feat: keyless wallet & apple google oauth login #9394

sidmorizon · 2025-12-22T08:56:26Z

No description provided.

coderabbitai · 2025-12-22T08:56:34Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/android-google-login

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

revan-zhang · 2025-12-22T08:56:44Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2025-12-24T12:28:39Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

…d references - Renamed `setMainWindow` to `setMainWindowForOAuthServer` in `oauthLocalServer` for better clarity. - Updated all references in `app.ts` to reflect the new function name. - Enhanced the `BaseSkeleton` component to accept a forwarded ref, improving its integration with parent components. - Updated `HyperlinkText` to use a lazy-loaded default internationalization instance. - Improved OAuth state handling in `openOAuthPopupWeb` and `useSupabaseAuth` for enhanced security and reliability.

…ed components - Added support for `oneKeyState` in the OAuth callback handling to improve security and state validation. - Updated `openOAuthPopupDesktopLocalhost` to manage OAuth sessions effectively, including session persistence options. - Refactored `useSupabaseAuth` to streamline OAuth processes and ensure compatibility with the new state handling. - Removed the deprecated `openOAuthPopupDesktopLocalhost` function to clean up the codebase. - Enhanced error handling across various OAuth methods to provide clearer feedback on authentication issues.

- Changed OAuth callback paths for desktop and web to `/oauth_callback_desktop` and `/oauth_callback_web`, respectively, improving clarity and consistency. - Introduced `ensureOneKeyOAuthState` utility to guarantee the presence of the `ONEKEY_OAUTH_STATE_KEY` parameter in redirect URLs, enhancing security. - Updated various components to utilize the new callback paths and state handling, ensuring robust OAuth flow and validation. - Improved error handling and state validation in the OAuth process to mitigate potential security risks.

…e callback handling - Removed fixed port range for OAuth callbacks, allowing the server to listen on a dynamically assigned port. - Enhanced the OAuth callback handling logic to improve error responses and streamline the process of receiving authorization codes. - Updated documentation to reflect changes in the OAuth flow and the new method of handling redirect URLs. - Improved error messages for better user feedback during OAuth server startup.

- Introduced a new `getRedirectUrl` function to standardize the retrieval of the OAuth redirect URL, ensuring it matches Google Cloud Console configuration. - Updated `openOAuthPopupExtIdentity` to utilize the new redirect URL function and accept an optional `authUrl` parameter for improved flexibility. - Refactored the OAuth flow processing to simplify the handling of authentication URLs and session management. - Enhanced `useSupabaseAuth` to support the new `authUrl` parameter, aligning the extension's OAuth handling with web standards.

- Removed OAuth2 configuration from Chrome manifest files, streamlining the setup process. - Simplified the `IHandleOAuthSessionPersistenceParams` type by removing unnecessary properties. - Introduced a unified `OAuthPopup` class structure for handling OAuth across web, desktop, extension, and native platforms. - Enhanced `useSupabaseAuth` to leverage the new `OAuthPopup` implementation, improving session management and code clarity. - Updated various components to ensure compatibility with the new OAuth structure and improve overall maintainability.

- Deleted unused OAuth handling files for desktop, extension, native, and web platforms to streamline the codebase. - Removed related types and utility functions that are no longer necessary, enhancing maintainability and clarity. - This cleanup aligns with recent refactoring efforts to consolidate OAuth handling across platforms.

- Introduced a comprehensive guide for configuring Apple Sign-In with Supabase for the OneKey app, focusing on web platform setup. - Documented prerequisites, local development testing, and detailed steps for Apple Developer Console and Supabase configuration. - Included troubleshooting tips and security considerations to enhance user understanding and implementation of Apple Sign-In. - Updated OAuthPopup components to improve callback URL validation and nonce generation for enhanced security during authentication.

…ture

(cherry picked from commit 06ee0c4)

socket-security · 2026-01-05T09:38:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jpush-react-native@3.2.1
	react-native-webview-cleaner@1.0.0
	react-native-cloud-fs@2.6.5
	react-native-get-random-values@1.1.14

View full report

…issues

(cherry picked from commit 425b31cad2bfc3bfd9658e71526c44b55e5afec4)

…nstants - Return undefined nonce for iOS Google Sign-In to fix authentication issue - Add improved comments explaining nonce behavior in OAuth flow - Reorganize Supabase and Keyless config sections with clear separators

# Conflicts: # apps/mobile/ios/Podfile.lock # apps/mobile/package.json

limichange

Code Review Report

File	Line	Issue
packages/kit-bg/src/services/ServiceKeylessWallet/ServiceKeylessWallet.ts	1176-1183	P1 JWT Token Not Validated Before Trust
packages/kit-bg/src/services/ServiceKeylessWallet/ServiceKeylessWallet.ts	1254-1284	P1 Sensitive Data in Memory Without Secure Cleanup
packages/kit-bg/src/services/ServiceKeylessWallet/utils/JuiceboxClient.ts	101	P1 Global Callback Function Assignment
packages/kit-bg/src/services/ServiceKeylessWallet/ServiceKeylessWallet.ts	1285	P2 Error Handling TODO for Critical Flow
packages/kit-bg/src/services/ServiceKeylessWallet/utils/keylessMnemonicPasswordStorage.ts	66-83	P2 Double Encryption with Same Key Source

