yaver-feedback-react-native 0.5.5 → 0.6.1

package/dist/auth.js

@@ -2,26 +2,25 @@
 /**
  * Authentication + device/agent discovery API used by the Yaver Feedback SDK.
  *
- * This module is a trimmed SDK-local port of mobile/src/lib/auth.ts. It only
- * covers what the embedded login/machine-picker flow needs:
+ * Mirrors mobile/src/lib/auth.ts:
  *
- *   - Device-code login (`POST /auth/device-code` + `GET /auth/device-code/poll`)
- *     so users can sign in via any OAuth provider (apple/google/github/gitlab/
- *     microsoft) on yaver.io without requiring deep-link wiring in the host app.
+ *   - Native Apple Sign-In (`POST /auth/apple-native`) on iOS via
+ *     `expo-apple-authentication`.
+ *   - In-app browser OAuth for Google/Microsoft/GitHub/GitLab via
+ *     `expo-web-browser`'s `openAuthSessionAsync` — same callback URL
+ *     (`yaver://oauth-callback`) the Yaver mobile app uses.
  *   - Email / password sign-up + login (no 2FA flow — for SDK simplicity).
- *   - Token validation + refresh.
+ *   - Token validation.
  *   - `/devices/list` → owned + shared (guest) remote dev machines.
  *
- * All calls target the public Yaver Convex site URL by default; callers may
- * override via `init()` config to point at staging.
- *
- * Token persistence uses `@react-native-async-storage/async-storage` (already
- * a peer dep). SecureStore is intentionally avoided to keep the SDK portable
- * to any RN host app.
+ * Mobile-only. A web equivalent will ship as a separate `yaver-web-feedback`
+ * package; do not import this module from a browser bundle.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = void 0;
+exports.DEFAULT_OAUTH_REDIRECT = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = void 0;
 exports.configureAuthEndpoints = configureAuthEndpoints;
+exports.setStrictNativeAuth = setStrictNativeAuth;
+exports.isStrictNativeAuth = isStrictNativeAuth;
 exports.getConvexSiteUrl = getConvexSiteUrl;
 exports.getWebBaseUrl = getWebBaseUrl;
 exports.getToken = getToken;
@@ -33,8 +32,8 @@ exports.getSelectedDeviceId = getSelectedDeviceId;
 exports.saveSelectedDeviceId = saveSelectedDeviceId;
 exports.clearSelectedDeviceId = clearSelectedDeviceId;
 exports.validateToken = validateToken;
-exports.startDeviceCode = startDeviceCode;
-exports.pollDeviceCode = pollDeviceCode;
+exports.signInWithApple = signInWithApple;
+exports.signInWithOAuth = signInWithOAuth;
 exports.signupWithEmail = signupWithEmail;
 exports.loginWithEmail = loginWithEmail;
 exports.listReachableDevices = listReachableDevices;
@@ -46,6 +45,21 @@ try {
 catch {
     // not installed — token persistence disabled, caller must pass authToken
 }
+let WebBrowser = null;
+try {
+    WebBrowser = require('expo-web-browser');
+    WebBrowser?.maybeCompleteAuthSession();
+}
+catch {
+    // optional
+}
+let AppleAuth = null;
+try {
+    AppleAuth = require('expo-apple-authentication');
+}
+catch {
+    // optional — Apple sign-in falls back to in-app browser OAuth
+}
 const TOKEN_KEY = 'yaver_feedback_auth_token';
 const USER_KEY = 'yaver_feedback_user';
 const DEVICE_KEY = 'yaver_feedback_selected_device';
@@ -53,6 +67,7 @@ exports.DEFAULT_CONVEX_SITE_URL = 'https://shocking-echidna-394.eu-west-1.convex
 exports.DEFAULT_WEB_BASE_URL = 'https://yaver.io';
 let convexSiteUrl = exports.DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = exports.DEFAULT_WEB_BASE_URL;
+let strictNativeAuth = false;
 /** Override the Convex site URL + web base (staging vs prod). */
 function configureAuthEndpoints(opts) {
     if (opts.convexSiteUrl)
@@ -60,6 +75,17 @@ function configureAuthEndpoints(opts) {
     if (opts.webBaseUrl)
         webBaseUrl = opts.webBaseUrl;
 }
+/**
+ * Enable strict native auth: refuse any fallback that would redirect the
+ * user to an external browser (Safari / Chrome) or show a device code.
