@account-kit/react-native-signer 4.1.8-alpha

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/EventEmitters.h

@@ -0,0 +1,17 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateEventEmitterH.js
+ */
+#pragma once
+
+#include <react/renderer/components/view/ViewEventEmitter.h>
+
+
+namespace facebook::react {
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/NativeTEKStamperSpecJSI-generated.cpp

@@ -0,0 +1,54 @@
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateModuleCpp.js
+ */
+
+#include "NativeTEKStamperSpecJSI.h"
+
+namespace facebook::react {
+
+static jsi::Value __hostFunction_NativeTEKStamperCxxSpecJSI_init(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  return static_cast<NativeTEKStamperCxxSpecJSI *>(&turboModule)->init(
+    rt
+  );
+}
+static jsi::Value __hostFunction_NativeTEKStamperCxxSpecJSI_clear(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  static_cast<NativeTEKStamperCxxSpecJSI *>(&turboModule)->clear(
+    rt
+  );
+  return jsi::Value::undefined();
+}
+static jsi::Value __hostFunction_NativeTEKStamperCxxSpecJSI_publicKey(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  auto result = static_cast<NativeTEKStamperCxxSpecJSI *>(&turboModule)->publicKey(
+    rt
+  );
+  return result ? jsi::Value(std::move(*result)) : jsi::Value::null();
+}
+static jsi::Value __hostFunction_NativeTEKStamperCxxSpecJSI_injectCredentialBundle(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  return static_cast<NativeTEKStamperCxxSpecJSI *>(&turboModule)->injectCredentialBundle(
+    rt,
+    count <= 0 ? throw jsi::JSError(rt, "Expected argument in position 0 to be passed") : args[0].asString(rt)
+  );
+}
+static jsi::Value __hostFunction_NativeTEKStamperCxxSpecJSI_stamp(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  return static_cast<NativeTEKStamperCxxSpecJSI *>(&turboModule)->stamp(
+    rt,
+    count <= 0 ? throw jsi::JSError(rt, "Expected argument in position 0 to be passed") : args[0].asString(rt)
+  );
+}
+
+NativeTEKStamperCxxSpecJSI::NativeTEKStamperCxxSpecJSI(std::shared_ptr<CallInvoker> jsInvoker)
+  : TurboModule("NativeTEKStamper", jsInvoker) {
+  methodMap_["init"] = MethodMetadata {0, __hostFunction_NativeTEKStamperCxxSpecJSI_init};
+  methodMap_["clear"] = MethodMetadata {0, __hostFunction_NativeTEKStamperCxxSpecJSI_clear};
+  methodMap_["publicKey"] = MethodMetadata {0, __hostFunction_NativeTEKStamperCxxSpecJSI_publicKey};
+  methodMap_["injectCredentialBundle"] = MethodMetadata {1, __hostFunction_NativeTEKStamperCxxSpecJSI_injectCredentialBundle};
+  methodMap_["stamp"] = MethodMetadata {1, __hostFunction_NativeTEKStamperCxxSpecJSI_stamp};
+}
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/NativeTEKStamperSpecJSI.h

