react-native-oauth-essentials 1.0.12 → 1.1.1

package/lib/typescript/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;IAC/B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;IAChC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;IAChC,IAAI,EAAE,IAAI,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;IAC/B,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,oBAAY,eAAe;IACzB,SAAS,cAAc,CAAE,4BAA4B;IACrD,QAAQ,aAAa,CAAE,4BAA4B;IACnD,QAAQ,aAAa,CAAE,+BAA+B;IACtD,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,SAAS,cAAc,CAAE,gCAAgC;IACzD,OAAO,YAAY;CACpB;AAED,oBAAY,eAAe;IACzB,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,eAAe,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;IAC/B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;IAChC,IAAI,EAAE;QACJ,2EAA2E;QAC3E,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,oBAAoB;QACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACjC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;IAChC,IAAI,EAAE,IAAI,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;IAC/B,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,mDAAmD;QACnD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,iEAAiE;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,oBAAY,eAAe;IACzB,SAAS,cAAc,CAAE,4BAA4B;IACrD,QAAQ,aAAa,CAAE,4BAA4B;IACnD,QAAQ,aAAa,CAAE,+BAA+B;IACtD,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,SAAS,cAAc,CAAE,gCAAgC;IACzD,OAAO,YAAY,CAAE,0BAA0B;IAC/C,KAAK,UAAU;CAChB;AAED,oBAAY,sBAAsB;IAChC,UAAU,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,WAAW,gBAAgB;CAC5B;AAED,oBAAY,eAAe;IACzB;;OAEG;IACH,sBAAsB,2BAA2B;IACjD,8FAA8F;IAC9F,iBAAiB,sBAAsB;IACvC,4FAA4F;IAC5F,oBAAoB,yBAAyB;IAC7C,kFAAkF;IAClF,oBAAoB,yBAAyB;IAC7C,qFAAqF;IACrF,uBAAuB,4BAA4B;IACnD,yFAAyF;IACzF,mBAAmB,wBAAwB;IAC3C,8FAA8F;IAC9F,mBAAmB,wBAAwB;IAC3C;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C,+EAA+E;IAC/E,aAAa,kBAAkB;CAChC;AAED,wEAAwE;AACxE,MAAM,MAAM,mBAAmB,GAAG,GAAG,eAAe,EAAE,CAAC;AAEvD,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,CAC9B,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,IACjD,KAAK,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-oauth-essentials",
-  "version": "1.0.12",
+  "version": "1.1.1",
   "description": "Essential Auth tools for every app.",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -10,6 +10,8 @@
       "types": "./lib/typescript/src/index.d.ts",
       "default": "./lib/module/index.js"
     },
+    "./jest": "./jest/index.js",
+    "./app.plugin.js": "./app.plugin.js",
     "./package.json": "./package.json"
   },
   "files": [
@@ -20,6 +22,9 @@
     "cpp",
     "*.podspec",
     "react-native.config.js",
+    "app.plugin.js",
+    "plugin",
+    "jest",
     "!ios/build",
     "!android/build",
     "!android/gradle",
@@ -50,6 +55,7 @@
     "ios",
     "android",
     "expo",
+    "expo-config-plugin",
     "oauth",
     "oauth2",
     "auth",
@@ -71,9 +77,7 @@
     "google-sign-in",
     "openid",
     "openid-connect",
-    "biometric",
-    "mobile",
-    "web"
+    "mobile"
   ],
   "repository": {
     "type": "git",

