@saltcorn/mobile-app 1.6.3-beta.1 → 1.7.0-alpha.1

package/src/index.js

@@ -1,4 +1,4 @@
-import { init } from "./init";
+import { init, postShare } from "./init";
 import * as api from "./helpers/api";
 import * as auth from "./helpers/auth";
 import * as common from "./helpers/common";
@@ -12,7 +12,7 @@ import { router } from "./routing/index";
 let notifications = undefined;
 try {
   notifications = require("./helpers/notifications");
-  console.log("Notifications module available");  
+  console.log("Notifications module available");
 } catch (err) {
   console.log("Notifications module not available");
 }
@@ -21,9 +21,8 @@ try {
 let backgroundSync = undefined;
 try {
   backgroundSync = require("./helpers/background_sync");
-  console.log("Background sync module available");  
-}
-catch (err) {
+  console.log("Background sync module available");
+} catch (err) {
   console.log("Background sync module not available");
 }
 
@@ -38,6 +37,7 @@ context.keys().forEach((key) => {
 
 export const mobileApp = {
   init,
+  postShare,
   api,
   auth,
   common,

package/src/init.js

@@ -11,9 +11,9 @@ import {
   createSyncInfoTables,
   dbUpdateNeeded,
   updateDb,
-  createJwtTable,
+  createSessionTable,
 } from "./helpers/db_schema.js";
-import { publicLogin, checkJWT } from "./helpers/auth.js";
+import { publicLogin, checkSession } from "./helpers/auth.js";
 import { router } from "./routing/index.js";
 import {
   replaceIframe,
@@ -30,7 +30,6 @@ import { readJSONCordova, readTextCordova } from "./helpers/file_system.js";
 
 import i18next from "i18next";
 import i18nextSprintfPostProcessor from "i18next-sprintf-postprocessor";
-import { jwtDecode } from "jwt-decode";
 
 import { Network } from "@capacitor/network";
 import { App } from "@capacitor/app";
@@ -152,19 +151,34 @@ const handlePluginHeaders = async (plugins) => {
   }
 };
 
-const getJwt = async () => {
-  const rows = await saltcorn.data.db.select("jwt_table");
-  return rows?.length > 0 ? rows[0].jwt : null;
+const getSession = async () => {
+  const rows = await saltcorn.data.db.select("session_table");
+  return rows?.length > 0 ? rows[0] : null;
 };
 
-const initJwt = async () => {
-  if (!(await saltcorn.data.db.tableExists("jwt_table"))) {
-    await createJwtTable();
+const initSession = async () => {
+  if (!(await saltcorn.data.db.tableExists("session_table"))) {
+    await createSessionTable();
   } else {
-    const jwt = await getJwt();
-    if (jwt) {
+    const row = await getSession();
+    if (row?.csrfToken) {
       const state = saltcorn.data.state.getState();
-      state.mobileConfig.jwt = jwt;
+      state.mobileConfig.csrfToken = row.csrfToken;
+      state.mobileConfig.isPublicUser = !!row.isPublicUser;
+      state.mobileConfig.hasSession = true;
+      if (row.isPublicUser) {
+        state.mobileConfig.user = {
+          role_id: 100,
+          email: "public",
+          language: "en",
+        };
+      } else if (row.userJson) {
+        try {
+          state.mobileConfig.user = JSON.parse(row.userJson);
+        } catch {
+          // corrupted local row, fall back to a network check
+        }
+      }
     }
   }
 };
@@ -210,7 +224,7 @@ const showErrorPage = async (error) => {
 const onResume = async () => {
   if (typeof saltcorn === "undefined") return;
   const mobileConfig = saltcorn.data.state.getState().mobileConfig;
-  if (mobileConfig?.jwt) {
+  if (mobileConfig?.hasSession) {
     const netStatus = await Network.getStatus();
     mobileConfig.networkState = netStatus.connectionType;
     if (
@@ -226,8 +240,8 @@ const onResume = async () => {
         await showErrorPage(error);
       }
     } else if (mobileConfig.networkState !== "none") {
-      if (!mobileConfig.isOfflineMode && !isPublicJwt(mobileConfig.jwt)) {
-        await checkJWT(mobileConfig.jwt);
+      if (!mobileConfig.isOfflineMode && !mobileConfig.isPublicUser) {
+        await checkSession();
       }
       if (mobileConfig.allowOfflineMode && mobileConfig.syncOnAppResume) {
         try {
@@ -240,21 +254,6 @@ const onResume = async () => {
   }
 };
 
