@saltcorn/mobile-app 1.7.0-alpha.0 → 1.7.0-beta.0

package/src/helpers/auth.js

@@ -1,6 +1,5 @@
 /*global saltcorn*/
 
-import { jwtDecode } from "jwt-decode";
 import i18next from "i18next";
 import { apiCall } from "./api";
 import { router } from "../routing/index";
@@ -15,50 +14,57 @@ import {
 } from "./common";
 
 /**
- * internal helper for the normal login/signup and public login
+ * fetches a CSRF token and caches it in mobileConfig.csrfToken.
+ * Call again after every login/logout, since both reset it.
+ */
+export async function refreshCsrfToken() {
+  const response = await apiCall({ method: "GET", path: "/auth/csrf-token" });
+  const config = saltcorn.data.state.getState().mobileConfig;
+  config.csrfToken = response?.data?.csrfToken;
+  return config.csrfToken;
+}
+
+/**
+ * internal helper for the normal login/signup
  * @param {any} param0
  * @returns
  */
-async function loginRequest({ email, password, isSignup, isPublic }) {
-  const opts = isPublic
+async function loginRequest({ email, password, isSignup, code }) {
+  await refreshCsrfToken();
+  const opts = code
     ? {
-        method: "GET",
-        path: "/auth/login-with/jwt",
+        method: "POST",
+        path: "/auth/session-from-code",
+        body: { code },
       }
     : isSignup
     ? {
         method: "POST",
         path: "/auth/signup",
-        body: {
-          email,
-          password,
-        },
+        body: { email, password },
       }
     : {
         method: "POST",
-        path: "/auth/login-with/jwt",
-        body: {
-          email,
-          password,
-        },
+        path: "/auth/login-with/session",
+        body: { email, password },
       };
   const response = await apiCall(opts);
   return response.data;
 }
 
 /**
- * internal helper to process a JWT token
- * @param {string} tokenStr
+ * internal helper to process a successful session login response
+ * ({ success: true, user }) and persist it locally
  */
-const handleToken = async (tokenStr, config) => {
-  const token = jwtDecode(tokenStr);
-  const user = token.user;
+const handleSessionLogin = async (user, config) => {
   config.user = user;
   config.isPublicUser = false;
   config.isOfflineMode = false;
+  config.hasSession = true;
   await insertUser(user);
-  await setJwt(tokenStr);
-  config.jwt = tokenStr;
+  // login regenerated the session, so the previously fetched token is stale
+  await refreshCsrfToken();
+  await persistSession(config);
   i18next.changeLanguage(user.language);
 };
 
@@ -101,22 +107,22 @@ const getEntryPoint = (config) => {
 };
 
 /**
- * For normal login/signup email and password are used
- * When called from auth provider login (see google-auth plugin), token is used
+ * Normal login/signup use email and password. An OAuth-provider login
+ * (e.g. google-auth's finishLogin) instead passes the short-lived code
+ * its deep-link callback was handed, which stands in for a session here.
  * @param {*} param0
  */
 export async function login({ email, password, isSignup, token }) {
-  const loginResult = !token
-    ? await loginRequest({
-        email,
-        password,
-        isSignup,
-      })
-    : token;
-  if (typeof loginResult === "string") {
+  const loginResult = await loginRequest({
+    email,
+    password,
+    isSignup,
+    code: token,
+  });
+  if (loginResult?.success && loginResult?.user) {
     const alerts = [];
     const config = saltcorn.data.state.getState().mobileConfig;
-    await handleToken(loginResult, config);
+    await handleSessionLogin(loginResult.user, config);
     if (config.allowOfflineMode) alerts.push(await initialSync(config));
     await tryInitPush(config);
     await tryInitBackgroundSync(config);
@@ -129,14 +135,31 @@ export async function login({ email, password, isSignup, token }) {
     });
 
