feat(paywalls): web_view bridge session with document-reset lifecycle (5/7)

RevenueCat.xcodeproj/project.pbxproj

@@ -114,6 +114,7 @@
 		FC5AE63E8F81C3EC2FFDA408 /* WebViewOriginPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 28661C6CE3F64078A0138080 /* WebViewOriginPolicy.swift */; };
 		FA4A2DF41FC434A9401F08CC /* PaywallWebViewValue.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9D0C57ECDF0E7F1A5B4418FF /* PaywallWebViewValue.swift */; };
 		11CC2EA83C56933E40D8E5D8 /* WebViewEnvelope.swift in Sources */ = {isa = PBXBuildFile; fileRef = 89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */; };
+		0F4E490A741F00F18C4985D8 /* WebViewSession.swift in Sources */ = {isa = PBXBuildFile; fileRef = 72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */; };
 		16DA8F1E2E4FB6E200283940 /* ImageComponent.json in Resources */ = {isa = PBXBuildFile; fileRef = 16DA8F1B2E4FB6E200283940 /* ImageComponent.json */; };
 		16DA8F1F2E4FB6E200283940 /* VideoComponent.json in Resources */ = {isa = PBXBuildFile; fileRef = 16DA8F1C2E4FB6E200283940 /* VideoComponent.json */; };
 		16E146AD2E99F3480089B609 /* TransactionNotifications.swift in Sources */ = {isa = PBXBuildFile; fileRef = 16E146AB2E99F1E20089B609 /* TransactionNotifications.swift */; };
@@ -1684,6 +1685,8 @@
 		89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewEnvelope.swift; sourceTree = "<group>"; };
 		C1B939C7DAAFEA1DE2DE2674 /* WebViewEnvelopeTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewEnvelopeTests.swift; sourceTree = "<group>"; };
 		686562C08D953A27986DB276 /* PaywallWebViewValueTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PaywallWebViewValueTests.swift; sourceTree = "<group>"; };
+		72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewSession.swift; sourceTree = "<group>"; };
+		F75819E258F47D1DB058500D /* WebViewSessionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewSessionTests.swift; sourceTree = "<group>"; };
 		16DA8F1B2E4FB6E200283940 /* ImageComponent.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = ImageComponent.json; sourceTree = "<group>"; };
 		16DA8F1C2E4FB6E200283940 /* VideoComponent.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = VideoComponent.json; sourceTree = "<group>"; };
 		16E146AB2E99F1E20089B609 /* TransactionNotifications.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TransactionNotifications.swift; sourceTree = "<group>"; };
@@ -3250,6 +3253,7 @@
 				9E7AD021B4580265DFDF6A02 /* WebViewNavigationPolicyTests.swift */,
 				686562C08D953A27986DB276 /* PaywallWebViewValueTests.swift */,
 				C1B939C7DAAFEA1DE2DE2674 /* WebViewEnvelopeTests.swift */,
+				F75819E258F47D1DB058500D /* WebViewSessionTests.swift */,
 				802593842FE07057005AF6DF /* PaywallStateStoreTests.swift */,
 				16A9F7B62FAA22D0008E8A4D /* VideoComponentViewTests.swift */,
 				A9D45E4EAFAD4C0385BEDFB3 /* VideoPlayerViewTests.swift */,
@@ -3390,6 +3394,7 @@
 				28661C6CE3F64078A0138080 /* WebViewOriginPolicy.swift */,
 				9D0C57ECDF0E7F1A5B4418FF /* PaywallWebViewValue.swift */,
 				89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */,
+				72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */,
 			);
 			path = WebView;
 			sourceTree = "<group>";
@@ -8347,6 +8352,7 @@
 				FC5AE63E8F81C3EC2FFDA408 /* WebViewOriginPolicy.swift in Sources */,
 				FA4A2DF41FC434A9401F08CC /* PaywallWebViewValue.swift in Sources */,
 				11CC2EA83C56933E40D8E5D8 /* WebViewEnvelope.swift in Sources */,
+				0F4E490A741F00F18C4985D8 /* WebViewSession.swift in Sources */,
 				DBAA1FC22F8D4ED8000E8C81 /* HeaderNestedHeroZLayerSafeAreaPreview.swift in Sources */,
 				164681D22E6B577600854AA5 /* VideoComponentViewModel.swift in Sources */,
 				2C7457422CE81107004ACE52 /* IntroOfferEligibilityContext.swift in Sources */,

RevenueCatUI/Data/Strings.swift

@@ -109,6 +109,12 @@ enum Strings {
     case video_failed_to_set_audio_session_category(Error)
     case video_failed_to_cache(URL, Error)
 
+    // WebView
+    case paywall_web_view_message_rejected(reason: String)
+    case paywall_web_view_post_message_failed(String)
+    case paywall_web_view_post_message_skipped(reason: String)
+    case paywall_web_view_invalid_expected_origin(String)
+
     // Exit Offers
     case errorFetchingOfferings(Error)
     case exitOfferNotFound(String)
@@ -364,6 +370,16 @@ extension Strings: CustomStringConvertible {
         case .video_failed_to_cache(let url, let error):
             return "Failed to cache video at \(url): \(error)"
 
+        case .paywall_web_view_message_rejected(let reason):
+            return "Paywalls V2 web_view message rejected: \(reason)"
+        case .paywall_web_view_post_message_failed(let error):
+            return "Paywalls V2 web_view postMessage failed: \(error)"
+        case .paywall_web_view_post_message_skipped(let reason):
+            return "Paywalls V2 web_view postMessage skipped: \(reason)"
+        case .paywall_web_view_invalid_expected_origin(let origin):
+            return "Paywalls V2 web_view expected origin '\(origin)' is not a valid origin; " +
+                "the bridge cannot verify message provenance and will reject all messages."
+
         case .errorFetchingOfferings(let error):
             return "Error fetching offerings: \(error)"
         case .exitOfferNotFound(let offeringId):

RevenueCatUI/Templates/V2/Components/WebView/WebViewEnvelope.swift

@@ -1,3 +1,7 @@
+//
+//  Copyright RevenueCat Inc. All Rights Reserved.
+//
+
 import Foundation
 
 #if !os(tvOS) // For Paywalls V2
@@ -7,6 +11,8 @@ enum WebViewEnvelope {
 
     static let channel = "rc-web-components"
     static let messageHandlerName = "rcWebComponents"
+    /// Name of the JS function injected into the web view that receives host-to-content frames.
+    static let receiveFunction = "__rcWebComponentsReceive"
     static let defaultProtocolVersion = 1
 
     static let messageTypeResize = "resize"

RevenueCatUI/Templates/V2/Components/WebView/WebViewOriginPolicy.swift

@@ -1,24 +1,47 @@
-import Foundation
-
-#if canImport(WebKit)
-import WebKit
-#endif
+//
+//  Copyright RevenueCat Inc. All Rights Reserved.
+//
 
 #if !os(tvOS) && canImport(WebKit) // For Paywalls V2
 
-@available(iOS 15.0, macOS 12.0, tvOS 15.0, watchOS 8.0, *)
-enum WebViewOrigin {
+import Foundation
+import WebKit
+
+extension URL {
 
-    nonisolated static func origin(of url: URL) -> String? {
-        guard let scheme = url.scheme?.lowercased(),
-              let host = url.host?.lowercased(),
+    /// Canonical origin (`scheme://host[:port]`) of the URL, or `nil` if it has no scheme or host.
+    nonisolated var webViewOrigin: String? {
+        guard let scheme = self.scheme?.lowercased(),
+              let host = self.host?.lowercased(),
               !host.isEmpty else {
             return nil
         }
+        return WebViewOrigin.canonicalOrigin(scheme: scheme, host: host, port: self.port)
+    }
+
+}
+
+extension WKSecurityOrigin {
+
+    /// Canonical origin of the frame that posted a script message. Uses the frame's security origin
+    /// (the authoritative sender) rather than the WebView's top-level URL.
+    var webViewOrigin: String? {
+        let scheme = self.`protocol`.lowercased()
+        let host = self.host.lowercased()
+        guard !scheme.isEmpty, !host.isEmpty else {
+            return nil
+        }
+        // `WKSecurityOrigin` reports `0` for the scheme's default port.
+        return WebViewOrigin.canonicalOrigin(scheme: scheme, host: host, port: self.port == 0 ? nil : self.port)
+    }
+
+}
+
+private enum WebViewOrigin {
 
-        let port = url.port
+    nonisolated static func canonicalOrigin(scheme: String, host: String, port: Int?) -> String {
         let suffix: String
-        if let port, !Self.isDefaultPort(port, scheme: scheme) {
+        if let port, !isDefaultPort(port, scheme: scheme) {
             suffix = ":\(port)"
         } else {
             suffix = ""
@@ -42,14 +65,14 @@ enum WebViewNavigationPolicy {
     // to `default-src 'self'`).
     static func policy(for url: URL?, isMainFrame: Bool, expectedOrigin: String) -> WKNavigationActionPolicy {
         guard let url,
-              let origin = WebViewOrigin.origin(of: url),
+              let origin = url.webViewOrigin,
               origin.hasPrefix("https://") else {
             return .cancel
         }
         guard isMainFrame else {
             return .allow
         }
-        let expected = URL(string: expectedOrigin).flatMap(WebViewOrigin.origin(of:))
+        let expected = URL(string: expectedOrigin)?.webViewOrigin
         return origin == expected ? .allow : .cancel
     }