-const isPublicJwt = (jwt) => {
-  try {
-    if (!jwt) return false;
-    const decoded = jwtDecode(jwt);
-    return decoded.sub === "public";
-  } catch (error) {
-    console.log(
-      `Unable to inspect '${jwt}': ${
-        error.message ? error.message : "Unknown error"
-      }`
-    );
-    return false;
-  }
-};
-
 const isPublicEntryPoint = async (entryPoint) => {
   if (!entryPoint) return false;
   try {
@@ -309,7 +308,7 @@ const notEmpty = (shareData) => {
   }
 };
 
-const postShare = async (shareData) => {
+export const postShare = async (shareData) => {
   const page = await router.resolve({
     pathname: "post/notifications/share",
     shareData,
@@ -390,7 +389,7 @@ export async function init(mobileConfig) {
       try {
         const url = event.url;
         if (url.startsWith("mobileapp://auth/callback")) {
-          const token = new URL(url).searchParams.get("token");
+          const token = new URL(url).searchParams.get("code");
           const method = new URL(url).searchParams.get("method");
           const methods = saltcorn.data.state.getState().auth_methods;
           if (!methods[method])
@@ -429,7 +428,7 @@ export async function init(mobileConfig) {
       await updateDb(tablesJSON);
     }
     await createSyncInfoTables(mobileConfig.synchedTables);
-    await initJwt();
+    await initSession();
     await state.refresh_tables();
     await state.refresh_views();
     await state.refresh_pages();
@@ -455,14 +454,16 @@ export async function init(mobileConfig) {
     Network.addListener("networkStatusChange", networkChangeCallback);
 
     const networkDisabled = state.mobileConfig.networkState === "none";
-    const jwt = state.mobileConfig.jwt;
+    const hasSession = !!state.mobileConfig.hasSession;
+    const isPublicUser = !!state.mobileConfig.isPublicUser;
     const alerts = [];
-    if ((networkDisabled && jwt) || (await checkJWT(jwt))) {
-      // already logged in, continue
+    if (
+      hasSession &&
+      !isPublicUser &&
+      (networkDisabled || (await checkSession()))
+    ) {
+      // already logged in, continue - mobileConfig.user was restored by initSession()
       const mobileConfig = state.mobileConfig;
-      const decodedJwt = jwtDecode(mobileConfig.jwt);
-      mobileConfig.user = decodedJwt.user;
-      mobileConfig.isPublicUser = false;
       await i18next.changeLanguage(mobileConfig.user.language);
       if (mobileConfig.allowOfflineMode) {
         const { offlineUser } = (await getLastOfflineSession()) || {};
@@ -536,11 +537,9 @@ export async function init(mobileConfig) {
         });
       }
       if (page.content) await replaceIframe(page.content, page.isFile);
-    } else if (isPublicJwt(jwt)) {
+    } else if (hasSession && isPublicUser) {
       // already logged in as public
       const config = state.mobileConfig;
-      config.user = { role_id: 100, email: "public", language: "en" };
-      config.isPublicUser = true;
       i18next.changeLanguage(config.user.language);
       const entryPoint = getEntryPoint(100, state, state.mobileConfig);
       if (!entryPoint) await showLogin(alerts);

package/src/routing/mocks/request.js

@@ -29,7 +29,7 @@ export function MobileRequest({
       }),
     isAuthenticated: () => {
       const mobileCfg = saltcorn.data.state.getState().mobileConfig;
-      return mobileCfg && mobileCfg.jwt && !mobileCfg.isPublicUser;
+      return mobileCfg && mobileCfg.hasSession && !mobileCfg.isPublicUser;
     },
     getLocale: () => {
       const mobileCfg = saltcorn.data.state.getState().mobileConfig;

package/src/routing/routes/notifications.js

@@ -3,7 +3,7 @@
 import { wrapContents } from "../utils";
 import { MobileRequest } from "../mocks/request";
 