package/plugin/withOauthEssentials.js

@@ -0,0 +1,291 @@
+/**
+ * Expo config plugin of react-native-oauth-essentials.
+ *
+ *   plugins: [
+ *     ['react-native-oauth-essentials', {
+ *       google: { iosClientId: '1234-abcd.apps.googleusercontent.com', webClientId: '...' },
+ *       appleSignIn: true,
+ *       webCredentialsDomains: ['example.com'],
+ *     }],
+ *   ]
+ *
+ * - google: `{ iosClientId?, webClientId? }`, or `true` to only use the Firebase files
+ *   (`ios.googleServicesFile` / `android.googleServicesFile`) for the missing ids. Writes:
+ *   - iOS: the reversed iOS client id URL scheme (without it GoogleSignIn cannot open), and
+ *     GIDClientID / GIDServerClientID to Info.plist;
+ *   - Android: the web client id as the `com.oauthessentials.GOOGLE_WEB_CLIENT_ID` meta-data.
+ *   So the app can call `googleSignIn()` without client ids.
+ * - appleSignIn: adds the Sign in with Apple entitlement.
+ * - webCredentialsDomains: adds `webcredentials:<domain>` associated domains (passkeys and
+ *   saved passwords).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const PLUGIN_NAME = 'react-native-oauth-essentials';
+const APPLE_SIGN_IN_ENTITLEMENT = 'com.apple.developer.applesignin';
+const ASSOCIATED_DOMAINS_ENTITLEMENT = 'com.apple.developer.associated-domains';
+const GOOGLE_WEB_CLIENT_ID_META_DATA =
+  'com.oauthessentials.GOOGLE_WEB_CLIENT_ID';
+
+// OAuth client types in google-services.json.
+const IOS_CLIENT_TYPE = 2;
+const WEB_CLIENT_TYPE = 3;
+
+/**
+ * Same rule as GoogleSignIn (GIDSignInCallbackSchemes): the client id components in reverse order.
+ */
+function googleUrlScheme(iosClientId) {
+  return iosClientId.split('.').reverse().join('.');
+}
+
+function nonEmpty(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+/**
+ * `CLIENT_ID` (the iOS client id) of a Firebase GoogleService-Info.plist, which Firebase always
+ * writes as XML.
+ */
+function googleIdsFromServicesPlist(xml) {
+  const match = /<key>\s*CLIENT_ID\s*<\/key>\s*<string>([^<]*)<\/string>/.exec(
+    xml
+  );
+  return { iosClientId: nonEmpty(match && match[1]) };
+}
+
+/**
+ * Web and iOS client ids of a Firebase google-services.json: the `client` of `androidPackage`
+ * (or the first one), its `oauth_client` and `appinvite_service.other_platform_oauth_client`.
+ * The iOS client must match `bundleIdentifier` when it is known.
+ */
+function googleIdsFromServicesJson(
+  json,
+  { androidPackage, bundleIdentifier } = {}
+) {
+  const clients = Array.isArray(json && json.client) ? json.client : [];
+  const client =
+    clients.find(
+      (item) =>
+        androidPackage &&
+        item.client_info &&
+        item.client_info.android_client_info &&
+        item.client_info.android_client_info.package_name === androidPackage
+    ) || clients[0];
+  if (!client) {
+    return {};
+  }
+  const oauthClients = [
+    ...(client.oauth_client || []),
+    ...((client.services &&
+      client.services.appinvite_service &&
+      client.services.appinvite_service.other_platform_oauth_client) ||
+      []),
+  ];
+  const web = oauthClients.find((item) => item.client_type === WEB_CLIENT_TYPE);
+  const ios = oauthClients.find(
+    (item) =>
+      item.client_type === IOS_CLIENT_TYPE &&
+      (!bundleIdentifier ||
+        (item.ios_info && item.ios_info.bundle_id === bundleIdentifier))
+  );
+  return {
+    webClientId: nonEmpty(web && web.client_id),
+    iosClientId: nonEmpty(ios && ios.client_id),
+  };
+}
+
+/**
+ * Explicit ids win over the ones read from the Firebase files.
+ */
+function resolveGoogleIds(google, fromPlist = {}, fromJson = {}) {
+  const explicit = typeof google === 'object' && google !== null ? google : {};
+  return {
+    iosClientId:
+      nonEmpty(explicit.iosClientId) ||
+      fromPlist.iosClientId ||
+      fromJson.iosClientId,
+    webClientId: nonEmpty(explicit.webClientId) || fromJson.webClientId,
+  };
+}
+
+/**
+ * Reads the Firebase files set in the app config (paths relative to the project root).
+ */
+function loadGoogleIds(config, google, projectRoot) {
+  const read = (file) =>
+    file ? fs.readFileSync(path.resolve(projectRoot, file), 'utf8') : null;
+  const plist = read(config.ios && config.ios.googleServicesFile);
+  const json = read(config.android && config.android.googleServicesFile);
+  return resolveGoogleIds(
+    google,
+    plist ? googleIdsFromServicesPlist(plist) : {},
+    json
+      ? googleIdsFromServicesJson(JSON.parse(json), {
+          androidPackage: config.android && config.android.package,
+          bundleIdentifier: config.ios && config.ios.bundleIdentifier,
+        })
+      : {}
+  );
+}
+
+/**
+ * Leaves Info.plist unchanged without an iOS client id (Google may be used on Android only).
+ */
+function setGoogleInfoPlist(infoPlist, google) {
+  const iosClientId = google && nonEmpty(google.iosClientId);
+  if (!iosClientId) {
+    return infoPlist;
+  }
+  const scheme = googleUrlScheme(iosClientId);
+  const urlTypes = Array.isArray(infoPlist.CFBundleURLTypes)
