catalyst-core 0.0.3-canary.9 → 0.1.0-beta.2

package/dist/native/iosnativeWebView/Sources/Core/Utils/SafeAreaUtils.swift

@@ -0,0 +1,132 @@
+//
+//  SafeAreaUtils.swift
+//  iosnativeWebView
+//
+//  Safe area inset calculation utilities for iOS
+//  Equivalent to Android's SafeAreaUtils.kt
+//
+
+import UIKit
+import os
+
+private let logger = Logger(subsystem: Bundle.main.bundleIdentifier ?? "com.app", category: "SafeAreaUtils")
+
+// MARK: - SafeAreaInsets Data Structure
+
+/// Represents safe area insets for all edges of the screen
+/// Matches Android's SafeAreaInsets data class
+public struct SafeAreaInsets: Codable, Equatable, CustomStringConvertible {
+    public let top: CGFloat
+    public let right: CGFloat
+    public let bottom: CGFloat
+    public let left: CGFloat
+
+    /// Zero insets (no safe area)
+    public static let zero = SafeAreaInsets(top: 0, right: 0, bottom: 0, left: 0)
+
+    /// Public initializer
+    public init(top: CGFloat, right: CGFloat, bottom: CGFloat, left: CGFloat) {
+        self.top = top
+        self.right = right
+        self.bottom = bottom
+        self.left = left
+    }
+
+    /// Convert to dictionary for JSON serialization
+    public func toDict() -> [String: Any] {
+        return [
+            "top": Int(top),
+            "right": Int(right),
+            "bottom": Int(bottom),
+            "left": Int(left)
+        ]
+    }
+
+    /// Convert to header dictionary for HTTP requests
+    public func toHeaders() -> [String: String] {
+        return [
+            "X-Safe-Area-Top": String(Int(top)),
+            "X-Safe-Area-Right": String(Int(right)),
+            "X-Safe-Area-Bottom": String(Int(bottom)),
+            "X-Safe-Area-Left": String(Int(left)),
+            // Prevent caching of SSR response so updated headers are always used
+            "Cache-Control": "no-cache, no-store, must-revalidate",
+            "Pragma": "no-cache"
+        ]
+    }
+
+    /// Check if all insets are zero
+    public var isZero: Bool {
+        return top == 0 && right == 0 && bottom == 0 && left == 0
+    }
+
+    /// String representation for logging and debugging
+    public var description: String {
+        return "SafeAreaInsets(top: \(Int(top)), right: \(Int(right)), bottom: \(Int(bottom)), left: \(Int(left)))"
+    }
+}
+
+// MARK: - SafeAreaUtils
+
+public class SafeAreaUtils {
+    public static func getSafeAreaInsets(from window: UIWindow?, edgeToEdgeEnabled: Bool) -> SafeAreaInsets {
+        guard let window = window else {
+            #if DEBUG
+            logger.debug("⚠️ No window available, returning zero insets")
+            #endif
+            return .zero
+        }
+
+        // If edge-to-edge is disabled, SwiftUI is already respecting safe areas
+        // The system handles padding automatically, so return zero
+        // (app doesn't need to apply manual padding)
+        guard edgeToEdgeEnabled else {
+            #if DEBUG
+            logger.debug("🎨 Edge-to-edge disabled - SwiftUI respects safe areas, returning zero")
+            #endif
+            return .zero
+        }
+
+        // Edge-to-edge enabled: Content draws behind system UI
+        // Return actual insets so the app can apply padding manually
+        let safeArea = window.safeAreaInsets
+
+        #if DEBUG
+        logger.debug("📐 Window safe area insets - top: \(safeArea.top), right: \(safeArea.right), bottom: \(safeArea.bottom), left: \(safeArea.left)")
+        logger.debug("🎨 Edge-to-edge enabled - returning insets for manual padding")
+        #endif
+
+        // On iOS, safeAreaInsets already includes:
+        // - Status bar
+        // - Home indicator
+        // - Notch/Dynamic Island
+        // - Any other screen intrusions
+        //
+        // Unlike Android, we don't need to manually combine system bars and cutouts
+
+        let insets = SafeAreaInsets(
+            top: max(0, safeArea.top),
+            right: max(0, safeArea.right),
+            bottom: max(0, safeArea.bottom),
+            left: max(0, safeArea.left)
+        )
+
+        #if DEBUG
+        logger.debug("✅ Computed safe area insets: \(insets)")
+        #endif
+
+        return insets
+    }
+
+    /// Get safe area insets from the key window of a scene
+    /// Convenience method that finds the active window automatically
+    public static func getSafeAreaInsetsFromKeyWindow(edgeToEdgeEnabled: Bool) -> SafeAreaInsets {
+        // Get the key window from active scene
+        let window = UIApplication.shared.connectedScenes
+            .compactMap { $0 as? UIWindowScene }
+            .flatMap { $0.windows }
+            .first { $0.isKeyWindow }
+
+        return getSafeAreaInsets(from: window, edgeToEdgeEnabled: edgeToEdgeEnabled)
+    }
+}

package/dist/native/iosnativeWebView/Sources/Core/Utils/ScreenSecureManager.swift

@@ -0,0 +1,131 @@
+// ScreenSecureManager.swift
+// Manages screen security on iOS by overlaying a blank view when the app
+// moves to the background — preventing the app switcher thumbnail from
+// capturing sensitive content.
+//
+// iOS limitation: unlike Android FLAG_SECURE, iOS cannot block system or
+// third-party screenshots. This only protects the app switcher snapshot.
+
+import UIKit
+import os
+
+private let secureLogger = Logger(subsystem: Bundle.main.bundleIdentifier ?? "com.app", category: "ScreenSecureManager")
+
+final class ScreenSecureManager {
+
+    public static let shared = ScreenSecureManager()
+    private init() {
+        setupSceneObservers()
+    }
+
+    // Track whether screen security is requested by the web layer
+    private(set) var isScreenSecure: Bool = false
+
+    // The overlay view installed over the window when backgrounding
+    private var overlayWindow: UIWindow?
+    // Guard flag set before async dispatch to prevent double-install race
+    private var overlayInstalling: Bool = false
+
+    // MARK: - Public API
+
+    /// Enable or disable screen-secure mode.
+    /// When enabled, a blank overlay is shown whenever the app moves to background
+    /// so the app-switcher snapshot does not capture sensitive content.
+    func setScreenSecure(_ enable: Bool) {
+        isScreenSecure = enable
+        secureLogger.debug("setScreenSecure called: enable=\(enable)")
+        if !enable {
+            removeOverlay()
+        }
+        // If enabling while already in background, install immediately
+        if enable && UIApplication.shared.applicationState == .background {
+            secureLogger.debug("setScreenSecure: app already in background, installing overlay immediately")
+            installOverlay()
+        }
+    }
+
+    // MARK: - Scene lifecycle
+
+    private func setupSceneObservers() {
+        NotificationCenter.default.addObserver(
+            self,
+            selector: #selector(sceneWillDeactivate),
+            name: UIScene.willDeactivateNotification,
+            object: nil
+        )
+        NotificationCenter.default.addObserver(
+            self,
+            selector: #selector(sceneDidActivate),
+            name: UIScene.didActivateNotification,
+            object: nil
+        )
+    }
+
+    @objc private func sceneWillDeactivate() {
+        secureLogger.debug("sceneWillDeactivate fired: isScreenSecure=\(self.isScreenSecure)")
+        guard isScreenSecure else { return }
+        installOverlay()
+    }
+
+    @objc private func sceneDidActivate() {
+        secureLogger.debug("sceneDidActivate fired — removing overlay")
+        removeOverlay()
+    }
+
+    // MARK: - Overlay management
+
+    private func installOverlay() {
+        // Set flag before async dispatch to prevent double-install race
+        guard overlayWindow == nil && !overlayInstalling else {
+            secureLogger.debug("installOverlay: skipped (already installing or installed)")
+            return
+        }
+        overlayInstalling = true
+        secureLogger.debug("installOverlay: dispatching to main thread")
+
+        DispatchQueue.main.async { [weak self] in
+            guard let self else { return }
+            defer { self.overlayInstalling = false }
+
+            // Accept foregroundInactive too — that's the state during the
+            // willDeactivate transition on both simulator and device.
+            guard let scene = UIApplication.shared.connectedScenes
+                .first(where: {
+                    $0.activationState == .foregroundActive ||
+                    $0.activationState == .foregroundInactive ||
+                    $0.activationState == .background
+                })
+                as? UIWindowScene else {
+                secureLogger.error("installOverlay: no suitable UIWindowScene found — overlay NOT installed")
+                return
+            }
+
+            secureLogger.debug("installOverlay: scene found (state=\(String(describing: scene.activationState.rawValue))), creating overlay window")
+
+            let window = UIWindow(windowScene: scene)
+            window.windowLevel = .alert + 1
+            window.backgroundColor = .black
+            window.rootViewController = UIViewController()
+            window.rootViewController?.view.backgroundColor = .black
+            window.isHidden = false
+
+            self.overlayWindow = window
+            secureLogger.debug("installOverlay: overlay window installed successfully")
+        }
+    }
+
+    private func removeOverlay() {
+        DispatchQueue.main.async { [weak self] in
+            guard let self else { return }
+            if self.overlayWindow != nil {
+                secureLogger.debug("removeOverlay: hiding and releasing overlay window")
+            }
+            self.overlayWindow?.isHidden = true
+            self.overlayWindow = nil
+        }
+    }
+
+    deinit {
+        NotificationCenter.default.removeObserver(self)
+    }
+}

package/dist/native/iosnativeWebView/Sources/Core/Utils/URLWhitelistManager.swift

@@ -0,0 +1,224 @@
+import Foundation
+import os
+
+private let logger = Logger(subsystem: Bundle.main.bundleIdentifier ?? "com.app", category: "URLWhitelistManager")
+
+/// Data structure to hold categorized URL patterns for efficient matching
+private struct CategorizedPatterns {
+    let contains: [String]
+    let prefix: [String]
+    let suffix: [String]
+}
+
+/// Manager for URL whitelisting and access control
+/// Provides centralized URL validation with pattern matching support
+///
+/// Pattern matching rules:
+/// - *text* or text (no wildcard) -> checks if URL contains "text"
+/// - text* -> checks if URL starts with "text"
+/// - *text -> checks if URL ends with "text"
+///
+/// URL processing:
+/// - Query parameters and hash fragments are stripped before matching
+/// - Matching is case-insensitive
+/// - Ports are kept as-is (user must include port in pattern if URL has explicit port)
+class URLWhitelistManager {
+    static let shared = URLWhitelistManager()
+
+    private var accessControlEnabled: Bool = false
+    private var patterns: CategorizedPatterns?
+    private let syncQueue = DispatchQueue(label: "com.app.urlwhitelist", attributes: .concurrent)
+
+    private init() {
+        loadConfiguration()
+    }
+
+    #if DEBUG
+    /// Test-only initialization method to override configuration
+    /// This allows unit tests to set custom whitelist configurations
+    /// - Parameters:
+    ///   - enabled: Whether access control is enabled
+    ///   - allowedUrls: Array of URL patterns to allow
+    func testInitialize(enabled: Bool, allowedUrls: [String]) {
+        syncQueue.sync(flags: .barrier) {
+            self.accessControlEnabled = enabled
+            self.patterns = categorizePatterns(allowedUrls)
+        }
+    }
+    #endif
+
+    /// Load URL whitelist configuration from ConfigConstants
+    private func loadConfiguration() {
+        syncQueue.sync(flags: .barrier) {
+            self.accessControlEnabled = ConfigConstants.accessControlEnabled
+            let allowedUrls = ConfigConstants.allowedUrls
+            self.patterns = categorizePatterns(allowedUrls)
+
+            logger.info("URLWhitelistManager initialized")
+            logger.info("Access Control Enabled: \(self.accessControlEnabled)")
+            logger.info("Allowed URLs: \(allowedUrls)")
+            if let patterns = self.patterns {
+                logger.info("Categorized - Contains: \(patterns.contains)")
+                logger.info("Categorized - Prefix: \(patterns.prefix)")
