@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.28 → 1.0.0-canary.29

package/ARCHITECTURE.md

@@ -45,7 +45,7 @@ The "Chain of Trust" ensures that passkeys are only used by the legitimate owner
 1.  **Digital Asset Links**: For a passkey to be used across a website and an Android app, the website must host a `/.well-known/assetlinks.json` file that explicitly authorizes the Android app (via its package name and certificate fingerprint). This establishes a cryptographically verified link between the web origin and the mobile application.
 2.  **Relying Party ID (rpId) Validation**: When the service receives a `BeginGetCredentialRequest` or `BeginCreateCredentialRequest`, it includes information about the `rpId` (e.g., `example.com`). The system verifies that the requesting app is authorized for that `rpId`; the provider then enforces credential scope itself (`credentials/RelyingParty.kt`): a get request is resolved to an effective RP ID (the request's `rpId`, else the calling app's `android:apk-key-hash:` origin), only credentials stored for that RP are offered as entries, and `GetPasskeyActivity` re-checks the selected credential against the request before any private material is loaded. A request that names no relying party gets no entries. Related Origin Requests are not supported.
 3.  **App Signature Verification**: The Android system verifies the signature of the app requesting the credential. It will only offer credentials to apps that can prove their identity through the Digital Asset Link chain.
-4.  **User Consent**: The `CredentialProviderService` does not directly return the credential. Instead, it returns a list of "Entries" (like `PublicKeyCredentialEntry`). When a user selects an entry, a `PendingIntent` is triggered, which typically launches an activity (like `GetPasskeyActivity`) to perform user verification (e.g., biometric check) before the actual passkey is released to the requesting app.
+4.  **User Consent**: The `CredentialProviderService` does not directly return the credential. Instead, it returns a list of "Entries" (like `PublicKeyCredentialEntry`). When a user selects an entry, a `PendingIntent` is triggered, which typically launches an activity (like `GetPasskeyActivity`) to perform user verification (e.g., biometric check) before the actual passkey is released to the requesting app. `GetPasskeyActivity` and `CreatePasskeyActivity` are not exported: they trust the extras they are started with (credential id, request JSON, calling-app info, the biometric result), so only the service's own `PendingIntent` may start them. `ManifestExportPolicyTest` keeps it that way.
 
 ### iOS Implementation (`ios/`) [WIP]
 

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+# [1.0.0-canary.29](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.28...v1.0.0-canary.29) (2026-09-30)
+
+### Bug Fixes
+
+- **android:** stop exporting the passkey activities ([dfb376e](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/dfb376e84aeef3fea36d742fa338dcefde153b3e))
+
 # [1.0.0-canary.28](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.27...v1.0.0-canary.28) (2026-09-29)
 
 ### Bug Fixes

package/android/src/main/AndroidManifest.xml

@@ -18,8 +18,12 @@
                 android:name="android.credentials.provider"
                 android:resource="@xml/provider" />
         </service>
-        <activity android:name="co.algorand.passkeyautofill.GetPasskeyActivity" 
-            android:exported="true" 
+        <!--
+          Not exported: both activities trust the extras they are started with, so only the
+          provider service's own PendingIntent (explicit component, this app's UID) may start them.
+        -->
+        <activity android:name="co.algorand.passkeyautofill.GetPasskeyActivity"
+            android:exported="false"
             android:launchMode="singleTop"
             android:theme="@style/Theme.PasskeyAutofill.Dialog">
             <intent-filter>
@@ -27,8 +31,8 @@
                 <category android:name="android.intent.category.DEFAULT"/>
             </intent-filter>
         </activity>
-        <activity android:name="co.algorand.passkeyautofill.CreatePasskeyActivity" 
-            android:exported="true" 
+        <activity android:name="co.algorand.passkeyautofill.CreatePasskeyActivity"
+            android:exported="false"
             android:launchMode="singleTop"
             android:theme="@style/Theme.PasskeyAutofill.Dialog">
             <intent-filter>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algorandfoundation/react-native-passkey-autofill",
-  "version": "1.0.0-canary.28",
+  "version": "1.0.0-canary.29",
   "description": "Passkey AutoFill React Native",
   "keywords": [
     "@algorandfoundation/react-native-passkey-autofill",