     // open first page
-    const entryPoint = getEntryPoint(config);
-    addRoute({ route: entryPoint, query: undefined });
-    const page = await router.resolve({
-      pathname: entryPoint,
-      fullWrap: true,
-      alerts,
-    });
-    if (page.content) await replaceIframe(page.content, page.isFile);
+    try {
+      const entryPoint = getEntryPoint(config);
+      addRoute({ route: entryPoint, query: undefined });
+      const page = await router.resolve({
+        pathname: entryPoint,
+        fullWrap: true,
+        alerts,
+      });
+      if (page.content) await replaceIframe(page.content, page.isFile);
+    } catch (error) {
+      // Logged in fine, but this user can't open the app's entry point
+      // (e.g. its role doesn't allow it) - say so instead of leaving
+      // them stuck on the login page with no explanation.
+      showToasts([
+        {
+          type: "error",
+          msg: i18next.t("Logged in as %s, but unable to open the app: %s", {
+            postProcess: "sprintf",
+            sprintf: [config.user.email, error.message || "unknown error"],
+          }),
+        },
+      ]);
+    }
+  } else if (loginResult?.error) {
+    showToasts([{ type: "error", msg: loginResult.error }]);
   } else if (loginResult?.alerts) {
     showToasts(loginResult?.alerts);
   } else {
@@ -146,44 +169,39 @@ export async function login({ email, password, isSignup, token }) {
 
 export async function publicLogin(entryPoint) {
   try {
-    const loginResult = await loginRequest({ isPublic: true });
-    if (typeof loginResult === "string") {
-      const config = saltcorn.data.state.getState().mobileConfig;
-      config.user = {
-        role_id: 100,
-        email: "public",
-        language: "en",
-      };
-      config.isPublicUser = true;
-      await setJwt(loginResult);
-      config.jwt = loginResult;
-      i18next.changeLanguage(config.user.language);
-      addRoute({
-        route: entryPoint,
-        query: undefined,
-      });
-      const page = await router.resolve({
-        pathname: entryPoint,
-        fullWrap: true,
-        alerts: [
-          {
-            type: "success",
-            msg: i18next.t("Welcome to %s!", {
-              postProcess: "sprintf",
-              sprintf: [
-                saltcorn.data.state.getState().getConfig("site_name") ||
-                  "Saltcorn",
-              ],
-            }),
-          },
-        ],
-      });
-      if (page.content) await replaceIframe(page.content, page.isFile);
-    } else if (loginResult?.alerts) {
-      showToasts(loginResult?.alerts);
-    } else {
-      throw new Error("The login failed.");
-    }
+    const config = saltcorn.data.state.getState().mobileConfig;
+    // no login needed for public, but a CSRF token is still cached upfront.
+    await refreshCsrfToken();
+    config.user = {
+      role_id: 100,
+      email: "public",
+      language: "en",
+    };
+    config.isPublicUser = true;
+    config.hasSession = true;
+    await persistSession(config);
+    i18next.changeLanguage(config.user.language);
+    addRoute({
+      route: entryPoint,
+      query: undefined,
+    });
+    const page = await router.resolve({
+      pathname: entryPoint,
+      fullWrap: true,
+      alerts: [
+        {
+          type: "success",
+          msg: i18next.t("Welcome to %s!", {
+            postProcess: "sprintf",
+            sprintf: [
+              saltcorn.data.state.getState().getConfig("site_name") ||
+                "Saltcorn",
+            ],
+          }),
+        },
+      ],
+    });
+    if (page.content) await replaceIframe(page.content, page.isFile);
   } catch (error) {
     console.error(error);
     showToasts([
@@ -203,9 +221,11 @@ export async function logout() {
     await tryStopBackgroundSync();
     const response = await apiCall({ method: "GET", path: "/auth/logout" });
     if (response.data.success) {
-      await removeJwt();
+      await clearSession();
       clearHistory();
-      config.jwt = undefined;
+      config.csrfToken = undefined;
+      config.hasSession = false;
+      config.isPublicUser = false;
       const page = await router.resolve({
         pathname: "get/auth/login",
         entryView: config.entry_point,
@@ -232,43 +252,34 @@ export async function insertUser({ id, email, role_id, language }) {
   );
 }
 
-export async function removeJwt() {
-  await saltcorn.data.db.deleteWhere("jwt_table");
+export async function clearSession() {
+  await saltcorn.data.db.deleteWhere("session_table");
 }
 
-export async function setJwt(jwt) {
-  await removeJwt();
-  await saltcorn.data.db.insert("jwt_table", { jwt: jwt });
-}
-
-async function renewJwt() {
-  try {
-    const response = await apiCall({
-      method: "POST",
-      path: "/auth/renew-jwt",
-    });
-    if (typeof response.data === "string") {
-      const config = saltcorn.data.state.getState().mobileConfig;
-      await setJwt(response.data);
-      config.jwt = response.data;
-    }
-  } catch (e) {
-    console.error("JWT renewal failed:", e.message);
-  }
+/**
+ * persists the current mobileConfig session state (csrf token, user,
+ * public/authenticated flag) so the app can restore it at next boot
+ * without a network call (used e.g. when starting offline).
+ */
+export async function persistSession(config) {
+  await clearSession();
+  await saltcorn.data.db.insert("session_table", {
+    csrfToken: config.csrfToken,
+    userJson: config.isPublicUser ? null : JSON.stringify(config.user),
+    isPublicUser: !!config.isPublicUser,
+  });
 }
 
-export async function checkJWT(jwtStr) {
-  if (jwtStr && jwtStr !== "undefined") {
-    const response = await apiCall({
-      method: "GET",
-      path: "/auth/authenticated",
-      timeout: 10000,
-    });
-    if (!response.data.authenticated) return false;
-    const decoded = jwtDecode(jwtStr);
-    if (decoded.exp && decoded.exp - Date.now() / 1000 < 7 * 24 * 3600) {
-      await renewJwt();
-    }
-    return true;
-  } else return false;
+/**
+ * checks with the server whether the current session cookie is still valid,
+ * and refreshes the cached CSRF token (its secret lives in the session, so
+ * it's fine to keep reusing the same token as long as the session is alive).
+ */
+export async function checkSession() {
+  const response = await apiCall({
+    method: "GET",
+    path: "/auth/authenticated",
+    timeout: 10000,
+  });
+  return !!response?.data?.authenticated;
 }

package/src/helpers/db_schema.js

@@ -1,7 +1,7 @@
 /*global saltcorn */
 
 const historyFile = "update_history";
-const jwtTableName = "jwt_table";
+const sessionTableName = "session_table";
 
 import { readFile, fileExists, writeJSON } from "./file_system";
 import { Directory } from "@capacitor/filesystem";
@@ -206,8 +206,10 @@ export async function updateDb(tablesJSON) {
   });
 }
 
-export async function createJwtTable() {
-  await saltcorn.data.db.query(`CREATE TABLE IF NOT EXISTS ${jwtTableName} (
-    jwt VARCHAR(500)
+export async function createSessionTable() {
+  await saltcorn.data.db.query(`CREATE TABLE IF NOT EXISTS ${sessionTableName} (
+    csrfToken VARCHAR(500),
+    userJson VARCHAR(2000),
+    isPublicUser BOOLEAN
   )`);
 }

package/src/helpers/file_system.js

@@ -1,4 +1,7 @@
 import { Filesystem, Encoding, Directory } from "@capacitor/filesystem";
+// side-effect only: registers the plugin so it works on the web platform too,
+// same as Filesystem above (native platforms pick it up either way)
+import "@capacitor/file-transfer";
 
