review fixes

Author: ksroda-sa

samples/react-native/login-pkce/App.tsx

@@ -36,11 +36,16 @@ type IdTokenClaims = {
 };
 
 function decodeIdToken(idToken: string): IdTokenClaims {
-  const [, payload] = idToken.split(".");
-  if (!payload) return {};
-  const b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), "=");
-  return JSON.parse(atob(padded)) as IdTokenClaims;
+  try {
+    const [, payload] = idToken.split(".");
+    if (!payload) return {};
+    const b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), "=");
+    return JSON.parse(atob(padded)) as IdTokenClaims;
+  } catch {
+    // Malformed / opaque token — fall through to the default welcome message
+    return {};
+  }
 }
 
 function formatLocal(iso: string): string {

samples/react-native/login-pkce/android/app/build.gradle

@@ -87,7 +87,9 @@ android {
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
         versionName "1.0"
-        manifestPlaceholders = [appAuthRedirectScheme: "com.secureauth.quickstart"]
+        // Use put() (or +=) instead of `=` so we don't wipe placeholders
+        // injected upstream by the React Native gradle plugin (e.g. usesCleartextTraffic).
+        manifestPlaceholders["appAuthRedirectScheme"] = "com.secureauth.quickstart"
     }
     signingConfigs {
         debug {

samples/react-native/login-pkce/ios/Quickstart/Info.plist

@@ -46,8 +46,6 @@
 		<key>NSAllowsLocalNetworking</key>
 		<true/>
 	</dict>
-	<key>NSLocationWhenInUseUsageDescription</key>
-	<string></string>
 	<key>RCTNewArchEnabled</key>
 	<true/>
 	<key>UILaunchStoryboardName</key>

samples/react-native/token-refresh/App.tsx

@@ -45,11 +45,16 @@ type IdTokenClaims = {
 };
 
 function decodeIdToken(idToken: string): IdTokenClaims {
-  const [, payload] = idToken.split(".");
-  if (!payload) return {};
-  const b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), "=");
-  return JSON.parse(atob(padded)) as IdTokenClaims;
+  try {
+    const [, payload] = idToken.split(".");
+    if (!payload) return {};
+    const b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), "=");
+    return JSON.parse(atob(padded)) as IdTokenClaims;
+  } catch {
+    // Malformed / opaque token — fall through to the default welcome message
+    return {};
+  }
 }
 
 function welcomeMessage(...tokens: (string | null | undefined)[]): string {

samples/react-native/token-refresh/android/app/build.gradle

@@ -87,7 +87,9 @@ android {
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
         versionName "1.0"
-        manifestPlaceholders = [appAuthRedirectScheme: "com.secureauth.quickstart"]
+        // Use put() (or +=) instead of `=` so we don't wipe placeholders
+        // injected upstream by the React Native gradle plugin (e.g. usesCleartextTraffic).
+        manifestPlaceholders["appAuthRedirectScheme"] = "com.secureauth.quickstart"
     }
     signingConfigs {
         debug {

samples/react-native/token-refresh/ios/Quickstart/Info.plist

@@ -46,8 +46,6 @@
 		<key>NSAllowsLocalNetworking</key>
 		<true/>
 	</dict>
-	<key>NSLocationWhenInUseUsageDescription</key>
-	<string></string>
 	<key>RCTNewArchEnabled</key>
 	<true/>
 	<key>UILaunchStoryboardName</key>

