@authon/react-native-wallet 0.0.0-stage → 0.1.0

package/build/useAuthonWallet.d.ts

@@ -0,0 +1,25 @@
+import { AuthonWalletClient } from './client';
+import { AuthonWalletError } from './errors';
+import type { AuthonWalletOptions, EmbeddedWallet, TokenGetter } from './types';
+export interface UseAuthonWalletOptions extends Omit<AuthonWalletOptions, 'getToken'> {
+    /** Defaults to the session of the surrounding `<AuthonProvider>` from @authon/react-native. */
+    getToken?: TokenGetter;
+}
+export interface UseAuthonWalletResult {
+    /** The client; call ensure(), signMessage(), protect() etc. on it. */
+    wallet: AuthonWalletClient;
+    /** The signed-in user's wallet, null when signed out or before it is created. */
+    current: EmbeddedWallet | null;
+    /** False until the first status check finished (or while signed out and the auth SDK is loading). */
+    isLoaded: boolean;
+    error: AuthonWalletError | null;
+    /** Reloads `current`. */
+    refresh: () => Promise<void>;
+}
+/**
+ * Wallet of the signed-in user. Inside `<AuthonProvider>` (@authon/react-native) the session token
+ * comes from the provider and the wallet follows sign-in and sign-out; elsewhere pass `getToken`.
+ * The client is recreated only when publishableKey, apiUrl or appId change.
+ */
+export declare function useAuthonWallet(options: UseAuthonWalletOptions): UseAuthonWalletResult;
+//# sourceMappingURL=useAuthonWallet.d.ts.map

package/build/useAuthonWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthonWallet.d.ts","sourceRoot":"","sources":["../src/useAuthonWallet.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhF,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC;IACnF,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iFAAiF;IACjF,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,qGAAqG;IACrG,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChC,yBAAyB;IACzB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CA0EtF"}

package/build/useAuthonWallet.js

@@ -0,0 +1,77 @@
+import { useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { getAuthonContext } from './authonContext';
+import { AuthonWalletClient } from './client';
+import { AuthonWalletError } from './errors';
+/**
+ * Wallet of the signed-in user. Inside `<AuthonProvider>` (@authon/react-native) the session token
+ * comes from the provider and the wallet follows sign-in and sign-out; elsewhere pass `getToken`.
+ * The client is recreated only when publishableKey, apiUrl or appId change.
+ */
+export function useAuthonWallet(options) {
+    const session = useContext(getAuthonContext());
+    const latest = useRef({ options, session });
+    latest.current = { options, session };
+    if (!options.getToken && !session) {
+        throw new AuthonWalletError('NOT_CONFIGURED', 'useAuthonWallet needs getToken, or must be used inside <AuthonProvider> from @authon/react-native');
+    }
+    const appIdKey = typeof options.appId === 'string' ? options.appId : JSON.stringify(options.appId ?? null);
+    const testingKey = JSON.stringify(options.testing ?? null);
+    const wallet = useMemo(() => new AuthonWalletClient({
+        ...latest.current.options,
+        getToken: async () => {
+            const { options: o, session: s } = latest.current;
+            if (o.getToken)
+                return o.getToken();
+            if (!s?.isSignedIn)
+                return null;
+            const token = s.getToken?.();
+            if (token)
+                return token;
+            return (await s.client?.refreshToken?.())?.accessToken ?? null;
+        },
+    }), 
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [options.publishableKey, options.apiUrl, appIdKey, options.requireDeviceAuthentication, testingKey]);
+    // dispose() only resets the client, so this is safe under StrictMode's double effects.
+    useEffect(() => () => wallet.dispose(), [wallet]);
+    const [current, setCurrent] = useState(null);
+    const [isLoaded, setLoaded] = useState(false);
+    const [error, setError] = useState(null);
+    useEffect(() => wallet.onChange(setCurrent), [wallet]);
+    const signedIn = options.getToken ? true : session?.isSignedIn === true;
+    const sessionUser = options.getToken ? null : session?.userId ?? null;
+    const authLoaded = options.getToken ? true : session?.isLoaded !== false;
+    const lastUser = useRef(undefined);
+    const refresh = useCallback(async () => {
+        try {
+            setCurrent(await wallet.get());
+            setError(null);
+        }
+        catch (e) {
+            setError(e instanceof AuthonWalletError ? e : new AuthonWalletError('UNKNOWN', String(e)));
+        }
+        finally {
+            setLoaded(true);
+        }
+    }, [wallet]);
+    useEffect(() => {
+        if (!authLoaded)
+            return;
+        if (!signedIn) {
+            wallet.dispose();
+            lastUser.current = undefined;
+            setCurrent(null);
+            setError(null);
+            setLoaded(true);
+            return;
+        }
+        // Another user signed in: drop the previous user's cached accounts and in-flight calls.
+        if (lastUser.current !== undefined && lastUser.current !== sessionUser)
+            wallet.dispose();
+        lastUser.current = sessionUser;
+        setLoaded(false);
+        void refresh();
+    }, [authLoaded, signedIn, sessionUser, refresh, wallet]);
+    return { wallet, current, isLoaded, error, refresh };
+}
+//# sourceMappingURL=useAuthonWallet.js.map

