pakstr 0.18.2 → 0.19.1

package/README.md

@@ -44,8 +44,13 @@ build:
   web: ./dist
   out: ./build/app.apk
   builder: docker
+
+# runtime:
+#   apiBase: https://api.example.com  # Optional packaged /api/* proxy target.
 ```
 
+`runtime.apiBase` must be an absolute HTTPS URL. It is public APK metadata, not a secret. When omitted, Pakstr generates an empty runtime config and keeps `/api/*` disabled; when set, `/api/x` forwards to `<apiBase>/api/x`.
+
 ### 3. Build, sign, and publish
 ```bash
 npx pakstr run

package/android-template/app/build.gradle.kts

@@ -39,6 +39,23 @@ android {
         }
     }
 
+    androidResources {
+        ignoreAssetsPatterns.clear()
+        ignoreAssetsPatterns.addAll(
+            listOf(
+                "!.svn",
+                "!.git",
+                "!.ds_store",
+                "!*.scc",
+                ".*",
+                "!CVS",
+                "!thumbs.db",
+                "!picasa.ini",
+                "!*~"
+            )
+        )
+    }
+
     defaultConfig {
         applicationId = "com.pakstr.app"
         minSdk = 28
@@ -53,9 +70,23 @@ android {
         debug {
             applicationIdSuffix = ".debug"
             versionNameSuffix = "-debug"
+            manifestPlaceholders["pakstrNip55CallbackScheme"] =
+                "pakstr-${providers.gradleProperty("pakstrDebugCallbackHash").get()}"
+            buildConfigField(
+                "String",
+                "PAKSTR_NIP55_CALLBACK_SCHEME",
+                "\"pakstr-${providers.gradleProperty("pakstrDebugCallbackHash").get()}\""
+            )
         }
 
         release {
+            manifestPlaceholders["pakstrNip55CallbackScheme"] =
+                "pakstr-${providers.gradleProperty("pakstrReleaseCallbackHash").get()}"
+            buildConfigField(
+                "String",
+                "PAKSTR_NIP55_CALLBACK_SCHEME",
+                "\"pakstr-${providers.gradleProperty("pakstrReleaseCallbackHash").get()}\""
+            )
             // Only attach the signing config when a keystore was provided;
             // otherwise emit an unsigned release APK for pakstr sign to sign.
             val keystorePath = System.getenv("PAKSTR_ANDROID_KEYSTORE_PATH")

package/android-template/app/src/androidTest/java/com/pakstr/app/Nip55CallbackTest.kt

@@ -0,0 +1,106 @@
+package com.pakstr.app
+
+import android.content.Intent
+import android.net.Uri
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class Nip55CallbackTest {
+
+    @Test
+    fun accepts_fragment_callback_and_preserves_logical_event() {
+        val event = "{\"kind\":27235,\"content\":\"hello & goodbye / 100%\"}"
+        val intent = callbackIntent(
+            "${Nip55Callback.PARAM}=${Uri.encode(event)}"
+        )
+
+        val result = Nip55Callback.result(intent)
+
+        assertEquals(event, result)
+        assertEquals(
+            event,
+            Uri.parse(Nip55Callback.localUrl(result!!))
+                .getQueryParameter(Nip55Callback.PARAM)
+        )
+    }
+
+    @Test
+    fun rejects_query_callback() {
+        val url = Uri.Builder()
+            .scheme(BuildConfig.PAKSTR_NIP55_CALLBACK_SCHEME)
+            .authority("nip55-callback")
+            .appendQueryParameter(Nip55Callback.PARAM, "value")
+            .build()
+
+        assertNull(Nip55Callback.result(Intent(Intent.ACTION_VIEW, url)))
+    }
+
+    @Test
+    fun rejects_missing_or_empty_fragment_result() {
+        assertNull(Nip55Callback.result(callbackIntent("other=value")))
+        assertNull(Nip55Callback.result(callbackIntent("${Nip55Callback.PARAM}=")))
+        assertNull(Nip55Callback.result(callbackIntent(null)))
+    }
+
+    @Test
+    fun rejects_unexpected_fragment_structure() {
+        assertNull(
+            Nip55Callback.result(
+                callbackIntent("${Nip55Callback.PARAM}=value&other=value")
+            )
+        )
+        assertNull(
+            Nip55Callback.result(
+                callbackIntent("prefix-${Nip55Callback.PARAM}=value")
+            )
+        )
+        assertNull(
+            Nip55Callback.result(
+                callbackIntent("${Nip55Callback.PARAM}=%not-encoded")
+            )
+        )
+    }
+
+    @Test
+    fun rejects_untrusted_callback_location_or_action() {
+        val validScheme = BuildConfig.PAKSTR_NIP55_CALLBACK_SCHEME
+        val encodedFragment = "${Nip55Callback.PARAM}=value"
+        val urls = listOf(
+            "https://nip55-callback#$encodedFragment",
+            "$validScheme://other#$encodedFragment",
+            "$validScheme://nip55-callback/path#$encodedFragment",
+            "$validScheme://nip55-callback:123#$encodedFragment"
+        )
+
+        urls.forEach { url ->
+            assertNull(
+                url,
+                Nip55Callback.result(
+                    Intent(Intent.ACTION_VIEW, Uri.parse(url))
+                )
+            )
+        }
+        assertNull(
+            Nip55Callback.result(
+                Intent(
+                    Intent.ACTION_SEND,
+                    Uri.parse("$validScheme://nip55-callback#$encodedFragment")
+                )
+            )
+        )
+    }
+
+    private fun callbackIntent(encodedFragment: String?): Intent {
+        val url = Uri.Builder()
+            .scheme(BuildConfig.PAKSTR_NIP55_CALLBACK_SCHEME)
+            .authority("nip55-callback")
+            .apply {
+                if (encodedFragment != null) {
+                    encodedFragment(encodedFragment)
+                }
+            }
+            .build()
+        return Intent(Intent.ACTION_VIEW, url)
+    }
+}

package/android-template/app/src/main/AndroidManifest.xml

@@ -37,6 +37,7 @@
         <activity
             android:name=".MainActivity"
             android:exported="true"
+            android:launchMode="singleTask"
             android:theme="@style/Theme.App.Starting">
 
             <intent-filter>
@@ -44,6 +45,15 @@
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
 
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data
+                    android:scheme="${pakstrNip55CallbackScheme}"
+                    android:host="nip55-callback" />
+            </intent-filter>
+
         </activity>
 
         <provider

package/android-template/app/src/main/java/com/pakstr/app/MainActivity.kt

@@ -160,9 +160,16 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
         showLoader(true)
 
         runtime.start()
+        Nip55Callback.result(intent)?.let(runtime::handleNip55Callback)
 
     }
 
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        setIntent(intent)
+        Nip55Callback.result(intent)?.let(runtime::handleNip55Callback)
+    }
+
     private fun showDebugFab() {
         diagnosticsHandler.removeCallbacks(diagnosticsExpiryCheck)
 

package/android-template/app/src/main/java/com/pakstr/app/Nip55Callback.kt

@@ -0,0 +1,55 @@
+package com.pakstr.app
+
+import android.content.Intent
+import android.net.Uri
+
+internal object Nip55Callback {
+
+    const val PARAM = "nip55_event"
+    private const val HOST = "nip55-callback"
+    private const val FRAGMENT_PREFIX = "$PARAM="
+    private const val MAX_RESULT_LENGTH = 128 * 1024
+
+    fun result(intent: Intent?): String? {
+        if (intent?.action != Intent.ACTION_VIEW) {
+            return null
+        }
+
+        val url = intent.data ?: return null
+        if (url.scheme != BuildConfig.PAKSTR_NIP55_CALLBACK_SCHEME ||
+            url.host != HOST ||
+            (url.path != null && url.path != "") ||
+            url.port != -1 ||
+            url.query != null
+        ) {
+            return null
+        }
+
+        val encodedFragment = url.encodedFragment ?: return null
+        if (!encodedFragment.startsWith(FRAGMENT_PREFIX)) {
+            return null
+        }
+
+        val encodedResult = encodedFragment.removePrefix(FRAGMENT_PREFIX)
+        if (encodedResult.isEmpty()) {
+            return null
+        }
+
+        val result = Uri.decode(encodedResult)
+        return result.takeIf {
+            it.isNotEmpty() &&
+                    it.length <= MAX_RESULT_LENGTH &&
+                    Uri.encode(it) == encodedResult
+        }
+    }
+
+    fun localUrl(result: String): String {
+        return Uri.Builder()
+            .scheme("http")
+            .encodedAuthority("127.0.0.1:${Config.PORT}")
+            .path("/")
+            .appendQueryParameter(PARAM, result)
+            .build()
+            .toString()
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/PakstrBridge.kt

@@ -0,0 +1,11 @@
+package com.pakstr.app
+
+import android.webkit.JavascriptInterface
+
+class PakstrBridge {
+
+    @JavascriptInterface
+    fun getNip55CallbackUrl(): String {
+        return "${BuildConfig.PAKSTR_NIP55_CALLBACK_SCHEME}://nip55-callback#nip55_event="
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/ShellRuntime.kt

@@ -198,6 +198,10 @@ class ShellRuntime(
 
     }
 
+    fun handleNip55Callback(result: String) {
+        controller.handleNip55Callback(result)
+    }
+
     fun getWebview(): WebView {
 
         return webView

package/android-template/app/src/main/java/com/pakstr/app/WebViewController.kt

@@ -1,7 +1,10 @@
 package com.pakstr.app
 
 import android.app.Activity
+import android.content.ActivityNotFoundException
 import android.content.Context
+import android.content.Intent
+import android.provider.Browser
 import android.view.View
 import android.webkit.CookieManager
 import android.webkit.PermissionRequest
@@ -39,9 +42,15 @@ class WebViewController(
     private val permissionHandler: PermissionHandler
 
 ) {
+    private var pendingNip55Result: String? = null
+    private var isSetup = false
+
     // Keeps a reference to the runnable to prevent memory leaks if destroyed early
     private val loadRunnable = Runnable {
-        webView.loadUrl("http://127.0.0.1:$port/")
+        val url = pendingNip55Result?.let(Nip55Callback::localUrl)
+            ?: "http://127.0.0.1:$port/"
+        pendingNip55Result = null
+        webView.loadUrl(url)
         //webView.loadUrl("https://sigit.io")
         //webView.loadUrl("http://127.0.0.1:$port/not-found.html")
     }
@@ -52,9 +61,22 @@ class WebViewController(
         showLoader()
         setupCookies()
         setupWebView()
+        isSetup = true
         loadApp()
     }
 
+    fun handleNip55Callback(result: String) {
+        if (!isSetup) {
+            pendingNip55Result = result
+            return
+        }
+
+        webView.removeCallbacks(loadRunnable)
+        webView.post {
+            webView.loadUrl(Nip55Callback.localUrl(result))
+        }
+    }
+
     private fun setupWebView() {
         webView.apply {
             // Idiomatically configure WebView settings using scoping functions
@@ -205,6 +227,25 @@ class WebViewController(
                     view: WebView?, request: WebResourceRequest?
                 ): Boolean {
                     val url = request?.url ?: return true
+                    if (url.scheme.equals("nostrsigner", ignoreCase = true)) {
+                        try {
+                            val intent = Intent(Intent.ACTION_VIEW, url).apply {
+                                putExtra(
+                                    Browser.EXTRA_APPLICATION_ID,
+                                    context.packageName
+                                )
+                            }
+                            context.startActivity(intent)
+                        } catch (error: ActivityNotFoundException) {
+                            AppDebugLogger.error(
+                                context,
+                                "WEBVIEW",
+                                "No app can handle nostrsigner URL",
+                                error
+                            )
+                        }
+                        return true
+                    }
                     return url.host != "127.0.0.1"
                 }
 
@@ -274,6 +315,10 @@ class WebViewController(
             "AndroidBridge"
 
         )
+        webView.addJavascriptInterface(
+            PakstrBridge(),
+            "PakstrBridge"
+        )
 
     }
 
@@ -320,6 +365,7 @@ class WebViewController(
 
         webView.loadUrl("about:blank")
         webView.removeCallbacks(loadRunnable)
+        pendingNip55Result = null
         webView.onPause()
 
