@protobase/mobile 0.44.4 → 0.45.0

package/android/build.gradle

@@ -0,0 +1,47 @@
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+        maven {
+            url = "https://plugins.gradle.org/m2/"
+        }
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+    }
+}
+
+apply plugin: 'com.android.library'
+
+android {
+    namespace = "net.protobase.mobile"
+    compileSdk = project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 36
+    defaultConfig {
+        minSdkVersion project.hasProperty('minSdkVersion') ? rootProject.ext.minSdkVersion : 24
+        targetSdkVersion project.hasProperty('targetSdkVersion') ? rootProject.ext.targetSdkVersion : 36
+        versionCode 1
+        versionName "1.0"
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+    lintOptions {
+        abortOnError = false
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    implementation project(':capacitor-android')
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+</manifest>

package/android/src/main/java/net/protobase/mobile/AuthHeaders.java

@@ -0,0 +1,65 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.JSObject;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Locale;
+import java.util.Set;
+import org.json.JSONObject;
+
+/**
+ * The request headers ProtobaseAuth sends of those page script gives: the string-valued ones, without the Fetch spec's
+ * forbidden request header names, which a page's Request never carries. So page script cannot set the cookie, the
+ * origin, or the host a shared ingress routes by, nor override the method.
+ */
+final class AuthHeaders {
+
+    private static final Set<String> FORBIDDEN = new HashSet<>(
+        Arrays.asList(
+            "accept-charset",
+            "accept-encoding",
+            "access-control-request-headers",
+            "access-control-request-method",
+            "connection",
+            "content-length",
+            "cookie",
+            "cookie2",
+            "date",
+            "dnt",
+            "expect",
+            "host",
+            "keep-alive",
+            "origin",
+            "referer",
+            "set-cookie",
+            "te",
+            "trailer",
+            "transfer-encoding",
+            "upgrade",
+            "via",
+            "x-http-method",
+            "x-http-method-override",
+            "x-method-override"
+        )
+    );
+
+    private AuthHeaders() {}
+
+    static JSObject allowed(JSONObject given) {
+        JSObject headers = new JSObject();
+        if (given == null) return headers;
+        Iterator<String> names = given.keys();
+        while (names.hasNext()) {
+            String name = names.next();
+            Object value = given.opt(name);
+            if (value instanceof String && !forbidden(name)) headers.put(name, (String) value);
+        }
+        return headers;
+    }
+
+    private static boolean forbidden(String name) {
+        String lower = name.toLowerCase(Locale.ROOT);
+        return FORBIDDEN.contains(lower) || lower.startsWith("proxy-") || lower.startsWith("sec-");
+    }
+}

package/android/src/main/java/net/protobase/mobile/AuthUrl.java

@@ -0,0 +1,71 @@
+package net.protobase.mobile;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Locale;
+import java.util.regex.Pattern;
+
+/**
+ * Whether ProtobaseAuth may call a URL: one below the auth base path of the API origin, as the shell's
+ * nativeAuthFetch checks it. Parsed by URI and by URL, which HttpRequestHandler opens it with, and both must agree;
+ * dot segments and an encoded dot, slash or backslash are refused, since the server's URL parser decodes `%2e%2e`
+ * into `..`.
+ */
+final class AuthUrl {
+
+    /** Where Better Auth's endpoints are served, as packages/schema/src/auth-base-path.ts names it. */
+    static final String AUTH_BASE_PATH = "/api/auth";
+
+    private static final Pattern ENCODED_DOT_OR_SEPARATOR = Pattern.compile("%(2e|2f|5c)", Pattern.CASE_INSENSITIVE);
+
+    private AuthUrl() {}
+
+    /** The parts both parsers agree on. */
+    private static final class Parts {
+
+        final String scheme;
+        final String host;
+        final int port;
+        final String path;
+
+        Parts(String scheme, String host, int port, String path) {
+            this.scheme = scheme;
+            this.host = host;
+            this.port = port;
+            this.path = path;
+        }
+    }
+
+    static boolean allowed(String url, String apiOrigin) {
+        Parts origin = parse(apiOrigin);
+        Parts target = parse(url);
+        if (origin == null || target == null || !origin.path.isEmpty()) return false;
+        if (!target.scheme.equals(origin.scheme) || !target.host.equals(origin.host) || target.port != origin.port) return false;
+        String path = target.path;
+        if (!path.startsWith(AUTH_BASE_PATH + "/") || path.contains("\\") || ENCODED_DOT_OR_SEPARATOR.matcher(path).find()) return false;
+        return Arrays.stream(path.split("/")).noneMatch((segment) -> segment.equals(".") || segment.equals(".."));
+    }
+
+    // `null` when the parsers disagree, or the URL is not plain http or https.
+    private static Parts parse(String text) {
+        URI uri;
+        URL url;
+        try {
+            uri = new URI(text);
+            url = new URL(text);
+        } catch (URISyntaxException | MalformedURLException e) {
+            return null;
+        }
+        String scheme = uri.getScheme() == null ? "" : uri.getScheme().toLowerCase(Locale.ROOT);
+        if (!scheme.equals("http") && !scheme.equals("https")) return null;
+        if (uri.getHost() == null || uri.getRawUserInfo() != null || url.getUserInfo() != null || uri.getRawPath() == null) return null;
+        String host = uri.getHost().toLowerCase(Locale.ROOT);
+        int port = uri.getPort() == -1 ? (scheme.equals("https") ? 443 : 80) : uri.getPort();
+        int urlPort = url.getPort() == -1 ? url.getDefaultPort() : url.getPort();
+        boolean agree = url.getProtocol().equalsIgnoreCase(scheme) && url.getHost().equalsIgnoreCase(host) && urlPort == port && url.getPath().equals(uri.getRawPath());
+        return agree ? new Parts(scheme, host, port, uri.getRawPath()) : null;
+    }
+}

package/android/src/main/java/net/protobase/mobile/GuardedWebViewClient.java

@@ -0,0 +1,73 @@
+package net.protobase.mobile;
+
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+import android.webkit.WebView;
+import com.getcapacitor.Bridge;
+import com.getcapacitor.BridgeWebViewClient;
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Objects;
+
+/**
+ * Keeps page script from reading the app's files through its local server, which opens any file a request's path
+ * names (AndroidProtocolHandler.java:66-87): the WebView's cookie database, with the session token in plain text,
+ * lives below the app's data folder. Refused, with an empty 403:
+ * - the file and content routes, `/_capacitor_file_` and `/_capacitor_content_`, which Protobase never uses;
+ * - a `..` segment in the decoded path the server opens;
+ * - while the server serves files from a folder (the live updater's bundle), a path whose file is not inside the
+ *   live updater's bundles folder, wherever that folder came from.
+ * The decoded path is the one the server reads (WebViewLocalServer.java:236-239,686-689). The server's folder is read
+ * again after it answered, so a switch between the check and the read is refused too.
+ */
+final class GuardedWebViewClient extends BridgeWebViewClient {
+
+    private final Bridge bridge;
+    private final File bundles;
+
+    GuardedWebViewClient(Bridge bridge, File bundles) {
+        super(bridge);
+        this.bridge = bridge;
+        this.bundles = bundles;
+    }
+
+    @Override
+    public WebResourceResponse shouldInterceptRequest(WebView view, WebResourceRequest request) {
+        String decoded = request.getUrl().getPath();
+        String path = decoded == null ? "" : decoded;
+        String basePath = bridge.getServerBasePath();
+        if (refused(path, basePath)) return forbidden();
+        WebResourceResponse response = super.shouldInterceptRequest(view, request);
+        // A stream left open here is the garbage collector's to close: it only happens to a request racing a switch.
+        if (!Objects.equals(basePath, bridge.getServerBasePath())) return forbidden();
+        return response;
+    }
+
+    private boolean refused(String path, String basePath) {
+        if (path.startsWith(Bridge.CAPACITOR_FILE_START) || path.startsWith(Bridge.CAPACITOR_CONTENT_START)) return true;
+        if (Arrays.asList(path.split("/")).contains("..")) return true;
+        if (basePath == null || !new File(basePath).isAbsolute()) return false;
+        return !inside(new File(basePath + path));
+    }
+
+    // Compares whole path components of the canonical paths, so a sibling such as `<bundles>_x` is not inside. One
+    // that cannot be made canonical is refused.
+    private boolean inside(File file) {
+        String canonical;
+        String root;
+        try {
+            canonical = file.getCanonicalPath();
+            root = bundles.getCanonicalPath();
+        } catch (IOException e) {
+            return false;
+        }
+        return canonical.equals(root) || canonical.startsWith(root + File.separator);
+    }
+
+    private static WebResourceResponse forbidden() {
+        return new WebResourceResponse("text/plain", "utf-8", 403, "Forbidden", Collections.emptyMap(), new ByteArrayInputStream(new byte[0]));
+    }
+}

