Merge branch 'main' into push-auth

shilgapira · web-flow · commit 3485e9b42b1b · 2026-07-13T15:54:39.000+03:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up JDK 17
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: "zulu"
           java-version: "17"
diff --git a/.github/workflows/detekt.yml b/.github/workflows/detekt.yml
@@ -23,10 +23,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Setup detekt
-      uses: peter-murray/setup-detekt@26449609a63e843a5b9bad8a4b63ef0ee717f7a5 # v3.0.0
+      uses: peter-murray/setup-detekt@4c0b45d6dac2620e84abd4ea7008a8a140b9f20a # v4.0.0
       with:
         detekt_version: 1.23
     
@@ -51,7 +51,7 @@ jobs:
         )" > ${{ github.workspace }}/detekt.sarif.json
 
     # Uploads results to GitHub repository using the upload-sarif action
-    - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+    - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         # Path to SARIF file relative to the root of the repository
         sarif_file: ${{ github.workspace }}/detekt.sarif.json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -9,9 +9,9 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up JDK 17
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: "zulu"
           java-version: "17"
diff --git a/descopesdk/src/main/java/com/descope/android/DescopeFlowBridge.kt b/descopesdk/src/main/java/com/descope/android/DescopeFlowBridge.kt
@@ -19,6 +19,7 @@ import com.descope.internal.others.debug
 import com.descope.internal.others.error
 import com.descope.internal.others.info
 import com.descope.internal.others.isUnsafeEnabled
+import com.descope.internal.others.parseServerError
 import com.descope.internal.others.stringOrEmptyAsNull
 import com.descope.internal.others.with
 import com.descope.internal.routes.isWebAuthnSupported
@@ -103,8 +104,15 @@ internal class FlowBridge(val webView: WebView) {
     }
 
     private fun bridgeOnError(error: String) {
+        val parsed = parseServerError(error)
+        val exception = when {
+            parsed == null -> DescopeException.flowFailed.with(message = error)
+            // Convert server flow cancellation to local flow cancellation for cohesive error handling
+            parsed.code == "E102122" -> DescopeException.flowCancelled.with(message = parsed.message)
+            else -> parsed
+        }
         handler.post {
-            listener?.onError(DescopeException.flowFailed.with(message = error))
+            listener?.onError(exception)
         }
     }
 
diff --git a/descopesdk/src/main/java/com/descope/android/DescopeFlowCoordinator.kt b/descopesdk/src/main/java/com/descope/android/DescopeFlowCoordinator.kt
@@ -299,6 +299,7 @@ class DescopeFlowCoordinator(val webView: WebView) {
         } catch (e: DescopeException) {
             if (e == DescopeException.oauthNativeCancelled) {
                 logger.info("OAuth native canceled")
+                sendResponse(FlowBridgeResponse.Failure("OAuthNativeCancelled"))
                 return
             }
             logger.error("OAuth native failed", e)
@@ -310,9 +311,14 @@ class DescopeFlowCoordinator(val webView: WebView) {
         pendingDeepLinkType = request.variant
         logger.info("Launching custom tab for ${request.variant}")
         try {
-            launchCustomTab(webView.context, request.startUrl, flow?.presentation?.createCustomTabsIntent(webView.context))
+            launchCustomTab(webView.context, request.startUrl, flow?.presentation?.createCustomTabsIntent(webView.context)) {
+                // Custom tab dismissed by the user before completing the auth flow.
+                pendingDeepLinkType = null
+                sendResponse(FlowBridgeResponse.Failure("WebAuthCancelled"))
+            }
         } catch (e: DescopeException) {
             logger.error("Failed to launch custom tab", e)
+            pendingDeepLinkType = null
             sendResponse(FlowBridgeResponse.Failure("CustomTabFailure"))
         }
     }
@@ -325,6 +331,7 @@ class DescopeFlowCoordinator(val webView: WebView) {
         } catch (e: DescopeException) {
             if (e == DescopeException.passkeyCancelled) {
                 logger.info("Passkeys canceled")
+                sendResponse(FlowBridgeResponse.Failure("PasskeyCancelled"))
                 return
             }
             val failure = when (e) {
@@ -353,6 +360,7 @@ class DescopeFlowCoordinator(val webView: WebView) {
         } catch (e: DescopeException) {
             if (e == DescopeException.passkeyCancelled) {
                 logger.info("Passkeys canceled")
+                sendResponse(FlowBridgeResponse.Failure("PasskeyCancelled"))
                 return
             }
             val failure = when (e) {
diff --git a/descopesdk/src/main/java/com/descope/android/DescopeHelperActivity.kt b/descopesdk/src/main/java/com/descope/android/DescopeHelperActivity.kt
@@ -30,6 +30,7 @@ class DescopeHelperActivity : Activity() {
         // interfere with user input, etc.
         if (listenForClose) {
             listenForClose = false
+            activityHelper.onCustomTabCanceled()
             finish()
         } else {
             listenForClose = true
diff --git a/descopesdk/src/main/java/com/descope/android/Utils.kt b/descopesdk/src/main/java/com/descope/android/Utils.kt
@@ -27,12 +27,12 @@ fun sendViewIntent(context: Context, uri: Uri) {
 
