catalyst-core 0.1.0-canary.3 → 0.1.0-canary.5

package/changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.1.0-canary.4] - 2026-02-12
+
+- Added Google Sign-In support for both Android and iOS in Catalyst, enabling a unified native authentication experience for apps built on the framework.
+- Improved release/build reliability with related bridge and CI updates, making integration smoother and more consistent across platforms.
+
+## [0.1.0-canary.3] - 2026-02-04
+
+- Android device security: added root, emulator, and Frida detection with launch-time checks and a Material Design 3 bottom sheet threat alert UI
+
 ## [0.1.0-canary.2] - 2026-01-28
 
 - Adds mono-repository support for catalyst

package/dist/native/androidProject/app/build.gradle.kts

@@ -15,6 +15,18 @@ val keystorePassword: String? by project.properties  // Changed from keyStorePas
 val keyAlias: String? by project.properties
 val keyPassword: String? by project.properties
 
+fun isAllowBackupEnabled(): Boolean {
+    return try {
+        val propsFile = File("${project.projectDir}/src/main/assets/webview_config.properties")
+        if (!propsFile.exists()) return false
+        val props = Properties()
+        props.load(propsFile.inputStream())
+        props.getProperty("android.security.allowBackup", "false").trim().lowercase() == "true"
+    } catch (e: Exception) {
+        false
+    }
+}
+
 fun isNotificationsEnabled(): Boolean {
     return try {
         if (configPath == null) return false
@@ -56,6 +68,7 @@ android {
         versionName = "1.1"
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         buildConfigField("String", "LOCAL_IP", "\"${getLocalIpAddress()}\"")
+        manifestPlaceholders["allowBackup"] = isAllowBackupEnabled()
     }
 
     // Add signing configuration for app bundle
@@ -148,6 +161,13 @@ android {
         abortOnError = true
     }
 
+    // Configure test options for unit tests
+    testOptions {
+        unitTests {
+            isReturnDefaultValues = true
+        }
+    }
+
     // Conditional source sets based on notifications config
     sourceSets {
         getByName("main") {
@@ -171,8 +191,10 @@ dependencies {
     androidTestImplementation(libs.androidx.junit)
     androidTestImplementation(libs.androidx.espresso.core)
     implementation(libs.androidx.webkit)
+    implementation(libs.androidx.credentials)
+    implementation(libs.androidx.credentials.play.services.auth)
+    implementation(libs.googleid)
     implementation("org.json:json:20231013")
-
     // Ktor Server dependencies for FrameworkServer (~200KB total)
     implementation("io.ktor:ktor-server-core:3.0.3")
     implementation("io.ktor:ktor-server-netty:3.0.3")

package/dist/native/androidProject/app/src/main/AndroidManifest.xml

@@ -12,7 +12,7 @@
         </intent>
     </queries>
     <application
-        android:allowBackup="true"
+        android:allowBackup="${allowBackup}"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
         android:hardwareAccelerated="true"

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/CatalystConstants.kt

@@ -70,7 +70,10 @@ object CatalystConstants {
             "logger",
             "pickFile",
             "openFileWithIntent",
-            "requestHapticFeedback"
+            "requestHapticFeedback",
+            "setScreenSecure",
+            "getScreenSecure",
+            "clearWebData"
         )
     }
 

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/CustomWebview.kt

@@ -15,8 +15,7 @@ import androidx.webkit.WebResourceRequestCompat
 import android.widget.ProgressBar
 import androidx.webkit.WebViewAssetLoader
 import io.yourname.androidproject.WebCacheManager
-import io.yourname.androidproject.isUrlAllowed
-import io.yourname.androidproject.isExternalDomain
+import io.yourname.androidproject.URLWhitelistManager
 import io.yourname.androidproject.matchesCachePattern
 import io.yourname.androidproject.utils.CameraUtils
 import io.yourname.androidproject.utils.NetworkUtils
@@ -100,6 +99,9 @@ class CustomWebView(
             .getProperty("accessControl.enabled", "true")
             .equals("true", ignoreCase = true)
 
+        // Initialize URLWhitelistManager with access control configuration
+        URLWhitelistManager.initialize(accessControlEnabled, allowedUrls)
+
         // Set initial flags based on buildOptimisation
         if (buildOptimisation) {
             isInitialApiCalled = false
@@ -187,6 +189,10 @@ class CustomWebView(
         webView.clearHistory()
     }
 
+    fun clearAllCache() {
+        cacheManager.clearAll()
+    }
+
     fun canGoBack(): Boolean = webView.canGoBack()
 
     fun goBack() {
@@ -480,7 +486,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is allowed
-                    if (accessControlEnabled && !isUrlAllowed(url, allowedUrls)) {
+                    if (!URLWhitelistManager.isUrlAllowed(url)) {
                         if (BuildConfig.DEBUG) {
                             Log.w(TAG, "🙫 SERVICE_WORKER: Request blocked by access control: $url")
                         }
@@ -624,7 +630,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is an external domain
-                    if (url.scheme in listOf("http", "https") && isExternalDomain(urlString, allowedUrls)) {
+                    if (url.scheme in listOf("http", "https") && URLWhitelistManager.isExternalDomain(urlString)) {
                         if (BuildConfig.DEBUG) {
                             Log.d(TAG, "🌍 External domain detected, opening in in-app browser: $urlString")
                         }
@@ -633,7 +639,7 @@ class CustomWebView(
                     }
 
                     // Check if URL is allowed for internal navigation
-                    if (accessControlEnabled && !isUrlAllowed(urlString, allowedUrls)) {
+                    if (!URLWhitelistManager.isUrlAllowed(urlString)) {
                         if (BuildConfig.DEBUG) {
                             Log.w(TAG, "🚫 URL blocked by access control: $urlString")
                         }
@@ -666,21 +672,18 @@ class CustomWebView(
                     Log.d(TAG, "🔄 INTERCEPT: isInitialPageLoaded: $isInitialPageLoaded")
                 }
 
-                if (accessControlEnabled) {
-                    if (!isUrlAllowed(url, allowedUrls)) {
-                        if (BuildConfig.DEBUG) {
-                            Log.w(TAG, "🚫 STEP_1_FAIL: Network request blocked by access control: $url")
-                            Log.w(TAG, "🚫 STEP_1_FAIL: Allowed URLs: $allowedUrls")
-                        }
-                        // Return an empty response to block the request
-                        return WebResourceResponse("text/plain", "utf-8", null)
-                    } else {
-                        if (BuildConfig.DEBUG) {
-                            Log.d(TAG, "✅ STEP_1_PASS: URL allowed by access control: $url")
-                        }
+                if (!URLWhitelistManager.isUrlAllowed(url)) {
+                    if (BuildConfig.DEBUG) {
+                        Log.w(TAG, "🚫 STEP_1_FAIL: Network request blocked by access control: $url")
                     }
+                    // Return an empty response to block the request
+                    return WebResourceResponse("text/plain", "utf-8", null)
                 } else if (BuildConfig.DEBUG) {
-                    Log.d(TAG, "⚙️ STEP_1_SKIP: Access control disabled, allowing URL: $url")
+                    if (URLWhitelistManager.isAccessControlEnabled()) {
+                        Log.d(TAG, "✅ STEP_1_PASS: URL allowed by access control: $url")
+                    } else {
+                        Log.d(TAG, "⚙️ STEP_1_SKIP: Access control disabled, allowing URL: $url")
+                    }
                 }
 
                 // TODO: Add HTML file workflow - index.html not available yet

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/MainActivity.kt

@@ -141,6 +141,25 @@ class MainActivity : AppCompatActivity(), CoroutineScope by MainScope() {
     // Public method for NativeBridge to get current safe area insets
     fun getCurrentSafeAreaInsets(): SafeAreaInsets = latestSafeAreaInsets
 