package/build/useAuthonWallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthonWallet.js","sourceRoot":"","sources":["../src/useAuthonWallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAoB7C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CACH,IAAI,kBAAkB,CAAC;QACrB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;QACzB,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;YAClD,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,UAAU;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QACjE,CAAC;KACF,CAAC;IACJ,uDAAuD;IACvD,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,2BAA2B,EAAE,UAAU,CAAC,CACpG,CAAC;IACF,uFAAuF;IACvF,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAElD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAA2B,IAAI,CAAC,CAAC;IAEnE,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC;IAEzE,MAAM,QAAQ,GAAG,MAAM,CAA4B,SAAS,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEb,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzF,QAAQ,CAAC,OAAO,GAAG,WAAW,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,OAAO,EAAE,CAAC;IACjB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["apple", "android"],
+  "apple": {
+    "modules": ["AuthonWalletModule"]
+  },
+  "android": {
+    "modules": ["dev.authon.reactnative.wallet.AuthonWalletModule"]
+  }
+}

package/ios/AuthonReactNativeWallet.podspec

@@ -0,0 +1,37 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name = 'AuthonReactNativeWallet'
+  s.version = package['version']
+  s.summary = package['description']
+  s.license = { :type => 'MIT' }
+  s.author = 'Authon'
+  s.homepage = 'https://authon.dev'
+  # AuthonWallet needs iOS 16 (the Swift package's minimum); PRF passkeys need iOS 18 at run time.
+  s.platforms = { :ios => '16.0' }
+  s.source = { :git => 'https://github.com/mikusnuz/authon-sdk.git', :tag => "react-native-wallet@#{s.version}" }
+  s.static_framework = true
+  s.swift_version = '5.9'
+  s.dependency 'ExpoModulesCore'
+  s.frameworks = 'Security', 'CryptoKit', 'LocalAuthentication', 'AuthenticationServices', 'SwiftUI'
+
+  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs.
+  # CSecp256k1: compile only build/*.c (they include src/*.c); CKeccak: sha3.c and memzero.c.
+  s.source_files = [
+    '*.swift',
+    'vendor/AuthonWallet/**/*.swift',
+    'vendor/CSecp256k1/build/*.c',
+    'vendor/CSecp256k1/include/*.h',
+    'vendor/CKeccak/sha3.c',
+    'vendor/CKeccak/memzero.c',
+    'vendor/CKeccak/include/ckeccak.h',
+  ]
+  s.public_header_files = ['vendor/CSecp256k1/include/*.h', 'vendor/CKeccak/include/ckeccak.h']
+  s.preserve_paths = ['vendor/CSecp256k1/src/**/*', 'vendor/CKeccak/*.h']
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'GCC_PREPROCESSOR_DEFINITIONS' => '$(inherited) ENABLE_MODULE_RECOVERY=1',
+  }
+end