package/android/src/main/java/net/protobase/mobile/LocalServerGuard.java

@@ -0,0 +1,22 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import java.io.File;
+
+/**
+ * Puts GuardedWebViewClient in front of the app's local server. It has no methods: it only acts when it loads, which
+ * is before the first page, since Capacitor 8.5.3 loads plugins before it installs the bridge's WebViewClient on the
+ * WebView (Bridge.java:231-233,281).
+ */
+@CapacitorPlugin(name = "ProtobaseLocalServerGuard")
+public class LocalServerGuard extends Plugin {
+
+    // The folder the live updater keeps its bundles in, a fixed name below the app's files (LiveUpdate.java:114).
+    private static final String LIVE_UPDATE_BUNDLES = "_capacitor_live_update_bundles";
+
+    @Override
+    public void load() {
+        getBridge().setWebViewClient(new GuardedWebViewClient(getBridge(), new File(getContext().getFilesDir(), LIVE_UPDATE_BUNDLES)));
+    }
+}

package/android/src/main/java/net/protobase/mobile/ProtobaseAuth.java

@@ -0,0 +1,105 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import com.getcapacitor.plugin.util.HttpRequestHandler;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Locale;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import org.json.JSONObject;
+
+/**
+ * The shell's sign-in requests, through native HTTP and the device's cookie jar, to `<apiOrigin>/api/auth/` only. It
+ * names the Capacitor origin of the app, which the server trusts for sign-in, and hands page script no Set-Cookie: the
+ * session token stays in the jar. `apiOrigin` and `origin` come from capacitor.config.json, which the CLI writes and
+ * ships outside the app's web part, so neither page script nor a live update can change them.
+ */
+@CapacitorPlugin(name = "ProtobaseAuth")
+public class ProtobaseAuth extends Plugin {
+
+    private final ExecutorService executor = Executors.newCachedThreadPool();
+
+    @Override
+    protected void handleOnDestroy() {
+        super.handleOnDestroy();
+        executor.shutdownNow();
+    }
+
+    @PluginMethod
+    public void request(PluginCall call) {
+        String apiOrigin = getConfig().getString("apiOrigin");
+        String origin = getConfig().getString("origin");
+        if (apiOrigin == null || origin == null) {
+            call.reject("ProtobaseAuth has no apiOrigin or origin in its config");
+            return;
+        }
+        String url = call.getString("url");
+        if (url == null || !AuthUrl.allowed(url, apiOrigin)) {
+            call.reject("ProtobaseAuth calls " + apiOrigin + AuthUrl.AUTH_BASE_PATH + "/ only");
+            return;
+        }
+        String method = call.getString("method", "GET").toUpperCase(Locale.ROOT);
+        // All Better Auth serves.
+        if (!method.equals("GET") && !method.equals("POST")) {
+            call.reject("ProtobaseAuth sends GET or POST only, not " + method);
+            return;
+        }
+        Object data = call.getData().opt("data");
+        if (data != null && !(data instanceof String)) {
+            call.reject("ProtobaseAuth sends a text body only");
+            return;
+        }
+        JSObject headers = AuthHeaders.allowed(call.getObject("headers"));
+        headers.put("Origin", origin);
+        replaceOptions(call.getData(), url, method, headers, (String) data);
+        if (executor.isShutdown()) {
+            call.reject("ProtobaseAuth was shut down");
+            return;
+        }
+        executor.submit(() -> send(call, method));
+    }
+
+    private void send(PluginCall call, String method) {
+        // Every failure answers the call, as CapacitorHttp's does: a task's exception would otherwise leave it unanswered.
+        try {
+            JSObject response = HttpRequestHandler.request(call, method, getBridge());
+            removeCookieHeaders(response.optJSONObject("headers"));
+            call.resolve(response);
+        } catch (Exception e) {
+            call.reject(e.getLocalizedMessage(), e.getClass().getSimpleName(), e);
+        }
+    }
+
+    // HttpRequestHandler reads its options from the call: only the checked ones are left, so page script cannot add
+    // params, a file body (`dataType`), timeouts or redirects.
+    private static void replaceOptions(JSObject options, String url, String method, JSObject headers, String data) {
+        for (String key : keysOf(options)) options.remove(key);
+        options.put("url", url);
+        options.put("method", method);
+        options.put("headers", headers);
+        if (data != null) options.put("data", data);
+        options.put("responseType", "text");
+        options.put("disableRedirects", true);
+    }
+
+    private static void removeCookieHeaders(JSONObject headers) {
+        if (headers == null) return;
+        for (String name : keysOf(headers)) {
+            if (name.equalsIgnoreCase("set-cookie") || name.equalsIgnoreCase("set-cookie2")) headers.remove(name);
+        }
+    }
+
+    // Collected before any is removed, which the iterator does not allow.
+    private static List<String> keysOf(JSONObject object) {
+        List<String> keys = new ArrayList<>();
+        Iterator<String> names = object.keys();
+        while (names.hasNext()) keys.add(names.next());
+        return keys;
+    }
+}

