@tokamakdev/platform-ios-simulator-arm64 0.1.1-beta.44 → 0.1.1-beta.45

package/ios-simulator-arm64/build/entrypoint

@@ -80,6 +80,7 @@ sign_bundle() {
   if [[ "$platform" == ios ]]; then
     signing_args=(
       sign
+      --platform ios
       --project "$project_dir"
       --bundle "$bundle"
       --bundle-id "$identifier"
@@ -88,7 +89,15 @@ sign_bundle() {
       signing_args+=(--device-id "$(cat "$metadata/device-id")")
     fi
     "$apple_tool" "${signing_args[@]}"
+  elif [[ "$platform" == macos && -n "${TOKAMAK_MACOS_TEAM_ID:-}" ]]; then
+    "$apple_tool" sign \
+      --platform macos \
+      --project "$project_dir" \
+      --bundle "$bundle" \
+      --bundle-id "$identifier"
   else
+    # Ad-hoc signatures carry no provisioning profile.
+    rm -f "$contents/embedded.provisionprofile"
     codesign --force --timestamp=none --sign - "$bundle"
   fi
 }
@@ -111,7 +120,7 @@ if [[ -f "$metadata/input-key" ]]; then
         shasum -a 256 "$plist_path"
       fi
       env | LC_ALL=C sort | sed -n '/^TOKAMAK_/p' |
-        sed '/^TOKAMAK_IOS_TEAM_ID=/d; /^TOKAMAK_IOS_SIGNING_IDENTITY=/d; /^TOKAMAK_IOS_PROVISIONING_PROFILE=/d; /^TOKAMAK_IOS_BUILD_NUMBER=/d; /^TOKAMAK_MACOS_BUILD_NUMBER=/d'
+        sed '/^TOKAMAK_IOS_TEAM_ID=/d; /^TOKAMAK_IOS_SIGNING_IDENTITY=/d; /^TOKAMAK_IOS_PROVISIONING_PROFILE=/d; /^TOKAMAK_MACOS_TEAM_ID=/d; /^TOKAMAK_IOS_BUILD_NUMBER=/d; /^TOKAMAK_MACOS_BUILD_NUMBER=/d'
       printf '%s\n' "${DEVELOPER_DIR:-}" "$PATH"
       xcodebuild -version
     } | shasum -a 256 | cut -d ' ' -f 1
@@ -213,6 +222,27 @@ for plugin in "$input/plugins"/*; do
   done
 done
 
+# Simulator builds embed application-identifier and keychain-access-groups in
+# __TEXT,__entitlements, where the simulator reads them.
+if [[ "$platform" == ios-simulator ]]; then
+  simulator_entitlements=$temporary/simulator.entitlements
+  cat > "$simulator_entitlements" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>application-identifier</key>
+  <string>$identifier</string>
+  <key>keychain-access-groups</key>
+  <array>
+    <string>$identifier</string>
+  </array>
+</dict>
+</plist>
+EOF
+  swift_args+=(-Xlinker -sectcreate -Xlinker __TEXT -Xlinker __entitlements -Xlinker "$simulator_entitlements")
+fi
+
 xcrun --sdk "$sdk" swiftc "${swift_args[@]}" -o "$executable_dir/$app_slug"
 xcrun --sdk "$sdk" strip "$executable_dir/$app_slug"
 

package/ios-simulator-arm64/native-shell/TokamakOrigin.swift

@@ -0,0 +1,20 @@
+import Foundation
+import WebKit
+
+extension URL {
+  /// Whether this URL is on the app origin, `https://<host>`.
+  func isAppOrigin(_ host: String) -> Bool {
+    scheme?.caseInsensitiveCompare("https") == .orderedSame
+      && self.host?.caseInsensitiveCompare(host) == .orderedSame
+      && (port == nil || port == 443)
+  }
+}
+
+extension WKSecurityOrigin {
+  /// Whether this is the app origin, `https://<host>`.
+  func isAppOrigin(_ host: String) -> Bool {
+    self.protocol.caseInsensitiveCompare("https") == .orderedSame
+      && self.host.caseInsensitiveCompare(host) == .orderedSame
+      && (port == 0 || port == 443)
+  }
+}

package/ios-simulator-arm64/native-shell/TokamakPlugins.swift

@@ -91,12 +91,9 @@ final class TokamakPluginBridge: NSObject, WKScriptMessageHandler {
     _ userContentController: WKUserContentController,
     didReceive message: WKScriptMessage
   ) {
-    let origin = message.frameInfo.securityOrigin
     guard
       message.frameInfo.isMainFrame,
-      origin.protocol == "https",
-      origin.host == host,
-      origin.port == 0 || origin.port == 443,
+      message.frameInfo.securityOrigin.isAppOrigin(host),
       let encoded = message.body as? String,
       let data = encoded.data(using: .utf8),
       let request = try? JSONSerialization.jsonObject(with: data)
@@ -160,10 +157,21 @@ final class TokamakPluginBridge: NSObject, WKScriptMessageHandler {
     }
   }
 
