@protobase/mobile 0.94.32 → 0.94.34

package/ios/Sources/ProtobaseMobile/AuthRequest.swift

@@ -3,11 +3,12 @@ import Foundation
 
 /**
  * One sign-in request of ProtobaseAuth, checked in the order of Android's ProtobaseAuth.java and sent through
- * Capacitor's own request type, which refuses redirects, with the device's cookie jar. The call's options are never
- * handed to Capacitor code, so page script cannot add params, a file body, timeouts or redirects.
+ * Capacitor's own request type, which refuses redirects, with the session's cookies from SessionStore, which stay on
+ * this device. The call's options are never handed to Capacitor code, so page script cannot add params, a file body,
+ * timeouts or redirects.
  */
 enum AuthRequest {
-    static func send(_ call: CAPPluginCall, config: PluginConfig, capConfig: InstanceConfiguration?) {
+    static func send(_ call: CAPPluginCall, config: PluginConfig) {
         guard let apiOrigin = config.getString("apiOrigin"), let origin = config.getString("origin") else {
             call.reject("ProtobaseAuth has no apiOrigin or origin in its config")
             return
@@ -39,28 +40,23 @@ enum AuthRequest {
         let request = CapacitorUrlRequest(url, method: method)
         request.setRequestHeaders(headers)
         if let body { request.request.httpBody = Data(body.utf8) }
-        // The session holds its delegate, the request that refuses redirects, until it is invalidated.
-        let session = URLSession(configuration: .default, delegate: request, delegateQueue: nil)
-        let task = session.dataTask(with: request.getUrlRequest()) { data, response, error in
-            session.invalidateAndCancel()
-            if let error {
+        // The request refuses redirects as the session's delegate; the cookies come from and go to SessionStore alone.
+        SessionRequest.send(request.getUrlRequest(), store: SessionStore(keychain: DeviceKeychain()), delegate: request) { result in
+            switch result {
+            case .failure(let error as KeychainError):
+                call.reject("ProtobaseAuth cannot reach the session: \(error)")
+            case .failure(let error):
                 call.reject(error.localizedDescription, (error as NSError).domain, error, nil)
-                return
+            case .success(let (data, response)):
+                var output = HttpRequestHandler.buildResponse(data, response, responseType: .text)
+                // Set-Cookie stays native; buildResponse lower-cases the names.
+                if var answerHeaders = output["headers"] as? [String: Any] {
+                    answerHeaders.removeValue(forKey: "set-cookie")
+                    answerHeaders.removeValue(forKey: "set-cookie2")
+                    output["headers"] = answerHeaders
+                }
+                call.resolve(output)
             }
-            guard let response = response as? HTTPURLResponse else {
-                call.reject("ProtobaseAuth got no HTTP answer")
-                return
-            }
-            HttpRequestHandler.setCookiesFromResponse(response, capConfig)
-            var output = HttpRequestHandler.buildResponse(data, response, responseType: .text)
-            // Set-Cookie stays in the jar; buildResponse lower-cases the names.
-            if var answerHeaders = output["headers"] as? [String: Any] {
-                answerHeaders.removeValue(forKey: "set-cookie")
-                answerHeaders.removeValue(forKey: "set-cookie2")
-                output["headers"] = answerHeaders
-            }
-            call.resolve(output)
         }
-        task.resume()
     }
 }

package/ios/Sources/ProtobaseMobile/DevicePurge.swift

@@ -0,0 +1,28 @@
+import Capacitor
+import Foundation
+import WebKit
+
+/**
+ * Removes everything a fresh install lacks, through the APIs that own each part rather than by WebKit's folders: the
+ * device's cookie jar, the session, the app's user defaults, the live update Capacitor would load and the bundles it
+ * downloaded, at once, so the bridge reads none of it; then the WebView's data (drafts, cookies, caches), which WebKit
+ * removes in its own time, calling `done` once it has. Main thread only.
+ */
+enum DevicePurge {
+    static func run(done: @escaping () -> Void) throws {
+        HTTPCookieStorage.shared.removeCookies(since: .distantPast)
+        try SessionStore(keychain: DeviceKeychain()).save(.none)
+        if let id = Bundle.main.bundleIdentifier { UserDefaults.standard.removePersistentDomain(forName: id) }
+        try removeMissingOk { try KeyValueStore.standard.delete("serverBasePath") }
+        try removeMissingOk { try FileManager.default.removeItem(atPath: BundlesFolder.path) }
+        WKWebsiteDataStore.default().removeData(ofTypes: WKWebsiteDataStore.allWebsiteDataTypes(), modifiedSince: .distantPast, completionHandler: done)
+    }
+
+    private static func removeMissingOk(_ remove: () throws -> Void) throws {
+        do {
+            try remove()
+        } catch let error as CocoaError where error.code == .fileNoSuchFile {
+            return
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/FreshInstall.swift

@@ -0,0 +1,108 @@
+import Foundation
+import Security
+import UIKit
+
+/**
+ * What the app's AppDelegate calls first thing at launch, before the bridge reads what a live update left: an app a
+ * backup restored, even on the same iPhone, or one moved to another iPhone, starts as a fresh install, signed out with
+ * no drafts and no live update.
+ */
+public enum ProtobaseFreshInstall {
+    public static func prepare() {
+        FreshInstall.device().prepare { error in
+            fatalError("Protobase cannot tell whether this install is new: \(error)")
+        }
+    }
+}
+
+/**
+ * An install knows itself by a random mark kept twice: in a keychain item that stays on this device, and in a file that
+ * no backup holds. A restore lacks the file and another iPhone lacks the item too, so either missing, or the two
+ * differing, purges everything the app kept, then sets the mark again. The page waits at PageGate until that is done.
+ * While the device is locked, as in a launch in the background before the first unlock, both are unreadable: it reads,
+ * purges and writes nothing until the device is unlocked.
+ */
+struct FreshInstall {
+    static let service = "net.protobase.mobile.install"
+
+    let keychain: Keychain
+    let markerFile: URL
+    let gate: PageGate
+    /** Runs its closure on the main thread once protected data is available: now, or at the unlock. */
+    let whenUnlocked: (@escaping () -> Void) -> Void
+    /** Purges, throwing on what it removes at once, and calls its closure once the rest is removed too. */
+    let purge: (@escaping () -> Void) throws -> Void
+
+    static func device() -> FreshInstall {
+        let support = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0]
+        return FreshInstall(
+            keychain: DeviceKeychain(),
+            markerFile: support.appendingPathComponent("net.protobase.mobile/install"),
+            gate: .shared,
+            whenUnlocked: whenProtectedDataAvailable,
+            purge: DevicePurge.run)
+    }
+
+    func prepare(fail: @escaping (Error) -> Void) {
+        gate.close()
+        whenUnlocked {
+            do {
+                try check(fail: fail)
+            } catch {
+                fail(error)
+            }
+        }
+    }
+
+    private func check(fail: @escaping (Error) -> Void) throws {
+        if try isKnown() {
+            gate.open()
+            return
+        }
+        try purge {
+            do {
+                try mark()
+                gate.open()
+            } catch {
+                fail(error)
+            }
+        }
+    }
+
+    private func isKnown() throws -> Bool {
+        guard let kept = try keychain.read(Self.service), FileManager.default.fileExists(atPath: markerFile.path) else { return false }
+        return try Data(contentsOf: markerFile) == kept
+    }
+
+    private func mark() throws {
+        var bytes = [UInt8](repeating: 0, count: 32)
+        let status = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
+        guard status == errSecSuccess else { throw KeychainError(status: status) }
+        try keychain.write(Self.service, Data(bytes))
+        try writeMarker(Data(bytes))
+    }
+
+    /** Writes the file aside, excludes it from backup, then moves it in place, so the file never stands unexcluded. */
+    private func writeMarker(_ mark: Data) throws {
+        let folder = markerFile.deletingLastPathComponent()
+        try FileManager.default.createDirectory(at: folder, withIntermediateDirectories: true)
+        var aside = folder.appendingPathComponent(markerFile.lastPathComponent + ".new")
+        try mark.write(to: aside)
+        var values = URLResourceValues()
+        values.isExcludedFromBackup = true
+        try aside.setResourceValues(values)
+        _ = try FileManager.default.replaceItemAt(markerFile, withItemAt: aside)
+    }
+
+    private static func whenProtectedDataAvailable(_ run: @escaping () -> Void) {
+        if UIApplication.shared.isProtectedDataAvailable {
+            run()
+            return
+        }
+        var observer: NSObjectProtocol?
+        observer = NotificationCenter.default.addObserver(forName: UIApplication.protectedDataDidBecomeAvailableNotification, object: nil, queue: .main) { _ in
+            if let observer { NotificationCenter.default.removeObserver(observer) }
+            run()
+        }
+    }
+}

