craft-native 0.0.144 → 0.0.145

package/dist/cli.js

@@ -3303,7 +3303,7 @@ function pinCraftNativeDependency(packagePath, craftVersion) {
 `);
 }
 // package.json
-var version = "0.0.144";
+var version = "0.0.145";
 
 // bin/cli.ts
 var spawnedFrom = process6.env[CRAFT_CLI_SPAWN_MARKER];

package/dist/index.cjs

@@ -310,7 +310,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.144";
+var version = "0.0.145";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/index.js

@@ -58,7 +58,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.144";
+var version = "0.0.145";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/ios/templates/CraftApp.swift

@@ -6694,17 +6694,14 @@ struct CraftWebView: UIViewRepresentable {
 
         // MARK: - Social Auth (Apple Sign In)
         private func signInWithApple(nonce: String?, callbackId: String?) {
+            // The same sheet a native screen asks for (CraftNativeUI.swift).
             DispatchQueue.main.async {
-                self.pendingCallbackId = callbackId
-                let provider = ASAuthorizationAppleIDProvider()
-                let request = provider.createRequest()
-                request.requestedScopes = [.fullName, .email]
-                if let nonce, !nonce.isEmpty { request.nonce = nonce }
-
-                let controller = ASAuthorizationController(authorizationRequests: [request])
-                controller.delegate = self
-                controller.presentationContextProvider = self
-                controller.performRequests()
+                CraftSignInWithApple.shared.signIn(nonce: nonce) { [weak self] result in
+                    switch result {
+                    case .success(let value): self?.resolveCallback(callbackId, result: value)
+                    case .failure(let failure): self?.rejectCallback(callbackId, error: failure.message, code: failure.code)
+                    }
+                }
             }
         }
 
@@ -7968,56 +7965,6 @@ extension CraftWebView.Coordinator: UIDocumentPickerDelegate {
     }
 }
 
-// MARK: - Apple Sign In Delegate
-extension CraftWebView.Coordinator: ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
-    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
-        if let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
-            let userId = appleIDCredential.user
-            let email = appleIDCredential.email
-            let fullName = appleIDCredential.fullName
-
-            var name = ""
-            if let givenName = fullName?.givenName {
-                name = givenName
-            }
-            if let familyName = fullName?.familyName {
-                name += (name.isEmpty ? "" : " ") + familyName
-            }
-
-            var result: [String: Any] = ["userId": userId]
-            if let email = email { result["email"] = email }
-            if !name.isEmpty { result["name"] = name }
-
-            if let identityToken = appleIDCredential.identityToken,
-               let tokenString = String(data: identityToken, encoding: .utf8) {
-                result["identityToken"] = tokenString
-            }
-            // One use, five minutes: the server redeems it at Apple's token
-            // endpoint and so reads the identity straight from Apple.
-            if let authorizationCode = appleIDCredential.authorizationCode,
-               let codeString = String(data: authorizationCode, encoding: .utf8) {
-                result["authorizationCode"] = codeString
-            }
-
-            resolveCallback(pendingCallbackId, result: result)
-        }
-        pendingCallbackId = nil
-    }
-
-    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
-        rejectCallback(pendingCallbackId, error: error.localizedDescription)
-        pendingCallbackId = nil
-    }
-
-    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-        guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-              let window = windowScene.windows.first else {
-            return UIWindow()
-        }
-        return window
-    }
-}
-
 // MARK: - Bluetooth Delegate
 extension CraftWebView.Coordinator: CBCentralManagerDelegate {
     func centralManagerDidUpdateState(_ central: CBCentralManager) {

package/dist/ios/templates/CraftHybrid.swift

@@ -247,8 +247,33 @@ final class CraftHybrid: NSObject {
     fileprivate(set) var pageDepth = 0
     fileprivate(set) var pageReady = false
 
+    /// Shared keys a native screen wrote, by the page's own key (NSNull for a
+    /// removal), until the page has them: it reports each back as its own
+    /// write, which is when it leaves this list.
+    private var pendingShared: [String: Any] = [:]
+
     private override init() {}
 
+    /// A native screen wrote a key the page shares (`shareStorage`, named
+    /// here by its native name): both Keychain copies, and the page's own
+    /// storage, now if it is loaded or when it next loads. Nothing for a key
+    /// the config does not share.
+    func nativeWroteShared(nativeKey: String, value: String?) {
+        guard let webKey = config.shareStorage?.first(where: { $0.value == nativeKey })?.key else { return }
+        CraftHybridKeychain.set(nativeKey, value: value)
+        DispatchQueue.main.async {
+            self.pendingShared[webKey] = value ?? NSNull()
+            self.flushShared()
+        }
+    }
+
+    private func flushShared() {
+        guard pageReady, let webView, !pendingShared.isEmpty,
+              let data = try? JSONSerialization.data(withJSONObject: pendingShared),
+              let json = String(data: data, encoding: .utf8) else { return }
+        webView.evaluateJavaScript("window.__craftHybrid && window.__craftHybrid.adopt && window.__craftHybrid.adopt(\(json))")
+    }
+
     static var bundleURL: URL? {
         Bundle.main.url(forResource: "native-screen", withExtension: "js", subdirectory: "dist")
             ?? Bundle.main.url(forResource: "native-screen", withExtension: "js")
@@ -511,8 +536,26 @@ final class CraftHybrid: NSObject {
         SHARE.forEach(share);
       }
 
+      // A shared key a native screen wrote (a sign-in there): into this
+      // page's storage, which reports it back as the page's own write, and
+      // a `craftsharedstorage` event for whoever holds it in memory.
+      function adopt(values) {
+        Object.keys(values || {}).forEach(function (key) {
+          if (SHARE.indexOf(key) < 0) return;
+          var value = values[key];
+          try {
+            window.sessionStorage.removeItem(key);
+            if (value === null) window.localStorage.removeItem(key);
+            else window.localStorage.setItem(key, String(value));
+          } catch (e) {}
+          share(key);
+          try { window.dispatchEvent(new CustomEvent('craftsharedstorage', { detail: { key: key, value: value } })); } catch (e) {}
+        });
+      }
+
       window.__craftHybrid = {
         match: function (url) { var path = local(url); return path === null ? null : match(path); },
+        adopt: adopt,
         // The shell's own navigation: never handed back to it, and without
         // the page's slide, since the shell animates the push itself.
         // Answers once the page has drawn `path` (its router settles before
@@ -593,12 +636,15 @@ final class CraftHybrid: NSObject {
             for name in names { CraftSnapshots.write(name, json: nil) }
         case .shareStorage(let key, let value):
             guard let nativeKey = config.shareStorage?[key] else { return }
+            // The page's own write, or its echo of one a native screen made.
+            pendingShared.removeValue(forKey: key)
             CraftHybridKeychain.set(nativeKey, value: value)
         case .navigated(let path, let direction, let depth, let byHost):
             pagePath = path
             pageDepth = depth
             if direction == "load" { pageReady = true }
             controller?.pageNavigated(path: path, direction: direction, depth: depth, byHost: byHost)
+            if direction == "load" { flushShared() }
         case .navigateNative(let path, let replace):
             controller?.showNative(path: path, replace: replace)
         case .open(let path):

package/dist/ios/templates/CraftNativeActions.swift

@@ -45,6 +45,9 @@ enum CraftNativeActions {
         if config.enableDeepLinks { values.append("deepLinks") }
         if config.enableLocalNotifications { values.append("notifications") }
         if config.enableHealthKit { values.append("health") }
+        // The in-app browser and the system's web sign-in sheet (CraftBrowser).
+        values.append("browser")
+        if config.enableSocialAuth { values.append("appleSignIn") }
         return values
     }
 
@@ -117,6 +120,11 @@ enum CraftNativeActions {
                 return
             }
             sync = secureStorage(method: method, args: args)
+            // A key the web page shares (`shareStorage`): the page gets it too,
+            // so a sign-in on a native screen signs the page in.
+            if case .success = sync, ["set", "remove", "delete"].contains(method), let key = args.first as? String {
+                CraftHybrid.shared.nativeWroteShared(nativeKey: key, value: method == "set" ? args.count > 1 ? args[1] as? String : nil : nil)
+            }
         case ("Biometrics", "isAvailable"):
             sync = config.enableBiometric ? .success(biometricContext().canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil)) : failure("CAPABILITY_DISABLED", "Biometric authentication is disabled")
         case ("Biometrics", "getBiometricType"):
@@ -146,6 +154,32 @@ enum CraftNativeActions {
             }
             databaseQueue.async { complete(requestToken, database(method: method, args: args), completion) }
             return
+        case ("Browser", "open"):
+            // SFSafariViewController, or for `mode: 'auth'` the system's web
+            // sign-in sheet, the same as a page's `craft.browser.open`.
+            guard let address = args.first as? String, let url = URL(string: address) else {
+                complete(requestToken, failure("INVALID_ARGUMENT", "Browser.open needs a URL it can parse"), completion)
+                return
+            }
+            let options = args.count > 1 ? args[1] as? [String: Any] ?? [:] : [:]
+            DispatchQueue.main.async {
+                CraftBrowser.shared.open(url, mode: options["mode"] as? String ?? "safari", callbackScheme: options["callbackScheme"] as? String, from: nil) { answer in
+                    complete(requestToken, .success(answer), completion)
+                }
+            }
+            return
+        case ("Auth", "signInWithApple"):
+            guard config.enableSocialAuth else {
+                complete(requestToken, failure("CAPABILITY_DISABLED", "Social sign-in is disabled"), completion)
+                return
+            }
+            let options = args.first as? [String: Any] ?? [:]
+            DispatchQueue.main.async {
+                CraftSignInWithApple.shared.signIn(nonce: options["nonce"] as? String) { result in
+                    complete(requestToken, result.mapError { CraftNativeActionError(code: $0.code, message: $0.message) }.map { $0 as Any }, completion)
+                }
+            }
+            return
         case ("Dialog", _):
             // The system's own alert, confirmation and action sheet, the same
             // ones a page gets (CraftNativeUI.swift), over the native screen.

