SHA256
Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
71 lines
4.1 KiB
Markdown
71 lines
4.1 KiB
Markdown
# Server compatibility and authentication
|
|
|
|
Source reference: upstream 2.78.0 revision
|
|
`10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`. No general version range has been
|
|
certified. Anonymous bootstrap metadata deliberately omits the exact version;
|
|
native probing verifies shape, not an invented minimum-version comparison.
|
|
|
|
Use `https://family.example.com` or `https://family.example.com:8443`, backed by a
|
|
root-hosted Yuvomi installation and a valid system-trusted certificate. Operators
|
|
should set `SESSION_SECURE=true`, correct `BASE_URL`, and correct proxy trust.
|
|
Private servers are supported through reachable HTTPS/VPN, not TLS bypasses.
|
|
International hostnames should be entered in ASCII/punycode for both platforms.
|
|
|
|
Root-relative assets, API endpoints, cookie paths, callback redirects and worker
|
|
registration mean `/yuvomi/` subpaths are not supported by the inspected source.
|
|
Use a dedicated hostname. Reverse proxies must pass `/api/v1/*`, cookies, HTML,
|
|
JavaScript and the service worker consistently. An external authentication proxy
|
|
that intercepts bootstrap calls is rejected with a connection error; it is not
|
|
silently identified as a Yuvomi server.
|
|
|
|
## Authentication
|
|
|
|
Password login, TOTP/recovery codes, password reset, invitations, server-side
|
|
session expiry/revocation and logout remain upstream web flows. No native code
|
|
stores the password, supplies a CSRF bypass, or extends an expired session.
|
|
Backgrounding does not clear cookies. Native server erasure does not revoke a
|
|
remote session; use Yuvomi logout first or revoke sessions server-side.
|
|
|
|
### OIDC: local fixture verified; real-provider validation pending
|
|
|
|
The initiating Yuvomi session contains OIDC state, nonce and PKCE verifier. When
|
|
the server redirects to an identity provider, native consent offers an isolated
|
|
web sign-in window sharing the OS website cookie store. HTTPS-only redirects
|
|
can return to the server callback; the final same-origin page returns to the main
|
|
view. No app-capability handlers or JS bridge are installed in that auth window.
|
|
|
|
Some providers (including configurations that prohibit embedded user agents)
|
|
require a system browser. **Those cannot sign the native view in with upstream's
|
|
current protocol.** Use Server settings -> Open server in browser, and sign in
|
|
there for an independent browser session. Opening only the external authorization
|
|
link in a browser does not transfer the initiating cookie. Browser cookies are
|
|
never copied into the app, and custom-scheme callbacks are not fabricated.
|
|
|
|
The API 35 integration suite completes a native isolated-window round trip with
|
|
a local test IdP, real RS256 ID tokens, nonce and S256 PKCE. No external
|
|
IdP/developer account was supplied. Validate the actual provider, including
|
|
cross-site cookies, cancellation, errors, TOTP and account linking, before relying
|
|
on that deployment. iOS authentication has not run against Apple SDKs. A native
|
|
browser handoff would require an independently reviewed upstream protocol; no
|
|
such upstream change is included or published.
|
|
|
|
Android generated exports require a current WebView supporting document-start
|
|
scripts and are capped at 25 MB. A bounded Blob registry preserves a generated
|
|
file even when upstream immediately revokes its object URL; it does not fetch
|
|
blob URLs or alter the server's CSP. HTTPS file downloads are capped at 100 MB.
|
|
Update the system WebView if generated exports are unavailable on an old engine.
|
|
|
|
## Notifications and offline
|
|
|
|
Upstream implements Web Push and optional ntfy/Gotify/webhook/email channels.
|
|
Embedded web views do not supply a portable native push subscription. This app
|
|
has **no native remote-push claim**, no Firebase/APNs secrets, no background
|
|
polling service, and no fake notification-registration UI. Configure an existing
|
|
optional upstream ntfy/Gotify channel and its client if desired. No centralized
|
|
service is required by this application.
|
|
|
|
Upstream service-worker caching is read-only, allow-listed, and versioned.
|
|
Mutations/authentication remain online. Platform-specific cache/resume behavior
|
|
and offline account switching still need device validation. Do not rely on offline
|
|
editing, synchronization, or closed-app push in this native development build.
|