NSError
+            guard nsError.domain == AuthErrorDomain,
+                  let code = AuthErrorCode(rawValue: nsError.code),
+                  [.userNotFound, .userDisabled, .userTokenExpired, .invalidUserToken].contains(code)
+            else { return false }
+            await MainActor.run { _ = try? Auth.auth().signOut() }
+            return true
+        }
+    }
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Auth/LoginScreen.swift

@@ -0,0 +1,83 @@
+import AuthenticationServices
+import FirebaseAuth
+import FirebaseCore
+import SwiftUI
+
+struct LoginScreen: View {
+    @Environment(AuthSession.self) private var session
+    @State private var nonce = ""
+    @State private var error: String?
+    @State private var isSigningIn = false
+
+    var body: some View {
+        VStack(spacing: 32) {
+            Spacer()
+            VStack(spacing: 12) {
+                Image(systemName: "sparkles")
+                    .font(.system(size: 64))
+                    .foregroundStyle(.tint)
+                    .padding(.bottom, 4)
+                Text(verbatim: "{{APP_NAME}}")
+                    .font(.largeTitle.bold())
+                Text("Connectez-vous pour retrouver vos données.")
+                    .font(.subheadline)
+                    .foregroundStyle(.secondary)
+                    .multilineTextAlignment(.center)
+            }
+            Spacer()
+            SignInWithAppleButton(.signIn) { request in
+                let raw = AppleNonce.random()
+                nonce = raw
+                request.requestedScopes = [.fullName, .email]
+                request.nonce = AppleNonce.sha256(raw)
+            } onCompletion: { result in
+                Task { await handle(result) }
+            }
+            .signInWithAppleButtonStyle(.black)
+            .frame(height: 50)
+            .padding(.horizontal, 32)
+            .disabled(isSigningIn)
+            if let error {
+                Text(error)
+                    .font(.footnote)
+                    .foregroundStyle(.red)
+                    .padding(.horizontal, 32)
+            }
+            Spacer().frame(height: 40)
+        }
+    }
+
+    private func handle(_ result: Result<ASAuthorization, Error>) async {
+        isSigningIn = true
+        defer { isSigningIn = false }
+        do {
+            let auth = try result.get()
+            guard
+                let credential = auth.credential as? ASAuthorizationAppleIDCredential,
+                let tokenData = credential.identityToken,
+                let token = String(data: tokenData, encoding: .utf8)
+            else {
+                error = String(localized: "Apple n'a pas renvoyé de jeton.")
+                return
+            }
+            let oauth = OAuthProvider.appleCredential(
+                withIDToken: token,
+                rawNonce: nonce,
+                fullName: credential.fullName
+            )
+            // Before signing in: the session flips to signed-in the moment
+            // Firebase answers, and onboarding reads the name on appearing.
+            session.rememberAppleName(credential.fullName)
+            _ = try await Auth.auth().signIn(with: oauth)
+        } catch {
+            self.error = (error as NSError).localizedDescription
+        }
+    }
+}
+
+#Preview {
+    // `AuthSession` reads `Auth.auth()` on init, which traps when Firebase was
+    // never configured: the canvas does not run `App.init`.
+    if FirebaseApp.app() == nil { FirebaseApp.configure() }
+    return LoginScreen().environment(AuthSession())
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Home/HomeScreen.swift

@@ -0,0 +1,21 @@
+import SwiftUI
+
+/// The first tab, connected: owns the settings sheet. The first feature of the
+/// app replaces the page's empty state with what it shows.
+struct HomeScreen: View {
+    @Environment(\.accountFirstName) private var firstName
+    @State private var settingsShown = false
+
+    var body: some View {
+        NavigationStack {
+            HomePage(firstName: firstName) { action in
+                switch action {
+                case .openSettings: settingsShown = true
+                }
+            }
+            .sheet(isPresented: $settingsShown) {
+                SettingsHomeScreen()
+            }
+        }
+    }
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Home/components/pages/HomePage.swift

@@ -0,0 +1,40 @@
+import SwiftUI
+
+enum HomeAction {
+    case openSettings
+}
+
+/// The first tab, pure: a greeting and, until the first feature exists, the empty
+/// state. Settings sit behind the gear, top right.
+struct HomePage: View {
+    let firstName: String?
+    let onAction: (HomeAction) -> Void
+
+    var body: some View {
+        EmptyState(
+            systemImage: "sparkles",
+            title: "Rien pour l'instant",
+            message: "Ce qui arrive dans l'application s'affichera ici."
+        )
+        .navigationTitle(title)
+        .toolbar {
+            ToolbarItem(placement: .primaryAction) {
+                ToolbarIconButton(title: "Réglages", systemImage: "gearshape") { onAction(.openSettings) }
+                    .accessibilityIdentifier("home-settings")
+            }
+        }
+    }
+
+    private var title: String {
+        if let firstName, !firstName.isEmpty { return String(localized: "Bonjour \(firstName)") }
+        return String(localized: "Accueil")
+    }
+}
+
+#Preview {
+    NavigationStack { HomePage(firstName: "Ada") { _ in } }
+}
+
+#Preview("Without a name") {
+    NavigationStack { HomePage(firstName: nil) { _ in } }
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Onboarding/AccountEnvironment.swift

@@ -0,0 +1,7 @@
+import SwiftUI
+
+extension EnvironmentValues {
+    /// The first name the user gave at onboarding, set at the root from the launch
+    /// request, so the profile settings show it without a request of their own.
+    @Entry var accountFirstName: String? = nil
+}

package/templates/ios/ios/{{APP_NAME}}/Features/Onboarding/GraphQL/Onboarding.graphql

@@ -0,0 +1,16 @@
+# Everything a signed-in launch needs, in one request: the onboarding or the app,
+# and the first name the profile settings show.
+query Launch {
+  me {
+    firstName
+    onboardingCompleted
+  }
+}
+
+mutation CompleteOnboarding($input: CompleteOnboardingInput!) {
+  completeOnboarding(input: $input) {
+    userId
+    firstName
+    onboardingCompleted
+  }
+}