+    fun clearWebCache() {
+        customWebView.clearAllCache()
+    }
+
+    fun setScreenSecure(enable: Boolean) {
+        if (enable) {
+            window.setFlags(
+                WindowManager.LayoutParams.FLAG_SECURE,
+                WindowManager.LayoutParams.FLAG_SECURE
+            )
+        } else {
+            window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        }
+    }
+
+    fun isScreenSecure(): Boolean {
+        return (window.attributes.flags and WindowManager.LayoutParams.FLAG_SECURE) != 0
+    }
+
     /**
      * Notify WebView when safe area insets are updated
      * Called when deferred inset calculation completes

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/NativeBridge.kt

@@ -10,12 +10,19 @@ import android.webkit.WebView
 import androidx.activity.result.ActivityResultLauncher
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.core.app.NotificationCompat
+import androidx.credentials.CredentialManager
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialException
+import com.google.android.libraries.identity.googleid.GetSignInWithGoogleOption
+import com.google.android.libraries.identity.googleid.GoogleIdTokenCredential
 import io.yourname.androidproject.MainActivity
 import io.yourname.androidproject.utils.*
 import kotlinx.coroutines.*
 import org.json.JSONArray
 import org.json.JSONObject
 import java.util.Properties
+import java.util.concurrent.atomic.AtomicBoolean
 
 private data class FilePickerOptions(
     val mimeType: String = "*/*",
@@ -86,6 +93,38 @@ private fun JSONObject.optIntNullable(key: String): Int? =
 private fun JSONObject.optLongNullable(key: String): Long? =
     if (has(key) && !isNull(key)) getLong(key) else null
 
+private data class GoogleSignInOptions(
+    val clientId: String,
+    val nonce: String? = null,
+    val autoSelect: Boolean = false,
+    val filterByAuthorizedAccounts: Boolean = false
+) {
+    companion object {
+        fun fromRaw(raw: String?): GoogleSignInOptions {
+            if (raw.isNullOrBlank()) {
+                // Allow fallback to config-supplied clientId
+                return GoogleSignInOptions(clientId = "")
+            }
+
+            return try {
+                val json = JSONObject(raw)
+                val resolvedClientId = json.optString("clientId")
+                    .ifBlank { json.optString("webClientId") }
+
+                GoogleSignInOptions(
+                    clientId = resolvedClientId,
+                    nonce = json.optString("nonce").takeIf { it.isNotBlank() },
+                    autoSelect = json.optBoolean("autoSelect", false),
+                    filterByAuthorizedAccounts = json.optBoolean("filterByAuthorizedAccounts", false)
+                )
+            } catch (e: Exception) {
+                BridgeUtils.logDebug("NativeBridge", "Failed to parse options JSON: ${e.message}")
+                GoogleSignInOptions(clientId = raw.trim())
+            }
+        }
+    }
+}
+
 class NativeBridge(
     private val mainActivity: MainActivity,
     private val webView: WebView,
@@ -104,6 +143,12 @@ class NativeBridge(
     private lateinit var permissionLauncher: ActivityResultLauncher<String>
     private lateinit var filePickerLauncher: ActivityResultLauncher<Intent>
     private var currentFilePickerOptions: FilePickerOptions = FilePickerOptions()
+    private val isGoogleSignInInProgress = AtomicBoolean(false)
+    private val credentialManager: CredentialManager by lazy { CredentialManager.create(mainActivity) }
+    private val isGoogleSignInEnabled: Boolean by lazy {
+        properties.getProperty("googleSignIn.enabled", "false").toBoolean()
+    }
+    
     private var networkMonitor: NetworkMonitor? = null
 
     // Unified notification manager
@@ -111,6 +156,7 @@ class NativeBridge(
 
     companion object {
         private const val TAG = "NativeBridge"
+        private const val GOOGLE_SIGN_IN_SAFE_EXECUTE_ACTION = "start Google Sign-In"
 
         /**
          * Parse and validate bridge message
@@ -237,6 +283,55 @@ class NativeBridge(
         }
     }
 
