craft-native 0.0.487 → 0.0.491

package/dist/android/src/index.d.ts

@@ -183,6 +183,20 @@ export interface CraftAndroidConfig {
      * screen, and a change of it is `SESSION_CHANGED { key, token, previous }`.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while choosing the start path, before any screen
+     * is built. The `nativeApp` script cannot do the same job: `openScreen`
+     * returns as soon as it has an isolate and evaluates the script later, so
+     * the gate and the first screen race — and on a launch that follows an
+     * expired token rather than a sign-out, losing paints the previous
+     * session's kept snapshot.
+     *
+     * The same shape as the iOS field, deliberately: one `nativeGate` block
+     * must gate both hosts or an app is protected on one and not the other.
+     */
+    nativeGate?: AndroidNativeGate;
     /** Wake the app script every so often (`craftBackgroundRefresh`), through WorkManager. */
     backgroundRefresh?: {
         enabled?: boolean;
@@ -208,6 +222,20 @@ export interface CraftAndroidConfig {
         sessions?: boolean;
     };
 }
+/**
+ * An auth gate the shell applies while choosing the start path.
+ *
+ * See `CraftAndroidConfig.nativeGate`. Mirrors the iOS `NativeGate`, field for
+ * field, because one config block has to gate both hosts.
+ */
+export interface AndroidNativeGate {
+    /** Paths a signed-out launch may start on, each admitting what sits under it. */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftTabBarConfig {
     selection?: {
         /** The selected tab indicator's corner radius in dp; omitted keeps the default. */

package/dist/android/src/index.js

@@ -1247,6 +1247,21 @@ function validateNativeRouteConfig(config) {
     if (!matchesNativeRoute(config.nativeScreens, start, config.nativeScreenConstraints))
       throw new Error(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativeRoutePath(gate.redirect) !== gate.redirect)
+      throw new Error(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    if (config.renderer === "native" && screens.length > 0 && !matchesNativeRoute(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativeRoutePath(path) !== path)
+        throw new Error(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (!(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      throw new Error("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       throw new Error(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/android/templates/CraftNativeServices.kt.template

@@ -685,7 +685,16 @@ internal class CraftNativeServices(
                 voiceRecorder = null
                 val metadata = MediaMetadataRetriever()
                 val duration = try { metadata.setDataSource(file.absolutePath); (metadata.extractMetadata(MediaMetadataRetriever.METADATA_KEY_DURATION)?.toDoubleOrNull() ?: 0.0) / 1000 } finally { metadata.release() }
-                if (!file.exists() || file.length() == 0L || duration <= 0) throw IllegalStateException("Empty recording")
+                // Nothing recorded is its own answer, not a read failure.
+                // Thrown into the blanket catch below, it reached callers as
+                // RECORDING_FAILED and became indistinguishable from a damaged
+                // file, so an app could offer "nothing was recorded — try
+                // again" on iOS and not here (#496).
+                if (!file.exists() || file.length() == 0L || duration <= 0) {
+                    cancelVoice()
+                    done(failure("EMPTY_RECORDING", "The recording was empty"))
+                    return
+                }
                 done(success(JSONObject().put("path", file.absolutePath).put("name", file.name).put("type", "audio/mp4").put("size", file.length()).put("durationSeconds", duration)))
             } catch (_: Exception) { cancelVoice(); done(failure("RECORDING_FAILED", "The recording could not be read")) }
             return

package/dist/android/templates/CraftNativeShell.kt.template

@@ -398,6 +398,15 @@ internal class CraftNativeStores private constructor(
 
     fun snapshot(name: String): String? = snapshotCache[name]
 
+    /**
+     * One secure value, read directly rather than through the preload.
+     *
+     * For code that runs before any isolate exists. The auth gate resolves the
+     * start path before the first screen is built, so it cannot wait for the
+     * preload every isolate is handed (#499).
+     */
+    fun secureValue(key: String): String? = secure?.getString(key, null)
+
     /** `craft.storage.setSync`: null removes the key. Tells every isolate. */
     fun setStorage(key: String, json: String?, from: String?) {
         synchronized(CraftNativeStorage.lock) {
@@ -416,6 +425,13 @@ internal class CraftNativeStores private constructor(
             main.post { done(false) }
             return
         }
+        // UIKit refuses a payload that is not JSON before it touches the
+        // disk, and a checkpoint kept on one host and refused on the other is
+        // the divergence this contract exists to prevent (#396).
+        if (json != null && !craftNativeIsJsonText(json)) {
+            main.post { done(false) }
+            return
+        }
         writer.execute {
             val file = snapshotFile(name)
             val previous = snapshotCache[name]
@@ -465,7 +481,19 @@ internal class CraftNativeStores private constructor(
         CraftNativeHub.broadcast("SYNC_UPDATE", payload, except = from)
     }
 