 export async function writeFile(name, directory, content) {
   try {

package/src/helpers/offline_mode.js

@@ -59,11 +59,11 @@ const insertRemoteData = async (table, rows, syncTimestamp) => {
     const ref = _sync_info_tbl_ref_,
       last_modified = _sync_info_tbl_last_modified_;
     await saltcorn.data.db.insert(tblName, rest, { replace: true });
-    const infos = await saltcorn.data.db.select(
-      `${saltcorn.data.db.sqlsanitize(tblName)}_sync_info`,
-      {
-        ref: String(rest[pkName]),
-      }
+    // ref is inlined as a literal, not passed as a param, so numeric-looking
+    // refs like "19" don't get silently turned into "19.0" on iOS.
+    const { rows: infos } = await saltcorn.data.db.query(
+      `select 1 from "${saltcorn.data.db.sqlsanitize(tblName)}_sync_info"
+         where ref=${sqlRef(rest[pkName])}`
     );
     if (infos.length > 0) {
       await saltcorn.data.db.query(
@@ -72,14 +72,10 @@ const insertRemoteData = async (table, rows, syncTimestamp) => {
                where ref=${sqlRef(rest[pkName])}`
       );
     } else {
-      await saltcorn.data.db.insert(
-        `${saltcorn.data.db.sqlsanitize(tblName)}_sync_info`,
-        {
-          ref: String(ref),
-          last_modified: syncTimestamp,
-          deleted: false,
-          modified_local: false,
-        }
+      await saltcorn.data.db.query(
+        `insert into "${saltcorn.data.db.sqlsanitize(tblName)}_sync_info"
+           (ref, last_modified, deleted, modified_local)
+           values (${sqlRef(ref)}, ${syncTimestamp}, false, false)`
       );
     }
   }

package/src/index.js

@@ -1,4 +1,4 @@
-import { init } from "./init";
+import { init, postShare } from "./init";
 import * as api from "./helpers/api";
 import * as auth from "./helpers/auth";
 import * as common from "./helpers/common";
@@ -12,7 +12,7 @@ import { router } from "./routing/index";
 let notifications = undefined;
 try {
   notifications = require("./helpers/notifications");
-  console.log("Notifications module available");  
+  console.log("Notifications module available");
 } catch (err) {
   console.log("Notifications module not available");
 }
@@ -21,9 +21,8 @@ try {
 let backgroundSync = undefined;
 try {
   backgroundSync = require("./helpers/background_sync");
-  console.log("Background sync module available");  
-}
-catch (err) {
+  console.log("Background sync module available");
+} catch (err) {
   console.log("Background sync module not available");
 }
 
@@ -38,6 +37,7 @@ context.keys().forEach((key) => {
 
 export const mobileApp = {
   init,
+  postShare,
   api,
   auth,
   common,

package/src/init.js

@@ -11,9 +11,9 @@ import {
   createSyncInfoTables,
   dbUpdateNeeded,
   updateDb,
-  createJwtTable,
+  createSessionTable,
 } from "./helpers/db_schema.js";
-import { publicLogin, checkJWT } from "./helpers/auth.js";
+import { publicLogin, checkSession } from "./helpers/auth.js";
 import { router } from "./routing/index.js";
 import {
   replaceIframe,
@@ -30,7 +30,6 @@ import { readJSONCordova, readTextCordova } from "./helpers/file_system.js";
 
 import i18next from "i18next";
 import i18nextSprintfPostProcessor from "i18next-sprintf-postprocessor";
-import { jwtDecode } from "jwt-decode";
 
 import { Network } from "@capacitor/network";
 import { App } from "@capacitor/app";
@@ -152,19 +151,34 @@ const handlePluginHeaders = async (plugins) => {
   }
 };
 
-const getJwt = async () => {
-  const rows = await saltcorn.data.db.select("jwt_table");
-  return rows?.length > 0 ? rows[0].jwt : null;
+const getSession = async () => {
+  const rows = await saltcorn.data.db.select("session_table");
+  return rows?.length > 0 ? rows[0] : null;
 };
 
-const initJwt = async () => {
-  if (!(await saltcorn.data.db.tableExists("jwt_table"))) {
-    await createJwtTable();
+const initSession = async () => {
+  if (!(await saltcorn.data.db.tableExists("session_table"))) {
+    await createSessionTable();
   } else {
-    const jwt = await getJwt();
-    if (jwt) {
+    const row = await getSession();
+    if (row?.csrfToken) {
       const state = saltcorn.data.state.getState();
-      state.mobileConfig.jwt = jwt;
+      state.mobileConfig.csrfToken = row.csrfToken;
+      state.mobileConfig.isPublicUser = !!row.isPublicUser;
+      state.mobileConfig.hasSession = true;
+      if (row.isPublicUser) {
+        state.mobileConfig.user = {
+          role_id: 100,
+          email: "public",
+          language: "en",
+        };
+      } else if (row.userJson) {
+        try {
+          state.mobileConfig.user = JSON.parse(row.userJson);
+        } catch {
+          // corrupted local row, fall back to a network check
+        }
+      }
     }
   }
 };
@@ -210,7 +224,7 @@ const showErrorPage = async (error) => {
 const onResume = async () => {
   if (typeof saltcorn === "undefined") return;
   const mobileConfig = saltcorn.data.state.getState().mobileConfig;
-  if (mobileConfig?.jwt) {
+  if (mobileConfig?.hasSession) {
     const netStatus = await Network.getStatus();
     mobileConfig.networkState = netStatus.connectionType;
     if (
@@ -226,8 +240,8 @@ const onResume = async () => {
         await showErrorPage(error);
       }
     } else if (mobileConfig.networkState !== "none") {
-      if (!mobileConfig.isOfflineMode && !isPublicJwt(mobileConfig.jwt)) {
-        await checkJWT(mobileConfig.jwt);
+      if (!mobileConfig.isOfflineMode && !mobileConfig.isPublicUser) {
+        await checkSession();
       }
       if (mobileConfig.allowOfflineMode && mobileConfig.syncOnAppResume) {
         try {
@@ -240,21 +254,6 @@ const onResume = async () => {
   }
 };
 
-const isPublicJwt = (jwt) => {
-  try {
-    if (!jwt) return false;
-    const decoded = jwtDecode(jwt);
-    return decoded.sub === "public";
-  } catch (error) {
-    console.log(
-      `Unable to inspect '${jwt}': ${
-        error.message ? error.message : "Unknown error"
-      }`
-    );
-    return false;
-  }
-};
-
 const isPublicEntryPoint = async (entryPoint) => {
   if (!entryPoint) return false;
   try {
@@ -309,7 +308,7 @@ const notEmpty = (shareData) => {
   }
 };
 
-const postShare = async (shareData) => {
+export const postShare = async (shareData) => {
   const page = await router.resolve({
     pathname: "post/notifications/share",
     shareData,
@@ -390,7 +389,7 @@ export async function init(mobileConfig) {
       try {
         const url = event.url;
         if (url.startsWith("mobileapp://auth/callback")) {
-          const token = new URL(url).searchParams.get("token");
+          const token = new URL(url).searchParams.get("code");
           const method = new URL(url).searchParams.get("method");
           const methods = saltcorn.data.state.getState().auth_methods;
           if (!methods[method])
@@ -429,7 +428,7 @@ export async function init(mobileConfig) {
       await updateDb(tablesJSON);
     }
     await createSyncInfoTables(mobileConfig.synchedTables);
-    await initJwt();
+    await initSession();
     await state.refresh_tables();
     await state.refresh_views();
     await state.refresh_pages();
@@ -455,14 +454,16 @@ export async function init(mobileConfig) {
     Network.addListener("networkStatusChange", networkChangeCallback);
 