 

package/android-template/gradle.properties

@@ -12,4 +12,6 @@ org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
 # https://developer.android.com/r/tools/gradle-multi-project-decoupled-projects
 # org.gradle.parallel=true
 # Kotlin code style for this project: "official" or "obsolete":
-kotlin.code.style=official
+kotlin.code.style=official
+pakstrReleaseCallbackHash=e4f4806f2885cc1a66691b4798000f54f5109b8b0fe5eb2e25d6f4e6bd879024
+pakstrDebugCallbackHash=693aba441df6e40093bc62f2bf8eb9591cc5d9178729d604cccf6b45a4c6521d

package/dist/android/gradle.js

@@ -4,7 +4,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patchGradle = patchGradle;
+exports.callbackScheme = callbackScheme;
 exports.readAndroidGradleMetadata = readAndroidGradleMetadata;
+const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const ASSIGNMENTS = {
@@ -20,6 +22,7 @@ function patchGradle(androidRoot, manifest) {
     content = replaceSingleAssignment(content, "versionCode", ASSIGNMENTS.versionCode, `versionCode = ${manifest.versionCode}`);
     content = replaceSingleAssignment(content, "versionName", ASSIGNMENTS.versionName, `versionName = ${quoteKotlinString(manifest.versionName)}`);
     fs_1.default.writeFileSync(gradlePath, content);
+    patchCallbackHashes(androidRoot, manifest.appId);
     const metadata = readAndroidGradleMetadata(gradlePath);
     if (metadata.applicationId !== manifest.appId) {
         throw new Error("Generated Gradle applicationId does not match manifest.appId");
@@ -33,6 +36,25 @@ function patchGradle(androidRoot, manifest) {
     console.log("⚙️ Gradle identity and version patched");
     return metadata;
 }
+function callbackScheme(applicationId) {
+    const hash = crypto_1.default.createHash("sha256").update(applicationId, "utf8").digest("hex");
+    return `pakstr-${hash}`;
+}
+function patchCallbackHashes(androidRoot, applicationId) {
+    const propertiesPath = path_1.default.join(androidRoot, "gradle.properties");
+    let content = fs_1.default.readFileSync(propertiesPath, "utf8");
+    content = replaceSingleProperty(content, "pakstrReleaseCallbackHash", callbackScheme(applicationId).slice("pakstr-".length));
+    content = replaceSingleProperty(content, "pakstrDebugCallbackHash", callbackScheme(`${applicationId}.debug`).slice("pakstr-".length));
+    fs_1.default.writeFileSync(propertiesPath, content);
+}
+function replaceSingleProperty(content, name, value) {
+    const pattern = new RegExp(`^${name}=.*$`, "gm");
+    const matches = content.match(pattern) ?? [];
+    if (matches.length !== 1) {
+        throw new Error(`Expected exactly one Gradle property ${name}, found ${matches.length}`);
+    }
+    return content.replace(pattern, `${name}=${value}`);
+}
 function readAndroidGradleMetadata(gradlePath) {
     const content = fs_1.default.readFileSync(gradlePath, "utf8");
     return {

package/dist/commands/build.js

@@ -36,6 +36,7 @@ async function buildCommand(configPath) {
             androidRoot,
             webDir: config.build.web,
             app: config.app,
+            runtime: config.runtime,
             configDir: config.configDir,
         });
         console.log("\n⚙️  Running build runner...");

package/dist/commands/init.js

@@ -183,6 +183,9 @@ build:
   out: ${c.out}          # OPTIONAL. Default ./build/<appId>.apk
   builder: docker               # Only "docker" is specified.
 
