@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.2 → 1.0.0-canary.21

package/android/src/main/java/co/algorand/passkeyautofill/service/PasskeyAutofillCredentialProviderService.kt

@@ -24,10 +24,17 @@ import androidx.credentials.provider.CreateEntry
 import androidx.credentials.provider.CredentialProviderService
 import androidx.credentials.provider.ProviderClearCredentialStateRequest
 import androidx.credentials.provider.PublicKeyCredentialEntry
+import androidx.credentials.provider.BiometricPromptData
+import androidx.biometric.BiometricPrompt
+import co.algorand.passkeyautofill.auth.BiometricRequirement
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
+import co.algorand.passkeyautofill.utils.PasskeyUtils
+import android.util.Base64 as AndroidBase64
 import com.tencent.mmkv.MMKV
+import javax.crypto.Cipher
 import kotlinx.coroutines.*
+import org.json.JSONArray
 import org.json.JSONObject
 
 @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@@ -43,6 +50,25 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         const val CREATE_PASSKEY_INTENT = 2
         const val DEFAULT_GET_PASSKEY_ACTION = "co.algorand.passkeyautofill.GET_PASSKEY"
         const val DEFAULT_CREATE_PASSKEY_ACTION = "co.algorand.passkeyautofill.CREATE_PASSKEY"
+
+        /**
+         * MMKV key holding the last time Android routed a credential request to
+         * this service. Set from both `onBeginCreate` and `onBeginGet` callbacks.
+         * Consumed by `ReactNativePasskeyAutofillModule.isProviderActive` as a
+         * reliable "this app is a registered provider" signal, since the raw
+         * `Settings.Secure("credential_service")` key is @hide-restricted on
+         * Android 12+ and not readable from regular apps.
+         */
+        const val KEY_LAST_INVOKED_AT_MS = "provider_last_invoked_at_ms"
+
+        internal fun stampActivated(context: android.content.Context) {
+            try {
+                MMKV.initialize(context)
+                MMKV.defaultMMKV()?.encode(KEY_LAST_INVOKED_AT_MS, System.currentTimeMillis())
+            } catch (e: Exception) {
+                Log.w(TAG, "Failed to stamp provider activation: ${e.message}")
+            }
+        }
     }
     /**
      * Handle Create Credential Requests
@@ -53,6 +79,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         cancellationSignal: CancellationSignal,
         callback: OutcomeReceiver<BeginCreateCredentialResponse, CreateCredentialException>
     ) {
+        stampActivated(this)
         val response: BeginCreateCredentialResponse? = processCreateCredentialRequest(request)
         if (response != null) {
             callback.onResult(response)
@@ -89,21 +116,43 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
             return BeginCreateCredentialResponse(createEntries)
         }
 
-        val userJson = JSONObject(request.requestJson).optJSONObject("user")
+        val pkJson = JSONObject(request.requestJson)
+        val pk = if (pkJson.has("publicKey")) pkJson.getJSONObject("publicKey") else pkJson
+        val userJson = pk.optJSONObject("user")
         val name = userJson?.optString("name") ?: "New Passkey"
+        
+        val authenticatorSelection = pk.optJSONObject("authenticatorSelection")
+        val userVerification = authenticatorSelection?.optString("userVerification") ?: "preferred"
+        Log.d(TAG, "handleCreatePasskeyQuery: userVerification=$userVerification")
 
         val action = credentialRepository.getCreatePasskeyAction(this) ?: DEFAULT_CREATE_PASSKEY_ACTION
 
         val data = Bundle()
         data.putString("requestJson", request.requestJson)
+        data.putString("userVerification", userVerification)
 
-        val createEntry = CreateEntry.Builder(
+        val builder = CreateEntry.Builder(
             name,
             createNewPendingIntent(action, CREATE_PASSKEY_INTENT, data)
         ).setIcon(Icon.createWithResource(this, android.R.drawable.ic_menu_add))
-            .build()
+
+        if (userVerification != "discouraged") {
+            try {
+                val requirement = BiometricRequirement.resolve(this)
+                val biometricPromptDataBuilder = BiometricPromptData.Builder()
+                    .setAllowedAuthenticators(requirement.allowedAuthenticators)
+                if (requirement.isCryptoBound) {
+                    val cipher = credentialRepository.getBiometricCipherForEncryption(this, requirement)
+                    biometricPromptDataBuilder.setCryptoObject(BiometricPrompt.CryptoObject(cipher))
+                }
+                builder.setBiometricPromptData(biometricPromptDataBuilder.build())
+                Log.d(TAG, "Set BiometricPromptData for CreateEntry")
+            } catch (e: Exception) {
+                Log.e(TAG, "Failed to set BiometricPromptData for CreateEntry", e)
+            }
+        }
         
-        createEntries.add(createEntry)
+        createEntries.add(builder.build())
         return BeginCreateCredentialResponse(createEntries)
     }
     /**
@@ -115,6 +164,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         cancellationSignal: CancellationSignal,
         callback: OutcomeReceiver<BeginGetCredentialResponse, GetCredentialException>,
     ) {
+        stampActivated(this)
         try {
             val response = processGetCredentialRequest(request)
             callback.onResult(response)
@@ -127,7 +177,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     /**
      * Fake a list of available PublicKeyCredential Entries
      */
-    private fun processGetCredentialRequest(request: BeginGetCredentialRequest): BeginGetCredentialResponse{
+    private fun processGetCredentialRequest(request: BeginGetCredentialRequest): BeginGetCredentialResponse {
         // Ensure we have a master key available. If not, we can't sign anything, so don't show entries.
         if (!credentialRepository.isMasterKeyAvailable(this)) {
             return BeginGetCredentialResponse(emptyList())
@@ -138,42 +188,101 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         }
 
         val action = credentialRepository.getGetPasskeyAction(this) ?: DEFAULT_GET_PASSKEY_ACTION
+        val allEntries = mutableListOf<PublicKeyCredentialEntry>()
 
-        val entries = credentials.mapNotNull { credential ->
-            try {
-                // Find suitable option for this entry
-                val option = request.beginGetCredentialOptions.find { opt -> 
-                    if (opt !is BeginGetPublicKeyCredentialOption) return@find false
-                    
-                    // In a real app, we'd check if this credential's origin matches the request's origin
-                    // For now, we return all credentials that match the requested type.
-                    true
-                } as? BeginGetPublicKeyCredentialOption
-
-                if (option == null) {
-                    return@mapNotNull null
-                }
+        for (option in request.beginGetCredentialOptions) {
+            if (option !is BeginGetPublicKeyCredentialOption) continue
 
