Skip to content

feat(paywalls): web_view bridge session with document-reset lifecycle (5/7) #7231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ajpallares merged 34 commits into from
Jul 21, 2026
Merged

feat(paywalls): web_view bridge session with document-reset lifecycle (5/7) #7231

Show file tree
Hide file tree
Changes from 31 commits
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
5cf1dfd
feat(paywalls): public API surface for web_view messages (1/7)
cursoragent Jul 15, 2026
f7f5d16
feat(paywalls): web_view wire envelope + JSON hardening (2/7)
cursoragent Jul 15, 2026
d331b34
feat(paywalls): web_view navigation policy + content-rule isolation (…
cursoragent Jul 15, 2026
7664d35
Merge webview/3-isolation-navigation into webview/5-session base
cursoragent Jul 15, 2026
b033efa
feat(paywalls): web_view bridge session with document-reset lifecycle…
cursoragent Jul 15, 2026
24f352c
fix: remove extra vertical whitespace for SwiftLint
cursoragent Jul 15, 2026
e671378
refactor(paywalls): keep web view bridge internal
cursoragent Jul 16, 2026
41401ac
refactor(paywalls): keep web view bridge internal
cursoragent Jul 16, 2026
b5caeda
refactor(paywalls): keep web view bridge internal
cursoragent Jul 16, 2026
d941c01
Merge updated internal web view API base
cursoragent Jul 16, 2026
c9f7142
Merge updated internal web view API stack
cursoragent Jul 16, 2026
111d7ea
Merge updated internal web view API dependencies
cursoragent Jul 16, 2026
ca80c8f
Merge branch 'main' into webview/1-public-api
ajpallares Jul 17, 2026
94982da
fix(paywalls): remove client-side web view payload limits
cursoragent Jul 17, 2026
ea6d24b
test(paywalls): address web view envelope review
cursoragent Jul 17, 2026
0612595
refactor(paywalls): remove unused web view handler API
cursoragent Jul 17, 2026
d14d63c
fix(paywalls): retain internal bridge dependencies
cursoragent Jul 17, 2026
19cbfe6
refactor(paywalls): remove web view message handler concept
JZDesign Jul 17, 2026
c3d27a9
Merge branch 'webview/1-public-api' into webview/2-envelope
JZDesign Jul 17, 2026
e3ad994
Merge updated internal web view API stack (handler removal)
JZDesign Jul 17, 2026
4671130
Merge updated internal web view API dependencies (handler removal)
JZDesign Jul 17, 2026
eb53f30
Adapt web view bridge to trimmed envelope API
ajpallares Jul 20, 2026
66b3e33
Merge branch 'main' into webview/5-session
ajpallares Jul 21, 2026
f984e23
Merge branch 'main' into webview/5-session
ajpallares Jul 21, 2026
86d9c0b
refactor(paywalls): harden web_view session origin gating
ajpallares Jul 21, 2026
ab69065
Merge remote-tracking branch 'origin/webview/5-session' into webview/…
ajpallares Jul 21, 2026
a48f936
Merge branch 'main' into webview/5-session
ajpallares Jul 21, 2026
7940b96
refactor(paywalls): expose web_view origin as URL/WKSecurityOrigin ex…
ajpallares Jul 21, 2026
7280b5d
refactor(paywalls): consolidate web_view imports under single platfor…
ajpallares Jul 21, 2026
0a866f8
refactor(paywalls): add copyright header to web_view files and fix im…
ajpallares Jul 21, 2026
8ceb7d4
Merge branch 'main' into webview/5-session
ajpallares Jul 21, 2026
07ecb4c
fix(paywalls): treat unresolvable web_view origin as inert bridge
ajpallares Jul 21, 2026
2eb1308
refactor(paywalls): tidy web_view session comments and narrow handleC…
ajpallares Jul 21, 2026
53fde7e
test(paywalls): add missing web_view drop-branch coverage and harden …
ajpallares Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions RevenueCat.xcodeproj/project.pbxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@
FC5AE63E8F81C3EC2FFDA408 /* WebViewOriginPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 28661C6CE3F64078A0138080 /* WebViewOriginPolicy.swift */; };
