@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.2 → 1.0.0-canary.21

package/ios/AutofillCredentialProvider/PasskeyKeystoreMMKV.mm

@@ -0,0 +1,86 @@
+#import "PasskeyKeystoreMMKV.h"
+
+#import <MMKVCore/MMKV.h>
+
+@implementation PasskeyKeystoreMMKV
+
++ (nullable mmkv::MMKV *)keystoreForAppGroup:(NSString *)appGroup
+                                       error:(NSError * _Nullable * _Nullable)error {
+  NSURL *containerURL = [[NSFileManager defaultManager]
+    containerURLForSecurityApplicationGroupIdentifier:appGroup];
+  if (containerURL == nil) {
+    if (error != nil) {
+      *error = [NSError errorWithDomain:@"ReactNativePasskeyAutofill"
+                                   code:2
+                               userInfo:@{
+                                 NSLocalizedDescriptionKey:
+                                   [NSString stringWithFormat:@"App Group is not accessible: %@", appGroup]
+                               }];
+    }
+    return nil;
+  }
+
+  std::string rootPath([containerURL.path UTF8String]);
+  mmkv::MMKV::initializeMMKV(rootPath);
+  return mmkv::MMKV::mmkvWithID("keystore", mmkv::MMKV_MULTI_PROCESS, nullptr, &rootPath);
+}
+
++ (BOOL)setString:(NSString *)value
+           forKey:(NSString *)key
+         appGroup:(NSString *)appGroup
+            error:(NSError * _Nullable * _Nullable)error {
+  mmkv::MMKV *keystore = [self keystoreForAppGroup:appGroup error:error];
+  if (keystore == nullptr) {
+    return NO;
+  }
+
+  std::string cppValue([value UTF8String]);
+  std::string cppKey([key UTF8String]);
+  return keystore->set(cppValue, cppKey);
+}
+
++ (nullable NSString *)stringForKey:(NSString *)key
+                           appGroup:(NSString *)appGroup
+                              error:(NSError * _Nullable * _Nullable)error {
+  mmkv::MMKV *keystore = [self keystoreForAppGroup:appGroup error:error];
+  if (keystore == nullptr) {
+    return nil;
+  }
+
+  std::string result;
+  std::string cppKey([key UTF8String]);
+  if (!keystore->getString(cppKey, result)) {
+    return nil;
+  }
+  return [NSString stringWithUTF8String:result.c_str()];
+}
+
++ (NSArray<NSString *> *)allKeysForAppGroup:(NSString *)appGroup
+                                      error:(NSError * _Nullable * _Nullable)error {
+  mmkv::MMKV *keystore = [self keystoreForAppGroup:appGroup error:error];
+  if (keystore == nullptr) {
+    return @[];
+  }
+
+  std::vector<std::string> keys = keystore->allKeys();
+  NSMutableArray<NSString *> *result = [NSMutableArray arrayWithCapacity:keys.size()];
+  for (const auto &key : keys) {
+    [result addObject:[NSString stringWithUTF8String:key.c_str()]];
+  }
+  return result;
+}
+
++ (BOOL)removeValueForKey:(NSString *)key
+                 appGroup:(NSString *)appGroup
+                    error:(NSError * _Nullable * _Nullable)error {
+  mmkv::MMKV *keystore = [self keystoreForAppGroup:appGroup error:error];
+  if (keystore == nullptr) {
+    return NO;
+  }
+
+  std::string cppKey([key UTF8String]);
+  keystore->removeValueForKey(cppKey);
+  return YES;
+}
+
+@end

package/ios/AutofillCredentialProvider/Prf.swift

@@ -0,0 +1,89 @@
+import CryptoKit
+import Foundation
+
+/// WebAuthn PRF (`prf`) extension helpers, backed by the authenticator
+/// `hmac-secret` mechanism (CTAP2.1).
+///
+/// Per the WebAuthn spec, for each input salt the authenticator computes:
+///
+///     output = HMAC-SHA256(credRandom, SHA256("WebAuthn PRF" || 0x00 || salt))
+///
+/// where `credRandom` is a 32-byte per-credential secret. To avoid a storage
+/// migration we derive `credRandom` deterministically from the wallet's HD
+/// root secret and the credential's (rpId, userHandle) — the same inputs that
+/// already produce the deterministic P-256 signing key. As a result, restoring
+/// the wallet seed on another device produces the same PRF outputs.
+enum Prf {
+  /// Domain separator used to derive `credRandom` from the HD root secret.
+  /// Kept under a distinct label from the P-256 key derivation to ensure
+  /// the credRandom value can never collide with private-key material.
+  static let credRandomInfo = "WebAuthn-PRF-credRandom"
+
+  /// WebAuthn-defined prefix for PRF salt hashing.
+  /// See: https://www.w3.org/TR/webauthn-3/#prf-extension
+  static let saltPrefix: [UInt8] = Array("WebAuthn PRF".utf8) + [0x00]
+
+  /// Derive a 32-byte per-credential PRF secret (`credRandom`) from the wallet
+  /// HD root secret. Deterministic over `(hdRootSecret, rpId, userHandle)`.
+  static func credRandom(
+    hdRootSecret: Data,
+    relyingPartyIdentifier: String,
+    userHandle: String
+  ) -> Data {
+    var salt = Data()
+    salt.append(contentsOf: relyingPartyIdentifier.lowercased().utf8)
+    salt.append(0x00)
+    salt.append(contentsOf: userHandle.lowercased().utf8)
+
+    let info = Data(credRandomInfo.utf8)
+    let key = SymmetricKey(data: hdRootSecret)
+    let derived = HKDF<SHA256>.deriveKey(
+      inputKeyMaterial: key,
+      salt: salt,
+      info: info,
+      outputByteCount: 32
+    )
+    return derived.withUnsafeBytes { Data($0) }
+  }
+
+  /// Evaluate the PRF for a single salt. Returns 32 bytes of output material.
+  ///
+  /// Per the WebAuthn spec the PRF input the authenticator sees is the
+  /// hash `SHA-256("WebAuthn PRF" || 0x00 || rpSalt)`. The platform layer
+  /// (Apple AuthenticationServices on iOS, the system credential manager on
+  /// Android with `prfAlreadyHashed`) performs this hashing before passing
+  /// the salt down to credential providers. Pass `alreadyHashed = true` in
+  /// that case so we don't hash twice.
+  static func evaluate(credRandom: Data, salt: Data, alreadyHashed: Bool = true) -> Data {
+    let macInput: Data
+    if alreadyHashed {
+      macInput = salt
+    } else {
+      var hashInput = Data(saltPrefix)
+      hashInput.append(salt)
+      macInput = Data(SHA256.hash(data: hashInput))
+    }
+    let mac = HMAC<SHA256>.authenticationCode(
+      for: macInput,
+      using: SymmetricKey(data: credRandom)
+    )
+    return Data(mac)
+  }
+}
+
+/// Parsed PRF extension input as supplied by the relying party.
+///
+/// At the WebAuthn layer the RP can either supply a single global pair of
+/// salts (`eval`) or a per-credential map (`evalByCredential`). We always
+/// reduce that down to at most two salts for the credential we are about to
+/// assert with, matching the platform behaviour on iOS 18 and Android.
+struct PrfInput {
+  let first: Data
+  let second: Data?
+}
+
+/// Computed PRF outputs ready to attach to a WebAuthn response.
+struct PrfOutput {
+  let first: Data
+  let second: Data?
+}

package/ios/AutofillCredentialProvider/WebAuthn.swift

@@ -0,0 +1,186 @@
+import CryptoKit
+import Foundation
+
+enum WebAuthnError: LocalizedError {
+  case invalidP256PublicKeyLength(Int)
+
+  var errorDescription: String? {
+    switch self {
+    case .invalidP256PublicKeyLength(let length):
+      return "Invalid P-256 public key length: \(length)."
+    }
+  }
+}
+
+enum WebAuthn {
+  private static let aaguidInfoDictionaryKey = "ReactNativePasskeyAutofillAAGUID"
+  private static let defaultAaguid = UUID(uuidString: "1F59713A-C021-4E63-9158-2CC5FDC14E52")!
+
+  // Injected by the Expo config plugin (`aaguid` prop) via the extension Info.plist so all
+  // platforms can present the same authenticator identity; falls back to the module default.
+  static let aaguid: UUID = {
+    guard
+      let raw = Bundle.main.object(forInfoDictionaryKey: aaguidInfoDictionaryKey) as? String,
+      let configured = UUID(uuidString: raw)
+    else {
+      return defaultAaguid
+    }
+    return configured
+  }()
+
+  static func authenticatorDataForAssertion(relyingPartyIdentifier: String) -> Data {
+    var data = Data(SHA256.hash(data: Data(relyingPartyIdentifier.utf8)))
+    data.append(flags(attestedCredentialDataIncluded: false))
+    data.append(signCount())
+    return data
+  }
+
+  static func authenticatorDataForAttestation(
+    relyingPartyIdentifier: String,
+    credentialId: Data,
+    publicKey: Data
+  ) throws -> Data {
+    var data = Data(SHA256.hash(data: Data(relyingPartyIdentifier.utf8)))
+    data.append(flags(attestedCredentialDataIncluded: true))
+    data.append(signCount())
+    data.append(try attestedCredentialData(credentialId: credentialId, publicKey: publicKey))
+    return data
+  }
+
+  static func attestationObject(authenticatorData: Data) -> Data {
+    Cbor.encodeMap([
+      (Cbor.encodeText("fmt"), Cbor.encodeText("none")),
+      (Cbor.encodeText("attStmt"), Cbor.encodeMap([])),
+      (Cbor.encodeText("authData"), Cbor.encodeBytes(authenticatorData)),
+    ])
+  }
+
+  static func credentialId(publicKey: Data) -> Data {
+    Data(SHA256.hash(data: publicKey))
+  }
+
+  private static func flags(attestedCredentialDataIncluded: Bool) -> Data {
+    var flags: UInt8 = 0x01
+    flags |= 0x04
+    flags |= 0x08
+    flags |= 0x10
+    if attestedCredentialDataIncluded {
+      flags |= 0x40
+    }
+    return Data([flags])
+  }
+
+  private static func signCount() -> Data {
+    Data([0x00, 0x00, 0x00, 0x00])
+  }
+
+  private static func attestedCredentialData(credentialId: Data, publicKey: Data) throws -> Data {
+    var data = aaguid.bytes
+    data.append(UInt8((credentialId.count >> 8) & 0xff))
+    data.append(UInt8(credentialId.count & 0xff))
+    data.append(credentialId)
+    data.append(try coseKey(publicKey: publicKey))
+    return data
+  }
+
+  private static func coseKey(publicKey: Data) throws -> Data {