-                val data = Bundle()
-                data.putString("credentialId", credential.credentialId)
-                data.putString("userHandle", credential.userHandle)
-                data.putString("requestJson", option.requestJson)
-
-                PublicKeyCredentialEntry.Builder(
-                    this@PasskeyAutofillCredentialProviderService,
-                    credential.userHandle,
-                    createNewPendingIntent(action, GET_PASSKEY_INTENT, data),
-                    option
-                )
-                    .setIcon(Icon.createWithResource(this@PasskeyAutofillCredentialProviderService, android.R.drawable.ic_lock_lock))
-                    .build()
+            val requestJsonStr = option.requestJson
+            var allowCredentials: JSONArray? = null
+            var userVerification = "preferred"
+            try {
+                val json = JSONObject(requestJsonStr)
+                val pk = if (json.has("publicKey")) json.getJSONObject("publicKey") else json
+                allowCredentials = pk.optJSONArray("allowCredentials")
+                userVerification = pk.optString("userVerification", "preferred")
+                Log.d(TAG, "handleGetPasskeyQuery: userVerification=$userVerification")
             } catch (e: Exception) {
-                Log.e(TAG, "Error building PublicKeyCredentialEntry", e)
+                Log.e(TAG, "Error parsing requestJson", e)
+            }
+
+            val allowedIds = if (allowCredentials != null && allowCredentials.length() > 0) {
+                val ids = mutableSetOf<String>()
+                for (i in 0 until allowCredentials.length()) {
+                    ids.add(allowCredentials.getJSONObject(i).getString("id"))
+                }
+                ids
+            } else {
                 null
             }
+
+            for (credential in credentials) {
+                if (allowedIds != null) {
+                    val isAllowed = allowedIds.any { allowedId ->
+                        allowedId == credential.credentialId ||
+                        PasskeyUtils.normalizeBase64(allowedId) == PasskeyUtils.normalizeBase64(credential.credentialId)
+                    }
+                    if (!isAllowed) continue
+                }
+
+                try {
+                    val data = Bundle()
+                    data.putString("credentialId", credential.credentialId)
+                    data.putString("userHandle", credential.userHandle)
+                    data.putString("requestJson", option.requestJson)
+                    data.putString("userVerification", userVerification)
+                    credential.biometricIv?.let { data.putString("biometricIv", it) }
+
+                    // Use a unique requestCode for each PendingIntent to avoid data being overwritten
+                    val uniqueRequestCode = (credential.credentialId + option.requestJson).hashCode()
+
+                    val entryBuilder = PublicKeyCredentialEntry.Builder(
+                        this,
+                        credential.userHandle,
+                        createNewPendingIntent(action, uniqueRequestCode, data),
+                        option
+                    ).setIcon(Icon.createWithResource(this, android.R.drawable.ic_lock_lock))
+
+                    if (userVerification != "discouraged") {
+                        try {
+                            val requirement = BiometricRequirement.resolve(this)
+                            val biometricPromptDataBuilder = BiometricPromptData.Builder()
+                                .setAllowedAuthenticators(requirement.allowedAuthenticators)
+
+                            if (requirement.isCryptoBound) {
+                                val iv = credential.biometricIv
+                                if (iv != null) {
+                                    val ivBytes = AndroidBase64.decode(iv, AndroidBase64.DEFAULT)
+                                    val cipher = credentialRepository.getBiometricCipherForDecryption(this, ivBytes, requirement)
+                                    biometricPromptDataBuilder.setCryptoObject(BiometricPrompt.CryptoObject(cipher))
+                                } else {
+                                    // Even if the key isn't locked, provide a CryptoObject to enable Single Tap
+                                    // and ensure the user is authenticated for this operation.
+                                    try {
+                                        val cipher = credentialRepository.getBiometricCipherForEncryption(this, requirement)
+                                        biometricPromptDataBuilder.setCryptoObject(BiometricPrompt.CryptoObject(cipher))
+                                    } catch (e: Exception) {
+                                        Log.d(TAG, "Could not get encryption cipher for Single Tap: ${e.message}")
+                                    }
+                                }
+                            }
+
+                            entryBuilder.setBiometricPromptData(biometricPromptDataBuilder.build())
+                            Log.d(TAG, "Set BiometricPromptData for entry ${credential.userHandle}")
+                        } catch (e: Exception) {
+                            Log.e(TAG, "Failed to set BiometricPromptData for entry", e)
+                        }
+                    }
+
+                    allEntries.add(entryBuilder.build())
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error building PublicKeyCredentialEntry", e)
+                }
+            }
         }
-        return BeginGetCredentialResponse(entries)
+        return BeginGetCredentialResponse(allEntries)
     }
+
     override fun onClearCredentialStateRequest(
         request: ProviderClearCredentialStateRequest,
         cancellationSignal: CancellationSignal,
@@ -186,12 +295,17 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     private fun createNewPendingIntent(action: String, requestCode: Int, extra: Bundle?): PendingIntent{
         MMKV.initialize(this)
         val intent = Intent(action)
-        // Set component to be explicit to this library's activities
-        val componentName = when(requestCode) {
-            GET_PASSKEY_INTENT -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.GetPasskeyActivity")
-            CREATE_PASSKEY_INTENT -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.CreatePasskeyActivity")
+
+        // Determine component based on action instead of requestCode
+        val getAction = credentialRepository.getGetPasskeyAction(this) ?: DEFAULT_GET_PASSKEY_ACTION
+        val createAction = credentialRepository.getCreatePasskeyAction(this) ?: DEFAULT_CREATE_PASSKEY_ACTION
+
+        val componentName = when(action) {
+            getAction -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.GetPasskeyActivity")
+            createAction -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.CreatePasskeyActivity")
             else -> null
         }
+
         if (componentName != null) {
             intent.component = componentName
         } else {

package/android/src/main/java/co/algorand/passkeyautofill/utils/PasskeyUtils.kt

@@ -0,0 +1,119 @@
+package co.algorand.passkeyautofill.utils
+
+import android.util.Log
+import javax.crypto.Cipher
+
+object PasskeyUtils {
+    private const val TAG = "PasskeyUtils"
+
+    fun normalizeBase64(s: String): String {
+        return s.replace("-", "+").replace("_", "/").replace("=", "")
+    }
+
+    /**
+     * Extracts a Cipher from a BiometricPrompt.AuthenticationResult or similar objects 
+     * using reflection. This is necessary because the Credentials library uses 
+     * hidden or internal wrappers for platform/androidx biometric results.
+     */
+    fun extractCipher(authResult: Any?): Cipher? {
+        if (authResult == null) return null
+        return try {
+            Log.i(TAG, "Attempting to extract cipher from: ${authResult.javaClass.name}")
+            
+            // 1. Try direct getCryptoObject (works for androidx.biometric or platform)
+            var cryptoObject = authResult.javaClass.methods.find { it.name == "getCryptoObject" }?.invoke(authResult)
+            
+            // 2. If not found, check if it's a wrapper like androidx.credentials.provider.AuthenticationResult
+            if (cryptoObject == null) {
+                val unwrappingMethods = listOf(
+                    "getFrameworkAuthenticationResult", 
+                    "getBiometricPromptAuthenticationResult",
+                    "getAuthenticationResult"
+                )
+                for (methodName in unwrappingMethods) {
+                    try {
+                        val method = authResult.javaClass.methods.find { it.name == methodName }
+                        if (method != null) {
+                            val innerResult = method.invoke(authResult)
+                            if (innerResult != null && innerResult !== authResult) {
+                                Log.i(TAG, "Unwrapped via $methodName to ${innerResult.javaClass.name}")
+                                cryptoObject = innerResult.javaClass.methods.find { it.name == "getCryptoObject" }?.invoke(innerResult)
+                                if (cryptoObject != null) break
+                            }
+                        }
+                    } catch (e: Exception) { /* ignore */ }
+                }
+            }
+            
+            // 2.5 Try to find hidden fields directly if methods fail
+            if (cryptoObject == null) {
+                val hiddenFields = listOf("mFrameworkAuthenticationResult", "mBiometricPromptAuthenticationResult")
+                for (fieldName in hiddenFields) {
+                    try {
+                        val field = authResult.javaClass.getDeclaredField(fieldName)
+                        field.isAccessible = true
+                        val innerResult = field.get(authResult)
+                        if (innerResult != null) {
+                            Log.i(TAG, "Unwrapped via field $fieldName to ${innerResult.javaClass.name}")
+                            cryptoObject = innerResult.javaClass.methods.find { it.name == "getCryptoObject" }?.invoke(innerResult)
+                            if (cryptoObject != null) break
+                        }
+                    } catch (e: Exception) { /* ignore */ }
+                }
+            }
+            
+            // 3. Exhaustive search for any method returning something that has getCryptoObject
+            if (cryptoObject == null) {
+                for (method in authResult.javaClass.methods) {
+                    if (method.parameterCount == 0 && method.name.startsWith("get") && method.returnType != Void.TYPE) {
+                        try {
+                            val candidate = method.invoke(authResult) ?: continue
+                            if (candidate === authResult) continue
+                            
+                            val getCrypto = candidate.javaClass.methods.find { it.name == "getCryptoObject" }
+                            if (getCrypto != null) {
+                                cryptoObject = getCrypto.invoke(candidate)
+                                if (cryptoObject != null) {
+                                    Log.i(TAG, "Found cryptoObject via ${method.name} -> ${candidate.javaClass.name}")
+                                    break
+                                }
+                            }
+                        } catch (e: Exception) { continue }
+                    }
+                }
+            }
+
+            // 4. Try searching for fields too
+            if (cryptoObject == null) {
+                for (field in authResult.javaClass.declaredFields) {
+                    try {
+                        field.isAccessible = true
+                        val candidate = field.get(authResult) ?: continue
+                        val getCrypto = candidate.javaClass.methods.find { it.name == "getCryptoObject" }
+                        if (getCrypto != null) {
+                            cryptoObject = getCrypto.invoke(candidate)
+                            if (cryptoObject != null) {
+                                Log.i(TAG, "Found cryptoObject in field ${field.name}")
+                                break
+                            }
+                        }
+                    } catch (e: Exception) { continue }
+                }
+            }
+            
+            if (cryptoObject == null) {
+                Log.w(TAG, "Could not find CryptoObject in ${authResult.javaClass.name}")
+                return null
+            }
+            
+            // 5. Finally extract the Cipher from the CryptoObject
+            val getCipher = cryptoObject.javaClass.methods.find { it.name == "getCipher" }
+            val cipher = getCipher?.invoke(cryptoObject) as? Cipher
+            Log.i(TAG, "Extracted cipher: $cipher")
+            cipher
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to extract cipher via reflection", e)
+            null
+        }
+    }
+}

package/android/src/main/res/values/styles.xml

@@ -0,0 +1,10 @@
+<resources>
+    <style name="Theme.PasskeyAutofill.Dialog" parent="Theme.AppCompat.Light.Dialog.MinWidth">
+        <item name="android:windowIsTranslucent">true</item>
+        <item name="android:windowBackground">@android:color/transparent</item>
+        <item name="android:windowContentOverlay">@null</item>
+        <item name="android:windowNoTitle">true</item>
+        <item name="android:windowIsFloating">true</item>
+        <item name="android:backgroundDimEnabled">false</item>
+    </style>
+</resources>