snippets.json

@@ -678,15 +678,15 @@
           "code": "  async function signIn() {\n    setError(null);\n    setExpired(false);\n    try {\n      const result = await authorize(authConfig);\n      setAuthState(result);\n    } catch (e) {\n      setError(e instanceof Error ? e.message : String(e));\n    }\n  }",
           "file": "App.tsx",
           "lang": "tsx",
-          "lines": "67-78"
+          "lines": "72-83"
         },
         {
           "step": 4,
           "description": "Revoke the access token at the IdP and clear local auth state",
           "code": "  async function signOut() {\n    if (!authState) return;\n    try {\n      await revoke(authConfig, {\n        tokenToRevoke: authState.accessToken,\n        sendClientId: true,\n      });\n    } catch (e) {\n      // Revocation is best-effort — proceed with local logout regardless.\n      Alert.alert(\n        \"Sign-out warning\",\n        e instanceof Error ? e.message : String(e),\n      );\n    }\n    setAuthState(null);\n    setExpired(false);\n  }",
           "file": "App.tsx",
           "lang": "tsx",
-          "lines": "81-99"
+          "lines": "86-104"
         }
       ],
       "framework": "react-native",
@@ -724,23 +724,23 @@
           "code": "  const signIn = useCallback(async () => {\n    setError(null);\n    try {\n      const result: AuthorizeResult = await authorize(authConfig);\n      const next: Tokens = {\n        accessToken: result.accessToken,\n        accessTokenExpirationDate: result.accessTokenExpirationDate,\n        refreshToken: result.refreshToken ?? null,\n        idToken: result.idToken ?? null,\n      };\n      setTokens(next);\n      if (next.refreshToken) {\n        await persistRefreshToken(next.refreshToken);\n      }\n    } catch (e) {\n      setError(e instanceof Error ? e.message : String(e));\n    }\n  }, []);",
           "file": "App.tsx",
           "lang": "tsx",
-          "lines": "80-99"
+          "lines": "85-104"
         },
         {
           "step": 4,
           "description": "Persist the refresh token in platform secure storage (Keychain on iOS, EncryptedSharedPreferences on Android)",
           "code": "  async function persistRefreshToken(refreshToken: string): Promise<void> {\n    await Keychain.setGenericPassword(\"refreshToken\", refreshToken, {\n      service: KEYCHAIN_SERVICE,\n      accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED,\n    });\n  }\n\n  async function loadRefreshToken(): Promise<string | null> {\n    const credentials = await Keychain.getGenericPassword({\n      service: KEYCHAIN_SERVICE,\n    });\n    return credentials ? credentials.password : null;\n  }\n\n  async function clearRefreshToken(): Promise<void> {\n    await Keychain.resetGenericPassword({ service: KEYCHAIN_SERVICE });\n  }",
           "file": "App.tsx",
           "lang": "tsx",
-          "lines": "102-120"
+          "lines": "107-125"
         },
         {
           "step": 5,
           "description": "Exchange the refresh token for a new access token; on failure clear local state and require re-login",
           "code": "  const refreshTokens = useCallback(async () => {\n    setError(null);\n    try {\n      const stored = tokens?.refreshToken ?? (await loadRefreshToken());\n      if (!stored) {\n        setError(\"No refresh token available. Sign in first.\");\n        return;\n      }\n      const result: RefreshResult = await refresh(authConfig, {\n        refreshToken: stored,\n      });\n      const next: Tokens = {\n        accessToken: result.accessToken,\n        accessTokenExpirationDate: result.accessTokenExpirationDate,\n        refreshToken: result.refreshToken ?? stored,\n        // Refresh responses don't always include a new id_token — keep the\n        // previous one so the welcome message stays populated.\n        idToken: result.idToken ?? tokens?.idToken ?? null,\n      };\n      setTokens(next);\n      if (next.refreshToken && next.refreshToken !== stored) {\n        await persistRefreshToken(next.refreshToken);\n      }\n    } catch (e) {\n      // Refresh tokens can be revoked or expire — clear local state and surface the error.\n      await clearRefreshToken();\n      setTokens(null);\n      setError(\n        e instanceof Error\n          ? `Refresh failed (${e.message}). Sign in again.`\n          : `Refresh failed. Sign in again.`,\n      );\n    }\n  }, [tokens]);",
           "file": "App.tsx",
           "lang": "tsx",
-          "lines": "123-158"
+          "lines": "128-163"
         }
       ],
       "framework": "react-native",