@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.27 → 1.0.0-canary.28

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+# [1.0.0-canary.28](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.27...v1.0.0-canary.28) (2026-09-29)
+
+### Bug Fixes
+
+- restrict client hash to privileged list ([d17cea0](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/d17cea058745b5de0103d4ccd767885a2d185981))
+
 # [1.0.0-canary.27](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.26...v1.0.0-canary.27) (2026-09-22)
 
 ### Bug Fixes

package/android/src/main/AndroidManifest.xml

@@ -1,6 +1,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           xmlns:tools="http://schemas.android.com/tools">
     <uses-permission android:name="android.permission.USE_BIOMETRIC"/>
+    <!-- Refreshes Google's privileged-browser allowlist (PrivilegedBrowserAllowlist). -->
+    <uses-permission android:name="android.permission.INTERNET"/>
     <application>
         <service
             android:name=".service.PasskeyAutofillCredentialProviderService"

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -29,6 +29,7 @@ import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
 import co.algorand.passkeyautofill.credentials.MasterKeyUnavailableException
 import co.algorand.passkeyautofill.utils.PasskeyUtils
+import co.algorand.passkeyautofill.utils.PrivilegedBrowserAllowlist
 import java.security.KeyPair
 import android.util.Base64 as AndroidBase64
 import androidx.biometric.BiometricPrompt
@@ -49,6 +50,8 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
     private var origin: String = "unknown-origin" // Derivation origin (rpId or hash)
     private var displayOrigin: String = "unknown-origin"
+    /** The verified web origin when the caller is an allow-listed privileged browser; null for every ordinary app. */
+    private var privilegedOrigin: String? = null
     private var userHandle: String = "unknown-user"
     private var userName: String = "User"
     private var userId: String = "unknown-id"
@@ -108,6 +111,12 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
         if (request != null) {
             try {
+                // A caller-asserted web origin is trusted only for an allow-listed
+                // privileged browser; everyone else is bound to their app identity.
+                val allowlist = PrivilegedBrowserAllowlist.json(this)
+                privilegedOrigin = allowlist?.let {
+                    credentialRepository.getPrivilegedOrigin(request!!.callingAppInfo, it)
+                }
                 val systemOrigin = credentialRepository.getOrigin(request!!.callingAppInfo)
                 origin = systemOrigin
                 displayOrigin = systemOrigin
@@ -403,11 +412,16 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 "Relying party requires user verification but no verification ceremony completed"
             }
             PasskeyLog.d(TAG, "Building AuthenticatorAttestationResponse (uv=${verification.verified})")
+            // The origin the registration is bound to: the verified web origin
+            // for an allow-listed privileged browser, otherwise the caller's
+            // android:apk-key-hash: identity. This is independent of `origin`,
+            // which stays the derivation origin (rpId) so keys re-derive stably.
+            val responseOrigin = privilegedOrigin ?: credentialRepository.getOrigin(req.callingAppInfo)
             val response = AuthenticatorAttestationResponse(
                 requestOptions = requestOptions,
                 credentialId = credentialId,
                 credentialPublicKey = credentialRepository.getPublicKeyFromKeyPair(keyPair),
-                origin = credentialRepository.getOrigin(req.callingAppInfo),
+                origin = responseOrigin,
                 up = true,
                 uv = verification.verified,
                 be = true,
@@ -426,7 +440,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
             val respJson = fullJson.getJSONObject("response")
 
             // Ensure compact clientDataJSON for registration too
-            val sanitizedOrigin = credentialRepository.getOrigin(req.callingAppInfo).replace(Regex("/$"), "")
+            val sanitizedOrigin = responseOrigin.replace(Regex("/$"), "")
             val challenge = if (requestJson.has("publicKey")) {
                 requestJson.getJSONObject("publicKey").getString("challenge")
             } else {

