@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.2 → 1.0.0-canary.21

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -6,7 +6,12 @@ import android.content.Intent
 import android.os.Build
 import android.os.Bundle
 import android.util.Log
+import android.graphics.Color
+import android.graphics.Typeface
+import android.view.Gravity
 import android.widget.Button
+import android.widget.ImageView
+import android.widget.LinearLayout
 import android.widget.TextView
 import androidx.annotation.RequiresApi
 import androidx.appcompat.app.AppCompatActivity
@@ -18,10 +23,20 @@ import androidx.credentials.provider.ProviderGetCredentialRequest
 import androidx.credentials.webauthn.AuthenticatorAssertionResponse
 import androidx.credentials.webauthn.FidoPublicKeyCredential
 import androidx.credentials.webauthn.PublicKeyCredentialRequestOptions
+import co.algorand.passkeyautofill.auth.BiometricRequirement
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
+import co.algorand.passkeyautofill.utils.PasskeyUtils
 import java.security.KeyPair
+import java.security.MessageDigest
 import android.util.Base64 as AndroidBase64
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.core.content.ContextCompat
+import androidx.lifecycle.lifecycleScope
+import kotlin.coroutines.resume
+import kotlin.coroutines.suspendCoroutine
+import kotlinx.coroutines.launch
 import org.json.JSONObject
 
 @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@@ -33,70 +48,475 @@ class GetPasskeyActivity : AppCompatActivity() {
     }
 
     private var origin: String = "unknown-origin"
+    private var displayOrigin: String = "unknown-origin"
     private var userHandle: String = "unknown-user"
     private var credentialIdEnc: String? = null
+    private var userVerification: String = "preferred"
+    private var bundleRequestJson: String? = null
     private var request: ProviderGetCredentialRequest? = null
+    private var biometricPromptResult: Any? = null
+    private var systemUnlockedCipher: javax.crypto.Cipher? = null
+    private var isHandling: Boolean = false
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+        Log.i(TAG, "onCreate started")
         
-        request = PendingIntentHandler.retrieveProviderGetCredentialRequest(intent)
-        val credentialData = intent.getBundleExtra("CREDENTIAL_DATA")
+        request = try {
+            PendingIntentHandler.retrieveProviderGetCredentialRequest(intent)
+        } catch (e: Exception) {
+            Log.e(TAG, "Error retrieving request from intent", e)
+            null
+        }
+        Log.i(TAG, "Retrieved request: $request")
         
-        if (request != null && credentialData != null) {
-            origin = credentialRepository.getOrigin(request!!.callingAppInfo)
+        // Check for system-provided biometric result (Single Tap flow)
+        try {
+            val biometricResult = request?.biometricPromptResult
+            Log.i(TAG, "biometricResult from system: $biometricResult")
+            if (biometricResult != null) {
+                this.biometricPromptResult = biometricResult
+                val authResult = biometricResult.authenticationResult
+                Log.i(TAG, "authResult from system: $authResult (${authResult?.javaClass?.name})")
+                
+                // Also try to find it in the biometricResult object itself
+                systemUnlockedCipher = if (authResult != null) {
+                    PasskeyUtils.extractCipher(authResult)
+                } else {
+                    PasskeyUtils.extractCipher(biometricResult)
+                }
+                Log.i(TAG, "systemUnlockedCipher from system: $systemUnlockedCipher")
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "Error processing biometricPromptResult", e)
+        }
+
+        val credentialData = intent.getBundleExtra("CREDENTIAL_DATA")
+
+        if (credentialData != null) {
             credentialIdEnc = credentialData.getString("credentialId")
             userHandle = credentialData.getString("userHandle") ?: "unknown-user"
+            bundleRequestJson = credentialData.getString("requestJson")
+            userVerification = credentialData.getString("userVerification") ?: "preferred"
+        }
+
+        if (request != null) {
+            origin = credentialRepository.getOrigin(request!!.callingAppInfo)
+            displayOrigin = origin
+            
+            // Try to extract rpId for better display
+            val rawJson = bundleRequestJson ?: (request?.credentialOptions?.get(0) as? GetPublicKeyCredentialOption)?.requestJson
+            if (rawJson != null) {
+                try {
+                    val jsonObj = JSONObject(rawJson)
+                    val pkJson = if (jsonObj.has("publicKey")) jsonObj.getJSONObject("publicKey") else jsonObj
+                    val rpId = pkJson.optString("rpId")
+                    if (rpId.isNotEmpty()) {
+                        displayOrigin = rpId
+                    }
+                } catch (e: Exception) {
+                    // ignore
+                }
+            }
         }
 