+                logger.info("Categorized - Suffix: \(patterns.suffix)")
+            }
+        }
+    }
+
+    /// Check if URL whitelisting is enabled
+    var isAccessControlEnabled: Bool {
+        return syncQueue.sync { self.accessControlEnabled }
+    }
+
+    /// Check if a URL is allowed according to the whitelist patterns
+    /// If access control is disabled, all URLs are allowed
+    /// - Parameter url: The URL to check
+    /// - Returns: true if URL is allowed, false otherwise
+    func isUrlAllowed(_ url: URL) -> Bool {
+        return isUrlAllowed(url.absoluteString)
+    }
+
+    /// Check if a URL string is allowed according to the whitelist patterns
+    /// If access control is disabled, all URLs are allowed
+    /// - Parameter urlString: The URL string to check
+    /// - Returns: true if URL is allowed, false otherwise
+    func isUrlAllowed(_ urlString: String) -> Bool {
+        return syncQueue.sync {
+            // If access control is disabled, allow everything
+            if !self.accessControlEnabled {
+                return true
+            }
+
+            // Always allow framework server URLs (localhost with /framework- pattern)
+            // These are internal infrastructure URLs used for large file handling
+            let frameworkPattern = "^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?/framework-[a-zA-Z0-9_-]+"
+            if let regex = try? NSRegularExpression(pattern: frameworkPattern, options: .caseInsensitive) {
+                let range = NSRange(location: 0, length: urlString.utf16.count)
+                if regex.firstMatch(in: urlString, options: [], range: range) != nil {
+                    return true
+                }
+            }
+
+            guard let patterns = self.patterns else {
+                return false
+            }
+
+            // If all pattern lists are empty, block everything
+            if patterns.contains.isEmpty && patterns.prefix.isEmpty && patterns.suffix.isEmpty {
+                return false
+            }
+
+            let cleanUrl = cleanUrl(urlString)
+
+            // Check contains patterns
+            if patterns.contains.contains(where: { cleanUrl.contains($0) }) {
+                logger.info("✅ URL allowed (contains match): \(urlString)")
+                return true
+            }
+
+            // Check prefix patterns
+            if patterns.prefix.contains(where: { cleanUrl.hasPrefix($0) }) {
+                logger.info("✅ URL allowed (prefix match): \(urlString)")
+                return true
+            }
+
+            // Check suffix patterns
+            if patterns.suffix.contains(where: { cleanUrl.hasSuffix($0) }) {
+                logger.info("✅ URL allowed (suffix match): \(urlString)")
+                return true
+            }
+
+            logger.warning("🚫 URL blocked by access control: \(urlString)")
+            logger.warning("🚫 Clean URL: \(cleanUrl)")
+
+            return false
+        }
+    }
+
+    /// Check if a URL is from an external domain (not in whitelist)
+    /// If access control is disabled, nothing is considered external
+    /// - Parameter url: The URL to check
+    /// - Returns: true if URL is external, false if it's whitelisted
+    func isExternalDomain(_ url: URL) -> Bool {
+        return isExternalDomain(url.absoluteString)
+    }
+
+    /// Check if a URL string is from an external domain (not in whitelist)
+    /// If access control is disabled, nothing is considered external
+    /// - Parameter urlString: The URL string to check
+    /// - Returns: true if URL is external, false if it's whitelisted
+    func isExternalDomain(_ urlString: String) -> Bool {
+        // If access control is disabled, nothing is external
+        if !self.accessControlEnabled {
+            return false
+        }
+
+        // Simply the inverse of isUrlAllowed
+        return !isUrlAllowed(urlString)
+    }
+
+    /// Clean URL by removing query parameters and hash, then lowercase for case-insensitive matching
+    /// Also decodes URL-encoded characters to prevent bypass attempts
+    /// - Parameter url: The URL string to clean
+    /// - Returns: Cleaned and lowercased URL string