package/android/src/main/java/net/protobase/mobile/Refusal.java

@@ -0,0 +1,13 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.PluginCall;
+
+/** How the stand-ins answer page script that calls a stock plugin they replace. */
+final class Refusal {
+
+    private Refusal() {}
+
+    static void reject(PluginCall call, String plugin) {
+        call.reject(plugin + " is not available to page script in a Protobase app");
+    }
+}

package/android/src/main/java/net/protobase/mobile/RefusedCookies.java

@@ -0,0 +1,45 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+/**
+ * Takes the place of Capacitor's CapacitorCookies, which lets page script write and delete any cookie in the device's
+ * jar: plant another session or clear the user's. Replaced by name as RefusedHttp is. The stock plugin's load() has
+ * already installed the cookie handler native HTTP keeps the session with (CapacitorCookies.java:21-28).
+ */
+@CapacitorPlugin(name = "CapacitorCookies")
+public class RefusedCookies extends Plugin {
+
+    @Override
+    public void load() {
+        getBridge().getWebView().removeJavascriptInterface("CapacitorCookiesAndroidInterface");
+    }
+
+    @PluginMethod
+    public void getCookies(PluginCall call) {
+        Refusal.reject(call, "CapacitorCookies");
+    }
+
+    @PluginMethod
+    public void setCookie(PluginCall call) {
+        Refusal.reject(call, "CapacitorCookies");
+    }
+
+    @PluginMethod
+    public void deleteCookie(PluginCall call) {
+        Refusal.reject(call, "CapacitorCookies");
+    }
+
+    @PluginMethod
+    public void clearCookies(PluginCall call) {
+        Refusal.reject(call, "CapacitorCookies");
+    }
+
+    @PluginMethod
+    public void clearAllCookies(PluginCall call) {
+        Refusal.reject(call, "CapacitorCookies");
+    }
+}

package/android/src/main/java/net/protobase/mobile/RefusedHttp.java

@@ -0,0 +1,52 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+/**
+ * Takes the place of Capacitor's CapacitorHttp, whose answers hand page script every response header, the session's
+ * Set-Cookie included, for any request it makes with the device's cookie jar. Capacitor 8.5.3 registers its core
+ * plugins first and an app's plugins after them under the same map, keyed by name only (Bridge.java:660-668,711), so
+ * this one replaces it. Native code keeps HttpRequestHandler, which ProtobaseAuth uses.
+ */
+@CapacitorPlugin(name = "CapacitorHttp")
+public class RefusedHttp extends Plugin {
+
+    @Override
+    public void load() {
+        // Added by the stock plugin's load(), which already ran; plugins load before the first page.
+        getBridge().getWebView().removeJavascriptInterface("CapacitorHttpAndroidInterface");
+    }
+
+    @PluginMethod
+    public void request(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+
+    @PluginMethod
+    public void get(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+
+    @PluginMethod
+    public void post(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+
+    @PluginMethod
+    public void put(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+
+    @PluginMethod
+    public void patch(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+
+    @PluginMethod
+    public void delete(PluginCall call) {
+        Refusal.reject(call, "CapacitorHttp");
+    }
+}

package/android/src/main/java/net/protobase/mobile/RefusedWebView.java

@@ -0,0 +1,35 @@
+package net.protobase.mobile;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+/**
+ * Takes the place of Capacitor's WebView plugin, which lets page script point the app's local server at any folder,
+ * and keep it there across launches (WebView.java:17-48). Replaced by name as RefusedHttp is. The live updater sets
+ * the server's folder on the bridge itself, not through this plugin.
+ */
+@CapacitorPlugin(name = "WebView")
+public class RefusedWebView extends Plugin {
+
+    @PluginMethod
+    public void setServerAssetPath(PluginCall call) {
+        Refusal.reject(call, "WebView");
+    }
+
+    @PluginMethod
+    public void setServerBasePath(PluginCall call) {
+        Refusal.reject(call, "WebView");
+    }
+
+    @PluginMethod
+    public void getServerBasePath(PluginCall call) {
+        Refusal.reject(call, "WebView");
+    }
+
+    @PluginMethod
+    public void persistServerBasePath(PluginCall call) {
+        Refusal.reject(call, "WebView");
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.44.4",
-  "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions; installed by the CLI on first use.",
+  "version": "0.45.0",
+  "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugin that keeps page script away from the session; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -14,8 +14,15 @@
     "node": ">=22.12.0"
   },
   "files": [
-    "LICENSE"
+    "LICENSE",
+    "android/src/main/",
+    "android/build.gradle"
   ],
+  "capacitor": {
+    "android": {
+      "src": "android"
+    }
+  },
   "publishConfig": {
     "access": "public"
   },