fix(ios): ios local access limit for self-hosted workspace (#15338)

## Summary
- Route iOS nbstore worker token reads through the main-thread
MessagePort and skip Capacitor Auth on `/socket.io` polling so self-host
WebSocket/XHR sync no longer hangs on Connect timeout.
- Harden workspace `flavour:id` routing, DocSyncPeer abort/status
handling, and `resetSync` so local selfhost edits push and Mac browsers
can receive them.
- Soften root-doc readiness waits and session-exchange throttling to
keep mobile selfhost sign-in/sync stable under retries.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Improved workspace switching across local and remote environments,
preserving workspace type and server context.
  * Added support for page navigation with query parameters.
* Added iOS local-network permission messaging for self-hosted
workspaces.
* **Bug Fixes**
* Improved document synchronization, reset handling, prioritized
document refreshes, and retry behavior.
* Prevented authentication headers and refresh attempts for socket
connection requests.
* Improved workspace reopening and routing when multiple workspace types
share an ID.
  * Fixed handling of unlimited data query limits.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: DarkSky <darksky2048@gmail.com>

packages/frontend/apps/ios/App/App/Info.plist

@@ -39,6 +39,8 @@
 	<true/>
 	<key>NSCameraUsageDescription</key>
 	<string>AFFiNE requires access to the camera to capture images and insert them into your documents</string>
+	<key>NSLocalNetworkUsageDescription</key>
+	<string>AFFiNE needs local network access to connect to your self-hosted workspace on this device's Wi-Fi network.</string>
 	<key>NSPhotoLibraryUsageDescription</key>
 	<string>AFFiNE requires access to select photos from your photo library and insert them into your documents</string>
 	<key>NSUserTrackingUsageDescription</key>

packages/frontend/apps/ios/App/App/InfoPlist.xcstrings

@@ -37,6 +37,18 @@
         }
       }
     },
+    "NSLocalNetworkUsageDescription" : {
+      "comment" : "Privacy - Local Network Usage Description",
+      "extractionState" : "extracted_with_value",
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "AFFiNE needs local network access to connect to your self-hosted workspace on this device's Wi-Fi network."
+          }
+        }
+      }
+    },
     "NSPhotoLibraryUsageDescription" : {
       "comment" : "Privacy - Photo Library Usage Description",
       "extractionState" : "extracted_with_value",

packages/frontend/apps/ios/src/app.tsx

@@ -335,15 +335,31 @@ registerNativeImageFilesPicker(async () => {
 });
 
