yaver-feedback-react-native 0.5.5 → 0.6.1

package/src/auth.ts

@@ -1,22 +1,19 @@
 /**
  * Authentication + device/agent discovery API used by the Yaver Feedback SDK.
  *
- * This module is a trimmed SDK-local port of mobile/src/lib/auth.ts. It only
- * covers what the embedded login/machine-picker flow needs:
+ * Mirrors mobile/src/lib/auth.ts:
  *
- *   - Device-code login (`POST /auth/device-code` + `GET /auth/device-code/poll`)
- *     so users can sign in via any OAuth provider (apple/google/github/gitlab/
- *     microsoft) on yaver.io without requiring deep-link wiring in the host app.
+ *   - Native Apple Sign-In (`POST /auth/apple-native`) on iOS via
+ *     `expo-apple-authentication`.
+ *   - In-app browser OAuth for Google/Microsoft/GitHub/GitLab via
+ *     `expo-web-browser`'s `openAuthSessionAsync` — same callback URL
+ *     (`yaver://oauth-callback`) the Yaver mobile app uses.
  *   - Email / password sign-up + login (no 2FA flow — for SDK simplicity).
- *   - Token validation + refresh.
+ *   - Token validation.
  *   - `/devices/list` → owned + shared (guest) remote dev machines.
  *
- * All calls target the public Yaver Convex site URL by default; callers may
- * override via `init()` config to point at staging.
- *
- * Token persistence uses `@react-native-async-storage/async-storage` (already
- * a peer dep). SecureStore is intentionally avoided to keep the SDK portable
- * to any RN host app.
+ * Mobile-only. A web equivalent will ship as a separate `yaver-web-feedback`
+ * package; do not import this module from a browser bundle.
  */
 
 // AsyncStorage is an optional peer dep — degrade gracefully if missing.
@@ -31,6 +28,41 @@ try {
   // not installed — token persistence disabled, caller must pass authToken
 }
 
+// Optional peer deps used by native sign-in and in-app browser OAuth. When
+// missing the SDK still works — Apple falls back to in-app browser OAuth, and
+// providers without expo-web-browser surface a clear error.
+type WebBrowserModule = {
+  openAuthSessionAsync: (
+    url: string,
+    redirectUrl: string,
+    options?: { showInRecents?: boolean; preferEphemeralSession?: boolean },
+  ) => Promise<{ type: string; url?: string }>;
+  maybeCompleteAuthSession: () => void;
+};
+type AppleAuthModule = {
+  isAvailableAsync: () => Promise<boolean>;
+  signInAsync: (opts: { requestedScopes: number[] }) => Promise<{
+    identityToken: string | null;
+    fullName?: { givenName?: string | null; familyName?: string | null } | null;
+  }>;
+  AppleAuthenticationScope: { FULL_NAME: number; EMAIL: number };
+};
+
+let WebBrowser: WebBrowserModule | null = null;
+try {
+  WebBrowser = require('expo-web-browser');
+  WebBrowser?.maybeCompleteAuthSession();
+} catch {
+  // optional
+}
+
+let AppleAuth: AppleAuthModule | null = null;
+try {
+  AppleAuth = require('expo-apple-authentication');
+} catch {
+  // optional — Apple sign-in falls back to in-app browser OAuth
+}
+
 const TOKEN_KEY = 'yaver_feedback_auth_token';
 const USER_KEY = 'yaver_feedback_user';
 const DEVICE_KEY = 'yaver_feedback_selected_device';
@@ -41,6 +73,7 @@ export const DEFAULT_WEB_BASE_URL = 'https://yaver.io';
 
 let convexSiteUrl = DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = DEFAULT_WEB_BASE_URL;
+let strictNativeAuth = false;
 
 /** Override the Convex site URL + web base (staging vs prod). */
 export function configureAuthEndpoints(opts: {
@@ -51,6 +84,19 @@ export function configureAuthEndpoints(opts: {
   if (opts.webBaseUrl) webBaseUrl = opts.webBaseUrl;
 }
 
+/**
+ * Enable strict native auth: refuse any fallback that would redirect the
+ * user to an external browser (Safari / Chrome) or show a device code.
+ * See FeedbackConfig.strictNativeAuth for rationale.
+ */
+export function setStrictNativeAuth(enabled: boolean): void {
+  strictNativeAuth = enabled;
+}
+
+export function isStrictNativeAuth(): boolean {
+  return strictNativeAuth;
+}
+
 export function getConvexSiteUrl(): string {
   return convexSiteUrl;
 }
@@ -177,74 +223,131 @@ export async function validateToken(token: string): Promise<User | null> {
   }
 }
 
-// ─── Device-code flow (for OAuth via web) ─────────────────────────────
-
-export interface DeviceCodeStart {
-  userCode: string;
-  deviceCode: string;
-  expiresAt: number;
-  verificationUrl: string;
-}
+// ─── Native Apple Sign-In ─────────────────────────────────────────────
 
