@saltcorn/mobile-app 1.6.3-beta.1 → 1.7.0-alpha.1

package/src/helpers/api.js

@@ -1,7 +1,5 @@
 /*global saltcorn, splashConfig*/
 
-import axios from "axios";
-import { jwtDecode } from "jwt-decode";
 import { router } from "../routing/index";
 import { replaceIframe, clearHistory } from "./navigation";
 
@@ -19,49 +17,83 @@ export async function apiCall({
       ? saltcorn.data.state.getState().mobileConfig
       : splashConfig;
   const serverPath = config.server_path;
-  const url = `${serverPath}${path}`;
+  let url = `${serverPath}${path}`;
+  if (params) {
+    const qs = new URLSearchParams(params).toString();
+    if (qs) url += `${url.includes("?") ? "&" : "?"}${qs}`;
+  }
   const headers = {
     "X-Requested-With": "XMLHttpRequest",
     "X-Saltcorn-Client": "mobile-app",
     ...(additionalHeaders || {}),
   };
   if (config.tenantAppName) headers["X-Saltcorn-App"] = config.tenantAppName;
-  const token = config.jwt;
-  if (token) {
-    try {
-      const decoded = jwtDecode(token);
-      if (decoded.exp && decoded.exp < Date.now() / 1000 && typeof saltcorn !== "undefined" && !path.startsWith("/auth/")) {
-        const mobileConfig = saltcorn.data.state.getState().mobileConfig;
-        mobileConfig.jwt = undefined;
-        await saltcorn.data.db.deleteWhere("jwt_table");
-        clearHistory();
-        const page = await router.resolve({
-          pathname: "get/auth/login",
-          alerts: [
-            { type: "warning", msg: "Your session has expired, please log in again." },
-          ],
-        });
-        await replaceIframe(page.content);
-        return;
-      }
-    } catch {
-      // malformed token, let the request proceed and fail naturally
-    }
-    headers.Authorization = `jwt ${token}`;
+  // The session cookie is attached automatically by the WebView (credentials: "include").
+  // The CSRF token has to be sent explicitly, same as the web client does.
+  if (config.csrfToken) headers["CSRF-Token"] = config.csrfToken;
+  const fetchOptions = { method, headers, credentials: "include" };
+  if (body !== undefined) {
+    fetchOptions.body = JSON.stringify(body);
+    headers["Content-Type"] = "application/json";
   }
+  const controller = timeout ? new AbortController() : null;
+  const timeoutId = controller
+    ? setTimeout(() => controller.abort(), timeout)
+    : null;
+  if (controller) fetchOptions.signal = controller.signal;
   try {
-    const result = await axios({
-      url: url,
-      method,
-      params,
-      headers,
-      responseType: responseType ? responseType : "json",
-      data: body,
-      timeout: timeout ? timeout : 0,
-    });
-    return result;
+    const res = await fetch(url, fetchOptions);
+    if (!res.ok) {
+      const error = new Error(`Request failed with status code ${res.status}`);
+      error.response = { status: res.status };
+      throw error;
+    }
+    let data;
+    if (responseType === "blob") data = await res.blob();
+    else if (responseType === "text") data = await res.text();
+    else {
+      // A redirected error page still counts as a 200 here, so parse by
+      // hand to give a clear error instead of a cryptic JSON parse failure.
+      const text = await res.text();
+      try {
+        data = text ? JSON.parse(text) : undefined;
+      } catch {
+        const error = new Error(
+          `Expected JSON but got ${
+            res.headers.get("content-type") || "unknown content-type"
+          } (status ${res.status}, url ${res.url})`
+        );
+        error.response = { status: res.status };
+        throw error;
+      }
+    }
+    return { data, status: res.status };
   } catch (error) {
+    if (
+      error.response?.status === 401 &&
+      typeof saltcorn !== "undefined" &&
+      !path.startsWith("/auth/")
+    ) {
+      const mobileConfig = saltcorn.data.state.getState().mobileConfig;
+      mobileConfig.csrfToken = undefined;
+      mobileConfig.hasSession = false;
+      await saltcorn.data.db.deleteWhere("session_table");
+      clearHistory();
+      const page = await router.resolve({
+        pathname: "get/auth/login",
+        alerts: [
+          {
+            type: "warning",
+            msg: "Your session has expired, please log in again.",
+          },
+        ],
+      });
+      await replaceIframe(page.content);
+      return;
+    }
     error.message = `Unable to call ${method} ${url}:\n${error.message}`;
     throw error;
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
   }
 }

package/src/helpers/auth.js

@@ -1,6 +1,5 @@
 /*global saltcorn*/
 
-import { jwtDecode } from "jwt-decode";
 import i18next from "i18next";
 import { apiCall } from "./api";
 import { router } from "../routing/index";
@@ -15,50 +14,57 @@ import {
 } from "./common";
 