Found 5 issue(s).

packages/kit-bg/src/services/ServiceKeylessWallet/ServiceKeylessWallet.ts

packages/kit-bg/src/services/ServiceKeylessWallet/utils/JuiceboxClient.ts

packages/kit-bg/src/services/ServiceKeylessWallet/ServiceKeylessWallet.ts

packages/kit-bg/src/services/ServiceKeylessWallet/utils/keylessMnemonicPasswordStorage.ts

franco-chan added 3 commits December 17, 2025 16:55

onekeyid login page

130f2f3

social & otp

04313e2

ui

f91e280

sidmorizon changed the title ~~Fix/android google login~~ feat: ios & android google login Dec 22, 2025

fix conflix

0e38666

sidmorizon force-pushed the fix/android-google-login branch from 0150a99 to 46a739e Compare December 24, 2025 12:27

sidmorizon added 14 commits December 24, 2025 20:29

fix: google sign in for iOS

6ebc6f7

fix: ios google login

5b1b702

fix: upgrade google sign in sdk

86917c6

fix: lint

06890c1

apple login

d443a0f

fix(crypto): update crypto.subtle.digest test result

385a00b

sidmorizon changed the title ~~feat: ios & android google login~~ feat: apple & google login Dec 24, 2025

sidmorizon force-pushed the fix/android-google-login branch from 46a739e to 385a00b Compare December 24, 2025 12:30

sidmorizon and others added 5 commits December 24, 2025 20:30

fix: lint

06f3b80

fix: lint

3891607

apple login

bd8071d

fix: add ios apple sign in entitlements

0cb3717

ui

4cae995

franco-chan and others added 5 commits January 3, 2026 02:04

authentication page improvement: light & dark mode styles and layout

fe52e9e

feat: add juicebox-sdk integration and keyless wallet reset debug fea…

52c8301

…ture

fix(kit): support google login in onboarding get started page

89f0ba9

fix: owner id

3f97d00

(cherry picked from commit 06ee0c4)

fix: add pre-install hook for GitHub URL configuration

08364ed

originalix and others added 9 commits January 5, 2026 23:12

fix: move pre-install hook to package.json for EAS build configuration

861dba9

Update provisioning profiles and add JuiceboxSdk dependency

9b12fa7

chore: xcode profile

8f768b0

fix: update code signing settings and resolve JuiceboxSdkFfi linking …

8b5b25a

…issues

fix: merge

149f8f9

fix(kit): add error toast for OAuth sign-in failures

416a07a

(cherry picked from commit 425b31cad2bfc3bfd9658e71526c44b55e5afec4)

Merge branch 'x' into fix/android-google-login

b653f6a

# Conflicts: # apps/mobile/ios/Podfile.lock # apps/mobile/package.json

fix: build

be00f0d

sidmorizon marked this pull request as ready for review January 6, 2026 11:09

sidmorizon requested review from ezailWang, huhuanming, originalix and revan-zhang as code owners January 6, 2026 11:09

sidmorizon enabled auto-merge (squash) January 6, 2026 11:09

sidmorizon changed the title ~~feat: apple & google login~~ feat: keyless wallet & apple google oauth login Jan 6, 2026

Merge branch 'x' into fix/android-google-login

b99eab7

limichange reviewed Jan 6, 2026

View reviewed changes

Merge branch 'x' into fix/android-google-login

5ba70a2

originalix approved these changes Jan 7, 2026

View reviewed changes

Merge branch 'x' into fix/android-google-login

39ec34e

huhuanming approved these changes Jan 7, 2026

View reviewed changes

sidmorizon merged commit d7a42d3 into x Jan 7, 2026
10 checks passed

sidmorizon deleted the fix/android-google-login branch January 7, 2026 04:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: keyless wallet & apple google oauth login #9394

feat: keyless wallet & apple google oauth login #9394

Uh oh!

sidmorizon commented Dec 22, 2025

Uh oh!

coderabbitai bot commented Dec 22, 2025

Review skipped

Uh oh!

revan-zhang commented Dec 22, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Dec 24, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

limichange left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

feat: keyless wallet & apple google oauth login #9394

feat: keyless wallet & apple google oauth login #9394

Uh oh!

Conversation

sidmorizon commented Dec 22, 2025

Uh oh!

coderabbitai bot commented Dec 22, 2025

Review skipped

Uh oh!

revan-zhang commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

socket-security bot commented Dec 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

limichange left a comment

Choose a reason for hiding this comment

Code Review Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

revan-zhang commented Dec 22, 2025 •

edited

Loading

socket-security bot commented Dec 24, 2025 •

edited

Loading

socket-security bot commented Jan 5, 2026 •

edited

Loading