Repository navigation
feat: auth.webSession, sign-in in the system's web authentication sheet - #13
Merged
Merged
Conversation
… sheet
Google refuses to sign in inside an embedded web view, so the page asks the
shell to open core's sign-in hop in the system's sign-in sheet
(`auth.webSession { url }` → `{ callbackUrl }`, PROTOCOL.md §7.1). The sheet
closes on the plugchoice-link scheme and the URL goes back to the page.
- iOS: ASWebAuthenticationSession with callback scheme plugchoice-link,
sharing Safari's cookies. Listed always; the host app needs nothing.
- Android: Chrome's Auth Tab (androidx.browser 1.9 AuthTabIntent), which
answers the activity that opened it, so no intent filter and no app
competes for the scheme. Listed only when the browser supports Auth Tab;
a <queries> entry lets the library find a Custom Tabs browser.
The callback URL holds a one-time code that is worth nothing without the
run's credential; shells never log it.
tygoegmond
pushed a commit
that referenced
this pull request
Oct 19, 2026
🤖 I have created a release *beep* *boop* --- ## [0.7.0](0.6.0...0.7.0) (2026-10-16) ### Features * auth.webSession, sign-in in the system's web authentication sheet ([#13](#13)) ([2823e20](2823e20)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a bridge method for signing in with a web identity provider such as Google or Apple. Google doesn't allow sign-in inside an embedded web view, so the shell opens the sign-in page in the system's web authentication sheet instead of the Link screen's web view.
Protocol (
bridge/PROTOCOL.md§7.1)auth.webSession { url }.{ callbackUrl }.userCancelled,unavailable, andinvalidParamswhenurlisn'thttps.plugchoice-linkscheme, and that URL goes back to the page.iOS
ASWebAuthenticationSessionwith callback schemeplugchoice-link.Android
androidx.browser:browser:1.9.0,AuthTabIntent).<queries>entry forCustomTabsServicelets the library find that browser on API 30 and later. It merges into the host app's manifest.Checks
xcodebuild testpasses (199 tests). New tests cover the URL check, the capability, andunavailablewhen there is no window.testDebugUnitTestandlintDebugpass. New tests cover the capability and the URL check.:example:assembleDebugbuilds.