yaver-feedback-react-native 0.9.3 → 0.9.6

package/src/__tests__/dogfoodPolicy.test.ts

@@ -20,7 +20,7 @@ describe('resolveSDKDogfood', () => {
     });
   });
 
-  it('supports a key-enrolled installation without an app account', () => {
+  it('supports an account-bound key-enrolled installation without an app backend', () => {
     expect(resolveSDKDogfood({ enabled: true, appId: 'io.example', installationStatus: 'active' }).code)
       .toBe('SDK_DOGFOOD_INSTALLATION_REQUIRED');
     expect(resolveSDKDogfood({ enabled: true, appId: 'io.example', installationId: 'install-1', installationStatus: 'pending' }).code)

package/src/auth.ts

@@ -202,6 +202,35 @@ export async function clearSelectedDeviceId(): Promise<void> {
   }
 }
 
+/** Verify that this full Yaver session owns the exact registered Dogfood app.
+ * Any login is not enough, and installation-scoped SDK tokens return false. */
+export async function getDogfoodAccountAccess(appId: string, token: string, installationId?: string): Promise<{
+  authenticated: boolean;
+  ownerAuthorized: boolean;
+  installationAuthorized: boolean;
+}> {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    const query = new URLSearchParams({ appId });
+    if (installationId) query.set('installationId', installationId);
+    const response = await fetch(`${convexSiteUrl}/dogfood/access?${query.toString()}`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal,
+    });
+    clearTimeout(timeout);
+    if (!response.ok) return { authenticated: false, ownerAuthorized: false, installationAuthorized: false };
+    const result = await response.json();
+    return {
+      authenticated: result?.authenticated === true,
+      ownerAuthorized: result?.ownerAuthorized === true,
+      installationAuthorized: result?.installationAuthorized === true,
+    };
+  } catch {
+    return { authenticated: false, ownerAuthorized: false, installationAuthorized: false };
+  }
+}
+
 // ─── Token validation ──────────────────────────────────────────────────
 
 export async function validateToken(token: string): Promise<User | null> {

package/src/deviceDogfood.ts

@@ -15,6 +15,9 @@ export interface DeviceDogfoodOptions {
   appId: string;
   label?: string;
   backendUrl?: string;
+  /** Full Yaver OAuth token. Required for enrollment; never persisted with the
+   * installation private key. The backend binds its user to this key. */
+  authToken?: string;
   /** Advanced bare-RN integration. Expo apps use SecureStore automatically. */
   secureStore?: SecureStoreLike;
 }
@@ -79,8 +82,9 @@ function sessionMessage(appId: string, installationId: string, challenge: string
   return new TextEncoder().encode(`yaver-dogfood-session-v1\n${appId}\n${installationId}\n${challenge}`);
 }
 
-/** Account-free third-party Dogfood enrollment. The UUID is a public lookup
- * handle; possession is proven by the private key retained in this app. */
+/** Account-bound third-party Dogfood enrollment. The installation ID is a
+ * public lookup handle; possession is proven by the private key retained in
+ * this app, while enrollment is bound to the signed-in Yaver account. */
 export class YaverDeviceDogfood {
   private readonly backendUrl: string;
   private readonly store: SecureStoreLike;
@@ -118,9 +122,10 @@ export class YaverDeviceDogfood {
   }
 
   async enroll(platform = 'unknown'): Promise<{ status: DeviceDogfoodState; installationId: string }> {
+    if (!this.options.authToken) throw new Error('Sign in to Yaver before registering this device for Dogfood.');
     const identity = await this.identity();
     const started = await responseJSON(await fetch(`${this.backendUrl}/dogfood/enroll/start`, {
-      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${this.options.authToken}` },
       body: JSON.stringify({ appId: this.options.appId, installationId: identity.installationId, registrationSlot: identity.registrationSlot, publicKey: identity.publicKey, platform, label: this.options.label }),
     }));
     if (started.status === 'active') return { status: 'active', installationId: identity.installationId };

package/src/dogfoodPolicy.ts

@@ -1,3 +1,21 @@
+export interface DogfoodAccessSnapshot {
+  appId: string;
+  /** A Yaver session exists locally; not itself an authorization decision. */
+  yaverAuthenticated: boolean;
+  /** Backend-confirmed owner/maintainer of this exact appId. */
+  ownerAuthorized: boolean;
+  installationId?: string;
+  deviceState: 'unknown' | 'unregistered' | 'pending' | 'active' | 'cancelled' | 'revoked' | 'superseded';
+  /** True only for a backend-approved device key or an authenticated owner. */
+  authorized: boolean;
+}
+
+export interface DogfoodFlowSnapshot {
+  phase: 'idle' | 'denied' | 'auth-required' | 'machine-required' | 'opening' | 'error';
+  appId?: string;
+  error?: string;
+}
+
 export interface SDKDogfoodConfig {
   /** Explicit opt-in. Omitted/false keeps the normal Feedback SDK. */
   enabled?: boolean;
@@ -5,7 +23,7 @@ export interface SDKDogfoodConfig {
   accountIds?: string[];
   /** The third-party app's currently authenticated account ID. */
   currentAccountId?: string;
-  /** Account-free installation identity resolved by YaverDeviceDogfood. */
+  /** Account-bound installation identity resolved by YaverDeviceDogfood. */
   appId?: string;
   installationId?: string;
   installationStatus?: 'pending' | 'active' | 'cancelled' | 'revoked' | 'superseded';
@@ -13,6 +31,19 @@ export interface SDKDogfoodConfig {
   onExit?: () => void | Promise<void>;
   /** Optional app label shown beside Dogfood mode. */
   label?: string;
+  /** Project/framework hints used by the zero-orchestration onboarding UI. */
+  projectName?: string;
+  framework?: string;
+  /** Advanced override for staging/self-hosted enrollment. */
+  backendUrl?: string;
+  /** Presentation-only ACL hook, e.g. `() => user.isAdmin`. Server-side OAuth
+   * or device-signature verification remains the authority boundary. */
+  canShow?: (access: DogfoodAccessSnapshot) => boolean | Promise<boolean>;
+  /** Optional callback alternative to onDogfoodFlowState(). */
+  onStateChange?: (state: DogfoodFlowSnapshot) => void;
+  /** ACL-backed Home Screen/App Shortcut. Dynamic and absent until Yaver
+   * owner auth or this installation's approved key authorizes it. */
+  appShortcut?: boolean | { label?: string };
 }
 
 export interface SDKDogfoodStatus {

package/src/index.ts

@@ -29,7 +29,7 @@
  */
 
 export { YaverFeedback } from './YaverFeedback';
-export type { DogfoodOnboardingOptions } from './YaverFeedback';
+export type { DogfoodOnboardingOptions, DogfoodFlowPhase, DogfoodFlowState } from './YaverFeedback';
 export { captureStoreScreenshots } from './storeShots';
 export type {
   CaptureStoreScreenshotsOptions,
@@ -81,7 +81,7 @@ export { FloatingButton } from './FloatingButton';
 export { YaverModeBadge, hideYaverModeBadge, showYaverModeBadge, isYaverModeBadgeHidden } from './YaverModeBadge';
 export type { YaverModeBadgeProps } from './YaverModeBadge';
 export { resolveSDKDogfood } from './dogfoodPolicy';
-export type { SDKDogfoodConfig, SDKDogfoodStatus } from './dogfoodPolicy';
+export type { DogfoodAccessSnapshot, DogfoodFlowSnapshot, SDKDogfoodConfig, SDKDogfoodStatus } from './dogfoodPolicy';
 export { YaverDeviceDogfood } from './deviceDogfood';
 export type { DeviceDogfoodOptions, DeviceDogfoodSession, DeviceDogfoodState } from './deviceDogfood';
 export {
@@ -114,6 +114,8 @@ export {
   getQuickIconDisabled,
   setQuickIconDisabled,
   clearQuickIconDisabled,
+  getPreferredDogfoodLane,
+  setPreferredDogfoodLane,
 } from './preferences';
 export {
   configureAuthEndpoints,
@@ -125,6 +127,7 @@ export {
   getUser,
   saveUser,
   getSelectedDeviceId,
+  getDogfoodAccountAccess,
   saveSelectedDeviceId,
   clearSelectedDeviceId,
   validateToken,

package/src/preferences.ts

@@ -159,6 +159,7 @@ export async function clearQuickIconColorPreset(): Promise<void> {
 
 const PREFERRED_RUNNER_KEY = 'yaver_feedback_preferred_runner';
 const PREFERRED_MODEL_KEY = 'yaver_feedback_preferred_model';
+const PREFERRED_DOGFOOD_LANE_PREFIX = 'yaver_feedback_dogfood_lane_';
 
 export async function getPreferredRunner(): Promise<string | null> {
   if (!AsyncStorage) return null;
@@ -205,3 +206,22 @@ export async function setPreferredModel(model: string | null): Promise<void> {
     /* best-effort */
   }
 }
+
+export async function getPreferredDogfoodLane(appId: string): Promise<'browser' | 'hermes' | 'webrtc' | null> {
+  if (!AsyncStorage || !appId) return null;
+  try {
+    const value = await AsyncStorage.getItem(`${PREFERRED_DOGFOOD_LANE_PREFIX}${appId}`);
+    return value === 'browser' || value === 'hermes' || value === 'webrtc' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function setPreferredDogfoodLane(appId: string, lane: 'browser' | 'hermes' | 'webrtc'): Promise<void> {
+  if (!AsyncStorage || !appId) return;
+  try {
+    await AsyncStorage.setItem(`${PREFERRED_DOGFOOD_LANE_PREFIX}${appId}`, lane);
+  } catch {
+    /* best-effort */
+  }
+}