@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.4 → 1.0.0-canary.6

package/.eslintrc.js

@@ -2,4 +2,7 @@ module.exports = {
   root: true,
   extends: ['universe/native', 'universe/web'],
   ignorePatterns: ['build'],
+  rules: {
+    'node/handle-callback-err': 'off',
+  },
 };

package/.releaserc

@@ -0,0 +1,23 @@
+{
+  "branches": [
+    "release",
+    {
+      "name": "main",
+      "prerelease": "canary"
+    }
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    "@semantic-release/npm",
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["package.json", "CHANGELOG.md"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    "@semantic-release/github"
+  ]
+}

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# [1.0.0-canary.6](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.5...v1.0.0-canary.6) (2026-03-24)
+
+
+### Bug Fixes
+
+* include banner for package README ([60a6559](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/60a655932faac6de57daf0f30261f2d03a2c1476))
+
+# [1.0.0-canary.5](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.4...v1.0.0-canary.5) (2026-03-24)
+
+
+### Features
+
+* **android:** add allowed credentials mapping ([e7134fc](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/e7134fc1e5bf09649155e38010e4ef9728580812))
+* **android:** credential compatibility with system-provided clientDataHash and compact JSON ([428e96f](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/428e96f89b73cd35fdbfaa6669f39da68403e17e))

package/CONTRIBUTING.md

@@ -50,6 +50,16 @@ The project includes an example app in the `example/` directory. You can use it
 
 For more details on how the project is structured, see the [Architecture Guide](./ARCHITECTURE.md).
 
+### Testing
+
+Before submitting a Pull Request, ensure that both JavaScript and Native tests pass:
+
+```bash
+npm run test:all
+```
+
+For more details on the testing strategy, refer to the [Testing section in README.md](./README.md#🧪-testing).
+
 ## Submitting a Pull Request
 
 1. Create a new branch for your feature or bugfix:

package/README.md

@@ -1,7 +1,7 @@
 # @algorandfoundation/react-native-passkey-autofill
 
 <p align="center">
-  <img src="./example/assets/banner.png" width="100%" />
+  <img src="./assets/banner.png" width="100%" />
 </p>
 
 <p align="center">
@@ -66,6 +66,34 @@ await ReactNativePasskeyAutofill.configureIntentActions(
 await ReactNativePasskeyAutofill.clearCredentials();
 ```
 
+## 🧪 Testing
+
+The project is set up with a comprehensive testing approach covering both JavaScript and Native (Kotlin) sides.
+
+### JavaScript Tests
+Run unit tests for the TypeScript module using Jest:
+```bash
+npm test
+```
+
+### Native Android Tests
+Run unit tests for the Kotlin code using JUnit and Robolectric. These tests are executed via the example app's Gradle wrapper:
+```bash
+npm run test:android
+```
+
+### All Tests
+Run both JS and Native tests:
+```bash
+npm run test:all
+```
+
+### Continuous Integration (CI)
+The project includes a GitHub Actions workflow that automatically runs linting, JS tests, and Native Android tests on every push and pull request to the `main` or `release` branches. You can find the configuration in `.github/workflows/ci.yml`.
+
+### Integration Testing (E2E)
+For full end-to-end testing that covers the bridge between JavaScript and Native, we recommend using [Maestro](https://maestro.mobile.dev/). It provides a clean, YAML-based way to automate UI flows and verify the integration of the Passkey Autofill service with the system UI.
+
 ## 📱 Example App
 
 The [example](./example) app demonstrates how to integrate this module with a full wallet implementation.

package/android/build.gradle

@@ -27,6 +27,7 @@ if (useManagedAndroidSdkVersions) {
     defaultConfig {
       minSdkVersion safeExtGet("minSdkVersion", 24)
       targetSdkVersion safeExtGet("targetSdkVersion", 36)
+      testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
     }
   }
 }
@@ -43,6 +44,12 @@ android {
   kotlinOptions {
     freeCompilerArgs += ["-opt-in=kotlin.time.ExperimentalTime", "-opt-in=kotlin.RequiresOptIn"]
   }
+  testOptions {
+    unitTests.includeAndroidResources = true
+  }
+  packagingOptions {
+    pickFirst '**/libc++_shared.so'
+  }
 }
 
 dependencies {
@@ -59,6 +66,17 @@ dependencies {
   implementation fileTree(dir: 'libs', include: ['*.jar'])
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.0"
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.0"
+
+  // Testing dependencies
+  testImplementation "junit:junit:4.13.2"
+  testImplementation "org.robolectric:robolectric:4.11.1"
+  testImplementation "io.mockk:mockk:1.13.8"
+  testImplementation "org.jetbrains.kotlinx:kotlinx-coroutines-test:1.8.0"
+
+  androidTestImplementation "androidx.test:runner:1.5.2"
+  androidTestImplementation "androidx.test:rules:1.5.0"
+  androidTestImplementation "androidx.test.ext:junit:1.1.5"
+  androidTestImplementation "androidx.test.espresso:espresso-core:3.5.1"
 }
 
 repositories {

package/android/src/main/AndroidManifest.xml

@@ -6,7 +6,6 @@
             android:enabled="true"
             android:exported="true"
             android:label="@string/passkey_autofill_label"
-            android:icon="@mipmap/ic_launcher"
             android:permission="android.permission.BIND_CREDENTIAL_PROVIDER_SERVICE"
             tools:targetApi="upside_down_cake">
             <intent-filter>

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -266,25 +266,34 @@ class CreatePasskeyActivity : AppCompatActivity() {
             )
 
             val resultIntent = Intent()
-            val responseJson = JSONObject(fidoCredential.json())
-            val passkeyDetails = JSONObject()
-            
-            val ecPubKey = keyPair.public as java.security.interfaces.ECPublicKey
-            val ecPrivKey = keyPair.private as java.security.interfaces.ECPrivateKey
-            
-            fun to32(bi: java.math.BigInteger): ByteArray {
-                var ba = bi.toByteArray()
-                if (ba.size < 32) {
-                    ba = ByteArray(32 - ba.size) + ba
+            val fullJson = JSONObject(fidoCredential.json())
+            val respJson = fullJson.getJSONObject("response")
+
+            // Ensure compact clientDataJSON for registration too
+            val sanitizedOrigin = credentialRepository.getOrigin(req.callingAppInfo).replace(Regex("/$"), "")
+            val challenge = if (requestJson.has("publicKey")) {
+                requestJson.getJSONObject("publicKey").getString("challenge")
+            } else {
+                requestJson.getString("challenge")
+            }
+
+            val clientDataJSONString = if (sanitizedOrigin.startsWith("https://") || sanitizedOrigin.startsWith("http://")) {
+                "{\"type\":\"webauthn.create\",\"challenge\":\"$challenge\",\"origin\":\"$sanitizedOrigin\",\"crossOrigin\":false}"
+            } else {
+                val json = JSONObject()
+                json.put("type", "webauthn.create")
+                json.put("challenge", challenge)
+                json.put("origin", sanitizedOrigin)
+                json.put("crossOrigin", false)
+                if (sanitizedOrigin.startsWith("android:apk-key-hash:")) {
+                    json.put("androidPackageName", req.callingAppInfo.packageName)
                 }
-                return ba.copyOfRange(ba.size - 32, ba.size)
+                json.toString()
             }
-            
-            val x = to32(ecPubKey.w.affineX)
-            val y = to32(ecPubKey.w.affineY)
-            val s = to32(ecPrivKey.s)
+            val clientDataJSONb64 = AndroidBase64.encodeToString(clientDataJSONString.toByteArray(), AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
+            respJson.put("clientDataJSON", clientDataJSONb64)
 
-            val createResponse = CreatePublicKeyCredentialResponse(responseJson.toString())
+            val createResponse = CreatePublicKeyCredentialResponse(fullJson.toString())
             
             PendingIntentHandler.setCreateCredentialResponse(
                 resultIntent,

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -229,17 +229,31 @@ class GetPasskeyActivity : AppCompatActivity() {
             }
             val sanitizedOrigin = origin.replace(Regex("/$"), "")
 
-            val clientDataJSON = JSONObject()
-            clientDataJSON.put("type", "webauthn.get")
-            clientDataJSON.put("challenge", challenge)
-            clientDataJSON.put("origin", sanitizedOrigin)
-            clientDataJSON.put("crossOrigin", false)
-            if (sanitizedOrigin.startsWith("android:apk-key-hash:")) {
-                clientDataJSON.put("androidPackageName", req.callingAppInfo.packageName)
+            // Look for system-provided clientDataHash (e.g. from Chrome)
+            val systemClientDataHash = run {
+                val option = req.credentialOptions.find { opt ->
+                    opt is GetPublicKeyCredentialOption && (opt.requestJson == rawRequestJson || 
+                        try { JSONObject(opt.requestJson).toString() == JSONObject(rawRequestJson!!).toString() } catch(e: Exception) { false })
+                } as? GetPublicKeyCredentialOption
+                option?.requestData?.getByteArray("androidx.credentials.BUNDLE_KEY_CLIENT_DATA_HASH")
             }
 
-            val clientDataJSONString = clientDataJSON.toString()
-            val clientDataHash = MessageDigest.getInstance("SHA-256").digest(clientDataJSONString.toByteArray(Charsets.UTF_8))
+            val clientDataJSONString = if (sanitizedOrigin.startsWith("https://") || sanitizedOrigin.startsWith("http://")) {
+                // Compact JSON for web origins to match browser hashing (no spaces, specific order)
+                "{\"type\":\"webauthn.get\",\"challenge\":\"$challenge\",\"origin\":\"$sanitizedOrigin\",\"crossOrigin\":false}"
+            } else {
+                val json = JSONObject()
+                json.put("type", "webauthn.get")
+                json.put("challenge", challenge)
+                json.put("origin", sanitizedOrigin)
+                json.put("crossOrigin", false)
+                if (sanitizedOrigin.startsWith("android:apk-key-hash:")) {
+                    json.put("androidPackageName", req.callingAppInfo.packageName)
+                }
+                json.toString()
+            }
+
+            val clientDataHash = systemClientDataHash ?: MessageDigest.getInstance("SHA-256").digest(clientDataJSONString.toByteArray(Charsets.UTF_8))
 
             val dbCred = credentialRepository.getCredential(this, credId)
                 ?: throw IllegalStateException("Credential not found")

package/android/src/main/java/co/algorand/passkeyautofill/service/PasskeyAutofillCredentialProviderService.kt

@@ -26,8 +26,10 @@ import androidx.credentials.provider.ProviderClearCredentialStateRequest
 import androidx.credentials.provider.PublicKeyCredentialEntry
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
+import co.algorand.passkeyautofill.utils.PasskeyUtils
 import com.tencent.mmkv.MMKV
 import kotlinx.coroutines.*
+import org.json.JSONArray
 import org.json.JSONObject
 
 @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@@ -127,7 +129,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     /**
      * Fake a list of available PublicKeyCredential Entries
      */
-    private fun processGetCredentialRequest(request: BeginGetCredentialRequest): BeginGetCredentialResponse{
+    private fun processGetCredentialRequest(request: BeginGetCredentialRequest): BeginGetCredentialResponse {
         // Ensure we have a master key available. If not, we can't sign anything, so don't show entries.
         if (!credentialRepository.isMasterKeyAvailable(this)) {
             return BeginGetCredentialResponse(emptyList())
@@ -138,42 +140,66 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         }
 
         val action = credentialRepository.getGetPasskeyAction(this) ?: DEFAULT_GET_PASSKEY_ACTION
+        val allEntries = mutableListOf<PublicKeyCredentialEntry>()
 
-        val entries = credentials.mapNotNull { credential ->
-            try {
-                // Find suitable option for this entry
-                val option = request.beginGetCredentialOptions.find { opt -> 
