feat(paywalls): render web_view component (PWENG-98)

[alexrepty]

Checklist

• If applicable, unit tests
• If applicable, create follow-up issues for purchases-ios and hybrids

Motivation

With the web_view schema in place, the component needs to actually render its hosted content in a Paywalls V2 paywall.

Part of PWENG-98.

Description

• Adds WebViewComponentView (a WebView hosted via AndroidView), WebViewComponentStyle, the StyleFactory mapping, and ComponentView dispatch.
• Adds WebViewUrlResolver: resolves the URL template against paywall variables natively, then validates it is an HTTPS URL with a host. If it does not resolve, the component renders nothing (availability is gated by SDK version on the frontend).
• No bridge or CSP yet — those land in later PRs.
• Tested by StyleFactoryTests and WebViewUrlResolverTest.

iOS parity: mirrors purchases-ios (web-view-bridge-wiring).
Stack (merge bottom-up): schema → rendering → CSP → value types → message model → variables provider → JS bridge → wiring.

---

Note

Medium Risk
Introduces WebView with JavaScript enabled and external URL loading in the paywall surface; mitigations are HTTPS-only validation and navigation blocking, but CSP/bridge are still out of scope for this PR.

Overview
Paywalls V2 web_view components now render hosted HTTPS content instead of being dropped during style creation.

Style pipeline: StyleFactory maps WebViewComponent to WebViewComponentStyle (URL template, visibility, size), and ComponentView dispatches to the new composable.

Rendering: WebViewComponentView hosts an AndroidView WebView that resolves the URL via WebViewUrlResolver (paywall variables + locale), accepts only HTTPS URLs with a host, and renders nothing on failure. The WebView is keyed on the resolved URL so in-page navigation is not reset on recomposition; locale changes still refresh locale-dependent templates. Settings restrict file/content access, disallow mixed content, enable JS/DOM storage, and block non-HTTPS navigations in shouldOverrideUrlLoading.

Tests: StyleFactoryTests for style mapping and WebViewUrlResolverTest for URL resolution and rejection of non-HTTPS/malformed URLs.

^{Reviewed by Cursor Bugbot for commit 4fb9844. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alexrepty]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(paywalls): wire web_view messaging into the paywall (PWENG-98) #3653
• feat(paywalls): add web_view JavaScript bridge (PWENG-98) #3655
• feat(paywalls): add web_view SDK variables provider (PWENG-98) #3663
• feat(paywalls): add web_view message model and parsing (PWENG-98) #3654
• feat(paywalls): add web_view message value types (PWENG-98) #3662
• feat(paywalls): isolate web_view content with a fixed CSP (PWENG-98) #3652
• feat(paywalls): render web_view component (PWENG-98) #3651 👈 (View in Graphite)
• feat(paywalls): add web_view component schema (PWENG-98) #3650
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.48%. Comparing base (40615bf) to head (4fb9844).

Additional details and impacted files

@@                         Coverage Diff                         @@
##           alexrepty/paywalls-web-view-schema    #3651   +/-   ##
===================================================================
  Coverage                               80.48%   80.48%           
===================================================================
  Files                                     404      404           
  Lines                                   16728    16728           
  Branches                                 2389     2389           
===================================================================
  Hits                                    13464    13464           
  Misses                                   2322     2322           
  Partials                                  942      942           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cursor]

WebView URL variable resolution incomplete

Medium Severity

The PR resolves web_view URL templates against paywall variables, but WebViewUrlResolver only passes custom variables and locale into VariableProcessorV2, omitting selected package, subscription option, variableDataProvider, currency locale, and date context. createWebViewComponentStyle also does not capture enclosing rcPackage like text/video components. WebViewComponentView caches the URL in remember keyed by template, state identity, and locale, so it does not refresh when the user changes the selected package.

Additional Locations (2)

• ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewComponentView.kt#L30-L33
• ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/style/StyleFactory.kt#L583-L593

 

^{Reviewed by Cursor Bugbot for commit bc0f4e0. Configure here.}

[emerge-tools]

📸 Snapshot Test

593 unchanged

Name	Added	Removed	Modified	Renamed	Unchanged	Errored	Approval
TestPurchasesUIAndroidCompatibility com.revenuecat.testpurchasesuiandroidcompatibility	0	0	0	0	335	0	N/A
TestPurchasesUIAndroidCompatibility Paparazzi com.revenuecat.testpurchasesuiandroidcompatibility.paparazzi	0	0	0	0	258	0	N/A

---

🛸 Powered by Emerge Tools

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2634d3b. Configure here.}

[cursor]

java.net.URL as Compose key triggers blocking DNS

Medium Severity

key(resolvedUrl) uses a java.net.URL object as a Compose key. URL.equals() and URL.hashCode() perform blocking DNS resolution on the calling thread. Compose's key() calls equals() on every recomposition to check whether the composition identity changed, causing a synchronous network operation on the main/UI thread. This is a well-known Java pitfall flagged by Google's ErrorProne checker (URLEqualsHashCode). Using resolvedUrl.toString() as the key (or returning a URI/String from WebViewUrlResolver) avoids the blocking call entirely.

Additional Locations (1)

• ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewUrlResolver.kt#L40-L43

 

^{Reviewed by Cursor Bugbot for commit 2634d3b. Configure here.}