+    ? infoPlist.CFBundleURLTypes
+    : [];
+  const registered = urlTypes.some(
+    (type) =>
+      Array.isArray(type.CFBundleURLSchemes) &&
+      type.CFBundleURLSchemes.some(
+        (value) => String(value).toLowerCase() === scheme.toLowerCase()
+      )
+  );
+
+  const result = {
+    ...infoPlist,
+    CFBundleURLTypes: registered
+      ? urlTypes
+      : [...urlTypes, { CFBundleURLSchemes: [scheme] }],
+    GIDClientID: iosClientId,
+  };
+  const webClientId = nonEmpty(google.webClientId);
+  if (webClientId) {
+    result.GIDServerClientID = webClientId;
+  }
+  return result;
+}
+
+/**
+ * Sets the web client id `<meta-data>` of `<application>` (AndroidManifest as parsed by Expo),
+ * replacing a previous value.
+ */
+function setGoogleWebClientIdMetaData(androidManifest, webClientId) {
+  const manifest = androidManifest.manifest;
+  const applications = manifest.application || [];
+  if (applications.length === 0) {
+    throw new Error(`${PLUGIN_NAME}: AndroidManifest.xml has no <application>`);
+  }
+  const [application, ...rest] = applications;
+  const metaData = (application['meta-data'] || []).filter(
+    (item) =>
+      !item.$ || item.$['android:name'] !== GOOGLE_WEB_CLIENT_ID_META_DATA
+  );
+  metaData.push({
+    $: {
+      'android:name': GOOGLE_WEB_CLIENT_ID_META_DATA,
+      'android:value': webClientId,
+    },
+  });
+  return {
+    ...androidManifest,
+    manifest: {
+      ...manifest,
+      application: [{ ...application, 'meta-data': metaData }, ...rest],
+    },
+  };
+}
+
+function setEntitlements(entitlements, options) {
+  const result = { ...entitlements };
+  if (options.appleSignIn) {
+    result[APPLE_SIGN_IN_ENTITLEMENT] = ['Default'];
+  }
+  const domains = options.webCredentialsDomains || [];
+  if (domains.length > 0) {
+    const current = Array.isArray(result[ASSOCIATED_DOMAINS_ENTITLEMENT])
+      ? result[ASSOCIATED_DOMAINS_ENTITLEMENT]
+      : [];
+    const added = domains.map((domain) =>
+      domain.startsWith('webcredentials:') ? domain : `webcredentials:${domain}`
+    );
+    result[ASSOCIATED_DOMAINS_ENTITLEMENT] = [
+      ...new Set([...current, ...added]),
+    ];
+  }
+  return result;
+}
+
+function withOauthEssentials(config, options = {}) {
+  // Loaded lazily: only Expo apps have it, and the helpers above are tested without it.
+  const {
+    withInfoPlist,
+    withEntitlementsPlist,
+    withAndroidManifest,
+    WarningAggregator,
+  } = require('expo/config-plugins');
+
+  let result = config;
+  if (options.google) {
+    result = withInfoPlist(result, (mod) => {
+      const ids = loadGoogleIds(
+        mod,
+        options.google,
+        mod.modRequest.projectRoot
+      );
+      if (!ids.iosClientId) {
+        WarningAggregator.addWarningIOS(
+          PLUGIN_NAME,
+          'no Google iOS client id, so Info.plist is not changed and googleSignIn() rejects with ' +
+            'CONFIGURATION_ERROR on iOS. Set "google": { "iosClientId": "..." } or ' +
+            '"ios.googleServicesFile" (ignore this if you only use Google on Android).'
+        );
+        return mod;
+      }
+      if (!ids.webClientId) {
+        WarningAggregator.addWarningIOS(
+          PLUGIN_NAME,
+          'no Google web client id, so GIDServerClientID is not set (the idToken audience is the iOS ' +
+            'client id). Set "google": { "webClientId": "..." } or "android.googleServicesFile".'
+        );
+      }
+      mod.modResults = setGoogleInfoPlist(mod.modResults, ids);
+      return mod;
+    });
+    result = withAndroidManifest(result, (mod) => {
+      const ids = loadGoogleIds(
+        mod,
+        options.google,
+        mod.modRequest.projectRoot
+      );
+      if (!ids.webClientId) {
+        WarningAggregator.addWarningAndroid(
+          PLUGIN_NAME,
+          'no Google web client id: googleSignIn() rejects with CONFIGURATION_ERROR on Android unless ' +
+            'it receives { webClientId }. Set "google": { "webClientId": "..." } or ' +
+            '"android.googleServicesFile".'
+        );
+        return mod;
+      }
+      mod.modResults = setGoogleWebClientIdMetaData(
+        mod.modResults,
+        ids.webClientId
+      );
+      return mod;
+    });
+  }
+  if (options.appleSignIn || (options.webCredentialsDomains || []).length > 0) {
+    result = withEntitlementsPlist(result, (mod) => {
+      mod.modResults = setEntitlements(mod.modResults, options);
+      return mod;
+    });
+  }
+  return result;
+}
+
+module.exports = withOauthEssentials;
+module.exports.googleUrlScheme = googleUrlScheme;
+module.exports.googleIdsFromServicesPlist = googleIdsFromServicesPlist;
+module.exports.googleIdsFromServicesJson = googleIdsFromServicesJson;
+module.exports.resolveGoogleIds = resolveGoogleIds;
+module.exports.setGoogleInfoPlist = setGoogleInfoPlist;
+module.exports.setGoogleWebClientIdMetaData = setGoogleWebClientIdMetaData;
+module.exports.setEntitlements = setEntitlements;

package/src/NativeOauthEssentials.ts

@@ -3,12 +3,20 @@ import {
   type TurboModule,
   TurboModuleRegistry,
 } from 'react-native';
+import { missingNativeModuleMessage } from './platform';
 
 export interface Spec extends TurboModule {
   // Events
+  /** Emitted with the `{ type, data }` a credential method resolves with, including `CANCELLED`. */
   readonly onCredentialSuccess: CodegenTypes.EventEmitter<CredentialSuccessEvent>;
+  /** Emitted with `{ code, message }` when a credential method rejects. */
   readonly onCredentialFailure: CodegenTypes.EventEmitter<CredentialErrorEvent>;
+  /** iOS only: emitted with `{ type: 'REVOKED' }` on `credentialRevokedNotification`. */
+  readonly onAppleIdCredentialRevoked: CodegenTypes.EventEmitter<AppleIdCredentialRevokedEvent>;
 
+  /**
+   * Read once when the module loads. See the exported constants in `index.tsx` for the values.
+   */
   getConstants(): {
     readonly GOOGLE_PLAY_SERVICES_SUPPORTED: boolean;
     readonly PASSWORD_SUPPORTED: boolean;
@@ -16,53 +24,115 @@ export interface Spec extends TurboModule {
     readonly APPLE_ID_SUPPORTED: boolean;
     readonly HYBRID_SUPPORTED: boolean;
     readonly PASSKEYS_SUPPORTED: boolean;
+    readonly OAUTH_REDIRECT_URI: string;
   };
 