 /**
- * internal helper for the normal login/signup and public login
+ * fetches a CSRF token and caches it in mobileConfig.csrfToken.
+ * Call again after every login/logout, since both reset it.
+ */
+export async function refreshCsrfToken() {
+  const response = await apiCall({ method: "GET", path: "/auth/csrf-token" });
+  const config = saltcorn.data.state.getState().mobileConfig;
+  config.csrfToken = response?.data?.csrfToken;
+  return config.csrfToken;
+}
+
+/**
+ * internal helper for the normal login/signup
  * @param {any} param0
  * @returns
  */
-async function loginRequest({ email, password, isSignup, isPublic }) {
-  const opts = isPublic
+async function loginRequest({ email, password, isSignup, code }) {
+  await refreshCsrfToken();
+  const opts = code
     ? {
-        method: "GET",
-        path: "/auth/login-with/jwt",
+        method: "POST",
+        path: "/auth/session-from-code",
+        body: { code },
       }
     : isSignup
     ? {
         method: "POST",
         path: "/auth/signup",
-        body: {
-          email,
-          password,
-        },
+        body: { email, password },
       }
     : {
         method: "POST",
-        path: "/auth/login-with/jwt",
-        body: {
-          email,
-          password,
-        },
+        path: "/auth/login-with/session",
+        body: { email, password },
       };
   const response = await apiCall(opts);
   return response.data;
 }
 
 /**
- * internal helper to process a JWT token
- * @param {string} tokenStr
+ * internal helper to process a successful session login response
+ * ({ success: true, user }) and persist it locally
  */
-const handleToken = async (tokenStr, config) => {
-  const token = jwtDecode(tokenStr);
-  const user = token.user;
+const handleSessionLogin = async (user, config) => {
   config.user = user;
   config.isPublicUser = false;
   config.isOfflineMode = false;
+  config.hasSession = true;
   await insertUser(user);
-  await setJwt(tokenStr);
-  config.jwt = tokenStr;
+  // login regenerated the session, so the previously fetched token is stale
+  await refreshCsrfToken();
+  await persistSession(config);
   i18next.changeLanguage(user.language);
 };
 
@@ -101,22 +107,22 @@ const getEntryPoint = (config) => {
 };
 
 /**
- * For normal login/signup email and password are used
- * When called from auth provider login (see google-auth plugin), token is used
+ * Normal login/signup use email and password. An OAuth-provider login
+ * (e.g. google-auth's finishLogin) instead passes the short-lived code
+ * its deep-link callback was handed, which stands in for a session here.
  * @param {*} param0
  */
 export async function login({ email, password, isSignup, token }) {
-  const loginResult = !token
-    ? await loginRequest({
-        email,
-        password,
-        isSignup,
-      })
-    : token;
-  if (typeof loginResult === "string") {
+  const loginResult = await loginRequest({
+    email,
+    password,
+    isSignup,
+    code: token,
+  });
+  if (loginResult?.success && loginResult?.user) {
     const alerts = [];
     const config = saltcorn.data.state.getState().mobileConfig;
-    await handleToken(loginResult, config);
+    await handleSessionLogin(loginResult.user, config);
     if (config.allowOfflineMode) alerts.push(await initialSync(config));
     await tryInitPush(config);
     await tryInitBackgroundSync(config);
@@ -129,14 +135,31 @@ export async function login({ email, password, isSignup, token }) {
     });
 
     // open first page
-    const entryPoint = getEntryPoint(config);
-    addRoute({ route: entryPoint, query: undefined });
-    const page = await router.resolve({
-      pathname: entryPoint,
-      fullWrap: true,
-      alerts,
-    });
-    if (page.content) await replaceIframe(page.content, page.isFile);
+    try {
+      const entryPoint = getEntryPoint(config);
+      addRoute({ route: entryPoint, query: undefined });
+      const page = await router.resolve({
+        pathname: entryPoint,
+        fullWrap: true,
+        alerts,
+      });
+      if (page.content) await replaceIframe(page.content, page.isFile);
+    } catch (error) {
+      // Logged in fine, but this user can't open the app's entry point
+      // (e.g. its role doesn't allow it) - say so instead of leaving
+      // them stuck on the login page with no explanation.
+      showToasts([
+        {
+          type: "error",
+          msg: i18next.t("Logged in as %s, but unable to open the app: %s", {
+            postProcess: "sprintf",
+            sprintf: [config.user.email, error.message || "unknown error"],
+          }),
+        },
+      ]);
+    }
+  } else if (loginResult?.error) {
+    showToasts([{ type: "error", msg: loginResult.error }]);
   } else if (loginResult?.alerts) {
     showToasts(loginResult?.alerts);
   } else {
@@ -146,44 +169,39 @@ export async function login({ email, password, isSignup, token }) {
 
 export async function publicLogin(entryPoint) {
   try {
-    const loginResult = await loginRequest({ isPublic: true });
-    if (typeof loginResult === "string") {
-      const config = saltcorn.data.state.getState().mobileConfig;
-      config.user = {
-        role_id: 100,
-        email: "public",
-        language: "en",
-      };
-      config.isPublicUser = true;
-      await setJwt(loginResult);
-      config.jwt = loginResult;
-      i18next.changeLanguage(config.user.language);
-      addRoute({
-        route: entryPoint,
-        query: undefined,
-      });
-      const page = await router.resolve({
-        pathname: entryPoint,
-        fullWrap: true,
-        alerts: [
-          {
-            type: "success",
-            msg: i18next.t("Welcome to %s!", {
-              postProcess: "sprintf",
-              sprintf: [
-                saltcorn.data.state.getState().getConfig("site_name") ||
-                  "Saltcorn",
-              ],
-            }),
-          },
-        ],
-      });
-      if (page.content) await replaceIframe(page.content, page.isFile);
-    } else if (loginResult?.alerts) {
-      showToasts(loginResult?.alerts);
-    } else {
-      throw new Error("The login failed.");
-    }
+    const config = saltcorn.data.state.getState().mobileConfig;
+    // no login needed for public, but a CSRF token is still cached upfront.
+    await refreshCsrfToken();
+    config.user = {
+      role_id: 100,
+      email: "public",
+      language: "en",
+    };
+    config.isPublicUser = true;
+    config.hasSession = true;
+    await persistSession(config);
+    i18next.changeLanguage(config.user.language);
+    addRoute({
+      route: entryPoint,
+      query: undefined,
+    });
+    const page = await router.resolve({
+      pathname: entryPoint,
+      fullWrap: true,
+      alerts: [
+        {
+          type: "success",
+          msg: i18next.t("Welcome to %s!", {
+            postProcess: "sprintf",
+            sprintf: [
+              saltcorn.data.state.getState().getConfig("site_name") ||
+                "Saltcorn",
+            ],
+          }),
+        },
+      ],
+    });
+    if (page.content) await replaceIframe(page.content, page.isFile);
   } catch (error) {
     console.error(error);
     showToasts([
@@ -203,9 +221,11 @@ export async function logout() {
     await tryStopBackgroundSync();
     const response = await apiCall({ method: "GET", path: "/auth/logout" });
     if (response.data.success) {
-      await removeJwt();
+      await clearSession();
       clearHistory();
-      config.jwt = undefined;
+      config.csrfToken = undefined;
+      config.hasSession = false;
+      config.isPublicUser = false;
       const page = await router.resolve({
         pathname: "get/auth/login",
         entryView: config.entry_point,
@@ -232,43 +252,34 @@ export async function insertUser({ id, email, role_id, language }) {
   );
 }
 
-export async function removeJwt() {
-  await saltcorn.data.db.deleteWhere("jwt_table");
+export async function clearSession() {
+  await saltcorn.data.db.deleteWhere("session_table");
 }
 
-export async function setJwt(jwt) {
-  await removeJwt();
-  await saltcorn.data.db.insert("jwt_table", { jwt: jwt });
-}
-
-async function renewJwt() {
-  try {
-    const response = await apiCall({
-      method: "POST",
-      path: "/auth/renew-jwt",
-    });
-    if (typeof response.data === "string") {
-      const config = saltcorn.data.state.getState().mobileConfig;
-      await setJwt(response.data);
-      config.jwt = response.data;
-    }
-  } catch (e) {
-    console.error("JWT renewal failed:", e.message);
-  }
+/**
+ * persists the current mobileConfig session state (csrf token, user,
+ * public/authenticated flag) so the app can restore it at next boot
+ * without a network call (used e.g. when starting offline).
+ */
+export async function persistSession(config) {
+  await clearSession();
+  await saltcorn.data.db.insert("session_table", {
+    csrfToken: config.csrfToken,
+    userJson: config.isPublicUser ? null : JSON.stringify(config.user),
+    isPublicUser: !!config.isPublicUser,
+  });
 }
 
