317 lines
9.6 KiB
Dart
317 lines
9.6 KiB
Dart
import 'dart:async';
|
|
import 'dart:convert';
|
|
|
|
import 'package:flutter/cupertino.dart';
|
|
import 'package:flutter/foundation.dart';
|
|
import 'package:flutter/services.dart';
|
|
import 'package:please_pay_me/data/models/json.dart';
|
|
import 'package:please_pay_me/theme/theme.dart';
|
|
import 'package:please_pay_me/ui/ui.dart';
|
|
import 'package:url_launcher/url_launcher.dart';
|
|
import 'package:webview_flutter/webview_flutter.dart';
|
|
import 'package:webview_flutter_android/webview_flutter_android.dart';
|
|
|
|
/// Name of the JavaScript channel injected into the cabinet page.
|
|
/// Must stay in sync with `web/src/auth/telegramRedirect.ts`.
|
|
const telegramAuthChannel = 'PpmAuth';
|
|
|
|
/// Chrome-like UA without the `; wv` token Android WebView inserts.
|
|
/// Telegram's widget rejects the default WebView user-agent on some devices.
|
|
const telegramWebViewUserAgent =
|
|
'Mozilla/5.0 (Linux; Android 13; Mobile) AppleWebKit/537.36 '
|
|
'(KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36';
|
|
|
|
/// Runs inside the cabinet and hands the JWT back to Flutter.
|
|
///
|
|
/// Two paths, both without backend changes:
|
|
/// 1. The web app posts to `PpmAuth` from `setSession` right after login.
|
|
/// 2. This script hooks `localStorage.setItem` and polls, so an already-open
|
|
/// session (or an older cabinet build) still works.
|
|
const telegramTokenProbeJs = '''
|
|
(function () {
|
|
function ping() {
|
|
try {
|
|
var token = window.localStorage.getItem('ppm_session_jwt');
|
|
if (token && window.$telegramAuthChannel) {
|
|
$telegramAuthChannel.postMessage(JSON.stringify({ token: token }));
|
|
}
|
|
} catch (error) {}
|
|
}
|
|
|
|
if (!window.__ppmAuthHooked) {
|
|
window.__ppmAuthHooked = true;
|
|
try {
|
|
var original = window.localStorage.setItem.bind(window.localStorage);
|
|
window.localStorage.setItem = function (key, value) {
|
|
original(key, value);
|
|
if (key === 'ppm_session_jwt') ping();
|
|
};
|
|
} catch (error) {}
|
|
}
|
|
|
|
ping();
|
|
})();
|
|
''';
|
|
|
|
/// WebView login only exists on mobile; desktop and web fall back to the token
|
|
/// form.
|
|
bool get isTelegramWebLoginSupported {
|
|
if (kIsWeb) return false;
|
|
return defaultTargetPlatform == TargetPlatform.android ||
|
|
defaultTargetPlatform == TargetPlatform.iOS;
|
|
}
|
|
|
|
/// The cabinet and the API share an origin (nginx proxies `/api`), so the API
|
|
/// address can be derived unless it was configured explicitly.
|
|
String resolveApiBaseUrl({
|
|
required String cabinetUrl,
|
|
String configuredApiBaseUrl = '',
|
|
}) {
|
|
if (configuredApiBaseUrl.trim().isNotEmpty) {
|
|
return configuredApiBaseUrl.trim().replaceAll(RegExp(r'/$'), '');
|
|
}
|
|
|
|
return resolveCabinetOrigin(cabinetUrl);
|
|
}
|
|
|
|
/// Origin of the cabinet URL — used both as the API base and as a sanity check.
|
|
String resolveCabinetOrigin(String cabinetUrl) {
|
|
final uri = resolveCabinetLoginUri(cabinetUrl);
|
|
return uri.hasPort && !_isDefaultPort(uri)
|
|
? '${uri.scheme}://${uri.host}:${uri.port}'
|
|
: '${uri.scheme}://${uri.host}';
|
|
}
|
|
|
|
/// Always open `/login` so the Telegram widget is on screen.
|
|
Uri resolveCabinetLoginUri(String cabinetUrl) {
|
|
var raw = cabinetUrl.trim();
|
|
if (raw.isEmpty) return Uri.parse('https://localhost/login');
|
|
|
|
if (!raw.contains('://')) {
|
|
raw = 'https://$raw';
|
|
}
|
|
|
|
final uri = Uri.parse(raw);
|
|
final path = uri.path;
|
|
if (path.isEmpty || path == '/') {
|
|
return uri.replace(path: '/login');
|
|
}
|
|
return uri;
|
|
}
|
|
|
|
bool _isDefaultPort(Uri uri) {
|
|
return (uri.scheme == 'https' && uri.port == 443) ||
|
|
(uri.scheme == 'http' && uri.port == 80);
|
|
}
|
|
|
|
/// Extracts the JWT from the payload posted by [telegramTokenProbeJs].
|
|
String? parseTelegramAuthMessage(String raw) {
|
|
try {
|
|
final token = asString(asMap(jsonDecode(raw))['token']);
|
|
return token.isEmpty ? null : token;
|
|
} on FormatException {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
bool isExternalAuthScheme(Uri uri) {
|
|
return uri.scheme == 'tg' || uri.scheme == 'telegram';
|
|
}
|
|
|
|
bool isTelegramOAuthHost(String host) {
|
|
return host == 'oauth.telegram.org' ||
|
|
host == 'telegram.org' ||
|
|
host.endsWith('.telegram.org');
|
|
}
|
|
|
|
/// Opens the cabinet in an in-app browser and resolves with the JWT once the
|
|
/// user has signed in through the Telegram Login Widget.
|
|
Future<String?> showTelegramLogin({
|
|
required BuildContext context,
|
|
required String cabinetUrl,
|
|
}) {
|
|
return Navigator.of(context, rootNavigator: true).push<String>(
|
|
CupertinoPageRoute(
|
|
fullscreenDialog: true,
|
|
builder: (_) => TelegramLoginScreen(cabinetUrl: cabinetUrl),
|
|
),
|
|
);
|
|
}
|
|
|
|
class TelegramLoginScreen extends StatefulWidget {
|
|
const TelegramLoginScreen({super.key, required this.cabinetUrl});
|
|
|
|
final String cabinetUrl;
|
|
|
|
@override
|
|
State<TelegramLoginScreen> createState() => _TelegramLoginScreenState();
|
|
}
|
|
|
|
class _TelegramLoginScreenState extends State<TelegramLoginScreen> {
|
|
late final WebViewController _controller;
|
|
Timer? _poll;
|
|
bool _loading = true;
|
|
bool _completed = false;
|
|
bool _canGoBack = false;
|
|
String? _error;
|
|
|
|
Uri get _startUri => resolveCabinetLoginUri(widget.cabinetUrl);
|
|
|
|
@override
|
|
void initState() {
|
|
super.initState();
|
|
|
|
_controller = WebViewController()
|
|
..setJavaScriptMode(JavaScriptMode.unrestricted)
|
|
..setUserAgent(telegramWebViewUserAgent)
|
|
..setBackgroundColor(const Color(0x00000000))
|
|
..addJavaScriptChannel(
|
|
telegramAuthChannel,
|
|
onMessageReceived: (message) => _onToken(message.message),
|
|
)
|
|
..setNavigationDelegate(
|
|
NavigationDelegate(
|
|
onNavigationRequest: _onNavigationRequest,
|
|
onPageStarted: (_) {
|
|
if (mounted) setState(() => _loading = true);
|
|
},
|
|
onPageFinished: (_) {
|
|
_refreshCanGoBack();
|
|
if (mounted) setState(() => _loading = false);
|
|
_probe();
|
|
},
|
|
onWebResourceError: (error) {
|
|
if (!mounted || _completed) return;
|
|
// Subframe errors (the Telegram iframe) must not kill the page.
|
|
if (error.isForMainFrame == false) return;
|
|
setState(() {
|
|
_loading = false;
|
|
_error = error.description;
|
|
});
|
|
},
|
|
),
|
|
);
|
|
|
|
_configureAndroid();
|
|
_controller.loadRequest(_startUri);
|
|
|
|
// The widget writes the token after an async callback, so polling is more
|
|
// reliable than a single probe on page load.
|
|
_poll = Timer.periodic(const Duration(milliseconds: 700), (_) => _probe());
|
|
}
|
|
|
|
Future<void> _configureAndroid() async {
|
|
if (kIsWeb || defaultTargetPlatform != TargetPlatform.android) return;
|
|
|
|
final platform = _controller.platform;
|
|
if (platform is! AndroidWebViewController) return;
|
|
|
|
final cookies = AndroidWebViewCookieManager(
|
|
const PlatformWebViewCookieManagerCreationParams(),
|
|
);
|
|
await cookies.setAcceptThirdPartyCookies(platform, true);
|
|
}
|
|
|
|
@override
|
|
void dispose() {
|
|
_poll?.cancel();
|
|
super.dispose();
|
|
}
|
|
|
|
Future<void> _probe() async {
|
|
if (_completed) return;
|
|
try {
|
|
await _controller.runJavaScript(telegramTokenProbeJs);
|
|
} on PlatformException {
|
|
// The page may be mid-navigation; the next tick retries.
|
|
}
|
|
}
|
|
|
|
Future<NavigationDecision> _onNavigationRequest(NavigationRequest request) async {
|
|
final uri = Uri.tryParse(request.url);
|
|
if (uri == null) return NavigationDecision.navigate;
|
|
|
|
if (isExternalAuthScheme(uri)) {
|
|
await launchUrl(uri, mode: LaunchMode.externalApplication);
|
|
return NavigationDecision.prevent;
|
|
}
|
|
|
|
return NavigationDecision.navigate;
|
|
}
|
|
|
|
Future<void> _refreshCanGoBack() async {
|
|
final canGoBack = await _controller.canGoBack();
|
|
if (mounted && canGoBack != _canGoBack) {
|
|
setState(() => _canGoBack = canGoBack);
|
|
}
|
|
}
|
|
|
|
void _onToken(String raw) {
|
|
if (_completed) return;
|
|
|
|
final token = parseTelegramAuthMessage(raw);
|
|
if (token == null) return;
|
|
|
|
_completed = true;
|
|
_poll?.cancel();
|
|
Navigator.of(context).pop(token);
|
|
}
|
|
|
|
@override
|
|
Widget build(BuildContext context) {
|
|
return CupertinoPageScaffold(
|
|
backgroundColor: AppColors.of(context, AppColors.groupedBackground),
|
|
navigationBar: AppNavBar(
|
|
title: 'Вход через Telegram',
|
|
subtitle: _startUri.host,
|
|
leading: CupertinoButton(
|
|
padding: EdgeInsets.zero,
|
|
minimumSize: Size.zero,
|
|
onPressed: () => Navigator.of(context).pop(),
|
|
child: const AppText.body('Закрыть', color: AppColors.accent),
|
|
),
|
|
trailing: Row(
|
|
mainAxisSize: MainAxisSize.min,
|
|
children: [
|
|
if (_canGoBack)
|
|
CupertinoButton(
|
|
padding: EdgeInsets.zero,
|
|
minimumSize: Size.zero,
|
|
onPressed: () async {
|
|
await _controller.goBack();
|
|
await _refreshCanGoBack();
|
|
},
|
|
child: const AppIcon(CupertinoIcons.back, color: AppColors.accent),
|
|
),
|
|
CupertinoButton(
|
|
padding: EdgeInsets.zero,
|
|
minimumSize: Size.zero,
|
|
onPressed: () {
|
|
setState(() => _error = null);
|
|
_controller.reload();
|
|
},
|
|
child: const AppIcon(CupertinoIcons.refresh, color: AppColors.accent),
|
|
),
|
|
],
|
|
),
|
|
),
|
|
child: SafeArea(
|
|
child: _error != null
|
|
? AppErrorView(
|
|
message: _error!,
|
|
onRetry: () {
|
|
setState(() => _error = null);
|
|
_controller.reload();
|
|
},
|
|
)
|
|
: Stack(
|
|
children: [
|
|
WebViewWidget(controller: _controller),
|
|
if (_loading) const Center(child: AppSpinner()),
|
|
],
|
|
),
|
|
),
|
|
);
|
|
}
|
|
}
|