capacitor-native-google-one-tap-signin 0.2.0 → 0.3.0

package/CapacitorNativeGoogleOneTapSignin.podspec

@@ -1,16 +1,17 @@
+require 'json'
 
-  Pod::Spec.new do |s|
-    s.name = 'CapacitorNativeGoogleOneTapSignin'
-    s.version = '0.0.1'
-    s.summary = 'Google One Tap sign-in plugin for capacitor.'
-    s.license = 'MIT'
-    s.homepage = 'https://github.com/inouiw/capacitor-native-google-one-tap-signin'
-    s.author = 'David Neuy'
-    s.source = { :git => 'https://github.com/inouiw/capacitor-native-google-one-tap-signin.git', :tag => s.version.to_s }
-    s.source_files = 'ios/Plugin/**/*.{swift,h,m,c,cc,mm,cpp}'
-    s.ios.deployment_target  = '12.0'
-    s.dependency 'Capacitor'
-    s.dependency 'GoogleSignIn', '~> 6.2.4'
-    s.static_framework = true,
-    s.swift_version = '5.1'
-  end
+package = JSON.parse(File.read(File.join(__dir__, 'package.json')))
+  
+Pod::Spec.new do |s|
+  s.name = 'CapacitorNativeGoogleOneTapSignin'
+  s.version = package['version']
+  s.summary = package['description']
+  s.license = package['license']
+  s.homepage = package['repository']['url']
+  s.author = package['author']
+  s.source = { :git => package['repository']['url'], :tag => s.version.to_s }
+  s.source_files = 'ios/Plugin/**/*.{swift,h,m,c,cc,mm,cpp}'
+  s.ios.deployment_target  = '13.0'
+  s.dependency 'Capacitor'
+  s.swift_version = '5.1'
+end

package/README.md

@@ -2,17 +2,21 @@
 
 Wraps the native android One Tap api for ionic capacitor apps. One Tap Sign In is part of Sign in with Google and offers features as automatic sign-in on return visits.
 
+This library intends to provide the best google authentication experience for each platform.
+
 <img src="screenshots/one-tap-sign-in-demo-initial-sign-in.jpg" alt="One tap signin screenshot initial sign-in" width=250/>
 <img src="screenshots/one-tap-sign-in-demo-sign-back-in.jpg" alt="One tap signin screenshot sign back in" width=250/>
 <img src="screenshots/one-tap-sign-in-demo-without-filter-by-authorized-acounts.jpg" alt="One tap signin screenshot without filter by authorized accounts" width=250/>
 
 
-Currently the idToken, id (e-mail), displayName, givenName, familyName, profilePictureUri are returned. You may check the idToken contents on https://jwt.io/.
+After a successful authentication, the idToken is returned as base64 and as object.
 
 The user is automatically signed-in, without a prompt after the first sign-in.
 
-API version 29 or higher seems to be required for one-tap sign-in to work.
+The andorid minSdkVersion is 24, however the one-tap library seems to require API version 29. For lower API versions GoogleSignIn is used.
 
+# Supported platforms
+Android, iOS, Web.
 
 # Demos
 See the `demo` folder.
@@ -20,7 +24,50 @@ See the `demo` folder.
 # Setup
 You need to provide the plug-in a client ID of type "Web application". However you will also need to create a client ID of type "Android" as stated in the [One Tap Get started docu](https://developers.google.cn/identity/one-tap/android/get-started) in the [Google Cloud Console](https://console.cloud.google.com/apis/dashboard).
 
-To test it using an emulator, you need to create an emulator with android play services and API version 29 or higher. See [my stackoverflow answer](https://stackoverflow.com/questions/71325279/missing-featurename-auth-api-credentials-begin-sign-in-version-6/75285717#75285717).
+To test it using an emulator, you need to create an emulator with android play services and API version 24 or higher. See [my stackoverflow answer](https://stackoverflow.com/questions/71325279/missing-featurename-auth-api-credentials-begin-sign-in-version-6/75285717#75285717). For older API levels like 24, you may need to update Chrome after creating the emulator because the plugin targets JavaScript es2017.
+
+# Usage recommendation
+
+For web, it will auto-sign in even if the user signs out.
+For android, after sign-out sill be able to add another google account.
+
+# Detailed description of different use cases
+
+See https://developers.google.com/identity/gsi/web/guides/features
+
+# Exposed api
+See `src/definitions.ts` for a complete definition.
+
+```TypeScript
+/**
+ * For the web platform, starts pre-loading the google one tap JavaScript library.
+ * @param options 
+ */
+initialize(options: InitializeOptions): Promise<void>;
+/**
+ * Tries to auto-sign in the user.
+ * If there is a single google account and that account has previously signed into the app, then that user is auto signed in. A short popover is displayed during sign-in.
+ * If there are multiple google accounts and more than one have previously signed into the app then a user selection screen is shown.
+ * If there is no active google session or if no user session has logged in previously in the app or if the user has opt out of One Tap, the auto sign-in will fail.
+ * See https://developers.google.com/identity/gsi/web/guides/features
+ */
+tryAutoSignIn(): Promise<SignInResult>;
+/**
+ * 
+ * @param parentElementId 
+ * @param options 
+ * @param gsiButtonConfiguration Not all button configuration options are supported on android.
+ */
+renderSignInButton(parentElementId: string, options: RenderSignInButtonOptions, gsiButtonConfiguration?: google.GsiButtonConfiguration): Promise<SignInResult>;
+/**
+ * Ends the session.
+ */
+signOut(): Promise<SignOutResult>;
+/**
+ * Gets the last user defined or auto-created nonce.
+ */
+getNonce(): string;
+```
 
 # Design decisions
 Promises will not be rejected for anticipated unsuccessful control flow. For example, if the one tap auto-login does not succeed with the reason `opt_out_or_no_session` then this is not exceptional but expected in many cases. Rejecting the promise would mean the caller would have to catch an exception when calling `await xy` and then run follow-up code in the catch block. Instead of rejecting promises the resolved promise contains a `isSuccess` property.
@@ -44,9 +91,18 @@ npx cap update
 
 ## Usage
 
-### Android
+```TypeScript
+import { GoogleOneTapAuth, SignInResult } from 'capacitor-native-google-one-tap-signin';
 
-todo
+await GoogleOneTapAuth.initialize({ clientId: clientId });
+let signInResult = await GoogleOneTapAuth.tryAutoSignIn();
+if (!signInResult.isSuccess) {
+  signInResult = await GoogleOneTapAuth.renderSignInButton('appleid-signin', {}, { locale: 'en-us', theme: 'outline', text: 'continue_with', shape: 'rectangular' });
+}
+console.log(signInResult);
+
+// See the demo folder for an example application.
+```
 
 ## License
 

package/android/build.gradle

@@ -4,7 +4,7 @@ buildscript {
         google()
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:7.2.1'
+        classpath 'com.android.tools.build:gradle:7.4.0'
         classpath 'com.google.gms:google-services:4.3.13'
     }
 }
@@ -14,7 +14,7 @@ apply plugin: 'com.android.library'
 android {
     compileSdkVersion 31
     defaultConfig {
-        minSdkVersion 29
+        minSdkVersion 24
         targetSdkVersion 31
         versionCode 1
         versionName "1.0"
@@ -51,5 +51,6 @@ dependencies {
     implementation 'com.google.android.gms:play-services-auth:20.4.1'
     implementation 'com.google.android.gms:play-services-tasks:18.0.2'
     implementation 'com.google.android.gms:play-services-base:18.0.1'
+    implementation 'org.json:json:20220924'
 }
 

package/android/src/main/java/com/proventask/capacitor/GoogleOneTapAuth/GoogleOneTapAuth.java

@@ -14,39 +14,65 @@ import com.getcapacitor.JSObject;
 import com.getcapacitor.Plugin;
 import com.getcapacitor.PluginCall;
 import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.ActivityCallback;
 import com.getcapacitor.annotation.CapacitorPlugin;
 import com.google.android.gms.auth.api.identity.BeginSignInRequest;
 import com.google.android.gms.auth.api.identity.Identity;
 import com.google.android.gms.auth.api.identity.SignInClient;
+import com.google.android.gms.auth.api.signin.GoogleSignIn;
+import com.google.android.gms.auth.api.signin.GoogleSignInAccount;
+import com.google.android.gms.auth.api.signin.GoogleSignInClient;
+import com.google.android.gms.auth.api.signin.GoogleSignInOptions;
+import com.google.android.gms.auth.api.signin.GoogleSignInStatusCodes;
 import com.google.android.gms.common.ConnectionResult;
 import com.google.android.gms.common.GoogleApiAvailability;
 import com.google.android.gms.common.api.ApiException;
+import com.google.android.gms.tasks.Task;
+
+import org.json.JSONException;
+import org.json.JSONObject;
 
-import java.util.Base64;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Future;
 
 @CapacitorPlugin()
 public class GoogleOneTapAuth extends Plugin {
+    private enum SignInMethod {NotSignedIn, OneTap, GoogleSignIn}
     private static final String TAG = "GoogleOneTapAuth Plugin";
     private String clientId;
+    private String nonce;
     private SignInClient oneTapClient;
+    private GoogleSignInClient googleSignInClient;
     private ActivityResultLauncher<IntentSenderRequest> googleOneTapSignInActivityResultHandlerIntentSenderRequest;
-    private CompletableFuture<JSObject> signInFuture;
+    private CompletableFuture<JSObject> oneTapSignInFuture;
+    private CompletableFuture<JSObject> googleSignInFuture;
+    private SignInMethod signInMethod = SignInMethod.NotSignedIn;
 
     @Override
     public void load() {
-        clientId = getConfig().getString("clientId");
+        registerSignInResultHandler();
+    }
 
-        if (clientId == null || clientId.endsWith("apps.googleusercontent.com") == false) {
-            throw new RuntimeException("clientId must end with 'apps.googleusercontent.com' but is: " + clientId + ". Check capacitor.config.ts.");
-        }
+    @PluginMethod()
+    public void initialize(PluginCall call) {
+        initializeOptionsFromCall(call);
         oneTapClient = Identity.getSignInClient(this.getActivity());
-        RegisterSignInResultHandler();
+
+        var gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
+                .requestEmail()
+                .requestIdToken(clientId)
+                .build();
+        googleSignInClient = GoogleSignIn.getClient(this.getActivity(), gso);
+        call.resolve();
     }
 
-    private void RegisterSignInResultHandler() {
+    private void initializeOptionsFromCall(PluginCall call) {
+        clientId = call.getString("clientId");
+        nonce = call.getString("nonce");
+    }
+
+    private void registerSignInResultHandler() {
         googleOneTapSignInActivityResultHandlerIntentSenderRequest = bridge.registerForActivityResult(
                 new ActivityResultContracts.StartIntentSenderForResult(),
                 result -> {
@@ -56,59 +82,41 @@ public class GoogleOneTapAuth extends Plugin {
                         try {
                             Intent data = result.getData();
                             var credential = oneTapClient.getSignInCredentialFromIntent(data);
-                            var email = credential.getId();
-                            signInFuture.complete(createSuccessResponse(credential.getGoogleIdToken(), email));
+                            signInMethod = SignInMethod.OneTap;
+                            oneTapSignInFuture.complete(createSuccessResponse(credential.getGoogleIdToken()));
                         } catch (ApiException e) {
-                            signInFuture.complete(createErrorResponse(e.toString()));
+                            oneTapSignInFuture.complete(createErrorResponse(null, e.toString()));
                         }
                     } else {
                         var resultCodeString = ActivityResult.resultCodeToString(resultCode);
-                        signInFuture.complete(createErrorResponse(resultCodeString));
+                        oneTapSignInFuture.complete(createErrorResponse(null, resultCodeString));
                     }
                 });
     }
 
-    @PluginMethod()
-    public void initialize(PluginCall call) {
-        // Currently no code to run here.
-        call.resolve();
-    }
-
     @PluginMethod()
     public void tryAutoSignIn(PluginCall call) {
         try {
             var signInResult = beginSignIn(true).get();
+            if (!signInResult.getBool("isSuccess")) {
+                signInResult = beginSignIn(false).get();
+            }
+            if (!signInResult.getBool("isSuccess")) {
+                signInResult = googleSilentSignIn(call).get();
+            }
             call.resolve(signInResult);
-        } catch (ExecutionException e) {
-            call.reject(e.toString());
-        } catch (InterruptedException e) {
-            call.reject(e.toString());
-        }
-    }
-
-    @PluginMethod()
-    public void trySignInWithPrompt(PluginCall call) {
-        try {
-            var signInResult = beginSignIn(false).get();
-            call.resolve(signInResult);
-        } catch (ExecutionException e) {
-            call.reject(e.toString());
-        } catch (InterruptedException e) {
+        } catch (ExecutionException | InterruptedException e) {
             call.reject(e.toString());
         }
     }
 