 // Custom Tab
 
-fun launchCustomTab(context: Context, url: String, customTabsIntent: CustomTabsIntent? = null) {
-    launchCustomTab(context, url.toUri(), customTabsIntent)
+fun launchCustomTab(context: Context, url: String, customTabsIntent: CustomTabsIntent? = null, onCancel: (() -> Unit)? = null) {
+    launchCustomTab(context, url.toUri(), customTabsIntent, onCancel)
 }
 
-fun launchCustomTab(context: Context, uri: Uri, customTabsIntent: CustomTabsIntent? = null) {
-    activityHelper.openCustomTab(context, customTabsIntent ?: defaultCustomTabIntent(), uri)
+fun launchCustomTab(context: Context, uri: Uri, customTabsIntent: CustomTabsIntent? = null, onCancel: (() -> Unit)? = null) {
+    activityHelper.openCustomTab(context, customTabsIntent ?: defaultCustomTabIntent(), uri, onCancel)
 }
 
 internal fun defaultCustomTabIntent(): CustomTabsIntent {
diff --git a/descopesdk/src/main/java/com/descope/internal/http/ClientErrors.kt b/descopesdk/src/main/java/com/descope/internal/http/ClientErrors.kt
@@ -1,21 +1,7 @@
 package com.descope.internal.http
 
-import com.descope.internal.others.toMap
 import com.descope.internal.others.with
 import com.descope.types.DescopeException
-import org.json.JSONObject
-
-internal fun parseServerError(response: String): DescopeException? {
-    try {
-        val map = JSONObject(response).toMap()
-        val code = map["errorCode"] as? String ?: return null
-        val desc = map["errorDescription"] as? String ?: "Descope server error"
-        val message = map["errorMessage"] as? String
-        return DescopeException(code = code, desc = desc, message = message)
-    } catch (_: Exception) {
-        return null
-    }
-}
 
 internal fun exceptionFromResponseCode(code: Int): DescopeException? {
     val desc = failureFromResponseCode(code) ?: return null
diff --git a/descopesdk/src/main/java/com/descope/internal/http/DescopeClient.kt b/descopesdk/src/main/java/com/descope/internal/http/DescopeClient.kt
@@ -1,6 +1,7 @@
 package com.descope.internal.http
 
 import com.descope.android.SystemInfo
+import com.descope.internal.others.parseServerError
 import com.descope.sdk.DescopeConfig
 import com.descope.sdk.DescopeSdk
 import com.descope.types.DeliveryMethod
diff --git a/descopesdk/src/main/java/com/descope/internal/http/Responses.kt b/descopesdk/src/main/java/com/descope/internal/http/Responses.kt
@@ -21,6 +21,7 @@ internal data class JwtServerResponse(
     val cookiePath: String,
     val cookieName: String?,
     val sessionCookieName: String?,
+    val externalToken: String?,
 ) {
     companion object {
         fun fromJson(json: String, cookies: List<HttpCookie>) = JSONObject(json).run {
@@ -49,6 +50,7 @@ internal data class JwtServerResponse(
                 cookiePath = stringOrEmptyAsNull("cookiePath") ?: "",
                 cookieName = cookieName,
                 sessionCookieName = sessionCookieName,
+                externalToken = stringOrEmptyAsNull("externalToken"),
             )
         }
     }
diff --git a/descopesdk/src/main/java/com/descope/internal/others/ActivityHelper.kt b/descopesdk/src/main/java/com/descope/internal/others/ActivityHelper.kt
@@ -10,14 +10,18 @@ import com.descope.types.DescopeException
 
 internal interface ActivityHelper {
     val customTabsIntent: CustomTabsIntent?
-    fun openCustomTab(context: Context, customTabsIntent: CustomTabsIntent, url: Uri)
+    // onCancel is registered JIT (lifecycle-bound to this custom-tab launch) so
+    // it doesn't outlive the tab and can't be hijacked by a different caller.
+    fun openCustomTab(context: Context, customTabsIntent: CustomTabsIntent, url: Uri, onCancel: (() -> Unit)? = null)
     fun closeCustomTab(context: Context)
+    fun onCustomTabCanceled()
 }
 
 internal val activityHelper = object : ActivityHelper {
+    private var cancelCallback: (() -> Unit)? = null
     override var customTabsIntent: CustomTabsIntent? = null
 
-    override fun openCustomTab(context: Context, customTabsIntent: CustomTabsIntent, url: Uri) {
+    override fun openCustomTab(context: Context, customTabsIntent: CustomTabsIntent, url: Uri, onCancel: (() -> Unit)?) {
         this.customTabsIntent = customTabsIntent
         if (!isBrowserSupported(context, url)) {
             throw DescopeException.customTabFailed.with(message = "No browser application was found")
@@ -30,11 +34,13 @@ internal val activityHelper = object : ActivityHelper {
         } catch (e: Exception) {
             throw DescopeException.customTabFailed.with(message = "Failed to open custom tab from context", cause = e)
         }
+        this.cancelCallback = onCancel
     }
 
     override fun closeCustomTab(context: Context) {
         if (this.customTabsIntent == null) return
         this.customTabsIntent = null
+        this.cancelCallback = null
         val intent = Intent(context, DescopeHelperActivity::class.java)
         intent.flags = Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_SINGLE_TOP
         try {
@@ -44,6 +50,11 @@ internal val activityHelper = object : ActivityHelper {
         }
     }
 
+    override fun onCustomTabCanceled() {
+        cancelCallback?.invoke()
+        cancelCallback = null
+    }
+
     private fun isBrowserSupported(context: Context, uri: Uri): Boolean {
         val intent = Intent(Intent.ACTION_VIEW, uri)
         val component = intent.resolveActivity(context.packageManager)
diff --git a/descopesdk/src/main/java/com/descope/internal/others/Errors.kt b/descopesdk/src/main/java/com/descope/internal/others/Errors.kt
@@ -1,10 +1,23 @@
 package com.descope.internal.others
 
 import com.descope.types.DescopeException
+import org.json.JSONObject
 
 internal fun DescopeException.with(desc: String? = null, message: String? = null, cause: Throwable? = null) = DescopeException(
     code = code,
     desc = desc ?: this.desc,
     message = message ?: this.message,
     cause = cause ?: this.cause,
 )
+
+internal fun parseServerError(response: String): DescopeException? {
+    try {
+        val map = JSONObject(response).toMap()
+        val code = map["errorCode"] as? String ?: return null
+        val desc = map["errorDescription"] as? String ?: "Descope server error"
+        val message = map["errorMessage"] as? String
+        return DescopeException(code = code, desc = desc, message = message)
+    } catch (_: Exception) {
+        return null
+    }
+}
diff --git a/descopesdk/src/main/java/com/descope/internal/routes/Shared.kt b/descopesdk/src/main/java/com/descope/internal/routes/Shared.kt
@@ -61,6 +61,7 @@ internal fun JwtServerResponse.convert(): AuthenticationResponse {
         sessionToken = Token(sessionJwt),
         user = user.convert(),
         isFirstAuthentication = firstSeen,
+        externalToken = externalToken,
     )
 }
 
diff --git a/descopesdk/src/main/java/com/descope/types/Responses.kt b/descopesdk/src/main/java/com/descope/types/Responses.kt
@@ -9,12 +9,14 @@ import com.descope.session.DescopeToken
  * @property refreshToken the refresh token is used to refresh expired session tokens.
  * @property isFirstAuthentication whether this the user's first authentication.
  * @property user information about the user.
+ * @property externalToken a token provided by an external token connector, when configured in the project.
  */
 data class AuthenticationResponse(
     val sessionToken: DescopeToken,
     val refreshToken: DescopeToken,
     val isFirstAuthentication: Boolean,
     val user: DescopeUser,
+    val externalToken: String? = null,
 )
 
 /**
diff --git a/descopesdk/src/test/java/com/descope/internal/http/JwtServerResponseTest.kt b/descopesdk/src/test/java/com/descope/internal/http/JwtServerResponseTest.kt
@@ -0,0 +1,34 @@
+package com.descope.internal.http
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class JwtServerResponseTest {
+
+    @Test
+    fun externalToken_populatedWhenPresent() {
+        val json = """
+            {
+                "sessionJwt": "session",
+                "refreshJwt": "refresh",
+                "firstSeen": true,
+                "externalToken": "ext-token-value"
+            }
+        """.trimIndent()
+        val response = JwtServerResponse.fromJson(json, emptyList())
+        assertEquals("ext-token-value", response.externalToken)
+    }
+
+    @Test
+    fun externalToken_nullWhenAbsent() {
+        val json = """
+            {
+                "sessionJwt": "session",
+                "refreshJwt": "refresh",
+                "firstSeen": true
+            }
+        """.trimIndent()
+        val response = JwtServerResponse.fromJson(json, emptyList())
+        assertNull(response.externalToken)
+    }
+}
diff --git a/descopesdk/src/test/java/com/descope/internal/routes/TestUtils.kt b/descopesdk/src/test/java/com/descope/internal/routes/TestUtils.kt
@@ -111,6 +111,7 @@ internal val mockJwtResponse = JwtServerResponse(
     cookiePath = "/path",
     cookieName = null,
     sessionCookieName = null,
+    externalToken = null,
 )
 
 private object MockInfo: SystemInfo {
diff --git a/descopesdk/src/test/java/com/descope/types/DescopeExceptionTest.kt b/descopesdk/src/test/java/com/descope/types/DescopeExceptionTest.kt
@@ -1,8 +1,9 @@
 package com.descope.types
 
-import com.descope.internal.http.parseServerError
+import com.descope.internal.others.parseServerError
 import org.json.JSONObject
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Assert.fail
 import org.junit.Test
 
@@ -22,5 +23,24 @@ class DescopeExceptionTest {
             else -> fail("wrong when clause")
         }
     }
-    
+
+    @Test
+    fun error_message_preserved() {
+        val payload = JSONObject().apply {
+            put("errorCode", "E102122")
+            put("errorDescription", "Flow aborted")
+            put("errorMessage", "User canceled")
+        }.toString()
+        val exception = parseServerError(payload)
+        assertEquals("E102122", exception?.code)
+        assertEquals("Flow aborted", exception?.desc)
+        assertEquals("User canceled", exception?.message)
+    }
+
+    @Test
+    fun invalid_error_payload_parsing() {
+        assertNull(parseServerError("not a json error"))
+        assertNull(parseServerError(JSONObject().apply { put("errorMessage", "no code here") }.toString()))
+    }
+
 }

Original file line number	Diff line number	Diff line change
`@@ -27,12 +27,12 @@ fun sendViewIntent(context: Context, uri: Uri) {`
`27`	`27`
`28`	`28`	`// Custom Tab`
`29`	`29`
`30`		`-fun launchCustomTab(context: Context, url: String, customTabsIntent: CustomTabsIntent? = null) {`
`31`		`- launchCustomTab(context, url.toUri(), customTabsIntent)`
	`30`	`+fun launchCustomTab(context: Context, url: String, customTabsIntent: CustomTabsIntent? = null, onCancel: (() -> Unit)? = null) {`
	`31`	`+ launchCustomTab(context, url.toUri(), customTabsIntent, onCancel)`
`32`	`32`	`}`
`33`	`33`
`34`		`-fun launchCustomTab(context: Context, uri: Uri, customTabsIntent: CustomTabsIntent? = null) {`
`35`		`- activityHelper.openCustomTab(context, customTabsIntent ?: defaultCustomTabIntent(), uri)`
	`34`	`+fun launchCustomTab(context: Context, uri: Uri, customTabsIntent: CustomTabsIntent? = null, onCancel: (() -> Unit)? = null) {`
	`35`	`+ activityHelper.openCustomTab(context, customTabsIntent ?: defaultCustomTabIntent(), uri, onCancel)`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`internal fun defaultCustomTabIntent(): CustomTabsIntent {`
Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,7 @@ internal data class JwtServerResponse(`
`21`	`21`	`val cookiePath: String,`
`22`	`22`	`val cookieName: String?,`
`23`	`23`	`val sessionCookieName: String?,`
	`24`	`+ val externalToken: String?,`
`24`	`25`	`) {`
`25`	`26`	`companion object {`
`26`	`27`	`fun fromJson(json: String, cookies: List<HttpCookie>) = JSONObject(json).run {`
`@@ -49,6 +50,7 @@ internal data class JwtServerResponse(`
`49`	`50`	`cookiePath = stringOrEmptyAsNull("cookiePath") ?: "",`
`50`	`51`	`cookieName = cookieName,`
`51`	`52`	`sessionCookieName = sessionCookieName,`
	`53`	`+ externalToken = stringOrEmptyAsNull("externalToken"),`
`52`	`54`	`)`
`53`	`55`	`}`
`54`	`56`	`}`