@@ -0,0 +1,150 @@
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateModuleH.js
+ */
+
+#pragma once
+
+#include <ReactCommon/TurboModule.h>
+#include <react/bridging/Bridging.h>
+
+namespace facebook::react {
+
+
+  
+#pragma mark - NativeTEKStamperTStamp
+
+template <typename P0, typename P1>
+struct NativeTEKStamperTStamp {
+  P0 stampHeaderName;
+  P1 stampHeaderValue;
+  bool operator==(const NativeTEKStamperTStamp &other) const {
+    return stampHeaderName == other.stampHeaderName && stampHeaderValue == other.stampHeaderValue;
+  }
+};
+
+template <typename T>
+struct NativeTEKStamperTStampBridging {
+  static T types;
+
+  static T fromJs(
+      jsi::Runtime &rt,
+      const jsi::Object &value,
+      const std::shared_ptr<CallInvoker> &jsInvoker) {
+    T result{
+      bridging::fromJs<decltype(types.stampHeaderName)>(rt, value.getProperty(rt, "stampHeaderName"), jsInvoker),
+      bridging::fromJs<decltype(types.stampHeaderValue)>(rt, value.getProperty(rt, "stampHeaderValue"), jsInvoker)};
+    return result;
+  }
+
+#ifdef DEBUG
+  static jsi::String stampHeaderNameToJs(jsi::Runtime &rt, decltype(types.stampHeaderName) value) {
+    return bridging::toJs(rt, value);
+  }
+
+  static jsi::String stampHeaderValueToJs(jsi::Runtime &rt, decltype(types.stampHeaderValue) value) {
+    return bridging::toJs(rt, value);
+  }
+#endif
+
+  static jsi::Object toJs(
+      jsi::Runtime &rt,
+      const T &value,
+      const std::shared_ptr<CallInvoker> &jsInvoker) {
+    auto result = facebook::jsi::Object(rt);
+    result.setProperty(rt, "stampHeaderName", bridging::toJs(rt, value.stampHeaderName, jsInvoker));
+    result.setProperty(rt, "stampHeaderValue", bridging::toJs(rt, value.stampHeaderValue, jsInvoker));
+    return result;
+  }
+};
+
+class JSI_EXPORT NativeTEKStamperCxxSpecJSI : public TurboModule {
+protected:
+  NativeTEKStamperCxxSpecJSI(std::shared_ptr<CallInvoker> jsInvoker);
+
+public:
+  virtual jsi::Value init(jsi::Runtime &rt) = 0;
+  virtual void clear(jsi::Runtime &rt) = 0;
+  virtual std::optional<jsi::String> publicKey(jsi::Runtime &rt) = 0;
+  virtual jsi::Value injectCredentialBundle(jsi::Runtime &rt, jsi::String bundle) = 0;
+  virtual jsi::Value stamp(jsi::Runtime &rt, jsi::String payload) = 0;
+
+};
+
+template <typename T>
+class JSI_EXPORT NativeTEKStamperCxxSpec : public TurboModule {
+public:
+  jsi::Value get(jsi::Runtime &rt, const jsi::PropNameID &propName) override {
+    return delegate_.get(rt, propName);
+  }
+
+  static constexpr std::string_view kModuleName = "NativeTEKStamper";
+
+protected:
+  NativeTEKStamperCxxSpec(std::shared_ptr<CallInvoker> jsInvoker)
+    : TurboModule(std::string{NativeTEKStamperCxxSpec::kModuleName}, jsInvoker),
+      delegate_(reinterpret_cast<T*>(this), jsInvoker) {}
+
+
+private:
+  class Delegate : public NativeTEKStamperCxxSpecJSI {
+  public:
+    Delegate(T *instance, std::shared_ptr<CallInvoker> jsInvoker) :
+      NativeTEKStamperCxxSpecJSI(std::move(jsInvoker)), instance_(instance) {
+
+    }
+
+    jsi::Value init(jsi::Runtime &rt) override {
+      static_assert(
+          bridging::getParameterCount(&T::init) == 1,
+          "Expected init(...) to have 1 parameters");
+
+      return bridging::callFromJs<jsi::Value>(
+          rt, &T::init, jsInvoker_, instance_);
+    }
+    void clear(jsi::Runtime &rt) override {
+      static_assert(
+          bridging::getParameterCount(&T::clear) == 1,
+          "Expected clear(...) to have 1 parameters");
+
+      return bridging::callFromJs<void>(
+          rt, &T::clear, jsInvoker_, instance_);
+    }
+    std::optional<jsi::String> publicKey(jsi::Runtime &rt) override {
+      static_assert(
+          bridging::getParameterCount(&T::publicKey) == 1,
+          "Expected publicKey(...) to have 1 parameters");
+
+      return bridging::callFromJs<std::optional<jsi::String>>(
+          rt, &T::publicKey, jsInvoker_, instance_);
+    }
+    jsi::Value injectCredentialBundle(jsi::Runtime &rt, jsi::String bundle) override {
+      static_assert(
+          bridging::getParameterCount(&T::injectCredentialBundle) == 2,
+          "Expected injectCredentialBundle(...) to have 2 parameters");
+
+      return bridging::callFromJs<jsi::Value>(
+          rt, &T::injectCredentialBundle, jsInvoker_, instance_, std::move(bundle));
+    }
+    jsi::Value stamp(jsi::Runtime &rt, jsi::String payload) override {
+      static_assert(
+          bridging::getParameterCount(&T::stamp) == 2,
+          "Expected stamp(...) to have 2 parameters");
+
+      return bridging::callFromJs<jsi::Value>(
+          rt, &T::stamp, jsInvoker_, instance_, std::move(payload));
+    }
+
+  private:
+    friend class NativeTEKStamperCxxSpec;
+    T *instance_;
+  };
+
+  Delegate delegate_;
+};
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/Props.cpp

@@ -0,0 +1,19 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GeneratePropsCpp.js
+ */
+
+#include "Props.h"
+#include <react/renderer/core/PropsParserContext.h>
+#include <react/renderer/core/propsConversions.h>
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/Props.h