+    @JavascriptInterface
+    fun googleSignIn(optionsRaw: String?) {
+        BridgeUtils.safeExecute(
+            webView,
+            BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+            GOOGLE_SIGN_IN_SAFE_EXECUTE_ACTION
+        ) {
+            if (!isGoogleSignInEnabled) {
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "Google Sign-In is disabled in config"
+                )
+                return@safeExecute
+            }
+
+            val options = GoogleSignInOptions.fromRaw(optionsRaw)
+
+            val resolvedClientId = when {
+                options.clientId.isNotBlank() -> options.clientId
+                !properties.getProperty("googleSignIn.clientId", "").isNullOrBlank() ->
+                    properties.getProperty("googleSignIn.clientId", "")
+                else -> ""
+            }
+
+            if (resolvedClientId.isBlank()) {
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "clientId is required for Google Sign-In"
+                )
+                return@safeExecute
+            }
+
+            if (!isGoogleSignInInProgress.compareAndSet(false, true)) {
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "A Google Sign-In request is already in progress"
+                )
+                return@safeExecute
+            }
+
+            BridgeUtils.logDebug(TAG, "Google Sign-In using clientId prefix: ${resolvedClientId.take(12)}...")
+
+            launchGoogleSignIn(options.copy(clientId = resolvedClientId))
+        }
+    }
+
     @JavascriptInterface
     fun openFileWithIntent(params: String?) {
         BridgeUtils.safeExecute(webView, BridgeUtils.WebEvents.ON_INTENT_ERROR, "open file with intent") {
@@ -626,6 +721,115 @@ class NativeBridge(
             }
         }
     }
+
+    private fun launchGoogleSignIn(options: GoogleSignInOptions) {
+        launch {
+            try {
+                val googleOptionBuilder = GetSignInWithGoogleOption.Builder(options.clientId)
+                options.nonce?.let { googleOptionBuilder.setNonce(it) }
+                val googleOption = googleOptionBuilder.build()
+
+                val request = GetCredentialRequest.Builder()
+                    .addCredentialOption(googleOption)
+                    .build()
+
+                BridgeUtils.logDebug(
+                    TAG,
+                    "Starting Google Sign-In via CredentialManager (hasNonce=${options.nonce != null})"
+                )
+
+                val response = credentialManager.getCredential(mainActivity, request)
+                handleCredentialResponse(response)
+            } catch (e: GetCredentialCancellationException) {
+                isGoogleSignInInProgress.set(false)
+                BridgeUtils.logDebug(
+                    TAG,
+                    "Google Sign-In cancelled: ${e.message} :: ${e.javaClass.simpleName}"
+                )
+                BridgeUtils.notifyWeb(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_CANCELLED,
+                    "User cancelled Google sign-in"
+                )
+            } catch (e: GetCredentialException) {
+                isGoogleSignInInProgress.set(false)
+                val message = e.errorMessage?.toString() ?: e.message ?: "Credential request failed"
+                BridgeUtils.logError(
+                    TAG,
+                    "Google Sign-In credential error: $message :: ${e.javaClass.simpleName}",
+                    e
+                )
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    message
+                )
+            } catch (e: Exception) {
+                isGoogleSignInInProgress.set(false)
+                BridgeUtils.logError(
+                    TAG,
+                    "Google Sign-In unexpected error: ${e.message} :: ${e.javaClass.simpleName}",
+                    e
+                )
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "Error preparing Google sign-in: ${e.message}"
+                )
+            }
+        }
+    }
+
+    private fun handleCredentialResponse(response: androidx.credentials.GetCredentialResponse) {
+        try {
+            val credential = response.credential
+            if (credential.type != GoogleIdTokenCredential.TYPE_GOOGLE_ID_TOKEN_CREDENTIAL) {
+                BridgeUtils.logError(TAG, "Unexpected credential type: ${credential.type}")
+                isGoogleSignInInProgress.set(false)
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "Unsupported credential type returned"
+                )
+                return
+            }
+
+            val googleCredential = GoogleIdTokenCredential.createFrom(credential.data)
+            val idToken = googleCredential.idToken
+
+            if (idToken.isNullOrBlank()) {
+                isGoogleSignInInProgress.set(false)
+                BridgeUtils.notifyWebError(
+                    webView,
+                    BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                    "No ID token returned from Google sign-in"
+                )
+                return
+            }
+
+            val payload = JSONObject().apply {
+                put("idToken", idToken)
+                googleCredential.id?.let { put("email", it) }
+                googleCredential.displayName?.let { put("name", it) }
+                googleCredential.profilePictureUri?.toString()?.let { put("photoUrl", it) }
+                put("provider", "google")
+            }
+
+            isGoogleSignInInProgress.set(false)
+            BridgeUtils.notifyWebJson(
+                webView,
+                BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_SUCCESS,
+                payload
+            )
+        } catch (e: Exception) {
+            isGoogleSignInInProgress.set(false)
+            BridgeUtils.notifyWebError(
+                webView,
+                BridgeUtils.WebEvents.ON_GOOGLE_SIGN_IN_ERROR,
+                "Error handling Google credential: ${e.message}"
+            )
+        }
+    }
     
     private fun processSelectedFiles(uris: List<Uri>, options: FilePickerOptions) {
         launch {
@@ -825,6 +1029,110 @@ class NativeBridge(
         }
     }
 
+    @JavascriptInterface
+    fun setScreenSecure(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                val enable = try {
+                    org.json.JSONObject(params ?: "{}").optBoolean("enable", true)
+                } catch (e: Exception) {
+                    true
+                }
+                mainActivity.setScreenSecure(enable)
+                BridgeUtils.notifyWeb(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_SET,
+                    """{"secure": $enable, "success": true}"""
+                )
+            } catch (e: Exception) {
+                // Use notifyWebJson to prevent JSON injection from e.message
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "setScreenSecure failed")
+                    }
+                )
+            }
+        }
+    }
+
+    @JavascriptInterface
+    fun getScreenSecure(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                val isSecure = mainActivity.isScreenSecure()
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_STATUS,
+                    org.json.JSONObject().apply {
+                        put("secure", isSecure)
+                        put("success", true)
+                    }
+                )
+            } catch (e: Exception) {
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_SCREEN_SECURE_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "getScreenSecure failed")
+                    }
+                )
+            }
+        }
+    }
+
+    @JavascriptInterface
+    fun clearWebData(params: String?) {
+        mainActivity.runOnUiThread {
+            try {
+                webView.clearCache(true)
+                webView.clearHistory()
+                android.webkit.WebStorage.getInstance().deleteAllData()
+                mainActivity.clearWebCache()
+                // CookieManager.removeAllCookies is async — fire success only from its callback
+                android.webkit.CookieManager.getInstance().removeAllCookies { cookiesRemoved ->
+                    android.webkit.CookieManager.getInstance().flush()
+                    mainActivity.runOnUiThread {
+                        try {
+                            // Use notifyWebJson to prevent JSON injection; cookiesRemoved is a
+                            // Boolean so string interpolation is safe, but keep consistent pattern
+                            BridgeUtils.notifyWebJson(
+                                webView,
+                                BridgeUtils.WebEvents.ON_WEB_DATA_CLEARED,
+                                org.json.JSONObject().apply {
+                                    put("success", true)
+                                    put("cookiesRemoved", cookiesRemoved)
+                                }
+                            )
+                        } catch (e: Exception) {
+                            BridgeUtils.notifyWebJson(
+                                webView,
+                                BridgeUtils.WebEvents.ON_WEB_DATA_CLEAR_ERROR,
+                                org.json.JSONObject().apply {
+                                    put("success", false)
+                                    put("error", e.message ?: "clearWebData cookie flush failed")
+                                }
+                            )
+                        }
+                    }
+                }
+            } catch (e: Exception) {
+                // Use notifyWebJson to prevent JSON injection from e.message
+                BridgeUtils.notifyWebJson(
+                    webView,
+                    BridgeUtils.WebEvents.ON_WEB_DATA_CLEAR_ERROR,
+                    org.json.JSONObject().apply {
+                        put("success", false)
+                        put("error", e.message ?: "clearWebData failed")
+                    }
+                )
+            }
+        }
+    }
+
     @JavascriptInterface
     fun getSafeArea(data: String? = null) {
         BridgeUtils.safeExecute(webView, BridgeUtils.WebEvents.ON_SAFE_AREA_INSETS_UPDATED, "get safe area") {