@protobase/mobile 0.56.0 → 0.57.0

package/ios/Sources/ProtobaseMobile/AuthHeaders.swift

@@ -0,0 +1,34 @@
+import Foundation
+
+/**
+ * The request headers ProtobaseAuth sends of those page script gives, as Android's AuthHeaders.java keeps them: the
+ * string-valued ones, without the Fetch spec's forbidden request header names, which a page's Request never carries.
+ * So page script cannot set the cookie, the origin, or the host a shared ingress routes by, nor override the method.
+ * A name that is no HTTP token, or a value holding CR, LF or NUL, is dropped too.
+ */
+enum AuthHeaders {
+    private static let forbidden: Set<String> = [
+        "accept-charset", "accept-encoding", "access-control-request-headers", "access-control-request-method",
+        "connection", "content-length", "cookie", "cookie2", "date", "dnt", "expect", "host", "keep-alive", "origin",
+        "referer", "set-cookie", "te", "trailer", "transfer-encoding", "upgrade", "via", "x-http-method",
+        "x-http-method-override", "x-method-override",
+    ]
+
+    // RFC 9110's tchar.
+    private static let token = CharacterSet(charactersIn: "!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+
+    static func allowed(_ given: [String: Any]?) -> [String: String] {
+        var headers: [String: String] = [:]
+        for (name, value) in given ?? [:] {
+            guard let text = value as? String, !isForbidden(name), !text.contains(where: { "\r\n\0".contains($0) }) else { continue }
+            headers[name] = text
+        }
+        return headers
+    }
+
+    private static func isForbidden(_ name: String) -> Bool {
+        let lower = name.lowercased()
+        let isToken = !name.isEmpty && name.unicodeScalars.allSatisfy { token.contains($0) }
+        return !isToken || forbidden.contains(lower) || lower.hasPrefix("proxy-") || lower.hasPrefix("sec-")
+    }
+}

package/ios/Sources/ProtobaseMobile/AuthRequest.swift

@@ -0,0 +1,66 @@
+import Capacitor
+import Foundation
+
+/**
+ * One sign-in request of ProtobaseAuth, checked in the order of Android's ProtobaseAuth.java and sent through
+ * Capacitor's own request type, which refuses redirects, with the device's cookie jar. The call's options are never
+ * handed to Capacitor code, so page script cannot add params, a file body, timeouts or redirects.
+ */
+enum AuthRequest {
+    static func send(_ call: CAPPluginCall, config: PluginConfig, capConfig: InstanceConfiguration?) {
+        guard let apiOrigin = config.getString("apiOrigin"), let origin = config.getString("origin") else {
+            call.reject("ProtobaseAuth has no apiOrigin or origin in its config")
+            return
+        }
+        guard let text = call.options["url"] as? String, let url = AuthUrl.allowed(text, apiOrigin: apiOrigin) else {
+            call.reject("ProtobaseAuth calls \(apiOrigin)\(AuthUrl.authBasePath)/ only")
+            return
+        }
+        let method = (call.getString("method") ?? "GET").uppercased()
+        // All Better Auth serves.
+        guard method == "GET" || method == "POST" else {
+            call.reject("ProtobaseAuth sends GET or POST only, not \(method)")
+            return
+        }
+        let data = call.options["data"]
+        guard data == nil || data is String else {
+            call.reject("ProtobaseAuth sends a text body only")
+            return
+        }
+        let body = data as? String
+        // URLSession fails a GET with a body, and the shell never sends one.
+        guard body == nil || method == "POST" else {
+            call.reject("ProtobaseAuth sends a body with POST only")
+            return
+        }
+        var headers = AuthHeaders.allowed(call.getObject("headers"))
+        headers["Origin"] = origin
+
+        let request = CapacitorUrlRequest(url, method: method)
+        request.setRequestHeaders(headers)
+        if let body { request.request.httpBody = Data(body.utf8) }
+        // The session holds its delegate, the request that refuses redirects, until it is invalidated.
+        let session = URLSession(configuration: .default, delegate: request, delegateQueue: nil)
+        let task = session.dataTask(with: request.getUrlRequest()) { data, response, error in
+            session.invalidateAndCancel()
+            if let error {
+                call.reject(error.localizedDescription, (error as NSError).domain, error, nil)
+                return
+            }
+            guard let response = response as? HTTPURLResponse else {
+                call.reject("ProtobaseAuth got no HTTP answer")
+                return
+            }
+            HttpRequestHandler.setCookiesFromResponse(response, capConfig)
+            var output = HttpRequestHandler.buildResponse(data, response, responseType: .text)
+            // Set-Cookie stays in the jar; buildResponse lower-cases the names.
+            if var answerHeaders = output["headers"] as? [String: Any] {
+                answerHeaders.removeValue(forKey: "set-cookie")
+                answerHeaders.removeValue(forKey: "set-cookie2")
+                output["headers"] = answerHeaders
+            }
+            call.resolve(output)
+        }
+        task.resume()
+    }
+}

package/ios/Sources/ProtobaseMobile/AuthUrl.swift

@@ -0,0 +1,36 @@
+import Foundation
+
+/** The sign-in addresses ProtobaseAuth calls: `<apiOrigin>/api/auth/...`, as Android's AuthUrl.java allows them. */
+enum AuthUrl {
+    /** Where Better Auth's endpoints are served, as packages/schema/src/auth-base-path.ts names it. */
+    static let authBasePath = "/api/auth"
+
+    private struct Parts {
+        let scheme: String
+        let host: String
+        let port: Int
+        let path: String
+        let hasUser: Bool
+    }
+
+    private static func parse(_ text: String) -> Parts? {
+        guard let url = URL(string: text), let parts = URLComponents(url: url, resolvingAgainstBaseURL: false) else { return nil }
+        let scheme = (parts.scheme ?? "").lowercased()
+        guard scheme == "http" || scheme == "https", let host = parts.percentEncodedHost, !host.isEmpty else { return nil }
+        let port = parts.port ?? (scheme == "https" ? 443 : 80)
+        let hasUser = parts.percentEncodedUser != nil || parts.percentEncodedPassword != nil
+        return Parts(scheme: scheme, host: host.lowercased(), port: port, path: parts.percentEncodedPath, hasUser: hasUser)
+    }
+
+    /** The URL to send when `text` is allowed, so the URL checked is the URL sent; `nil` otherwise. */
+    static func allowed(_ text: String, apiOrigin: String) -> URL? {
+        guard let origin = parse(apiOrigin), let target = parse(text), origin.path.isEmpty, !target.hasUser else { return nil }
+        guard target.scheme == origin.scheme, target.host == origin.host, target.port == origin.port else { return nil }
+        let path = target.path
+        guard path.hasPrefix(authBasePath + "/"), !path.contains("\\") else { return nil }
+        let lower = path.lowercased()
+        guard !["%2e", "%2f", "%5c"].contains(where: { lower.contains($0) }) else { return nil }
+        guard !path.split(separator: "/", omittingEmptySubsequences: false).contains(where: { $0 == "." || $0 == ".." }) else { return nil }
+        return URL(string: text)
+    }
+}

