SHA256
Yuvomi Mobile Contributors
4b483c20e3
Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.
37 lines
1.8 KiB
Markdown
37 lines
1.8 KiB
Markdown
# Changelog
|
|
|
|
## [Unreleased]
|
|
|
|
### Android 0.2.1 native preview (code 3)
|
|
|
|
- Fix login against upstream-default session cookies without `Secure`: Android
|
|
now retains them in its origin-bound HTTPS-only jar instead of losing the
|
|
authenticated session. HTTP, cross-origin redirects and invalid TLS remain denied.
|
|
- Distinguish credential/code rejection from a missing/rejected native session;
|
|
clear a previous login error after a successful retry.
|
|
- Exercise both upstream cookie configurations over real HTTPS, including a wrong
|
|
password followed by a successful native login. See `docs/login-troubleshooting.md`.
|
|
|
|
### Initial native preview
|
|
|
|
- Begin the genuine native rebuild: Compose/SwiftUI screens, direct HTTPS API,
|
|
protected native session storage and initial auth/dashboard/task/note/shopping
|
|
flows. Archive the rejected WebView renderer and its tests. Full PWA parity is
|
|
explicitly incomplete; see `docs/native-parity.md`.
|
|
|
|
- Gitea workflows for the maintainer's Ubuntu pool and native M4 Pro runner,
|
|
explicit SDK/KVM prerequisites, SHA-256 checkout and unsigned-only CI release builds.
|
|
|
|
### Archived browser prototype (not shipped)
|
|
|
|
- Native Android HTTPS onboarding, origin-bound browsing, session persistence,
|
|
recovery, server erasure, camera/document selection, downloads and blob exports.
|
|
- SwiftUI/WKWebView iOS implementation, isolated web sign-in, native settings,
|
|
recovery, file export, and strict URL/metadata policies; Xcode validation pending.
|
|
- JVM, Android emulator, portable Swift, and real pinned-upstream HTTPS tests.
|
|
- Reproducible build configuration, CI and maintainer-controlled release procedures.
|
|
- MIT licensing, upstream audit, security model and release documentation.
|
|
|
|
No stable release has been published. No native push or browser-to-app session
|
|
handoff is claimed. See validation records for what has actually been executed.
|