-export async function checkJWT(jwtStr) {
-  if (jwtStr && jwtStr !== "undefined") {
-    const response = await apiCall({
-      method: "GET",
-      path: "/auth/authenticated",
-      timeout: 10000,
-    });
-    if (!response.data.authenticated) return false;
-    const decoded = jwtDecode(jwtStr);
-    if (decoded.exp && decoded.exp - Date.now() / 1000 < 7 * 24 * 3600) {
-      await renewJwt();
-    }
-    return true;
-  } else return false;
+/**
+ * checks with the server whether the current session cookie is still valid,
+ * and refreshes the cached CSRF token (its secret lives in the session, so
+ * it's fine to keep reusing the same token as long as the session is alive).
+ */
+export async function checkSession() {
+  const response = await apiCall({
+    method: "GET",
+    path: "/auth/authenticated",
+    timeout: 10000,
+  });
+  return !!response?.data?.authenticated;
 }

package/src/helpers/background_tasks.js

@@ -0,0 +1,47 @@
+/*global saltcorn*/
+
+import { Capacitor } from "@capacitor/core";
+import { apiCall } from "./api.js";
+import { sync } from "./offline_mode.js";
+
+/**
+ * Perform one background sync pass.
+ */
+export async function performSync() {
+  console.log("Background sync starting:", new Date().toISOString());
+  await sync(true);
+  console.log("Background sync finished:", new Date().toISOString());
+}
+
+/**
+ * Re-register the push sync subscription with the server.
+ */
+export async function performHeartbeat() {
+  const config = saltcorn.data.state.getState().mobileConfig;
+  if (!config?.pushSync || !config?.pushConfiguration) {
+    console.log("Push sync heartbeat: skipping (push sync not active)");
+    return;
+  }
+  const { token, deviceId } = config.pushConfiguration;
+  const platform = Capacitor.getPlatform();
+  console.log("Push sync heartbeat: re-registering subscription");
+  try {
+    const response = await apiCall({
+      method: "POST",
+      path: "/sync/push_subscribe",
+      body: {
+        token,
+        deviceId,
+        platform,
+        synchedTables: config.synchedTables,
+        apnsEnvironment: config.apnsEnvironment,
+      },
+    });
+    const data = response.data;
+    if (data.success === "ok")
+      console.log("Push sync heartbeat: subscription refreshed");
+    else console.error("Push sync heartbeat: server error", data);
+  } catch (e) {
+    console.error("Push sync heartbeat error:", e);
+  }
+}

package/src/helpers/common.js

@@ -1,6 +1,7 @@
 /*global saltcorn, $*/
 
 import { apiCall } from "./api";
+import { Capacitor } from "@capacitor/core";
 import { Camera, CameraResultType } from "@capacitor/camera";
 import { ScreenOrientation } from "@capacitor/screen-orientation";
 import { SendIntent } from "send-intent";
@@ -224,7 +225,19 @@ export async function tryInitPush(config) {
     try {
       await initPushNotifications();
       if (saltcorn.data.utils.isPushEnabled(config.user)) addPusNotifyHandler();
-      if (config.pushSync) addPushSyncHandler();
+      if (config.pushSync) {
+        addPushSyncHandler();
+        if (Capacitor.getPlatform() === "ios") {
+          try {
+            const { initIosSilentPushListener } = await import(
+              "../helpers/ios_silent_push.js"
+            );
+            await initIosSilentPushListener();
+          } catch (e) {
+            console.log("iOS silent push not available:", e);
+          }
+        }
+      }
     } catch (error) {
       console.error("Error initializing push notifications:", error);
     }
@@ -234,21 +247,26 @@ export async function tryInitPush(config) {
 }
 
