Skip to content

webviewsdk: standardize config params#1946

Merged
seshanthS merged 8 commits intodevfrom
feat/standardize-config-params
Apr 10, 2026
Merged

webviewsdk: standardize config params#1946
seshanthS merged 8 commits intodevfrom
feat/standardize-config-params

Conversation

@seshanthS
Copy link
Copy Markdown
Collaborator

@seshanthS seshanthS commented Apr 8, 2026

Summary

  • Centralize SDK constants: Extract hardcoded URLs, hosts, ports, and paths into a shared SdkConstants
    object in KMP commonMain, eliminating duplicated magic strings across Android and iOS
  • Shared query-param builder: Replace the platform-specific buildQueryParams() in SelfVerificationActivity
    (which used org.json manual parsing) with a shared QueryParamsBuilder in commonMain that operates on typed
    SelfSdkConfig/VerificationRequest objects
  • Stricter Android launch validation: Deserialize config/request JSON via kotlinx.serialization upfront in
    initVerificationFlow() and fail early with INVALID_BOOTSTRAP if either is malformed, instead of deferring
    failure to query-param building
  • Belt-and-suspenders debug guard: WebView debug features (localhost loading,
    setWebContentsDebuggingEnabled) now require both config.debug == true AND ApplicationInfo.FLAG_DEBUGGABLE —
    a release APK with debug=true in config will no longer enable debug behavior
  • Internalize CryptoProvider: Make CryptoProvider, AndroidKeystoreCryptoProvider, and
    SdkProviderRegistry.crypto internal. The WebView uses Web Crypto API directly, so consumers no longer need
    to register a crypto provider. isConfigured() now only checks secureStorage
  • Remove legacy intent extras: Drop EXTRA_DEBUG_MODE and EXTRA_DEV_SERVER_URL from SelfVerificationActivity
    — all config is now read from the serialized EXTRA_CONFIG payload
  • iOS: Replace local buildQueryParams/encodeParam in WebViewProviderImpl with constants from SdkConstants
    (temporarily via self-sdk-swift until KMP framework export is wired)

Test plan

  • New QueryParamsBuilderTest — covers default config, all config/request params, comma-joined lists, empty
    list omission, null field omission, URL encoding of special characters
  • New AndroidWebViewHostSecurityTest cases — verifies isDebugMode=true + isDebuggable=false loads remote URL
    (not localhost), and both-true loads localhost
  • cd packages/kmp-sdk && ./gradlew :shared:jvmTest passes
  • Android build + manual smoke: launch verification flow, confirm WebView loads correct URL with expected
    query params
  • iOS build + manual smoke: same verification flow check

Native Consolidation Checklist

  • CONTRACTS.md reviewed - no unintended contract changes
  • Layer 1 bridge contract tests pass (cd app && yarn jest:run / yarn workspace @selfxyz/rn-sdk-test-app test)
  • Layer 3 builds pass (app iOS, RN test app iOS, RN test app Android)
  • Layer 4 manual smoke test signed off (if consolidation PR)
  • No new native business logic added (logic belongs in TypeScript)

Summary by CodeRabbit

  • Bug Fixes
    • Stronger startup validation for verification flows and safer WebView debug behavior based on app debuggability.
  • Refactor
    • Centralized SDK constants across platforms; removed legacy debug/dev intent extras and updated URL selection logic.
    • Centralized, more robust query-parameter generation and encoding for WebView launches.
    • Crypto provider is no longer required for SDK readiness/initialization.
  • Tests
    • Added unit tests for WebView URL selection and query-parameter assembly.

seshanthS and others added 2 commits April 9, 2026 01:37
- Add shared SdkConstants (loopback host, debug port, didit host, tour path, default URLs)
- Add shared QueryParamsBuilder replacing duplicated platform-specific builders
- Android: deserialize config/request via kotlinx.serialization instead of org.json
- Android: add belt-and-suspenders debug guard (isDebugMode && isDebuggable)
- Android: remove redundant EXTRA_DEBUG_MODE and EXTRA_DEV_SERVER_URL intent extras
- iOS: replace local buildQueryParams/encodeParam with shared QueryParamsBuilder
- All default URLs now reference SdkConstants instead of hardcoded strings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace hardcoded constants with SdkConstants.shared.* from KMP framework
- Replace "/tunnel/tour/1" with SdkConstants.shared.BUNDLED_TOUR_PATH
- Add SelfSdk as local package dependency in self-sdk-swift Package.swift

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 8, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
self-webview-app Ignored Ignored Preview Apr 9, 2026 5:05pm

Request Review

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 8, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 71effc2d-a615-4368-a5bf-9bdd97a42ab0

📥 Commits

Reviewing files that changed from the base of the PR and between d1d90bd and 29a27f5.

📒 Files selected for processing (1)
  • packages/kmp-sdk-test-app/composeApp/src/commonMain/kotlin/xyz/self/testapp/screens/DomainSmokeScreen.kt

📝 Walkthrough

Walkthrough

Centralizes SDK constants into SdkConstants (Kotlin/Swift), adds a centralized QueryParamsBuilder, shifts WebView debug detection to application debuggability, removes Intent debug/dev extras, makes crypto providers/internal and removes crypto from public APIs and test apps, and updates related platform integrations and tests.

Changes

Cohort / File(s) Summary
Constants Centralization
packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/SdkConstants.kt, packages/self-sdk-swift/Sources/SelfSdkSwift/Constants/SdkConstants.swift
Added shared SdkConstants with loopback host, debug port, DIDIT host, bundled tour path, default endpoint, and default remote web app base URL.
Constant References Updated
packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/SelfSdkConfig.kt, packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/webview/IosWebViewHost.kt, packages/self-sdk-swift/Sources/SelfSdkSwift/Providers/WebViewProviderImpl.swift
Replaced hardcoded default endpoint/remote base URL and related literals with SdkConstants references.
Query Parameter Builder & Tests
packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/QueryParamsBuilder.kt, packages/kmp-sdk/shared/src/commonTest/kotlin/xyz/self/sdk/api/QueryParamsBuilderTest.kt
Added internal QueryParamsBuilder and urlEncode helper; added comprehensive unit tests for encoding, param inclusion, list serialization, and fallbacks.
Platform Query Integration
packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/api/SelfSdk.ios.kt, packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/api/SelfSdk.android.kt
Entry points now delegate query string construction to QueryParamsBuilder; Android no longer injects EXTRA_DEBUG_MODE or EXTRA_DEV_SERVER_URL into the launch Intent.
Android WebView Host & Activity
packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/webview/AndroidWebViewHost.kt, packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/webview/SelfVerificationActivity.kt
AndroidWebViewHost gained isDebuggable flag and uses SdkConstants; SelfVerificationActivity now decodes typed JSON for config/request, uses QueryParamsBuilder, derives debuggability from ApplicationInfo.FLAG_DEBUGGABLE, and removed debug/dev intent extras and the local query-builder.
iOS WebView Host / Provider updates
packages/self-sdk-swift/Sources/SelfSdkSwift/Providers/WebViewProviderImpl.swift, packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/webview/IosWebViewHost.kt
Switched to SdkConstants for host/port/path/base URL; updated bundled resource path and debug port usage to use constants.
WebView Debug Tests
packages/kmp-sdk/shared/src/androidUnitTest/kotlin/xyz/self/sdk/webview/AndroidWebViewHostSecurityTest.kt
Added tests asserting initialContentUrl selection for combinations of isDebugMode and isDebuggable.
Crypto provider visibility & registry
packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/providers/CryptoProvider.kt, packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/providers/AndroidKeystoreCryptoProvider.kt, packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/providers/SdkProviderRegistry.kt
Made CryptoProvider and AndroidKeystoreCryptoProvider internal; made SdkProviderRegistry.crypto internal and removed crypto requirement from isConfigured().
Public API / Examples (Swift)
packages/self-sdk-swift/Sources/SelfSdkSwift/SelfSdkSwift.swift
Removed public crypto provider property and example usage from Swift public API.
Test App Changes
packages/kmp-sdk-test-app/composeApp/src/androidMain/kotlin/xyz/self/testapp/MainActivity.kt, packages/kmp-sdk-test-app/composeApp/src/commonMain/kotlin/xyz/self/testapp/screens/DomainSmokeScreen.kt, packages/kmp-sdk-test-app/iosApp/iosApp/iOSApp.swift, packages/kmp-minipay-sample/iosApp/iosApp/iOSApp.swift
Removed registration/usage of crypto provider and crypto smoke tests; updated test descriptions and app initializers to no longer register crypto.
Packaging / Scripts
packages/kmp-sdk/Package.swift, scripts/check-license-headers.mjs
Moved swift-tools-version directive to file top; enhanced license-header script to preserve shebang and swift-tools-version lines when inserting headers.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'webviewsdk: standardize config params' accurately summarizes the main objective of centralizing SDK configuration parameters and standardizing their usage across the codebase.
Description check ✅ Passed The PR description thoroughly documents all major changes including SDK constants centralization, query builder refactoring, Android validation improvements, debug guards, crypto provider internalization, and intent extra removals. Test plan includes new tests and manual smoke test coverage.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/standardize-config-params

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 53a053ae-eae5-45d4-9153-84e8acc17201

📥 Commits

Reviewing files that changed from the base of the PR and between 77df53b and 04820c0.

📒 Files selected for processing (12)
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/api/SelfSdk.android.kt
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/webview/AndroidWebViewHost.kt
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/webview/SelfVerificationActivity.kt
  • packages/kmp-sdk/shared/src/androidUnitTest/kotlin/xyz/self/sdk/webview/AndroidWebViewHostSecurityTest.kt
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/QueryParamsBuilder.kt
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/SdkConstants.kt
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/api/SelfSdkConfig.kt
  • packages/kmp-sdk/shared/src/commonTest/kotlin/xyz/self/sdk/api/QueryParamsBuilderTest.kt
  • packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/api/SelfSdk.ios.kt
  • packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/webview/IosWebViewHost.kt
  • packages/self-sdk-swift/Package.swift
  • packages/self-sdk-swift/Sources/SelfSdkSwift/Providers/WebViewProviderImpl.swift
💤 Files with no reviewable changes (1)
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/api/SelfSdk.android.kt

Comment thread packages/self-sdk-swift/Package.swift Outdated
seshanthS and others added 2 commits April 9, 2026 16:23
CryptoProvider is never called at runtime (WebView uses Web Crypto API
directly). Make the interface, its Android implementation, and the
registry field internal so consumers no longer need to provide or
register a crypto implementation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2


ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e4734977-8cd6-4dd3-8b1d-ebdbf6152ef6

📥 Commits

Reviewing files that changed from the base of the PR and between 04820c0 and de879d7.

📒 Files selected for processing (10)
  • packages/kmp-sdk-test-app/composeApp/src/androidMain/kotlin/xyz/self/testapp/MainActivity.kt
  • packages/kmp-sdk-test-app/composeApp/src/commonMain/kotlin/xyz/self/testapp/screens/DomainSmokeScreen.kt
  • packages/kmp-sdk-test-app/iosApp/iosApp/iOSApp.swift
  • packages/kmp-sdk/Package.swift
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/providers/AndroidKeystoreCryptoProvider.kt
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/providers/CryptoProvider.kt
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/providers/SdkProviderRegistry.kt
  • packages/kmp-sdk/shared/src/iosMain/kotlin/xyz/self/sdk/api/SelfSdk.ios.kt
  • packages/self-sdk-swift/Sources/SelfSdkSwift/SelfSdkSwift.swift
  • scripts/check-license-headers.mjs
💤 Files with no reviewable changes (3)
  • packages/kmp-sdk-test-app/composeApp/src/androidMain/kotlin/xyz/self/testapp/MainActivity.kt
  • packages/self-sdk-swift/Sources/SelfSdkSwift/SelfSdkSwift.swift
  • packages/kmp-sdk-test-app/iosApp/iosApp/iOSApp.swift
✅ Files skipped from review due to trivial changes (3)
  • packages/kmp-sdk/Package.swift
  • packages/kmp-sdk/shared/src/commonMain/kotlin/xyz/self/sdk/providers/CryptoProvider.kt
  • packages/kmp-sdk/shared/src/androidMain/kotlin/xyz/self/sdk/providers/AndroidKeystoreCryptoProvider.kt

Comment thread scripts/check-license-headers.mjs
@seshanthS seshanthS merged commit 6dc79ea into dev Apr 10, 2026
32 checks passed
@seshanthS seshanthS deleted the feat/standardize-config-params branch April 10, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant