@superfan-app/spotify-auth 0.1.56 → 0.1.58

package/ios/SpotifyASWebAuthSession.swift

@@ -0,0 +1,100 @@
+import ExpoModulesCore
+import AuthenticationServices
+
+/// A lightweight wrapper around ASWebAuthenticationSession for Spotify OAuth
+final class SpotifyASWebAuthSession {
+    private var authSession: ASWebAuthenticationSession?
+    private var presentationContextProvider: ASWebAuthenticationPresentationContextProviding?
+    private var isAuthenticating = false
+    
+    private func secureLog(_ message: String) {
+        #if DEBUG
+        print("[SpotifyASWebAuth] \(message)")
+        #endif
+    }
+    
+    func startAuthFlow(
+        authUrl: URL,
+        redirectScheme: String?,
+        preferEphemeral: Bool = true,
+        completion: @escaping (Result<URL, Error>) -> Void
+    ) {
+        guard !isAuthenticating else {
+            completion(.failure(SpotifyAuthError.authorizationError("Authentication already in progress")))
+            return
+        }
+        
+        isAuthenticating = true
+        
+        // Create the auth session
+        authSession = ASWebAuthenticationSession(
+            url: authUrl,
+            callbackURLScheme: redirectScheme
+        ) { [weak self] callbackURL, error in
+            self?.isAuthenticating = false
+            
+            if let error = error {
+                if (error as NSError).code == ASWebAuthenticationSessionError.canceledLogin.rawValue {
+                    completion(.failure(SpotifyAuthError.userCancelled))
+                } else {
+                    completion(.failure(SpotifyAuthError.networkError(error.localizedDescription)))
+                }
+                return
+            }
+            
+            guard let callbackURL = callbackURL else {
+                completion(.failure(SpotifyAuthError.authorizationError("No callback URL received")))
+                return
+            }
+            
+            completion(.success(callbackURL))
+        }
+        
+        // Configure the session
+        authSession?.prefersEphemeralWebBrowserSession = preferEphemeral
+        
+        // Set up presentation context
+        let provider = PresentationContextProvider()
+        presentationContextProvider = provider
+        authSession?.presentationContextProvider = provider
+        
+        // Start the session
+        DispatchQueue.main.async { [weak self] in
+            guard let self = self, 
+                  let authSession = self.authSession,
+                  authSession.start() else {
+                self?.isAuthenticating = false
+                completion(.failure(SpotifyAuthError.authorizationError("Failed to start auth session")))
+                return
+            }
+            self.secureLog("Auth session started successfully")
+        }
+    }
+    
+    func cancel() {
+        authSession?.cancel()
+        isAuthenticating = false
+        authSession = nil
+        presentationContextProvider = nil
+    }
+}
+
+// MARK: - Presentation Context Provider
+
+private class PresentationContextProvider: NSObject, ASWebAuthenticationPresentationContextProviding {
+    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+        if #available(iOS 13.0, *) {
+            // Get the active window scene
+            let scene = UIApplication.shared.connectedScenes
+                .filter { $0.activationState == .foregroundActive }
+                .first(where: { $0 is UIWindowScene }) as? UIWindowScene
+            
+            // Get the key window from the scene
+            let keyWindow = scene?.windows.first(where: { $0.isKeyWindow })
+            return keyWindow ?? ASPresentationAnchor()
+        } else {
+            // Fallback for older iOS versions
+            return UIApplication.shared.keyWindow ?? ASPresentationAnchor()
+        }
+    }
+}

package/ios/SpotifyAuthAuth.swift

@@ -38,6 +38,9 @@ enum SpotifyAuthError: Error {
   case sessionError(String)
   case networkError(String)
   case recoverable(String, RetryStrategy)
+  case userCancelled
+  case authorizationError(String)
+  case invalidRedirectURL
   
   enum RetryStrategy {
     case none
@@ -74,6 +77,12 @@ enum SpotifyAuthError: Error {
       return "Network error: \(reason). Please check your internet connection."
     case .recoverable(let message, _):
       return message
+    case .userCancelled:
+      return "User cancelled the authentication process."
+    case .authorizationError(let reason):
+      return "Authorization error: \(reason). Please try logging in again."
+    case .invalidRedirectURL:
+      return "Invalid redirect URL. Please check your app.json configuration."
     }
   }
   
@@ -91,12 +100,12 @@ enum SpotifyAuthError: Error {
   }
 }
 
-final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate, SpotifyOAuthViewDelegate {
+final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate {
   /// A weak reference to our module's JS interface.
   weak var module: SpotifyAuthModule?
   
-  /// For web‑auth we present our own OAuth view.
-  private var webAuthView: SpotifyOAuthView?
+  /// For web‑auth we use ASWebAuthenticationSession
+  private var webAuthSession: SpotifyASWebAuthSession?
   private var isUsingWebAuth = false
   
   /// Stores the active configuration from JS.
@@ -416,20 +425,7 @@ final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate, SpotifyOAuthVi
             DispatchQueue.main.async { [weak self] in
                 guard let self = self else { return }
                 
-                let webView = SpotifyOAuthView(appContext: nil)
-                webView.delegate = self
-                self.webAuthView = webView
-                self.isUsingWebAuth = true
-                
-                webView.startOAuthFlow(
-                    clientId: clientId,
-                    redirectUri: redirectUrl.absoluteString,
-                    scopes: scopeStrings,
-                    showDialog: showDialog,
-                    campaign: campaign
-                )
-                
-                self.module?.presentWebAuth(webView)
+                self.initWebAuth(clientId: clientId, redirectUrl: redirectUrl, scopes: scopeStrings, showDialog: showDialog, campaign: campaign)
             }
         }
     } catch {
@@ -487,29 +483,19 @@ final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate, SpotifyOAuthVi
     module?.onSignOut()
   }
   
-  // MARK: - SpotifyOAuthViewDelegate
-  
-  func oauthView(_ view: SpotifyOAuthView, didReceiveCode code: String) {
-    // Exchange the code for tokens using tokenSwapURL.
-    exchangeCodeForToken(code)
-    cleanupWebAuth()
-  }
-  
-  func oauthView(_ view: SpotifyOAuthView, didFailWithError error: Error) {
-    handleError(error, context: "web_authentication")
-    cleanupWebAuth()
-  }
+  // MARK: - Web Auth Cancellation
   
-  func oauthViewDidCancel(_ view: SpotifyOAuthView) {
-    module?.onAuthorizationError(SpotifyAuthError.authenticationFailed("User cancelled authentication"))
+  func cancelWebAuth() {
+    webAuthSession?.cancel()
+    module?.onAuthorizationError(SpotifyAuthError.userCancelled)
     cleanupWebAuth()
   }
   
   private func cleanupWebAuth() {
     isUsingWebAuth = false
-    webAuthView = nil
+    webAuthSession?.cancel()
+    webAuthSession = nil
     currentConfig = nil
-    module?.dismissWebAuth()
   }
   
   /// Exchange an authorization code for tokens.
@@ -609,16 +595,6 @@ final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate, SpotifyOAuthVi
     task.resume()
   }
   
-  // MARK: - Web Auth Cancellation
-  
-  func webAuthViewDidCancel() {
-    guard let webView = webAuthView else {
-      module?.onAuthorizationError(SpotifyAuthError.sessionError("Web auth view not found"))
-      return
-    }
-    oauthViewDidCancel(webView)
-  }
-  
   // MARK: - Helpers
   
   private func stringToScope(scopeString: String) -> SPTScope? {
@@ -771,6 +747,75 @@ final class SpotifyAuthAuth: NSObject, SPTSessionManagerDelegate, SpotifyOAuthVi
       }
     }
   }
+  
+  private func initWebAuth(clientId: String, redirectUrl: URL, scopes: [String], showDialog: Bool, campaign: String?) {
+    guard var urlComponents = URLComponents(string: "https://accounts.spotify.com/authorize") else {
+      module?.onAuthorizationError(SpotifyAuthError.invalidRedirectURL)
+      return
+    }
+    
+    // Generate state for CSRF protection
+    let state = UUID().uuidString
+    
+    var queryItems = [
+      URLQueryItem(name: "client_id", value: clientId),
+      URLQueryItem(name: "response_type", value: "code"),
+      URLQueryItem(name: "redirect_uri", value: redirectUrl.absoluteString),
+      URLQueryItem(name: "state", value: state),
+      URLQueryItem(name: "scope", value: scopes.joined(separator: " ")),
+      URLQueryItem(name: "show_dialog", value: showDialog ? "true" : "false")
+    ]
+    
+    if let campaign = campaign {
+      queryItems.append(URLQueryItem(name: "campaign", value: campaign))
+    }
+    
+    urlComponents.queryItems = queryItems
+    
+    guard let authUrl = urlComponents.url else {
+      module?.onAuthorizationError(SpotifyAuthError.invalidRedirectURL)
+      return
+    }
+    
+    // Create and start web auth session
+    webAuthSession = SpotifyASWebAuthSession()
+    webAuthSession?.startAuthFlow(
+      authUrl: authUrl,
+      redirectScheme: redirectUrl.scheme,
+      preferEphemeral: true
+    ) { [weak self] result in
+      switch result {
+      case .success(let callbackURL):
+        guard let components = URLComponents(url: callbackURL, resolvingAgainstBaseURL: true),
+              let queryItems = components.queryItems else {
+          self?.module?.onAuthorizationError(SpotifyAuthError.invalidRedirectURL)
+          return
+        }
+        
+        // Verify state parameter to prevent CSRF attacks
+        guard let returnedState = queryItems.first(where: { $0.name == "state" })?.value,
+              returnedState == state else {
+          self?.module?.onAuthorizationError(SpotifyAuthError.stateMismatch)
+          return
+        }
+        
+        if let error = queryItems.first(where: { $0.name == "error" })?.value {
+          if error == "access_denied" {
+            self?.module?.onAuthorizationError(SpotifyAuthError.userCancelled)
+          } else {
+            self?.module?.onAuthorizationError(SpotifyAuthError.authorizationError(error))
+          }
+        } else if let code = queryItems.first(where: { $0.name == "code" })?.value {
+          self?.exchangeCodeForToken(code)
+        }
+        
+      case .failure(let error):
+        self?.module?.onAuthorizationError(error)
+      }
+      
+      self?.cleanupWebAuth()
+    }
+  }
 }
 
 // MARK: - Helper Extension

package/ios/SpotifyAuthModule.swift

@@ -75,15 +75,9 @@ public class SpotifyAuthModule: Module {
             }
         }
 
-        // Enables the module to be used as a native view.
-        View(SpotifyOAuthView.self) {
-            Events(spotifyAuthorizationEventName)
-            
-            Prop("name") { (_: SpotifyOAuthView, _: String) in
-                DispatchQueue.main.async {
-                    secureLog("View prop updated")
-                }
-            }
+        // Update the dismissal function
+        AsyncFunction("dismissAuthSession") {
+            self.spotifyAuth.cancelWebAuth()
         }
     }
 
@@ -272,49 +266,6 @@ public class SpotifyAuthModule: Module {
             return ("recoverable_error", "recoverable_unknown")
         }
     }
-
-    func presentWebAuth(_ webAuthView: SpotifyOAuthView) {
-        // Ensure we're on the main thread for all UI operations
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.presentWebAuth(webAuthView)
-            }
-            return
-        }
-        
-        guard let topViewController = UIApplication.shared.currentKeyWindow?.rootViewController?.topMostViewController() else {
-            onAuthorizationError(SpotifyAuthError.sessionError("Could not present web authentication"))
-            return
-        }
-        
-        // Create and configure container view controller
-        let containerVC = UIViewController()
-        containerVC.view = webAuthView
-        
-        // Create navigation controller and configure it
-        let navigationController = UINavigationController(rootViewController: containerVC)
-        navigationController.modalPresentationStyle = .fullScreen
-        
-        // Add cancel button
-        let cancelButton = UIBarButtonItem(barButtonSystemItem: .cancel, target: self, action: #selector(dismissWebAuthWithCancel))
-        containerVC.navigationItem.leftBarButtonItem = cancelButton
-        containerVC.navigationItem.title = "Spotify Login"
-        
-        // Present the web auth view
-        topViewController.present(navigationController, animated: true, completion: nil)
-    }
-    
-    @objc private func dismissWebAuthWithCancel() {
-        spotifyAuth.webAuthViewDidCancel()
-        dismissWebAuth()
-    }
-    
-    func dismissWebAuth() {
-        // Find and dismiss the web auth view controller
-        DispatchQueue.main.async {
-            UIApplication.shared.currentKeyWindow?.rootViewController?.topMostViewController().dismiss(animated: true)
-        }
-    }
 }
 