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -31,6 +31,7 @@ import co.algorand.passkeyautofill.credentials.KeystoreRecords
 import co.algorand.passkeyautofill.credentials.ParentSecretResult
 import co.algorand.passkeyautofill.credentials.RelyingParty
 import co.algorand.passkeyautofill.utils.PasskeyUtils
+import co.algorand.passkeyautofill.utils.PrivilegedBrowserAllowlist
 import java.security.KeyPair
 import java.security.MessageDigest
 import android.util.Base64 as AndroidBase64
@@ -53,6 +54,8 @@ class GetPasskeyActivity : AppCompatActivity() {
 
     private var origin: String = "unknown-origin"
     private var displayOrigin: String = "unknown-origin"
+    /** The verified web origin when the caller is an allow-listed privileged browser; null for every ordinary app. */
+    private var privilegedOrigin: String? = null
     private var userHandle: String = "unknown-user"
     private var credentialIdEnc: String? = null
     private var userVerification: String = "preferred"
@@ -112,7 +115,13 @@ class GetPasskeyActivity : AppCompatActivity() {
         }
 
         if (request != null) {
-            origin = credentialRepository.getOrigin(request!!.callingAppInfo)
+            // A caller-asserted web origin is trusted only for an allow-listed
+            // privileged browser; everyone else is bound to their app identity.
+            val allowlist = PrivilegedBrowserAllowlist.json(this)
+            privilegedOrigin = allowlist?.let {
+                credentialRepository.getPrivilegedOrigin(request!!.callingAppInfo, it)
+            }
+            origin = privilegedOrigin ?: credentialRepository.getOrigin(request!!.callingAppInfo)
             displayOrigin = origin
             
             // Try to extract rpId for better display
@@ -505,7 +514,20 @@ class GetPasskeyActivity : AppCompatActivity() {
                 json.toString()
             }
 
-            val clientDataHash = systemClientDataHash ?: MessageDigest.getInstance("SHA-256").digest(clientDataJSONString.toByteArray(Charsets.UTF_8))
+            // Only an allow-listed privileged browser may have its own
+            // clientDataHash (and web origin) trusted. For every other caller we
+            // IGNORE any supplied hash and sign OUR OWN hash of the app-bound
+            // clientDataJSON, so the assertion is bound to the caller's
+            // android:apk-key-hash: identity and a foreign RP rejects it.
+            val trustSystemHash = privilegedOrigin != null && systemClientDataHash != null
+            if (systemClientDataHash != null && !trustSystemHash) {
+                PasskeyLog.w(TAG, "Ignoring caller-supplied clientDataHash from non-privileged caller; binding assertion to app origin")
+            }
+            val clientDataHash = if (trustSystemHash) {
+                systemClientDataHash!!
+            } else {
+                MessageDigest.getInstance("SHA-256").digest(clientDataJSONString.toByteArray(Charsets.UTF_8))
+            }
 
             // Metadata only: everything the response needs before signing (user
             // handle, derivation pins) is read without touching the private key.
@@ -591,7 +613,13 @@ class GetPasskeyActivity : AppCompatActivity() {
 
             val fullJson = JSONObject(fidoCredential.json())
             val respJson = fullJson.getJSONObject("response")
-            respJson.put("clientDataJSON", clientDataJSONb64)
+            // When a privileged browser's own hash was signed, our clientDataJSON
+            // is not what was signed (the browser supplies its own), so we do not
+            // attach it. For all app-bound callers we attach the clientDataJSON
+            // whose hash we signed.
+            if (!trustSystemHash) {
+                respJson.put("clientDataJSON", clientDataJSONb64)
+            }
             respJson.put("signature", signatureb64)
 
             // Add clientExtensionResults as seen in the example

package/android/src/main/java/co/algorand/passkeyautofill/credentials/CredentialRepository.kt

@@ -107,6 +107,24 @@ interface CredentialRepository {
     fun getOrigin(info: CallingAppInfo): String
     fun appInfoToOrigin(info: CallingAppInfo): String
 