+ * See FeedbackConfig.strictNativeAuth for rationale.
+ */
+function setStrictNativeAuth(enabled) {
+    strictNativeAuth = enabled;
+}
+function isStrictNativeAuth() {
+    return strictNativeAuth;
+}
 function getConvexSiteUrl() {
     return convexSiteUrl;
 }
@@ -178,54 +204,113 @@ async function validateToken(token) {
         return null;
     }
 }
+// ─── Native Apple Sign-In ─────────────────────────────────────────────
 /**
- * Start a device-code flow. The user opens `verificationUrl`, signs in with
- * any OAuth provider on yaver.io, and the SDK polls `pollDeviceCode` until
- * a session token is issued.
+ * Sign in with Apple using the native ASAuthorization flow. Requires
+ * `expo-apple-authentication` installed and the host app's bundle to have
+ * the "Sign in with Apple" capability enabled. iOS only.
+ *
+ * Throws `cancelled` if the user dismisses the sheet.
  */
-async function startDeviceCode(opts) {
-    const res = await fetch(`${convexSiteUrl}/auth/device-code`, {
+async function signInWithApple() {
+    if (!AppleAuth) {
+        throw new Error('expo-apple-authentication is not installed. Add it as a peer dep to enable native Apple Sign-In.');
+    }
+    const available = await AppleAuth.isAvailableAsync();
+    if (!available) {
+        throw new Error('Apple Sign-In is not available on this device');
+    }
+    let credential;
+    try {
+        credential = await AppleAuth.signInAsync({
+            requestedScopes: [
+                AppleAuth.AppleAuthenticationScope.FULL_NAME,
+                AppleAuth.AppleAuthenticationScope.EMAIL,
+            ],
+        });
+    }
+    catch (err) {
+        if (err?.code === 'ERR_REQUEST_CANCELED') {
+            throw new Error('cancelled');
+        }
+        throw err;
+    }
+    if (!credential.identityToken) {
+        throw new Error('Apple did not return an identity token');
+    }
+    const fullName = [credential.fullName?.givenName, credential.fullName?.familyName]
+        .filter(Boolean)
+        .join(' ') || undefined;
+    const res = await fetch(`${convexSiteUrl}/auth/apple-native`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            machineName: opts?.machineName,
-            platform: opts?.platform,
-            preferredProvider: opts?.preferredProvider,
-            environment: 'feedback-sdk',
-        }),
+        body: JSON.stringify({ identityToken: credential.identityToken, fullName }),
     });
     if (!res.ok) {
-        const data = await res.json().catch(() => ({}));
-        throw new Error(data.error ?? 'Failed to start device-code');
+        const body = await res.text().catch(() => '');
+        throw new Error(body || 'Apple sign-in failed');
     }
     const data = await res.json();
-    const params = new URLSearchParams({ code: data.userCode });
-    if (opts?.preferredProvider) {
-        params.set('preferredProvider', opts.preferredProvider);
-    }
-    return {
-        userCode: data.userCode,
-        deviceCode: data.deviceCode,
-        expiresAt: data.expiresAt,
-        verificationUrl: `${webBaseUrl}/auth/device?${params.toString()}`,
-    };
+    return { token: data.token, userId: data.userId };
 }
-async function pollDeviceCode(deviceCode) {
+// ─── In-app browser OAuth (Google / GitHub / GitLab / Microsoft) ──────
+/**
+ * Default OAuth redirect — the same callback the Yaver mobile app uses
+ * (`yaver://oauth-callback`). `WebBrowser.openAuthSessionAsync` intercepts
+ * this redirect inside the auth session, so the host app does not need to
+ * register the scheme on iOS. On Android, add an `<intent-filter>` for
+ * `yaver://oauth-callback` in the host app's AndroidManifest.xml.
