WebView SDK

// Headers
X-App-Signature: "HMAC-SHA256(app_secret, device_fingerprint + timestamp)"
X-Device-Id:     "<device_fingerprint>"
X-App-Version:   "2.1.0"
Content-Type:    "application/json"

// Body
{
  "user_id":           "uuid-из-авторизации-ук",
  "device_fingerprint": "ANDROID_ID_or_IDFV",
  "platform":          "android" // или "ios"
}

{
  "access_token":  "eyJhbGci...",  // JWT, TTL 15 мин
  "refresh_token": "rt_abc123...", // opaque, TTL 30 дней
  "session_key":   "base64(AES-256)", // ключ сеанса
  "expires_in":    900,
  "token_type":    "bearer"
}

fun computeSignature(appSecret: String, deviceFp: String, timestamp: Long): String {
  val message = "$deviceFp$timestamp"
  val mac = Mac.getInstance("HmacSHA256")
  mac.init(SecretKeySpec(appSecret.toByteArray(), "HmacSHA256"))
  return Base64.encodeToString(mac.doFinal(message.toByteArray()), Base64.NO_WRAP)
}

// Headers
Authorization: "Bearer <access_token>"

// Body
{
  "target":             "request/123", // или "chat/abc", "/"
  "device_fingerprint": "ANDROID_ID_or_IDFV"
}

// Ответ
{
  "launch_token": "lt_one_time_abc...",
  "ttl": 10  // секунд
}

// НЕ передавать access_token в URL!
val url = "https://sosed-sosedu.ru/sdk/launch?lt=${launchToken}"
webView.loadUrl(url)

// Обязательные настройки WebView
webView.settings.apply {
  javaScriptEnabled = true
  domStorageEnabled = true
  allowFileAccess = false
  allowContentAccess = false
}

// Кастомный User-Agent с package name
webView.settings.userAgentString =
  "SosedSoseduSDK/1.0 (com.yourcompany.app; android)"

// Headers
X-Device-Id: "<device_fingerprint>"

// Body
{
  "refresh_token": "rt_старый..."
}

// Ответ 200
{
  "access_token":  "eyJ новый...",
  "refresh_token": "rt_новый...", // старый стал недействителен
  "expires_in":    900
}

// 401 — refresh истёк, требуется повторный логин в приложении УК

actor TokenManager {
  private var isRefreshing = false
  private var waiters: [CheckedContinuation<String, Error>] = []

  func getValidToken() async throws -> String {
    if let token = Keychain.read("access_token"), !isExpired(token) {
      return token
    }
    if isRefreshing {
      return try await withCheckedThrowingContinuation { waiters.append($0) }
    }
    isRefreshing = true
    defer { isRefreshing = false }
    let newToken = try await performRefresh()
    waiters.forEach { $0.resume(returning: newToken) }
    waiters.removeAll()
    return newToken
  }
}

// Отправка зашифрованного события
async function sendEvent(payload) {
  const { iv, ciphertext, tag } = await encryptAESGCM(payload, sessionKey);
  window.ReactNativeWebView?.postMessage(JSON.stringify({
    v: 1,
    nonce: crypto.randomUUID(),      // защита от replay
    ts: Date.now(),
    iv, data: ciphertext, tag
  }));
}

// Примеры событий из WebView
sendEvent({ type: "new_bid",     request_id: "abc", amount: 500 });
sendEvent({ type: "deal_done",   request_id: "abc" });
sendEvent({ type: "new_message", chat_id: "xyz", count: 3 });
sendEvent({ type: "error",       code: "SESSION_EXPIRED" });

// Отправка команды в WebView
suspend fun sendCommand(webView: WebView, command: Map<String, Any>) {
  val encrypted = AesGcm.encrypt(command.toJson(), sessionKey)
  val payload = mapOf(
    "v" to 1,
    "nonce" to UUID.randomUUID().toString(),
    "ts" to System.currentTimeMillis(),
    "iv" to encrypted.iv,
    "data" to encrypted.ciphertext,
    "tag" to encrypted.tag
  )
  withContext(Dispatchers.Main) {
    webView.evaluateJavascript(
      "window.dispatchEvent(new MessageEvent('message',{data:'${payload.toJson()}'}))",
      null
    )
  }
}

// Команды в WebView
sendCommand(webView, mapOf("type" to "navigate", "target" to "chat/xyz"))
sendCommand(webView, mapOf("type" to "refresh_token", "new_token" to newJwt))

val pinner = CertificatePinner.Builder()
  .add("sosed-sosedu.ru", "sha256/ХЕश_СЕРТИФИКАТА_BASE64=")
  .add("sosed-sosedu.ru", "sha256/BACKUP_PIN_BASE64=") // резервный пин
  .build()

val client = OkHttpClient.Builder()
  .certificatePinner(pinner)
  .build()

let trustKitConfig: [String: Any] = [
  kTSKSwizzleNetworkDelegates: false,
  kTSKPinnedDomains: [
    "sosed-sosedu.ru": [
      kTSKPublicKeyHashes: [
        "ХЕШ_СЕРТИФИКАТА_BASE64=",
        "BACKUP_PIN_BASE64="
      ]
    ]
  ]
]
TrustKit.initSharedInstance(withConfiguration: trustKitConfig)

// При перехвате sosed:// URI
fun handleDeepLink(uri: Uri) {
  val target = uri.path?.removePrefix("/") ?: "/"
  val launchToken = apiClient.getLaunchToken(target)
  openWebView("https://sosed-sosedu.ru/sdk/launch?lt=${launchToken}")
}

{
  "data": {
    "v":    "1",
    "blob": "AES-256-GCM-ciphertext-base64",
    "iv":   "base64",
    "tag":  "base64",
    "url":  "request/123"  // target для deep link
  }
}

// После расшифровки blob:
{
  "type":    "new_bid",
  "title":   "Новый отклик на ваш запрос",
  "body":    "Иван предложил 400₽",
  "request_id": "123"
}