-import { checkJWT } from "../../helpers/auth.js";
+import { checkSession } from "../../helpers/auth.js";
 import { apiCall } from "../../helpers/api";
 
 const buildErrMsg = (msg) => {
@@ -24,21 +24,45 @@ const buildSuccessMsg = (msg) => {
   );
 };
 
+// files have a real type (e.g. image/png); text/link shares are "text/plain"
+const isFileItem = (item) =>
+  item?.type && item.type !== "text/plain" && item.url;
+
 export const postShare = async (context) => {
   let content = "";
   const mobileCfg = saltcorn.data.state.getState().mobileConfig;
   if (mobileCfg.networkState === "none")
     content = buildErrMsg("No network connection");
-  else if (!(await checkJWT(mobileCfg.jwt)))
-    content = buildErrMsg("Not authenticated");
+  else if (!(await checkSession())) content = buildErrMsg("Not authenticated");
   else {
-    const response = await apiCall({
-      method: "POST",
-      path: "/notifications/share-handler",
-      body: context.shareData,
-    });
-    if (response.error) content = buildErrMsg(response.error);
-    else content = buildSuccessMsg("Shared successfully");
+    try {
+      const { title, description, type, url, additionalItems } =
+        context.shareData || {};
+      let body = context.shareData;
+      if (isFileItem({ type, url })) {
+        const items = [{ title, type, url }, ...(additionalItems || [])];
+        // title is the real on-disk filename, location is where to find it
+        const files = [];
+        for (const item of items) {
+          const uploaded = await saltcorn.data.models.File.uploadFromPath(
+            item.url,
+            item.title || "shared-file",
+            item.type
+          );
+          files.push({ title: uploaded.filename, location: uploaded.location });
+        }
+        body = { description, files };
+      }
+      const response = await apiCall({
+        method: "POST",
+        path: "/notifications/share-handler",
+        body,
+      });
+      if (response.error) content = buildErrMsg(response.error);
+      else content = buildSuccessMsg("Shared successfully");
+    } catch (error) {
+      content = buildErrMsg(error.message || "Error sharing");
+    }
   }
   return await wrapContents(
     saltcorn.markup.tags.div(

package/src/routing/routes/view.js

@@ -39,7 +39,7 @@ export const postView = async (context) => {
   const mobileCfg = state.mobileConfig;
   if (
     mobileCfg.user.role_id > view.min_role &&
-    !(await view.authorise_post({ body, req, ...view }))
+    !(await view.authorize(mobileCfg.user, { action: "post", req, body }))
   ) {
     throw new saltcorn.data.utils.NotAuthorized(req.__("Not authorized"));
   }
@@ -150,7 +150,11 @@ export const getView = async (context) => {
   if (!view) throw new Error(req.__("No such view: %s", viewname));
   if (
     state.mobileConfig.user.role_id > view.min_role &&
-    !(await view.authorise_get({ query, req, ...view }))
+    !(await view.authorize(state.mobileConfig.user, {
+      action: "get",
+      req,
+      state: query,
+    }))
   ) {
     const additionalInfos = `: your role: ${state.mobileConfig.user.role_id}, view min_role: ${view.min_role}`;
     throw new saltcorn.data.utils.NotAuthorized(
@@ -161,7 +165,9 @@ export const getView = async (context) => {
   if (!view.renderLocally()) {
     const response = await apiCall({
       method: "GET",
-      path: `/view/${encodeURIComponent(viewname)}${context.query ? `?${context.query}` : ""}`,
+      path: `/view/${encodeURIComponent(viewname)}${
+        context.query ? `?${context.query}` : ""
+      }`,
     });
     const data = response.data;
     contents0 = data;

package/src/routing/utils.js

@@ -24,7 +24,7 @@ export const getHeaders = () => {
     from_cfg.push({ style: state.getConfig("page_custom_css", "") });
   if (state.getConfig("page_custom_html", ""))
     from_cfg.push({ headerTag: state.getConfig("page_custom_html", "") });
-  return [...stdHeaders, ...config.pluginHeaders, ...from_cfg];
+  return [...stdHeaders, ...(config.pluginHeaders || []), ...from_cfg];
 };
 
 export const parseQuery = (queryStr) => {

package/www/js/iframe_view_utils.js

@@ -1,6 +1,21 @@
 /*eslint-env browser*/
 /*global $, KTDrawer, reload_embedded_view, submitWithEmptyAction, is_paging_param, bootstrap, common_done, unique_field_from_rows, inline_submit_success, get_current_state_url, initialize_page, reset_spinners */
 
