SHA256
Yuvomi Mobile Contributors
4b483c20e3
Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.
91 lines
4.2 KiB
Markdown
91 lines
4.2 KiB
Markdown
# YUVOMI MOBILE – FINAL DELIVERY REPORT
|
||
|
||
**Delivery status: incomplete native preview, not final product acceptance.**
|
||
This report closes the initial native rebuild slice, not the requested complete
|
||
1:1 replacement. No module has accepted functional and visual parity.
|
||
|
||
**Follow-up:** Android 0.2.1 native preview (code 3) fixes a reproduced session-cookie
|
||
login compatibility defect. See [login troubleshooting](login-troubleshooting.md)
|
||
and the newer [validation evidence](validation.md); the original 0.2.0 results
|
||
below remain historical evidence, not a replacement for the fixed APK.
|
||
|
||
## 1. Outcome
|
||
|
||
The rejected embedded-browser application has been replaced by genuine native
|
||
shipping entry points. Missing modules do not fall back to a WebView.
|
||
|
||
## 2. Upstream reference
|
||
|
||
Unmodified Yuvomi 2.78.0, commit
|
||
`10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`. No upstream change or push.
|
||
|
||
## 3. Android
|
||
|
||
Kotlin/Compose onboarding, setup/password/TOTP interfaces, basic dashboard,
|
||
tasks/notes/shopping and session management. Version `0.2.0-native-preview`,
|
||
code 2. This is a tested initial slice, not full module coverage.
|
||
|
||
## 4. iOS
|
||
|
||
SwiftUI equivalents, native API models/transport and Keychain storage implemented.
|
||
Sixteen portable tests pass; Apple SDK application/UI/Keychain validation remains
|
||
unverified locally. No installable IPA or App Store-ready archive is claimed.
|
||
|
||
## 5. Design parity
|
||
|
||
Upstream colors, spacing/radii and brand geometry guide native controls. One real
|
||
synthetic Android dashboard screenshot was inspected. No side-by-side full PWA
|
||
visual acceptance, complete adaptive-layout or accessibility approval yet.
|
||
|
||
## 6. API and architecture
|
||
|
||
Direct same-origin HTTPS/JSON, native controls and state; server-owned business
|
||
logic and authorization. Superseded browser code/tests are preserved in `legacy/`
|
||
but excluded from shipping builds and native test counts.
|
||
|
||
## 7. Security
|
||
|
||
System TLS, redirect refusal, bounded reads, upstream CSRF and protected native
|
||
cookies. AndroidKeyStore/AES-GCM and iOS Keychain/private URLSession storage; no
|
||
stored passwords, test CA in ordinary builds or hidden browser session import.
|
||
Human security review and additional device/role/error-path coverage remain open.
|
||
|
||
## 8. Executed validation
|
||
|
||
10 JVM tests, 6 native API-35 UI tests, the 7-test real-server suite (including
|
||
those same 6), both Android lint variants and package builds pass. Swift has 16
|
||
portable passes plus strict formatting/parsing. 27 script regressions, repository
|
||
checks, workflow lint and the 266-coordinate OSV scan pass. See
|
||
[validation](validation.md) for evidence, failures corrected and exact limitations.
|
||
|
||
## 9. Artifacts
|
||
|
||
The local collector replaces old wrapper outputs in ignored `artifacts/android/`
|
||
with native debug APK and unsigned release APK/AAB, checksums and manifest/network/
|
||
signature inspection. `build-info.json` records exact source identity and dirty
|
||
state. Only the development-signed debug APK is installable as provided.
|
||
|
||
## 10. Gitea CI
|
||
|
||
Android build job 1059 succeeded and uploaded `android-native-debug-apk`. The actual
|
||
artifact was downloaded, signature/version checked, installed and launched on the
|
||
authorized local emulator. [Download the verified artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk).
|
||
Mac Node bootstrap, checkout and Swift lookup now succeed, but
|
||
`xcrun simctl list devices available` times out after 60 seconds in follow-up job
|
||
1066. The runner's CoreSimulator availability needs administrator repair. The remote emulator matrix
|
||
still fails missing-KVM preflight, not native tests. No green whole-pipeline or
|
||
Apple application validation is claimed. See [validation](validation.md).
|
||
|
||
## 11. Signing and publication
|
||
|
||
Initial owner-authorized signing material/secrets are preserved privately; signing
|
||
workflow changes remain parked in the named stash. No production-signed native
|
||
release, store submission or claim of completed product delivery.
|
||
|
||
## 12. Remaining work
|
||
|
||
Native SSO/recovery/invitations, advanced first-slice controls, the remaining
|
||
modules/settings, files, offline, notifications, Apple/device validation and 1:1
|
||
visual/behavior acceptance remain substantial work. The complete page inventory
|
||
and acceptance criteria are in [native parity](native-parity.md).
|