package/ios/AuthonWalletModule.swift

@@ -0,0 +1,190 @@
+import ExpoModulesCore
+import Foundation
+
+/// Bridges the AuthonWallet core (vendor/AuthonWallet, generated from swift/Sources) to JS.
+///
+/// Only public data crosses the bridge: addresses, signatures, status and devices. The device
+/// share, the company share, the key and passkey PRF output stay inside the core. Every
+/// function resolves an envelope `{ ok: true, value }` or `{ ok: false, code, message }` with
+/// the web wallet's error codes, so JS never parses native exception text.
+public final class AuthonWalletModule: Module {
+  private let lock = NSLock()
+  private var wallets: [String: AuthonWallet] = [:]
+
+  public func definition() -> ModuleDefinition {
+    Name("AuthonWallet")
+
+    AsyncFunction("configure") { (id: String, config: [String: Any]) -> [String: Any] in
+      self.envelope { try self.configure(id, config); return NSNull() }
+    }
+
+    AsyncFunction("release") { (id: String) -> [String: Any] in
+      self.lock.withLock { self.wallets[id] = nil }
+      return ["ok": true, "value": NSNull()]
+    }
+
+    AsyncFunction("appConfig") { (id: String) async -> [String: Any] in
+      await self.call(id, token: nil) { try Self.appConfig(await $0.appConfig()) }
+    }
+
+    AsyncFunction("status") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { try Self.wallet(await $0.status()) }
+    }
+
+    AsyncFunction("create") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { try Self.wallet(await $0.create()) }
+    }
+
+    AsyncFunction("accounts") { (id: String, token: String, start: Int, count: Int) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        try await w.accounts(start: start, count: count).map { ["index": $0.index, "path": $0.path, "address": $0.address] }
+      }
+    }
+
+    AsyncFunction("signMessage") { (id: String, token: String, kind: String, message: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        let payload: WalletMessage = kind == "raw" ? .raw(message) : .text(message)
+        return try await w.signMessage(payload, account: account, address: address)
+      }
+    }
+
+    AsyncFunction("signTypedData") { (id: String, token: String, typedDataJson: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.signTypedData(typedDataJson, account: account, address: address) }
+    }
+
+    AsyncFunction("signTransaction") { (id: String, token: String, transactionJson: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.signTransaction(transactionJson, account: account, address: address) }
+    }
+
+    AsyncFunction("protect") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { ["shareVersion": try await $0.protect().shareVersion] }
+    }
+
+    AsyncFunction("upgradeBackup") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { ["shareVersion": try await $0.upgradeBackup().shareVersion] }
+    }
+
+    AsyncFunction("restore") { (id: String, token: String, reset: Bool) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        let r = try await w.restore(mode: reset ? .reset : .add)
+        return ["shareVersion": r.shareVersion, "backupUpgradeRecommended": r.backupUpgradeRecommended]
+      }
+    }
+
+    AsyncFunction("revokeDevice") { (id: String, token: String, deviceId: String) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.revokeDevice(deviceId); return NSNull() }
+    }
+  }
+
+  // MARK: - Instances
+
+  private static var isDebugBuild: Bool {
+    #if DEBUG
+    return true
+    #else
+    return false
+    #endif
+  }
+
+  private func configure(_ id: String, _ config: [String: Any]) throws {
+    guard let publishableKey = config["publishableKey"] as? String, !publishableKey.isEmpty else {
