feat: session cookies

Author: cfbender

README.md

@@ -14,7 +14,8 @@ API, SQLite storage, local file uploads, and an optional Capacitor mobile shell.
 
 - Own your data: production data lives in a local SQLite database under `/data`.
 - Import cards quickly: collection imports accept text and CSV/TXT files,
-  including files shared directly into the native Android and iOS shells.
+  including Android shares/open-with files and iOS shares sent into the native
+  shells.
 - Treat decks as physical commitments: deck cards can be allocated to concrete
   collection items so one copy cannot accidentally be promised to multiple decks.
 - Turn gaps into action: missing-card reports and buylist exports show what a
@@ -101,9 +102,10 @@ and native API work. The native shell starts from bundled setup assets in
 `native_www`, asks for the ManaVault server URL on first launch, stores that URL
 on the device, checks the latest GitHub release for APK updates, and then loads
 the configured server inside the native WebView.
-The native shells also register as text/CSV share targets; on Android, pick
-ManaVault from the sharesheet/export flow to open shared text or CSV/TXT files
-in the collection import flow.
+The native shells register as text/CSV share targets. On Android, ManaVault also
+accepts `content://` or `file://` open-with file intents; pick ManaVault with
+the Import action label beneath the app name from the Share, Open with, or
+Export file flow to send TXT/CSV exports into collection import with auto-preview.
 
 Use `aube` for JavaScript package tasks:
 

android/app/src/main/AndroidManifest.xml

@@ -38,7 +38,7 @@
                 <data android:scheme="manavault" />
             </intent-filter>
 
-            <intent-filter>
+            <intent-filter android:label="@string/intent_action_import">
                 <action android:name="android.intent.action.SEND" />
                 <category android:name="android.intent.category.DEFAULT" />
                 <data android:mimeType="text/plain" />
@@ -49,7 +49,7 @@
                 <data android:mimeType="application/vnd.ms-excel" />
             </intent-filter>
 
-            <intent-filter>
+            <intent-filter android:label="@string/intent_action_import">
                 <action android:name="android.intent.action.SEND_MULTIPLE" />
                 <category android:name="android.intent.category.DEFAULT" />
                 <data android:mimeType="text/plain" />
@@ -60,6 +60,19 @@
                 <data android:mimeType="application/vnd.ms-excel" />
             </intent-filter>
 
+            <intent-filter android:label="@string/intent_action_import">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:scheme="content" />
+                <data android:scheme="file" />
+                <data android:mimeType="text/plain" />
+                <data android:mimeType="text/*" />
+                <data android:mimeType="text/csv" />
+                <data android:mimeType="text/comma-separated-values" />
+                <data android:mimeType="application/csv" />
+                <data android:mimeType="application/vnd.ms-excel" />
+            </intent-filter>
+
         </activity>
 
         <provider

android/app/src/main/java/dev/cfb/manavault/SharedImportPlugin.java

@@ -19,6 +19,7 @@
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Locale;
 
 @CapacitorPlugin(name = "SharedImport")
 public class SharedImportPlugin extends Plugin {
@@ -79,8 +80,7 @@ private JSObject payloadFromIntent(Context context, Intent intent) {
 
         String action = intent.getAction();
         if (Intent.ACTION_VIEW.equals(action)) {
-            Uri data = intent.getData();
-            return isManaVaultLink(context, data) ? linkPayload(data.toString(), "android-view") : null;
+            return payloadFromViewIntent(context, intent);
         }
 
         if (!Intent.ACTION_SEND.equals(action) && !Intent.ACTION_SEND_MULTIPLE.equals(action)) return null;
@@ -111,6 +111,75 @@ private JSObject payloadFromIntent(Context context, Intent intent) {
         return importPayload(text, "Shared list.txt", intent.getType(), "android-share");
     }
 
+    private JSObject payloadFromViewIntent(Context context, Intent intent) {
+        Uri data = intent.getData();
+        if (isManaVaultLink(context, data)) return linkPayload(data.toString(), "android-view");
+        if (!isViewFileUri(data)) return null;
+
+        ContentResolver resolver = context.getContentResolver();
+        String intentType = normalizeMimeType(intent.getType());
+        String resolverType = normalizeMimeType(resolverMimeType(resolver, data));
+        boolean supportedType = isSupportedTextFileMimeType(intentType) || isSupportedTextFileMimeType(resolverType);
+
+        String fileName = null;
+        if (!supportedType && !hasTextFileExtension(data.getLastPathSegment())) {
+            fileName = displayName(resolver, data);
+            supportedType = hasTextFileExtension(fileName);
+        }
+        if (!supportedType) return null;
+
+        String text = readText(resolver, data);
+        if (text == null || text.trim().isEmpty()) return null;
+
+        if (fileName == null) fileName = displayName(resolver, data);
+        return importPayload(text, fileName, bestMimeType(intentType, resolverType), "android-view-file");
+    }
+
+    private boolean isViewFileUri(Uri uri) {
+        if (uri == null) return false;
+
+        String scheme = uri.getScheme();
+        return "content".equalsIgnoreCase(scheme) || "file".equalsIgnoreCase(scheme);
+    }
+
+    private String resolverMimeType(ContentResolver resolver, Uri uri) {
+        try {
+            return resolver.getType(uri);
+        } catch (SecurityException e) {
+            return null;
+        }
+    }
+
+    private String normalizeMimeType(String mimeType) {
+        if (mimeType == null) return null;
+
+        String normalized = mimeType.trim().toLowerCase(Locale.ROOT);
+        int parameters = normalized.indexOf(';');
+        return parameters >= 0 ? normalized.substring(0, parameters).trim() : normalized;
+    }
+
+    private boolean isSupportedTextFileMimeType(String mimeType) {
+        if (mimeType == null || mimeType.trim().isEmpty()) return false;
+
+        return mimeType.startsWith("text/")
+                || "application/csv".equals(mimeType)
+                || "application/vnd.ms-excel".equals(mimeType);
+    }
+
+    private boolean hasTextFileExtension(String value) {
+        if (value == null) return false;
+
+        String lower = value.trim().toLowerCase(Locale.ROOT);
+        return lower.endsWith(".txt") || lower.endsWith(".csv");
+    }
+
+    private String bestMimeType(String intentType, String resolverType) {
+        if (isSupportedTextFileMimeType(intentType)) return intentType;
+        if (isSupportedTextFileMimeType(resolverType)) return resolverType;
+        if (intentType != null && !intentType.trim().isEmpty()) return intentType;
+        return resolverType;
+    }
+
     @SuppressWarnings("deprecation")
     private Uri firstStreamUri(Intent intent) {
         Object stream = intent.getParcelableExtra(Intent.EXTRA_STREAM);