-        // Simple UI
-        val layout = android.widget.LinearLayout(this).apply {
-            orientation = android.widget.LinearLayout.VERTICAL
-            setPadding(50, 50, 50, 50)
+        // If the system already showed a biometric prompt (Single Tap), proceed automatically
+        if (biometricPromptResult != null) {
+            Log.d(TAG, "System already showed biometric prompt (Single Tap), proceeding automatically")
+            handleAssertion()
+            return
         }
+
+        // Auto-trigger assertion flow
+        handleAssertion()
+    }
+
+    private fun setupUI() {
+        if (isFinishing || isDestroyed) return
         
+        // Improved UI
+        val layout = LinearLayout(this).apply {
+            val padding = (32 * resources.displayMetrics.density).toInt()
+            orientation = LinearLayout.VERTICAL
+            setPadding(padding, padding, padding, padding)
+            gravity = Gravity.CENTER_HORIZONTAL
+            setBackgroundColor(Color.WHITE)
+        }
+
+        // Header with App Icon and Provider Label
+        try {
+            val appInfo = packageManager.getApplicationInfo(packageName, 0)
+            val appIcon = packageManager.getApplicationIcon(appInfo)
+            val appLabel = packageManager.getApplicationLabel(appInfo)
+
+            val density = resources.displayMetrics.density
+            val iconSize = (48 * density).toInt()
+            val iconMargin = (12 * density).toInt()
+            val headerPadding = (40 * density).toInt()
+
+            val header = LinearLayout(this).apply {
+                orientation = LinearLayout.HORIZONTAL
+                gravity = Gravity.CENTER_VERTICAL
+                setPadding(0, 0, 0, headerPadding)
+            }
+
+            val iconView = ImageView(this).apply {
+                setImageDrawable(appIcon)
+                layoutParams = LinearLayout.LayoutParams(iconSize, iconSize).apply {
+                    marginEnd = iconMargin
+                }
+            }
+            header.addView(iconView)
+
+            val providerLabel = TextView(this).apply {
+                text = appLabel
+                textSize = 16f
+                typeface = Typeface.DEFAULT_BOLD
+                setTextColor(Color.DKGRAY)
+            }
+            header.addView(providerLabel)
+            layout.addView(header)
+        } catch (e: Exception) {
+            // Fallback if app info cannot be loaded
+        }
+
         val title = TextView(this).apply {
             text = "Use Passkey"
-            textSize = 24f
-            setPadding(0, 0, 0, 50)
+            textSize = 28f
+            typeface = Typeface.DEFAULT_BOLD
+            setPadding(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+            setTextColor(Color.BLACK)
         }
         layout.addView(title)
 
-        val info = TextView(this).apply {
-            text = "User: $userHandle\nAt: $origin"
-            setPadding(0, 0, 0, 50)
+        val description = TextView(this).apply {
+            text = "Sign in to $displayOrigin"
+            textSize = 16f
+            setPadding(0, 0, 0, (40 * resources.displayMetrics.density).toInt())
+            gravity = Gravity.CENTER_HORIZONTAL
+            setTextColor(Color.GRAY)
         }
-        layout.addView(info)
-        
+        layout.addView(description)
+
+        val userInfoContainer = LinearLayout(this).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(0, 0, 0, (50 * resources.displayMetrics.density).toInt())
+            gravity = Gravity.CENTER_HORIZONTAL
+        }
+
+        val userLabel = TextView(this).apply {
+            text = "ACCOUNT"
+            textSize = 12f
+            typeface = Typeface.DEFAULT_BOLD
+            setTextColor(Color.GRAY)
+            setPadding(0, 0, 0, (4 * resources.displayMetrics.density).toInt())
+        }
+        userInfoContainer.addView(userLabel)
+
+        val userValue = TextView(this).apply {
+            text = userHandle
+            textSize = 20f
+            typeface = Typeface.DEFAULT_BOLD
+            setTextColor(Color.BLACK)
+        }
+        userInfoContainer.addView(userValue)
+        layout.addView(userInfoContainer)
+
         val confirmButton = Button(this).apply {
             text = "Sign In"
+            // Stable accessibility id for E2E tests (`~get-passkey-confirm`).
+            contentDescription = "get-passkey-confirm"
             setOnClickListener {
                 handleAssertion()
             }
+            layoutParams = LinearLayout.LayoutParams(
+                LinearLayout.LayoutParams.MATCH_PARENT,
+                LinearLayout.LayoutParams.WRAP_CONTENT
+            ).apply {
+                setMargins(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+            }
         }
         layout.addView(confirmButton)
 
