SHA256
Yuvomi Mobile Contributors
4b483c20e3
Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.
153 lines
8.9 KiB
Markdown
153 lines
8.9 KiB
Markdown
# Native rebuild continuation
|
|
|
|
## Current objective — do not restore the wrapper
|
|
|
|
The maintainer rejected the browser-wrapper architecture and requested the PWA's
|
|
appearance/functions implemented as genuine native screens. Shipping Android now
|
|
uses Compose and iOS SwiftUI, calling the existing API directly. `legacy/` holds
|
|
the superseded renderers/tests for reference only. No WebView fallback, raw-JSON
|
|
module placeholder or old browser-test pass may be represented as native parity.
|
|
|
|
Read [native parity](native-parity.md), [architecture](architecture.md), and
|
|
[current validation](validation.md) first. Initial auth/dashboard/tasks/notes/
|
|
shopping slices exist, but **no module has accepted full visual/functional parity**.
|
|
The remaining pages/settings/auth/file/offline/notification work is explicit.
|
|
|
|
### Android login follow-up: 0.2.1 native preview / code 3
|
|
|
|
A user reported immediate HTTP-401 login failure although the same direct password
|
|
login works in the browser. Reproduced against unmodified upstream by setting its
|
|
existing `SESSION_SECURE=false` default behind the HTTPS fixture: the old Android
|
|
jar discarded the cookie and the next authenticated request failed. The fix keeps
|
|
all native cookies HTTPS/origin-bound independent of that server attribute;
|
|
certificate checks, redirect refusal, encryption and expiry are unchanged. Login
|
|
errors now distinguish credential/code rejection from session-cookie problems and
|
|
a successful retry clears the old error. Both secure/default-cookie test modes
|
|
are in CI; see `login-troubleshooting.md` and the latest validation section.
|
|
|
|
The owner-authorized signing key and four Gitea secrets were created before this
|
|
correction. Their private backup is `/home/neste/yuvomi-signing/initial-20261021`.
|
|
Do not print its contents. Uncommitted signing changes are preserved in Git stash
|
|
`wip: owner-authorized signing setup paused for true native rewrite`; do not apply
|
|
them blindly or resume signing/publishing the old wrapper.
|
|
|
|
Current local native outputs/logs:
|
|
|
|
- `/home/neste/yuvomi-native-build` (use `YUVOMI_BUILD_DIR` on WSL).
|
|
- `/home/neste/yuvomi-native-validation.log` and native integration logs.
|
|
- `/home/neste/yuvomi-native-swift` and `/home/neste/yuvomi-native-swift.log`.
|
|
- The existing persistent SDK, Swift, ktlint, actionlint and unmodified upstream
|
|
paths listed below remain usable. Set `ANDROID_SERIAL=emulator-5554`; do not
|
|
authorize or deploy to unrelated devices visible in `adb devices`.
|
|
|
|
Run native JVM/Compose UI tests, the real upstream fixture, portable Swift API/
|
|
contract tests, formatting, lint and OSV after changes. Apple UI/Security.framework
|
|
is not typechecked by Linux. Gitea's Mac job now bootstraps pinned Node before
|
|
checkout, but actual Xcode results still need inspection. Ubuntu emulator jobs
|
|
continue requiring accessible KVM; do not weaken or fake that evidence.
|
|
|
|
Initial 0.2.0 local native evidence: 10 JVM tests, 6 API-35 Compose tests, 7 real-server
|
|
instrumentation tests (including those same 6), both lint variants and native
|
|
debug/unsigned release APK/AAB builds pass. Sixteen portable Swift tests and strict
|
|
format/parsing pass. Screenshot export now uses AndroidX test storage/AGP output
|
|
collection before uninstall; the PNG was opened and confirmed nonblank. Five new
|
|
output-regression tests guard missing, invalid, ambiguous and stale screenshots.
|
|
See `validation.md` for logs and limitations. No Apple SDK result is implied.
|
|
|
|
Android build job 1059 in global run 660 (#5) succeeded; the actual native debug
|
|
artifact was downloaded, checked and installed/launched on `emulator-5554`.
|
|
Jobs 1060/1061 still fail KVM preflight. Mac job 1062 in run 661 (#6) passed native
|
|
Node bootstrap and checkout, printed Xcode 27.1, then stalled in Apple-tool
|
|
preflight for at least 20 minutes. The new `check-apple-tools.py` prints each
|
|
command and imposes a 60-second deadline; fourteen runner/probe regressions pass.
|
|
Follow-up Mac job 1066 in run 663 (#8) identifies the exact blocker:
|
|
`xcrun simctl list devices available` exceeds 60 seconds. Xcode version and Swift
|
|
lookup pass. An administrator must fix the runner user's CoreSimulator/login
|
|
session/Xcode prerequisites without weakening the check. App compilation/tests
|
|
and archive have not run. No remote host license/settings were changed.
|
|
Rebuild/collect from a clean checkout; do not present cached wrapper artifacts as
|
|
the native preview. Keep the signing stash parked.
|
|
|
|
Next work: stabilize/visually compare this slice, close auth/advanced CRUD gaps,
|
|
then implement the remaining real native modules against the parity inventory.
|
|
|
|
## Historical environment and original delivery context
|
|
|
|
This is a development delivery, not authorization to publish. Preserve the Git
|
|
history on `feat/yuvomi-mobile`; use Conventional Commits and normal pushes only.
|
|
The authorized community remote is `https://git.nesterovic.cc/nessi/Yuvomi-App`.
|
|
Do not push, submit issues or open pull requests against upstream on this task's
|
|
behalf. No production credentials or store accounts have been provided.
|
|
|
|
## Start with the evidence
|
|
|
|
Read [validation](validation.md), [security review](security-review.md), and
|
|
[release gates](release-process.md). Do not repeat completed implementation work
|
|
or equate portable Swift checks with an iOS app build. Inspect `git status` before
|
|
editing; preserve any newer maintainer changes.
|
|
|
|
The upstream reference is Yuvomi 2.78.0 at
|
|
`10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`. Keep it unmodified. Subpath hosting,
|
|
browser-to-native OIDC handoff and native remote push are not implemented.
|
|
|
|
The extended API 35 HTTPS suite passes all seven tests, including the local-IdP
|
|
round trip, native transfers, recovery and back navigation. Portable Swift has
|
|
seven passing policy tests; the separate JUnit verifier has eight regressions.
|
|
Keep the fixture's scope separate from real-provider or Apple-platform validation.
|
|
|
|
## Persistent local environment (Linux/WSL)
|
|
|
|
- Repository: `/mnt/c/Users/neste/Documents/GIT/Yuvomi-App`.
|
|
- Upstream and installed dependencies: `/home/neste/yuvomi-tools/upstream`.
|
|
- SDK: `/home/neste/yuvomi-tools/android-toolchain/android-sdk`.
|
|
- Build outputs/logs: `/home/neste/yuvomi-build`.
|
|
- Swift 6.2.1: `/home/neste/yuvomi-tools/swift-6.2.1-RELEASE-ubuntu24.04/usr/bin`.
|
|
- Swift compatibility libraries: `/home/neste/yuvomi-tools/compat/usr/lib/x86_64-linux-gnu`.
|
|
- Swift scratch output: `/home/neste/yuvomi-swift-build`.
|
|
- ktlint and actionlint: `/home/neste/yuvomi-tools/ktlint.jar` and
|
|
`/home/neste/yuvomi-tools/actionlint`.
|
|
- Local collected artifacts/evidence: ignored `artifacts/android/`.
|
|
|
|
`/tmp/opencode` is temporary and was cleared by server restarts. Background
|
|
processes may also disappear. Keep durable logs under `/home/neste`; never persist
|
|
the integration fixture's generated private CA, keys or real household data.
|
|
|
|
```sh
|
|
export ANDROID_HOME=/home/neste/yuvomi-tools/android-toolchain/android-sdk
|
|
export YUVOMI_BUILD_DIR=/home/neste/yuvomi-build
|
|
"$ANDROID_HOME/platform-tools/adb" devices -l
|
|
"$ANDROID_HOME/platform-tools/adb" shell am get-started-user-state 0
|
|
# Require RUNNING_UNLOCKED, then:
|
|
python3 scripts/test-integration.py /home/neste/yuvomi-tools/upstream --android
|
|
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
|
|
python3 scripts/collect-android-artifacts.py
|
|
```
|
|
|
|
The API 35 AVD is `yuvomi-test`. Its stable attempt uses KVM, `-gpu host`,
|
|
`-no-window -no-audio -no-boot-anim -no-snapshot -memory 2560 -cores 2`.
|
|
Launch under the SDK/AVD owner with access to the `kvm` group. Other GPU modes
|
|
previously crashed the host emulator with SIGSEGV. API 37 had broken services and
|
|
locked credential-encrypted storage; no API 37 runtime success is claimed.
|
|
|
|
For portable Swift checks add the compiler directory to `PATH` and set
|
|
`LD_LIBRARY_PATH` to the compatibility-library directory above, then use the
|
|
commands in [iOS development](build-ios.md). Apple application/XCTest/UI/archive
|
|
validation must happen on macOS with Xcode and real supported devices.
|
|
|
|
## Highest-priority external work
|
|
|
|
1. Typecheck/build the iOS app against Apple SDKs, run its actual XCTest/UI tests,
|
|
and produce an unsigned archive. Fix any failures; none of these ran locally.
|
|
2. Run the API 37 permission grant/denial/revocation scenarios on a working image
|
|
or device, plus the minimum-supported Android and current WebView matrix.
|
|
3. Review iOS unknown-length download disk-pressure handling before release.
|
|
4. Validate real supported IdPs, TOTP after SSO, linking, cancellation, native
|
|
file/camera pickers, process death, accessibility and offline account isolation.
|
|
5. Establish private vulnerability reporting, owned identifiers, authorized CI,
|
|
human security review and owner-controlled signing before any distribution.
|
|
|
|
Gitea workflows in `.gitea/workflows/` target the maintainer's `ubuntu-latest`
|
|
pool and `macos-arm64` M4 Pro runner. Read [runner setup](ci-runners.md) before
|
|
changing their labels or signing policy. Hosted CI and store readiness still
|
|
require actual successful runs; runner registration alone is not test evidence.
|