 // ------ some apis for native ------
-(window as any).getCurrentServerBaseUrl = () => {
+const getCurrentServerForNative = () => {
   const globalContextService = frameworkProvider.get(GlobalContextService);
-  const currentServerId = globalContextService.globalContext.serverId.get();
+  const globalContext = globalContextService.globalContext;
+  const currentServerId = globalContext.serverId.get();
+  const currentWorkspaceFlavour = globalContext.workspaceFlavour.get();
   const serversService = frameworkProvider.get(ServersService);
   const defaultServerService = frameworkProvider.get(DefaultServerService);
-  const currentServer =
+
+  if (currentWorkspaceFlavour && currentWorkspaceFlavour !== 'local') {
+    const workspaceServer = serversService.server$(
+      currentWorkspaceFlavour
+    ).value;
+    if (workspaceServer) {
+      return workspaceServer;
+    }
+  }
+
+  return (
     (currentServerId ? serversService.server$(currentServerId).value : null) ??
-    defaultServerService.server;
-  return currentServer.baseUrl;
+    defaultServerService.server
+  );
+};
+
+(window as any).getCurrentServerBaseUrl = () => {
+  return getCurrentServerForNative().baseUrl;
 };
 (window as any).getCurrentI18nLocale = () => {
   return I18n.language;
@@ -365,11 +381,15 @@ registerNativeImageFilesPicker(async () => {
 };
 (window as any).waitForSelectedSources = async (documentIds: string[]) => {
   const globalContextService = frameworkProvider.get(GlobalContextService);
-  const currentWorkspaceId =
-    globalContextService.globalContext.workspaceId.get();
+  const globalContext = globalContextService.globalContext;
+  const currentWorkspaceId = globalContext.workspaceId.get();
+  const currentWorkspaceFlavour = globalContext.workspaceFlavour.get();
   const workspacesService = frameworkProvider.get(WorkspacesService);
   const workspaceRef = currentWorkspaceId
-    ? workspacesService.openByWorkspaceId(currentWorkspaceId)
+    ? workspacesService.openByWorkspaceId(
+        currentWorkspaceId,
+        currentWorkspaceFlavour
+      )
     : null;
   if (!workspaceRef) {
     throw new Error('Current workspace is unavailable');
@@ -408,13 +428,7 @@ registerNativeImageFilesPicker(async () => {
   return true;
 };
 const getCurrentNativeSignInContext = () => {
-  const globalContextService = frameworkProvider.get(GlobalContextService);
-  const currentServerId = globalContextService.globalContext.serverId.get();
-  const serversService = frameworkProvider.get(ServersService);
-  const defaultServerService = frameworkProvider.get(DefaultServerService);
-  const currentServer =
-    (currentServerId ? serversService.server$(currentServerId).value : null) ??
-    defaultServerService.server;
+  const currentServer = getCurrentServerForNative();
   const authService = currentServer.scope.get(AuthService);
   return { authService, currentServer };
 };
@@ -531,12 +545,16 @@ const showNativeSignIn = async () => {
 };
 (window as any).getCurrentDocContentInMarkdown = async () => {
   const globalContextService = frameworkProvider.get(GlobalContextService);
-  const currentWorkspaceId =
-    globalContextService.globalContext.workspaceId.get();
-  const currentDocId = globalContextService.globalContext.docId.get();
+  const globalContext = globalContextService.globalContext;
+  const currentWorkspaceId = globalContext.workspaceId.get();
+  const currentWorkspaceFlavour = globalContext.workspaceFlavour.get();
+  const currentDocId = globalContext.docId.get();
   const workspacesService = frameworkProvider.get(WorkspacesService);
   const workspaceRef = currentWorkspaceId
-    ? workspacesService.openByWorkspaceId(currentWorkspaceId)
+    ? workspacesService.openByWorkspaceId(
+        currentWorkspaceId,
+        currentWorkspaceFlavour
+      )
     : null;
   if (!workspaceRef) {
     return;
@@ -589,11 +607,15 @@ const showNativeSignIn = async () => {
   title: string
 ) => {
   const globalContextService = frameworkProvider.get(GlobalContextService);
-  const currentWorkspaceId =
-    globalContextService.globalContext.workspaceId.get();
+  const globalContext = globalContextService.globalContext;
+  const currentWorkspaceId = globalContext.workspaceId.get();
+  const currentWorkspaceFlavour = globalContext.workspaceFlavour.get();
   const workspacesService = frameworkProvider.get(WorkspacesService);
   const workspaceRef = currentWorkspaceId
-    ? workspacesService.openByWorkspaceId(currentWorkspaceId)
+    ? workspacesService.openByWorkspaceId(
+        currentWorkspaceId,
+        currentWorkspaceFlavour
+      )
     : null;
 
   try {

packages/frontend/apps/mobile-shared/src/auth/auth.spec.ts

@@ -96,6 +96,30 @@ describe('shouldRefreshAccessToken', () => {
 });
 
 describe('auth request fetch', () => {
+  test.each([
+    ['/socket.io', true],
+    ['/socket.io/', true],
+    ['/socket.io/?EIO=4&transport=polling', true],
+    ['/socket.ioevil', false],
+  ])('handles the socket auth boundary for %s', async (path, skipped) => {
+    const provider = {
+      getValidAccessToken: vi.fn(async () => 'access-token'),
+      refreshAccessToken: vi.fn(async () => 'refreshed-token'),
+    };
+    const rawFetch = vi.fn<typeof fetch>(async request => {
+      expect((request as Request).headers.has('Authorization')).toBe(!skipped);
+      return new Response(JSON.stringify({ code: 'ACCESS_TOKEN_EXPIRED' }), {
+        status: 401,
+        headers: { 'content-type': 'application/json' },
+      });
+    });
+
+    await createAuthFetch(provider, rawFetch)(`https://example.com${path}`);
+
+    expect(provider.getValidAccessToken).toHaveBeenCalledTimes(skipped ? 0 : 1);
+    expect(provider.refreshAccessToken).toHaveBeenCalledTimes(skipped ? 0 : 1);
+  });
+
   test('injects the endpoint token', async () => {
     const provider = {
       getValidAccessToken: vi.fn(async () => 'access-token'),
@@ -164,6 +188,30 @@ describe('auth request fetch', () => {
 });
 
 describe('auth request XMLHttpRequest', () => {
+  test.each([
+    ['/socket.io', true],
+    ['/socket.io/', true],
+    ['/socket.io/?EIO=4&transport=polling', true],
+    ['/socket.ioevil', false],
+  ])('handles the socket auth boundary for %s', async (path, skipped) => {
+    const xhrCalls = stubXMLHttpRequest();
+    const provider = {
+      getValidAccessToken: vi.fn(async () => 'access-token'),
+      refreshAccessToken: vi.fn(async () => 'refreshed-token'),
+    };
+    installAuthRequestProxy(provider);
+    const xhr = new XMLHttpRequest();
+
+    xhr.open('GET', `https://example.com${path}`);
+    xhr.send();
+    await vi.waitFor(() => expect(xhrCalls.send).toHaveBeenCalledOnce());
+    xhrCalls.respond(401, JSON.stringify({ code: 'ACCESS_TOKEN_EXPIRED' }));
+    await Promise.resolve();
+
+    expect(provider.getValidAccessToken).toHaveBeenCalledTimes(skipped ? 0 : 1);
+    expect(provider.refreshAccessToken).toHaveBeenCalledTimes(skipped ? 0 : 1);
+  });
+
   test('does not send after abort while waiting for a token', async () => {
     let resolveToken: (token: string | null) => void = () => {};
     const token = new Promise<string | null>(resolve => {

packages/frontend/apps/mobile-shared/src/auth/request.ts

@@ -19,6 +19,30 @@ function authEndpointForUrl(url: string | URL) {
   }
 }
 
+function shouldSkipStoredAuthToken(url: string | URL) {
+  try {
+    const { pathname } = new URL(
+      url,
+      globalThis.location?.origin ?? 'http://localhost'
+    );
+    if (pathname === '/socket.io' || pathname.startsWith('/socket.io/')) {
+      return true;
+    }
+    return [
+      '/api/auth/captcha',
+      '/api/auth/magic-link',
+      '/api/auth/open-app/sign-in',
+      '/api/auth/preflight',
+      '/api/auth/session/exchange',
+      '/api/auth/sign-in',
+      '/api/oauth/callback',
+      '/api/oauth/preflight',
+    ].includes(pathname);
+  } catch {
+    return false;
+  }
+}
+
 export function createAuthFetch(
   provider: AuthRequestProvider,
   rawFetch: typeof globalThis.fetch
@@ -26,7 +50,8 @@ export function createAuthFetch(
   return async (input: RequestInfo | URL, init?: RequestInit) => {
     const request = new Request(input, init);
     const retry = request.clone();
-    const endpoint = authEndpointForUrl(request.url);
+    const skipStoredAuth = shouldSkipStoredAuthToken(request.url);
+    const endpoint = skipStoredAuth ? null : authEndpointForUrl(request.url);
     const token = endpoint
       ? await provider.getValidAccessToken(endpoint)
       : null;
@@ -70,6 +95,7 @@ export function installAuthRequestProxy(provider: AuthRequestProvider) {
     private requestBody?: Document | XMLHttpRequestBodyInit | null;
     private replaying = false;
     private hasReplayed = false;
+    private skipStoredAuth = false;
     private sendVersion = 0;
 
     constructor() {
@@ -87,6 +113,7 @@ export function installAuthRequestProxy(provider: AuthRequestProvider) {
             this.status !== 401 ||
             this.replaying ||
             this.hasReplayed ||
+            this.skipStoredAuth ||
             !this.request?.async
           ) {
             return;
@@ -123,6 +150,7 @@ export function installAuthRequestProxy(provider: AuthRequestProvider) {
       this.requestBody = undefined;
       this.replaying = false;
       this.hasReplayed = false;
+      this.skipStoredAuth = shouldSkipStoredAuthToken(url.toString());
       xhrRequestUrls.set(this, url.toString());
       return super.open(
         method,
@@ -141,9 +169,11 @@ export function installAuthRequestProxy(provider: AuthRequestProvider) {
     override send(body?: Document | XMLHttpRequestBodyInit | null): void {
       this.requestBody = body;
       const requestUrl = xhrRequestUrls.get(this);
-      const endpoint = authEndpointForUrl(
-        requestUrl ?? globalThis.location.href
-      );
+      const targetUrl = requestUrl ?? globalThis.location.href;
+      this.skipStoredAuth = shouldSkipStoredAuthToken(targetUrl);
+      const endpoint = this.skipStoredAuth
+        ? null
+        : authEndpointForUrl(targetUrl);
       const sendVersion = this.sendVersion;
 
       const sendWithToken = (token: string | null) => {
@@ -168,7 +198,7 @@ export function installAuthRequestProxy(provider: AuthRequestProvider) {
 
     private async replayWithFreshToken() {
       const request = this.request;
-      if (!request) return this.failReplay();
+      if (!request || this.skipStoredAuth) return this.failReplay();
       const endpoint = authEndpointForUrl(request.url);
       if (!endpoint) return this.failReplay();
       const sendVersion = this.sendVersion;