+    let coordinates = try p256Coordinates(publicKey: publicKey)
+
+    return Cbor.encodeMap([
+      (Cbor.encodeInt(1), Cbor.encodeInt(2)),
+      (Cbor.encodeInt(3), Cbor.encodeInt(-7)),
+      (Cbor.encodeInt(-1), Cbor.encodeInt(1)),
+      (Cbor.encodeInt(-2), Cbor.encodeBytes(coordinates.x)),
+      (Cbor.encodeInt(-3), Cbor.encodeBytes(coordinates.y)),
+    ])
+  }
+
+  private static func p256Coordinates(publicKey: Data) throws -> (x: Data, y: Data) {
+    if let derPublicKey = try? P256.Signing.PublicKey(derRepresentation: publicKey) {
+      return try p256Coordinates(publicKey: derPublicKey.x963Representation)
+    }
+
+    if publicKey.count == 65, publicKey.first == 0x04 {
+      let coordinates = publicKey.dropFirst()
+      return (
+        Data(coordinates.prefix(32)),
+        Data(coordinates.dropFirst(32).prefix(32))
+      )
+    }
+
+    if publicKey.count == 64 {
+      return (
+        Data(publicKey.prefix(32)),
+        Data(publicKey.dropFirst(32).prefix(32))
+      )
+    }
+
+    throw WebAuthnError.invalidP256PublicKeyLength(publicKey.count)
+  }
+}
+
+private enum Cbor {
+  static func encodeInt(_ value: Int) -> Data {
+    if value >= 0 {
+      return encodeUnsigned(UInt64(value), majorType: 0)
+    }
+    return encodeUnsigned(UInt64(-1 - value), majorType: 1)
+  }
+
+  static func encodeBytes(_ bytes: Data) -> Data {
+    encodeUnsigned(UInt64(bytes.count), majorType: 2) + bytes
+  }
+
+  static func encodeText(_ string: String) -> Data {
+    let bytes = Data(string.utf8)
+    return encodeUnsigned(UInt64(bytes.count), majorType: 3) + bytes
+  }
+
+  static func encodeMap(_ pairs: [(Data, Data)]) -> Data {
+    var data = encodeUnsigned(UInt64(pairs.count), majorType: 5)
+    for (key, value) in pairs {
+      data.append(key)
+      data.append(value)
+    }
+    return data
+  }
+
+  private static func encodeUnsigned(_ value: UInt64, majorType: UInt8) -> Data {
+    let prefix = majorType << 5
+    switch value {
+    case 0..<24:
+      return Data([prefix | UInt8(value)])
+    case 24..<256:
+      return Data([prefix | 24, UInt8(value)])
+    case 256..<65_536:
+      return Data([prefix | 25, UInt8((value >> 8) & 0xff), UInt8(value & 0xff)])
+    case 65_536..<4_294_967_296:
+      return Data([
+        prefix | 26,
+        UInt8((value >> 24) & 0xff),
+        UInt8((value >> 16) & 0xff),
+        UInt8((value >> 8) & 0xff),
+        UInt8(value & 0xff),
+      ])
+    default:
+      return Data([
+        prefix | 27,
+        UInt8((value >> 56) & 0xff),
+        UInt8((value >> 48) & 0xff),
+        UInt8((value >> 40) & 0xff),
+        UInt8((value >> 32) & 0xff),
+        UInt8((value >> 24) & 0xff),
+        UInt8((value >> 16) & 0xff),
+        UInt8((value >> 8) & 0xff),
+        UInt8(value & 0xff),
+      ])
+    }
+  }
+}
+
+private extension UUID {
+  var bytes: Data {
+    var uuid = uuid
+    return withUnsafeBytes(of: &uuid) { Data($0) }
+  }
+}

package/ios/ReactNativePasskeyAutofill.podspec

@@ -19,11 +19,20 @@ Pod::Spec.new do |s|
   s.static_framework = true
 
   s.dependency 'ExpoModulesCore'
+  s.dependency 'MMKVCore'
 
-  # Swift/Objective-C compatibility
   s.pod_target_xcconfig = {
     'DEFINES_MODULE' => 'YES',
   }
 
-  s.source_files = "**/*.{h,m,mm,swift,hpp,cpp}"
+  s.source_files = [
+    "*.{h,m,mm,swift,hpp,cpp}",
+    "AutofillCredentialProvider/PasskeyAutofillCredentialProvider-Bridging-Header.h",
+    "AutofillCredentialProvider/PasskeyCredentialStore.swift",
+    "AutofillCredentialProvider/PasskeyKeystoreMMKV.h",
+    "AutofillCredentialProvider/PasskeyKeystoreMMKV.mm"
+  ]
+  s.public_header_files = [
+    "AutofillCredentialProvider/PasskeyKeystoreMMKV.h"
+  ]
 end

package/ios/ReactNativePasskeyAutofillModule.swift

@@ -1,4 +1,8 @@
 import ExpoModulesCore
+import AuthenticationServices
+#if canImport(UIKit)
+import UIKit
+#endif
 
 public class ReactNativePasskeyAutofillModule: Module {
   // Each module class must implement the definition function. The definition consists of components
@@ -10,26 +14,177 @@ public class ReactNativePasskeyAutofillModule: Module {
     // The module will be accessible from `requireNativeModule('ReactNativePasskeyAutofill')` in JavaScript.
     Name("ReactNativePasskeyAutofill")
 
-    // Defines constant property on the module.
-    Constant("PI") {
-      Double.pi
+    Events("onPasskeyAdded", "onPasskeyAuthenticated")
+
+    AsyncFunction("setMasterKey") { (secret: String) in
+      guard let store = PasskeyCredentialStore() else {
+        throw NSError(
+          domain: "ReactNativePasskeyAutofill",
+          code: 1,
+          userInfo: [NSLocalizedDescriptionKey: "App Group is not configured for passkey autofill."]
+        )
+      }
+      store.saveMasterKey(secret)
+    }
+
+    AsyncFunction("setHdRootKeyId") { (id: String) in
+      guard let store = PasskeyCredentialStore() else {
+        throw NSError(
+          domain: "ReactNativePasskeyAutofill",
+          code: 1,
+          userInfo: [NSLocalizedDescriptionKey: "App Group is not configured for passkey autofill."]
+        )
+      }
+      store.saveHdRootKeyId(id)
+    }
+
+    AsyncFunction("getHdRootKeyId") { () -> String? in
+      guard let store = PasskeyCredentialStore() else {
+        return nil
+      }
+      return store.hdRootKeyId()
+    }
+
+    AsyncFunction("clearCredentials") {
+      guard let store = PasskeyCredentialStore() else {
+        return
+      }
+      store.clear()
+      try await store.removeAllIdentities()
+    }
+
+    AsyncFunction("deleteCredential") { (credentialId: String) in
+      guard let store = PasskeyCredentialStore() else {
+        return
+      }
+      try store.removeCredential(id: credentialId)
+      try await store.replaceIdentityStore()
+    }
+
+    AsyncFunction("configureIntentActions") { (getPasskeyAction: String, createPasskeyAction: String) in
+      guard let store = PasskeyCredentialStore() else {
+        return
+      }
+      store.configureIntentActions(
+        getPasskeyAction: getPasskeyAction,
+        createPasskeyAction: createPasskeyAction
+      )
+    }
+
+    AsyncFunction("replaceCredentialIdentities") { (credentials: [[String: Any]]) in
+      guard let store = PasskeyCredentialStore() else {
+        throw NSError(
+          domain: "ReactNativePasskeyAutofill",
+          code: 1,
+          userInfo: [NSLocalizedDescriptionKey: "App Group is not configured for passkey autofill."]
+        )
+      }
+
+      let storedCredentials = credentials.compactMap { credential -> StoredPasskeyCredential? in
+        guard let credentialId = credential["credentialId"] as? String ?? credential["id"] as? String,
+              let relyingPartyIdentifier =
+                credential["relyingPartyIdentifier"] as? String ??
+                credential["rpId"] as? String ??
+                credential["origin"] as? String,
+              let userName =
+                credential["userName"] as? String ??
+                credential["name"] as? String ??
+                credential["userHandle"] as? String,
+              let userHandle =
+                credential["userHandle"] as? String ??
+                credential["userId"] as? String,
+              let privateKey =
+                credential["privateKey"] as? String ??
+                credential["privateKeyBase64"] as? String
+        else {
+          return nil
+        }
+
+        let metadata = credential["metadata"] as? [String: Any]
+
+        return StoredPasskeyCredential(
+          credentialId: credentialId,
+          relyingPartyIdentifier: relyingPartyIdentifier.relyingPartyIdentifier,
+          userName: userName,
+          userHandle: userHandle,
+          privateKey: privateKey,
+          publicKey: credential["publicKey"] as? String ?? credential["publicKeyBase64"] as? String,
+          createdAt: credential["createdAt"] as? Double ?? Date().timeIntervalSince1970,
+          lastUsedAt: credential["lastUsedAt"] as? Double ?? metadata?["lastUsedAt"] as? Double,
+          parentKeyId: credential["parentKeyId"] as? String ?? metadata?["parentKeyId"] as? String
+        )
+      }
+
+      try store.replace(storedCredentials)
+      try await store.replaceIdentityStore()
+    }
+
+    AsyncFunction("refreshCredentialIdentities") {
+      guard let store = PasskeyCredentialStore() else {
+        throw NSError(
+          domain: "ReactNativePasskeyAutofill",
+          code: 1,
+          userInfo: [NSLocalizedDescriptionKey: "App Group is not configured for passkey autofill."]
+        )
+      }
+
+      try await store.replaceIdentityStore()
+    }
+
+    AsyncFunction("getStoredCredentials") { () -> [[String: Any]] in
+      guard let store = PasskeyCredentialStore() else {
+        return []
+      }
+
+      return store.allCredentials().map { credential in
+        var result: [String: Any] = [
+          "credentialId": credential.credentialId,
+          "relyingPartyIdentifier": credential.relyingPartyIdentifier,
+          "userName": credential.userName,
+          "userHandle": credential.userHandle,
+          "createdAt": credential.createdAt,
+        ]
+
+        if let publicKey = credential.publicKey {
+          result["publicKey"] = publicKey
+        }
+        if let lastUsedAt = credential.lastUsedAt {
+          result["lastUsedAt"] = lastUsedAt
+        }
+        if let parentKeyId = credential.parentKeyId {
+          result["parentKeyId"] = parentKeyId
+        }
+
+        return result
+      }
     }
 