package/dist/ios/templates/CraftNativeScreen.swift

@@ -1,9 +1,11 @@
 import Foundation
 import AVFoundation
 import AVKit
+import CryptoKit
 import Darwin
 import JavaScriptCore
 import OSLog
+import Security
 import SwiftUI
 import UIKit
 
@@ -2461,6 +2463,89 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         jsContext.setObject(snapshotSet, forKeyedSubscript: "craftNativeSnapshotSet" as NSString)
         jsContext.setObject(secureGet, forKeyedSubscript: "craftNativeSecureGet" as NSString)
         jsContext.setObject(setOptions, forKeyedSubscript: "craftNativeSetOptions" as NSString)
+        // `crypto` for code shared with the page (a sign-in's nonce and its
+        // SHA-256): JavaScriptCore has none. Random bytes from the system's
+        // generator, digests from CryptoKit, both as hex.
+        let randomBytes: @convention(block) (Int) -> String? = { count in
+            guard count >= 0, count <= 65_536 else { return nil }
+            var bytes = [UInt8](repeating: 0, count: count)
+            guard count == 0 || SecRandomCopyBytes(kSecRandomDefault, count, &bytes) == errSecSuccess else { return nil }
+            return bytes.map { String(format: "%02x", $0) }.joined()
+        }
+        let digest: @convention(block) (String, String) -> String? = { algorithm, hex in
+            var data = Data(capacity: hex.count / 2)
+            var index = hex.startIndex
+            while index < hex.endIndex {
+                let next = hex.index(index, offsetBy: 2, limitedBy: hex.endIndex) ?? hex.endIndex
+                guard let byte = UInt8(hex[index..<next], radix: 16) else { return nil }
+                data.append(byte)
+                index = next
+            }
+            let bytes: [UInt8]
+            switch algorithm.uppercased() {
+            case "SHA-1": bytes = Array(Insecure.SHA1.hash(data: data))
+            case "SHA-256": bytes = Array(SHA256.hash(data: data))
+            case "SHA-384": bytes = Array(SHA384.hash(data: data))
+            case "SHA-512": bytes = Array(SHA512.hash(data: data))
+            default: return nil
+            }
+            return bytes.map { String(format: "%02x", $0) }.joined()
+        }
+        jsContext.setObject(randomBytes, forKeyedSubscript: "craftNativeRandomBytes" as NSString)
+        jsContext.setObject(digest, forKeyedSubscript: "craftNativeDigest" as NSString)
+        jsContext.evaluateScript("""
+            (function() {
+                var cryptoObject = globalThis.crypto || {};
+                function hexToBytes(hex) {
+                    var bytes = new Uint8Array(hex.length / 2);
+                    for (var i = 0; i < bytes.length; i++) bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+                    return bytes;
+                }
+                function toHex(bytes) {
+                    var out = '';
+                    for (var i = 0; i < bytes.length; i++) out += (bytes[i] < 16 ? '0' : '') + bytes[i].toString(16);
+                    return out;
+                }
+                function viewOf(data) {
+                    if (data instanceof ArrayBuffer) return new Uint8Array(data);
+                    if (ArrayBuffer.isView(data)) return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+                    throw new TypeError('crypto.subtle.digest needs an ArrayBuffer or a typed array');
+                }
+                if (typeof cryptoObject.getRandomValues !== 'function') {
+                    cryptoObject.getRandomValues = function(array) {
+                        if (!ArrayBuffer.isView(array)) throw new TypeError('crypto.getRandomValues needs a typed array');
+                        var hex = craftNativeRandomBytes(array.byteLength);
+                        if (hex == null) throw new Error('No random bytes from the system');
+                        new Uint8Array(array.buffer, array.byteOffset, array.byteLength).set(hexToBytes(hex));
+                        return array;
+                    };
+                }
+                if (typeof cryptoObject.randomUUID !== 'function') {
+                    cryptoObject.randomUUID = function() {
+                        var b = cryptoObject.getRandomValues(new Uint8Array(16));
+                        b[6] = (b[6] & 0x0f) | 0x40;
+                        b[8] = (b[8] & 0x3f) | 0x80;
+                        var h = toHex(b);
+                        return h.slice(0, 8) + '-' + h.slice(8, 12) + '-' + h.slice(12, 16) + '-' + h.slice(16, 20) + '-' + h.slice(20);
+                    };
+                }
+                if (!cryptoObject.subtle || typeof cryptoObject.subtle.digest !== 'function') {
+                    cryptoObject.subtle = Object.assign(cryptoObject.subtle || {}, {
+                        digest: function(algorithm, data) {
+                            try {
+                                var name = typeof algorithm === 'string' ? algorithm : algorithm && algorithm.name;
+                                var out = craftNativeDigest(String(name || ''), toHex(viewOf(data)));
+                                if (out == null) return Promise.reject(new Error('Unsupported digest: ' + name));
+                                return Promise.resolve(hexToBytes(out).buffer);
+                            } catch (error) {
+                                return Promise.reject(error);
+                            }
+                        }
+                    });
+                }
+                globalThis.crypto = cryptoObject;
+            })();
+        """)
         jsContext.evaluateScript("""
             (function() {
                 function text(value) {

package/dist/ios/templates/CraftNativeUI.swift

@@ -390,6 +390,74 @@ extension CraftBrowser: ASWebAuthenticationPresentationContextProviding {
     }
 }
 
+// MARK: - Sign in with Apple
+
+struct CraftSignInWithAppleError: Error {
+    let code: String
+    let message: String
+}
+
+/// `craft.signInWithApple`: the system's Sign in with Apple sheet, for a page
+/// and for a native screen alike. Answers with Apple's user id, the name and
+/// email when Apple shares them (the first time only), the identity token and
+/// the one-use authorization code a server redeems at Apple. `nonce` is what
+/// the caller wants written into the identity token (its SHA-256, by
+/// convention).
+final class CraftSignInWithApple: NSObject {
+    static let shared = CraftSignInWithApple()
+
+    private var completion: ((Result<[String: Any], CraftSignInWithAppleError>) -> Void)?
+    private var controller: ASAuthorizationController?
+
+    func signIn(nonce: String?, completion: @escaping (Result<[String: Any], CraftSignInWithAppleError>) -> Void) {
+        // One sheet at a time: a second request answers the first.
+        self.completion?(.failure(CraftSignInWithAppleError(code: "CANCELLED", message: "Another sign-in started")))
+        self.completion = completion
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        request.requestedScopes = [.fullName, .email]
+        if let nonce, !nonce.isEmpty { request.nonce = nonce }
+        let controller = ASAuthorizationController(authorizationRequests: [request])
+        controller.delegate = self
+        controller.presentationContextProvider = self
+        self.controller = controller
+        controller.performRequests()
+    }
+
+    private func finish(_ result: Result<[String: Any], CraftSignInWithAppleError>) {
+        let completion = self.completion
+        self.completion = nil
+        controller = nil
+        completion?(result)
+    }
+}
+
+extension CraftSignInWithApple: ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        guard let credential = authorization.credential as? ASAuthorizationAppleIDCredential else {
+            finish(.failure(CraftSignInWithAppleError(code: "SIGN_IN_FAILED", message: "Apple answered without an Apple ID")))
+            return
+        }
+        var result: [String: Any] = ["userId": credential.user]
+        if let email = credential.email { result["email"] = email }
+        let name = [credential.fullName?.givenName, credential.fullName?.familyName].compactMap { $0 }.joined(separator: " ")
+        if !name.isEmpty { result["name"] = name }
+        if let token = credential.identityToken.flatMap({ String(data: $0, encoding: .utf8) }) { result["identityToken"] = token }
+        // One use, five minutes: the server redeems it at Apple's token
+        // endpoint and so reads the identity straight from Apple.
+        if let code = credential.authorizationCode.flatMap({ String(data: $0, encoding: .utf8) }) { result["authorizationCode"] = code }
+        finish(.success(result))
+    }
+
+    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let cancelled = (error as? ASAuthorizationError)?.code == .canceled
+        finish(.failure(CraftSignInWithAppleError(code: cancelled ? "CANCELLED" : "SIGN_IN_FAILED", message: error.localizedDescription)))
+    }
+
+    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        CraftPresenter.keyWindow() ?? ASPresentationAnchor()
+    }
+}
+
 // MARK: - SF Symbols
 
 /// `craft.symbols.image`: an SF Symbol drawn to a PNG data URL, so a page can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craft-native",
-  "version": "0.0.144",
+  "version": "0.0.145",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",