@@ -0,0 +1,18 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GeneratePropsH.js
+ */
+#pragma once
+
+
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/ShadowNodes.cpp

@@ -0,0 +1,17 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateShadowNodeCpp.js
+ */
+
+#include "ShadowNodes.h"
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/ShadowNodes.h

@@ -0,0 +1,23 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateShadowNodeH.js
+ */
+
+#pragma once
+
+#include "EventEmitters.h"
+#include "Props.h"
+#include "States.h"
+#include <react/renderer/components/view/ConcreteViewShadowNode.h>
+#include <jsi/jsi.h>
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/States.cpp

@@ -0,0 +1,16 @@
+
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateStateCpp.js
+ */
+#include "States.h"
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/generated/jni/react/renderer/components/NativeTEKStamperSpec/States.h

@@ -0,0 +1,19 @@
+/**
+ * This code was generated by [react-native-codegen](https://www.npmjs.com/package/react-native-codegen).
+ *
+ * Do not edit this file as changes may cause incorrect behavior and will be lost
+ * once the code is regenerated.
+ *
+ * @generated by codegen project: GenerateStateH.js
+ */
+#pragma once
+
+#ifdef ANDROID
+#include <folly/dynamic.h>
+#endif
+
+namespace facebook::react {
+
+
+
+} // namespace facebook::react

package/android/gradle.properties

@@ -0,0 +1,5 @@
+ReactNativeSigner_kotlinVersion=1.7.0
+ReactNativeSigner_minSdkVersion=21
+ReactNativeSigner_targetSdkVersion=31
+ReactNativeSigner_compileSdkVersion=31
+ReactNativeSigner_ndkversion=21.4.7075529

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,3 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.accountkit.reactnativesigner">
+</manifest>

package/android/src/main/java/com/accountkit/reactnativesigner/KeyExtensions.kt

@@ -0,0 +1,77 @@
+package com.accountkit.reactnativesigner
+
+import com.google.crypto.tink.CleartextKeysetHandle
+import com.google.crypto.tink.InsecureSecretKeyAccess
+import com.google.crypto.tink.KeysetHandle
+import com.google.crypto.tink.hybrid.HpkeParameters
+import com.google.crypto.tink.hybrid.HpkePrivateKey
+import com.google.crypto.tink.hybrid.HpkePublicKey
+import com.google.crypto.tink.subtle.EllipticCurves
+import com.google.crypto.tink.util.Bytes
+import com.google.crypto.tink.util.SecretBytes
+import java.security.interfaces.ECPublicKey
+import javax.xml.bind.DatatypeConverter
+import com.google.crypto.tink.proto.HpkePrivateKey as ProtoHpkePrivateKey
+import com.google.crypto.tink.proto.HpkePublicKey as ProtoHpkePublicKey
+
+// Keyset Handle Extensions
+fun KeysetHandle.toHpkePublicKey(hpkeParameters: HpkeParameters): HpkePublicKey {
+    val keySet = CleartextKeysetHandle.getKeyset(this.publicKeysetHandle)
+    val protoKey = ProtoHpkePublicKey.parseFrom(keySet.keyList[0].keyData.value)
+
+    return HpkePublicKey.create(
+        hpkeParameters,
+        Bytes.copyFrom(protoKey.publicKey.toByteArray()),
+        null
+    )
+}
+
+fun KeysetHandle.toHpkePrivateKey(hpkeParams: HpkeParameters): HpkePrivateKey {
+    val publicKey = this.toHpkePublicKey(hpkeParams)
+    val pkKs = CleartextKeysetHandle.getKeyset(this)
+    val pkKeyData = pkKs.keyList[0].keyData
+    check(pkKeyData.typeUrl == "type.googleapis.com/google.crypto.tink.HpkePrivateKey") {
+        "invalid key type"
+    }
+
+    return HpkePrivateKey.create(
+        HpkePublicKey.create(
+            hpkeParams,
+            Bytes.copyFrom(publicKey.toByteArray()),
+            null
+        ),
+        SecretBytes.copyFrom(
+            ProtoHpkePrivateKey.parseFrom(pkKeyData.value).privateKey.toByteArray(),
+            InsecureSecretKeyAccess.get()
+        )
+    )
+}
+
+// HPKE Public Key Extensions
+fun HpkePublicKey.toHex(): String {
+    return this.toByteArray().toHex()
+}
+
+fun HpkePublicKey.toByteArray(): ByteArray {
+    return this.publicKeyBytes.toByteArray()
+}
+
+// ECPublicKey Extensions
+fun ECPublicKey.toBytes(
+    pfType: EllipticCurves.PointFormatType
+): ByteArray {
+    return EllipticCurves.pointEncode(
+        this.params.curve,
+        pfType,
+        this.w
+    )
+}
+
+// Conversions from Hex <-> byte[]
+fun String.fromHex(): ByteArray {
+    return DatatypeConverter.parseHexBinary(this)
+}
+
+fun ByteArray.toHex(): String {
+    return DatatypeConverter.printHexBinary(this)
+}

package/android/src/main/java/com/accountkit/reactnativesigner/NativeTEKStamperModule.kt

@@ -0,0 +1,234 @@
+package com.accountkit.reactnativesigner
+
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.annotations.ReactModule
+import com.google.crypto.tink.config.TinkConfig
+import com.google.crypto.tink.subtle.Base64
+import com.google.crypto.tink.subtle.EllipticCurves
+import java.nio.ByteBuffer
+import java.security.KeyFactory
+import java.security.Security
+import java.security.Signature
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import org.bitcoinj.core.Base58
+import org.bouncycastle.jce.ECNamedCurveTable
+import org.bouncycastle.jce.provider.BouncyCastleProvider
+import org.bouncycastle.jce.spec.ECPublicKeySpec
+
+@Serializable
+data class ApiStamp(val publicKey: String, val scheme: String, val signature: String)
+
+private const val BUNDLE_PRIVATE_KEY = "BUNDLE_PRIVATE_KEY"
+private const val BUNDLE_PUBLIC_KEY = "BUNDLE_PUBLIC_KEY"
+
+@ReactModule(name = NativeTEKStamperModule.NAME)
+class NativeTEKStamperModule(reactContext: ReactApplicationContext) :
+    NativeTEKStamperSpec(reactContext) {
+
+    private val context = reactContext
+
+    // This is how the docs for EncryptedSharedPreferences recommend creating this setup
+    // NOTE: we can further customize the permissions around accessing this master key and the keys
+    // used to generate it by using the .setKeyGenParameterSpec() method on this builder
+    // this would allow us to further specify the access requirements to this key
+    //
+    // we should explore the best practices on how to do this once we reach a phase of further
+    // cleanup
+    private val masterKey =
+        MasterKey.Builder(context.applicationContext)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            // requires that the phone be unlocked
+            .setUserAuthenticationRequired(false)
+            .build()
+
+    /**
+     * We are using EncryptedSharedPreferences to store 2 pieces of data
+     * 1. the TEK keypair - this is the ephemeral key-pair that Turnkey will use to encrypt the
+     * bundle with
+     * 2. the decrypted private key for a session
+     *
+     * The reason we are not using the android key store for either of these things is because
+     * 1. For us to be able to import the private key in the bundle into the KeyStore, Turnkey has
+     * to return the key in a different format (AFAIK):
+     * https://developer.android.com/privacy-and-security/keystore#ImportingEncryptedKeys
+     * 2. If we store the TEK in the KeyStore, then we have to roll our own HPKE decrypt function as
+     * there's no off the shelf solution (that I could find) to do the HPKE decryption. Rolling our
+     * own decryption feels wrong given we are not experts on this and don't have a good way to
+     * verify our implementation (and I don't trust the ChatGPT output to be correct. Even if it is,
+     * there's no guarantee we can test all the edge cases since those are unknown unknowns)
+     *
+     * NOTE: this isn't too far off from how Turnkey recommends doing it in Swift
+     * https://github.com/tkhq/swift-sdk/blob/5817374a7cbd4c99b7ea90b170363dc2bf6c59b9/docs/email-auth.md#email-authentication
+     *
+     * The open question is if the storage of the decrypted private key is secure enough though
+     */
+    private val sharedPreferences =
+        EncryptedSharedPreferences.create(
+            context,
+            "tek_stamper_shared_prefs",
+            masterKey,
+            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+
+    private val tekManager = HpkeTEKManager(sharedPreferences)
+
+    init {
+        TinkConfig.register()
+
+        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME).javaClass !=
+            BouncyCastleProvider::class.java
+        ) {
+            Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME)
+        }
+
+        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
+            Security.addProvider(BouncyCastleProvider())
+        }
+    }
+
+    override fun getName(): String {
+        return NAME
+    }
+
+    override fun init(promise: Promise) {
+        try {
+            val tekPublicKey = tekManager.createTEK()
+
+            return promise.resolve(tekPublicKey.toHex())
+        } catch (e: Exception) {
+            promise.reject(e)
+        }
+    }
+
+    override fun clear() {
+        sharedPreferences.edit().clear().apply()
+    }
+
+    override fun publicKey(): String? {
+        return tekManager.publicKeyHex()