-    // Defines event names that the module can send to JavaScript.
-    Events("onChange")
+    AsyncFunction("getDiagnostics") { () -> [String] in
+      guard let store = PasskeyCredentialStore() else {
+        return []
+      }
+      return store.diagnostics()
+    }
 
-    // Defines a JavaScript synchronous function that runs the native code on the JavaScript thread.
-    Function("hello") {
-      return "Hello world! 👋"
+    // Returns true when this app is the user-selected AutoFill credential
+    // provider. On iOS the Credential Provider extension reports its
+    // enablement via `ASCredentialIdentityStore.getState`.
+    AsyncFunction("isProviderActive") { (promise: Promise) in
+      ASCredentialIdentityStore.shared.getState { state in
+        promise.resolve(state.isEnabled)
+      }
     }
 
-    // Defines a JavaScript function that always returns a Promise and whose native code
-    // is by default dispatched on the different thread than the JavaScript runtime runs on.
-    AsyncFunction("setValueAsync") { (value: String) in
-      // Send an event to JavaScript.
-      self.sendEvent("onChange", [
-        "value": value
-      ])
+    // Best-effort deep link to the iOS AutoFill settings screen.
+    AsyncFunction("openProviderSettings") { () -> Bool in
+      #if canImport(UIKit)
+      if let url = URL(string: UIApplication.openSettingsURLString),
+         UIApplication.shared.canOpenURL(url) {
+        UIApplication.shared.open(url)
+        return true
+      }
+      #endif
+      return false
     }
 
     // Enables the module to be used as a native view. Definition components that are accepted as part of the

package/lefthook.yml

@@ -0,0 +1,14 @@
+# Lefthook configuration
+# Refer to https://github.com/evilmartians/lefthook/blob/master/docs/configuration.md
+
+pre-commit:
+  commands:
+    lint:
+      run: pnpm run lint
+    fmt:
+      run: pnpm run fmt
+pre-push:
+  parallel: true
+  commands:
+    test:
+      run: pnpm run test:all