+// Tapping a javascript: link silently does nothing on iOS, so we run the
+// code ourselves instead of relying on the link to do it.
+document.addEventListener("click", function (event) {
+  const link =
+    event.target.closest && event.target.closest("a[href^='javascript:']");
+  if (!link) return;
+  event.preventDefault();
+  const code = link.getAttribute("href").slice("javascript:".length);
+  try {
+    (0, eval)(code);
+  } catch (error) {
+    console.error("Error executing javascript: link:", error);
+  }
+});
+
 function combineFormAndQuery(form, query) {
   let paramsList = [];
   const formData = new FormData(form[0]);
@@ -87,7 +102,10 @@ async function formSubmit(e, urlSuffix, viewname, noSubmitCb, matchingState) {
     const urlParams = new URLSearchParams();
     const data = matchingState ? {} : null;
     for (const entry of new FormData(e).entries()) {
-      if (entry[1] instanceof File) files[entry[0]] = entry[1];
+      // cordova-plugin-file replaces window.File with its own class, so a
+      // real picked file no longer passes "instanceof File" - Blob still
+      // works, since every File is also a Blob.
+      if (entry[1] instanceof Blob) files[entry[0]] = entry[1];
       else {
         // is there a hidden input with a filename?
         const domEl = $(e).find(
@@ -431,22 +449,50 @@ async function pjax_to(href, query, e) {
     await parent.saltcorn.mobileApp.navigation.handleRoute(safeHref, query);
   else
     try {
-      const headers = {
-        pjaxpageload: "true",
-      };
-      if (localizer.length) headers.localizedstate = "true";
-      const result = await parent.saltcorn.mobileApp.api.apiCall({
-        path: path,
-        method: "GET",
-        additionalHeaders: headers,
-      });
+      const { isOfflineMode } =
+        parent.saltcorn.data.state.getState().mobileConfig;
+      let content;
+      if (isOfflineMode) {
+        const page = await parent.saltcorn.mobileApp.navigation.router.resolve(
+          {
+            pathname: `get${safeHref}`,
+            query: query,
+          }
+        );
+        if (page.redirect) {
+          const { path: redirectPath, query: redirectQuery } =
+            parent.saltcorn.mobileApp.navigation.splitPathQuery(
+              page.redirect
+            );
+          await parent.saltcorn.mobileApp.navigation.handleRoute(
+            redirectPath.startsWith("/") && redirectPath.length > 1
+              ? `get${redirectPath}`
+              : redirectPath,
+            redirectQuery
+          );
+          return;
+        }
+        content = typeof page === "string" ? page : page.content;
+      } else {
+        const headers = {
+          pjaxpageload: "true",
+        };
+        if (localizer.length) headers.localizedstate = "true";
+        const result = await parent.saltcorn.mobileApp.api.apiCall({
+          path: path,
+          method: "GET",
+          additionalHeaders: headers,
+          responseType: "text",
+        });
+        content = result.data;
+      }
       if (!inModal && !localizer.length) {
         // not sure for mobile
         // window.history.pushState({ url: href }, "", href);
       }
       if (inModal && !localizer.length)
         $(".sc-modal-linkout").attr("href", path);
-      $dest.html(result.data);
+      $dest.html(content);
       if (localizer.length) localizer.attr("data-sc-local-state", path);
       initialize_page();
     } catch (error) {
@@ -675,17 +721,16 @@ async function make_unique_field(
   }
 }
 
-function openFile(fileId) {
+async function openFile(fileId) {
   const config = parent.saltcorn.data.state.getState().mobileConfig;
   const serverPath = config.server_path;
-  const token = config.jwt;
-  const url = `${serverPath}/files/serve/${encodeURIComponent(
-    fileId
-  )}?jwt=${token}`;
+  const url = `${serverPath}/files/serve/${encodeURIComponent(fileId)}`;
   parent.cordova.InAppBrowser.open(
     url,
     "_blank",
-    "clearcache=yes,clearsessioncache=yes,location=no,toolbar=yes,toolbarposition=top"
+    // No clearcache - it clears cookies app-wide (Android's cookie store
+    // isn't scoped per tab), which would log the main app out too.
+    "location=no,toolbar=yes,toolbarposition=top"
   );
 }
 