     const networkDisabled = state.mobileConfig.networkState === "none";
-    const jwt = state.mobileConfig.jwt;
+    const hasSession = !!state.mobileConfig.hasSession;
+    const isPublicUser = !!state.mobileConfig.isPublicUser;
     const alerts = [];
-    if ((networkDisabled && jwt) || (await checkJWT(jwt))) {
-      // already logged in, continue
+    if (
+      hasSession &&
+      !isPublicUser &&
+      (networkDisabled || (await checkSession()))
+    ) {
+      // already logged in, continue - mobileConfig.user was restored by initSession()
       const mobileConfig = state.mobileConfig;
-      const decodedJwt = jwtDecode(mobileConfig.jwt);
-      mobileConfig.user = decodedJwt.user;
-      mobileConfig.isPublicUser = false;
       await i18next.changeLanguage(mobileConfig.user.language);
       if (mobileConfig.allowOfflineMode) {
         const { offlineUser } = (await getLastOfflineSession()) || {};
@@ -536,11 +537,9 @@ export async function init(mobileConfig) {
         });
       }
       if (page.content) await replaceIframe(page.content, page.isFile);
-    } else if (isPublicJwt(jwt)) {
+    } else if (hasSession && isPublicUser) {
       // already logged in as public
       const config = state.mobileConfig;
-      config.user = { role_id: 100, email: "public", language: "en" };
-      config.isPublicUser = true;
       i18next.changeLanguage(config.user.language);
       const entryPoint = getEntryPoint(100, state, state.mobileConfig);
       if (!entryPoint) await showLogin(alerts);

package/src/routing/mocks/request.js

@@ -29,7 +29,7 @@ export function MobileRequest({
       }),
     isAuthenticated: () => {
       const mobileCfg = saltcorn.data.state.getState().mobileConfig;
-      return mobileCfg && mobileCfg.jwt && !mobileCfg.isPublicUser;
+      return mobileCfg && mobileCfg.hasSession && !mobileCfg.isPublicUser;
     },
     getLocale: () => {
       const mobileCfg = saltcorn.data.state.getState().mobileConfig;

package/src/routing/routes/notifications.js

@@ -3,7 +3,7 @@
 import { wrapContents } from "../utils";
 import { MobileRequest } from "../mocks/request";
 
-import { checkJWT } from "../../helpers/auth.js";
+import { checkSession } from "../../helpers/auth.js";
 import { apiCall } from "../../helpers/api";
 
 const buildErrMsg = (msg) => {
@@ -24,21 +24,45 @@ const buildSuccessMsg = (msg) => {
   );
 };
 
+// files have a real type (e.g. image/png); text/link shares are "text/plain"
+const isFileItem = (item) =>
+  item?.type && item.type !== "text/plain" && item.url;
+
 export const postShare = async (context) => {
   let content = "";
   const mobileCfg = saltcorn.data.state.getState().mobileConfig;
   if (mobileCfg.networkState === "none")
     content = buildErrMsg("No network connection");
-  else if (!(await checkJWT(mobileCfg.jwt)))
-    content = buildErrMsg("Not authenticated");
+  else if (!(await checkSession())) content = buildErrMsg("Not authenticated");
   else {
-    const response = await apiCall({
-      method: "POST",
-      path: "/notifications/share-handler",
-      body: context.shareData,
-    });
-    if (response.error) content = buildErrMsg(response.error);
-    else content = buildSuccessMsg("Shared successfully");
+    try {
+      const { title, description, type, url, additionalItems } =
+        context.shareData || {};
+      let body = context.shareData;
+      if (isFileItem({ type, url })) {
+        const items = [{ title, type, url }, ...(additionalItems || [])];
+        // title is the real on-disk filename, location is where to find it
+        const files = [];
+        for (const item of items) {
+          const uploaded = await saltcorn.data.models.File.uploadFromPath(
+            item.url,
+            item.title || "shared-file",
+            item.type
+          );
+          files.push({ title: uploaded.filename, location: uploaded.location });
+        }
+        body = { description, files };
+      }
+      const response = await apiCall({
+        method: "POST",
+        path: "/notifications/share-handler",
+        body,
+      });
+      if (response.error) content = buildErrMsg(response.error);
+      else content = buildSuccessMsg("Shared successfully");
+    } catch (error) {
+      content = buildErrMsg(error.message || "Error sharing");
+    }
   }
   return await wrapContents(
     saltcorn.markup.tags.div(