@W-16171409: [Android] Add QR Code Login Support in MSDK #2594

JohnsonEricAtSalesforce · 2024-07-22T20:58:47Z

🎸 Ready For Review! 🥁

This adds support for log in via log in QR codes generated with the UI Bridge API to MSDK. This completes a very detailed spike previously completed by @wmathurin and directly inherits from that codebase.

Before reviewing, I highly recommend reading this document and references in detail:
👉🏻 https://salesforce.quip.com/JXmvAwirhR3V

There's actually very little if any logic change from the spike code. What I did try to apply was my novice's eye to the topic so we can name and document the code such that it'll be a bit more approachable for those uninitiated to the UI Bridge API, how that is delivered via the QR code and the many touch points that has in MSDK's log in logic. I did the same in the companion pull request that introduces commented out content to our template guiding a developer through enabling this in a new app.

The companion template update is in forcedotcom/SalesforceMobileSDK-Templates#417

For now launches QR code reader and print url to log

…th config

Using user agent flow if no pkce code verifier provided

…Style And Commentary Cleanup)

JohnsonEricAtSalesforce · 2024-07-22T21:01:43Z

It's worth noting I did intend to include commits from the spike performed by @wmathurin. I rebased his branch on dev before adding my own commits. Plus, a squash will make this very tidy on dev when we're done while preserving his history here.

JohnsonEricAtSalesforce · 2024-07-22T21:06:55Z

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/LoginActivity.kt

-    public override fun onSaveInstanceState(bundle: Bundle) {
-        super.onSaveInstanceState(bundle)
-        webviewHelper?.saveState(bundle)
+    public override fun onSaveInstanceState(outState: Bundle) {


This was an unrelated yet low-risk inspector cleanup.

JohnsonEricAtSalesforce · 2024-07-22T21:08:40Z

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/LoginActivity.kt

+     * @return Boolean true if a log in attempt is possible using the provided QR
+     * code content, false otherwise
+     */
+    fun loginFromQrCode(


All the new methods here should look very familiar to @wmathurin. I did apply quite a bit of comment and naming thought though to reflect my own journey in understanding how it all worked plus see if I could make the semantic match through all the reference documentation. There's some Kotlin style added as well for extra credit.

@JohnsonEricAtSalesforce @wmathurin Is there any kind of profile limitation to this login option? If not should we consider moving this to a standalone utility class that could be used by LoginActivity and native login consumers? Perhaps native login support is a new story to itself, just trying to be forward thinking so we don't have to deprecate and move APIs around if possible.

The bridge url is supposed to be loaded in a web view to get the tokens or the code - it is not a headless API. So it's another form of web view based login.

Yes, but despite it being a web based login it is possible to do it without the customer ever seeing a webview. You can put a button on a native login screen that has the same code as the QrCodeEnabledLoginActivity from the template app and if the user is pre authorized (a requirement for headless flow) they don't have to accept connected app policy. This is obviously work well beyond the scope of this PR and would require a headless webview but it sounds possible, right?

It's like the web view to get a code for the SP in the IDP-based login. You have to show it because user interaction might be needed.
But you are right that you could launch it from the native login screen.

Yeah, if the user is preauthorized, we could hide the web view. I guess we could let the mobile app know whether to show the web view or not by adding a field in the JSON we encode in the QR URL.

JohnsonEricAtSalesforce · 2024-07-22T21:09:28Z

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt

+     * @param frontdoorBridgeUrl The UI Bridge API front door bridge API
+     * @param pkceCodeVerifier The PKCE code verifier
+     */
+    internal fun loginWithFrontdoorBridgeUrl(


@wmathurin - I made this internal. Was there any reason it wasn't before?

The packing of front door bridge URL and PKCE in a QR code will be up to the apex or java page.
Hopefully it will use the attributes names we recommend, if it does not, an app could parse them out itself and call this method directly?
I guess if we make the method internal, it will force the server page to use the attributes names in the JSON that we expect.

That's very helpful, since I was also starting to wonder where a custom APEX with different structure would tie in. I'll make this public again!

mobilesdk-bot · 2024-07-22T21:13:32Z

	2 Warnings
⚠️	libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/LoginActivity.kt#L209 - Using `setJavaScriptEnabled` can introduce XSS vulnerabilities into your application, review carefully
⚠️	libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt#L215 - Using `setJavaScriptEnabled` can introduce XSS vulnerabilities into your application, review carefully

Tests results for SalesforceSDK

Generated by 🚫 Danger

…ve Review)

JohnsonEricAtSalesforce · 2024-07-23T20:37:54Z

Hold merging this to dev and the 12.1.0 codebase until we confirm the iOS version will also make it in time for the release.

brandonpage · 2024-07-23T22:53:16Z

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt

@@ -661,7 +661,7 @@ open class OAuthWebviewHelper : KeyChainAliasCallback {
                    )

                    else -> when {
-                        instance.useWebServerAuthentication -> onWebServerFlowComplete(params["code"])
+                        codeVerifier?.isNotEmpty() == true -> onWebServerFlowComplete(params["code"])


This is a bug and needs to be reverted as it will break User Agent flow login. codeVerifier is always created no matter which flow we are using.