 // Helper extension to find top-most view controller

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superfan-app/spotify-auth",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "description": "Spotify OAuth module for Expo",
   "main": "src/index.tsx",
   "types": "build/index.d.ts",

package/ios/SpotifyOAuthView.swift

@@ -1,379 +0,0 @@
-import ExpoModulesCore
-import WebKit
-
-protocol SpotifyOAuthViewDelegate: AnyObject {
-    func oauthView(_ view: SpotifyOAuthView, didReceiveCode code: String)
-    func oauthView(_ view: SpotifyOAuthView, didFailWithError error: Error)
-    func oauthViewDidCancel(_ view: SpotifyOAuthView)
-}
-
-enum SpotifyOAuthError: Error {
-    case invalidRedirectURL
-    case stateMismatch
-    case timeout
-    case userCancelled
-    case networkError(Error)
-    case authorizationError(String)
-    
-    var localizedDescription: String {
-        switch self {
-        case .invalidRedirectURL:
-            return "Invalid redirect URL"
-        case .stateMismatch:
-            return "State mismatch - possible CSRF attack"
-        case .timeout:
-            return "Authentication timed out"
-        case .userCancelled:
-            return "User cancelled authentication"
-        case .networkError(let error):
-            return "Network error: \(error.localizedDescription)"
-        case .authorizationError(let message):
-            return "Authorization error: \(message)"
-        }
-    }
-}
-
-// This view will be used as a native component for web-based OAuth when Spotify app isn't installed
-class SpotifyOAuthView: ExpoView {
-    weak var delegate: SpotifyOAuthViewDelegate?
-    private var webView: WKWebView!
-    private let state: String
-    private var isAuthenticating = false
-    private var expectedRedirectScheme: String?
-    private var authTimeout: Timer?
-    private static let authTimeoutInterval: TimeInterval = 300 // 5 minutes
-    private var observerToken: NSKeyValueObservation?
-    
-    private func secureLog(_ message: String) {
-        #if DEBUG
-        print("[SpotifyOAuthView] \(message)")
-        #endif
-    }
-    
-    required init(appContext: AppContext? = nil) {
-        // Generate a random state string for CSRF protection
-        self.state = UUID().uuidString
-        super.init(appContext: appContext)
-        secureLog("Initializing SpotifyOAuthView with state: \(String(state.prefix(8)))...")
-        setupWebView()
-    }
-    
-    required init?(coder: NSCoder) {
-        fatalError("init(coder:) has not been implemented")
-    }
-    
-    override func layoutSubviews() {
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.layoutSubviews()
-            }
-            return
-        }
-        super.layoutSubviews()
-    }
-    
-    override func didMoveToWindow() {
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.didMoveToWindow()
-            }
-            return
-        }
-        super.didMoveToWindow()
-    }
-    
-    override func didMoveToSuperview() {
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.didMoveToSuperview()
-            }
-            return
-        }
-        super.didMoveToSuperview()
-    }
-    
-    private func setupWebView() {
-        // Ensure we're on the main thread for UI setup
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.setupWebView()
-            }
-            return
-        }
-
-        secureLog("Setting up WebView configuration...")
-        // Create a configuration that prevents data persistence
-        let config: WKWebViewConfiguration = {
-            let configuration = WKWebViewConfiguration()
-            configuration.processPool = WKProcessPool() // Create a new process pool
-            let prefs = WKWebpagePreferences()
-            prefs.allowsContentJavaScript = true
-            configuration.defaultWebpagePreferences = prefs
-            
-            // Ensure cookies and data are not persisted
-            let dataStore = WKWebsiteDataStore.nonPersistent()
-            configuration.websiteDataStore = dataStore
-            self.secureLog("WebView configuration created with non-persistent data store")
-            return configuration
-        }()
-
-        // Initialize webview with error handling
-        do {
-            webView = WKWebView(frame: .zero, configuration: config)
-            guard webView != nil else {
-                throw NSError(domain: "SpotifyAuth", code: -1, userInfo: [NSLocalizedDescriptionKey: "Failed to initialize WebView"])
-            }
-            self.secureLog("WebView successfully initialized")
-            
-            webView.navigationDelegate = self
-            webView.allowsBackForwardNavigationGestures = true
-            webView.customUserAgent = "SpotifyAuth-iOS/1.0"
-            
-            // Create UI elements
-            let activityIndicator = UIActivityIndicatorView(style: .medium)
-            activityIndicator.translatesAutoresizingMaskIntoConstraints = false
-            activityIndicator.hidesWhenStopped = true
-            
-            // Perform all UI operations in a single block