+ */
+exports.DEFAULT_OAUTH_REDIRECT = 'yaver://oauth-callback';
+/**
+ * Sign in through the in-app browser via yaver.io. Opens
+ * `https://yaver.io/api/auth/oauth/<provider>?client=mobile`, the user picks
+ * an OAuth provider, and the web callback redirects back to
+ * `yaver://oauth-callback?token=...` which `openAuthSessionAsync` captures
+ * inside the auth session. No deep-link wiring required on iOS.
+ *
+ * Throws `cancelled` if the user dismisses the browser.
+ */
+async function signInWithOAuth(provider, opts) {
+    if (!WebBrowser) {
+        // In strictNativeAuth we hard-fail rather than letting the caller
+        // fall back to any homegrown `Linking.openURL(…)` flow that would
+        // leave the app for Safari. Without strict mode we still can't
+        // proceed (no browser module available) so the behavior is the same
+        // — just a clearer error message.
+        throw new Error('expo-web-browser is not installed. Add it as a peer dep to enable in-app OAuth sign-in.');
+    }
+    const redirectUrl = opts?.redirectUrl ?? exports.DEFAULT_OAUTH_REDIRECT;
+    const params = new URLSearchParams({ client: 'mobile' });
+    const authUrl = `${webBaseUrl}/api/auth/oauth/${provider}?${params.toString()}`;
+    // In strict mode force ephemeral session (ASWebAuthenticationSession
+    // with no shared cookie jar) so the OAuth dance is visibly native and
+    // can never hand off to the user's default browser.
+    const prefer = strictNativeAuth || opts?.preferEphemeralSession
+        ? true
+        : false;
+    const result = await WebBrowser.openAuthSessionAsync(authUrl, redirectUrl, {
+        preferEphemeralSession: prefer,
+        showInRecents: !strictNativeAuth,
+    });
+    if (result.type !== 'success' || !result.url) {
+        throw new Error('cancelled');
+    }
+    let token = null;
     try {
-        const res = await fetch(`${convexSiteUrl}/auth/device-code/poll?device_code=${encodeURIComponent(deviceCode)}`);
-        if (!res.ok)
-            return { status: 'expired' };
-        const data = await res.json();
-        if (data.status === 'authorized' && typeof data.token === 'string') {
-            return { status: 'authorized', token: data.token };
-        }
-        if (data.status === 'pending')
-            return { status: 'pending' };
-        return { status: 'expired' };
+        const parsed = new URL(result.url);
+        token = parsed.searchParams.get('token');
     }
     catch {
-        return { status: 'pending' }; // network blip — let caller keep polling
+        // best-effort fallback for odd schemes
+        const match = result.url.match(/[?&]token=([^&]+)/);
+        if (match)
+            token = decodeURIComponent(match[1]);
+    }
+    if (!token) {
+        throw new Error('OAuth callback did not include a token');
     }
+    return { token };
 }
 // ─── Email / password (no 2FA) ────────────────────────────────────────
 async function signupWithEmail(fullName, email, password) {
@@ -252,9 +337,9 @@ async function loginWithEmail(email, password) {
     }
     const data = await res.json();
     if (data?.requires2fa) {
-        // SDK login surface does not handle 2FA — direct the user to complete
-        // sign-in through the web flow (device-code) which supports it.
-        throw new Error('2FA is enabled on this account. Sign in via the device-code flow instead.');
+        // SDK login surface does not handle 2FA — direct the user to sign in
+        // through one of the OAuth providers, which complete 2FA on the web.