package/ios/Sources/ProtobaseMobile/CookiePromptFilter.swift

@@ -0,0 +1,48 @@
+import WebKit
+
+/**
+ * Stands in front of the WebView's UI delegate, Capacitor's WebViewDelegationHandler, which answers a JSON `prompt` of
+ * type `CapacitorCookies.set` or `CapacitorCookies.get` without a dialog, whether CapacitorCookies is enabled or not,
+ * and crashes on a `set` without its fields. Those prompts answer `null`; everything else goes to Capacitor's delegate.
+ */
+final class CookiePromptFilter: NSObject, WKUIDelegate {
+    private static let refusedTypes: Set<String> = ["CapacitorCookies.set", "CapacitorCookies.get"]
+
+    private let original: NSObject & WKUIDelegate
+
+    private init(original: NSObject & WKUIDelegate) {
+        self.original = original
+    }
+
+    /** Puts the filter in front; the caller keeps it, as the WebView holds its UI delegate weakly. */
+    static func install(on webView: WKWebView) -> CookiePromptFilter {
+        guard let original = webView.uiDelegate as? NSObject & WKUIDelegate else { fatalError("ProtobaseAuth needs Capacitor's UI delegate on the WebView") }
+        let filter = CookiePromptFilter(original: original)
+        webView.uiDelegate = filter
+        return filter
+    }
+
+    func webView(_ webView: WKWebView, runJavaScriptTextInputPanelWithPrompt prompt: String, defaultText: String?, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (String?) -> Void) {
+        // Parsed as WebViewDelegationHandler.swift parses it.
+        if let data = prompt.data(using: .utf8),
+           let payload = try? JSONSerialization.jsonObject(with: data, options: .fragmentsAllowed) as? [String: AnyObject],
+           let type = payload["type"] as? String,
+           Self.refusedTypes.contains(type) {
+            completionHandler(nil)
+            return
+        }
+        guard let forward = original.webView(_:runJavaScriptTextInputPanelWithPrompt:defaultText:initiatedByFrame:completionHandler:) else {
+            completionHandler(nil)
+            return
+        }
+        forward(webView, prompt, defaultText, frame, completionHandler)
+    }
+
+    override func responds(to aSelector: Selector!) -> Bool {
+        super.responds(to: aSelector) || original.responds(to: aSelector)
+    }
+
+    override func forwardingTarget(for aSelector: Selector!) -> Any? {
+        original
+    }
+}

package/ios/Sources/ProtobaseMobile/GuardedAssetHandler.swift

@@ -0,0 +1,50 @@
+import Capacitor
+import ObjectiveC
+import WebKit
+
+/**
+ * Capacitor's asset handler with LocalFileGuard in front. WebKit holds the handler from the WebView's creation, before
+ * any plugin loads, so `install` switches the live instance to this class, which adds no stored state; the guard is an
+ * associated object. One lock covers the check and the serving, and `setAssetPath`, so the base path cannot change
+ * between them.
+ */
+final class GuardedAssetHandler: WebViewAssetHandler {
+    private static var guardKey: UInt8 = 0
+
+    static func install(on handler: WebViewAssetHandler, _ fileGuard: LocalFileGuard) {
+        objc_setAssociatedObject(handler, &guardKey, fileGuard, .OBJC_ASSOCIATION_RETAIN)
+        object_setClass(handler, GuardedAssetHandler.self)
+    }
+
+    private var fileGuard: LocalFileGuard {
+        guard let fileGuard = objc_getAssociatedObject(self, &Self.guardKey) as? LocalFileGuard else { fatalError("GuardedAssetHandler has no LocalFileGuard") }
+        return fileGuard
+    }
+
+    override func setAssetPath(_ assetPath: String) {
+        let fileGuard = fileGuard
+        fileGuard.withLock {
+            fileGuard.basePath = assetPath
+            super.setAssetPath(assetPath)
+        }
+    }
+
+    override func webView(_ webView: WKWebView, start urlSchemeTask: WKURLSchemeTask) {
+        let fileGuard = fileGuard
+        fileGuard.withLock {
+            if fileGuard.refuses(path: urlSchemeTask.request.url?.path ?? "") {
+                forbid(urlSchemeTask)
+                return
+            }
+            super.webView(webView, start: urlSchemeTask)
+        }
+    }
+
+    // An empty 403, as Android's LocalServerGuard answers.
+    private func forbid(_ urlSchemeTask: WKURLSchemeTask) {
+        let url = urlSchemeTask.request.url ?? URL(fileURLWithPath: "/")
+        urlSchemeTask.didReceive(HTTPURLResponse(url: url, statusCode: 403, httpVersion: nil, headerFields: [:])!)
+        urlSchemeTask.didReceive(Data())
+        urlSchemeTask.didFinish()
+    }
+}

package/ios/Sources/ProtobaseMobile/LocalFileGuard.swift

@@ -0,0 +1,59 @@
+import Capacitor
+import Foundation
+
+/**
+ * Decides which `capacitor://localhost` paths the app's asset handler may serve to page script: none of the local file
+ * or native HTTP routes, no `..`, and from a base path outside the app bundle only files that are really inside the
+ * live updater's bundles folder. Each check runs on the decoded path, the one the asset handler opens.
+ */
+final class LocalFileGuard {
+    // Where the live updater unzips bundles (capacitor-live-update's LiveUpdate.swift) and Capacitor serves a persisted
+    // server base path from (CAPBridgeViewController.swift).
+    private static let bundlesFolder = "Library/NoCloud/ionic_built_snapshots"
+    private static let refusedPrefixes = [
+        CapacitorBridge.fileStartIdentifier,
+        CapacitorBridge.httpInterceptorStartIdentifier,
+        CapacitorBridge.httpsInterceptorStartIdentifier,
+    ]
+
+    private let lock = NSLock()
+    private let appBundle: String?
+    // Resolved once: with no bundles folder at launch, nothing outside the app bundle is served.
+    private let bundles: String?
+    var basePath: String
+
+    init(basePath: String) {
+        self.basePath = basePath
+        appBundle = Self.realPath(Bundle.main.bundlePath)
+        bundles = Self.realPath(NSHomeDirectory() + "/" + Self.bundlesFolder)
+    }
+
+    func withLock<T>(_ body: () throws -> T) rethrows -> T {
+        lock.lock()
+        defer { lock.unlock() }
+        return try body()
+    }
+
+    func refuses(path: String) -> Bool {
+        if Self.refusedPrefixes.contains(where: { path.hasPrefix($0) }) { return true }
+        if path.contains("\0") || path.split(separator: "/", omittingEmptySubsequences: false).contains("..") { return true }
+        guard let base = Self.realPath(basePath) else { return true }
+        if let appBundle, Self.isInside(base, appBundle) { return false }
+        guard let bundles else { return true }
+        // The file the asset handler opens, by Capacitor's own routing.
+        var router = CapacitorRouter()
+        router.basePath = basePath
+        guard let file = Self.realPath(router.route(for: path)) else { return true }
+        return !Self.isInside(file, bundles)
+    }
+
+    private static func isInside(_ path: String, _ folder: String) -> Bool {
+        path == folder || path.hasPrefix(folder.hasSuffix("/") ? folder : folder + "/")
+    }
+
+    private static func realPath(_ path: String) -> String? {
+        guard let resolved = realpath(path, nil) else { return nil }
+        defer { free(resolved) }
+        return String(cString: resolved)
+    }
+}