-            DispatchQueue.main.async { [weak self] in
-                guard let self = self else { return }
-                
-                self.addSubview(self.webView)
-                self.addSubview(activityIndicator)
-                
-                // Setup constraints
-                self.webView.translatesAutoresizingMaskIntoConstraints = false
-                NSLayoutConstraint.activate([
-                    self.webView.topAnchor.constraint(equalTo: self.topAnchor),
-                    self.webView.leadingAnchor.constraint(equalTo: self.leadingAnchor),
-                    self.webView.trailingAnchor.constraint(equalTo: self.trailingAnchor),
-                    self.webView.bottomAnchor.constraint(equalTo: self.bottomAnchor),
-                    
-                    activityIndicator.centerXAnchor.constraint(equalTo: self.centerXAnchor),
-                    activityIndicator.centerYAnchor.constraint(equalTo: self.centerYAnchor)
-                ])
-                
-                // Setup modern KVO observation
-                self.observerToken = self.webView.observe(\.isLoading, options: [.new]) { [weak self] _, _ in
-                    DispatchQueue.main.async {
-                        if let activityIndicator = self?.subviews.first(where: { $0 is UIActivityIndicatorView }) as? UIActivityIndicatorView {
-                            if self?.webView.isLoading == true {
-                                activityIndicator.startAnimating()
-                            } else {
-                                activityIndicator.stopAnimating()
-                            }
-                        }
-                    }
-                }
-            }
-        } catch {
-            secureLog("Failed to setup WebView: \(error.localizedDescription)")
-            DispatchQueue.main.async { [weak self] in
-                guard let self = self else { return }
-                self.delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.authorizationError("Failed to initialize web view"))
-            }
-        }
-    }
-    
-    func startOAuthFlow(clientId: String, redirectUri: String, scopes: [String], showDialog: Bool = false, campaign: String? = nil) {
-        // Ensure we're on the main thread - WebView setup must be done on the main thread
-        if !Thread.isMainThread {
-            DispatchQueue.main.async { [weak self] in
-                self?.startOAuthFlow(clientId: clientId, redirectUri: redirectUri, scopes: scopes, showDialog: showDialog, campaign: campaign)
-            }
-            return
-        }
-
-        guard !isAuthenticating else { return }
-        isAuthenticating = true
-        
-        // Extract and store the redirect scheme
-        guard let url = URL(string: redirectUri),
-              let scheme = url.scheme else {
-            delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.invalidRedirectURL)
-            return
-        }
-        expectedRedirectScheme = scheme
-        
-        // Start auth timeout timer
-        startAuthTimeout()
-        
-        // Clear any existing cookies/data to ensure a fresh login
-        // Wait for completion before initiating the auth request
-        WKWebsiteDataStore.default().removeData(
-            ofTypes: [WKWebsiteDataTypeCookies, WKWebsiteDataTypeSessionStorage],
-            modifiedSince: Date(timeIntervalSince1970: 0)
-        ) { [weak self] in
-            // Ensure we're still in a valid state after the async operation
-            guard let self = self, self.isAuthenticating else { return }
-            
-            DispatchQueue.main.async {
-                self.initiateAuthRequest(
-                    clientId: clientId,
-                    redirectUri: redirectUri,
-                    scopes: scopes,
-                    showDialog: showDialog,
-                    campaign: campaign
-                )
-            }
-        }
-    }
-    
-    private func startAuthTimeout() {
-        authTimeout?.invalidate()
-        authTimeout = Timer.scheduledTimer(withTimeInterval: Self.authTimeoutInterval, repeats: false) { [weak self] _ in
-            self?.handleTimeout()
-        }
-    }
-    
-    private func handleTimeout() {
-        delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.timeout)
-        cleanup()
-    }
-    
-    private func cleanup() {
-        secureLog("Cleaning up authentication session")
-        isAuthenticating = false
-        authTimeout?.invalidate()
-        authTimeout = nil
-        expectedRedirectScheme = nil
-        
-        // Clear web view data
-        WKWebsiteDataStore.default().removeData(
-            ofTypes: [WKWebsiteDataTypeCookies, WKWebsiteDataTypeSessionStorage],
-            modifiedSince: Date(timeIntervalSince1970: 0)
-        ) { }
-    }
-    
-    private func initiateAuthRequest(clientId: String, redirectUri: String, scopes: [String], showDialog: Bool, campaign: String?) {
-        guard var urlComponents = URLComponents(string: "https://accounts.spotify.com/authorize") else {
-            isAuthenticating = false
