fix(mas,ios): drop the network.server entitlement with Earth Engine sign-in (#1651)

* fix(mas,ios): drop the network.server entitlement with Earth Engine sign-in

App Review rejected GeoLibre Desktop 2.4.0 under guideline 2.4.5: the bundle
carried com.apple.security.network.server with no functionality the automated
analysis could match to it.

The entitlement was real, not stray. Earth Engine sign-in uses Google's OAuth
loopback-redirect flow, so earth_engine_oauth.rs binds 127.0.0.1:5173 and
accepts the browser's inbound redirect to receive the token. The bind happens
lazily inside a Tauri command, which is why nothing static pointed at it.

Rather than justify the entitlement in App Review Information, drop the feature
from both Apple targets: the module is gated
`#[cfg(not(any(feature = "mas", target_os = "ios")))]` and replaced by stub
commands that bind nothing, so neither the Mac App Store build nor the iOS app
ever opens a listening socket. This was the only inbound listener left in those
builds — wait_for_port_free (Jupyter) and spawn_martin_server were already
compiled out.

Every other target keeps Earth Engine unchanged: Developer ID macOS, Windows,
Linux, Android, and the web build (a browser uses Google's popup/redirect flow
and binds nothing, so Earth Engine still works in Safari on iOS).

- Remove com.apple.security.network.server from the MAS entitlements template.
- Fail mas-store.yml if it ever reappears in the signature.
- Hide the Processing menu item and command-palette entry behind
  isEarthEngineAvailable(); authenticateEarthEngine throws early if a restored
  panel state or an external plugin still reaches it.
- Document the rejection and the constraint in docs/mac-app-store.md.

* chore: bump the version to 2.4.1 for the App Store resubmission

App Store Connect rejects a re-upload at a version already submitted, and 2.4.0
was rejected under guideline 2.4.5 (see the previous commit). Bump every
version declaration that tracks the app release.

Workers stay at 0.0.0 (deliberately unversioned), and the historical 2.4.0
references in docs/ios.md, docs/mac-app-store.md, ios.yml, publish-embed.yml,
and mas-store.yml are left alone — they describe the rejected submission.

* chore: sync CITATION.cff with the 2.4.1 version bump

CI's "Validate CITATION.cff" job asserts the cff version matches
package.json, so the bump left it failing.

* Address Claude review feedback

- tests/earth-engine-availability.test.ts: correct the "plain Node" comment.
  It claimed both defaults resolve to false because there is no `navigator`,
  but Node exposes a global `navigator` (userAgent "Node.js/<major>"). The
  assertion was always right — that UA matches none of the Apple patterns, and
  maxTouchPoints is undefined so the `> 1` check is false — only the stated
  reasoning was wrong.

* Address Claude review feedback

- maplibre-geoagent.ts: gate the GeoAgent Earth Engine overlay behind
  isEarthEngineAvailable(). enhanceEarthEngineSignIn injected a "Sign in"
  button unconditionally, so on the Apple App Store builds it rendered and only
  failed on click via the defense-in-depth throw -- worse UX than the Processing
  menu, which hides its entry outright, and it contradicted
  docs/mac-app-store.md's claim that those builds remove the overlay. Hide the
  whole .geoagent-earth-engine section instead: every control in it (status
  line, OAuth client id, project id) is Earth Engine-specific and useless
  without sign-in.

* Address Claude review feedback

- Extract the iPadOS "desktop Macintosh UA" heuristic into
  @geolibre/core's new platform.ts and call it from both copies. is-mobile.ts
  and earth-engine-auth.ts each encoded `/Macintosh/.test(ua) && touch > 1`
  independently, so a future correction to an Apple behaviour could land in one
  and miss the other. Only that clause is shared -- the surrounding UA patterns
  legitimately differ (is-mobile includes Android, the Earth Engine check is
  Apple-only), so they stay separate.

* Address Claude review feedback

- Hoist the Earth Engine gate to a module-level EARTH_ENGINE_AVAILABLE
  constant in ProcessingMenu.tsx and import it in TopToolbar.tsx. TopToolbar
  called isEarthEngineAvailable() inside the commands array, which is rebuilt
  every render, while ProcessingMenu memoized it per instance. Both inputs (the
  build define and the user agent) are fixed for the session, so one
  module-level constant matches the IS_MAS_BUILD pattern and removes the
  inconsistency in both directions.
- mas-store.yml: annotate a codesign failure. Capturing its output meant a bad
  signature or path aborted the step with a bare shell error instead of an
  ::error:: message, unlike the two entitlement assertions below it.

Author: giswqs

.github/workflows/mas-store.yml

@@ -131,8 +131,20 @@ jobs:
           [[ -d "$app" ]] || { echo "::error::No app bundle at $app"; exit 1; }
           # Confirm the sandbox entitlement made it into the signature before
           # packaging; an unsandboxed binary is an automatic App Review reject.
-          codesign -d --entitlements - --xml "$app" | grep -q "com.apple.security.app-sandbox" \
+          entitlements="$(codesign -d --entitlements - --xml "$app")" \
+            || { echo "::error::codesign could not read entitlements from $app"; exit 1; }
+          grep -q "com.apple.security.app-sandbox" <<<"$entitlements" \
             || { echo "::error::App bundle is missing the app-sandbox entitlement"; exit 1; }
+          # App Review rejected 2.4.0 (guideline 2.4.5) for shipping
+          # network.server without matching functionality. The app now makes
+          # only outgoing connections — the Earth Engine OAuth loopback listener
+          # is compiled out of the `mas` build — so this entitlement must stay
+          # gone. If a future feature genuinely needs to accept an inbound
+          # connection, re-add it here AND justify it in App Review Information.
+          if grep -q "com.apple.security.network.server" <<<"$entitlements"; then
+            echo "::error::App bundle carries com.apple.security.network.server; App Review rejects it without an inbound-connection feature (see mas/Entitlements.mas.plist.template)"
+            exit 1
+          fi
           version="$(node -p "require('./apps/geolibre-desktop/src-tauri/tauri.conf.json').version")"
           pkg="GeoLibre.Desktop_${version}_universal_mas.pkg"
           xcrun productbuild --sign "$APPLE_MAS_INSTALLER_IDENTITY" \

CITATION.cff

@@ -9,8 +9,8 @@ authors:
     email: giswqs@gmail.com
     affiliation: "University of Tennessee, Knoxville, USA"
     orcid: "https://orcid.org/0000-0001-5437-4073"
-version: 2.4.0
-date-released: 2026-07-29
+version: 2.4.1
+date-released: 2026-08-02
 doi: "10.5281/zenodo.20785400"
 repository-code: "https://github.com/opengeos/GeoLibre"
 url: "https://geolibre.app"

apps/geolibre-desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "geolibre-desktop",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "private": true,
   "type": "module",
   "scripts": {

apps/geolibre-desktop/src-tauri/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "geolibre-desktop"
-version = "2.4.0"
+version = "2.4.1"
 description = "GeoLibre Desktop — lightweight cloud-native desktop GIS"
 authors = ["GeoLibre Contributors"]
 edition = "2021"

apps/geolibre-desktop/src-tauri/Cargo.toml

@@ -16,10 +16,18 @@
 
   - network.client: map tiles, basemap styles, remote GeoJSON/COG/PMTiles,
     collab websocket.
-  - network.server: the Earth Engine OAuth flow listens on a loopback port for
-    the redirect callback.
   - files.user-selected.read-write: open/save project files and datasets picked
     through the file dialogs.
+
+  There is deliberately NO network.server entitlement. The app makes only
+  outgoing connections. The one feature that listened for an inbound connection
+  was Earth Engine sign-in (Google's OAuth loopback-redirect flow binds
+  127.0.0.1 to receive the browser redirect); App Review rejected the 2.4.0
+  submission over it (guideline 2.4.5, submission 76036eca), so the `mas` build
+  compiles that flow out entirely and hides its UI. If you ever add a feature
+  that accepts an inbound connection, adding the entitlement back is not enough
+  — it has to be justified in App Review Information, and mas-store.yml's
+  "no server entitlement" check will fail until this comment is revisited.
 -->
 <plist version="1.0">
 <dict>
@@ -31,8 +39,6 @@
   <string>${APPLE_TEAM_ID}</string>
   <key>com.apple.security.network.client</key>
   <true/>
-  <key>com.apple.security.network.server</key>
-  <true/>
   <key>com.apple.security.files.user-selected.read-write</key>
   <true/>
 </dict>

apps/geolibre-desktop/src-tauri/mas/Entitlements.mas.plist.template

@@ -1,4 +1,32 @@
+// Earth Engine sign-in uses Google's OAuth loopback-redirect flow, which binds
+// a listener on 127.0.0.1 to accept the browser's redirect. Accepting an
+// inbound connection requires the `com.apple.security.network.server`
+// entitlement, which App Review rejects for an app that otherwise only makes
+// outgoing requests (guideline 2.4.5, submission 76036eca). Both Apple App
+// Store targets therefore compile the whole flow out and hide the Earth Engine
+// UI, so no Apple build ever binds a listening socket: the `mas` (macOS) build,
+// and iOS — which ships through the same review pipeline and has no way to
+// justify a listener either. Every other target (Developer ID macOS, Windows,
+// Linux, Android, web) keeps it. See docs/mac-app-store.md.
+#[cfg(not(any(feature = "mas", target_os = "ios")))]
 mod earth_engine_oauth;
+// App Store stub, mirroring the `native_duckdb` pattern below: the commands stay
+// in the handler list (so a stale panel state or an external plugin gets a clear
+// message instead of an "unknown command" error) but no socket is ever bound.
+#[cfg(any(feature = "mas", target_os = "ios"))]
+mod earth_engine_oauth {
+    const UNAVAILABLE: &str = "Earth Engine sign-in is not available in the App Store build of GeoLibre.";
+
+    #[tauri::command]
+    pub fn start_earth_engine_oauth(_client_id: String) -> Result<serde_json::Value, String> {
+        Err(UNAVAILABLE.to_string())
+    }
+
+    #[tauri::command]
+    pub fn poll_earth_engine_oauth(_state_id: String) -> Result<Option<serde_json::Value>, String> {
+        Err(UNAVAILABLE.to_string())
+    }
+}
 #[cfg(feature = "native-duckdb")]
 mod native_duckdb;
 #[cfg(not(feature = "native-duckdb"))]
@@ -28,9 +56,9 @@ mod native_duckdb {
 #[cfg(all(feature = "mas", feature = "native-duckdb"))]
 compile_error!("the `mas` (Mac App Store) build must not enable `native-duckdb`: DuckDB loads its spatial extension as unsigned native code at runtime, which App Sandbox and App Store guideline 2.5.2 forbid.");
 
-use earth_engine_oauth::{
-    poll_earth_engine_oauth, start_earth_engine_oauth, EarthEngineOAuthState,
-};
+use earth_engine_oauth::{poll_earth_engine_oauth, start_earth_engine_oauth};
+#[cfg(not(any(feature = "mas", target_os = "ios")))]
+use earth_engine_oauth::EarthEngineOAuthState;
 use flate2::read::{GzDecoder, ZlibDecoder};
 use rusqlite::{params, Connection, OpenFlags, OptionalExtension};
 use serde::{Deserialize, Serialize};
@@ -255,8 +283,13 @@ pub fn run() {
         .plugin(tauri_plugin_persisted_scope::init())
         .plugin(tauri_plugin_geolocation::init())
         .plugin(tauri_plugin_http::init())
-        .plugin(tauri_plugin_opener::init())
-        .manage(EarthEngineOAuthState::default());
+        .plugin(tauri_plugin_opener::init());
+
+    // The Earth Engine OAuth loopback listener is compiled out of the Apple App
+    // Store builds (see the module gate at the top of this file); the stub
+    // commands are stateless, so the state goes with it.
+    #[cfg(not(any(feature = "mas", target_os = "ios")))]
+    let builder = builder.manage(EarthEngineOAuthState::default());
 
     // The Martin/sidecar/Jupyter process managers exist only where the commands
     // that spawn those processes do; the MAS build compiles both out together.

apps/geolibre-desktop/src-tauri/src/lib.rs

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "GeoLibre Desktop",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "identifier": "org.geolibre.desktop",
   "build": {
     "beforeDevCommand": "npm run dev",

apps/geolibre-desktop/src-tauri/tauri.conf.json

@@ -131,7 +131,7 @@ import { HelpMenu } from "./toolbar/HelpMenu";
 import { OsmPbfDialogs } from "./toolbar/OsmPbfDialogs";
 import { PluginsMenu } from "./toolbar/PluginsMenu";
 import { PluginToolbarMenus } from "./toolbar/PluginToolbarMenus";
-import { ProcessingMenu } from "./toolbar/ProcessingMenu";
+import { EARTH_ENGINE_AVAILABLE, ProcessingMenu } from "./toolbar/ProcessingMenu";
 import { ProjectFileDialogs } from "./toolbar/ProjectFileDialogs";
 import { ProjectMenu } from "./toolbar/ProjectMenu";
 import { googleEarthUrl, googleMapsUrl } from "../../lib/external-map-links";
@@ -1201,12 +1201,21 @@ export function TopToolbar({
       group: t("toolbar.commandGroup.processing"),
       run: handleOpenPlanetaryComputer,
     },
-    {
-      id: "proc.earth-engine",
-      title: t("toolbar.command.earthEngine"),
-      group: t("toolbar.commandGroup.processing"),
-      run: panels.earthEngine.toggle,
-    },
+    // Earth Engine sign-in needs the Rust loopback OAuth listener, which the
+    // Apple App Store builds (Mac App Store and iOS) compile out so the app
+    // claims no `com.apple.security.network.server` entitlement. Shares the
+    // ProcessingMenu gate's module-level constant rather than recomputing it in
+    // this array, which is rebuilt on every render.
+    ...(EARTH_ENGINE_AVAILABLE
+      ? [
+          {
+            id: "proc.earth-engine",
+            title: t("toolbar.command.earthEngine"),
+            group: t("toolbar.commandGroup.processing"),
+            run: panels.earthEngine.toggle,
+          },
+        ]
+      : []),
     // Controls
     ...MAP_CONTROL_ITEMS.map((control) => ({
       id: `control.${control.id}`,

apps/geolibre-desktop/src/components/layout/TopToolbar.tsx

@@ -1,4 +1,5 @@
 import { type NetworkToolKind, useAppStore } from "@geolibre/core";
+import { isEarthEngineAvailable } from "@geolibre/plugins";
 import {
   Button,
   DropdownMenu,
@@ -22,6 +23,14 @@ import { isMenuItemVisible } from "../../../lib/ui-profile";
 import { WHITEBOX_MENU_CATALOG } from "../../../lib/whitebox-menu-catalog";
 import type { ToolbarChrome } from "./constants";
 
+// Earth Engine sign-in needs the Rust loopback OAuth listener, which the Apple
+// App Store builds (Mac App Store and iOS) compile out so the app claims no
+// `com.apple.security.network.server` entitlement — App Review rejected it
+// otherwise. Module scope, like IS_MAS_BUILD: the build flag and user agent it
+// reads are fixed for the session, so there is nothing to recompute per render.
+// TopToolbar's command-palette gate reads the same constant.
+export const EARTH_ENGINE_AVAILABLE = isEarthEngineAvailable();
+
 interface ProcessingMenuProps {
   chrome: ToolbarChrome;
   earthEnginePanel: ToolbarPanel;
@@ -72,6 +81,7 @@ export function ProcessingMenu({
   // the browser via WebAssembly, so unlike the sidecar-backed tools it stays
   // available on mobile.
   const showWhitebox = show("processing.whitebox");
+  const showEarthEngine = EARTH_ENGINE_AVAILABLE && show("processing.earthEngine");
 
   // Open the Whitebox toolbox dialog preselected to a specific tool, used by the
   // per-category submenus below. Two store writes: queue the tool, then open.
@@ -104,7 +114,7 @@ export function ProcessingMenu({
     show("processing.notebook") ||
     show("processing.dashboard") ||
     show("processing.planetaryComputer") ||
-    show("processing.earthEngine");
+    showEarthEngine;
 
   return (
     <DropdownMenu>
@@ -530,7 +540,7 @@ export function ProcessingMenu({
             {t("toolbar.command.planetaryComputer")}
           </DropdownMenuItem>
         )}
-        {show("processing.earthEngine") && (
+        {showEarthEngine && (
           <DropdownMenuItem onSelect={earthEnginePanel.toggle}>
             {t("toolbar.command.earthEngine")}
             {earthEnginePanel.visible ? " ✓" : ""}