package/ios/Sources/ProtobaseMobile/GuardedAssetHandler.swift

@@ -6,7 +6,7 @@ import WebKit
  * Capacitor's asset handler with LocalFileGuard in front. WebKit holds the handler from the WebView's creation, before
  * any plugin loads, so `install` switches the live instance to this class, which adds no stored state; the guard is an
  * associated object. One lock covers the check and the serving, and `setAssetPath`, so the base path cannot change
- * between them.
+ * between them. Every request waits at PageGate while a fresh install's purge runs.
  */
 final class GuardedAssetHandler: WebViewAssetHandler {
     private static var guardKey: UInt8 = 0
@@ -30,6 +30,16 @@ final class GuardedAssetHandler: WebViewAssetHandler {
     }
 
     override func webView(_ webView: WKWebView, start urlSchemeTask: WKURLSchemeTask) {
+        PageGate.shared.whenOpen(ObjectIdentifier(urlSchemeTask)) { [self] in serve(webView, urlSchemeTask) }
+    }
+
+    // A request WebKit stops while it waits at the gate is never started.
+    override func webView(_ webView: WKWebView, stop urlSchemeTask: WKURLSchemeTask) {
+        if PageGate.shared.cancel(ObjectIdentifier(urlSchemeTask)) { return }
+        super.webView(webView, stop: urlSchemeTask)
+    }
+
+    private func serve(_ webView: WKWebView, _ urlSchemeTask: WKURLSchemeTask) {
         let fileGuard = fileGuard
         fileGuard.withLock {
             if fileGuard.refuses(path: urlSchemeTask.request.url?.path ?? "") {

package/ios/Sources/ProtobaseMobile/Keychain.swift

@@ -0,0 +1,58 @@
+import Foundation
+import Security
+
+/** A keychain status other than found or not found; it names the status alone, never what the item holds. */
+struct KeychainError: Error, CustomStringConvertible {
+    let status: OSStatus
+    var description: String { "the keychain answered OSStatus \(status)" }
+}
+
+/** Generic-password items by service: `read` is nil when there is none. */
+protocol Keychain {
+    func read(_ service: String) throws -> Data?
+    func write(_ service: String, _ data: Data) throws
+    func delete(_ service: String) throws
+}
+
+/**
+ * The app's own keychain, whose items stay on this device: readable after the first unlock since it started, never
+ * synchronized to iCloud Keychain, and never restored to another device from a backup or a transfer.
+ */
+struct DeviceKeychain: Keychain {
+    static func query(_ service: String) -> [String: Any] {
+        [kSecClass as String: kSecClassGenericPassword, kSecAttrService as String: service, kSecAttrSynchronizable as String: kCFBooleanFalse as Any]
+    }
+
+    static func attributes(_ data: Data) -> [String: Any] {
+        [kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, kSecValueData as String: data]
+    }
+
+    static func addQuery(_ service: String, _ data: Data) -> [String: Any] {
+        query(service).merging(attributes(data)) { $1 }
+    }
+
+    func read(_ service: String) throws -> Data? {
+        var result: AnyObject?
+        let status = SecItemCopyMatching(Self.query(service).merging([kSecReturnData as String: true]) { $1 } as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data else { throw KeychainError(status: status) }
+        return data
+    }
+
+    /**
+     * Updates the item in place, its accessibility included, so a failed write keeps the item it had; adds it only when
+     * there is none.
+     */
+    func write(_ service: String, _ data: Data) throws {
+        let updated = SecItemUpdate(Self.query(service) as CFDictionary, Self.attributes(data) as CFDictionary)
+        if updated == errSecSuccess { return }
+        guard updated == errSecItemNotFound else { throw KeychainError(status: updated) }
+        let added = SecItemAdd(Self.addQuery(service, data) as CFDictionary, nil)
+        guard added == errSecSuccess else { throw KeychainError(status: added) }
+    }
+
+    func delete(_ service: String) throws {
+        let status = SecItemDelete(Self.query(service) as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else { throw KeychainError(status: status) }
+    }
+}

package/ios/Sources/ProtobaseMobile/PageGate.swift

@@ -0,0 +1,40 @@
+import Foundation
+
+/**
+ * Holds the requests for the app's own files, its page among them, while a fresh install's purge runs, so no page script
+ * reads what it removes. Closed only by FreshInstall; main thread only, where WebKit and the purge call it.
+ */
+final class PageGate {
+    static let shared = PageGate()
+
+    private(set) var isClosed = false
+    private var waiting: [(id: ObjectIdentifier, run: () -> Void)] = []
+
+    func close() {
+        isClosed = true
+    }
+
+    /** Opens the gate, running what waits in the order it came. */
+    func open() {
+        isClosed = false
+        let runs = waiting
+        waiting = []
+        for item in runs { item.run() }
+    }
+
+    /** Runs `run` now when the gate is open, else once it opens, unless `cancel(id)` comes first. */
+    func whenOpen(_ id: ObjectIdentifier, _ run: @escaping () -> Void) {
+        guard isClosed else {
+            run()
+            return
+        }
+        waiting.append((id, run))
+    }
+
+    /** Whether `id` was waiting; it no longer is. */
+    func cancel(_ id: ObjectIdentifier) -> Bool {
+        guard let index = waiting.firstIndex(where: { $0.id == id }) else { return false }
+        waiting.remove(at: index)
+        return true
+    }
+}

package/ios/Sources/ProtobaseMobile/ProtobaseAuthPlugin.swift

@@ -23,6 +23,6 @@ public class ProtobaseAuthPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     @objc func request(_ call: CAPPluginCall) {
-        AuthRequest.send(call, config: getConfig(), capConfig: bridge?.config)
+        AuthRequest.send(call, config: getConfig())
     }
 }

package/ios/Sources/ProtobaseMobile/SessionCookies.swift

@@ -0,0 +1,68 @@
+import Foundation
+
+/**
+ * The cookies ProtobaseAuth keeps for the API, the session among them, as a value: what an answer sets and what a request
+ * sends. It takes the place of the device's cookie jar and the WebView's, which iOS saves where a backup carries them;
+ * SessionStore keeps this one on the device alone.
+ */
+struct SessionCookies: Codable, Equatable {
+    struct Cookie: Codable, Equatable {
+        var name: String
+        var value: String
+        var domain: String
+        var path: String
+        var expires: Date?
+        var secure: Bool
+    }
+
+    static let none = SessionCookies(cookies: [])
+
+    private(set) var cookies: [Cookie]
+
+    var isEmpty: Bool { cookies.isEmpty }
+
+    /**
+     * The cookies once `response` to a request for `url` arrived: each Set-Cookie replaces the cookie of its name, domain
+     * and path, and one that has expired, such as sign-out's `Max-Age=0`, removes it. `now` defaults to the time after
+     * parsing, as `Max-Age=0` expires the moment it is parsed.
+     */
+    func received(_ response: HTTPURLResponse, for url: URL, now: Date? = nil) -> SessionCookies {
+        var fields: [String: String] = [:]
+        for case let (name as String, value as String) in response.allHeaderFields { fields[name] = value }
+        let parsed = HTTPCookie.cookies(withResponseHeaderFields: fields, for: url)
+        let now = now ?? Date()
+        var kept = cookies
+        for cookie in parsed {
+            kept.removeAll { $0.name == cookie.name && $0.domain == cookie.domain && $0.path == cookie.path }
+            kept.append(Cookie(name: cookie.name, value: cookie.value, domain: cookie.domain, path: cookie.path, expires: cookie.expiresDate, secure: cookie.isSecure))
+        }
+        return SessionCookies(cookies: kept.filter { !$0.hasExpired(now) })
+    }
+
+    /** The `Cookie` header for a request to `url`, or nil when no cookie goes there. */
+    func header(for url: URL, now: Date = Date()) -> String? {
+        let sent = cookies.filter { !$0.hasExpired(now) && $0.matches(url) }
+        guard !sent.isEmpty else { return nil }
+        return sent.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
+    }
+}
+
+extension SessionCookies.Cookie {
+    func hasExpired(_ now: Date) -> Bool {
+        guard let expires else { return false }
+        return expires <= now
+    }
+
+    /** RFC 6265's domain, path and secure match. */
+    func matches(_ url: URL) -> Bool {
+        guard let host = url.host?.lowercased() else { return false }
+        if secure && url.scheme?.lowercased() != "https" { return false }
+        let domain = domain.lowercased()
+        let domainMatch = domain.hasPrefix(".") ? host == String(domain.dropFirst()) || host.hasSuffix(domain) : host == domain
+        guard domainMatch else { return false }
+        let requestPath = url.path.isEmpty ? "/" : url.path
+        if requestPath == path { return true }
+        guard requestPath.hasPrefix(path) else { return false }
+        return path.hasSuffix("/") || requestPath.dropFirst(path.count).hasPrefix("/")
+    }
+}

package/ios/Sources/ProtobaseMobile/SessionRequest.swift

@@ -0,0 +1,59 @@
+import Foundation
+
+/**
+ * Sends one sign-in request with the session's cookies from SessionStore and keeps what its answer sets there, never in
+ * the device's cookie jar or the WebView's, which a backup carries. Requests go one at a time, so two answers cannot
+ * each keep their own copy of the cookies and lose the other's.
+ */
+enum SessionRequest {
+    private static let queue = DispatchQueue(label: "net.protobase.mobile.session")
+
+    /** A session that neither reads nor saves any cookie jar. */
+    static func configuration() -> URLSessionConfiguration {
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.httpCookieStorage = nil
+        configuration.httpShouldSetCookies = false
+        configuration.httpCookieAcceptPolicy = .never
+        return configuration
+    }
+
+    static func send(
+        _ request: URLRequest,
+        store: SessionStore,
+        delegate: URLSessionDelegate?,
+        configuration: URLSessionConfiguration = configuration(),
+        completion: @escaping (Result<(Data?, HTTPURLResponse), Error>) -> Void
+    ) {
+        queue.async {
+            completion(Result { try exchange(request, store: store, delegate: delegate, configuration: configuration) })
+        }
+    }
+
+    private struct NoHttpAnswer: LocalizedError {
+        var errorDescription: String? { "ProtobaseAuth got no HTTP answer" }
+    }
+
+    private static func exchange(_ given: URLRequest, store: SessionStore, delegate: URLSessionDelegate?, configuration: URLSessionConfiguration) throws -> (Data?, HTTPURLResponse) {
+        guard let url = given.url else { throw URLError(.badURL) }
+        let cookies = try store.load()
+        var request = given
+        request.httpShouldHandleCookies = false
+        request.setValue(cookies.header(for: url), forHTTPHeaderField: "Cookie")
+
+        var outcome: (Data?, URLResponse?, Error?) = (nil, nil, nil)
+        let done = DispatchSemaphore(value: 0)
+        // The session holds its delegate until it is invalidated.
+        let session = URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil)
+        session.dataTask(with: request) { data, response, error in
+            outcome = (data, response, error)
+            done.signal()
+        }.resume()
+        done.wait()
+        session.invalidateAndCancel()
+
+        if let error = outcome.2 { throw error }
+        guard let response = outcome.1 as? HTTPURLResponse else { throw NoHttpAnswer() }
+        try store.save(cookies.received(response, for: url))
+        return (outcome.0, response)
+    }
+}

package/ios/Sources/ProtobaseMobile/SessionStore.swift

@@ -0,0 +1,30 @@
+import Foundation
+
+/**
+ * Where ProtobaseAuth keeps its cookies between launches: one keychain item that stays on this device, so no backup
+ * and no new iPhone holds the session. A keychain that cannot be read throws, and the sign-in call fails as signed out.
+ */
+struct SessionStore {
+    static let service = "net.protobase.mobile.session"
+
+    let keychain: Keychain
+
+    /** The kept cookies; none when there is no item, and an item that does not decode is deleted and counts as none. */
+    func load() throws -> SessionCookies {
+        guard let data = try keychain.read(Self.service) else { return .none }
+        guard let cookies = try? JSONDecoder().decode(SessionCookies.self, from: data) else {
+            try keychain.delete(Self.service)
+            return .none
+        }
+        return cookies
+    }
+
+    /** Keeps `cookies`, deleting the item once none are left, as after signing out. */
+    func save(_ cookies: SessionCookies) throws {
+        guard !cookies.isEmpty else {
+            try keychain.delete(Self.service)
+            return
+        }
+        try keychain.write(Self.service, try JSONEncoder().encode(cookies))
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/mobile",
-  "version": "0.94.32",
+  "version": "0.94.34",
   "description": "The Capacitor that protobase mobile builds a Protobase app's iOS and Android projects with, at fixed versions, and the native plugins that keep page script away from the session and give the iOS app its bounce; installed by the CLI on first use.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,7 @@
     "android/build.gradle",
     "icon"
   ],
-  "nativeContract": 11,
+  "nativeContract": 12,
   "capacitor": {
     "ios": {
       "src": "ios"