FA4A2DF41FC434A9401F08CC /* PaywallWebViewValue.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9D0C57ECDF0E7F1A5B4418FF /* PaywallWebViewValue.swift */; };
11CC2EA83C56933E40D8E5D8 /* WebViewEnvelope.swift in Sources */ = {isa = PBXBuildFile; fileRef = 89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */; };
0F4E490A741F00F18C4985D8 /* WebViewSession.swift in Sources */ = {isa = PBXBuildFile; fileRef = 72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */; };
16DA8F1E2E4FB6E200283940 /* ImageComponent.json in Resources */ = {isa = PBXBuildFile; fileRef = 16DA8F1B2E4FB6E200283940 /* ImageComponent.json */; };
16DA8F1F2E4FB6E200283940 /* VideoComponent.json in Resources */ = {isa = PBXBuildFile; fileRef = 16DA8F1C2E4FB6E200283940 /* VideoComponent.json */; };
16E146AD2E99F3480089B609 /* TransactionNotifications.swift in Sources */ = {isa = PBXBuildFile; fileRef = 16E146AB2E99F1E20089B609 /* TransactionNotifications.swift */; };
Expand Down Expand Up @@ -1684,6 +1685,8 @@
89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewEnvelope.swift; sourceTree = "<group>"; };
C1B939C7DAAFEA1DE2DE2674 /* WebViewEnvelopeTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewEnvelopeTests.swift; sourceTree = "<group>"; };
686562C08D953A27986DB276 /* PaywallWebViewValueTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PaywallWebViewValueTests.swift; sourceTree = "<group>"; };
72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewSession.swift; sourceTree = "<group>"; };
F75819E258F47D1DB058500D /* WebViewSessionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewSessionTests.swift; sourceTree = "<group>"; };
16DA8F1B2E4FB6E200283940 /* ImageComponent.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = ImageComponent.json; sourceTree = "<group>"; };
16DA8F1C2E4FB6E200283940 /* VideoComponent.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = VideoComponent.json; sourceTree = "<group>"; };
16E146AB2E99F1E20089B609 /* TransactionNotifications.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TransactionNotifications.swift; sourceTree = "<group>"; };
Expand Down Expand Up @@ -3250,6 +3253,7 @@
9E7AD021B4580265DFDF6A02 /* WebViewNavigationPolicyTests.swift */,
686562C08D953A27986DB276 /* PaywallWebViewValueTests.swift */,
C1B939C7DAAFEA1DE2DE2674 /* WebViewEnvelopeTests.swift */,
F75819E258F47D1DB058500D /* WebViewSessionTests.swift */,
802593842FE07057005AF6DF /* PaywallStateStoreTests.swift */,
16A9F7B62FAA22D0008E8A4D /* VideoComponentViewTests.swift */,
A9D45E4EAFAD4C0385BEDFB3 /* VideoPlayerViewTests.swift */,
Expand Down Expand Up @@ -3390,6 +3394,7 @@
28661C6CE3F64078A0138080 /* WebViewOriginPolicy.swift */,
9D0C57ECDF0E7F1A5B4418FF /* PaywallWebViewValue.swift */,
89DD761C9E00E61032AAEB44 /* WebViewEnvelope.swift */,
72CC1CD0385BF18D1392EB43 /* WebViewSession.swift */,
);
path = WebView;
sourceTree = "<group>";
Expand Down Expand Up @@ -8347,6 +8352,7 @@
FC5AE63E8F81C3EC2FFDA408 /* WebViewOriginPolicy.swift in Sources */,
FA4A2DF41FC434A9401F08CC /* PaywallWebViewValue.swift in Sources */,
11CC2EA83C56933E40D8E5D8 /* WebViewEnvelope.swift in Sources */,
0F4E490A741F00F18C4985D8 /* WebViewSession.swift in Sources */,
DBAA1FC22F8D4ED8000E8C81 /* HeaderNestedHeroZLayerSafeAreaPreview.swift in Sources */,
164681D22E6B577600854AA5 /* VideoComponentViewModel.swift in Sources */,
2C7457422CE81107004ACE52 /* IntroOfferEligibilityContext.swift in Sources */,
Expand Down
12 changes: 12 additions & 0 deletions RevenueCatUI/Data/Strings.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,11 @@ enum Strings {
case video_failed_to_set_audio_session_category(Error)
case video_failed_to_cache(URL, Error)

// WebView
case paywall_web_view_message_rejected(reason: String)
case paywall_web_view_post_message_failed(String)
case paywall_web_view_post_message_skipped

// Exit Offers
case errorFetchingOfferings(Error)
case exitOfferNotFound(String)
Expand Down Expand Up @@ -364,6 +369,13 @@ extension Strings: CustomStringConvertible {
case .video_failed_to_cache(let url, let error):
return "Failed to cache video at \(url): \(error)"

case .paywall_web_view_message_rejected(let reason):
return "Paywalls V2 web_view message rejected: \(reason)"
case .paywall_web_view_post_message_failed(let error):
return "Paywalls V2 web_view postMessage failed: \(error)"
case .paywall_web_view_post_message_skipped:
return "Paywalls V2 web_view postMessage skipped because the channel is not ready or origin changed."

case .errorFetchingOfferings(let error):
return "Error fetching offerings: \(error)"
case .exitOfferNotFound(let offeringId):
Expand Down
6 changes: 6 additions & 0 deletions RevenueCatUI/Templates/V2/Components/WebView/WebViewEnvelope.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
//
// Copyright RevenueCat Inc. All Rights Reserved.
//

import Foundation

#if !os(tvOS) // For Paywalls V2
Expand All @@ -7,6 +11,8 @@ enum WebViewEnvelope {

static let channel = "rc-web-components"
static let messageHandlerName = "rcWebComponents"
/// Name of the JS function injected into the web view that receives host-to-content frames.
static let receiveFunction = "__rcWebComponentsReceive"

@ajpallares ajpallares Jul 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it here to make it equal to Android (+ it makes more sense to me)

static let defaultProtocolVersion = 1

static let messageTypeResize = "resize"
Expand Down
51 changes: 37 additions & 14 deletions RevenueCatUI/Templates/V2/Components/WebView/WebViewOriginPolicy.swift
View file
Open in desktop

@ajpallares ajpallares Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file only contains a simple refactor to have getter webViewOrigin variables on URL and WKSecurityOrigin instead of two methods in WebViewOrigin. The WebViewOrigin enum is now a private namespace for the common canonicalOrigin method

Original file line number Diff line number Diff line change
@@ -1,24 +1,47 @@
import Foundation

#if canImport(WebKit)
import WebKit
#endif
//
// Copyright RevenueCat Inc. All Rights Reserved.
//

#if !os(tvOS) && canImport(WebKit) // For Paywalls V2

@available(iOS 15.0, macOS 12.0, tvOS 15.0, watchOS 8.0, *)
enum WebViewOrigin {
import Foundation
import WebKit

extension URL {

nonisolated static func origin(of url: URL) -> String? {
guard let scheme = url.scheme?.lowercased(),
let host = url.host?.lowercased(),
/// Canonical origin (`scheme://host[:port]`) of the URL, or `nil` if it has no scheme or host.
nonisolated var webViewOrigin: String? {
guard let scheme = self.scheme?.lowercased(),
let host = self.host?.lowercased(),
!host.isEmpty else {
return nil
}
return WebViewOrigin.canonicalOrigin(scheme: scheme, host: host, port: self.port)
}

}

extension WKSecurityOrigin {

/// Canonical origin of the frame that posted a script message. Uses the frame's security origin
/// (the authoritative sender) rather than the WebView's top-level URL.
var webViewOrigin: String? {
let scheme = self.`protocol`.lowercased()
let host = self.host.lowercased()
guard !scheme.isEmpty, !host.isEmpty else {
return nil
}
// `WKSecurityOrigin` reports `0` for the scheme's default port.
return WebViewOrigin.canonicalOrigin(scheme: scheme, host: host, port: self.port == 0 ? nil : self.port)
}

}

private enum WebViewOrigin {

let port = url.port
nonisolated static func canonicalOrigin(scheme: String, host: String, port: Int?) -> String {
let suffix: String
if let port, !Self.isDefaultPort(port, scheme: scheme) {
if let port, !isDefaultPort(port, scheme: scheme) {
suffix = ":\(port)"
} else {
suffix = ""
Expand All @@ -42,14 +65,14 @@ enum WebViewNavigationPolicy {
// to `default-src 'self'`).
static func policy(for url: URL?, isMainFrame: Bool, expectedOrigin: String) -> WKNavigationActionPolicy {
guard let url,
let origin = WebViewOrigin.origin(of: url),
let origin = url.webViewOrigin,
origin.hasPrefix("https://") else {
return .cancel
}
guard isMainFrame else {
return .allow
}
let expected = URL(string: expectedOrigin).flatMap(WebViewOrigin.origin(of:))
let expected = URL(string: expectedOrigin)?.webViewOrigin
return origin == expected ? .allow : .cancel
}

Expand Down
Loading