SHA256
Yuvomi Mobile Contributors
4b483c20e3
Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.
1.8 KiB
1.8 KiB
Changelog
[Unreleased]
Android 0.2.1 native preview (code 3)
- Fix login against upstream-default session cookies without
Secure: Android now retains them in its origin-bound HTTPS-only jar instead of losing the authenticated session. HTTP, cross-origin redirects and invalid TLS remain denied. - Distinguish credential/code rejection from a missing/rejected native session; clear a previous login error after a successful retry.
- Exercise both upstream cookie configurations over real HTTPS, including a wrong
password followed by a successful native login. See
docs/login-troubleshooting.md.
Initial native preview
-
Begin the genuine native rebuild: Compose/SwiftUI screens, direct HTTPS API, protected native session storage and initial auth/dashboard/task/note/shopping flows. Archive the rejected WebView renderer and its tests. Full PWA parity is explicitly incomplete; see
docs/native-parity.md. -
Gitea workflows for the maintainer's Ubuntu pool and native M4 Pro runner, explicit SDK/KVM prerequisites, SHA-256 checkout and unsigned-only CI release builds.
Archived browser prototype (not shipped)
- Native Android HTTPS onboarding, origin-bound browsing, session persistence, recovery, server erasure, camera/document selection, downloads and blob exports.
- SwiftUI/WKWebView iOS implementation, isolated web sign-in, native settings, recovery, file export, and strict URL/metadata policies; Xcode validation pending.
- JVM, Android emulator, portable Swift, and real pinned-upstream HTTPS tests.
- Reproducible build configuration, CI and maintainer-controlled release procedures.
- MIT licensing, upstream audit, security model and release documentation.
No stable release has been published. No native push or browser-to-app session handoff is claimed. See validation records for what has actually been executed.