+    // This method is not part of the api but only called from GoogleOneTapAuth.ts.
     @PluginMethod()
-    public void tryAutoSignInThenTrySignInWithPrompt(PluginCall call) {
+    public void triggerGoogleSignIn(PluginCall call) {
         try {
-            var signInResult = beginSignIn(true).get();
-            if (!signInResult.getBool("isSuccess")) {
-                signInResult = beginSignIn(false).get();
-            }
+            var signInResult = googleSignIn(call).get();
             call.resolve(signInResult);
-        } catch (ExecutionException e) {
-            call.reject(e.toString());
-        } catch (InterruptedException e) {
+        } catch (ExecutionException | InterruptedException e) {
             call.reject(e.toString());
         }
     }
@@ -116,7 +124,7 @@ public class GoogleOneTapAuth extends Plugin {
     private Future<JSObject> beginSignIn(boolean filterByAuthorizedAccounts) {
         var context = this.getContext();
         var beginSignInRequest = createBeginSignInRequest(filterByAuthorizedAccounts);
-        signInFuture = new CompletableFuture<>();
+        oneTapSignInFuture = new CompletableFuture<>();
 
         oneTapClient.beginSignIn(beginSignInRequest)
                 .addOnCompleteListener(task -> {
@@ -126,11 +134,7 @@ public class GoogleOneTapAuth extends Plugin {
                         var intentSenderRequest = new IntentSenderRequest.Builder(intentSender).build();
                         googleOneTapSignInActivityResultHandlerIntentSenderRequest.launch(intentSenderRequest);
                     } else {
-                        if (filterByAuthorizedAccounts) {
-                            Log.i(TAG, "beginSignIn with FilterByAuthorizedAccounts=true failed", task.getException());
-                        } else {
-                            Log.e(TAG, "beginSignIn with FilterByAuthorizedAccounts=false failed", task.getException());
-                        }
+                        Log.i(TAG, "beginSignIn with FilterByAuthorizedAccounts=" + filterByAuthorizedAccounts + " did not succeed.", task.getException());
                         var errorMessage = task.getException().toString();
 
                         if (!isGooglePlayServicesAvailable(context)) {
@@ -140,22 +144,23 @@ public class GoogleOneTapAuth extends Plugin {
                             errorMessage += "\nGooglePlay is not installed or must be logged in to setup.";
                         }
                         if (errorMessage.contains("ApiException: 8")) {
-                            errorMessage += "\nOne reason for the exception is when the device has no internet.";
+                            errorMessage += "\nOne reason for the exception is when the device has no internet, or one-tap is not possible.";
                         }
                         // Other errors:
                         // com.google.android.gms.common.api.ApiException: 10: Caller not whitelisted to call this API.
                         // --> Try if restarting the phone fixes the problem.
                         // --> Test to sign in several times to ensure it works repeatedly.
-                        signInFuture.complete(createErrorResponse(errorMessage));
+                        oneTapSignInFuture.complete(createErrorResponse(null, errorMessage));
                     }
                 });
-        return signInFuture;
+        return oneTapSignInFuture;
     }
 
     private BeginSignInRequest createBeginSignInRequest(boolean filterByAuthorizedAccounts) {
         return BeginSignInRequest.builder()
                 .setGoogleIdTokenRequestOptions(BeginSignInRequest.GoogleIdTokenRequestOptions.builder()
                         .setSupported(true)
+                        .setNonce(nonce)
                         // A OAuth client ID with application type "Web application".
                         .setServerClientId(clientId)
                         // If true, only the Google accounts that the user has authorized before will show up in the credential list. This can
@@ -167,27 +172,38 @@ public class GoogleOneTapAuth extends Plugin {
                 .build();
     }
 
-    private JSObject createErrorResponse(String noSuccessAdditionalInfo) {
+    private JSObject createErrorResponse(String reasonCode, String noSuccessAdditionalInfo) {
         var result = new JSObject();
         result.put("isSuccess", false);
+        result.put("noSuccessReasonCode", reasonCode);
         result.put("noSuccessAdditionalInfo", noSuccessAdditionalInfo);
         return result;
     }
 