+# runtime:
+#   apiBase: https://api.example.com  # OPTIONAL. Enables the packaged /api/* proxy.
+
 publish:
   upload:
     provider: blossom

package/dist/core/androidProject.js

@@ -21,7 +21,7 @@ const DEFAULT_ICON_PATH = path_1.default.resolve(__dirname, "../../assets/logo.p
  * icon, splash, and permissions, then verifies the generated project.
  */
 async function prepareAndroidProject(opts) {
-    const { androidRoot, webDir, app, configDir } = opts;
+    const { androidRoot, webDir, app, runtime = {}, configDir } = opts;
     const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
     if (!fs_1.default.existsSync(webDir)) {
         throw new Error(`Web assets not found: ${webDir}`);
@@ -29,7 +29,7 @@ async function prepareAndroidProject(opts) {
     fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
     fs_1.default.mkdirSync(assetsTarget, { recursive: true });
     copyFolder(webDir, assetsTarget);
-    generateRuntimeConfig(assetsTarget);
+    generateRuntimeConfig(assetsTarget, runtime);
     (0, gradle_1.patchGradle)(androidRoot, app);
     (0, branding_1.patchAppName)(androidRoot, app.appName);
     const icon = await (0, iconResolver_1.resolveAppIcon)({
@@ -50,16 +50,12 @@ async function prepareAndroidProject(opts) {
         appLabel: app.appName,
     });
 }
-/**
- * Generate the runtime config written into the packaged web assets.
- * Pakstr's config model has no runtime/debug fields, so this emits an empty
- * config (kept for template compatibility).
- */
-function generateRuntimeConfig(webRoot) {
-    const runtime = {};
-    const jsContent = `window.PAKSTR_CONFIG = ${JSON.stringify(runtime, null, 2)};\n`;
-    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-config.js"), jsContent.trim());
-    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-runtime.json"), JSON.stringify(runtime, null, 2));
+/** Generate runtime config files in the packaged web assets. */
+function generateRuntimeConfig(webRoot, runtime = {}) {
+    const serialized = JSON.stringify(runtime, null, 2);
+    const jsContent = `window.PAKSTR_CONFIG = ${serialized};`;
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-config.js"), jsContent);
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-runtime.json"), serialized);
 }
 function copyFolder(src, dest) {
     for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {

package/dist/core/pakstrConfig.js

@@ -178,6 +178,20 @@ function resolveAndValidate(config, configPath) {
         versionName: resolvedVersion.versionName,
         versionCode: resolvedVersion.versionCode,
     };
+    // runtime section
+    const runtime = config.runtime;
+    const resolvedRuntime = {};
+    if (runtime !== undefined) {
+        if (runtime === null || typeof runtime !== "object" || Array.isArray(runtime)) {
+            fail(`${where("runtime")} must be a mapping`, configPath);
+        }
+        if (runtime.apiBase !== undefined) {
+            if (typeof runtime.apiBase !== "string" || runtime.apiBase.length === 0) {
+                fail(`${where("runtime.apiBase")} must be a non-empty string`, configPath);
+            }
+            resolvedRuntime.apiBase = validateRuntimeApiBase(runtime.apiBase, "runtime.apiBase", configPath);
+        }
+    }
     // publish section
     const publish = config.publish;
     let zapstoreEnabled = true;
@@ -277,6 +291,7 @@ function resolveAndValidate(config, configPath) {
         configPath,
         app: resolvedApp,
         build: { web: webAbs, out, builder },
+        runtime: resolvedRuntime,
         publish: { zapstoreEnabled, zapstoreSource, upload, publishKey, relay, blossom },
     };
 }
@@ -311,6 +326,25 @@ function validatePublicUrl(value, field, configPath) {
     }
     return parsed.toString().replace(/\/$/, value.endsWith("/") ? "/" : "");
 }
+function validateRuntimeApiBase(value, field, configPath) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        fail(`${field} must be an absolute HTTPS URL`, configPath);
+    }
+    if (parsed.protocol !== "https:" || !parsed.hostname) {
+        fail(`${field} must be an absolute HTTPS URL`, configPath);
+    }
+    if (parsed.username || parsed.password) {
+        fail(`${field} must not contain credentials`, configPath);
+    }
+    if (parsed.search || parsed.hash) {
+        fail(`${field} must not contain a query string or fragment`, configPath);
+    }
+    return parsed.toString().replace(/\/$/, "");
+}
 function requireSafeSegment(value, field, configPath) {
     requireString(value, field, configPath);
     if (value === "." || value === ".." || /[\\/\x00-\x1f\x7f]/.test(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.18.2",
+  "version": "0.19.1",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",