Use a webview for WP.com login #21414

jkmassel · 2024-11-04T22:57:08Z

Fixes a fairly common login issue reported in https://a8c.slack.com/archives/C02AVAR9B/p1728576885606729.

To Test:

Install both Jetpack and WordPress.
Try logging into WP.com
Note that it works

Regression Notes

Potential unintended areas of impact
Could be other issues around login – I tried very narrowly address the issue in this PR – nothing has been removed, so everything should work like it did before (for instance, use re-authentication).
What I did to test those areas of impact (or what existing automated tests I relied on)
n/a
What automated tests I added (or what prevented me from doing so)
There wouldn't be a lot of benefit to automated tests at this point.

PR Submission Checklist:

I have completed the Regression Notes.
I have considered adding accessibility improvements for my changes.
I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

Testing Checklist (strike-out the not-applying and unnecessary ones):

dangermattic · 2024-11-04T22:59:21Z

	3 Errors
🚫	Please add tests for class `WPcomLoginHelper` (or add `unit-tests-exemption` label to ignore this).
🚫	Please add tests for class `WPcomLoginClient` (or add `unit-tests-exemption` label to ignore this).
🚫	Please add tests for class `WPcomLoginError` (or add `unit-tests-exemption` label to ignore this).

	1 Message
📖	This PR is still a Draft: some checks will be skipped.

Generated by 🚫 Danger

wpmobilebot · 2024-11-04T23:16:09Z

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr21414-ade3342
	Commit	`ade3342`
	Direct Download	`wordpress-prototype-build-pr21414-ade3342.apk`

Note: Google Login is not supported on these builds.

wpmobilebot · 2024-11-04T23:17:17Z

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr21414-ade3342
	Commit	`ade3342`
	Direct Download	`jetpack-prototype-build-pr21414-ade3342.apk`

Note: Google Login is not supported on these builds.

crazytonyli · 2024-11-04T23:42:28Z

WordPress/src/main/java/org/wordpress/android/ui/accounts/login/WPcomLoginHelper.kt

+
+        runBlocking {
+            val tokenResult = loginClient.exchangeAuthCodeForToken(code, BuildConfig.OAUTH_REDIRECT_URI)
+            accountStore.updateAccessToken(tokenResult.getOrThrow())


I think you'd want to check if the token belongs to the current user before saving it. Users can log in with any account from the login webpage.

This should be for first-time authentication only – I'm thinking we'll want a reauthenticate method that does what you say – forces login to a specific account

nbradbury · 2024-11-05T13:16:32Z

@jkmassel I'm running into some issues with this. When I try to login with a 2FA account, I see this screen and can't go any further:

If I try with a non-2FA account, after I login I'm not redirected to the app - instead I'm still in the browser. Is this intended? I also did not expect to be taken to the browser to login. Is it not possible to do this in a WebView within the app?

wplogin.mp4

nbradbury · 2024-11-05T13:17:58Z

WordPress/src/main/AndroidManifest.xml

@@ -113,7 +113,18 @@
        <activity
            android:name=".ui.accounts.LoginActivity"
            android:theme="@style/LoginTheme.TransparentSystemBars"
-            android:windowSoftInputMode="adjustResize" />
+            android:windowSoftInputMode="adjustResize"
+            android:exported="true">


Sonarcloud flags this as a security risk. Does it need to be exported?

My understanding is that this was required in order to handle custom URL schemes, but I might be incorrect!

Ah, I suspect you're right about that. This Sonarcloud page mentions ways to fix this warning.

jkmassel · 2024-11-05T23:23:54Z

If I try with a non-2FA account, after I login I'm not redirected to the app - instead I'm still in the browser. Is this intended?

That's really odd – I wonder if maybe the app needs to be fully uninstalled? You're being redirected to http://android.a8c.com, which is the old behaviour 🤔

Is it not possible to do this in a WebView within the app

Good question! I had assumed that we'd want to use the default browser for password managers, etc – if we can do it in an in-app browser that would be nicer for sure.

nbradbury · 2024-11-06T12:36:35Z

That's really odd – I wonder if maybe the app needs to be fully uninstalled? You're being redirected to http://android.a8c.com, which is the old behaviour

I tried again, this time using a new emulator instance (so no previous install), and I'm still seeing this behavior.

wpmobilebot · 2024-11-18T21:59:48Z

Project dependencies changes

The following changes in project dependencies were detected (configuration wordpressVanillaReleaseRuntimeClasspath):

list

tree

+\--- androidx.browser:browser:1.5.0 -> 1.8.0 (*)

jkmassel · 2024-11-18T22:08:38Z

@nbradbury – could you give this a try again? It now uses Chrome Tabs in-app, which should share all of password management goodness we need.

I tried it with a Google-synced passkey and it worked, and I tried with a Yubikey and that worked too (on my ancient Galaxy S9) so I'm hopeful it works for you too!

nbradbury · 2024-11-19T12:23:10Z

could you give this a try again? It now uses Chrome Tabs in-app, which should share all of password management goodness we need.

@jkmassel Chrome Custom tabs is a much better solution, but I'm still seeing issues. With a non-2FA account, I end up being redirected to the Automattic home page.

redirect.mp4

With a 2FA account, I still get stuck in some sort of passkey loop which I don't understand.

passkey.mp4

nbradbury · 2024-11-19T14:17:12Z

gradle/libs.versions.toml

@@ -9,6 +9,7 @@ androidx-activity = '1.9.3'
 androidx-annotation = '1.9.1'
 androidx-appcompat = '1.7.0'
 androidx-arch-core = '2.2.0'
+androidx-browser = '1.5.0'


Note that this is an outdated version of the library. The latest is 1.8.0.

nbradbury · 2024-11-19T14:21:33Z

WordPress/src/main/java/org/wordpress/android/ui/accounts/LoginActivity.java

+    public void showEmailLoginScreen(@NonNull Context context) {
+        CustomTabsIntent intent = new CustomTabsIntent.Builder()
+                .setShareState(CustomTabsIntent.SHARE_STATE_OFF)
+                .setStartAnimations(this, R.anim.activity_slide_up_from_bottom, R.anim.activity_slide_up_from_bottom)


For consistency with the other login screens, WDYT about changing this to slide in from the right, slide out to the left?

sonarcloud · 2024-11-22T18:44:15Z

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

jkmassel requested review from nbradbury and oguzkocer November 4, 2024 22:57

crazytonyli reviewed Nov 4, 2024

View reviewed changes

nbradbury reviewed Nov 5, 2024

View reviewed changes

jkmassel added 2 commits November 18, 2024 15:07

Use a webview for WP.com login

52733dd

Use Custom Chrome Tabs

d93b1f8

jkmassel force-pushed the use/webview-for-dotcom-login branch from eb5c5a5 to d93b1f8 Compare November 18, 2024 22:07

jkmassel requested a review from nbradbury November 18, 2024 22:08

jkmassel added 2 commits November 18, 2024 17:10

Rename showEmailLoginScreen->showWPcomLoginScreen

09270f6

Use showWPcomLoginScreen to reauthenticate

b0ddc76

nbradbury reviewed Nov 19, 2024

View reviewed changes

jkmassel added 2 commits November 20, 2024 09:17

Don’t compile if secrets are missing

ec1b34b

Use the latest secrets.properties

ade3342

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use a webview for WP.com login #21414

Use a webview for WP.com login #21414

jkmassel commented Nov 4, 2024

dangermattic commented Nov 4, 2024

wpmobilebot commented Nov 4, 2024 •

edited

Loading

wpmobilebot commented Nov 4, 2024 •

edited

Loading

crazytonyli Nov 4, 2024

jkmassel Nov 5, 2024

nbradbury commented Nov 5, 2024 •

edited

Loading

nbradbury Nov 5, 2024

jkmassel Nov 5, 2024

nbradbury Nov 6, 2024

jkmassel commented Nov 5, 2024

nbradbury commented Nov 6, 2024

wpmobilebot commented Nov 18, 2024

jkmassel commented Nov 18, 2024

nbradbury commented Nov 19, 2024

nbradbury Nov 19, 2024

nbradbury Nov 19, 2024 •

edited

Loading

sonarcloud bot commented Nov 22, 2024

Use a webview for WP.com login #21414

Are you sure you want to change the base?

Use a webview for WP.com login #21414

Conversation

jkmassel commented Nov 4, 2024

To Test:

Regression Notes

PR Submission Checklist:

Testing Checklist (strike-out the not-applying and unnecessary ones):

dangermattic commented Nov 4, 2024

wpmobilebot commented Nov 4, 2024 • edited Loading

wpmobilebot commented Nov 4, 2024 • edited Loading

crazytonyli Nov 4, 2024

Choose a reason for hiding this comment

jkmassel Nov 5, 2024

Choose a reason for hiding this comment

nbradbury commented Nov 5, 2024 • edited Loading

nbradbury Nov 5, 2024

Choose a reason for hiding this comment

jkmassel Nov 5, 2024

Choose a reason for hiding this comment

nbradbury Nov 6, 2024

Choose a reason for hiding this comment

jkmassel commented Nov 5, 2024

nbradbury commented Nov 6, 2024

wpmobilebot commented Nov 18, 2024

Project dependencies changes

jkmassel commented Nov 18, 2024

nbradbury commented Nov 19, 2024

nbradbury Nov 19, 2024

Choose a reason for hiding this comment

nbradbury Nov 19, 2024 • edited Loading

Choose a reason for hiding this comment

sonarcloud bot commented Nov 22, 2024

Quality Gate failed

wpmobilebot commented Nov 4, 2024 •

edited

Loading

wpmobilebot commented Nov 4, 2024 •

edited

Loading

nbradbury commented Nov 5, 2024 •

edited

Loading

nbradbury Nov 19, 2024 •

edited

Loading