fix(iOS): use ASWebAuthenticationSession instead of WKWebView for login

WKWebView silently fails to complete cross-domain OIDC redirects (e.g.
when Nextcloud delegates authentication to an external IdP like Authentik).
The user authenticates successfully on the IdP side, but WKWebView drops
the callback redirect back to the Nextcloud origin, leaving the login
flow stuck in a polling loop that never resolves.

ASWebAuthenticationSession uses the system browser which properly handles
cross-domain redirects, passkeys, and deep links. Credentials continue
to be obtained via the existing polling mechanism.

macOS retains the WKWebView sheet since ASWebAuthenticationSession
behaves differently on that platform and cross-domain redirects are
less problematic there.

Ref: nextcloud/ios#3996 (same fix applied to the main iOS app)
Made-with: Cursor

Author: thomas

Sources/SwiftNextcloudUI/Features/AuthSessionCoordinator.swift

@@ -0,0 +1,28 @@
+// SPDX-FileCopyrightText: Nextcloud GmbH
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#if os(iOS)
+import AuthenticationServices
+import UIKit
+
+///
+/// Provides the presentation anchor for `ASWebAuthenticationSession` in SwiftUI contexts.
+///
+/// `ASWebAuthenticationSession` requires an `ASWebAuthenticationPresentationContextProviding`
+/// to determine which window to present the authentication UI in. This coordinator bridges
+/// the gap between SwiftUI (which doesn't expose `UIWindow` directly) and the UIKit-based API.
+///
+@MainActor
+class AuthSessionCoordinator: NSObject, ASWebAuthenticationPresentationContextProviding {
+    nonisolated func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+        return MainActor.assumeIsolated {
+            guard let windowScene = UIApplication.shared.connectedScenes.first(where: { $0.activationState == .foregroundActive }) as? UIWindowScene,
+                  let window = windowScene.windows.first(where: \.isKeyWindow)
+            else {
+                return ASPresentationAnchor()
+            }
+            return window
+        }
+    }
+}
+#endif

Sources/SwiftNextcloudUI/Views/ServerAddressView.swift

@@ -5,6 +5,10 @@
 import CodeScanner
 import SwiftUI
 
+#if os(iOS)
+import AuthenticationServices
+#endif
+
 ///
 /// A new remote user account should be added locally in the persistence of the app.
 ///
@@ -111,6 +115,10 @@ public struct ServerAddressView: View, QRCodeParsing, URLSanitizing {
     ///
     @State var pollingToken: String?
 
+    #if os(iOS)
+    @State private var authSessionCoordinator = AuthSessionCoordinator()
+    #endif
+
     // MARK: - Implementation
 
     public var body: some View {
@@ -216,7 +224,9 @@ public struct ServerAddressView: View, QRCodeParsing, URLSanitizing {
             .safeAreaPadding(.all)
         }
         .ignoresSafeArea()
+        #if os(macOS)
         .webSheet(initialURL: $loginAddress, isPresented: $isPresentingWebView, userAgent: userAgent, onDismiss: endWebView)
+        #endif
         .alert(String(localized: "Login Failed", comment: "Alert title"), isPresented: $isPresentingAlert) {
             Button(role: .cancel) {
                 errorMessage = nil
@@ -290,16 +300,48 @@ public struct ServerAddressView: View, QRCodeParsing, URLSanitizing {
 
     func beginWebView(_ url: URL) {
         self.loginAddress = url
+
+        #if os(iOS)
+        startAuthSession(url: url)
+        #else
         isPresentingWebView = true
+        #endif
     }
 
+    #if os(iOS)
+    ///
+    /// Start an `ASWebAuthenticationSession` to present the login page.
+    ///
+    /// This replaces the `WKWebView` sheet on iOS. `ASWebAuthenticationSession` uses the system
+    /// browser which properly handles cross-domain redirects (e.g. OIDC providers), passkeys, and
+    /// deep links — all of which fail silently in `WKWebView`.
+    ///
+    /// Credentials are still obtained via polling by the host app. The callback URL scheme (`nc://`)
+    /// is used by Nextcloud's Login Flow v2 to signal completion; receiving it cancels polling early.
+    ///
+    private func startAuthSession(url: URL) {
+        let session = ASWebAuthenticationSession(url: url, callbackURLScheme: "nc") { _, error in
+            if let error = error as? ASWebAuthenticationSessionError, error.code == .canceledLogin {
+                endWebView()
+                return
+            }
+            // Login completed (callback received or session ended).
+            // Credentials are picked up via the host app's polling mechanism.
+        }
+
+        session.presentationContextProvider = authSessionCoordinator
+        session.prefersEphemeralWebBrowserSession = true
+        session.start()
+    }
+    #endif
+
     ///
-    /// Dismisses the sheet with the web view.
+    /// Dismisses the login UI.
     ///
     /// Multiple paths can lead to here. In example:
     ///
-    /// - The user dismisses the sheet without logging in.
-    /// - The login completed successfully.
+    /// - The user dismisses the session without logging in.
+    /// - The login completed successfully (detected by polling).
     ///
     func endWebView() {
         if let pollingToken {