+        throw new Error('2FA is enabled on this account. Sign in with Apple/Google/GitHub/GitLab/Microsoft instead.');
     }
     return { token: data.token, userId: data.userId };
 }

package/dist/index.d.ts

@@ -38,8 +38,8 @@ export { ShakeDetector } from './ShakeDetector';
 export { FloatingButton } from './FloatingButton';
 export { FeedbackModal } from './FeedbackModal';
 export { FixReport } from './FixReport';
-export { configureAuthEndpoints, getConvexSiteUrl, getWebBaseUrl, getToken, saveToken, clearToken, getUser, saveUser, getSelectedDeviceId, saveSelectedDeviceId, clearSelectedDeviceId, validateToken, startDeviceCode, pollDeviceCode, signupWithEmail, loginWithEmail, listReachableDevices, DEFAULT_CONVEX_SITE_URL, DEFAULT_WEB_BASE_URL, } from './auth';
-export type { OAuthProvider, User, DeviceCodeStart, DeviceCodePoll, RemoteDevice, DeviceList, } from './auth';
+export { configureAuthEndpoints, getConvexSiteUrl, getWebBaseUrl, getToken, saveToken, clearToken, getUser, saveUser, getSelectedDeviceId, saveSelectedDeviceId, clearSelectedDeviceId, validateToken, signInWithApple, signInWithOAuth, signupWithEmail, loginWithEmail, listReachableDevices, DEFAULT_CONVEX_SITE_URL, DEFAULT_WEB_BASE_URL, DEFAULT_OAUTH_REDIRECT, } from './auth';
+export type { OAuthProvider, User, RemoteDevice, DeviceList, } from './auth';
 export { captureScreenshot, startAudioRecording, stopAudioRecording } from './capture';
 export { uploadFeedback } from './upload';
 export type { FeedbackConfig, FeedbackBundle, FeedbackMetadata, DeviceInfo, AppInfo, TimelineEvent, FeedbackReport, AgentCommentary, FeedbackStreamEvent, VoiceCapability, CapturedError, TestFix, TestSession, } from './types';

package/dist/index.js

@@ -23,7 +23,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.uploadFeedback = exports.stopAudioRecording = exports.startAudioRecording = exports.captureScreenshot = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = exports.listReachableDevices = exports.loginWithEmail = exports.signupWithEmail = exports.pollDeviceCode = exports.startDeviceCode = exports.validateToken = exports.clearSelectedDeviceId = exports.saveSelectedDeviceId = exports.getSelectedDeviceId = exports.saveUser = exports.getUser = exports.clearToken = exports.saveToken = exports.getToken = exports.getWebBaseUrl = exports.getConvexSiteUrl = exports.configureAuthEndpoints = exports.FixReport = exports.FeedbackModal = exports.FloatingButton = exports.ShakeDetector = exports.AuthOverlay = exports.YaverMachinePickerScreen = exports.YaverLoginScreen = exports.YaverConnectionScreen = exports.P2PClient = exports.YaverDiscovery = exports.initExpo = exports.YaverUpdates = exports.BlackBox = exports.YaverFeedback = void 0;
+exports.uploadFeedback = exports.stopAudioRecording = exports.startAudioRecording = exports.captureScreenshot = exports.DEFAULT_OAUTH_REDIRECT = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = exports.listReachableDevices = exports.loginWithEmail = exports.signupWithEmail = exports.signInWithOAuth = exports.signInWithApple = exports.validateToken = exports.clearSelectedDeviceId = exports.saveSelectedDeviceId = exports.getSelectedDeviceId = exports.saveUser = exports.getUser = exports.clearToken = exports.saveToken = exports.getToken = exports.getWebBaseUrl = exports.getConvexSiteUrl = exports.configureAuthEndpoints = exports.FixReport = exports.FeedbackModal = exports.FloatingButton = exports.ShakeDetector = exports.AuthOverlay = exports.YaverMachinePickerScreen = exports.YaverLoginScreen = exports.YaverConnectionScreen = exports.P2PClient = exports.YaverDiscovery = exports.initExpo = exports.YaverUpdates = exports.BlackBox = exports.YaverFeedback = void 0;
 var YaverFeedback_1 = require("./YaverFeedback");
 Object.defineProperty(exports, "YaverFeedback", { enumerable: true, get: function () { return YaverFeedback_1.YaverFeedback; } });
 var BlackBox_1 = require("./BlackBox");
@@ -65,13 +65,14 @@ Object.defineProperty(exports, "getSelectedDeviceId", { enumerable: true, get: f
 Object.defineProperty(exports, "saveSelectedDeviceId", { enumerable: true, get: function () { return auth_1.saveSelectedDeviceId; } });
 Object.defineProperty(exports, "clearSelectedDeviceId", { enumerable: true, get: function () { return auth_1.clearSelectedDeviceId; } });
