@authon/react-native-wallet 0.0.0-stage → 0.1.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Bytes.kt

@@ -0,0 +1,74 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Bytes.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.security.MessageDigest
+import java.security.SecureRandom
+import java.util.Base64
+
+internal object Bytes {
+    private val random = SecureRandom()
+
+    fun utf8(value: String): ByteArray = value.toByteArray(Charsets.UTF_8)
+
+    fun toBase64(bytes: ByteArray): String = Base64.getEncoder().encodeToString(bytes)
+
+    /** Accepts standard and URL-safe alphabets, with or without padding (like the frame's atob path). */
+    fun fromBase64(value: String): ByteArray {
+        val normalized = value.replace('-', '+').replace('_', '/').trimEnd('=')
+        return try {
+            Base64.getDecoder().decode(normalized.padEnd((normalized.length + 3) / 4 * 4, '='))
+        } catch (e: IllegalArgumentException) {
+            throw WalletException(WalletErrorCode.INVALID_REQUEST, "invalid base64", e)
+        }
+    }
+
+    fun toBase64Url(bytes: ByteArray): String = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
+
+    fun toHex(bytes: ByteArray): String {
+        val out = StringBuilder(bytes.size * 2)
+        for (b in bytes) {
+            val v = b.toInt() and 0xff
+            out.append(HEX[v ushr 4]).append(HEX[v and 0x0f])
+        }
+        return out.toString()
+    }
+
+    /** Hex with or without 0x; null when malformed. */
+    fun fromHexOrNull(value: String): ByteArray? {
+        val body = if (value.startsWith("0x") || value.startsWith("0X")) value.substring(2) else value
+        if (body.length % 2 != 0) return null
+        val out = ByteArray(body.length / 2)
+        for (i in out.indices) {
+            val hi = Character.digit(body[i * 2], 16)
+            val lo = Character.digit(body[i * 2 + 1], 16)
+            if (hi < 0 || lo < 0) return null
+            out[i] = ((hi shl 4) or lo).toByte()
+        }
+        return out
+    }
+
+    fun fromHex(value: String): ByteArray =
+        fromHexOrNull(value) ?: throw WalletException(WalletErrorCode.INVALID_REQUEST, "invalid hex")
+
+    fun concat(vararg parts: ByteArray): ByteArray {
+        val out = ByteArray(parts.sumOf { it.size })
+        var offset = 0
+        for (p in parts) {
+            p.copyInto(out, offset)
+            offset += p.size
+        }
+        return out
+    }
+
+    fun randomBytes(length: Int): ByteArray = ByteArray(length).also { random.nextBytes(it) }
+
+    fun wipe(vararg buffers: ByteArray?) {
+        for (b in buffers) b?.fill(0)
+    }
+
+    fun sha256(data: ByteArray): ByteArray = MessageDigest.getInstance("SHA-256").digest(data)
+
+    fun sameBytes(a: ByteArray, b: ByteArray): Boolean = MessageDigest.isEqual(a, b)
+
+    private const val HEX = "0123456789abcdef"
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/CredentialManagerPasskeys.kt

@@ -0,0 +1,192 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/CredentialManagerPasskeys.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.app.Activity
+import androidx.credentials.CreatePublicKeyCredentialRequest
+import androidx.credentials.CreatePublicKeyCredentialResponse
+import androidx.credentials.CredentialManager
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.GetPublicKeyCredentialOption
+import androidx.credentials.PublicKeyCredential
+import androidx.credentials.exceptions.CreateCredentialCancellationException
+import androidx.credentials.exceptions.CreateCredentialException
+import androidx.credentials.exceptions.CreateCredentialProviderConfigurationException
+import androidx.credentials.exceptions.CreateCredentialUnsupportedException
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+import androidx.credentials.exceptions.domerrors.DomError
+import androidx.credentials.exceptions.domerrors.NotAllowedError
+import androidx.credentials.exceptions.domerrors.NotSupportedError
+import androidx.credentials.exceptions.domerrors.SecurityError
+import androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException
+import androidx.credentials.exceptions.publickeycredential.GetPublicKeyCredentialDomException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.addJsonObject
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.put
+import kotlinx.serialization.json.putJsonArray
+import kotlinx.serialization.json.putJsonObject
+
+/**
+ * Backup passkeys through Credential Manager with WebAuthn JSON for RP `wallet.authon.dev`
+ * (the same RP as the web frame, so synced passkeys restore on either side). PRF is requested with
+ * `extensions.prf.eval.first` and read from `clientExtensionResults.prf.results.first`.