+    private func cleanUrl(_ url: String) -> String {
+        // Decode URL-encoded characters first to prevent bypass (e.g., %3F for ?, %23 for #)
+        let decoded = url.removingPercentEncoding ?? url
+
+        var cleanUrl = decoded
+
+        // Remove hash fragment (# and everything after)
+        if let hashIndex = cleanUrl.firstIndex(of: "#") {
+            cleanUrl = String(cleanUrl[..<hashIndex])
+        }
+
+        // Remove query parameters (? and everything after)
+        if let queryIndex = cleanUrl.firstIndex(of: "?") {
+            cleanUrl = String(cleanUrl[..<queryIndex])
+        }
+
+        return cleanUrl.lowercased()
+    }
+
+    /// Categorize patterns into contains, prefix, and suffix for efficient matching
+    /// - Parameter allowedUrls: Array of URL pattern strings
+    /// - Returns: Categorized patterns structure
+    private func categorizePatterns(_ allowedUrls: [String]) -> CategorizedPatterns {
+        var contains: [String] = []
+        var prefix: [String] = []
+        var suffix: [String] = []
+
+        for pattern in allowedUrls {
+            let startsWithWildcard = pattern.hasPrefix("*")
+            let endsWithWildcard = pattern.hasSuffix("*")
+
+            if startsWithWildcard && endsWithWildcard {
+                // *text* -> contains check
+                let extracted = String(pattern.dropFirst().dropLast()).lowercased()
+                if !extracted.isEmpty {
+                    contains.append(extracted)
+                }
+            } else if endsWithWildcard {
+                // text* -> prefix check
+                let extracted = String(pattern.dropLast()).lowercased()
+                if !extracted.isEmpty {
+                    prefix.append(extracted)
+                }
+            } else if startsWithWildcard {
+                // *text -> suffix check
+                let extracted = String(pattern.dropFirst()).lowercased()
+                if !extracted.isEmpty {
+                    suffix.append(extracted)
+                }
+            } else {
+                // No wildcard -> treat as contains check
+                let extracted = pattern.lowercased()
+                if !extracted.isEmpty {
+                    contains.append(extracted)
+                }
+            }
+        }
+
+        return CategorizedPatterns(contains: contains, prefix: prefix, suffix: suffix)
+    }
+}

package/dist/native/iosnativeWebView/Sources/Core/Utils/WebKitConfig.swift

@@ -0,0 +1,43 @@
+//
+//  WebKitConfig.swift
+//  CatalystCore
+//
+//  Lightweight shim that keeps legacy APIs compiling without triggering
+//  WKProcessPool deprecation warnings on iOS 15+.
+//
+
+import WebKit
+
+public enum WebKitConfig {
+    @available(iOS, introduced: 11.0, deprecated: 15.0, message: "Custom WKProcessPool instances have no effect on iOS 15+.")
+    public static let sharedProcessPool = WKProcessPool()
+    
+    private static var legacyPrewarmedWebView: WKWebView?
+    
+    /// Recreate the legacy shared process pool behavior for iOS versions where it still matters.
+    @discardableResult
+    public static func prewarmProcessPoolIfNeeded() -> WKWebView? {
+        if #available(iOS 15, *) {
+            logWithTimestamp("🔥 WebKit process pool prewarm skipped (ignored by iOS 15+)")
+            legacyPrewarmedWebView = nil
+            return nil
+        } else {
+            if legacyPrewarmedWebView == nil {
+                let configuration = WKWebViewConfiguration()
+                configuration.processPool = sharedProcessPool
+                legacyPrewarmedWebView = WKWebView(frame: .zero, configuration: configuration)
+                logWithTimestamp("🔥 WebKit process pool prewarmed for legacy iOS versions")
+            }
+            return legacyPrewarmedWebView
+        }
+    }
+    
+    /// Apply the shared process pool only on OS versions where Apple still honors it.
+    public static func applySharedProcessPoolIfNeeded(to configuration: WKWebViewConfiguration) {
+        if #available(iOS 15, *) {
+            return
+        } else {
+            configuration.processPool = sharedProcessPool
+        }
+    }
+}