android/app/src/main/res/values/strings.xml

@@ -2,6 +2,7 @@
 <resources>
     <string name="app_name">ManaVault</string>
     <string name="title_activity_main">ManaVault</string>
+    <string name="intent_action_import">Import</string>
     <string name="package_name">dev.cfb.manavault</string>
     <string name="custom_url_scheme">dev.cfb.manavault</string>
 </resources>

docs/android.md

@@ -1,8 +1,8 @@
 # Android App Builds
 
 ManaVault publishes an Android APK from GitHub releases. That official APK is
-signed with the ManaVault release key, accepts Android shares of text/CSV files,
-and can load any ManaVault server URL after first launch.
+signed with the ManaVault release key, accepts Android text/CSV shares and
+open-with file intents, and can load any ManaVault server URL after first launch.
 
 Verified Android App Links are navigation intents: Android only opens
 `https://...` links in an app when the APK declares that exact host and the
@@ -14,29 +14,31 @@ website publishes the APK signing certificate fingerprint at
 Use the release APK from ManaVault GitHub releases when you only need:
 
 - entering your self-hosted ManaVault URL in the app on first launch
-- Android sharesheet/export imports from apps like ManaBox
+- Android Share/Open with/Export file imports from apps like ManaBox
 - `manavault://...` links
 - verified links for `https://manavault.cfb.dev/...`
 
 No custom Android build is needed for that flow.
 
 ## Import From ManaBox
 
-In ManaBox, export or share the collection as CSV, custom text, or a TXT/CSV
-file through Android's sharesheet, then choose the ManaVault native app.
-ManaVault receives that native share and opens the collection import dialog with
-the shared text or file contents.
+In ManaBox, export the collection as CSV, custom text, or a TXT/CSV file, then
+use Android's Share, Open with, or Export file flow and choose ManaVault with
+the Import action label beneath the app name.
+ManaVault accepts text/CSV Android shares and `content://` or `file://`
+open-with file intents, then opens the collection import dialog with the shared
+text or file contents and previews the import.
 
-Do not use a ManaVault HTTPS page opened inside ManaBox's embedded browser for
-import. A page loaded in another app's WebView is not an Android
-`ACTION_SEND`, `ACTION_SEND_MULTIPLE`, or `ACTION_VIEW` intent delivered to
-ManaVault, so ManaVault cannot force native ingest from that path.
+If ManaBox opens a ManaVault HTTPS page inside its own embedded browser, back
+out and choose the Android resolver/share target instead. That WebView path is
+not an `ACTION_SEND`, `ACTION_SEND_MULTIPLE`, or `ACTION_VIEW` intent delivered
+to ManaVault, so ManaVault cannot ingest the export from there.
 
 `manavault://collection?importFile=true`,
 `manavault:///collection?importFile=true`, verified App Links, and hosted or
 self-hosted `https://...` ManaVault URLs are navigation links. They can open the
-app route, but they do not carry a ManaBox export file; use the sharesheet or
-export-file path for imports.
+app route, but they do not carry a ManaBox export file; use the Android
+Share/Open with/Export file path for imports.
 
 ## Build An APK For A Custom Domain
 

lib/manavault_web/endpoint.ex

@@ -4,11 +4,13 @@ defmodule ManavaultWeb.Endpoint do
   # The session will be stored in the cookie and signed,
   # this means its contents can be read but not tampered with.
   # Set :encryption_salt if you would also like to encrypt it.
+  @session_max_age_seconds 60 * 60 * 24 * 180
   @session_options [
     store: :cookie,
     key: "_manavault_key",
     signing_salt: "HGc1xdq0",
-    same_site: "Lax"
+    same_site: "Lax",
+    max_age: @session_max_age_seconds
   ]
 
   @fresh_asset_cache_control "no-cache, no-store, must-revalidate"

test/manavault_web/controllers/auth_controller_test.exs

@@ -92,6 +92,15 @@ defmodule ManavaultWeb.AuthControllerTest do
     assert html_response(conn, 200) =~ ~s(id="manavault-root")
   end
 
+  test "login sets a persistent session cookie", %{conn: conn} do
+    configure_password("secret")
+
+    conn = post(conn, "/login", %{"password" => "secret", "return_to" => "/collection"})
+
+    assert [cookie] = get_resp_header(conn, "set-cookie")
+    assert cookie =~ "max-age=15552000"
+  end
+
   test "login rejects an incorrect password", %{conn: conn} do
     configure_password("secret")