-                    if (opt !is BeginGetPublicKeyCredentialOption) return@find false
-                    
-                    // In a real app, we'd check if this credential's origin matches the request's origin
-                    // For now, we return all credentials that match the requested type.
-                    true
-                } as? BeginGetPublicKeyCredentialOption
-
-                if (option == null) {
-                    return@mapNotNull null
-                }
+        for (option in request.beginGetCredentialOptions) {
+            if (option !is BeginGetPublicKeyCredentialOption) continue
 
-                val data = Bundle()
-                data.putString("credentialId", credential.credentialId)
-                data.putString("userHandle", credential.userHandle)
-                data.putString("requestJson", option.requestJson)
-
-                PublicKeyCredentialEntry.Builder(
-                    this@PasskeyAutofillCredentialProviderService,
-                    credential.userHandle,
-                    createNewPendingIntent(action, GET_PASSKEY_INTENT, data),
-                    option
-                )
-                    .setIcon(Icon.createWithResource(this@PasskeyAutofillCredentialProviderService, android.R.drawable.ic_lock_lock))
-                    .build()
+            val requestJsonStr = option.requestJson
+            var allowCredentials: JSONArray? = null
+            try {
+                val json = JSONObject(requestJsonStr)
+                val pk = if (json.has("publicKey")) json.getJSONObject("publicKey") else json
+                allowCredentials = pk.optJSONArray("allowCredentials")
             } catch (e: Exception) {
-                Log.e(TAG, "Error building PublicKeyCredentialEntry", e)
+                Log.e(TAG, "Error parsing requestJson", e)
+            }
+
+            val allowedIds = if (allowCredentials != null && allowCredentials.length() > 0) {
+                val ids = mutableSetOf<String>()
+                for (i in 0 until allowCredentials.length()) {
+                    ids.add(allowCredentials.getJSONObject(i).getString("id"))
+                }
+                ids
+            } else {
                 null
             }
+
+            for (credential in credentials) {
+                if (allowedIds != null) {
+                    val isAllowed = allowedIds.any { allowedId ->
+                        allowedId == credential.credentialId ||
+                        PasskeyUtils.normalizeBase64(allowedId) == PasskeyUtils.normalizeBase64(credential.credentialId)
+                    }
+                    if (!isAllowed) continue
+                }
+
+                try {
+                    val data = Bundle()
+                    data.putString("credentialId", credential.credentialId)
+                    data.putString("userHandle", credential.userHandle)
+                    data.putString("requestJson", option.requestJson)
+
+                    // Use a unique requestCode for each PendingIntent to avoid data being overwritten
+                    val uniqueRequestCode = (credential.credentialId + option.requestJson).hashCode()
+
+                    val entry = PublicKeyCredentialEntry.Builder(
+                        this,
+                        credential.userHandle,
+                        createNewPendingIntent(action, uniqueRequestCode, data),
+                        option
+                    )
+                        .setIcon(Icon.createWithResource(this, android.R.drawable.ic_lock_lock))
+                        .build()
+                    allEntries.add(entry)
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error building PublicKeyCredentialEntry", e)
+                }
+            }
         }
-        return BeginGetCredentialResponse(entries)
+        return BeginGetCredentialResponse(allEntries)
     }
+
     override fun onClearCredentialStateRequest(
         request: ProviderClearCredentialStateRequest,
         cancellationSignal: CancellationSignal,
@@ -186,12 +212,17 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
     private fun createNewPendingIntent(action: String, requestCode: Int, extra: Bundle?): PendingIntent{
         MMKV.initialize(this)
         val intent = Intent(action)
-        // Set component to be explicit to this library's activities
-        val componentName = when(requestCode) {
-            GET_PASSKEY_INTENT -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.GetPasskeyActivity")
-            CREATE_PASSKEY_INTENT -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.CreatePasskeyActivity")
+
+        // Determine component based on action instead of requestCode
+        val getAction = credentialRepository.getGetPasskeyAction(this) ?: DEFAULT_GET_PASSKEY_ACTION
+        val createAction = credentialRepository.getCreatePasskeyAction(this) ?: DEFAULT_CREATE_PASSKEY_ACTION
+
+        val componentName = when(action) {
+            getAction -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.GetPasskeyActivity")
+            createAction -> android.content.ComponentName(packageName, "co.algorand.passkeyautofill.CreatePasskeyActivity")
             else -> null
         }
+
         if (componentName != null) {
             intent.component = componentName
         } else {

package/android/src/main/java/co/algorand/passkeyautofill/utils/PasskeyUtils.kt

@@ -0,0 +1,7 @@
+package co.algorand.passkeyautofill.utils
+
+object PasskeyUtils {
+    fun normalizeBase64(s: String): String {
+        return s.replace("-", "+").replace("_", "/").replace("=", "")
+    }
+}

package/ios/ReactNativePasskeyAutofillModule.swift

@@ -10,26 +10,25 @@ public class ReactNativePasskeyAutofillModule: Module {
     // The module will be accessible from `requireNativeModule('ReactNativePasskeyAutofill')` in JavaScript.
     Name("ReactNativePasskeyAutofill")
 
-    // Defines constant property on the module.
-    Constant("PI") {
-      Double.pi
+    AsyncFunction("setMasterKey") { (secret: String) in
+      // TODO: Implement for iOS
     }
 
-    // Defines event names that the module can send to JavaScript.
-    Events("onChange")
+    AsyncFunction("setHdRootKeyId") { (id: String) in
+      // TODO: Implement for iOS
+    }
+
+    AsyncFunction("getHdRootKeyId") { () -> String? in
+      // TODO: Implement for iOS
+      return nil
+    }
 
-    // Defines a JavaScript synchronous function that runs the native code on the JavaScript thread.
-    Function("hello") {
-      return "Hello world! 👋"
+    AsyncFunction("clearCredentials") {
+      // TODO: Implement for iOS
     }
 
-    // Defines a JavaScript function that always returns a Promise and whose native code
-    // is by default dispatched on the different thread than the JavaScript runtime runs on.
-    AsyncFunction("setValueAsync") { (value: String) in
-      // Send an event to JavaScript.
-      self.sendEvent("onChange", [
-        "value": value
-      ])
+    AsyncFunction("configureIntentActions") { (getPasskeyAction: String, createPasskeyAction: String) in
+      // TODO: Implement for iOS
     }
 
     // Enables the module to be used as a native view. Definition components that are accepted as part of the

package/lefthook.yml

@@ -0,0 +1,13 @@
+# Lefthook configuration
+# Refer to https://github.com/evilmartians/lefthook/blob/master/docs/configuration.md
+
+pre-commit:
+  commands:
+    lint:
+      run: npm run lint
+
+pre-push:
+  parallel: true
+  commands:
+    test:
+      run: npm run test:all

package/package.json

@@ -1,18 +1,22 @@
 {
   "name": "@algorandfoundation/react-native-passkey-autofill",
-  "version": "1.0.0-canary.4",
+  "version": "1.0.0-canary.6",
   "description": "Passkey AutoFill React Native",
   "main": "build/index.js",
   "types": "build/index.d.ts",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "scripts": {
     "build": "expo-module build",
     "clean": "expo-module clean",
-    "lint": "expo-module lint",
-    "test": "expo-module test",
-    "prepare": "expo-module prepare",
+    "lint": "ESLINT_USE_FLAT_CONFIG=false expo-module lint",
+    "test": "CI=true expo-module test",
+    "test:android": "cd example/android && ./gradlew :algorandfoundation-react-native-passkey-autofill:testDebugUnitTest --no-daemon",
+    "test:android:instrumented": "cd example/android && ./gradlew :algorandfoundation-react-native-passkey-autofill:connectedDebugAndroidTest --no-daemon",
+    "test:all": "npm run test && npm run test:android",
+    "prepare": "expo-module prepare && npx lefthook install",
     "prepublishOnly": "expo-module prepublishOnly",
     "expo-module": "expo-module",
     "open:ios": "xed example/ios",
@@ -24,22 +28,38 @@
     "@algorandfoundation/react-native-passkey-autofill",
     "ReactNativePasskeyAutofill"
   ],
-  "repository": "https://github.com/algorandfoundation/react-native-passkey-autofill",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/algorandfoundation/react-native-passkey-autofill.git"
+  },
   "bugs": {
     "url": "https://github.com/algorandfoundation/react-native-passkey-autofill/issues"
   },
-  "author": "Algorand Foundation <michael.feher@algorand.foundation> (https://github.com/algorandfoundation)",
+  "author": "Algorand Foundation",
   "license": "Apache-2.0",
   "homepage": "https://github.com/algorandfoundation/react-native-passkey-autofill#readme",
   "dependencies": {
     "@algorandfoundation/react-native-keystore": "^1.0.0-canary.6"
   },
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node",
+    "testMatch": [
+      "<rootDir>/src/**/__tests__/**/*.test.ts"
+    ]
+  },
   "devDependencies": {
     "@expo/config-plugins": "^9.0.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.5",
     "@types/react": "~19.1.1",
     "expo": "^55.0.1",
     "expo-module-scripts": "^55.0.2",
-    "react-native": "0.82.1"
+    "lefthook": "^2.1.4",
+    "react-native": "0.82.1",
+    "semantic-release": "^25.0.3"
   },
   "peerDependencies": {
     "expo": "*",