 /**
- * init background sync, if available
+ * init background tasks (sync and/or push-sync heartbeat), if available
  */
 export async function tryInitBackgroundSync(config) {
+  if (
+    !(config.syncInterval && config.syncInterval > 0) &&
+    !(config.pushSyncHeartbeatInterval && config.pushSyncHeartbeatInterval > 0)
+  )
+    return;
   try {
-    const { startPeriodicBackgroundSync } = await import(
-      "../helpers/background_sync.js"
-    );
+    const { initBackground } = await import("../helpers/background.js");
     try {
-      if (config.syncInterval && config.syncInterval > 0)
-        await startPeriodicBackgroundSync(config.syncInterval);
+      await initBackground(
+        config.syncInterval,
+        config.pushSyncHeartbeatInterval
+      );
     } catch (error) {
-      console.error("Error initializing background sync:", error);
+      console.error("Error initializing background tasks:", error);
     }
   } catch (error) {
-    console.log("Background sync module not available:", error);
+    console.log("Background module not available:", error);
   }
 }
 
@@ -271,19 +289,17 @@ export async function tryUnregisterPush() {
 }
 
 /**
- * stop background sync, if available
+ * stop background tasks (sync and/or push-sync heartbeat), if available
  */
 export async function tryStopBackgroundSync() {
   try {
-    const { stopPeriodicBackgroundSync } = await import(
-      "../helpers/background_sync.js"
-    );
+    const { stopBackground } = await import("../helpers/background.js");
     try {
-      await stopPeriodicBackgroundSync();
+      await stopBackground();
     } catch (error) {
-      console.error("Error stopping periodic background sync:", error);
+      console.error("Error stopping background tasks:", error);
     }
   } catch (error) {
-    console.error("Push notifications module not available:", error);
+    console.log("Background module not available:", error);
   }
 }

package/src/helpers/db_schema.js

@@ -1,7 +1,7 @@
 /*global saltcorn */
 
 const historyFile = "update_history";
-const jwtTableName = "jwt_table";
+const sessionTableName = "session_table";
 
 import { readFile, fileExists, writeJSON } from "./file_system";
 import { Directory } from "@capacitor/filesystem";
@@ -206,8 +206,10 @@ export async function updateDb(tablesJSON) {
   });
 }
 
-export async function createJwtTable() {
-  await saltcorn.data.db.query(`CREATE TABLE IF NOT EXISTS ${jwtTableName} (
-    jwt VARCHAR(500)
+export async function createSessionTable() {
+  await saltcorn.data.db.query(`CREATE TABLE IF NOT EXISTS ${sessionTableName} (
+    csrfToken VARCHAR(500),
+    userJson VARCHAR(2000),
+    isPublicUser BOOLEAN
   )`);
 }

package/src/helpers/file_system.js

@@ -1,4 +1,7 @@
 import { Filesystem, Encoding, Directory } from "@capacitor/filesystem";
+// side-effect only: registers the plugin so it works on the web platform too,
+// same as Filesystem above (native platforms pick it up either way)
+import "@capacitor/file-transfer";
 
 export async function writeFile(name, directory, content) {
   try {

package/src/helpers/offline_mode.js

@@ -59,11 +59,11 @@ const insertRemoteData = async (table, rows, syncTimestamp) => {
     const ref = _sync_info_tbl_ref_,
       last_modified = _sync_info_tbl_last_modified_;
     await saltcorn.data.db.insert(tblName, rest, { replace: true });
-    const infos = await saltcorn.data.db.select(
-      `${saltcorn.data.db.sqlsanitize(tblName)}_sync_info`,
-      {
-        ref: String(rest[pkName]),
-      }
+    // ref is inlined as a literal, not passed as a param, so numeric-looking
+    // refs like "19" don't get silently turned into "19.0" on iOS.
+    const { rows: infos } = await saltcorn.data.db.query(
+      `select 1 from "${saltcorn.data.db.sqlsanitize(tblName)}_sync_info"
+         where ref=${sqlRef(rest[pkName])}`
     );
     if (infos.length > 0) {
       await saltcorn.data.db.query(
@@ -72,14 +72,10 @@ const insertRemoteData = async (table, rows, syncTimestamp) => {
                where ref=${sqlRef(rest[pkName])}`
       );
     } else {
-      await saltcorn.data.db.insert(
-        `${saltcorn.data.db.sqlsanitize(tblName)}_sync_info`,
-        {
-          ref: String(ref),
-          last_modified: syncTimestamp,
-          deleted: false,
-          modified_local: false,
-        }
+      await saltcorn.data.db.query(
+        `insert into "${saltcorn.data.db.sqlsanitize(tblName)}_sync_info"
+           (ref, last_modified, deleted, modified_local)
+           values (${sqlRef(ref)}, ${syncTimestamp}, false, false)`
       );
     }
   }