+      throw WalletError(.invalidRequest, "publishableKey required")
+    }
+    let apiUrl = (config["apiUrl"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? "https://api.authon.dev"
+    let appId = (config["appId"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+    let testing = config["testing"] as? [String: Any] ?? [:]
+    let softwareKeys = testing["allowSoftwareKeys"] as? Bool ?? false
+    let autoApprove = testing["autoApprove"] as? Bool ?? false
+    if (softwareKeys || autoApprove) && !Self.isDebugBuild {
+      throw WalletError(.invalidRequest, "testing options are only available in debug builds")
+    }
+    let wallet = AuthonWallet(
+      publishableKey: publishableKey,
+      apiURL: apiUrl,
+      sessionProvider: { CallToken.value ?? "" },
+      appId: appId,
+      approver: autoApprove ? TestAutoApprover() : SheetWalletApprover(),
+      requireDeviceAuthentication: config["requireDeviceAuthentication"] as? Bool ?? false,
+      allowSoftwareKeys: softwareKeys
+    )
+    lock.withLock { wallets[id] = wallet }
+  }
+
+  private func call(_ id: String, token: String?, _ body: @escaping (AuthonWallet) async throws -> Any) async -> [String: Any] {
+    guard let wallet = lock.withLock({ wallets[id] }) else {
+      return Self.failure(WalletError(.invalidRequest, "wallet not configured"))
+    }
+    do {
+      // The token is the Authon session token for this call, not a wallet secret.
+      let value = try await CallToken.$value.withValue(token) { try await body(wallet) }
+      return ["ok": true, "value": value]
+    } catch {
+      return Self.failure(error)
+    }
+  }
+
+  private func envelope(_ body: () throws -> Any) -> [String: Any] {
+    do {
+      return ["ok": true, "value": try body()]
+    } catch {
+      return Self.failure(error)
+    }
+  }
+
+  private static func failure(_ error: Error) -> [String: Any] {
+    let e: WalletError
+    if let w = error as? WalletError {
+      e = w
+    } else if error is CancellationError {
+      e = WalletError(.userCancelled)
+    } else {
+      e = WalletError(.internal, "unexpected error")
+    }
+    return ["ok": false, "code": e.code.rawValue, "message": e.message]
+  }
+
+  // MARK: - Public data only
+
+  private static func orNull(_ value: Any?) -> Any { value ?? NSNull() }
+
+  private static func wallet(_ w: PublicWallet) -> [String: Any] {
+    [
+      "address": w.address,
+      "protected": w.isProtected,
+      "needsRestore": w.needsRestore,
+      "backupUpgradeRecommended": w.backupUpgradeRecommended,
+      "devices": w.devices.map {
+        [
+          "id": $0.id,
+          "label": orNull($0.label),
+          "createdAt": orNull($0.createdAt),
+          "lastUsedAt": orNull($0.lastUsedAt),
+          "current": $0.current,
+        ] as [String: Any]
+      },
+    ]
+  }
+
+  private static func appConfig(_ c: WalletAppConfig) -> [String: Any] {
+    [
+      "projectId": orNull(c.projectId),
+      "allowed": c.allowed,
+      "approved": c.approved,
+      "enabled": c.enabled,
+      "chainIds": c.chainIds,
+      "confirmSigning": c.confirmSigning,
+      "rpId": c.rpId,
+      "minFrameProtocol": orNull(c.minFrameProtocol),
+    ]
+  }
+}
+
+private enum CallToken {
+  @TaskLocal static var value: String?
+}
+
+/// Debug builds only (checked in configure): approves every request without UI, so automated
+/// smoke tests on the simulator can sign. Never used unless the app passes `testing.autoApprove`.
+private struct TestAutoApprover: WalletApprover {
+  func approveSignature(_ summary: SignSummary) async throws {}
+}

