@saltcorn/mobile-app 1.7.0-alpha.0 → 1.7.0-beta.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@saltcorn/mobile-app",
   "displayName": "Saltcorn mobile app",
-  "version": "1.7.0-alpha.0",
+  "version": "1.7.0-beta.0",
   "description": "Saltcorn mobile app for Android and iOS",
   "main": "index.js",
   "scripts": {
@@ -16,7 +16,6 @@
   },
   "dependencies": {
     "universal-router": "9.2.1",
-    "axios": "0.32.0",
     "jwt-decode": "4.0.0",
     "i18next": "24.2.2",
     "i18next-sprintf-postprocessor": "0.2.2",

package/share_extension_files/Info.plist

@@ -2,6 +2,24 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+    <key>CFBundleDevelopmentRegion</key>
+    <string>en</string>
+    <key>CFBundleDisplayName</key>
+    <string>$(PRODUCT_NAME)</string>
+    <key>CFBundleExecutable</key>
+    <string>$(EXECUTABLE_NAME)</string>
+    <key>CFBundleIdentifier</key>
+    <string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>$(PRODUCT_NAME)</string>
+    <key>CFBundlePackageType</key>
+    <string>XPC!</string>
+    <key>CFBundleShortVersionString</key>
+    <string>$(MARKETING_VERSION)</string>
+    <key>CFBundleVersion</key>
+    <string>$(CURRENT_PROJECT_VERSION)</string>
     <key>NSExtension</key>
     <dict>
         <key>NSExtensionAttributes</key>
@@ -24,8 +42,8 @@
                     <false/>
                 </dict>
         </dict>
-        <key>NSExtensionMainStoryboard</key>
-        <string>MainInterface</string>
+        <key>NSExtensionPrincipalClass</key>
+        <string>$(PRODUCT_MODULE_NAME).ShareViewController</string>
         <key>NSExtensionPointIdentifier</key>
         <string>com.apple.share-services</string>
     </dict>

package/share_extension_files/ShareViewController.swift

@@ -10,89 +10,104 @@ import Social
 import UIKit
 
 class ShareItem {
-    
+
     public var title: String?
     public var type: String?
     public var url: String?
 }
 