-    private JSObject createSuccessResponse(String idToken, String email) {
+    private JSObject createSuccessResponse(String idToken) {
+        var decodedIdToken = decodeJwtBody(idToken);
+        JSONObject decodedIdTokenJson = null;
+        String userId = null;
+        String email = null;
+        try {
+            decodedIdTokenJson = new JSONObject(decodedIdToken);
+            userId = decodedIdTokenJson.getString("sub");
+            email = decodedIdTokenJson.getString("email");
+        } catch (JSONException e) {
+            // Do nothing.
+        }
         var result = new JSObject();
         result.put("isSuccess", true);
         result.put("idToken", idToken);
+        result.put("userId", userId);
         result.put("email", email);
-        result.put("decodedIdToken", decodeJwtBody(idToken));
+        result.put("decodedIdToken", decodedIdTokenJson);
         return result;
     }
 
     private String decodeJwtBody(String jwtToken) {
-        var decoder = Base64.getUrlDecoder();
         var parts = jwtToken.split("\\.");
-        var payloadJson = new String(decoder.decode(parts[1]));
-        return payloadJson;
+        return new String(android.util.Base64.decode(parts[1], android.util.Base64.DEFAULT));
     }
 
     private boolean isGooglePlayServicesAvailable(Context context) {
@@ -199,16 +215,70 @@ public class GoogleOneTapAuth extends Plugin {
     @PluginMethod()
     public void signOut(final PluginCall call) {
         oneTapClient.signOut()
-                .addOnCompleteListener(task -> {
-                    var signOutResult = new JSObject();
-                    if (task.isSuccessful()) {
-                        signOutResult.put("isSuccess", true);
-                    } else {
-                        Log.e(TAG, "signOut failed", task.getException());
-                        signOutResult.put("isSuccess", false);
-                        signOutResult.put("error", task.getException().toString());
-                    }
-                    call.resolve(signOutResult);
-                });
+                .addOnCompleteListener(task -> call.resolve(signOutResultTaskToJSObject(task)));
+        googleSignInClient.signOut()
+                .addOnCompleteListener(task -> call.resolve(signOutResultTaskToJSObject(task)));
+    }
+
+    private JSObject signOutResultTaskToJSObject(Task<Void> completedTask) {
+        var signOutResult = new JSObject();
+        if (completedTask.isSuccessful()) {
+            signOutResult.put("isSuccess", true);
+        } else {
+            Log.e(TAG, "signOut failed", completedTask.getException());
+            signOutResult.put("isSuccess", false);
+            signOutResult.put("error", completedTask.getException().toString());
+        }
+        return signOutResult;
+    }
+
+    private JSObject createSuccessResult() {
+        var jsObject = new JSObject();
+        jsObject.put("isSuccess", true);
+        return jsObject;
+    }
+
+    private Future<JSObject> googleSilentSignIn(final PluginCall call) {
+        googleSignInFuture = new CompletableFuture<>();
+        googleSignInClient.silentSignIn()
+                .addOnCompleteListener(task -> handleGoogleSignInResult(call, task, "silentSignIn"));
+        return googleSignInFuture;
+    }
+
+    private Future<JSObject> googleSignIn(final PluginCall call) {
+        googleSignInFuture = new CompletableFuture<>();
+        var intent = googleSignInClient.getSignInIntent();
+        startActivityForResult(call, intent, "googleSignInResultIntentCallback");
+        return googleSignInFuture;
+    }
+
+    @ActivityCallback
+    private void googleSignInResultIntentCallback(PluginCall call, ActivityResult result) {
+        if (call == null) {
+            return;
+        }
+        Intent data = result.getData();
+        var task = GoogleSignIn.getSignedInAccountFromIntent(data);
+        handleGoogleSignInResult(call, task, "GoogleSignInClient.getSignInIntent");
+    }
+
+    private void handleGoogleSignInResult(PluginCall call, Task<GoogleSignInAccount> completedTask, String triggerMethodName) {
+        try {
+            var account = completedTask.getResult(ApiException.class);
+            signInMethod = SignInMethod.GoogleSignIn;
+            Log.i(TAG, triggerMethodName + " result " + account.toString());
+            googleSignInFuture.complete(createSuccessResponse(account.getIdToken()));
+        } catch (ApiException e) {
+            int statusCode = e.getStatusCode();
+            var statusCodeString = GoogleSignInStatusCodes.getStatusCodeString(statusCode);
+            Log.i(TAG, triggerMethodName + " not successful, statusCodeString " + statusCodeString, e);
+            if (statusCode == GoogleSignInStatusCodes.SIGN_IN_REQUIRED
+                || statusCode == GoogleSignInStatusCodes.SIGN_IN_CANCELLED) {
+                googleSignInFuture.complete(createErrorResponse(statusCodeString, null));
+            }
+            else {
+                googleSignInFuture.completeExceptionally(e);
+            }
+        }
     }
 }