   /**
-   * Performs the google sign in.
-   * @param androidAndIOSClientId
-   * @param options
+   * iOS: GoogleSignIn `signIn` from the top most view controller. Android: Credential Manager
+   * Google ID / "Sign in with Google" option, then the Authorization API when `scopes` or
+   * `offlineAccess` are set. Resolves `GOOGLE_ID` or `CANCELLED`.
+   * @param androidAndIOSClientId - Web client id on Android, iOS client id on iOS. '' reads it from
+   * the app: iOS `GIDClientID`, then `CLIENT_ID` of GoogleService-Info.plist; Android the
+   * `com.oauthessentials.GOOGLE_WEB_CLIENT_ID` meta-data, then the `default_web_client_id` string
+   * (Firebase). Rejects `CONFIGURATION_ERROR` when it is missing or, on iOS, when its reversed URL
+   * scheme is not registered.
+   * @param options - GoogleSignInOptions, already normalized by `index.tsx`.
    */
   googleSignIn(androidAndIOSClientId: string, options: Object): Promise<Object>;
 
   /**
-   * Sign ins with apple.
-   * @param androidWebUrl
+   * iOS: GoogleSignIn `restorePreviousSignIn` (no UI). Android: Credential Manager filtered to
+   * authorized accounts with auto select, authorization without UI.
+   * Resolves `GOOGLE_ID` or `CANCELLED`, rejects `NO_SIGN_IN_AVAILABLE` when there is nothing to restore.
    */
-  appleSignIn(androidWebUrl?: string): Promise<Object>;
+  googleSilentSignIn(
+    androidAndIOSClientId: string,
+    options: Object
+  ): Promise<Object>;
 
   /**
-   * Saves the username/password credential
-   * @param username
-   * @param password
+   * iOS: GoogleSignIn `signOut`. Android: Credential Manager `clearCredentialState`.
+   * Resolves `true`. Does not emit events.
+   */
+  signOut(): Promise<boolean>;
+
+  /**
+   * iOS: native Apple ID request (`fullName`, `email`, `options.nonce`, `options.state`); resolves
+   * `APPLE_ID` or `CANCELLED`, `androidWebUrl` is ignored.
+   * Android: opens `androidWebUrl` in a Custom Tab and resolves `WEB_APPLE_ID` with the redirect
+   * url or `CANCELLED`; `options` is ignored.
+   * Unlike `appleSignIn` in `index.tsx`, it does not fill `email`/`fullName` from previous results.
+   */
+  appleSignIn(androidWebUrl: string | null, options: Object): Promise<Object>;
+
+  /**
+   * iOS: `ASAuthorizationAppleIDProvider.getCredentialState`, resolves `AUTHORIZED`, `REVOKED`,
+   * `TRANSFERRED` or `NOT_FOUND`. Android: always rejects `NOT_SUPPORTED_ERROR`.
+   */
+  getAppleIdCredentialState(userId: string): Promise<string>;
+
+  /**
+   * iOS: resolves `false` without doing anything. Android: Credential Manager
+   * `CreatePasswordRequest`, resolves `true` when saved and `false` on any error.
    */
   passwordSignIn(username: string, password: string): Promise<boolean>;
 
   /**
-   * Gets the saved password.
+   * Shows the saved passwords. Resolves `PASSWORD`, or `CANCELLED` when there is none or the user
+   * dismisses it.
    */
   getPassword(): Promise<Object>;
 
   /**
-   * Performs the called so "hybrid sign in"
-   * @param googleClientId
-   * @param options
+   * iOS: Apple ID + password request (`googleClientId` ignored). Android: Google ID + password
+   * Credential Manager request. Resolves the picked credential or `CANCELLED`.
    */
   hybridSignIn(googleClientId: string, options: Object): Promise<Object>;
 