 class ShareViewController: UIViewController {
-    
+
     private var shareItems: [ShareItem] = []
-    
-    override public func viewDidAppear(_ animated: Bool) {
-       super.viewDidAppear(animated)
-       self.extensionContext!.completeRequest(returningItems: [], completionHandler: nil)
-    }
-    
+
     private func sendData() {
+        // URLComponents.url already percent-encodes queryItems values when
+        // building the final URL string - encoding them here too caused
+        // double-encoding (e.g. "text/plain" arrived as "text%2Fplain"),
+        // which broke type checks like isFileItem() on the JS side.
         let queryItems = shareItems.map {
             [
-                URLQueryItem(
-                    name: "title",
-                    value: $0.title?.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed) ?? ""),
+                URLQueryItem(name: "title", value: $0.title ?? ""),
                 URLQueryItem(name: "description", value: ""),
-                URLQueryItem(
-                    name: "type",
-                    value: $0.type?.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed) ?? ""),
-                URLQueryItem(
-                    name: "url",
-                    value: $0.url?.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed) ?? ""),
+                URLQueryItem(name: "type", value: $0.type ?? ""),
+                URLQueryItem(name: "url", value: $0.url ?? ""),
             ]
         }.flatMap({ $0 })
         var urlComps = URLComponents(string: "scappscheme://")!
         urlComps.queryItems = queryItems
         openURL(urlComps.url!)
     }
-    
+
     fileprivate func createSharedFileUrl(_ url: URL?) -> String {
-        let fileManager = FileManager.default
-        
-        let copyFileUrl =
-        fileManager.containerURL(forSecurityApplicationGroupIdentifier: "YOUR_APP_GROUP_ID")!
-            .absoluteString.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed)! + url!
-            .lastPathComponent.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed)!
-        try? Data(contentsOf: url!).write(to: URL(string: copyFileUrl)!)
-        
-        return copyFileUrl
+        guard let url = url else { return "" }
+        guard let containerURL = FileManager.default.containerURL(
+            forSecurityApplicationGroupIdentifier: "YOUR_APP_GROUP_ID"
+        ) else {
+            return ""
+        }
+        // appendingPathComponent handles escaping correctly on its own -
+        // hand-building a percent-encoded string here and then encoding it
+        // *again* as a URLQueryItem value in sendData() double-encoded it,
+        // so the path JS received didn't match any real file
+        let destinationURL = containerURL.appendingPathComponent(url.lastPathComponent)
+
+        // files vended by the Files app (iCloud, other apps' sandboxes) need
+        // this before they can actually be read - without it, Data(contentsOf:)
+        // fails and this used to silently return a path to a file that was
+        // never written
+        let didStartAccessing = url.startAccessingSecurityScopedResource()
+        defer {
+            if didStartAccessing { url.stopAccessingSecurityScopedResource() }
+        }
+        do {
+            try Data(contentsOf: url).write(to: destinationURL)
+            return destinationURL.absoluteString
+        } catch {
+            print("createSharedFileUrl failed: \(error)")
+            return ""
+        }
     }
-    
+
     func saveScreenshot(_ image: UIImage, _ index: Int) -> String {
-        let fileManager = FileManager.default
-        
-        let copyFileUrl =
-        fileManager.containerURL(forSecurityApplicationGroupIdentifier: "YOUR_APP_GROUP_ID")!
-            .absoluteString.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed)!
-        + "/screenshot_\(index).png"
+        guard let containerURL = FileManager.default.containerURL(
+            forSecurityApplicationGroupIdentifier: "YOUR_APP_GROUP_ID"
+        ) else {
+            return ""
+        }
+        let destinationURL = containerURL.appendingPathComponent("screenshot_\(index).png")
         do {
-            try image.pngData()?.write(to: URL(string: copyFileUrl)!)
-            return copyFileUrl
+            try image.pngData()?.write(to: destinationURL)
+            return destinationURL.absoluteString
         } catch {
-            print(error.localizedDescription)
+            print("saveScreenshot failed: \(error.localizedDescription)")
             return ""
         }
     }
-    
+
     fileprivate func handleTypeUrl(_ attachment: NSItemProvider)
     async throws -> ShareItem
     {
         let results = try await attachment.loadItem(forTypeIdentifier: kUTTypeURL as String, options: nil)
-        let url = results as! URL?
+        guard let url = results as? URL else {
+            throw NSError(domain: "ShareViewController", code: 1, userInfo: [
+                NSLocalizedDescriptionKey: "handleTypeUrl: expected a URL, got \(type(of: results))"
+            ])
+        }
         let shareItem: ShareItem = ShareItem()
-        
-        if url!.isFileURL {
-            shareItem.title = url!.lastPathComponent
-            shareItem.type = "application/" + url!.pathExtension.lowercased()
+
+        if url.isFileURL {
+            shareItem.title = url.lastPathComponent
+            shareItem.type = "application/" + url.pathExtension.lowercased()
             shareItem.url = createSharedFileUrl(url)
         } else {
-            shareItem.title = url!.absoluteString
-            shareItem.url = url!.absoluteString
+            shareItem.title = url.absoluteString
+            shareItem.url = url.absoluteString
             shareItem.type = "text/plain"
         }
-        
+
         return shareItem
     }
-    
+