+ *
+ * The app must be listed in the RP's Digital Asset Links (`get_login_creds`), which the API
+ * publishes only for approved app registrations.
+ */
+class CredentialManagerPasskeys(
+    private val activityProvider: () -> Activity?,
+    private val rpId: String = WalletApi.DEFAULT_RP_ID,
+) : PasskeyProvider {
+
+    private fun activity(): Activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+        ?: throw walletError(WalletErrorCode.INTERNAL, "no foreground activity for the passkey prompt")
+
+    override suspend fun create(userId: ByteArray, userName: String, salt: ByteArray): PasskeyCreateResult {
+        val request = buildJsonObject {
+            put("challenge", Bytes.toBase64Url(Bytes.randomBytes(32)))
+            putJsonObject("rp") {
+                put("id", rpId)
+                put("name", "Authon Wallet")
+            }
+            putJsonObject("user") {
+                put("id", Bytes.toBase64Url(userId))
+                put("name", userName)
+                put("displayName", userName)
+            }
+            putJsonArray("pubKeyCredParams") {
+                for (alg in listOf(-7, -257, -8)) addJsonObject {
+                    put("type", "public-key")
+                    put("alg", alg)
+                }
+            }
+            put("attestation", "none")
+            putJsonObject("authenticatorSelection") {
+                put("residentKey", "preferred")
+                put("userVerification", "required")
+            }
+            prfExtension(salt)
+        }
+        val activity = activity()
+        val response = try {
+            withContext(Dispatchers.Main) {
+                CredentialManager.create(activity).createCredential(activity, CreatePublicKeyCredentialRequest(request.toString()))
+            }
+        } catch (e: CreateCredentialException) {
+            throw mapCreate(e)
+        }
+        val json = (response as? CreatePublicKeyCredentialResponse)?.registrationResponseJson
+            ?: throw walletError(WalletErrorCode.INTERNAL, "unexpected credential response")
+        val cred = Json.parseToJsonElement(json) as JsonObject
+        val ext = cred["clientExtensionResults"] as? JsonObject
+        val prf = ext?.get("prf") as? JsonObject
+        if (prf == null || (prf["enabled"] as? JsonPrimitive)?.booleanOrNull == false) throw walletError(WalletErrorCode.PRF_UNSUPPORTED)
+        val credentialId = normalize(cred.str("rawId") ?: cred.str("id") ?: throw walletError(WalletErrorCode.INTERNAL, "credential id missing"))
+        val resp = cred["response"] as? JsonObject ?: JsonObject(emptyMap())
+        val alg = (resp["publicKeyAlgorithm"] as? JsonPrimitive)?.intOrNull
+        val spki = resp.str("publicKey")?.takeIf { alg == -7 || alg == -257 || alg == -8 }?.let { normalize(it) }
+        val attestation = resp.str("attestationObject")?.let { normalize(it) }
+        val direct = prfFirst(prf)
+        val prfOutput = direct ?: get(credentialId, salt, null).prfOutput
+        return PasskeyCreateResult(credentialId, prfOutput, spki, if (spki != null) alg else null, attestation)
+    }
+
+    override suspend fun get(credentialId: String, salt: ByteArray, challenge: ByteArray?): PasskeyGetResult {
+        val request = buildJsonObject {
+            put("challenge", Bytes.toBase64Url(challenge ?: Bytes.randomBytes(32)))
+            put("rpId", rpId)
+            putJsonArray("allowCredentials") {
+                addJsonObject {
+                    put("type", "public-key")
+                    put("id", normalize(credentialId))
+                }
+            }
+            put("userVerification", "required")
+            prfExtension(salt)
+        }
+        val activity = activity()
+        val result = try {
+            withContext(Dispatchers.Main) {
+                CredentialManager.create(activity).getCredential(
+                    activity,
+                    GetCredentialRequest(listOf(GetPublicKeyCredentialOption(request.toString()))),
+                )
+            }
+        } catch (e: GetCredentialException) {
+            throw mapGet(e)
+        }
+        val json = (result.credential as? PublicKeyCredential)?.authenticationResponseJson
+            ?: throw walletError(WalletErrorCode.INTERNAL, "unexpected credential response")
+        val cred = Json.parseToJsonElement(json) as JsonObject
+        val prf = (cred["clientExtensionResults"] as? JsonObject)?.get("prf") as? JsonObject
+        val out = prf?.let { prfFirst(it) } ?: throw walletError(WalletErrorCode.PRF_UNSUPPORTED)
+        val resp = cred["response"] as? JsonObject ?: JsonObject(emptyMap())
+        fun field(name: String) = resp.str(name)?.let { normalize(it) } ?: ""
+        return PasskeyGetResult(
+            out,
+            PasskeyAssertion(
+                credentialId = normalize(cred.str("rawId") ?: cred.str("id") ?: credentialId),
+                clientDataJSON = field("clientDataJSON"),
+                authenticatorData = field("authenticatorData"),
+                signature = field("signature"),
+            ),
+        )
+    }
+
+    private fun kotlinx.serialization.json.JsonObjectBuilder.prfExtension(salt: ByteArray) {
+        putJsonObject("extensions") {
+            putJsonObject("prf") {
+                putJsonObject("eval") { put("first", Bytes.toBase64Url(salt)) }
+            }
+        }
+    }
+
+    private fun prfFirst(prf: JsonObject): ByteArray? {
+        val first = ((prf["results"] as? JsonObject)?.get("first") as? JsonPrimitive)?.contentOrNull ?: return null
+        val bytes = runCatching { Bytes.fromBase64(first) }.getOrNull() ?: return null
+        return bytes.takeIf { it.size == 32 }
+    }
+
+    private fun normalize(b64: String): String = Bytes.toBase64Url(Bytes.fromBase64(b64))
+
+    private fun JsonObject.str(k: String) = (this[k] as? JsonPrimitive)?.takeIf { it.isString }?.content
+
+    private fun mapDom(error: DomError, cause: Exception): WalletException = when (error) {
+        is NotAllowedError -> WalletException(WalletErrorCode.USER_CANCELLED, cause.message, cause)
+        is SecurityError -> WalletException(
+            WalletErrorCode.ORIGIN_NOT_ALLOWED,
+            "this app is not linked to $rpId (Digital Asset Links): ${cause.message}",
+            cause,
+        )
+        is NotSupportedError -> WalletException(WalletErrorCode.PRF_UNSUPPORTED, cause.message, cause)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", cause)
+    }
+
+    private fun mapCreate(e: CreateCredentialException): WalletException = when (e) {
+        is CreateCredentialCancellationException -> WalletException(WalletErrorCode.USER_CANCELLED, e.message, e)
+        is CreateCredentialUnsupportedException, is CreateCredentialProviderConfigurationException ->
+            WalletException(WalletErrorCode.PRF_UNSUPPORTED, e.message, e)
+        is CreatePublicKeyCredentialDomException -> mapDom(e.domError, e)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", e)
+    }
+
+    private fun mapGet(e: GetCredentialException): WalletException = when (e) {
+        is GetCredentialCancellationException -> WalletException(WalletErrorCode.USER_CANCELLED, e.message, e)
+        is NoCredentialException -> WalletException(WalletErrorCode.USER_CANCELLED, "no matching backup passkey", e)
+        is GetCredentialUnsupportedException, is GetCredentialProviderConfigurationException ->
+            WalletException(WalletErrorCode.PRF_UNSUPPORTED, e.message, e)
+        is GetPublicKeyCredentialDomException -> mapDom(e.domError, e)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", e)
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/DeviceStore.kt

@@ -0,0 +1,170 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/DeviceStore.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.math.BigInteger
+import java.security.KeyPairGenerator
+import java.security.PrivateKey
+import java.security.Signature
+import java.security.interfaces.ECPublicKey
+import java.security.spec.ECGenParameterSpec
+import java.util.concurrent.ConcurrentHashMap
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+class SealedShare(val iv: ByteArray, val ciphertext: ByteArray)
+
+/**
+ * The non-exportable keys of one device record: a P-256 signing key (its public JWK is registered
+ * with the API) and an AES-256-GCM key that seals the device share D.
+ */
+interface DeviceKeys {
+    /** Identifies the keys inside their store (e.g. the Keystore alias prefix). */
+    val handle: String
+    val publicJwk: DevicePublicJwk
+
+    /** ECDSA P-256 / SHA-256 over [data]; raw r||s (64 bytes) like WebCrypto. */
+    fun sign(data: ByteArray): ByteArray
+
+    fun seal(plain: ByteArray, aad: ByteArray): SealedShare
+
+    fun open(sealed: SealedShare, aad: ByteArray): ByteArray
+}
+
+data class DeviceRecord(
+    /** `projectId \0 userId`. */
+    val key: String,
+    val keys: DeviceKeys,
+    val iv: ByteArray,
+    val ciphertext: ByteArray,
+    val deviceId: String,
+    val walletId: String,
+    val address: String,
+    val shareVersion: Int,
+    val createdAt: Long,
+)
+
+/** Where the device share lives. Only D (sealed) and key references are stored; never k, A or B. */
+interface DeviceStore {
+    suspend fun generateKeys(): DeviceKeys
+
+    /** Removes keys that never made it into a stored record. */
+    suspend fun discardKeys(keys: DeviceKeys)
+
+    suspend fun get(key: String): DeviceRecord?
+
+    /** Replaces the record for [DeviceRecord.key]; keys of a replaced record are removed. */
+    suspend fun put(record: DeviceRecord)
+
+    suspend fun delete(key: String)
+}
+
+internal object DeviceStorage {
+    fun storageKey(projectId: String, userId: String): String = "$projectId\u0000$userId"
+
+    /** DER ECDSA signature -> raw r||s, each left-padded to [size] bytes. */
+    fun derToRaw(der: ByteArray, size: Int = 32): ByteArray {
+        var i = 0
+        fun readLen(): Int {
+            var len = der[i++].toInt() and 0xff
+            if (len and 0x80 != 0) {
+                val n = len and 0x7f
+                len = 0
+                repeat(n) { len = (len shl 8) or (der[i++].toInt() and 0xff) }
+            }
+            return len
+        }
+        require(der[i++].toInt() == 0x30) { "not a DER sequence" }
+        readLen()
+        fun readInt(): ByteArray {
+            require(der[i++].toInt() == 0x02) { "not a DER integer" }
+            val len = readLen()
+            val v = der.copyOfRange(i, i + len)
+            i += len
+            return v
+        }
+        val r = readInt()
+        val s = readInt()
+        val out = ByteArray(size * 2)
+        fun place(v: ByteArray, offset: Int) {
+            val trimmed = v.dropWhile { it.toInt() == 0 }.toByteArray()
+            require(trimmed.size <= size) { "integer too long" }
+            trimmed.copyInto(out, offset + size - trimmed.size)
+        }
+        place(r, 0)
+        place(s, size)
+        return out
+    }
+
+    fun unsigned32(v: BigInteger): ByteArray {
+        val raw = v.toByteArray()
+        val trimmed = if (raw.size > 32) raw.copyOfRange(raw.size - 32, raw.size) else raw
+        return ByteArray(32 - trimmed.size) + trimmed
+    }
+
+    fun jwkOf(key: ECPublicKey): DevicePublicJwk =
+        DevicePublicJwk(Bytes.toBase64Url(unsigned32(key.w.affineX)), Bytes.toBase64Url(unsigned32(key.w.affineY)))
+
+    fun gcmSeal(key: SecretKey, plain: ByteArray, aad: ByteArray, iv: ByteArray? = null): SealedShare {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        if (iv == null) cipher.init(Cipher.ENCRYPT_MODE, key) else cipher.init(Cipher.ENCRYPT_MODE, key, GCMParameterSpec(128, iv))
+        cipher.updateAAD(aad)
+        val ct = cipher.doFinal(plain)
+        return SealedShare(cipher.iv, ct)
+    }
+
+    fun gcmOpen(key: SecretKey, sealed: SealedShare, aad: ByteArray): ByteArray {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, sealed.iv))
+        cipher.updateAAD(aad)
+        return cipher.doFinal(sealed.ciphertext)
+    }
+}
+
+/**
+ * In-memory store with software JCA keys. For JVM tests and emulators only: nothing survives the
+ * process and the keys are not hardware-backed.
+ */
+class InMemoryDeviceStore : DeviceStore {
+    private val records = ConcurrentHashMap<String, DeviceRecord>()
+    private var counter = 0
+
+    private class SoftwareKeys(override val handle: String) : DeviceKeys {
+        private val signKey: PrivateKey
+        private val aesKey: SecretKey = KeyGenerator.getInstance("AES").apply { init(256) }.generateKey()
+        override val publicJwk: DevicePublicJwk
+
+        init {
+            val pair = KeyPairGenerator.getInstance("EC").apply { initialize(ECGenParameterSpec("secp256r1")) }.generateKeyPair()
+            signKey = pair.private
+            publicJwk = DeviceStorage.jwkOf(pair.public as ECPublicKey)
+        }
+
+        override fun sign(data: ByteArray): ByteArray {
+            val s = Signature.getInstance("SHA256withECDSA")
+            s.initSign(signKey)
+            s.update(data)
+            return DeviceStorage.derToRaw(s.sign())
+        }
+
+        override fun seal(plain: ByteArray, aad: ByteArray): SealedShare =
+            DeviceStorage.gcmSeal(aesKey, plain, aad, Bytes.randomBytes(12))
+
+        override fun open(sealed: SealedShare, aad: ByteArray): ByteArray = DeviceStorage.gcmOpen(aesKey, sealed, aad)
+    }
+
+    override suspend fun generateKeys(): DeviceKeys = synchronized(this) { SoftwareKeys("mem-${++counter}") }
+
+    override suspend fun discardKeys(keys: DeviceKeys) = Unit
+
+    override suspend fun get(key: String): DeviceRecord? = records[key]
+
+    override suspend fun put(record: DeviceRecord) {
+        records[record.key] = record
+    }
+
+    override suspend fun delete(key: String) {
+        records.remove(key)
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/DialogWalletApprover.kt

@@ -0,0 +1,141 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/DialogWalletApprover.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.app.Activity
+import android.app.AlertDialog
+import android.content.Context
+import android.graphics.Color
+import android.graphics.Typeface
+import android.hardware.biometrics.BiometricManager
+import android.hardware.biometrics.BiometricPrompt
+import android.os.Build
+import android.os.CancellationSignal
+import android.util.TypedValue
+import android.view.ViewGroup
+import android.widget.LinearLayout
+import android.widget.ScrollView
+import android.widget.TextView
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.withContext
+import kotlin.coroutines.resume
+
+/**
+ * Default approval UI: a platform AlertDialog with the summary (rows, warnings, the full text).
+ * "Sign" is enabled only after the text was scrolled to the end, like the web approval card.
+ */
+class DialogWalletApprover(private val activityProvider: () -> Activity?) : WalletApprover {
+
+    override suspend fun approve(summary: SignSummary): Boolean = withContext(Dispatchers.Main) {
+        val activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+            ?: throw walletError(WalletErrorCode.CONFIRM_WINDOW_BLOCKED, "no foreground activity for the approval")
+        suspendCancellableCoroutine { cont ->
+            val scroll = ScrollView(activity)
+            scroll.addView(content(activity, summary))
+            var answered = false
+            val dialog = AlertDialog.Builder(activity)
+                .setTitle(summary.title)
+                .setView(scroll)
+                .setPositiveButton("Sign") { _, _ ->
+                    answered = true
+                    if (cont.isActive) cont.resume(true)
+                }
+                .setNegativeButton("Cancel") { _, _ ->
+                    answered = true
+                    if (cont.isActive) cont.resume(false)
+                }
+                .setOnDismissListener {
+                    if (!answered && cont.isActive) cont.resume(false)
+                }
+                .create()
+            dialog.setCanceledOnTouchOutside(false)
+            dialog.setOnShowListener {
+                val sign = dialog.getButton(AlertDialog.BUTTON_POSITIVE)
+                fun update() {
+                    sign.isEnabled = !scroll.canScrollVertically(1)
+                }
+                update()
+                scroll.setOnScrollChangeListener { _, _, _, _, _ -> if (!sign.isEnabled) update() }
+                scroll.post { update() }
+            }
+            cont.invokeOnCancellation { dialog.dismiss() }
+            dialog.show()
+        }
+    }
+
+    private fun content(context: Context, summary: SignSummary): LinearLayout {
+        val pad = dp(context, 20)
+        val layout = LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(pad, dp(context, 8), pad, dp(context, 8))
+        }
+        for (w in summary.warnings) {
+            layout.addView(text(context, w).apply { setTextColor(Color.rgb(0xb4, 0x23, 0x18)); setPadding(0, 0, 0, dp(context, 8)) })
+        }
+        for (row in summary.rows) {
+            layout.addView(text(context, row.label).apply { alpha = 0.7f; setTextSize(TypedValue.COMPLEX_UNIT_SP, 12f) })
+            layout.addView(
+                text(context, row.value).apply {
+                    if (row.mono) typeface = Typeface.MONOSPACE
+                    setTextIsSelectable(true)
+                    setPadding(0, 0, 0, dp(context, 8))
+                },
+            )
+        }
+        summary.body?.let { body ->
+            layout.addView(
+                text(context, body).apply {
+                    typeface = Typeface.MONOSPACE
+                    setTextSize(TypedValue.COMPLEX_UNIT_SP, 12f)
+                    setTextIsSelectable(true)
+                },
+            )
+        }
+        return layout
+    }
+
+    private fun text(context: Context, value: String) = TextView(context).apply {
+        text = value
+        layoutParams = LinearLayout.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT)
+    }
+
+    private fun dp(context: Context, v: Int) = (v * context.resources.displayMetrics.density).toInt()
+}
+
+/**
+ * Device lock check with the platform BiometricPrompt: biometrics or the device credential on
+ * Android 10+, biometrics only on Android 9.
+ */
+class BiometricDeviceAuthenticator(private val activityProvider: () -> Activity?) : DeviceAuthenticator {
+
+    override suspend fun authenticate(reason: String): Boolean = withContext(Dispatchers.Main) {
+        val activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+            ?: throw walletError(WalletErrorCode.CONFIRM_WINDOW_BLOCKED, "no foreground activity for device authentication")
+        suspendCancellableCoroutine { cont ->
+            val executor = activity.mainExecutor
+            val builder = BiometricPrompt.Builder(activity).setTitle(reason).setSubtitle("Confirm it is you")
+            when {
+                Build.VERSION.SDK_INT >= 30 -> builder.setAllowedAuthenticators(
+                    BiometricManager.Authenticators.BIOMETRIC_STRONG or BiometricManager.Authenticators.DEVICE_CREDENTIAL,
+                )
+                Build.VERSION.SDK_INT == 29 -> @Suppress("DEPRECATION") builder.setDeviceCredentialAllowed(true)
+                else -> builder.setNegativeButton("Cancel", executor) { _, _ -> if (cont.isActive) cont.resume(false) }
+            }
+            val signal = CancellationSignal()
+            cont.invokeOnCancellation { signal.cancel() }
+            builder.build().authenticate(
+                signal,
+                executor,
+                object : BiometricPrompt.AuthenticationCallback() {
+                    override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                        if (cont.isActive) cont.resume(true)
+                    }
+
+                    override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                        if (cont.isActive) cont.resume(false)
+                    }
+                },
+            )
+        }
+    }
+}