+  /// Plugins reply from any thread; delivery happens on the main thread.
   private func send(
     key: RequestKey,
     result: Result<Any?, TokamakPluginError>,
     done: Bool
+  ) {
+    DispatchQueue.main.async { [weak self] in
+      self?.deliver(key: key, result: result, done: done)
+    }
+  }
+
+  private func deliver(
+    key: RequestKey,
+    result: Result<Any?, TokamakPluginError>,
+    done: Bool
   ) {
     if done {
       cancellations.removeValue(forKey: key)?()
@@ -182,23 +190,12 @@ final class TokamakPluginBridge: NSObject, WKScriptMessageHandler {
     guard
       JSONSerialization.isValidJSONObject(response),
       let data = try? JSONSerialization.data(withJSONObject: response),
-      let json = String(data: data, encoding: .utf8)
+      let json = String(data: data, encoding: .utf8),
+      webView?.url?.isAppOrigin(host) == true
     else {
       return
     }
-    DispatchQueue.main.async { [weak self] in
-      guard
-        let self,
-        self.webView?.url?.scheme == "https",
-        self.webView?.url?.host == self.host,
-        self.webView?.url?.port == nil || self.webView?.url?.port == 443
-      else {
-        return
-      }
-      self.webView?.evaluateJavaScript(
-        "globalThis.__tokamakReceive?.(\(json))"
-      )
-    }
+    webView?.evaluateJavaScript("globalThis.__tokamakReceive?.(\(json))")
   }
 
   private static func bootstrap(host: String) -> String {

package/ios-simulator-arm64/native-shell/TokamakShell.swift

@@ -239,7 +239,7 @@ private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDele
       return
     }
 
-    if isAppOrigin(url) {
+    if url.isAppOrigin(runtime.host) {
       if navigationAction.targetFrame == nil {
         webView.load(navigationAction.request)
         decisionHandler(.cancel)
@@ -266,7 +266,7 @@ private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDele
       return
     }
 
-    if isAppOrigin(url) {
+    if url.isAppOrigin(runtime.host) {
       decisionHandler(.allow)
     } else {
       openExternal(url)
@@ -282,7 +282,7 @@ private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDele
   ) -> WKWebView? {
     _ = (configuration, windowFeatures)
     guard let url = navigationAction.request.url else { return nil }
-    if isAppOrigin(url) {
+    if url.isAppOrigin(runtime.host) {
       webView.load(navigationAction.request)
     } else {
       openExternal(url)
@@ -290,6 +290,18 @@ private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDele
     return nil
   }
 
+  /// The app's own usage descriptions cover its origin; other origins keep
+  /// WebKit's prompt.
+  func webView(
+    _ webView: WKWebView,
+    requestMediaCapturePermissionFor origin: WKSecurityOrigin,
+    initiatedByFrame frame: WKFrameInfo,
+    type: WKMediaCaptureType,
+    decisionHandler: @escaping (WKPermissionDecision) -> Void
+  ) {
+    decisionHandler(origin.isAppOrigin(runtime.host) ? .grant : .prompt)
+  }
+
   func webView(
     _ webView: WKWebView,
     didReceive challenge: URLAuthenticationChallenge,
@@ -328,16 +340,6 @@ private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDele
     print("tokamak WebView navigation failed: \(error)")
   }
 
-  private func isAppOrigin(_ url: URL) -> Bool {
-    guard
-      url.scheme?.caseInsensitiveCompare("https") == .orderedSame,
-      url.host?.caseInsensitiveCompare(runtime.host) == .orderedSame
-    else {
-      return false
-    }
-    return url.port == nil || url.port == 443
-  }
-
   private func openExternal(_ url: URL) {
     #if os(iOS)
       UIApplication.shared.open(url)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamakdev/platform-ios-simulator-arm64",
-  "version": "0.1.1-beta.44",
+  "version": "0.1.1-beta.45",
   "description": "The tokamak platform pack for ios-simulator-arm64",
   "repository": {
     "type": "git",