Skip to content

chore(runway): cherry-pick fix: support webcredentials cp-7.71.0#27845

Merged
chloeYue merged 1 commit into
release/7.71.0from
runway-cherry-pick-7.71.0-1774345421
Mar 24, 2026
Merged

chore(runway): cherry-pick fix: support webcredentials cp-7.71.0#27845
chloeYue merged 1 commit into
release/7.71.0from
runway-cherry-pick-7.71.0-1774345421

Conversation

@runway-github
Copy link
Copy Markdown
Contributor

@runway-github runway-github Bot commented Mar 24, 2026

Description

This pr patch the expo-web-browser to support https redirect schema
Taking reference from expo-web-browser sdk 55

https://github.com/expo/expo/blob/308031a6665f885811760aff7aebb68aea4a846a/packages/expo-web-browser/ios/WebAuthSession.swift#L36

Changelog

CHANGELOG entry: expo-web-browser support https redirect scheme
CHANGELOG entry: use webcredential for ios google login

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the
    app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described
    in the ticket it closes and includes the necessary testing evidence such
    as recordings and or screenshots.

Note

Medium Risk
Moderate risk because it changes iOS ASWebAuthenticationSession
callback configuration and entitlements, which can affect login/redirect
flows and associated-domain behavior.

Overview
Enables HTTPS redirect-based auth callbacks on iOS by patching
expo-web-browser’s WebAuthSession to use iOS 17.4+/macOS 14.4+
.https(host:path) callbacks when the redirectUrl is https, falling
back to the legacy callbackURLScheme behavior otherwise.

Updates iOS entitlements (MetaMask.entitlements and
MetaMaskDebug.entitlements) to include
webcredentials:link.metamask.io, and wires the patch into the build
via a Yarn resolutions entry plus corresponding yarn.lock changes.

Written by Cursor
Bugbot
for commit
7730be3. This will update automatically
on new commits. Configure
here.

[a2f8164](https://github.com/MetaMask/metamask-mobile/commit/a2f8164fd22f439025b15d8780eccfd3223d57a8)

)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
This pr patch the expo-web-browser to support https redirect schema
Taking reference from expo-web-browser sdk 55

https://github.com/expo/expo/blob/308031a6665f885811760aff7aebb68aea4a846a/packages/expo-web-browser/ios/WebAuthSession.swift#L36

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: expo-web-browser support https redirect scheme 
CHANGELOG entry: use webcredential for ios google login 

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Moderate risk because it changes iOS `ASWebAuthenticationSession`
callback configuration and entitlements, which can affect login/redirect
flows and associated-domain behavior.
> 
> **Overview**
> Enables **HTTPS redirect-based auth callbacks** on iOS by patching
`expo-web-browser`’s `WebAuthSession` to use iOS 17.4+/macOS 14.4+
`.https(host:path)` callbacks when the `redirectUrl` is `https`, falling
back to the legacy `callbackURLScheme` behavior otherwise.
> 
> Updates iOS entitlements (`MetaMask.entitlements` and
`MetaMaskDebug.entitlements`) to include
`webcredentials:link.metamask.io`, and wires the patch into the build
via a Yarn `resolutions` entry plus corresponding `yarn.lock` changes.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7730be3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@runway-github runway-github Bot requested a review from a team as a code owner March 24, 2026 09:43
@github-actions
Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Mar 24, 2026
@github-actions github-actions Bot added size-S risk-low Low testing needed · Low bug introduction risk labels Mar 24, 2026
@github-actions
Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: None (no tests recommended)
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 78%
click to see 🤖 AI reasoning details

E2E Test Selection:
The PR makes three types of changes:

  1. expo-web-browser yarn patch (package.json + .yarn/patches/ + yarn.lock): A patch is applied to the [email protected] package via yarn's patch mechanism. Searching the codebase reveals that expo-web-browser is NOT directly imported in any .ts or .tsx app files, meaning it's a transitive dependency. The patch itself (visible in the diff) only modifies the yarn.lock resolution entry — it doesn't appear to change any functional behavior of the package. This is a low-risk dependency management change.

  2. iOS entitlements (MetaMask.entitlements + MetaMaskDebug.entitlements): Both production and debug entitlements add webcredentials:link.metamask.io to the associated domains array. This enables iOS Shared Web Credentials / Password AutoFill capability for link.metamask.io. This is an iOS-native capability configuration change that doesn't affect JavaScript/React Native app logic, UI flows, or E2E test scenarios. It's a build-time configuration that enables a system-level feature.

Why no E2E tags are selected:

  • No app logic, UI components, controllers, or user flows are modified
  • The expo-web-browser patch doesn't affect any directly-used code paths in the app
  • The webcredentials entitlement is an iOS system capability that doesn't have corresponding E2E test coverage in the available tags
  • None of the available E2E test tags (SmokeAccounts, SmokeConfirmations, SmokeTrade, etc.) are specifically designed to test iOS entitlements or dependency patches
  • Running any test suite would not meaningfully validate these infrastructure-level changes

Performance tests: Not applicable — no UI rendering, state management, data loading, or performance-sensitive code paths are changed.

Performance Test Selection:
No performance-sensitive code paths are changed. The changes are limited to an iOS entitlements file (build-time configuration) and a yarn patch for expo-web-browser (a transitive dependency not directly used in app code). Neither change affects UI rendering, state management, data loading, or any other performance-measurable flows.

View GitHub Actions results

@sonarqubecloud
Copy link
Copy Markdown

@github-actions
Copy link
Copy Markdown
Contributor

E2E Fixture Validation — Schema is up to date
16 value mismatches detected (expected — fixture represents an existing user).
View details

Copy link
Copy Markdown
Contributor

@chloeYue chloeYue left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@chloeYue chloeYue merged commit 8b303c4 into release/7.71.0 Mar 24, 2026
107 checks passed
@chloeYue chloeYue deleted the runway-cherry-pick-7.71.0-1774345421 branch March 24, 2026 11:12
@github-actions github-actions Bot locked and limited conversation to collaborators Mar 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

risk-low Low testing needed · Low bug introduction risk size-S team-bots Bot team (for MetaMask Bot, Runway Bot, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants