Yuvomi Mobile Contributors
40a7962307
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
2.6 KiB
Historical architecture — superseded WebView prototype
Two independent native applications share a policy, not a cross-platform runtime:
| Responsibility | Android | iOS |
|---|---|---|
| Native entry/configuration | ComponentActivity and platform widgets | SwiftUI |
| Web application | Android WebView | WKWebView |
| Server URL policy | ServerAddress | ServerAddress |
| Reachability/metadata | HttpsURLConnection, no redirects/cookies | Ephemeral URLSession, no redirects/cookies |
| Authentication | Upstream web UI and OS cookie jar | Upstream web UI and WKWebsiteDataStore |
| OIDC | Separate restricted web view after consent | Separate restricted web view after consent |
| Downloads | Origin-bound streaming / bounded blob capture and pull | WKDownload to temporary protected file, system export |
The client never reimplements a Yuvomi module or introduces a backend. The user selects the origin. Bootstrap calls check the actual upstream unauthenticated metadata contract before loading the server application. Configuration stores only the origin and a query/fragment-free last path; auth/reset/invite routes are not restored. No native password or API-token storage exists.
The current web view remains alive across background/resume and ordinary rotation. Android handles orientation changes in the existing activity; process recreation loads the remembered path and retains OS cookies, not unsaved web form memory. iOS retains a StateObject-owned view; cold launch restores path and persistent cookies. No resume reload is imposed. Native recovery offers Retry, Keep viewing, and server management without hiding the route back to configuration.
Server erasure destroys the browsing context and clears all website storage before another server is loaded. The local wipe does not invalidate the remote session; logout is still a server-side operation. Web application history remains native web history. External schemes, universal links and app links are not registered because arbitrary self-hosted domains cannot be verified by this app in advance.
The optional integration build has a different Android package ID and adds trust for a fresh test CA generated outside the repository. It uses the same production code and the unmodified pinned upstream server. Neither normal debug nor release resources include that CA. Never distribute an integration APK.
Read-only offline functionality belongs to upstream's service worker. The app preserves it where the platform engine supports it, but does not promise offline editing, synchronization, or the same PWA cache behavior on all OS versions.