@@ -695,7 +740,9 @@ function openInAppBrowser(url, domId) {
     const ref = parent.cordova.InAppBrowser.open(
       url,
       "_blank",
-      "clearcache=yes,clearsessioncache=yes,location=no,toolbar=yes,toolbarposition=top"
+      // No clearcache - it clears cookies app-wide (Android's cookie store
+      // isn't scoped per tab), which would log the main app out too.
+      "location=no,toolbar=yes,toolbarposition=top"
     );
     ref.addEventListener("exit", function () {
       $(`#${domId}`).find(".spinner-border").addClass("d-none");

package/add_entitlements.rb

@@ -1,16 +0,0 @@
-require 'xcodeproj'
-
-project_path = 'ios/App/App.xcodeproj'
-target_name  = 'App'
-entitlements_relative_path = 'App/App.entitlements'
-
-project = Xcodeproj::Project.open(project_path)
-target = project.targets.find { |t| t.name == target_name }
-abort("Target '#{target_name}' not found") unless target
-
-target.build_configurations.each do |config|
-  config.build_settings['CODE_SIGN_ENTITLEMENTS'] = entitlements_relative_path
-end
-
-project.save
-puts "Entitlements configured successfully for target '#{target_name}'"

package/optional_sources/background_sync.js

@@ -1,91 +0,0 @@
-import { BackgroundFetch } from "@transistorsoft/capacitor-background-fetch";
-import { sync } from "./offline_mode.js";
-
-let isConfigured = false;
-
-/**
- * Init the periodic background sync with a min interval.
- * This runs the sync even if the app is in background or was swipe closed.
- * If no internet connection is available it fails silently.
- * @param {number} interval min time interval in minutes. The system decides when to actually do it
- * @returns {Promise<boolean>} True if configuration was successful, false otherwise.
- */
-export async function startPeriodicBackgroundSync(interval = 15) {
-  if (isConfigured) {
-    console.log("Background sync is already configured. Skipping.");
-    return true;
-  }
-
-  console.log("Configuring background sync with interval (minutes):", interval);
-
-  const status = await BackgroundFetch.configure(
-    {
-      minimumFetchInterval: interval,
-    },
-    async (taskId) => {
-      console.log(
-        "Starting background sync:",
-        taskId,
-        new Date().toISOString()
-      );
-      await sync(true);
-      console.log(
-        "Background sync finished:",
-        taskId,
-        new Date().toISOString()
-      );
-      BackgroundFetch.finish(taskId);
-    },
-    async (taskId) => {
-      console.log("[BackgroundFetch] TIMEOUT:", taskId);
-      BackgroundFetch.finish(taskId);
-    }
-  );
-
-  if (status === BackgroundFetch.STATUS_AVAILABLE) {
-    console.log("Background sync successfully configured.");
-    isConfigured = true; // Set the flag only on success
-    return true;
-  } else {
-    // Handle error statuses
-    if (status === BackgroundFetch.STATUS_DENIED) {
-      console.log(
-        "The user explicitly disabled background behavior for this app or for the whole system."
-      );
-    } else if (status === BackgroundFetch.STATUS_RESTRICTED) {
-      console.log(
-        "Background updates are unavailable and the user cannot enable them again."
-      );
-    }
-    isConfigured = false;
-    return false;
-  }
-}
-
-/**
- * Stops/Unregisters the periodic background sync.
- * This should be called when the user logs out.
- */
-export async function stopPeriodicBackgroundSync() {
-  if (!isConfigured) {
-    console.log("Background sync is not currently configured. Skipping stop.");
-    return;
-  }
-
-  console.log("Stopping background sync");
-  try {
-    await BackgroundFetch.stop();
-    console.log("Background sync successfully stopped.");
-    isConfigured = false;
-  } catch (error) {
-    console.error("Error stopping background sync:", error);
-  }
-}
-
-/**
- * Check if the background sync is currently configured/enabled.
- * @returns {boolean} True if the sync is configured, false otherwise.
- */
-export function isBackgroundSyncActive() {
-  return isConfigured;
-}