+    /**
+     * The real web origin of a caller that is an allow-listed privileged
+     * browser (one holding `CREDENTIAL_MANAGER_SET_ORIGIN` and present in
+     * [privilegedAllowlist]), or `null` for every ordinary app.
+     *
+     * This is the only place a caller-asserted origin (and, by extension, a
+     * caller-supplied `clientDataHash`) may be trusted. It delegates to
+     * [CallingAppInfo.getOrigin], whose contract is:
+     *  - returns the web origin when the caller set one AND is on the allowlist;
+     *  - returns `null` when the caller set no origin (the common native case);
+     *  - throws [IllegalStateException] when a non-allow-listed caller tries to
+     *    assert an origin (a spoofing attempt), which we swallow into `null` so
+     *    the assertion falls back to the caller's `android:apk-key-hash:` origin.
+     *
+     * @param privilegedAllowlist the FIDO/GPM privileged-apps JSON allowlist.
+     */
+    fun getPrivilegedOrigin(info: CallingAppInfo, privilegedAllowlist: String): String?
+
     /**
      * The credential stored under `credentialId` WITH its private material
      * (`privateKey`), opening the biometric wrapper with `biometricCipher` when
@@ -1105,6 +1123,21 @@ class Repository() : CredentialRepository {
         return appInfoToOrigin(info)
     }
 
+    @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    override fun getPrivilegedOrigin(info: CallingAppInfo, privilegedAllowlist: String): String? {
+        return try {
+            info.getOrigin(privilegedAllowlist)
+        } catch (e: IllegalStateException) {
+            // A non-allow-listed caller asserted an origin: treat as spoofing
+            // and fall back to the app-bound origin.
+            PasskeyLog.w(CredentialRepository.TAG, "Caller asserted an origin but is not an allow-listed privileged browser; ignoring it")
+            null
+        } catch (e: Exception) {
+            PasskeyLog.w(CredentialRepository.TAG, "Failed to resolve privileged browser origin; treating caller as non-privileged", e)
+            null
+        }
+    }
+
     @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     override fun appInfoToOrigin(info: CallingAppInfo): String {
         val cert = info.signingInfo.apkContentsSigners[0].toByteArray()

package/android/src/main/java/co/algorand/passkeyautofill/service/PasskeyAutofillCredentialProviderService.kt

@@ -31,6 +31,7 @@ import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
 import co.algorand.passkeyautofill.credentials.RelyingParty
 import co.algorand.passkeyautofill.utils.PasskeyUtils
+import co.algorand.passkeyautofill.utils.PrivilegedBrowserAllowlist
 import android.util.Base64 as AndroidBase64
 import com.tencent.mmkv.MMKV
 import javax.crypto.Cipher
@@ -82,6 +83,10 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     ) {
         PasskeyLog.init(this)
         stampActivated(this)
+        // Opportunistically keep the privileged-browser allowlist current so a
+        // rotated-out (e.g. compromised) browser stops being trusted; never
+        // blocks this callback.
+        PrivilegedBrowserAllowlist.refreshIfStale(this)
         val response: BeginCreateCredentialResponse? = processCreateCredentialRequest(request)
         if (response != null) {
             callback.onResult(response)
@@ -170,6 +175,10 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     ) {
         PasskeyLog.init(this)
         stampActivated(this)
+        // Opportunistically keep the privileged-browser allowlist current so a
+        // rotated-out (e.g. compromised) browser stops being trusted; never
+        // blocks this callback.
+        PrivilegedBrowserAllowlist.refreshIfStale(this)
         try {
             val response = processGetCredentialRequest(request)
             callback.onResult(response)

package/android/src/main/java/co/algorand/passkeyautofill/utils/PrivilegedBrowserAllowlist.kt

@@ -0,0 +1,238 @@
+package co.algorand.passkeyautofill.utils
+
+import android.content.Context
+import co.algorand.passkeyautofill.R
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.launch
+import org.json.JSONObject
+import java.io.File
+import java.net.HttpURLConnection
+import java.net.URL
+
+/**
+ * Supplies the FIDO/GPM privileged-browser allowlist (Google's
+ * `gpm-passkeys-privileged-apps` list) to
+ * [co.algorand.passkeyautofill.credentials.CredentialRepository.getPrivilegedOrigin].
+ *
+ * The allowlist is the set of callers this provider is willing to treat as real
+ * browsers: only for a caller on this list will a request-supplied web origin
+ * and `clientDataHash` be trusted. Every other caller is bound to its own
+ * `android:apk-key-hash:` origin.
+ *
+ * ### Sourcing strategy
+ * The list is not static: Google adds/removes browsers over time (and an app
+ * that turns malicious can be rotated *out* of it). Bundling only a snapshot
+ * means such changes never reach an installed provider until it ships again, so
+ * this loader keeps a current copy at runtime while degrading safely:
+ *
+ *  1. a fresh cached download (younger than [TTL_MS]);
+ *  2. the last good download, even if stale;
+ *  3. the bundled `res/raw` snapshot as the guaranteed offline floor.
+ *
+ * [json] is on the latency-sensitive credential path, so it NEVER touches the
+ * network; it only reads cache/disk/bundle. [refreshIfStale] performs the
+ * actual download on a background scope and is meant to be called from the
+ * credential-provider callbacks; it validates the payload before replacing the
+ * cache and leaves the previous copy untouched on any failure.
+ *
+ * Staleness cuts both ways. A browser *added* after our copy was fetched just
+ * falls back to app-binding (safe). But a browser *removed* from Google's list
+ * (e.g. rotated out because it turned malicious) keeps being trusted until the
+ * cache refreshes, so [TTL_MS] is the revocation window and is kept short. A
+ * missing/unreadable list makes every caller non-privileged (safe default).
+ */
+object PrivilegedBrowserAllowlist {
+    private const val TAG = "PrivilegedAllowlist"
+
+    /**
+     * Google's published GPM privileged-apps allowlist. This is the same file
+     * bundled as `res/raw/gpm_privileged_browser_allowlist.json`, kept current
+     * here. `CallingAppInfo.getOrigin` consumes the raw JSON string, so a fresh
+     * download can be handed to it as-is.
+     */
+    private const val REMOTE_URL = "https://www.gstatic.com/gpm-passkeys-privileged-apps/apps.json"
+
+    /** Filename of the cached download inside the app's private `filesDir`. */
+    private const val CACHE_FILE_NAME = "gpm_privileged_browser_allowlist.json"
+
+    /**
+     * How long a downloaded copy is considered fresh (24 hours). This bounds how
+     * long a browser Google has removed from the list can still be trusted; the
+     * payload is ~30 KB, so refreshing daily is cheap.
+     */
+    private const val TTL_MS = 24L * 60 * 60 * 1000
+
+    private const val CONNECT_TIMEOUT_MS = 10_000
+    private const val READ_TIMEOUT_MS = 10_000
+
+    /** Guards against a runaway download producing an oversized in-memory string. */
+    private const val MAX_DOWNLOAD_BYTES = 1L * 1024 * 1024 // 1 MiB
+
+    /**
+     * Process-lifetime scope for refreshes. Deliberately not tied to the
+     * short-lived provider service, whose scope is cancelled in `onDestroy` and
+     * would otherwise abort a download mid-flight.
+     */
+    private val refreshScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    @Volatile
+    private var memoryCache: String? = null
+
+    @Volatile
+    private var refreshInProgress = false
+
+    /**
+     * The allowlist JSON to hand to `CallingAppInfo.getOrigin`, chosen in
+     * priority order: an already-resolved in-memory copy → a valid cached
+     * download → the bundled raw snapshot. Returns `null` only if every source
+     * fails, which makes every caller non-privileged (the safe, app-bound
+     * default).
+     *
+     * This never performs network I/O and is safe to call on the credential
+     * path.
+     */
+    fun json(context: Context): String? {
+        memoryCache?.let { return it }
+        return synchronized(this) {
+            memoryCache ?: run {
+                val resolved = readCacheFile(context) ?: readBundled(context)
+                memoryCache = resolved
+                resolved
+            }
+        }
+    }
+
+    /**
+     * Kicks off a background refresh when the cached download is missing or older
+     * than [TTL_MS]. Returns immediately and never blocks the credential flow;
+     * the download runs on a process-lifetime background scope. The result
+     * replaces the cache (and the in-memory copy) only if it
+     * validates, so a truncated/garbage response can never clobber a good copy