 Object.defineProperty(exports, "validateToken", { enumerable: true, get: function () { return auth_1.validateToken; } });
-Object.defineProperty(exports, "startDeviceCode", { enumerable: true, get: function () { return auth_1.startDeviceCode; } });
-Object.defineProperty(exports, "pollDeviceCode", { enumerable: true, get: function () { return auth_1.pollDeviceCode; } });
+Object.defineProperty(exports, "signInWithApple", { enumerable: true, get: function () { return auth_1.signInWithApple; } });
+Object.defineProperty(exports, "signInWithOAuth", { enumerable: true, get: function () { return auth_1.signInWithOAuth; } });
 Object.defineProperty(exports, "signupWithEmail", { enumerable: true, get: function () { return auth_1.signupWithEmail; } });
 Object.defineProperty(exports, "loginWithEmail", { enumerable: true, get: function () { return auth_1.loginWithEmail; } });
 Object.defineProperty(exports, "listReachableDevices", { enumerable: true, get: function () { return auth_1.listReachableDevices; } });
 Object.defineProperty(exports, "DEFAULT_CONVEX_SITE_URL", { enumerable: true, get: function () { return auth_1.DEFAULT_CONVEX_SITE_URL; } });
 Object.defineProperty(exports, "DEFAULT_WEB_BASE_URL", { enumerable: true, get: function () { return auth_1.DEFAULT_WEB_BASE_URL; } });
+Object.defineProperty(exports, "DEFAULT_OAUTH_REDIRECT", { enumerable: true, get: function () { return auth_1.DEFAULT_OAUTH_REDIRECT; } });
 var capture_1 = require("./capture");
 Object.defineProperty(exports, "captureScreenshot", { enumerable: true, get: function () { return capture_1.captureScreenshot; } });
 Object.defineProperty(exports, "startAudioRecording", { enumerable: true, get: function () { return capture_1.startAudioRecording; } });

package/dist/types.d.ts

@@ -4,7 +4,8 @@ export interface FeedbackConfig {
     /**
      * Auth token for the Yaver agent. Optional in 0.5+: if omitted, the SDK
      * will hydrate one from AsyncStorage or show its in-app login screen
-     * (device-code / email / OAuth) the first time the user triggers feedback.
+     * (Apple native / OAuth in-app browser / email) the first time the user
+     * triggers feedback.
      */
     authToken?: string;
     /**
@@ -156,6 +157,25 @@ export interface FeedbackConfig {
      * Default: false (HTTPS preferred when fingerprint available, HTTP fallback).
      */
     requireTLS?: boolean;
+    /**
+     * Compile-time lockdown of the auth flow. When true the SDK refuses to
+     * ever open the user's external browser (Safari / Chrome) or show a
+     * 6-char device code. Auth happens only via native Apple Sign-In
+     * (`expo-apple-authentication`), in-app OAuth (`expo-web-browser`'s
+     * `ASWebAuthenticationSession` with `preferEphemeralSession: true`), or
+     * the built-in email/password form. If a required peer dep is missing,
+     * `signInWithOAuth`/`signInWithApple` throw instead of silently falling
+     * back to a web redirect.
+     *
+     * Recommended for apps that already embed OAuth on the native side and
+     * never want their users to see a `yaver.io` landing page. This is the
+     * belt-and-suspenders version of what the SDK has done since 0.6; set
+     * it to guarantee future regressions can't quietly reintroduce a
+     * browser-hop fallback.
+     *
+     * Default: false (preserve historical behavior).
+     */
+    strictNativeAuth?: boolean;
 }
 export interface FeedbackBundle {
     metadata: FeedbackMetadata;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.5.5",
+  "version": "0.6.1",
   "description": "Visual feedback SDK for Yaver — bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,7 +20,9 @@
   "peerDependencies": {
     "react": ">=18.0.0",
     "react-native": ">=0.70.0",
-    "@react-native-async-storage/async-storage": ">=1.17.0"
+    "@react-native-async-storage/async-storage": ">=1.17.0",
+    "expo-web-browser": ">=12.0.0",
+    "expo-apple-authentication": ">=6.0.0"
   },
   "peerDependenciesMeta": {
     "@expo/config-plugins": {
@@ -28,6 +30,9 @@
     },
     "expo-constants": {
       "optional": true
+    },
+    "expo-apple-authentication": {
+      "optional": true
     }
   },
   "devDependencies": {