Iframe e WebView

curl --request POST 'https://api.omni-ward.com/v1/sessions' \
  --header "Authorization: Bearer $OMNI_WARD_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
    "workflowId": "9a2c…",
    "allowedOrigins": ["https://app.exemplo.com"],
    "redirectUrl": "https://app.exemplo.com/verificacao/fim"
  }'

<iframe
  id="omni-ward"
  src="https://verify.omni-ward.com/v/…"
  allow="camera; microphone; fullscreen"
  title="Verificação de identidade"
  style="border: 0; width: 100%; max-width: 480px; height: 760px"
></iframe>

const verifyOrigin = new URL(sessionUrl).origin; // https://verify.omni-ward.com
const frame = document.getElementById('omni-ward');
let finished = false;

window.addEventListener('message', (e) => {
  if (e.origin !== verifyOrigin || e.source !== frame.contentWindow) return;
  if (e.data?.source !== 'omni-ward') return;

  switch (e.data.type) {
    case 'verification.started':
      mostrarProgresso();
      break;
    case 'verification.step_changed':
      atualizarProgresso(e.data.step); // ex.: "selfie_capture"
      break;
    case 'verification.completed':
    case 'verification.failed':
    case 'verification.cancelled':
    case 'verification.expired':
      if (finished) return; // pode chegar mais de uma vez
      finished = true;
      frame.remove();
      buscarResultadoNoBackend(); // decida pelo back-end, não pelo evento
      break;
  }
});

{ "source": "omni-ward", "type": "verification.step_changed", "step": "selfie_capture" }

import WebKit

final class VerificationViewController: UIViewController, WKScriptMessageHandler, WKUIDelegate, WKNavigationDelegate {
  private let url: URL           // session.url, vinda do seu back-end
  private var webView: WKWebView!
  private var finished = false

  init(url: URL) { self.url = url; super.init(nibName: nil, bundle: nil) }
  required init?(coder: NSCoder) { fatalError() }

  override func viewDidLoad() {
    super.viewDidLoad()
    let config = WKWebViewConfiguration()
    config.allowsInlineMediaPlayback = true                 // câmera dentro da página, não em tela cheia
    config.mediaTypesRequiringUserActionForPlayback = []
    config.userContentController.add(self, name: "omniWard") // canal dos eventos
    webView = WKWebView(frame: view.bounds, configuration: config)
    webView.uiDelegate = self
    webView.navigationDelegate = self
    view.addSubview(webView)
    webView.load(URLRequest(url: url))
  }

  // Libera a câmera só para a página da verificação (iOS 15+).
  func webView(_ webView: WKWebView, requestMediaCapturePermissionFor origin: WKSecurityOrigin,
               initiatedByFrame frame: WKFrameInfo, type: WKMediaCaptureType,
               decisionHandler: @escaping (WKPermissionDecision) -> Void) {
    decisionHandler(origin.host == url.host ? .grant : .deny)
  }

  func userContentController(_ controller: WKUserContentController, didReceive message: WKScriptMessage) {
    guard message.frameInfo.securityOrigin.host == url.host,
          let json = (message.body as? String)?.data(using: .utf8),
          let event = try? JSONSerialization.jsonObject(with: json) as? [String: Any],
          event["source"] as? String == "omni-ward",
          let type = event["type"] as? String else { return }
    let terminal = ["verification.completed", "verification.failed", "verification.cancelled", "verification.expired"]
    if terminal.contains(type) && !finished {
      finished = true
      dismiss(animated: true) // e busque o resultado no seu back-end
    }
  }
}

class VerificationActivity : AppCompatActivity() {
  private val terminal = setOf("verification.completed", "verification.failed", "verification.cancelled", "verification.expired")
  private var finished = false

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    val url = intent.getStringExtra("url")!!   // session.url, vinda do seu back-end
    val verifyHost = Uri.parse(url).host
    val webView = WebView(this)
    setContentView(webView)

    webView.settings.apply {
      javaScriptEnabled = true
      domStorageEnabled = true                 // a página guarda o progresso no armazenamento local
      mediaPlaybackRequiresUserGesture = false
    }
    // Libera a câmera só para a página da verificação.
    webView.webChromeClient = object : WebChromeClient() {
      override fun onPermissionRequest(request: PermissionRequest) {
        if (request.origin.host == verifyHost) request.grant(request.resources) else request.deny()
      }
    }
    // Canal dos eventos. Confira o host: a interface fica visível para qualquer página carregada.
    webView.addJavascriptInterface(object {
      @JavascriptInterface
      fun postMessage(json: String) = runOnUiThread {
        if (Uri.parse(webView.url ?: "").host != verifyHost) return@runOnUiThread
        val event = JSONObject(json)
        if (event.optString("source") != "omni-ward") return@runOnUiThread
        if (event.optString("type") in terminal && !finished) {
          finished = true
          finish() // e busque o resultado no seu back-end
        }
      }
    }, "OmniWardAndroid")
    webView.loadUrl(url)
  }
}

<WebView
  source={{ uri: sessionUrl }}
  javaScriptEnabled
  domStorageEnabled
  allowsInlineMediaPlayback
  mediaPlaybackRequiresUserAction={false}
  mediaCapturePermissionGrantType="grantIfSameHostElsePrompt"
  onMessage={(e) => {
    if (new URL(e.nativeEvent.url).origin !== new URL(sessionUrl).origin) return;
    const event = JSON.parse(e.nativeEvent.data);
    if (event.source !== 'omni-ward') return;
    // mesmos tipos de evento da tabela acima
  }}
/>