package/ios/vendor/AuthonWallet/AuthonWallet.swift

@@ -0,0 +1,212 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/AuthonWallet.swift. Do not edit: change the source and run the script.
+import Foundation
+import Security
+
+/// The Authon embedded wallet on iOS and macOS. Same wallet, shares and API as the web
+/// frame: the device keeps only its share D; every signature fetches the company share A
+/// with a device-key proof, combines them in memory, signs and wipes the key.
+///
+/// This module does not depend on the `Authon` auth module; `AuthonWalletAuthon` adds an
+/// initializer that takes an `Authon` instance.
+public final class AuthonWallet: @unchecked Sendable {
+    public typealias SessionProvider = @Sendable () async throws -> String
+
+    private let api: WalletAPIClient
+    private let sessionProvider: SessionProvider
+    private let appId: String?
+    private let customStore: DeviceStore?
+    private let customPasskeys: PasskeyProvider?
+    private let approver: WalletApprover?
+    private let deviceAuthenticator: DeviceAuthenticator?
+    private let allowSoftwareKeys: Bool
+    private let lock = NSLock()
+    private var cachedConfig: WalletAppConfig?
+    private var cachedStore: DeviceStore?
+
+    /// - Parameters:
+    ///   - sessionProvider: Returns the current Authon session token (refreshed if needed).
+    ///   - appId: `TEAMID.bundleId` as registered in the Authon console. Detected from the
+    ///     app's keychain access group when nil.
+    ///   - approver: Shown before every signature when the project requires confirmation
+    ///     (server setting). Pass your own to replace the default sheet.
+    ///   - requireDeviceAuthentication: Ask for Face ID / Touch ID / passcode before each signature.
+    ///   - deviceStore: Defaults to the Secure Enclave store.
+    ///   - allowSoftwareKeys: Use software device keys when there is no Secure Enclave (simulator,
+    ///     tests). Refused in release builds on devices. Never enable it for production.
+    public init(
+        publishableKey: String,
+        apiURL: String = "https://api.authon.dev",
+        sessionProvider: @escaping SessionProvider,
+        appId: String? = nil,
+        approver: WalletApprover? = SheetWalletApprover(),
+        requireDeviceAuthentication: Bool = false,
+        deviceAuthenticator: DeviceAuthenticator? = nil,
+        deviceStore: DeviceStore? = nil,
+        passkeys: PasskeyProvider? = nil,
+        allowSoftwareKeys: Bool = false,
+        urlSession: URLSession = .shared
+    ) {
+        api = WalletAPIClient(apiURL: apiURL, publishableKey: publishableKey, session: urlSession)
+        self.sessionProvider = sessionProvider
+        self.appId = appId
+        self.approver = approver
+        self.deviceAuthenticator = deviceAuthenticator ?? (requireDeviceAuthentication ? LocalDeviceAuthenticator() : nil)
+        customStore = deviceStore
+        customPasskeys = passkeys
+        self.allowSoftwareKeys = allowSoftwareKeys
+    }
+
+    // MARK: - Context
+
+    /// App registration and wallet settings from the API (cached).
+    public func appConfig() async throws -> WalletAppConfig {
+        if let c = lock.withLock({ cachedConfig }) { return c }
+        guard let appId = appId ?? Self.detectAppIdentifier() else {
+            throw WalletError(.originNotAllowed, "appId (TEAMID.bundleId) could not be determined")
+        }
+        let cfg = try await api.appConfig(platform: "ios", appId: appId)
+        lock.withLock { cachedConfig = cfg }
+        return cfg
+    }
+
+    private func store() throws -> DeviceStore {
+        if let s = customStore { return s }
+        return try lock.withLock {
+            if let s = cachedStore { return s }
+            let s: DeviceStore
+            if let se = try? SecureEnclaveDeviceStore() {
+                s = se
+            } else if allowSoftwareKeys {
+                s = try SoftwareDeviceStore(persistent: true)
+            } else {
+                throw WalletError(.storageUnavailable, "this device has no Secure Enclave")
+            }
+            cachedStore = s
+            return s
+        }
+    }
+
+    private func context(passkeys needed: Bool = false) async throws -> (WalletOps, String) {
+        // Like the frame, a request without a session is refused before anything else.
+        let session = try await sessionProvider()
+        guard !session.isEmpty else { throw WalletError(.unauthorized, "token required") }
+        let cfg = try await appConfig()
+        guard cfg.allowed else { throw WalletError(.originNotAllowed, "this app is not registered for the project") }
+        if let min = cfg.minFrameProtocol, min > WalletAPIClient.frameProtocol { throw WalletError(.frameOutdated) }
+        if needed && !cfg.approved {
+            throw WalletError(.originNotAllowed, "the app registration is not approved yet, so wallet passkeys are unavailable")
+        }
+        let ctx = WalletContext(
+            api: api,
