feat(paywalls): add web_view JavaScript bridge (PWENG-98)

[alexrepty]

Checklist

• If applicable, unit tests
• If applicable, create follow-up issues for purchases-ios and hybrids

Motivation

Provides the live JS↔native bridge that powers web_view bidirectional messaging, built on the message model and variables provider.

Part of PWENG-98.

Description

• Adds WebViewJavaScriptBridge: installs a document-start window.RevenueCatWebView shim, validates and dispatches inbound messages (origin-checked, on the main thread), and delivers native→web messages via window.__revenueCatReceiveMessage.
• Outgoing messages use the { "type", "component_id", "variables" } envelope (payload nested under variables), matching the other RevenueCat SDK platforms. On rc:request-variables the SDK auto-replies with its system variables, then invokes the app handler.
• Internal; exercised by unit tests in isolation. Wiring into the rendered paywall lands in the final PR.
• Tested by WebViewJavaScriptBridgeTest.

iOS parity: mirrors purchases-ios (web-view-bridge-wiring), including the { type, component_id, variables } envelope.
Stack (merge bottom-up): schema → rendering → CSP → value types → message model → variables provider → JS bridge → wiring.

---

Note

High Risk
Introduces a JavaScript interface on WebView with origin validation and CSP; mistakes could affect paywall security or hosted web flows, though the change includes explicit origin checks and extensive tests.

Overview
Adds bidirectional JS↔native messaging for Paywalls V2 web_view, aligned with workflow-web-components-sdk (rc-web-components channel, connect/init handshake, message/request/response frames) via window.rcWebComponents and __rcWebComponentsReceive—replacing a flat postMessage shape and document-start shim.

WebViewJavaScriptBridge handles handshake, origin checks, payload limits, auto-reply to rc:request-variables, fit/resize for fit sizing, and lifecycle on the main thread. WebViewMessageParser and WebViewEnvelope parse the new wire format; schema gains optional fallback stack.

WebViewComponentView installs the bridge when componentId is set, detects main-frame load failures (HTTP ≥400), renders the fallback stack, and adjusts layout from content-reported CSS size. Style factory passes componentId and fallback into WebViewComponentStyle; ComponentView forwards click/interaction callbacks to the web view path.

Coverage: WebViewJavaScriptBridgeTest and updated WebViewMessageParserTest.

^{Reviewed by Cursor Bugbot for commit 8063d3f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alexrepty]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(paywalls): wire web_view messaging into the paywall (PWENG-98) #3653
• feat(paywalls): add web_view JavaScript bridge (PWENG-98) #3655 👈 (View in Graphite)
• feat(paywalls): add web_view SDK variables provider (PWENG-98) #3663
• feat(paywalls): add web_view message model and parsing (PWENG-98) #3654
• feat(paywalls): add web_view message value types (PWENG-98) #3662
• feat(paywalls): isolate web_view content with a fixed CSP (PWENG-98) #3652
• feat(paywalls): render web_view component (PWENG-98) #3651
• feat(paywalls): add web_view component schema (PWENG-98) #3650
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Case-sensitive origin host matching

Medium Severity

toOriginOrNull builds an origin string with the host exactly as java.net.URL returns it, and isCurrentOriginExpected compares that to an origin parsed from webView.url using plain string equality. Hostnames are case-insensitive per URL rules, and Android’s WebView often lowercases the host in getUrl() after load. A paywall URL whose template keeps mixed-case ASCII in the host can make every inbound and outbound bridge message look like a cross-origin mismatch and be dropped.

Additional Locations (1)

• ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewJavaScriptBridge.kt#L185-L188

 

^{Reviewed by Cursor Bugbot for commit 26368d7. Configure here.}

[emerge-tools]

📸 Snapshot Test

593 unchanged

Name	Added	Removed	Modified	Renamed	Unchanged	Errored	Approval
TestPurchasesUIAndroidCompatibility Paparazzi com.revenuecat.testpurchasesuiandroidcompatibility.paparazzi	0	0	0	0	258	0	N/A
TestPurchasesUIAndroidCompatibility com.revenuecat.testpurchasesuiandroidcompatibility	0	0	0	0	335	0	N/A

---

🛸 Powered by Emerge Tools

[RevenueCat-Danger-Bot]

	1 Error
🚫	This PR changes 686 lines of production Kotlin/Java code, over the 300-line limit. Split it into smaller PRs, or add the skip-pr-lines-changed-check label to bypass.

Generated by 🚫 Danger

[AlvaroBrey]

@BugBot run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8063d3f. Configure here.}

[cursor]

postMessage payload omits variables key

Medium Severity

PaywallWebViewController.postMessage documents that app data is sent under a variables field, but the bridge sets the transport payload to the flat map from variables.toJsonObject(). Web content expecting payload.variables will not see app-provided fields for custom message types.

 

^{Reviewed by Cursor Bugbot for commit 8063d3f. Configure here.}

[cursor]

Main-frame errors always trigger fallback

Medium Severity

New WebViewClient error handlers set loadFailed on any main-frame onReceivedError or HTTP status ≥ 400, with no check for benign codes like ERROR_CANCELLED. Once loadFailed is true and a schema fallback exists, the web view is replaced permanently even if the page actually loaded.

 

^{Reviewed by Cursor Bugbot for commit 8063d3f. Configure here.}