+    }
+
+    override fun injectCredentialBundle(bundle: String, promise: Promise) {
+        try {
+            val tekPublicKey =
+                tekManager.publicKey()
+                    ?: return promise.reject(Exception("Stamper has not been initialized"))
+
+            val decodedBundle = Base58.decodeChecked(bundle)
+            val buffer = ByteBuffer.wrap(decodedBundle)
+            val ephemeralPublicKeyLength = 33
+            val ephemeralPublicKeyBytes = ByteArray(ephemeralPublicKeyLength)
+            buffer.get(ephemeralPublicKeyBytes)
+            val ephemeralPublicKey =
+                EllipticCurves.getEcPublicKey(
+                    EllipticCurves.CurveType.NIST_P256,
+                    EllipticCurves.PointFormatType.COMPRESSED,
+                    ephemeralPublicKeyBytes,
+                )
+                    .toBytes(EllipticCurves.PointFormatType.UNCOMPRESSED)
+
+            val ciphertext = ByteArray(buffer.remaining())
+            buffer.get(ciphertext)
+
+            val aad = ephemeralPublicKey + tekPublicKey.toByteArray()
+
+            val decryptedKey =
+                tekManager.hpkeDecrypt(
+                    ephemeralPublicKey,
+                    ciphertext,
+                    "turnkey_hpke".toByteArray(),
+                    aad
+                )
+
+            val (publicKeyBytes, privateKeyBytes) = privateKeyToKeyPair(decryptedKey)
+
+            sharedPreferences
+                .edit()
+                .putString(BUNDLE_PRIVATE_KEY, privateKeyBytes.toHex().lowercase())
+                .apply()
+
+            sharedPreferences
+                .edit()
+                .putString(BUNDLE_PUBLIC_KEY, publicKeyBytes.toHex().lowercase())
+                .apply()
+
+            return promise.resolve(true)
+        } catch (e: Exception) {
+            promise.reject(e)
+        }
+    }
+
+    override fun stamp(payload: String, promise: Promise) {
+        try {
+            val signingKeyHex =
+                sharedPreferences.getString(BUNDLE_PRIVATE_KEY, null)
+                    ?: return promise.reject(
+                        Exception("No injected bundle, did you complete auth?")
+                    )
+
+            val publicSigningKeyHex =
+                sharedPreferences.getString(BUNDLE_PUBLIC_KEY, null)
+                    ?: return promise.reject(
+                        Exception("No injected bundle, did you complete auth?")
+                    )
+
+            val ecPrivateKey =
+                EllipticCurves.getEcPrivateKey(
+                    EllipticCurves.CurveType.NIST_P256,
+                    signingKeyHex.fromHex()
+                )
+
+            val signer = Signature.getInstance("SHA256withECDSA")
+            signer.initSign(ecPrivateKey)
+            signer.update(payload.toByteArray())
+            val signature = signer.sign()
+
+            val apiStamp =
+                ApiStamp(publicSigningKeyHex, "SIGNATURE_SCHEME_TK_API_P256", signature.toHex())
+
+            val stamp = Arguments.createMap()
+            stamp.putString("stampHeaderName", "X-Stamp")
+            stamp.putString(
+                "stampHeaderValue",
+                Base64.urlSafeEncode(Json.encodeToString(apiStamp).toByteArray())
+            )
+            return promise.resolve(stamp)
+        } catch (e: Exception) {
+            promise.reject(e)
+        }
+    }
+
+    private fun privateKeyToKeyPair(privateKey: ByteArray): Pair<ByteArray, ByteArray> {
+        val ecPrivateKey =
+            EllipticCurves.getEcPrivateKey(EllipticCurves.CurveType.NIST_P256, privateKey)
+
+        // compute the public key
+        val s = ecPrivateKey.s
+        val bcSpec = ECNamedCurveTable.getParameterSpec("secp256r1")
+        val pubSpec = ECPublicKeySpec(bcSpec.g.multiply(s).normalize(), bcSpec)
+        val keyFactory = KeyFactory.getInstance("EC", BouncyCastleProvider.PROVIDER_NAME)
+
+        val ecPublicKey = EllipticCurves.getEcPublicKey(keyFactory.generatePublic(pubSpec).encoded)
+
+        // verify the key pair
+        EllipticCurves.validatePublicKey(ecPublicKey, ecPrivateKey)
+
+        // compress it to match turnkey expectations
+        val compressedPublicKey =
+            ecPublicKey.toBytes(
+                EllipticCurves.PointFormatType.COMPRESSED,
+            )
+        return Pair(compressedPublicKey, privateKey)
+    }
+
+    companion object {
+        const val NAME = "NativeTEKStamper"
+    }
+}