package/ios/Sources/ProtobaseMobile/PageScriptFilter.swift

@@ -0,0 +1,70 @@
+import Capacitor
+import WebKit
+
+/**
+ * Stands in front of Capacitor's `bridge` script message handler, the way page script calls native code. It drops
+ * messages from any frame but the main one of the app's own origin, as Capacitor Android's MessageHandler does, and
+ * refuses `CapacitorHttp`, `CapacitorCookies` and `WebView`, which hand over or plant the session, and any plugin id
+ * the bridge has not loaded: Capacitor would otherwise load a plugin by class name, such as `CAPHttpPlugin`.
+ */
+final class PageScriptFilter: NSObject, WKScriptMessageHandler {
+    private static let handlerName = "bridge"
+    private static let refusedPlugins: Set<String> = ["CapacitorHttp", "CapacitorCookies", "WebView"]
+
+    private weak var bridge: CapacitorBridge?
+
+    private init(bridge: CapacitorBridge) {
+        self.bridge = bridge
+    }
+
+    static func install(on bridge: CapacitorBridge) {
+        let contentController = bridge.webViewDelegationHandler.contentController
+        contentController.removeScriptMessageHandler(forName: handlerName)
+        contentController.add(PageScriptFilter(bridge: bridge), name: handlerName)
+    }
+
+    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
+        guard let bridge, message.frameInfo.isMainFrame, isAppOrigin(message.frameInfo.securityOrigin, bridge.config.serverURL) else { return }
+        guard let body = message.body as? [String: Any], let type = body["type"] as? String else { return }
+        if type == "js.error" || type == "cordova" {
+            bridge.webViewDelegationHandler.userContentController(userContentController, didReceive: message)
+            return
+        }
+        guard type == "message" else { return }
+        let pluginId = body["pluginId"] as? String ?? ""
+        if !Self.refusedPlugins.contains(pluginId), bridge.plugin(withName: pluginId) != nil {
+            bridge.webViewDelegationHandler.userContentController(userContentController, didReceive: message)
+            return
+        }
+        refuse(body, pluginId: pluginId, in: message.webView)
+    }
+
+    // Rejects the call's promise, as Capacitor answers a failed call (CapacitorBridge.swift, toJs).
+    private func refuse(_ body: [String: Any], pluginId: String, in webView: WKWebView?) {
+        guard let callbackId = body["callbackId"] as? String else { return }
+        let answer: [String: Any] = [
+            "callbackId": callbackId,
+            "pluginId": pluginId,
+            "methodName": body["methodName"] as? String ?? "",
+            "success": false,
+            "error": ["message": "\(pluginId) is not available to page script in a Protobase app"],
+        ]
+        guard let json = try? JSONSerialization.data(withJSONObject: answer), let text = String(data: json, encoding: .utf8) else { return }
+        webView?.evaluateJavaScript("window.Capacitor.fromNative(\(text))")
+    }
+
+    private func isAppOrigin(_ origin: WKSecurityOrigin, _ serverURL: URL) -> Bool {
+        let scheme = (serverURL.scheme ?? "").lowercased()
+        let serverPort = serverURL.port ?? defaultPort(scheme)
+        let originPort = origin.port == 0 ? defaultPort(origin.protocol.lowercased()) : origin.port
+        return origin.protocol.lowercased() == scheme && origin.host.lowercased() == (serverURL.host ?? "").lowercased() && originPort == serverPort
+    }
+
+    private func defaultPort(_ scheme: String) -> Int {
+        switch scheme {
+        case "http": return 80
+        case "https": return 443
+        default: return 0
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/ProtobaseAuthPlugin.swift

@@ -0,0 +1,28 @@
+import Capacitor
+import WebKit
+
+/**
+ * The shell's sign-in requests (AuthRequest), and what keeps page script away from the session: it filters the
+ * bridge's script messages and cookie prompts, and guards the asset handler's local file routes. The bridge loads
+ * plugins once the WebView, its delegates and its scheme handler exist and before any page script runs.
+ * `apiOrigin` and `origin` come from capacitor.config.json, which the CLI writes outside the app's web part.
+ */
+@objc(ProtobaseAuthPlugin)
+public class ProtobaseAuthPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "ProtobaseAuthPlugin"
+    public let jsName = "ProtobaseAuth"
+    public let pluginMethods: [CAPPluginMethod] = [CAPPluginMethod(name: "request", returnType: CAPPluginReturnPromise)]
+
+    private var promptFilter: CookiePromptFilter?
+
+    override public func load() {
+        guard let bridge = bridge as? CapacitorBridge, let webView = bridge.webView else { fatalError("ProtobaseAuth needs Capacitor's own bridge and WebView") }
+        GuardedAssetHandler.install(on: bridge.webViewAssetHandler, LocalFileGuard(basePath: bridge.config.appLocation.path))
+        PageScriptFilter.install(on: bridge)
+        promptFilter = CookiePromptFilter.install(on: webView)
+    }
+
+    @objc func request(_ call: CAPPluginCall) {
+        AuthRequest.send(call, config: getConfig(), capConfig: bridge?.config)
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugins that keep page script away from the session and give the iOS app its bounce; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {