Merge pull request #12 from vladimir-kotikov/cordova-lib-refactoring
Cordova-lib refactoring proposal
diff --git a/proposals/CLI-Templates.md b/proposals/CLI-Templates.md
new file mode 100644
index 0000000..7f4e102
--- /dev/null
+++ b/proposals/CLI-Templates.md
@@ -0,0 +1,26 @@
+## Cordova CLI Create with Template argument
+
+
+
+This proposal is to update the Cordova CLI to support the argument --template for create command
+
+ $cordova create myApp --template=<NPM ID | GIT URL | Local Path>
+
+- NPM ID is a npm package name with optional version
+- GIT ULR is a git url, similar format as adding platforms and plugins via Git
+- Local Path, is a local directory
+
+- This will allow to specify the IBM NPM Cordova Template like $cordova create myApp --template=cordova-template-mfp or $cordova create myApp --template=cordova-template-mfp@1.0.0
+
+--template is different from --copy-from, it copies everything from the template including hooks, res, config.xml, hooks, dot files (.gitignore) except plugins and platforms, templates should not have this folder but if they do they get ignored and not copy
+if the template is missing certain files or directories it get's default ones here is the list:
+config.xml a default one is created from cordoba-app-hello-world
+hooks, the default hooks with readme is created
+www/, is missing the default is created from cordoba-app-hello-world
+
+### References:
+- [JIRA CB-9964](https://issues.apache.org/jira/browse/CB-9964)
+- [Discussion](https://github.com/cordova/cordova-discuss/issues/5)
+- [Lib PR] (https://github.com/apache/cordova-lib/pull/339)
+- [CLI PR] (https://github.com/apache/cordova-cli/pull/226)
+
diff --git a/proposals/Face2Face-Oct15.md b/proposals/Face2Face-Oct15.md
new file mode 100644
index 0000000..c4f4c5a
--- /dev/null
+++ b/proposals/Face2Face-Oct15.md
@@ -0,0 +1,124 @@
+# Cordova Face To Face Meeting
+
+ | |
+--- | --- | ---
+Date | 14 & 15 October, 2015
+Location | Building 33, 16070 NE 36th Way, Redmond, WA, USA 98052 (Room Name - Rainier)
+Streaming | Working on a link
+
+
+## Agenda
+
+### Day 1: October 14, 2015
+
+Time | Agenda
+-----|-------
+08:00 - 10:00 | Optional Breakfast and Networking
+10:30 - 11:00 | Introductions, State of the Union (@Shaz)
+11:00 - 12:00 | Cordova Round Table (discuss broadly applicable topics like roadmap, processes, etc)
+12:00 - 1:00 | Lunch
+ 1:00 - 4:00 | Smaller workgroups - to discuss specific topcs
+ 4:00 - 5:00 | Getting back together, discuss results from breakouts
+5:00 | End time (and head to bar for beer)
+
+### Day2: October 15, 2015
+
+Time | Agenda
+-----|-------
+ 9:00 - 10:00 | Breakfast
+10:00 - 12:00 | Cordova Ecosystem Show and tell - presentations on how Cordova is used in tools or projects.
+12:00 - 1:00 | Lunch
+ 1:00 - 4:00 | Smaller workgroups - to discuss specific topcs
+ 4:00 - 5:00 | Getting back together, discuss results from breakouts
+ 5:00 | End of sessions, recap
+
+
+## Day One Topics
+
+### Cordova Community Processes & Engineering System
+
+Topic | Attendee
+------|---------
+Cordova Security Process and Procedures - (Discussion on timelines, mostly for PMC/Committers) | Joe, Carlos
+JIRA triage - Who's responsible & accountable - Stategies for dealing with Bug/Quality debt | Nikhil
+Cordova Workflow for Contributors (How do I debug a platform/plugin issue?) | Joe, Carlos
+
+
+### Plugin Ecosystem
+
+Topic | Attendee
+------|---------
+How to influence quality improvements for Cordova plugins? |
+Cocoapods as dependencies in plugin.xml same way as gradle | Carlos
+Versioning Hell (TACO Kits?) - Which plugin works with which platform? How should I upgrade my Cordova project? | Nikhil & Carlos
+CPR end of life discussion | Steve
+
+
+### CI & Testing (1 hour)
+
+Topic | Attendee
+------|----------
+Current state of CI and testing | Everyone, right?
+Why aren't we looking at the CI? | Everyone, yes.
+Future steps for our CI Software | Everyone.
+Future steps for our CI Hardware | Everyone.
+Future steps for testing | Everyone, definitely.
+
+
+## Day Two Topics
+
+Start with Demos
+
+(lunch)
+
+
+### Downstream Tooling ideas
+
+Topic | Attendee
+------|---------
+Tension between innovation vs. being part of an ecosystem |
+What belongs in Cordova and what should be left to downstream tools? |
+What do integrators need from Cordova? |
+PlatformApi refactoring |
+Standardized logging and error/progress reporting |
+Plugin dependencies Installation | Omar Mefire
+
+### Documenation (1 hour)
+Docs/Communication (Where do we need to focus first?) | Nikhil
+
+### Hybrid Apps & Native Development
+
+Topic | Attendee
+------|---------
+What can we learn from the React Native plugin API? NativeScript API? | Parashu
+What is needed to allow customizing native (Xcode/Gradle/...) projects when using the CLI? | Martin
+Can we share tools or plugins with React Native? | Parashu & Martin
+Allow per-platform ids? | Martin
+
+### Others
+
+Topic | Attendee
+------|---------
+Supporting multiple web views (e.g. for native navigation + web content scenarios) |
+2 Modes, Production vs. Dev to support ES6, Typescript, www-dist | Carlos
+A new inAppBrowser for iOS based on SafariViewController | Carlos
+Cordova Desktop Browser - Electron JS + Emulation/Ripple | Carlos
+3rd Party npm dependencies & checked into Cordova git (legal, screaning, maintaining) | Carlos
+
+
+### More
+
+- How can we improve the development experience?
+ - What can we learn from the React Native developer experience?
+ - Replacing 'white screen of death' with an error reporting screen
+ - Adding a development/debugger menu
+ - How can we make platform installation easier?
+ - Improve requirements checking and error messages
+ - Install SDKs with one command (TACO)
+- Platform-specific topics
+ - (windows) why is windows icon list so limited? should it be possible to specify more?
+ - (windows) Any options for HTML5 debugging for Windows 10 devices?
+ - (windows) security related to windows preview apps - how to allow dyanmic content to access plugin APIs?
+ - (web-os) web-os setup broken, document and discuss)
+ - (iOS) wkwebview - recap of current approach, is it iOS 9 only?
+ - (android) annoyance/issue - appending of architecture digit problem?
diff --git a/proposals/ImprovedDocumentation.md b/proposals/ImprovedDocumentation.md
index 436dc5c..78a87a7 100644
--- a/proposals/ImprovedDocumentation.md
+++ b/proposals/ImprovedDocumentation.md
@@ -6,10 +6,12 @@
Here are topcis for new articles that we can add. If you already know of an article that points to the topic, please add it next to the topic
-- Upgrading you project from older versions of Cordova CLI
-- Managing plugins using npm and plugman - [current page](http://cordova.apache.org/docs/en/edge/plugin_ref_plugman.md.html#Using%20Plugman%20to%20Manage%20Plugins)
-- How to test Cordova applications
-- Documentation around `--save` command for plugins and platforms
-- More info on `<plugin>` tag replacing `<feature>`. Also how `<plugin>` tag autofetches on prepare
-- Whitelisting Guide
-- Non CLI workflows (more npm/grunt/gulp friendly ones)
+- [ ] Upgrading you project from older versions of Cordova CLI
+- [ ] Managing plugins using npm and plugman - [current page](http://cordova.apache.org/docs/en/edge/plugin_ref_plugman.md.html#Using%20Plugman%20to%20Manage%20Plugins)
+- [ ] How to test Cordova applications
+- [x] Documentation around `--save` command for plugins and platforms [Here](http://cordova.apache.org/docs/en/5.1.1/platform_plugin_versioning_ref_index.md.html#Platforms%20and%20Plugins%20Version%20Management)
+- [x] More info on `<plugin>` tag replacing `<feature>`. Also how `<plugin>` tag autofetches on prepare
+[Here](http://cordova.apache.org/docs/en/5.1.1/platform_plugin_versioning_ref_index.md.html#Platforms%20and%20Plugins%20Version%20Management)
+- [ ] Whitelisting Guide
+- [ ] Non CLI workflows (more npm/grunt/gulp friendly ones)
+- [ ] Update & simplify cordova-cli README.md
diff --git a/proposals/ThirdPartyPackageManagers.md b/proposals/ThirdPartyPackageManagers.md
new file mode 100644
index 0000000..a4df071
--- /dev/null
+++ b/proposals/ThirdPartyPackageManagers.md
@@ -0,0 +1,33 @@
+# Third-party Package Manager Support For Plugins
+
+Corresponding mailing list discussion [is here](http://markmail.org/message/5qvg6rwr4nz4q7mc).
+
+JIRA issue tracking this [is here](https://issues.apache.org/jira/browse/CB-9825)
+
+This is not a platform specific issue, at least for cordova-ios, and
+is the domain of the cordova-lib/cli currently. The
+cordova-lib re-factor might change this however.
+
+Proposed support is through the existing `<engine>` and `<framework>` tags.
+
+## Example usage
+
+```
+<engines>
+ <engine name="cocoapods" version=">=0.39.0" platform="ios" />
+ <engine name="nuget" version=">=3.2" platform="windows" />
+</engines>
+
+<framework src="path/to/mypod.podspec" type="podspec" />
+<framework src="path/to/mynu.nuspec" type="nuspec" />
+```
+
+The above use [existing documented attributes](https://cordova.apache.org/docs/en/5.1.1/plugin_ref/spec.html) for both the `<engine>` and `<framework>` tags.
+
+## Engine tag
+
+The `name` attribute would specify the command-line package manager to be used, for example "cocoapods" or "nuget". The `version` attribute should correspond to the version of the package manager supported -- the package manager itself should support sending its version to `stdout`. In this case, the `platform` attribute supported is implicit (since cocoapods is only supported in OS X and nuget in Windows), so the attribute is superfluous.
+
+## Framework Tag
+
+The `src` attribute can be a relative path or a URL. The `type` attribute specifies the type of framework that corresponds to the `engine` supported. In this case type `podspec` means that the lib should be installed using the `cocoapods` package manager, and `nuspec` for the `nuget` package manager.
diff --git a/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-current.png b/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-current.png
new file mode 100644
index 0000000..df0954d
--- /dev/null
+++ b/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-current.png
Binary files differ
diff --git a/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-proposed.png b/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-proposed.png
new file mode 100644
index 0000000..cab0cec
--- /dev/null
+++ b/proposals/images/ios-whitelist-removal/cordova-ios-4-whitelist-proposed.png
Binary files differ
diff --git a/proposals/ios-whitelist-removal.md b/proposals/ios-whitelist-removal.md
new file mode 100644
index 0000000..dc344d5
--- /dev/null
+++ b/proposals/ios-whitelist-removal.md
@@ -0,0 +1,37 @@
+# Proposal to Remove the Cordova iOS Native Whitelist
+
+This proposal is to advocate for the removal of the usage of the cordova-plugin-whitelist plugin in cordova-ios-4.x.
+
+In the diagrams, CSP refers to [Content-Security Policy](https://developer.mozilla.org/en-US/docs/Web/Security/CSP) and ATS refers to [App Transport Security](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW33).
+These two components are built-in to iOS, and are not part of Apache Cordova.
+
+The native whitelist component pictured is Apache Cordova's [cordova-plugin-whitelist](https://github.com/apache/cordova-plugin-whitelist) which is new for cordova-ios-4x.
+
+## Current Whitelist System
+
+
+
+All connections in the WebView *must* be whitelisted in the `CSP` *and* also be whitelisted in native through the `<access>` tag in `config.xml`. In the last released version of the `cordova-cli`, all `<access>` tags are automatically converted to `ATS` directives in the app's `Info.plist` file.
+
+There is a deficiency in `cordova-plugin-whitelist` in that `WKWebView` connections are not whitelisted while on iOS 8 (because WKWebView connections cannot be intercepted using NSURLProtocol). On iOS 9, `WKWebView` connections are whitelisted and intercepted by ATS.
+
+There is one difference in whitelisting through `ATS` and cordova-plugin-whitelist: a wildcard `*` in `cordova-plugin-whitelist` means all connections are accepted, while in `ATS` it means the same except that you can also restrict certain domains to connect through https or a certain TLS version, for example.
+
+The way `cordova-plugin-whitelist` works is by [implementing a protocol](https://github.com/apache/cordova-ios/blob/master/CordovaLib/Classes/Public/CDVURLRequestFilter.h) -- in the platform *all* plugins are then iterated through, and checked whether they implement a protocol method, and [each plugin is asked](https://github.com/apache/cordova-ios/blob/0ec2949d9b37495da6504867bfb371bd868242f0/CordovaLib/Classes/Public/CDVViewController.m#L518) whether a request is to be allowed. This means that any plugin that implements the protocol method can *veto* a request.
+
+It seems that this code was added to provide a generic way to allow whitelist as a plugin -- the utility of these protocol methods for other uses are not apparent.
+
+## Proposed Whitelist System
+
+
+
+The proposed whitelist system here requires us to remove:
+
+1. The [iteration of plugins](https://github.com/apache/cordova-ios/blob/0ec2949d9b37495da6504867bfb371bd868242f0/CordovaLib/Classes/Public/CDVViewController.m#L518) to see if they conform to the [protocol methods](https://github.com/apache/cordova-ios/blob/master/CordovaLib/Classes/Public/CDVURLRequestFilter.h)
+2. Usage of the [cordova-plugin-whitelist](https://github.com/apache/cordova-plugin-whitelist) itself
+
+This simplifies things in that we rely solely on iOS to handle security functionality -- Apple is a far better expert than us to handle these things.
+
+Developers still have to specify `<access>` tags to whitelist domains when they are whitelisted to in the `CSP` however, but this only applies to `iOS 9` and above. `<access>` tags are converted to `ATS` directives in the app's `Info.plist` by the `cordova-cli` and this functionality is only applicable for `iOS 9` and above. For `iOS 8` and below, the `<access>` tags have no effect. Thus, the adoption of this proposal basically removes all whitelist functionality for iOS versions 8 and below.
+
+An automatic `CSP to <access> tag` parser was proposed (through `cordova-lib` ios parser) -- this could work but at an expense of backwards-compatibility.
\ No newline at end of file