-    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}"))
+    /**
+     * The same names UIKit accepts, so one checkpoint key is not valid on one
+     * host and refused on the other.
+     *
+     * `CraftSnapshots.isValidName` allows ASCII alphanumerics and `-_.:`, up
+     * to 128 characters, and rejects only a leading dot. The `:` is deliberate
+     * there — its own comment calls it the account namespace — so a key like
+     * `account:slot` wrote on iOS and came back `false` on Android.
+     *
+     * A colon never reaches the filesystem: `snapshotFile` percent-encodes the
+     * name, and `snapshotName` decodes it back.
+     */
+    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}"))
 
     private fun snapshotFile(name: String): File = File(snapshotsDir, URLEncoder.encode(name, "UTF-8") + ".json")
 
@@ -495,6 +523,32 @@ internal object CraftNativePrelude {
      */
     fun sessionTokenKey(config: JSONObject): String = config.optString("sessionTokenKey").ifBlank { "auth.token" }
 
+    /**
+     * Whether `path` may be shown to someone who is not signed in.
+     *
+     * Listed, or under something listed: `/m/store` admits `/m/store/42` and
+     * not `/m/storefront`. The separator is attached before comparing so a
+     * listed path cannot admit a sibling that merely starts with its letters.
+     *
+     * A literal mirror of `CraftHybrid.gateAdmits` in
+     * `packages/ios/templates/CraftHybrid.swift`, down to the trailing-slash
+     * trimming, because the two hosts must admit exactly the same paths from
+     * the same `publicPaths` list. `native-gate.test.ts` runs both against one
+     * table of cases.
+     */
+    fun gateAdmits(path: String, allowed: List<String>): Boolean = allowed.any { entry ->
+        var listed = entry
+        while (listed.length > 1 && listed.endsWith("/")) listed = listed.dropLast(1)
+        when {
+            listed.isEmpty() -> false
+            path == listed -> true
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            listed == "/" -> false
+            else -> path.startsWith("$listed/")
+        }
+    }
+
     fun script(
         bridgeFields: String,
         post: String,
@@ -632,7 +686,12 @@ internal object CraftNativePrelude {
             if (message && message.type === 'FRAME_FIRE') {
               var due = frames;
               frames = [];
-              var time = message.payload && message.payload.time || Date.now();
+              // A real first frame is 0, which `||` would replace with a Unix
+              // epoch value twelve orders of magnitude away. Only a missing or
+              // non-finite time falls back, and it falls back to the same
+              // origin-relative scale rather than to wall-clock.
+              var reported = message.payload && message.payload.time;
+              var time = typeof reported === 'number' && isFinite(reported) ? reported : 0;
               due.forEach(function(entry) {
                 if (cancelledFrames[entry.id]) { delete cancelledFrames[entry.id]; return; }
                 try { entry.fn(time); } catch (error) { console.error('[frame] ' + (error && error.stack || error)); }
@@ -704,8 +763,11 @@ internal object CraftNativePrelude {
             if (json === null || json === undefined) return null;
             try { return JSON.parse(json); } catch (error) { return null; }
           }
+          // The same names the host accepts, including the `:` UIKit calls the
+          // account namespace. This gate runs inside the isolate, so a stricter
+          // rule here refuses a key the host would have kept.
           function validSnapshotName(name) {
-            return /^[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}$/.test(name);
+            return /^[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}$/.test(name);
           }
           var craft = globalThis.craft = globalThis.craft || {};
           function keep(name, extras) {
@@ -735,7 +797,7 @@ internal object CraftNativePrelude {
             },
             set: function(name, value) {
               name = String(name);
-              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_" and "-"'));
+              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_", "-" and ":"'));
               var json = value === null ? null : JSON.stringify(value);
               if (json === undefined) return Promise.reject(new TypeError('Snapshot ' + name + ' is not JSON'));
               if (json === null) delete sync.snapshots[name];
@@ -824,9 +886,24 @@ internal object CraftNativePrelude {
 