+     * (which would otherwise silently make every browser non-privileged).
+     *
+     * Intended to be called opportunistically from the credential-provider
+     * callbacks so the list stays current without a dedicated update job.
+     */
+    fun refreshIfStale(context: Context) {
+        if (!isCacheStale(context)) return
+        synchronized(this) {
+            if (refreshInProgress) return
+            refreshInProgress = true
+        }
+        val appContext = context.applicationContext
+        refreshScope.launch {
+            try {
+                val downloaded = download()
+                if (downloaded == null || !isValidAllowlist(downloaded)) {
+                    PasskeyLog.w(TAG, "Downloaded privileged allowlist missing or invalid; keeping previous copy")
+                    return@launch
+                }
+                writeCacheFile(appContext, downloaded)
+                memoryCache = downloaded
+                PasskeyLog.d(TAG, "Refreshed privileged browser allowlist from remote source")
+            } catch (e: Exception) {
+                PasskeyLog.w(TAG, "Failed to refresh privileged browser allowlist; keeping previous copy", e)
+            } finally {
+                synchronized(this@PrivilegedBrowserAllowlist) { refreshInProgress = false }
+            }
+        }
+    }
+
+    private fun cacheFile(context: Context) = File(context.filesDir, CACHE_FILE_NAME)
+
+    private fun isCacheStale(context: Context): Boolean {
+        val f = cacheFile(context)
+        if (!f.exists() || f.length() == 0L) return true
+        return (System.currentTimeMillis() - f.lastModified()) > TTL_MS
+    }
+
+    private fun readCacheFile(context: Context): String? {
+        return try {
+            val f = cacheFile(context)
+            if (!f.exists() || f.length() == 0L) return null
+            val text = f.readText()
+            if (isValidAllowlist(text)) {
+                text
+            } else {
+                PasskeyLog.w(TAG, "Cached privileged allowlist is invalid; falling back to bundled copy")
+                null
+            }
+        } catch (e: Exception) {
+            PasskeyLog.w(TAG, "Failed to read cached privileged allowlist; falling back to bundled copy", e)
+            null
+        }
+    }
+
+    private fun writeCacheFile(context: Context, text: String) {
+        val dst = cacheFile(context)
+        val tmp = File(context.filesDir, "$CACHE_FILE_NAME.tmp")
+        try {
+            tmp.writeText(text)
+            if (!tmp.renameTo(dst)) {
+                // Atomic rename failed (e.g. dst exists on some FS): overwrite.
+                dst.writeText(text)
+            }
+        } finally {
+            if (tmp.exists()) tmp.delete()
+        }
+    }
+
+    private fun readBundled(context: Context): String? {
+        return try {
+            context.resources
+                .openRawResource(R.raw.gpm_privileged_browser_allowlist)
+                .bufferedReader()
+                .use { it.readText() }
+        } catch (e: Exception) {
+            PasskeyLog.w(TAG, "Failed to load bundled privileged browser allowlist; all callers will be treated as non-privileged", e)
+            null
+        }
+    }
+
+    private fun download(): String? {
+        val conn = (URL(REMOTE_URL).openConnection() as HttpURLConnection).apply {
+            connectTimeout = CONNECT_TIMEOUT_MS
+            readTimeout = READ_TIMEOUT_MS
+            requestMethod = "GET"
+            setRequestProperty("Accept", "application/json")
+        }
+        return try {
+            val code = conn.responseCode
+            if (code != HttpURLConnection.HTTP_OK) {
+                PasskeyLog.w(TAG, "Privileged allowlist download returned HTTP $code")
+                return null
+            }
+            val bytes = conn.inputStream.buffered().use { input ->
+                val out = java.io.ByteArrayOutputStream()
+                val buf = ByteArray(8 * 1024)
+                var total = 0L
+                while (true) {
+                    val n = input.read(buf)
+                    if (n < 0) break
+                    total += n
+                    if (total > MAX_DOWNLOAD_BYTES) {
+                        PasskeyLog.w(TAG, "Privileged allowlist download exceeded size limit; discarding")
+                        return null
+                    }
+                    out.write(buf, 0, n)
+                }
+                out.toByteArray()
+            }
+            String(bytes, Charsets.UTF_8)
+        } finally {
+            conn.disconnect()
+        }
+    }
+
+    /** A well-formed allowlist parses as JSON with a non-empty `apps` array. */
+    private fun isValidAllowlist(text: String): Boolean {
+        return try {
+            val apps = JSONObject(text).optJSONArray("apps")
+            apps != null && apps.length() > 0
+        } catch (e: Exception) {
+            false
+        }
+    }
+}