yaver-feedback-react-native 0.6.0 → 0.6.1

package/dist/YaverFeedback.js

@@ -76,6 +76,9 @@ class YaverFeedback {
             convexSiteUrl: cfg.authConvexSiteUrl,
             webBaseUrl: cfg.authWebBaseUrl,
         });
+        // Compile-time lockdown: refuse any browser-hop / device-code fallback
+        // and force ASWebAuthenticationSession in ephemeral mode for OAuth.
+        (0, auth_1.setStrictNativeAuth)(cfg.strictNativeAuth === true);
         // If no explicit convexUrl was set but we have an auth site URL, use it
         // so Discovery.discoverFromConvex() has somewhere to look up the user's
         // machines (works for both LAN-direct and off-LAN relay paths).

package/dist/auth.d.ts

@@ -22,6 +22,13 @@ export declare function configureAuthEndpoints(opts: {
     convexSiteUrl?: string;
     webBaseUrl?: string;
 }): void;
+/**
+ * Enable strict native auth: refuse any fallback that would redirect the
+ * user to an external browser (Safari / Chrome) or show a device code.
+ * See FeedbackConfig.strictNativeAuth for rationale.
+ */
+export declare function setStrictNativeAuth(enabled: boolean): void;
+export declare function isStrictNativeAuth(): boolean;
 export declare function getConvexSiteUrl(): string;
 export declare function getWebBaseUrl(): string;
 export type OAuthProvider = 'google' | 'microsoft' | 'apple' | 'github' | 'gitlab';

package/dist/auth.js

@@ -19,6 +19,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_OAUTH_REDIRECT = exports.DEFAULT_WEB_BASE_URL = exports.DEFAULT_CONVEX_SITE_URL = void 0;
 exports.configureAuthEndpoints = configureAuthEndpoints;
+exports.setStrictNativeAuth = setStrictNativeAuth;
+exports.isStrictNativeAuth = isStrictNativeAuth;
 exports.getConvexSiteUrl = getConvexSiteUrl;
 exports.getWebBaseUrl = getWebBaseUrl;
 exports.getToken = getToken;
@@ -65,6 +67,7 @@ exports.DEFAULT_CONVEX_SITE_URL = 'https://shocking-echidna-394.eu-west-1.convex
 exports.DEFAULT_WEB_BASE_URL = 'https://yaver.io';
 let convexSiteUrl = exports.DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = exports.DEFAULT_WEB_BASE_URL;
+let strictNativeAuth = false;
 /** Override the Convex site URL + web base (staging vs prod). */
 function configureAuthEndpoints(opts) {
     if (opts.convexSiteUrl)
@@ -72,6 +75,17 @@ function configureAuthEndpoints(opts) {
     if (opts.webBaseUrl)
         webBaseUrl = opts.webBaseUrl;
 }
+/**
+ * Enable strict native auth: refuse any fallback that would redirect the
+ * user to an external browser (Safari / Chrome) or show a device code.
+ * See FeedbackConfig.strictNativeAuth for rationale.
+ */
+function setStrictNativeAuth(enabled) {
+    strictNativeAuth = enabled;
+}
+function isStrictNativeAuth() {
+    return strictNativeAuth;
+}
 function getConvexSiteUrl() {
     return convexSiteUrl;
 }
@@ -259,14 +273,25 @@ exports.DEFAULT_OAUTH_REDIRECT = 'yaver://oauth-callback';
  */
 async function signInWithOAuth(provider, opts) {
     if (!WebBrowser) {
-        throw new Error('expo-web-browser is not installed. Add it as a peer dep to enable OAuth sign-in.');
+        // In strictNativeAuth we hard-fail rather than letting the caller
+        // fall back to any homegrown `Linking.openURL(…)` flow that would
+        // leave the app for Safari. Without strict mode we still can't
+        // proceed (no browser module available) so the behavior is the same
+        // — just a clearer error message.
+        throw new Error('expo-web-browser is not installed. Add it as a peer dep to enable in-app OAuth sign-in.');
     }
     const redirectUrl = opts?.redirectUrl ?? exports.DEFAULT_OAUTH_REDIRECT;
     const params = new URLSearchParams({ client: 'mobile' });
     const authUrl = `${webBaseUrl}/api/auth/oauth/${provider}?${params.toString()}`;
+    // In strict mode force ephemeral session (ASWebAuthenticationSession
+    // with no shared cookie jar) so the OAuth dance is visibly native and
+    // can never hand off to the user's default browser.
+    const prefer = strictNativeAuth || opts?.preferEphemeralSession
+        ? true
+        : false;
     const result = await WebBrowser.openAuthSessionAsync(authUrl, redirectUrl, {
-        preferEphemeralSession: opts?.preferEphemeralSession ?? false,
-        showInRecents: true,
+        preferEphemeralSession: prefer,
+        showInRecents: !strictNativeAuth,
     });
     if (result.type !== 'success' || !result.url) {
         throw new Error('cancelled');

package/dist/types.d.ts

@@ -157,6 +157,25 @@ export interface FeedbackConfig {
      * Default: false (HTTPS preferred when fingerprint available, HTTP fallback).
      */
     requireTLS?: boolean;
+    /**
+     * Compile-time lockdown of the auth flow. When true the SDK refuses to
+     * ever open the user's external browser (Safari / Chrome) or show a
+     * 6-char device code. Auth happens only via native Apple Sign-In
+     * (`expo-apple-authentication`), in-app OAuth (`expo-web-browser`'s
+     * `ASWebAuthenticationSession` with `preferEphemeralSession: true`), or
+     * the built-in email/password form. If a required peer dep is missing,
+     * `signInWithOAuth`/`signInWithApple` throw instead of silently falling
+     * back to a web redirect.
+     *
+     * Recommended for apps that already embed OAuth on the native side and
+     * never want their users to see a `yaver.io` landing page. This is the
+     * belt-and-suspenders version of what the SDK has done since 0.6; set
+     * it to guarantee future regressions can't quietly reintroduce a
+     * browser-hop fallback.
+     *
+     * Default: false (preserve historical behavior).
+     */
+    strictNativeAuth?: boolean;
 }
 export interface FeedbackBundle {
     metadata: FeedbackMetadata;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Visual feedback SDK for Yaver — bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/YaverFeedback.ts

@@ -6,6 +6,7 @@ import { P2PClient } from './P2PClient';
 import { ShakeDetector } from './ShakeDetector';
 import {
   configureAuthEndpoints,
+  setStrictNativeAuth,
   getToken,
   getSelectedDeviceId,
   clearToken,
@@ -88,6 +89,9 @@ export class YaverFeedback {
       convexSiteUrl: cfg.authConvexSiteUrl,
       webBaseUrl: cfg.authWebBaseUrl,
     });
+    // Compile-time lockdown: refuse any browser-hop / device-code fallback
+    // and force ASWebAuthenticationSession in ephemeral mode for OAuth.
+    setStrictNativeAuth(cfg.strictNativeAuth === true);
     // If no explicit convexUrl was set but we have an auth site URL, use it
     // so Discovery.discoverFromConvex() has somewhere to look up the user's
     // machines (works for both LAN-direct and off-LAN relay paths).

package/src/auth.ts

@@ -73,6 +73,7 @@ export const DEFAULT_WEB_BASE_URL = 'https://yaver.io';
 
 let convexSiteUrl = DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = DEFAULT_WEB_BASE_URL;
+let strictNativeAuth = false;
 
 /** Override the Convex site URL + web base (staging vs prod). */
 export function configureAuthEndpoints(opts: {
@@ -83,6 +84,19 @@ export function configureAuthEndpoints(opts: {
   if (opts.webBaseUrl) webBaseUrl = opts.webBaseUrl;
 }
 
+/**
+ * Enable strict native auth: refuse any fallback that would redirect the
+ * user to an external browser (Safari / Chrome) or show a device code.
+ * See FeedbackConfig.strictNativeAuth for rationale.
+ */
+export function setStrictNativeAuth(enabled: boolean): void {
+  strictNativeAuth = enabled;
+}
+
+export function isStrictNativeAuth(): boolean {
+  return strictNativeAuth;
+}
+
 export function getConvexSiteUrl(): string {
   return convexSiteUrl;
 }
@@ -291,17 +305,29 @@ export async function signInWithOAuth(
   opts?: { redirectUrl?: string; preferEphemeralSession?: boolean },
 ): Promise<{ token: string }> {
   if (!WebBrowser) {
+    // In strictNativeAuth we hard-fail rather than letting the caller
+    // fall back to any homegrown `Linking.openURL(…)` flow that would
+    // leave the app for Safari. Without strict mode we still can't
+    // proceed (no browser module available) so the behavior is the same
+    // — just a clearer error message.
     throw new Error(
-      'expo-web-browser is not installed. Add it as a peer dep to enable OAuth sign-in.',
+      'expo-web-browser is not installed. Add it as a peer dep to enable in-app OAuth sign-in.',
     );
   }
   const redirectUrl = opts?.redirectUrl ?? DEFAULT_OAUTH_REDIRECT;
   const params = new URLSearchParams({ client: 'mobile' });
   const authUrl = `${webBaseUrl}/api/auth/oauth/${provider}?${params.toString()}`;
 
+  // In strict mode force ephemeral session (ASWebAuthenticationSession
+  // with no shared cookie jar) so the OAuth dance is visibly native and
+  // can never hand off to the user's default browser.
+  const prefer =
+    strictNativeAuth || opts?.preferEphemeralSession
+      ? true
+      : false;
   const result = await WebBrowser.openAuthSessionAsync(authUrl, redirectUrl, {
-    preferEphemeralSession: opts?.preferEphemeralSession ?? false,
-    showInRecents: true,
+    preferEphemeralSession: prefer,
+    showInRecents: !strictNativeAuth,
   });
 
   if (result.type !== 'success' || !result.url) {

package/src/types.ts

@@ -157,6 +157,25 @@ export interface FeedbackConfig {
    * Default: false (HTTPS preferred when fingerprint available, HTTP fallback).
    */
   requireTLS?: boolean;
+  /**
+   * Compile-time lockdown of the auth flow. When true the SDK refuses to
+   * ever open the user's external browser (Safari / Chrome) or show a
+   * 6-char device code. Auth happens only via native Apple Sign-In
+   * (`expo-apple-authentication`), in-app OAuth (`expo-web-browser`'s
+   * `ASWebAuthenticationSession` with `preferEphemeralSession: true`), or
+   * the built-in email/password form. If a required peer dep is missing,
+   * `signInWithOAuth`/`signInWithApple` throw instead of silently falling
+   * back to a web redirect.
+   *
+   * Recommended for apps that already embed OAuth on the native side and
+   * never want their users to see a `yaver.io` landing page. This is the
+   * belt-and-suspenders version of what the SDK has done since 0.6; set
+   * it to guarantee future regressions can't quietly reintroduce a
+   * browser-hop fallback.
+   *
+   * Default: false (preserve historical behavior).
+   */
+  strictNativeAuth?: boolean;
 }
 
 export interface FeedbackBundle {