 /**
  * The bar above a screen (back, title, the screen's buttons) and the tab bar
- * below it, in plain Android views. A screen sets its bar with
- * `craft.navigation.setOptions` (title, largeTitle, hidden, rightButtons,
- * tabAccessory, tabBarHidden); the tabs come from the app's `tabs`.
+ * below it, in plain Android views. The tabs come from the app's `tabs`; a
+ * screen sets its own chrome with
+ *
+ * `craft.navigation.setOptions({ title, largeTitle, titleColor, hidden,
+ *   backgroundColor, leftButtons, rightButtons, tabItem, tabAccessory,
+ *   tabBarHidden, tabBarHiddenWhenPushed, tabSwipeEnabled })`
+ *
+ * which `apply` below reads. That list is checked against `apply` itself
+ * rather than kept by hand, and only the list is: the iOS comment named
+ * twelve keys while fifteen shipped (#489), and a first attempt at the same
+ * ratchet there passed with keys deleted because the prose underneath
+ * happened to mention them. Six of these twelve had never been written down.
+ *
+ * `tabBarHiddenWhenPushed` was honoured here and nowhere else in Craft until
+ * #493: hiding the tab bar on push is the ordinary iOS idiom, so a caller who
+ * set it got the behaviour on one host and silence on the other. UIKit reads
+ * the same key now, at the same depth, through CraftNativeScreen's
+ * `wantsTabBarHidden`.
  */
 internal class CraftNativeChrome(
     context: Context,
@@ -1316,7 +1393,25 @@ internal class CraftNativeChrome(
         if (badge > 0) {
             view.text = "${view.text}${if (button.optString("badgeStyle") == "dot") " •" else " $badge"}"
         }
-        view.setOnClickListener { onButton?.invoke(id) }
+        // `menu`: the button opens a popup instead of reporting its own id, and
+        // each choice is reported as a press of that choice's id.
+        val choices = button.optJSONArray("menu")
+        val menu = (0 until minOf(choices?.length() ?: 0, 12)).mapNotNull { index ->
+            choices?.optJSONObject(index)?.takeIf { it.optString("id").isNotBlank() && it.optString("title").isNotBlank() }
+        }
+        view.setOnClickListener {
+            if (menu.isEmpty()) onButton?.invoke(id)
+            else android.widget.PopupMenu(context, view).apply {
+                menu.forEachIndexed { index, choice ->
+                    this.menu.add(0, index, index, choice.optString("title")).isEnabled = !choice.optBoolean("disabled")
+                }
+                setOnMenuItemClickListener { selected ->
+                    menu.getOrNull(selected.itemId)?.let { onButton?.invoke(it.optString("id")) }
+                    true
+                }
+                show()
+            }
+        }
         view.layoutParams = LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, ViewGroup.LayoutParams.MATCH_PARENT)
         return view
     }
@@ -2052,3 +2147,182 @@ internal object CraftNativeIcons {
         override fun getOpacity(): Int = android.graphics.PixelFormat.TRANSLUCENT
     }
 }
+
+/**
+ * Whether `text` is JSON that UIKit's own writer would also accept.
+ *
+ * UIKit refuses a snapshot whose payload is not JSON, before it touches the
+ * disk: `JSONSerialization.jsonObject(with:options: [.fragmentsAllowed])`
+ * returning nil fails the write. Android had no such check, so a payload iOS
+ * rejected was written here and the two hosts disagreed about whether a
+ * checkpoint had been kept (#396).
+ *
+ * The grammar is Foundation's, measured rather than assumed, because it is
+ * not RFC 8259 and a strict parser would have diverged in the other
+ * direction:
+ *
+ *  - top-level fragments are allowed (`42`, `"text"`, `null`);
+ *  - **one** trailing comma is allowed in an object or array — `{"a":1,}`
+ *    and `[1,]` are accepted, `{"a":1,,}` and `[,1]` are not;
+ *  - a lone surrogate escape is rejected, a matched pair accepted;
+ *  - a raw control character inside a string is rejected, its escape is not;
+ *  - `00`, `+1`, `.5`, `1.`, `1.0e`, `NaN` and `Infinity` are all rejected;
+ *  - trailing content after the value is rejected, surrounding space is not.
+ *
+ * `org.json` cannot stand in for this: `JSONTokener` accepts unquoted keys,
+ * single quotes and more, so it would admit payloads UIKit refuses.
+ * `android.util.JsonReader` in strict mode refuses top-level fragments that
+ * UIKit accepts. Both are wrong in a direction that matters, which is why
+ * this is scanned here and pinned against Foundation itself by
+ * `packages/android/src/snapshot-json-contract.test.ts`.
+ */
+private class CraftNativeJsonScanner(private val text: String) {
+    private var at = 0
+
+    fun validate(): Boolean {
+        skipWhitespace()
+        if (!value()) return false
+        skipWhitespace()
+        return at == text.length
+    }
+
+    private fun skipWhitespace() {
+        while (at < text.length && (text[at] == ' ' || text[at] == '\t' || text[at] == '\n' || text[at] == '\r')) at++
+    }
+
+    private fun value(): Boolean {
+        if (at >= text.length) return false