   /**
-   * Creates the passkey.
+   * Registers a passkey from `options.requestJson` (WebAuthn creation options).
+   * Resolves `PASSKEY` with the registration response JSON string in `data`, or `CANCELLED`.
    */
   createPassKey(options: Object): Promise<Object>;
 
   /**
-   * Gets the passkey
-   * @param options
+   * Asserts a passkey from `options.requestJson` (WebAuthn request options), with
+   * `options.mediation === 'autofill'` on iOS for QuickType bar AutoFill.
+   * Resolves `PASSKEY` with the authentication response JSON string in `data`, or `CANCELLED`.
    */
   getPassKey(options: Object): Promise<Object>;
+
+  /**
+   * iOS 16+: cancels a pending AutoFill `getPassKey` (which resolves `CANCELLED`) and resolves
+   * `true`, or resolves `false` when there is none. Android: resolves `false`.
+   */
+  cancelPassKeyAutoFill(): Promise<boolean>;
+
+  /**
+   * Resolves `{ codeVerifier, codeChallenge, state }`: a 32 byte random base64url verifier, its
+   * SHA-256 base64url challenge (PKCE S256) and a 16 byte random base64url state.
+   */
+  generatePkce(): Promise<Object>;
+
+  /**
+   * Opens `url` in `ASWebAuthenticationSession` (iOS, `options.callbackScheme`,
+   * `options.prefersEphemeralSession`) or a Custom Tab (Android, http/https only, `options`
+   * ignored). Resolves `{ type: 'REDIRECT', data: { url } }` with the redirect url, or `CANCELLED`.
+   * Does not emit events.
+   */
+  openAuthSession(url: string, options: Object): Promise<Object>;
+}
+
+// `get` instead of `getEnforcing` to explain Expo Go and missing rebuilds instead of a generic error.
+function getNativeModule(): Spec {
+  const module = TurboModuleRegistry.get<Spec>('OauthEssentials');
+  if (!module) {
+    throw new Error(missingNativeModuleMessage());
+  }
+  return module;
 }
 
-export default TurboModuleRegistry.getEnforcing<Spec>('OauthEssentials');
+export default getNativeModule();
 
 type CredentialSuccessEvent = {
   type: string;
@@ -73,3 +143,7 @@ type CredentialErrorEvent = {
   code: string;
   message: string;
 };
+
+type AppleIdCredentialRevokedEvent = {
+  type: string;
+};

package/src/errors.ts

@@ -0,0 +1,49 @@
+import {
+  CredentialError,
+  type CredentialErrorCode,
+  type OauthEssentialsError,
+} from './types';
+
+const CODES = new Set<string>(Object.values(CredentialError));
+
+/**
+ * Narrows an unknown error (e.g. in a `catch`) to an error rejected by this library, optionally
+ * with a specific code.
+ *
+ * ```ts
+ * try {
+ *   await googleSignIn({ iosClientId, webClientId });
+ * } catch (e) {
+ *   if (isCredentialError(e, CredentialError.BROWSER_UNAVAILABLE)) retryLater();
+ *   else if (isCredentialError(e)) report(e.code, e.message);
+ *   else throw e;
+ * }
+ * ```
+ */
+export function isCredentialError<
+  C extends CredentialErrorCode = CredentialErrorCode
+>(error: unknown, code?: C): error is OauthEssentialsError<C> {
+  if (typeof error !== 'object' || error === null) {
+    return false;
+  }
+  const value = (error as { code?: unknown }).code;
+  if (typeof value !== 'string' || !CODES.has(value)) {
+    return false;
+  }
+  return code === undefined || value === code;
+}
+
+export function createCredentialError<C extends CredentialErrorCode>(
+  code: C,
+  message: string,
+  cause?: unknown
+): OauthEssentialsError<C> {
+  const error = new Error(message) as OauthEssentialsError<C> & {
+    cause?: unknown;
+  };
+  error.code = code;
+  if (cause !== undefined) {
+    error.cause = cause;
+  }
+  return error;
+}