@authon/react-native-wallet 0.0.0-stage → 0.1.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletApi.kt

@@ -0,0 +1,353 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/WalletApi.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonObjectBuilder
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.longOrNull
+import kotlinx.serialization.json.put
+import okhttp3.OkHttpClient
+import java.io.IOException
+import java.net.URLEncoder
+
+data class WalletDevice(
+    val id: String,
+    val label: String?,
+    val shareVersion: Int?,
+    val createdAt: String?,
+    val lastUsedAt: String?,
+    val revokedAt: String?,
+)
+
+data class ServerWallet(
+    val id: String,
+    val address: String,
+    val status: String,
+    val protected: Boolean,
+    /** Null without a backup; false for a legacy backup that has no passkey public key. */
+    val backupVerifiable: Boolean?,
+    val shareVersion: Int,
+    val devices: List<WalletDevice>,
+)
+
+/** `GET /v1/wallet/app-config` for this app (platform=android, appId=package name). */
+data class WalletAppConfig(
+    val allowed: Boolean,
+    val approved: Boolean,
+    val projectId: String?,
+    val enabled: Boolean,
+    val chainIds: List<Long>,
+    /** Missing means true: signing needs a confirmation. */
+    val confirmSigning: Boolean,
+    /** PRF salt version for new backups. Missing means 1. */
+    val prfSaltVersion: Int,
+    val rpId: String,
+    val minFrameProtocol: Int?,
+)
+
+internal data class DeviceProof(val deviceId: String, val challenge: String, val signature: String) {
+    fun fill(b: JsonObjectBuilder) {
+        b.put("deviceId", deviceId)
+        b.put("challenge", challenge)
+        b.put("signature", signature)
+    }
+}
+
+internal data class RestoreStart(
+    val backupCiphertext: String?,
+    val credentialId: String?,
+    val companyShare: String?,
+    val upgradeRecommended: Boolean,
+    val passkeyChallenge: String?,
+)
+
+internal data class CreatedWallet(val wallet: ServerWallet?, val deviceId: String, val walletId: String, val shareVersion: Int)
+
+internal data class EnrolledDevice(val deviceId: String, val shareVersion: Int)
+
+/** HTTP contract of `apps/wallet/src/api.ts` (protocol 2), byte for byte in paths, headers and bodies. */
+internal class WalletApi(
+    apiUrl: String,
+    private val publishableKey: String,
+    private val client: OkHttpClient = Http.defaultClient,
+) {
+    private val base = apiUrl.trimEnd('/')
+
+    private suspend fun call(method: String, path: String, session: String?, body: JsonObject? = null): HttpResult {
+        val headers = LinkedHashMap<String, String>()
+        headers["x-api-key"] = publishableKey
+        headers["accept"] = "application/json"
+        if (session != null) headers["authorization"] = "Bearer $session"
+        if (body != null) headers["content-type"] = "application/json"
+        headers["user-agent"] = Http.userAgent()
+        return try {
+            Http.execute(client, Http.request("$base/v1/wallet$path", method, headers, body))
+        } catch (_: IOException) {
+            throw walletError(WalletErrorCode.API_ERROR, "network error")
+        }
+    }
+
+    private fun ensureOk(res: HttpResult): JsonObject {
+        if (res.ok) return res.json
+        val serverCode = res.json.str("code")
+        if (serverCode != null && serverCode in RESTORE_CODES) throw walletError(WalletErrorCode.NEEDS_RESTORE)
+        if (serverCode != null && serverCode in KNOWN_CODES) throw walletError(WalletErrorCode.valueOf(serverCode))
+        throw walletError(STATUS_CODES[res.status] ?: WalletErrorCode.API_ERROR)
+    }
+
+    suspend fun appConfig(packageName: String): WalletAppConfig {
+        val res = call("GET", "/app-config?platform=android&appId=${enc(packageName)}", null)
+        if (res.status == 403 || res.status == 404) {
+            return WalletAppConfig(false, false, null, false, emptyList(), true, 1, DEFAULT_RP_ID, null)