You are right, I did not try user agent flow when doing the spike.
But we can't just revert.
With QR login, we will decide what flow to use based on what came through the JSON encoded in the QR URL.
If the JSON contains a code verifier, we use it and we should to a web server flow. And we should set a new flag saying that web server flow should be used.
That flag should be set to instance.useWebServerAuthentication by default.
We should use the new flag here.

Thanks, @brandonpage (and @wmathurin)! I'll take a look.

Okay. So if I understand correctly the QR URL can/should override the app's setting for useWebServerAuthentication? Sounds like something that should be documented.

Also is User Agent Flow supported? The code above appears to require PKCE.

We support both, if the QR encodes a code verifier we expect to the bridge URL to do a web server flow and the redirect to get us a code. If the QR comes with an empty/null code verifier, then the code verifier ends up not being defined and the code above will take the user agent branch. The bridge URL should do a user agent flow and the redirect get us the refresh tokens.

During the spike, I played with both, but the web server flow case meant a longer URL encoded in the QR which made it harder to read with the reader. I could not get it to work completely. See https://salesforce.quip.com/JXmvAwirhR3V#temp:C:IIO55768e89acdc49948a3be45bf

@JohnsonEricAtSalesforce Before closing the story, we need to make sure user agent and web server flow work with and without QR. During the spike, I did not test them all or get them all working.

@wmathurin & @brandonpage - I broke out W-16336715: [MSDK Android] Correct QR Code Log In When Using Web Server to track this in detail. I'll commit that here before we merge for 12.1 or whichever release QR code login lands in soon.

I also broke out W-16336722 to track the other bug in Quip regarding the main activity not being displayed.

brandonpage

Where the QR Code Login work should live isn't a blocker, but the User Agent Flow issue I mentioned is.

…ing login using front door URL and code verifier to override web server Vs. user agent flow)

JohnsonEricAtSalesforce · 2024-09-29T02:52:09Z

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt

+                        // Determine if presence of override parameters require the user agent flow.
+                        val overrideWithUserAgentFlow = isUsingFrontDoorBridgeUrl && frontDoorBridgeCodeVerifier == null
+                        when {
+                            instance.useWebServerAuthentication && !overrideWithUserAgentFlow ->


💤 [No after hours reply needed] @brandonpage & @wmathurin, this is my current thinking for storing the front door bridge URL and its optional accompanying code verifier as dedicated properties so we may then use them to determine the authentication flow between web server and user agent. That's for this thread from earlier:

#2594 (comment)

This looks a lot like what I have in place for iOS in SFOAuthCoordinator.

Just having an outside force overriding the app's chosen auth flow is complicated, so I want to internalize that from the app and try to keep our code simple. I was hoping just storing those and then clearly determining this one local variable would keep that readable. I'm open the suggestions, though.

On the iOS side, SFOAuthCoordinator is the WKNavigationDelegate. It would possibly be a lot easier to maintain if that was a separate class chosen just when a front door URL is in place. I'm thinking "one class per job" rather than a single class with an overly complicated control flow. I didn't do that yet, but perhaps when we convert that to Swift and here we eliminate OAuthWebViewHelper we could really simplify the code for this complicated set of logic flow.

codecov-commenter · 2024-09-29T03:07:20Z

Codecov Report

Attention: Patch coverage is 16.98113% with 44 lines in your changes missing coverage. Please review.

Project coverage is 57.10%. Comparing base (301e0f4) to head (6f0974e).
Report is 72 commits behind head on dev.

Files with missing lines	Patch %	Lines
.../src/com/salesforce/androidsdk/ui/LoginActivity.kt	20.51%	27 Missing and 4 partials ⚠️
...com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt	0.00%	13 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                dev    #2594      +/-   ##
============================================
+ Coverage     51.41%   57.10%   +5.69%     
- Complexity     1789     2424     +635     
============================================
  Files           146      187      +41     
  Lines         12097    15204    +3107     
  Branches       1712     2135     +423     
============================================
+ Hits           6220     8683    +2463     
- Misses         5178     5615     +437     
- Partials        699      906     +207

Flag	Coverage Δ
MobileSync	`81.68% <ø> (?)`
SalesforceHybrid	`55.56% <ø> (ø)`
SalesforceReact	`52.36% <ø> (ø)`
SalesforceSDK	`42.24% <16.98%> (-0.81%)`	⬇️
SmartStore	`78.30% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../salesforce/androidsdk/app/SalesforceSDKManager.kt	`53.35% <100.00%> (+0.08%)`	⬆️
...com/salesforce/androidsdk/ui/OAuthWebviewHelper.kt	`10.28% <0.00%> (-0.15%)`	⬇️
.../src/com/salesforce/androidsdk/ui/LoginActivity.kt	`24.53% <20.51%> (-1.43%)`	⬇️

... and 49 files with indirect coverage changes

wmathurin and others added 12 commits July 17, 2024 16:32

(WIP) login with QR button in login screen

ba16f74

For now launches QR code reader and print url to log

Parsing bridge url and pkce code verifier from url read from QR

fb4baef

Enabling QR login in Rest Explorer

9a0a352

Loading frontdoor bridge url in web view (wip)

4396670

Adding custom scheme handler for login qr

ca4d874

Handling custom scheme (wip)

edf8c6a

Moving QR support code our of Mobile SDK (to template)

3c9c058

During QR login, do no load anything in the web view and don't get au…

4bb050c

…th config

Handling url encoded bridgeJson

43e03d9

Extracting login url from front door bridge url

e2bbfec

Using user agent flow if no pkce code verifier provided

@W-16171409: [Android] Add QR Code Login Support in MSDK (Light Cleanup)

7d28d9d

@W-16171409: [Android] Add QR Code Login Support in MSDK (Light Code …

57dc2c1

…Style And Commentary Cleanup)

JohnsonEricAtSalesforce self-assigned this Jul 22, 2024

JohnsonEricAtSalesforce requested a review from wmathurin July 22, 2024 20:58

JohnsonEricAtSalesforce mentioned this pull request Jul 22, 2024

W-16171426: [Android] Update Native Login Sample App to include QR Code Login Flow forcedotcom/SalesforceMobileSDK-Templates#417

Open

JohnsonEricAtSalesforce commented Jul 22, 2024

View reviewed changes

@W-16171409: [Android] Add QR Code Login Support in MSDK (Comprehensi…

f9ea0e5

…ve Review)

JohnsonEricAtSalesforce force-pushed the feature/w-16171409_android-add-qr-code-login-support-in-msdk branch from e0c01af to f9ea0e5 Compare July 22, 2024 22:19

wmathurin approved these changes Jul 23, 2024

View reviewed changes

brandonpage reviewed Jul 23, 2024

View reviewed changes

brandonpage requested changes Jul 23, 2024

View reviewed changes

JohnsonEricAtSalesforce mentioned this pull request Sep 16, 2024

@W-16362973: [iOS] Add QR Code Login Support in MSDK forcedotcom/SalesforceMobileSDK-iOS#3759

Open

@W-16171409: [Android] Add QR Code Login Support in MSDK (Logic allow…

6f0974e

…ing login using front door URL and code verifier to override web server Vs. user agent flow)

JohnsonEricAtSalesforce commented Sep 29, 2024

View reviewed changes

JohnsonEricAtSalesforce requested a review from brandonpage September 29, 2024 02:54

wmathurin approved these changes Sep 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

@W-16171409: [Android] Add QR Code Login Support in MSDK #2594

@W-16171409: [Android] Add QR Code Login Support in MSDK #2594

JohnsonEricAtSalesforce commented Jul 22, 2024 •

edited

Loading

JohnsonEricAtSalesforce commented Jul 22, 2024 •

edited

Loading

JohnsonEricAtSalesforce Jul 22, 2024

JohnsonEricAtSalesforce Jul 22, 2024

brandonpage Jul 23, 2024

wmathurin Jul 23, 2024

brandonpage Jul 23, 2024

wmathurin Jul 23, 2024

wmathurin Jul 23, 2024

JohnsonEricAtSalesforce Jul 22, 2024

wmathurin Jul 22, 2024

JohnsonEricAtSalesforce Jul 22, 2024

mobilesdk-bot commented Jul 22, 2024 •

edited

Loading

JohnsonEricAtSalesforce commented Jul 23, 2024

brandonpage Jul 23, 2024

wmathurin Jul 23, 2024

JohnsonEricAtSalesforce Jul 23, 2024 •

edited

Loading

brandonpage Jul 23, 2024

wmathurin Jul 23, 2024 •

edited

Loading

wmathurin Jul 23, 2024

JohnsonEricAtSalesforce Jul 25, 2024

brandonpage left a comment

JohnsonEricAtSalesforce Sep 29, 2024

codecov-commenter commented Sep 29, 2024 •

edited

Loading

@W-16171409: [Android] Add QR Code Login Support in MSDK #2594

Are you sure you want to change the base?

@W-16171409: [Android] Add QR Code Login Support in MSDK #2594

Conversation

JohnsonEricAtSalesforce commented Jul 22, 2024 • edited Loading

JohnsonEricAtSalesforce commented Jul 22, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mobilesdk-bot commented Jul 22, 2024 • edited Loading

Tests results for SalesforceSDK

JohnsonEricAtSalesforce commented Jul 23, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JohnsonEricAtSalesforce Jul 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wmathurin Jul 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brandonpage left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-commenter commented Sep 29, 2024 • edited Loading

Codecov Report

JohnsonEricAtSalesforce commented Jul 22, 2024 •

edited

Loading

JohnsonEricAtSalesforce commented Jul 22, 2024 •

edited

Loading

mobilesdk-bot commented Jul 22, 2024 •

edited

Loading

JohnsonEricAtSalesforce Jul 23, 2024 •

edited

Loading

wmathurin Jul 23, 2024 •

edited

Loading

codecov-commenter commented Sep 29, 2024 •

edited

Loading