+            store: try store(),
+            passkeys: customPasskeys ?? PlatformPasskeyProvider(relyingPartyIdentifier: cfg.rpId),
+            projectId: cfg.projectId ?? api.publishableKey,
+            confirmSigning: cfg.confirmSigning,
+            backupVersion: cfg.prfSaltVersion,
+            approver: approver,
+            deviceAuthenticator: deviceAuthenticator
+        )
+        return (WalletOps(ctx: ctx), session)
+    }
+
+    private func run<T>(passkeys: Bool = false, _ body: (WalletOps, String) async throws -> T) async throws -> T {
+        do {
+            let (ops, session) = try await context(passkeys: passkeys)
+            return try await body(ops, session)
+        } catch {
+            throw WalletError.wrap(error)
+        }
+    }
+
+    // MARK: - Operations
+
+    /// The wallet of the signed-in user. Throws NOT_FOUND when there is none yet.
+    public func status() async throws -> PublicWallet {
+        try await run { ops, s in try PublicWallet(try await ops.status(s)) }
+    }
+
+    /// Full status including a pending (unconfirmed) wallet; does not throw NOT_FOUND.
+    public func detailedStatus() async throws -> WalletStatus {
+        try await run { ops, s in try await ops.status(s) }
+    }
+
+    /// Creates the wallet (two-phase), or returns the existing one.
+    public func create() async throws -> PublicWallet {
+        try await run { ops, s in try PublicWallet(try await ops.create(s)) }
+    }
+
+    /// Addresses of accounts start..<start+count (m/44'/60'/0'/0/n).
+    public func accounts(start: Int = 0, count: Int = 1) async throws -> [WalletAccount] {
+        try await run { ops, s in try await ops.accounts(s, start: start, count: count) }
+    }
+
+    /// EIP-191 personal_sign. `account` > 0 must come with the address from `accounts()`.
+    public func signMessage(_ message: WalletMessage, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in try await ops.signMessage(s, message, account: try SignAccount.parse(index: account, address: address)) }
+    }
+
+    public func signMessage(_ text: String, account: Int = 0, address: String? = nil) async throws -> String {
+        try await signMessage(.text(text), account: account, address: address)
+    }
+
+    /// EIP-712 v4. `typedData` is a JSON string, a `[String: Any]` dictionary or a JSONValue.
+    public func signTypedData(_ typedData: Any, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in
+            let value: JSONValue = try (typedData as? String).map { try JSONValue.parse($0) } ?? JSONValue.from(typedData)
+            return try await ops.signTypedData(s, value, account: try SignAccount.parse(index: account, address: address))
+        }
+    }
+
+    /// Signs a legacy, EIP-2930 or EIP-1559 transaction and returns the serialized signed
+    /// transaction. Numeric fields may be numbers, decimal strings or 0x hex strings.
+    public func signTransaction(_ transaction: Any, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in
+            let value: JSONValue = try (transaction as? String).map { try JSONValue.parse($0) } ?? JSONValue.from(transaction)
+            return try await ops.signTransaction(s, value, account: try SignAccount.parse(index: account, address: address))
+        }
+    }
+
+    /// Creates the passkey backup (iOS 18 / macOS 15 for PRF).
+    public func protect() async throws -> ProtectResult {
+        try await run(passkeys: true) { ops, s in try await ops.protect(s) }
+    }
+
+    /// Replaces a legacy backup with a verifiable one, from a device that holds the wallet.
+    public func upgradeBackup() async throws -> ProtectResult {
+        try await run(passkeys: true) { ops, s in try await ops.upgradeBackup(s) }
+    }
+
+    /// Restores the wallet on this device with the backup passkey.
+    public func restore(mode: RestoreMode = .add) async throws -> RestoreResult {
+        try await run(passkeys: true) { ops, s in try await ops.restore(s, mode: mode) }
+    }
+
+    public func revokeDevice(_ deviceId: String) async throws {
+        try await run { ops, s in try await ops.revokeDevice(s, deviceId: deviceId) }
+    }
+
+    // MARK: - App identifier
+
+    /// `TEAMID.bundleId` from the default keychain access group (the app identifier prefix).
+    static func detectAppIdentifier() -> String? {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "dev.authon.wallet.app-id",
+            kSecAttrAccount as String: "probe",
+            kSecReturnAttributes as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        var status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound {
+            var add = q
+            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            status = SecItemAdd(add as CFDictionary, &out)
+        }
+        guard status == errSecSuccess, let attrs = out as? [String: Any], let group = attrs[kSecAttrAccessGroup as String] as? String,
+              group.contains(".") else { return nil }
+        return group
+    }
+}