+        }
+        val data = ensureOk(res)
+        val wc = data["walletConfig"] as? JsonObject ?: JsonObject(emptyMap())
+        return WalletAppConfig(
+            allowed = data.bool("allowed") != false,
+            approved = data.bool("approved") == true,
+            projectId = data.str("projectId"),
+            enabled = wc.bool("enabled") != false,
+            chainIds = (wc["chainIds"] as? JsonArray)?.mapNotNull { (it as? JsonPrimitive)?.longOrNull } ?: emptyList(),
+            confirmSigning = wc.bool("confirmSigning") != false,
+            prfSaltVersion = if ((wc["prfSaltVersion"] as? JsonPrimitive)?.intOrNull == 2) 2 else 1,
+            rpId = data.str("rpId") ?: DEFAULT_RP_ID,
+            minFrameProtocol = (data["minFrameProtocol"] as? JsonPrimitive)?.intOrNull,
+        )
+    }
+
+    suspend fun getMe(session: String): ServerWallet? {
+        val res = call("GET", "/me", session)
+        if (res.status == 404) return null
+        val data = ensureOk(res)
+        return normalizeWallet(data["wallet"]?.takeIf { it !is JsonNull } ?: res.json)
+    }
+
+    suspend fun proofChallenge(session: String, kind: String): ProofNonce {
+        val data = ensureOk(call("POST", "/me/proof-challenge", session, buildJsonObject { put("kind", kind) }))
+        val nonce = data.str("nonce")
+        val expiresAt = (data["expiresAt"] as? JsonPrimitive)?.takeIf { !it.isString }?.longOrNull
+        if (nonce == null || expiresAt == null) throw walletError(WalletErrorCode.API_ERROR)
+        return ProofNonce(nonce, expiresAt)
+    }
+
+    suspend fun createWallet(
+        session: String,
+        address: String,
+        companyShare: String,
+        devicePublicKey: DevicePublicJwk,
+        proof: String,
+        bound: ProofNonce,
+    ): CreatedWallet {
+        val body = buildJsonObject {
+            put("address", address)
+            put("companyShare", companyShare)
+            put("devicePublicKey", devicePublicKey.toJson())
+            put("proof", proof)
+            put("nonce", bound.nonce)
+            put("nonceExpiresAt", bound.expiresAt)
+            put("protocol", FRAME_PROTOCOL)
+        }
+        val data = ensureOk(call("POST", "/me", session, body))
+        val wallet = when {
+            data["wallet"] is JsonObject -> normalizeWallet(data["wallet"]!!)
+            data["id"] != null && data["id"] !is JsonNull -> normalizeWallet(data)
+            else -> null
+        }
+        val device = data["device"] as? JsonObject
+        return CreatedWallet(
+            wallet = wallet,
+            walletId = data.str("walletId") ?: wallet?.id ?: "undefined",
+            deviceId = data.str("deviceId") ?: device?.str("id") ?: "undefined",
+            shareVersion = data.int("shareVersion") ?: wallet?.shareVersion ?: 1,
+        )
+    }
+
+    suspend fun confirmWallet(session: String, proof: DeviceProof) {
+        ensureOk(call("POST", "/me/confirm", session, buildJsonObject { proof.fill(this) }))
+    }
+
+    suspend fun discardPending(session: String) {
+        val res = call("DELETE", "/me/pending", session)
+        if (res.status == 404) return
+        ensureOk(res)
+    }
+
+    suspend fun challenge(session: String, deviceId: String): String {
+        val data = ensureOk(call("POST", "/me/share/challenge", session, buildJsonObject { put("deviceId", deviceId) }))
+        return data.str("challenge") ?: throw walletError(WalletErrorCode.API_ERROR)
+    }
+
+    suspend fun releaseShare(session: String, proof: DeviceProof): String {
+        val data = ensureOk(call("POST", "/me/share", session, buildJsonObject { proof.fill(this) }))
+        return data.str("companyShare") ?: throw walletError(WalletErrorCode.API_ERROR)
+    }
+
+    class BackupKeyFields(val credentialPublicKey: String?, val credentialAlg: Int?, val attestationObject: String?)
+
+    suspend fun putBackup(
+        session: String,
+        proof: DeviceProof,
+        backupCiphertext: String,
+        credentialId: String,
+        newCompanyShare: String,
+        key: BackupKeyFields,
+        upgrade: Boolean,
+    ): Int {
+        val body = buildJsonObject {
+            proof.fill(this)
+            put("backupCiphertext", backupCiphertext)
+            put("credentialId", credentialId)
+            put("newCompanyShare", newCompanyShare)
+            if (key.credentialPublicKey != null && key.credentialAlg != null) {
+                put("credentialPublicKey", key.credentialPublicKey)
+                put("credentialAlg", key.credentialAlg)
+            } else if (key.attestationObject != null) {
+                put("attestationObject", key.attestationObject)
+            }
+            if (upgrade) put("upgrade", true)
+            put("protocol", FRAME_PROTOCOL)
+        }
+        val data = ensureOk(call("PUT", "/me/backup", session, body))
+        return data.int("shareVersion") ?: throw walletError(WalletErrorCode.API_ERROR)
+    }
+
+    suspend fun restoreStart(session: String): RestoreStart {
+        val data = ensureOk(call("POST", "/me/restore/start", session, JsonObject(emptyMap())))
+        val companyShare = data.str("companyShare")
+        val passkeyChallenge = data.str("passkeyChallenge")
+        if (companyShare == null && passkeyChallenge == null) throw walletError(WalletErrorCode.API_ERROR)
+        return RestoreStart(
+            backupCiphertext = data.str("backupCiphertext"),
+            credentialId = data.str("credentialId"),
+            companyShare = companyShare,
+            passkeyChallenge = passkeyChallenge,
+            upgradeRecommended = companyShare != null || data.bool("upgradeRecommended") == true,
+        )
+    }
+
+    suspend fun restoreAssert(session: String, assertion: PasskeyAssertion, challenge: String): String {
+        val body = buildJsonObject {
+            put("credentialId", assertion.credentialId)
+            put("clientDataJSON", assertion.clientDataJSON)
+            put("authenticatorData", assertion.authenticatorData)
+            put("signature", assertion.signature)
+            put("challenge", challenge)
+        }
+        val data = ensureOk(call("POST", "/me/restore/assert", session, body))
+        return data.str("companyShare") ?: throw walletError(WalletErrorCode.API_ERROR)
+    }
+
+    suspend fun restore(
+        session: String,
+        newCompanyShare: String,
+        newBackupCiphertext: String,
+        newDevicePublicKey: DevicePublicJwk,
+        credentialId: String,
+        proof: String,
+        bound: ProofNonce,
+    ): EnrolledDevice {
+        val body = buildJsonObject {
+            put("newCompanyShare", newCompanyShare)
+            put("newBackupCiphertext", newBackupCiphertext)
+            put("newDevicePublicKey", newDevicePublicKey.toJson())
+            put("credentialId", credentialId)
+            put("proof", proof)
+            put("nonce", bound.nonce)
+            put("nonceExpiresAt", bound.expiresAt)
+            put("protocol", FRAME_PROTOCOL)
+        }
+        val data = ensureOk(call("POST", "/me/restore", session, body))
+        return EnrolledDevice(
+            data.str("deviceId") ?: (data["device"] as? JsonObject)?.str("id") ?: "undefined",
+            data.int("shareVersion") ?: throw walletError(WalletErrorCode.API_ERROR),
+        )
+    }
+
+    suspend fun addDevice(session: String, devicePublicKey: DevicePublicJwk, proof: String, bound: ProofNonce): EnrolledDevice {
+        val body = buildJsonObject {
+            put("devicePublicKey", devicePublicKey.toJson())
+            put("proof", proof)
+            put("nonce", bound.nonce)
+            put("nonceExpiresAt", bound.expiresAt)
+            put("protocol", FRAME_PROTOCOL)
+        }
+        val data = ensureOk(call("POST", "/me/devices", session, body))
+        return EnrolledDevice(
+            data.str("deviceId") ?: "undefined",
+            data.int("shareVersion") ?: throw walletError(WalletErrorCode.API_ERROR),
+        )
+    }
+
+    suspend fun revokeDevice(session: String, deviceId: String, proof: DeviceProof) {
+        ensureOk(call("DELETE", "/me/devices/${enc(deviceId)}", session, buildJsonObject { proof.fill(this) }))
+    }
+
+    companion object {
+        /** Protocol sent as `protocol` in proof and backup requests (the API's CURRENT_FRAME_PROTOCOL). */
+        const val FRAME_PROTOCOL = 2
+        const val DEFAULT_RP_ID = "wallet.authon.dev"
+
+        private val STATUS_CODES = mapOf(
+            400 to WalletErrorCode.INVALID_REQUEST,
+            401 to WalletErrorCode.UNAUTHORIZED,
+            403 to WalletErrorCode.FORBIDDEN,
+            404 to WalletErrorCode.NOT_FOUND,
+            409 to WalletErrorCode.ALREADY_EXISTS,
+            426 to WalletErrorCode.FRAME_OUTDATED,
+            429 to WalletErrorCode.RATE_LIMITED,
+        )
+        private val RESTORE_CODES = setOf("NEEDS_RESTORE", "DEVICE_REVOKED", "DEVICE_NOT_FOUND", "STALE_SHARE_VERSION")
+        private val KNOWN_CODES = setOf(
+            "NOT_PROTECTED", "ORIGIN_NOT_ALLOWED", "ALREADY_EXISTS", "NOT_FOUND", "LAST_DEVICE", "SESSION_REQUIRED",
+            "WALLET_PENDING", "RATE_LIMITED", "FRAME_OUTDATED", "BACKUP_KEY_REQUIRED", "ALREADY_UPGRADED",
+        )
+
+        /** encodeURIComponent. */
+        fun enc(value: String): String = URLEncoder.encode(value, "UTF-8")
+            .replace("+", "%20").replace("%21", "!").replace("%27", "'")
+            .replace("%28", "(").replace("%29", ")").replace("%7E", "~")
+
+        private fun JsonObject.str(key: String): String? = (this[key] as? JsonPrimitive)?.takeIf { it.isString }?.content
+
+        private fun JsonObject.bool(key: String): Boolean? = (this[key] as? JsonPrimitive)?.takeIf { !it.isString }?.booleanOrNull
+
+        /** `Number(x)` for counters the server sends as numbers (or numeric strings). */
+        private fun JsonObject.int(key: String): Int? = (this[key] as? JsonPrimitive)?.contentOrNull?.toBigDecimalOrNull()?.toInt()
+
+        private fun JsonElement.asObj(): JsonObject = this as? JsonObject ?: JsonObject(emptyMap())
+
+        fun normalizeWallet(raw: JsonElement): ServerWallet {
+            val w = raw.asObj()
+            val prot = w.bool("protected") ?: (w["protectedAt"].let { it != null && it !is JsonNull && (it as? JsonPrimitive)?.contentOrNull?.isNotEmpty() == true })
+            return ServerWallet(
+                id = w.anyString("id") ?: w.anyString("walletId") ?: "undefined",
+                address = w.anyString("address") ?: "undefined",
+                status = w.anyString("status") ?: "active",
+                protected = prot,
+                backupVerifiable = w.bool("backupVerifiable"),
+                shareVersion = w.int("shareVersion") ?: 1,
+                devices = (w["devices"] as? JsonArray)?.mapNotNull { d ->
+                    val o = d as? JsonObject ?: return@mapNotNull null
+                    WalletDevice(
+                        id = o.anyString("id") ?: return@mapNotNull null,
+                        label = o.str("label"),
+                        shareVersion = o.int("shareVersion"),
+                        createdAt = o.str("createdAt"),
+                        lastUsedAt = o.str("lastUsedAt"),
+                        revokedAt = o.str("revokedAt"),
+                    )
+                } ?: emptyList(),
+            )
+        }
+
+        private fun JsonObject.anyString(key: String): String? =
+            (this[key] as? JsonPrimitive)?.takeIf { it !is JsonNull }?.contentOrNull
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletError.kt

@@ -0,0 +1,58 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/WalletError.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+/** Error codes of the web wallet frame (`apps/wallet/src/errors.ts`); [name] is the wire string. */
+enum class WalletErrorCode {
+    NOT_FOUND,
+    NEEDS_RESTORE,
+    NOT_PROTECTED,
+    PRF_UNSUPPORTED,
+    ORIGIN_NOT_ALLOWED,
+    USER_CANCELLED,
+    NEEDS_POPUP,
+    INVALID_REQUEST,
+    UNSUPPORTED_TYPE,
+    UNAUTHORIZED,
+    FORBIDDEN,
+    ALREADY_EXISTS,
+    RATE_LIMITED,
+    ADDRESS_MISMATCH,
+    STORAGE_UNAVAILABLE,
+    API_ERROR,
+    INTERNAL,
+    LAST_DEVICE,
+    SESSION_REQUIRED,
+    WALLET_PENDING,
+
+    /** The approval UI could not be shown. Nothing was signed. */
+    CONFIRM_WINDOW_BLOCKED,
+
+    /** The approval UI was dismissed before the user approved. Nothing was signed. */
+    CONFIRM_WINDOW_CLOSED,
+
+    /** The message or typed data is too long to show in full; it is refused. */
+    MESSAGE_TOO_LARGE,
+
+    /** The API no longer serves this SDK protocol version. */
+    FRAME_OUTDATED,
+
+    /** The backup passkey did not report a usable public key. */
+    BACKUP_KEY_REQUIRED,
+
+    /** upgradeBackup on a wallet whose backup is already verifiable. */
+    ALREADY_UPGRADED,
+
+    /** The wallet predates HD wallets and has only account 0. */
+    ACCOUNT_UNAVAILABLE,
+}
+
+class WalletException(
+    val code: WalletErrorCode,
+    message: String? = null,
+    cause: Throwable? = null,
+) : Exception(message ?: code.name, cause)
+
+internal fun walletError(code: WalletErrorCode, message: String? = null): WalletException = WalletException(code, message)
+
+internal fun Throwable.toWalletException(): WalletException =
+    this as? WalletException ?: WalletException(WalletErrorCode.INTERNAL, "unexpected error", this)