+        val cancelButton = Button(this, null, android.R.attr.borderlessButtonStyle).apply {
+            text = "Cancel"
+            contentDescription = "get-passkey-cancel"
+            setOnClickListener {
+                setResult(RESULT_CANCELED)
+                finish()
+            }
+            layoutParams = LinearLayout.LayoutParams(
+                LinearLayout.LayoutParams.MATCH_PARENT,
+                LinearLayout.LayoutParams.WRAP_CONTENT
+            )
+        }
+        layout.addView(cancelButton)
+
+        setContentView(layout)
+
+        // Ensure the activity is focusable and can receive touches
+        layout.isFocusable = true
+        layout.isFocusableInTouchMode = true
+        layout.requestFocus()
+    }
+
+    private fun setupErrorUI(message: String, allowRetry: Boolean) {
+        if (isFinishing || isDestroyed) return
+
+        val layout = LinearLayout(this).apply {
+            val padding = (32 * resources.displayMetrics.density).toInt()
+            orientation = LinearLayout.VERTICAL
+            setPadding(padding, padding, padding, padding)
+            gravity = Gravity.CENTER_HORIZONTAL
+            setBackgroundColor(Color.WHITE)
+        }
+
+        try {
+            val appInfo = packageManager.getApplicationInfo(packageName, 0)
+            val appIcon = packageManager.getApplicationIcon(appInfo)
+            val appLabel = packageManager.getApplicationLabel(appInfo)
+
+            val density = resources.displayMetrics.density
+            val iconSize = (48 * density).toInt()
+            val iconMargin = (12 * density).toInt()
+            val headerPadding = (40 * density).toInt()
+
+            val header = LinearLayout(this).apply {
+                orientation = LinearLayout.HORIZONTAL
+                gravity = Gravity.CENTER_VERTICAL
+                setPadding(0, 0, 0, headerPadding)
+            }
+
+            val iconView = ImageView(this).apply {
+                setImageDrawable(appIcon)
+                layoutParams = LinearLayout.LayoutParams(iconSize, iconSize).apply {
+                    marginEnd = iconMargin
+                }
+            }
+            header.addView(iconView)
+
+            val providerLabel = TextView(this).apply {
+                text = appLabel
+                textSize = 16f
+                typeface = Typeface.DEFAULT_BOLD
+                setTextColor(Color.DKGRAY)
+            }
+            header.addView(providerLabel)
+            layout.addView(header)
+        } catch (e: Exception) {
+        }
+
+        val title = TextView(this).apply {
+            text = "Couldn't sign in"
+            textSize = 28f
+            typeface = Typeface.DEFAULT_BOLD
+            setPadding(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+            setTextColor(Color.BLACK)
+        }
+        layout.addView(title)
+
+        val description = TextView(this).apply {
+            text = message
+            textSize = 16f
+            setPadding(0, 0, 0, (40 * resources.displayMetrics.density).toInt())
+            gravity = Gravity.CENTER_HORIZONTAL
+            setTextColor(Color.GRAY)
+        }
+        layout.addView(description)
+
+        if (allowRetry) {
+            val retryButton = Button(this).apply {
+                text = "Try Again"
+                contentDescription = "get-passkey-retry"
+                setOnClickListener {
+                    handleAssertion()
+                }
+                layoutParams = LinearLayout.LayoutParams(
+                    LinearLayout.LayoutParams.MATCH_PARENT,
+                    LinearLayout.LayoutParams.WRAP_CONTENT
+                ).apply {
+                    setMargins(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+                }
+            }
+            layout.addView(retryButton)
+        }
+
+        val closeButton = Button(this, null, android.R.attr.borderlessButtonStyle).apply {
+            text = "Close"
+            contentDescription = "get-passkey-cancel"
+            setOnClickListener {
+                setResult(RESULT_CANCELED)
+                finish()
+            }
+            layoutParams = LinearLayout.LayoutParams(
+                LinearLayout.LayoutParams.MATCH_PARENT,
+                LinearLayout.LayoutParams.WRAP_CONTENT
+            )
+        }
+        layout.addView(closeButton)
+
         setContentView(layout)
+
+        layout.isFocusable = true
+        layout.isFocusableInTouchMode = true
+        layout.requestFocus()
     }
 
     @SuppressLint("RestrictedApi")
     private fun handleAssertion() {
-        try {
-            val req = request ?: throw IllegalStateException("No request found")
-            val option = req.credentialOptions[0] as GetPublicKeyCredentialOption
-            val requestOptions = PublicKeyCredentialRequestOptions(option.requestJson)
+        if (isHandling) return
+        isHandling = true
+        Log.d(TAG, "handleAssertion started, userVerification=$userVerification")
+        lifecycleScope.launch {
+            val credentialData = intent.getBundleExtra("CREDENTIAL_DATA")
+            val biometricIv = credentialData?.getString("biometricIv")
+            Log.d(TAG, "biometricIv from bundle: $biometricIv")
             
-            val credId = AndroidBase64.decode(credentialIdEnc!!, AndroidBase64.DEFAULT)
-            val clientDataHash = option.requestData.getByteArray("androidx.credentials.BUNDLE_KEY_CLIENT_DATA_HASH")
-                ?: throw IllegalStateException("Missing clientDataHash")
+            val cipherToUse = systemUnlockedCipher ?: run {
+                if (biometricPromptResult != null) {
+                    try {
+                        val requirement = BiometricRequirement.resolve(this@GetPasskeyActivity)
+                        val fallback = if (biometricIv != null) {
+                            credentialRepository.getBiometricCipherForDecryption(this@GetPasskeyActivity, AndroidBase64.decode(biometricIv, AndroidBase64.DEFAULT), requirement)
+                        } else {
+                            credentialRepository.getBiometricCipherForEncryption(this@GetPasskeyActivity, requirement)
+                        }
+                        Log.i(TAG, "Successfully obtained fallback cipher from repository (Single Tap timeout)")
+                        fallback
+                    } catch (e: Exception) {
+                        Log.d(TAG, "Fallback cipher failed: ${e.message}")
+                        null
+                    }
+                } else {
+                    null
+                }
+            } ?: run {
+                // Only prompt for manual biometrics if userVerification is "required" 
+                // OR if the key was saved with biometric protection (biometricIv != null)
+                if (userVerification == "required" || biometricIv != null) {
+                    Log.i(TAG, "Manual biometrics required (userVerification=$userVerification, biometricIv present=${biometricIv != null})")
+                    val result = biometrics(biometricIv)
+                    Log.d(TAG, "Manual biometrics result: $result")
+                    if (result == null) {
+                        Log.w(TAG, "Biometrics failed or was canceled")
+                        val requirement = BiometricRequirement.resolve(this@GetPasskeyActivity)
+                        val canUseBiometrics =
+                            BiometricManager.from(this@GetPasskeyActivity)
+                                .canAuthenticate(
+                                    requirement.allowedAuthenticators,
+                                ) == BiometricManager.BIOMETRIC_SUCCESS
+                        if (canUseBiometrics) {
+                            setupUI()
+                        } else {
+                            setupErrorUI(
+                                "This device has no screen lock or biometric set up, which passkeys require. Add one in your device settings, then try again.",
+                                allowRetry = false,
+                            )
+                        }
+                        isHandling = false
+                        return@launch
+                    }
+                    result.cryptoObject?.cipher
+                } else {
+                    Log.d(TAG, "userVerification is $userVerification and key is not locked, skipping manual biometrics")
+                    null
+                }
+            }
+            
+            Log.d(TAG, "cipherToUse: $cipherToUse")
             
-            val dbCred = credentialRepository.getCredential(this, credId)
-                ?: throw IllegalStateException("Credential not found")
+            var finalCipher = cipherToUse
 
+            try {
+                val req = request ?: throw IllegalStateException("No request found")
+                Log.d(TAG, "Request found, origin: $origin")
+            
+            // Prefer using the request JSON from the bundle if available, as it's specifically for this entry
+            val rawRequestJson = bundleRequestJson ?: run {
+                val option = req.credentialOptions[0] as GetPublicKeyCredentialOption
+                option.requestJson
+            }
+            
+            val requestJson = JSONObject(rawRequestJson)
+            val passkeyReqJson = if (requestJson.has("publicKey")) {
+                requestJson.getJSONObject("publicKey").toString()
+            } else {
+                rawRequestJson
+            }
+            Log.d(TAG, "Passkey request JSON: $passkeyReqJson")
+            val requestOptions = try {
+                PublicKeyCredentialRequestOptions(passkeyReqJson)
+            } catch (e: org.json.JSONException) {
+                Log.e(TAG, "Invalid passkey request JSON: $passkeyReqJson")
+                throw e
+            }
+
+            val credId = AndroidBase64.decode(credentialIdEnc!!, AndroidBase64.DEFAULT)
+            Log.d(TAG, "Credential ID decoded")
+
+            val passkeyRequestJsonObj = JSONObject(passkeyReqJson)
+            val challenge = if (passkeyRequestJsonObj.has("challenge")) {
+                passkeyRequestJsonObj.getString("challenge")
+            } else {
+                throw org.json.JSONException("No value for challenge in requestJson: $passkeyReqJson")
+            }
+            val sanitizedOrigin = origin.replace(Regex("/$"), "")
+
+            // Look for system-provided clientDataHash (e.g. from Chrome)
+            val systemClientDataHash = run {
+                val option = req.credentialOptions.find { opt ->
+                    opt is GetPublicKeyCredentialOption && (opt.requestJson == rawRequestJson || 
+                        try { JSONObject(opt.requestJson).toString() == JSONObject(rawRequestJson!!).toString() } catch(e: Exception) { false })
+                } as? GetPublicKeyCredentialOption
+                option?.requestData?.getByteArray("androidx.credentials.BUNDLE_KEY_CLIENT_DATA_HASH")
+            }
+            Log.d(TAG, "systemClientDataHash present: ${systemClientDataHash != null}")
+
+            Log.d(TAG, "Building clientDataJSON, challenge: $challenge, origin: $sanitizedOrigin")
+            val clientDataJSONString = if (sanitizedOrigin.startsWith("https://") || sanitizedOrigin.startsWith("http://")) {
+                // Compact JSON for web origins to match browser hashing (no spaces, specific order)
+                "{\"type\":\"webauthn.get\",\"challenge\":\"$challenge\",\"origin\":\"$sanitizedOrigin\",\"crossOrigin\":false}"
+            } else {
+                val json = JSONObject()
+                json.put("type", "webauthn.get")
+                json.put("challenge", challenge)
+                json.put("origin", sanitizedOrigin)
+                json.put("crossOrigin", false)
+                if (sanitizedOrigin.startsWith("android:apk-key-hash:")) {
+                    json.put("androidPackageName", req.callingAppInfo.packageName)
+                }
+                json.toString()
+            }
+
+            val clientDataHash = systemClientDataHash ?: MessageDigest.getInstance("SHA-256").digest(clientDataJSONString.toByteArray(Charsets.UTF_8))
+
+            Log.d(TAG, "Getting credential from repository")
+            val dbCred = try {
+                credentialRepository.getCredential(this@GetPasskeyActivity, credId, finalCipher)
+                    ?: throw IllegalStateException("Credential not found")
+            } catch (e: Exception) {
+                if (e.message?.contains("user not authenticated", ignoreCase = true) == true || 
+                    e.cause?.message?.contains("user not authenticated", ignoreCase = true) == true) {
+                    Log.i(TAG, "Key is locked, triggering manual biometric prompt")
+                    val result = biometrics(biometricIv)
+                    if (result != null) {
+                        finalCipher = result.cryptoObject?.cipher
+                        Log.i(TAG, "Retrying getCredential with manual biometric cipher")
+                        credentialRepository.getCredential(this@GetPasskeyActivity, credId, finalCipher)
+                            ?: throw IllegalStateException("Credential not found after manual prompt")
+                    } else {
+                        throw e
+                    }
+                } else {
+                    throw e
+                }
+            }
+
+            Log.d(TAG, "Building AuthenticatorAssertionResponse")
             val response = AuthenticatorAssertionResponse(
                 requestOptions = requestOptions,
                 credentialId = credId,
-                origin = credentialRepository.getOrigin(req.callingAppInfo),
+                origin = sanitizedOrigin,
                 up = true,
                 uv = true,
                 be = true,
@@ -106,9 +526,30 @@ class GetPasskeyActivity : AppCompatActivity() {
                 clientDataHash = clientDataHash
             )
 
-            val keyPair = credentialRepository.getKeyPair(this, credId)
-                ?: throw IllegalStateException("No keypair found")
+            Log.d(TAG, "Getting key pair for signing")
+            val keyPair = try {
+                credentialRepository.getKeyPair(this@GetPasskeyActivity, credId, finalCipher)
+                    ?: throw IllegalStateException("No keypair found")
+            } catch (e: Exception) {
+                // If we get here, it means getCredential succeeded but something went wrong with getKeyPair.
+                // We shouldn't need a second prompt here if we already got the cipher, but for safety:
+                if (e.message?.contains("user not authenticated", ignoreCase = true) == true || 
+                    e.cause?.message?.contains("user not authenticated", ignoreCase = true) == true) {
+                     Log.i(TAG, "Key is locked for signing, triggering manual biometric prompt")
+                     val result = biometrics(biometricIv)
+                     if (result != null) {
+                         finalCipher = result.cryptoObject?.cipher
+                         credentialRepository.getKeyPair(this@GetPasskeyActivity, credId, finalCipher)
+                             ?: throw IllegalStateException("No keypair found after manual prompt")
+                     } else {
+                         throw e
+                     }
+                } else {
+                    throw e
+                }
+            }
 
+            Log.d(TAG, "Signing response")
             response.signature = credentialRepository.sign(keyPair, response.dataToSign())
 
             val fidoCredential = FidoPublicKeyCredential(
@@ -117,35 +558,133 @@ class GetPasskeyActivity : AppCompatActivity() {
                 authenticatorAttachment = "platform"
             )
 
-            // Manual addition of clientDataJSON if needed by some RPs, following reference
-            val requestJson = JSONObject(option.requestJson)
-            val challenge = requestJson.getString("challenge")
-            val clientDataJSONb64 = getClientDataJSONb64(origin, challenge)
-            
-            val delimiter = "response\":{"
-            val credentialJson = fidoCredential.json().substringBeforeLast(delimiter) + delimiter +
-                    "\"clientDataJSON\":\"$clientDataJSONb64\"," +
-                    fidoCredential.json().substringAfterLast(delimiter)
+            // Manual addition of clientDataJSON and signature to the response JSON
+            val clientDataJSONb64 = AndroidBase64.encodeToString(clientDataJSONString.toByteArray(), AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
+            val signatureb64 = AndroidBase64.encodeToString(response.signature, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
+
+            val fullJson = JSONObject(fidoCredential.json())
+            val respJson = fullJson.getJSONObject("response")
+            respJson.put("clientDataJSON", clientDataJSONb64)
+            respJson.put("signature", signatureb64)
+
+            // Add clientExtensionResults as seen in the example
+            val clientExtensionResults = JSONObject()
+            val credProps = JSONObject()
+            credProps.put("rk", true)
+            clientExtensionResults.put("credProps", credProps)
+
+            // WebAuthn `prf` extension (hmac-secret). If the RP requested PRF
+            // evaluation for this assertion, derive the per-credential
+            // `credRandom` from the wallet HD root secret and compute
+            // HMAC-SHA256-based outputs for the supplied salt(s).
+            try {
+                val credentialIdB64Url = AndroidBase64.encodeToString(
+                    credId,
+                    AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING,
+                )
+                val prfInput = Prf.parseInput(passkeyRequestJsonObj, credentialIdB64Url)
+                if (prfInput != null) {
+                    val hdRootSecret = credentialRepository.getHdRootSecret(this@GetPasskeyActivity)
+                    if (hdRootSecret == null) {
+                        Log.w(TAG, "PRF input present but HD root secret unavailable; skipping PRF output")
+                    } else {
+                        val credRandom = Prf.credRandom(
+                            hdRootSecret = hdRootSecret,
+                            relyingPartyIdentifier = displayOrigin,
+                            userHandle = dbCred.userHandle,
+                        )
+                        val first = Prf.evaluate(credRandom, prfInput.first, prfInput.alreadyHashed)
+                        val second = prfInput.second?.let { Prf.evaluate(credRandom, it, prfInput.alreadyHashed) }
+
+                        val prfResults = JSONObject().put("first", Prf.encodeOutput(first))
+                        if (second != null) {
+                            prfResults.put("second", Prf.encodeOutput(second))
+                        }
+                        clientExtensionResults.put("prf", JSONObject().put("results", prfResults))
+                        Log.d(TAG, "Computed PRF assertion output (second present=${second != null})")
+                    }
+                }
+            } catch (e: Exception) {
+                // Never fail the assertion because of a PRF error; just log
+                // and omit the extension result.
+                Log.w(TAG, "Failed to compute PRF assertion output", e)
+            }
+
+            fullJson.put("clientExtensionResults", clientExtensionResults)
+
+            val credentialJson = fullJson.toString()
+            Log.d(TAG, "Final credential JSON: $credentialJson")
 