 /**
- * Start a device-code flow. The user opens `verificationUrl`, signs in with
- * any OAuth provider on yaver.io, and the SDK polls `pollDeviceCode` until
- * a session token is issued.
+ * Sign in with Apple using the native ASAuthorization flow. Requires
+ * `expo-apple-authentication` installed and the host app's bundle to have
+ * the "Sign in with Apple" capability enabled. iOS only.
+ *
+ * Throws `cancelled` if the user dismisses the sheet.
  */
-export async function startDeviceCode(opts?: {
-  machineName?: string;
-  platform?: string;
-  preferredProvider?: OAuthProvider;
-}): Promise<DeviceCodeStart> {
-  const res = await fetch(`${convexSiteUrl}/auth/device-code`, {
+export async function signInWithApple(): Promise<{ token: string; userId: string }> {
+  if (!AppleAuth) {
+    throw new Error(
+      'expo-apple-authentication is not installed. Add it as a peer dep to enable native Apple Sign-In.',
+    );
+  }
+  const available = await AppleAuth.isAvailableAsync();
+  if (!available) {
+    throw new Error('Apple Sign-In is not available on this device');
+  }
+
+  let credential;
+  try {
+    credential = await AppleAuth.signInAsync({
+      requestedScopes: [
+        AppleAuth.AppleAuthenticationScope.FULL_NAME,
+        AppleAuth.AppleAuthenticationScope.EMAIL,
+      ],
+    });
+  } catch (err) {
+    if ((err as { code?: string } | null)?.code === 'ERR_REQUEST_CANCELED') {
+      throw new Error('cancelled');
+    }
+    throw err;
+  }
+
+  if (!credential.identityToken) {
+    throw new Error('Apple did not return an identity token');
+  }
+
+  const fullName =
+    [credential.fullName?.givenName, credential.fullName?.familyName]
+      .filter(Boolean)
+      .join(' ') || undefined;
+
+  const res = await fetch(`${convexSiteUrl}/auth/apple-native`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      machineName: opts?.machineName,
-      platform: opts?.platform,
-      preferredProvider: opts?.preferredProvider,
-      environment: 'feedback-sdk',
-    }),
+    body: JSON.stringify({ identityToken: credential.identityToken, fullName }),
   });
   if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
-    throw new Error(data.error ?? 'Failed to start device-code');
+    const body = await res.text().catch(() => '');
+    throw new Error(body || 'Apple sign-in failed');
   }
   const data = await res.json();
-  const params = new URLSearchParams({ code: data.userCode });
-  if (opts?.preferredProvider) {
-    params.set('preferredProvider', opts.preferredProvider);
-  }
-  return {
-    userCode: data.userCode,
-    deviceCode: data.deviceCode,
-    expiresAt: data.expiresAt,
-    verificationUrl: `${webBaseUrl}/auth/device?${params.toString()}`,
-  };
+  return { token: data.token, userId: data.userId };
 }
 
-export type DeviceCodePoll =
-  | { status: 'pending' }
-  | { status: 'authorized'; token: string }
-  | { status: 'expired' };
+// ─── In-app browser OAuth (Google / GitHub / GitLab / Microsoft) ──────
 
