Use initializeAuth instead of getAuth for Firebase Auth in iOS; update web/lib/firebase/users.ts to avoid gapi iframe issue on capacitor://localhost. Increment iOS project version to 7.

Author: MartinBraquet

ios/App/App.xcodeproj/project.pbxproj

@@ -357,7 +357,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 6;
+				CURRENT_PROJECT_VERSION = 7;
 				INFOPLIST_FILE = App/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks";
@@ -378,7 +378,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 6;
+				CURRENT_PROJECT_VERSION = 7;
 				INFOPLIST_FILE = App/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks";

ios/CLAUDE.md

@@ -27,6 +27,15 @@ is in the [root CLAUDE.md](../CLAUDE.md).
   `WebViewLocalServer` already resolves `.html` itself. If you add a dynamic route, no change is
   needed — the router finds the bracketed file by scanning the directory.
 
+- **Firebase Auth must be created with `initializeAuth`, not `getAuth`, inside the native shells.**
+  `getAuth` installs the default popup/redirect resolver, which loads `apis.google.com/js/api.js` and
+  builds a gapi iframe at startup. gapi cannot parse a non-http origin, so on `capacitor://localhost`
+  it throws `evaluating 'gapi.iframes.getContext'` and auth never initialises — `onIdTokenChanged`
+  never fires, `useUser()` stays `undefined`, and `pages/index.tsx` shows its loading animation
+  forever with no visible error. See `web/lib/firebase/users.ts`. Android is unaffected only because
+  Capacitor serves it from `https://localhost`; iOS cannot copy that, since the `capacitor://` scheme
+  is what makes the origin secure for `getUserMedia` and `crypto.subtle`.
+
 - **The iOS web build runs on macOS, so `scripts/build_web_view.sh` must stay BSD-tool-safe.** It
   strips `getStaticProps`/`getStaticPaths` from the pages in `SSG_PAGES` so dynamic routes export as
   plain `[username].html` / `blog/[slug].html` templates. That rename used GNU sed's `\b`, which BSD
@@ -61,6 +70,12 @@ is in the [root CLAUDE.md](../CLAUDE.md).
   `isNativeApp()` in `web/lib/util/webview.ts`. `isNativeApp()` is the default — the product is meant
   to look the same on both.
 
+## Debugging the WebView from Linux
+
+`ios/scripts/webview-eval.mjs` evaluates JS in the phone's WebView over `ios_webkit_debug_proxy`,
+without a browser — the fastest way to answer "what is the app actually seeing". Needs a build made
+with `IOS_WEB_DEBUG=1`; a stock Release build is never inspectable. See [README.md](README.md) §5.
+
 ## Editing the Xcode project without Xcode
 
 `project.pbxproj`, `Info.plist` and `*.entitlements` are all text and are fine to edit directly.

ios/README.md

@@ -202,10 +202,21 @@ For the JS console, DOM and network — which is most of what matters in a WebVi
 Settings → Safari → Advanced → Web Inspector on the phone, then:
 
 ```bash
-ios_webkit_debug_proxy -f chrome-devtools://devtools/bundled/inspector.html
-# open http://localhost:9221 and attach DevTools to the WKWebView
+ios_webkit_debug_proxy                       # then, in another terminal:
+node ios/scripts/webview-eval.mjs "location.href"
+node ios/scripts/webview-eval.mjs "Object.keys(Capacitor.Plugins).join(',')"
 ```
 
+`webview-eval.mjs` runs JavaScript in the WebView straight from the shell, which on Linux is far less
+trouble than the DevTools UI: the documented route is a `chrome-devtools://` URL, and current Chrome
+refuses to open that scheme from a link *or* the omnibox (it searches Google for it instead), while
+Firefox cannot open it at all. The script header documents the two protocol quirks it works around —
+commands must be wrapped in `Target.sendMessageToTarget`, and `awaitPromise` is unsupported, so use
+synchronous `XMLHttpRequest` or stash a result on `window` and read it back.
+
+If you do want the full UI: open `http://localhost:9222` in **Chrome**, right-click the
+`capacitor://localhost` entry, Copy Link Address, and paste it into the address bar.
+
 **A TestFlight build is not inspectable by default.** Capacitor sets `webView.isInspectable` only
 under `#if DEBUG`, and TestFlight ships Release — so the device advertises no inspectable page and the
 proxy's listing (`http://localhost:9222`) comes back empty, which reads as a broken proxy rather than a

web/lib/firebase/users.ts

@@ -15,6 +15,8 @@ import {
   connectAuthEmulator,
   getAuth,
   GoogleAuthProvider,
+  indexedDBLocalPersistence,
+  initializeAuth,
   OAuthProvider,
   reauthenticateWithCredential,
   reauthenticateWithPopup,
@@ -32,7 +34,25 @@ dayjs.extend(utc)
 
 export type {User}
 
-export const auth = getAuth(app)
+/**
+ * `getAuth()` installs Firebase's default popup/redirect resolver, which loads
+ * `apis.google.com/js/api.js` and builds a gapi iframe as soon as auth initialises. gapi cannot parse
+ * a non-http origin, so inside the iOS shell — served from `capacitor://localhost` — it throws
+ * `undefined is not an object (evaluating 'gapi.iframes.getContext')` and takes auth initialisation
+ * down with it. `onIdTokenChanged` then never fires, `useUser()` stays `undefined` forever, and
+ * `pages/index.tsx` renders its loading animation for good. Nothing logs a failure the app can see.
+ *
+ * `initializeAuth` with no `popupRedirectResolver` skips that machinery entirely. The native shells
+ * never need it: Google and Apple sign-in both go through `@capgo/capacitor-social-login` and
+ * `signInWithCredential`. The browser keeps `getAuth`, where `signInWithPopup` is the whole point.
+ *
+ * Android happens to work either way — Capacitor serves it from `https://localhost`, which gapi
+ * accepts. iOS cannot copy that: the scheme has to stay `capacitor://` for `getUserMedia` (voice
+ * auto-fill) and `crypto.subtle` (the Sign-in-with-Apple nonce) to see a secure context.
+ */
+export const auth = isNativeApp()
+  ? initializeAuth(app, {persistence: indexedDBLocalPersistence})
+  : getAuth(app)
 
 if (IS_FIREBASE_EMULATOR) {
   connectAuthEmulator(auth, 'http://127.0.0.1:9099', {disableWarnings: true})