-            delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.invalidRedirectURL)
-            return
-        }
-        
-        // Verify webView is properly initialized
-        guard let webView = self.webView else {
-            secureLog("Error: WebView not initialized when attempting to load auth request")
-            isAuthenticating = false
-            delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.authorizationError("WebView not initialized"))
-            return
-        }
-        
-        var queryItems = [
-            URLQueryItem(name: "client_id", value: clientId),
-            URLQueryItem(name: "response_type", value: "code"),
-            URLQueryItem(name: "redirect_uri", value: redirectUri),
-            URLQueryItem(name: "state", value: state),
-            URLQueryItem(name: "scope", value: scopes.joined(separator: " ")),
-            URLQueryItem(name: "show_dialog", value: showDialog ? "true" : "false")
-        ]
-        
-        if let campaign = campaign {
-            queryItems.append(URLQueryItem(name: "campaign", value: campaign))
-        }
-        
-        urlComponents.queryItems = queryItems
-        
-        guard let url = urlComponents.url else {
-            isAuthenticating = false
-            delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.invalidRedirectURL)
-            return
-        }
-        
-        let request = URLRequest(url: url, cachePolicy: .reloadIgnoringLocalAndRemoteCacheData)
-        secureLog("Initiating auth request to URL: \(url.absoluteString)")
-        
-        DispatchQueue.main.async {
-            guard Thread.isMainThread else {
-                assertionFailure("WebView load not on main thread despite DispatchQueue.main.async")
-                return
-            }
-            
-            if webView.isLoading {
-                self.secureLog("Warning: WebView is already loading content, stopping previous load")
-                webView.stopLoading()
-            }
-            
-            webView.load(request)
-            self.secureLog("Auth request load initiated")
-        }
-    }
-    
-    deinit {
-        observerToken?.invalidate()
-        authTimeout?.invalidate()
-    }
-}
-
-extension SpotifyOAuthView: WKNavigationDelegate {
-    func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
-        guard let url = navigationAction.request.url else {
-            decisionHandler(.allow)
-            return
-        }
-        
-        // Check if the URL matches our redirect URI scheme
-        if let expectedScheme = expectedRedirectScheme,
-           url.scheme == expectedScheme {
-            guard let components = URLComponents(url: url, resolvingAgainstBaseURL: true),
-                  let queryItems = components.queryItems else {
-                decisionHandler(.cancel)
-                return
-            }
-            
-            // Verify state parameter to prevent CSRF attacks
-            guard let returnedState = queryItems.first(where: { $0.name == "state" })?.value,
-                  returnedState == state else {
-                delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.stateMismatch)
-                decisionHandler(.cancel)
-                cleanup()
-                return
-            }
-            
-            cleanup()
-            
-            if let error = queryItems.first(where: { $0.name == "error" })?.value {
-                if error == "access_denied" {
-                    delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.userCancelled)
-                } else {
-                    delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.authorizationError(error))
-                }
-            } else if let code = queryItems.first(where: { $0.name == "code" })?.value {
-                delegate?.oauthView(self, didReceiveCode: code)
-            }
-            
-            decisionHandler(.cancel)
-            return
-        }
-        
-        // Only allow navigation to Spotify domains and our redirect URI
-        let allowedDomains = ["accounts.spotify.com", "spotify.com"]
-        if let host = url.host,
-           allowedDomains.contains(where: { host.hasSuffix($0) }) {
-            decisionHandler(.allow)
-        } else {
-            decisionHandler(.cancel)
-        }
-    }
-    
-    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-        delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.networkError(error))
-        cleanup()
-    }
-    
-    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
-        delegate?.oauthView(self, didFailWithError: SpotifyOAuthError.networkError(error))
-        cleanup()
-    }
-    
-    func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
-        // Ensure proper SSL/TLS handling
-        if let serverTrust = challenge.protectionSpace.serverTrust {
-            let credential = URLCredential(trust: serverTrust)
-            completionHandler(.useCredential, credential)
-        } else {
-            completionHandler(.cancelAuthenticationChallenge, nil)
-        }
-    }
-}