     fileprivate func handleTypeText(_ attachment: NSItemProvider)
     async throws -> ShareItem
     {
@@ -103,25 +118,29 @@ class ShareViewController: UIViewController {
         shareItem.type = "text/plain"
         return shareItem
     }
-    
+
     fileprivate func handleTypeMovie(_ attachment: NSItemProvider)
     async throws -> ShareItem
     {
         let results = try await attachment.loadItem(forTypeIdentifier: kUTTypeMovie as String, options: nil)
         let shareItem: ShareItem = ShareItem()
-        
-        let url = results as! URL?
-        shareItem.title = url!.lastPathComponent
-        shareItem.type = "video/" + url!.pathExtension.lowercased()
+
+        guard let url = results as? URL else {
+            throw NSError(domain: "ShareViewController", code: 1, userInfo: [
+                NSLocalizedDescriptionKey: "handleTypeMovie: expected a URL, got \(type(of: results))"
+            ])
+        }
+        shareItem.title = url.lastPathComponent
+        shareItem.type = "video/" + url.pathExtension.lowercased()
         shareItem.url = createSharedFileUrl(url)
         return shareItem
     }
-    
+
     fileprivate func handleTypeImage(_ attachment: NSItemProvider, _ index: Int)
     async throws -> ShareItem
     {
         let data = try await attachment.loadItem(forTypeIdentifier: kUTTypeImage as String, options: nil)
-        
+
         let shareItem: ShareItem = ShareItem()
             switch data {
                 case let image as UIImage:
@@ -137,48 +156,58 @@ class ShareViewController: UIViewController {
         }
         return shareItem
     }
-    
+
     override public func viewDidLoad() {
         super.viewDidLoad()
-        
+
         shareItems.removeAll()
-        
+
         let extensionItem = extensionContext?.inputItems[0] as! NSExtensionItem
         Task {
-            try await withThrowingTaskGroup(
-                of: ShareItem.self,
-                body: { taskGroup in
-                    
-                    for (index, attachment) in extensionItem.attachments!.enumerated() {
-                        if attachment.hasItemConformingToTypeIdentifier(kUTTypeURL as String) {
-                            taskGroup.addTask {
-                                return try await self.handleTypeUrl(attachment)
-                            }
-                        } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeText as String) {
-                            taskGroup.addTask {
-                                return try await self.handleTypeText(attachment)
-                            }
-                        } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeMovie as String) {
-                            taskGroup.addTask {
-                                return try await self.handleTypeMovie(attachment)
-                            }
-                        } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeImage as String) {
-                            taskGroup.addTask {
-                                return try await self.handleTypeImage(attachment, index)
+            do {
+                try await withThrowingTaskGroup(
+                    of: ShareItem.self,
+                    body: { taskGroup in
+
+                        for (index, attachment) in extensionItem.attachments!.enumerated() {
+                            if attachment.hasItemConformingToTypeIdentifier(kUTTypeURL as String) {
+                                taskGroup.addTask {
+                                    return try await self.handleTypeUrl(attachment)
+                                }
+                            } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeText as String) {
+                                taskGroup.addTask {
+                                    return try await self.handleTypeText(attachment)
+                                }
+                            } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeMovie as String) {
+                                taskGroup.addTask {
+                                    return try await self.handleTypeMovie(attachment)
+                                }
+                            } else if attachment.hasItemConformingToTypeIdentifier(kUTTypeImage as String) {
+                                taskGroup.addTask {
+                                    return try await self.handleTypeImage(attachment, index)
+                                }
                             }
                         }
-                    }
-                    
-                    for try await item in taskGroup {
-                        self.shareItems.append(item)
-                    }
-                })
-            
+
+                        for try await item in taskGroup {
+                            self.shareItems.append(item)
+                        }
+                    })
+            } catch {
+                // a bad attachment (e.g. an unexpected type) still needs to
+                // complete the request below, or the share sheet hangs
+                print("viewDidLoad: task group failed: \(error)")
+            }
+
             self.sendData()
-            
+            // only complete (letting the OS tear this extension down) once
+            // sendData() has actually handed off to the host app - doing
+            // this in viewDidAppear instead raced the async work above and
+            // usually won, killing the extension before openURL() ran
+            self.extensionContext!.completeRequest(returningItems: [], completionHandler: nil)
         }
     }
-    
+
     @objc func openURL(_ url: URL) {
         var responder: UIResponder? = self
         while responder != nil {
@@ -189,5 +218,5 @@ class ShareViewController: UIViewController {
             responder = responder?.next
         }
     }
-    
-}
+
+}