-export async function pollDeviceCode(
-  deviceCode: string,
-): Promise<DeviceCodePoll> {
-  try {
-    const res = await fetch(
-      `${convexSiteUrl}/auth/device-code/poll?device_code=${encodeURIComponent(deviceCode)}`,
+/**
+ * Default OAuth redirect — the same callback the Yaver mobile app uses
+ * (`yaver://oauth-callback`). `WebBrowser.openAuthSessionAsync` intercepts
+ * this redirect inside the auth session, so the host app does not need to
+ * register the scheme on iOS. On Android, add an `<intent-filter>` for
+ * `yaver://oauth-callback` in the host app's AndroidManifest.xml.
+ */
+export const DEFAULT_OAUTH_REDIRECT = 'yaver://oauth-callback';
+
+/**
+ * Sign in through the in-app browser via yaver.io. Opens
+ * `https://yaver.io/api/auth/oauth/<provider>?client=mobile`, the user picks
+ * an OAuth provider, and the web callback redirects back to
+ * `yaver://oauth-callback?token=...` which `openAuthSessionAsync` captures
+ * inside the auth session. No deep-link wiring required on iOS.
+ *
+ * Throws `cancelled` if the user dismisses the browser.
+ */
+export async function signInWithOAuth(
+  provider: OAuthProvider,
+  opts?: { redirectUrl?: string; preferEphemeralSession?: boolean },
+): Promise<{ token: string }> {
+  if (!WebBrowser) {
+    // In strictNativeAuth we hard-fail rather than letting the caller
+    // fall back to any homegrown `Linking.openURL(…)` flow that would
+    // leave the app for Safari. Without strict mode we still can't
+    // proceed (no browser module available) so the behavior is the same
+    // — just a clearer error message.
+    throw new Error(
+      'expo-web-browser is not installed. Add it as a peer dep to enable in-app OAuth sign-in.',
     );
-    if (!res.ok) return { status: 'expired' };
-    const data = await res.json();
-    if (data.status === 'authorized' && typeof data.token === 'string') {
-      return { status: 'authorized', token: data.token };
-    }
-    if (data.status === 'pending') return { status: 'pending' };
-    return { status: 'expired' };
+  }
+  const redirectUrl = opts?.redirectUrl ?? DEFAULT_OAUTH_REDIRECT;
+  const params = new URLSearchParams({ client: 'mobile' });
+  const authUrl = `${webBaseUrl}/api/auth/oauth/${provider}?${params.toString()}`;
+
+  // In strict mode force ephemeral session (ASWebAuthenticationSession
+  // with no shared cookie jar) so the OAuth dance is visibly native and
+  // can never hand off to the user's default browser.
+  const prefer =
+    strictNativeAuth || opts?.preferEphemeralSession
+      ? true
+      : false;
+  const result = await WebBrowser.openAuthSessionAsync(authUrl, redirectUrl, {
+    preferEphemeralSession: prefer,
+    showInRecents: !strictNativeAuth,
+  });
+
+  if (result.type !== 'success' || !result.url) {
+    throw new Error('cancelled');
+  }
+
+  let token: string | null = null;
+  try {
+    const parsed = new URL(result.url);
+    token = parsed.searchParams.get('token');
   } catch {
-    return { status: 'pending' }; // network blip — let caller keep polling
+    // best-effort fallback for odd schemes
+    const match = result.url.match(/[?&]token=([^&]+)/);
+    if (match) token = decodeURIComponent(match[1]);
+  }
+
+  if (!token) {
+    throw new Error('OAuth callback did not include a token');
   }
+  return { token };
 }
 
 // ─── Email / password (no 2FA) ────────────────────────────────────────
@@ -281,10 +384,10 @@ export async function loginWithEmail(
   }
   const data = await res.json();
   if (data?.requires2fa) {
-    // SDK login surface does not handle 2FA — direct the user to complete
-    // sign-in through the web flow (device-code) which supports it.
+    // SDK login surface does not handle 2FA — direct the user to sign in
+    // through one of the OAuth providers, which complete 2FA on the web.
     throw new Error(
-      '2FA is enabled on this account. Sign in via the device-code flow instead.',
+      '2FA is enabled on this account. Sign in with Apple/Google/GitHub/GitLab/Microsoft instead.',
     );
   }
   return { token: data.token, userId: data.userId };

package/src/index.ts

@@ -52,19 +52,18 @@ export {
   saveSelectedDeviceId,
   clearSelectedDeviceId,
   validateToken,
-  startDeviceCode,
-  pollDeviceCode,
+  signInWithApple,
+  signInWithOAuth,
   signupWithEmail,
   loginWithEmail,
   listReachableDevices,
   DEFAULT_CONVEX_SITE_URL,
   DEFAULT_WEB_BASE_URL,
+  DEFAULT_OAUTH_REDIRECT,
 } from './auth';
 export type {
   OAuthProvider,
   User,
-  DeviceCodeStart,
-  DeviceCodePoll,
   RemoteDevice,
   DeviceList,
 } from './auth';

package/src/types.ts

@@ -4,7 +4,8 @@ export interface FeedbackConfig {
   /**
    * Auth token for the Yaver agent. Optional in 0.5+: if omitted, the SDK
    * will hydrate one from AsyncStorage or show its in-app login screen
-   * (device-code / email / OAuth) the first time the user triggers feedback.
+   * (Apple native / OAuth in-app browser / email) the first time the user
+   * triggers feedback.
    */
   authToken?: string;
   /**
@@ -156,6 +157,25 @@ export interface FeedbackConfig {
    * Default: false (HTTPS preferred when fingerprint available, HTTP fallback).
    */
   requireTLS?: boolean;
+  /**
+   * Compile-time lockdown of the auth flow. When true the SDK refuses to
+   * ever open the user's external browser (Safari / Chrome) or show a
+   * 6-char device code. Auth happens only via native Apple Sign-In
+   * (`expo-apple-authentication`), in-app OAuth (`expo-web-browser`'s
+   * `ASWebAuthenticationSession` with `preferEphemeralSession: true`), or
+   * the built-in email/password form. If a required peer dep is missing,
+   * `signInWithOAuth`/`signInWithApple` throw instead of silently falling
+   * back to a web redirect.
+   *
+   * Recommended for apps that already embed OAuth on the native side and
+   * never want their users to see a `yaver.io` landing page. This is the
+   * belt-and-suspenders version of what the SDK has done since 0.6; set
+   * it to guarantee future regressions can't quietly reintroduce a
+   * browser-hop fallback.
+   *
+   * Default: false (preserve historical behavior).
+   */
+  strictNativeAuth?: boolean;
 }
 
 export interface FeedbackBundle {