+        return when (text[at]) {
+            '{' -> obj()
+            '[' -> arr()
+            '"' -> string()
+            't' -> literal("true")
+            'f' -> literal("false")
+            'n' -> literal("null")
+            else -> number()
+        }
+    }
+
+    private fun literal(word: String): Boolean {
+        if (!text.startsWith(word, at)) return false
+        at += word.length
+        return true
+    }
+
+    /** After a member, consume the separator. Returns null when malformed. */
+    private fun afterMember(closing: Char): Boolean? {
+        skipWhitespace()
+        if (at >= text.length) return null
+        return when (text[at]) {
+            ',' -> {
+                at++
+                skipWhitespace()
+                // Foundation allows exactly one trailing comma before the
+                // close. A second comma, or a close that never comes, is not.
+                if (at < text.length && text[at] == closing) { at++; true } else false
+            }
+            closing -> { at++; true }
+            else -> null
+        }
+    }
+
+    private fun obj(): Boolean {
+        at++
+        skipWhitespace()
+        if (at < text.length && text[at] == '}') { at++; return true }
+        while (true) {
+            skipWhitespace()
+            if (at >= text.length || text[at] != '"') return false
+            if (!string()) return false
+            skipWhitespace()
+            if (at >= text.length || text[at] != ':') return false
+            at++
+            skipWhitespace()
+            if (!value()) return false
+            val done = afterMember('}') ?: return false
+            if (done) return true
+        }
+    }
+
+    private fun arr(): Boolean {
+        at++
+        skipWhitespace()
+        if (at < text.length && text[at] == ']') { at++; return true }
+        while (true) {
+            skipWhitespace()
+            if (!value()) return false
+            val done = afterMember(']') ?: return false
+            if (done) return true
+        }
+    }
+
+    private fun string(): Boolean {
+        at++
+        var pendingHighSurrogate = false
+        while (at < text.length) {
+            val character = text[at]
+            when {
+                character == '"' -> { at++; return !pendingHighSurrogate }
+                character == '\\' -> {
+                    at++
+                    if (at >= text.length) return false
+                    val escape = text[at]
+                    if (escape == 'u') {
+                        if (at + 4 >= text.length) return false
+                        var code = 0
+                        for (offset in 1..4) {
+                            val digit = Character.digit(text[at + offset], 16)
+                            if (digit < 0) return false
+                            code = code * 16 + digit
+                        }
+                        at += 5
+                        val high = code in 0xD800..0xDBFF
+                        val low = code in 0xDC00..0xDFFF
+                        // A low surrogate is only legal directly after a high
+                        // one, and a high one must be followed by a low one.
+                        if (pendingHighSurrogate != low) return false
+                        pendingHighSurrogate = high
+                        continue
+                    }
+                    if (pendingHighSurrogate) return false
+                    if (escape !in listOf('"', '\\', '/', 'b', 'f', 'n', 'r', 't')) return false
+                    at++
+                }
+                character.code < 0x20 -> return false
+                else -> {
+                    if (pendingHighSurrogate) return false
+                    at++
+                }
+            }
+        }
+        return false
+    }
+
+    private fun number(): Boolean {
+        val start = at
+        if (at < text.length && text[at] == '-') at++
+        val integerStart = at
+        while (at < text.length && text[at] in '0'..'9') at++
+        if (at == integerStart) return false
+        // A leading zero may not be followed by another digit.
+        if (text[integerStart] == '0' && at - integerStart > 1) return false
+        if (at < text.length && text[at] == '.') {
+            at++
+            val fractionStart = at
+            while (at < text.length && text[at] in '0'..'9') at++
+            if (at == fractionStart) return false
+        }
+        if (at < text.length && (text[at] == 'e' || text[at] == 'E')) {
+            at++
+            if (at < text.length && (text[at] == '+' || text[at] == '-')) at++
+            val exponentStart = at
+            while (at < text.length && text[at] in '0'..'9') at++
+            if (at == exponentStart) return false
+        }
+        return at > start
+    }
+}
+
+/** Whether a snapshot payload is JSON both hosts accept. */
+private fun craftNativeIsJsonText(text: String): Boolean = CraftNativeJsonScanner(text).validate()
+