package/src/helpers/api.js

@@ -1,7 +1,5 @@
 /*global saltcorn, splashConfig*/
 
-import axios from "axios";
-import { jwtDecode } from "jwt-decode";
 import { router } from "../routing/index";
 import { replaceIframe, clearHistory } from "./navigation";
 
@@ -19,49 +17,83 @@ export async function apiCall({
       ? saltcorn.data.state.getState().mobileConfig
       : splashConfig;
   const serverPath = config.server_path;
-  const url = `${serverPath}${path}`;
+  let url = `${serverPath}${path}`;
+  if (params) {
+    const qs = new URLSearchParams(params).toString();
+    if (qs) url += `${url.includes("?") ? "&" : "?"}${qs}`;
+  }
   const headers = {
     "X-Requested-With": "XMLHttpRequest",
     "X-Saltcorn-Client": "mobile-app",
     ...(additionalHeaders || {}),
   };
   if (config.tenantAppName) headers["X-Saltcorn-App"] = config.tenantAppName;
-  const token = config.jwt;
-  if (token) {
-    try {
-      const decoded = jwtDecode(token);
-      if (decoded.exp && decoded.exp < Date.now() / 1000 && typeof saltcorn !== "undefined" && !path.startsWith("/auth/")) {
-        const mobileConfig = saltcorn.data.state.getState().mobileConfig;
-        mobileConfig.jwt = undefined;
-        await saltcorn.data.db.deleteWhere("jwt_table");
-        clearHistory();
-        const page = await router.resolve({
-          pathname: "get/auth/login",
-          alerts: [
-            { type: "warning", msg: "Your session has expired, please log in again." },
-          ],
-        });
-        await replaceIframe(page.content);
-        return;
-      }
-    } catch {
-      // malformed token, let the request proceed and fail naturally
-    }
-    headers.Authorization = `jwt ${token}`;
+  // The session cookie is attached automatically by the WebView (credentials: "include").
+  // The CSRF token has to be sent explicitly, same as the web client does.
+  if (config.csrfToken) headers["CSRF-Token"] = config.csrfToken;
+  const fetchOptions = { method, headers, credentials: "include" };
+  if (body !== undefined) {
+    fetchOptions.body = JSON.stringify(body);
+    headers["Content-Type"] = "application/json";
   }
+  const controller = timeout ? new AbortController() : null;
+  const timeoutId = controller
+    ? setTimeout(() => controller.abort(), timeout)
+    : null;
+  if (controller) fetchOptions.signal = controller.signal;
   try {
-    const result = await axios({
-      url: url,
-      method,
-      params,
-      headers,
-      responseType: responseType ? responseType : "json",
-      data: body,
-      timeout: timeout ? timeout : 0,
-    });
-    return result;
+    const res = await fetch(url, fetchOptions);
+    if (!res.ok) {
+      const error = new Error(`Request failed with status code ${res.status}`);
+      error.response = { status: res.status };
+      throw error;
+    }
+    let data;
+    if (responseType === "blob") data = await res.blob();
+    else if (responseType === "text") data = await res.text();
+    else {
+      // A redirected error page still counts as a 200 here, so parse by
+      // hand to give a clear error instead of a cryptic JSON parse failure.
+      const text = await res.text();
+      try {
+        data = text ? JSON.parse(text) : undefined;
+      } catch {
+        const error = new Error(
+          `Expected JSON but got ${
+            res.headers.get("content-type") || "unknown content-type"
+          } (status ${res.status}, url ${res.url})`
+        );
+        error.response = { status: res.status };
+        throw error;
+      }
+    }
+    return { data, status: res.status };
   } catch (error) {
+    if (
+      error.response?.status === 401 &&
+      typeof saltcorn !== "undefined" &&
+      !path.startsWith("/auth/")
+    ) {
+      const mobileConfig = saltcorn.data.state.getState().mobileConfig;
+      mobileConfig.csrfToken = undefined;
+      mobileConfig.hasSession = false;
+      await saltcorn.data.db.deleteWhere("session_table");
+      clearHistory();
+      const page = await router.resolve({
+        pathname: "get/auth/login",
+        alerts: [
+          {
+            type: "warning",
+            msg: "Your session has expired, please log in again.",
+          },
+        ],
+      });
+      await replaceIframe(page.content);
+      return;
+    }
     error.message = `Unable to call ${method} ${url}:\n${error.message}`;
     throw error;
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
   }
 }