             val resultIntent = Intent()
             val passkeyCredential = PublicKeyCredential(credentialJson)
-            
+
             PendingIntentHandler.setGetCredentialResponse(
                 resultIntent,
                 GetCredentialResponse(passkeyCredential)
             )
-            
+
             setResult(Activity.RESULT_OK, resultIntent)
+            Log.d(TAG, "Result set to OK")
+            credentialRepository.recordCredentialUsage(this@GetPasskeyActivity, credId)
+            ReactNativePasskeyAutofillModule.instance?.sendEvent("onPasskeyAuthenticated", Bundle().apply {
+                putBoolean("success", true)
+                putString("credentialId", credentialIdEnc)
+            })
+            finish()
         } catch (e: Exception) {
             Log.e(TAG, "Error during passkey assertion", e)
-            setResult(Activity.RESULT_CANCELED)
+            setupErrorUI(
+                "Something went wrong while signing in. Please try again.",
+                allowRetry = true,
+            )
+            isHandling = false
         }
-        finish()
+    }
     }
 
-    private fun getClientDataJSONb64(origin: String, challenge: String): String {
-        val sanitizedOrigin = origin.replace(Regex("/$"), "")
-        val jsonString = "{\"type\":\"webauthn.get\",\"challenge\":\"$challenge\",\"origin\":\"$sanitizedOrigin\",\"crossOrigin\":false}"
-        return AndroidBase64.encodeToString(jsonString.toByteArray(), AndroidBase64.NO_WRAP)
+    private suspend fun biometrics(iv: String?): BiometricPrompt.AuthenticationResult? {
+        val requirement = BiometricRequirement.resolve(this)
+        return suspendCoroutine { continuation ->
+            val biometricPrompt = BiometricPrompt(
+                this,
+                ContextCompat.getMainExecutor(this),
+                object : BiometricPrompt.AuthenticationCallback() {
+                    override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                        super.onAuthenticationSucceeded(result)
+                        continuation.resume(result)
+                    }
+
+                    override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                        super.onAuthenticationError(errorCode, errString)
+                        continuation.resume(null)
+                    }
+
+                    override fun onAuthenticationFailed() {
+                        super.onAuthenticationFailed()
+                    }
+                }
+            )
+            val promptInfoBuilder = BiometricPrompt.PromptInfo.Builder()
+                .setTitle("Sign In")
+                .setSubtitle("Authenticate to use your passkey")
+                .setAllowedAuthenticators(requirement.allowedAuthenticators)
+            if (!requirement.allowsDeviceCredential) {
+                promptInfoBuilder.setNegativeButtonText("Cancel")
+            }
+            val promptInfo = promptInfoBuilder.build()
+
+            if (iv != null && requirement.isCryptoBound) {
+                try {
+                    val ivBytes = AndroidBase64.decode(iv, AndroidBase64.DEFAULT)
+                    val cipher = credentialRepository.getBiometricCipherForDecryption(this, ivBytes, requirement)
+                    biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
+                } catch (e: Exception) {
+                    Log.e(TAG, "Failed to initialize biometric prompt with cipher", e)
+                    biometricPrompt.authenticate(promptInfo)
+                }
+            } else {
+                biometricPrompt.authenticate(promptInfo)
+            }
+        }
     }
 }