@authon/react-native-wallet 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @authon/react-native-wallet
 
+## 0.5.2
+
+- Signing, `accounts()`, `protect()` and `upgradeBackup()` fail with `NEEDS_RESTORE` when this device holds a share of an older generation than the server, instead of `ADDRESS_MISMATCH` (Swift and Kotlin). This happens when a backup was saved on the server but the device could not store its new share, or after another device upgraded the backup. `status()` already reports `needsRestore` in that case; `restore()` with the existing backup passkey brings the device back. Calling `protect()` again on a device already in that state no longer reports success. This detects the state on later calls; it does not make the server and device writes atomic. `revokeDevice()` skips the local share check, and the server's own device checks still apply (a device left behind by another device's upgrade is refused there).
+
 ## 0.5.1
 
 - `AuthonWalletError` gains `reason`, `phase` and `clientAttemptId` (null when not reported). Android: when the passkey provider says it cannot validate the RP for this app (a DataError of the "RP ID cannot be validated" family), `protect()`, `upgradeBackup()` and `restore()` fail with `ORIGIN_NOT_ALLOWED`, `reason: 'PASSKEY_RP_VALIDATION_FAILED'`, `phase: 'passkey.create.rpValidation'` (or `passkey.get.rpValidation`) and `retryable: false` instead of `INTERNAL`. Other provider data errors stay `INTERNAL`. `phase` is set on Android Credential Manager failures and `clientAttemptId` (a random device-side ID) on those other than a cancel or a missing passkey; all three are null on iOS and from older natives. `diagnosticId` stays the server request ID only.

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletOps.kt

@@ -171,11 +171,18 @@ internal class WalletOps(private val ctx: WalletContext) {
 
     private class Local(val record: DeviceRecord, val wallet: ServerWallet)
 
-    private suspend fun requireLocal(session: String): Local {
+    /**
+     * The local record for this user's wallet. With [currentShare] (every path that opens the device
+     * share) a share from an older generation is refused: the server rotated the shares (another
+     * device's upgrade, or a backup that committed before this device could save its new share), and
+     * combining the old share with the new company share would only fail later as ADDRESS_MISMATCH.
+     */
+    private suspend fun requireLocal(session: String, currentShare: Boolean = true): Local {
         val wallet = ctx.api.getMe(session)
         if (wallet == null || wallet.status == "pending") throw walletError(WalletErrorCode.NOT_FOUND)
         val record = ctx.store.get(recordKey(session))
         if (record == null || record.walletId != wallet.id) throw walletError(WalletErrorCode.NEEDS_RESTORE)
+        if (currentShare && record.shareVersion != wallet.shareVersion) throw walletError(WalletErrorCode.NEEDS_RESTORE)
         return Local(record, wallet)
     }
 
@@ -527,7 +534,7 @@ internal class WalletOps(private val ctx: WalletContext) {
 
     suspend fun revokeDevice(session: String, deviceId: String): Boolean {
         if (deviceId.isEmpty()) throw walletError(WalletErrorCode.INVALID_REQUEST, "deviceId required")
-        val local = requireLocal(session)
+        val local = requireLocal(session, currentShare = false)
         ctx.api.revokeDevice(session, deviceId, deviceProof(session, local.record))
         if (local.record.deviceId == deviceId) ctx.store.delete(recordKey(session))
         return true

package/ios/vendor/AuthonWallet/Wallet/WalletOps.swift

@@ -261,11 +261,16 @@ struct WalletOps {
         return try await status(session)
     }
 
-    private func requireLocal(_ session: String) async throws -> (record: DeviceRecord, wallet: ServerWallet) {
+    /// The local record for this user's wallet. With `currentShare` (every path that opens the device
+    /// share) a share from an older generation is refused: the server rotated the shares (another
+    /// device's upgrade, or a backup that committed before this device could save its new share), and
+    /// combining the old share with the new company share would only fail later as addressMismatch.
+    private func requireLocal(_ session: String, currentShare: Bool = true) async throws -> (record: DeviceRecord, wallet: ServerWallet) {
         guard let wallet = try await ctx.api.getMe(session), wallet.status != "pending" else { throw WalletError(.notFound) }
         guard let record = try ctx.store.get(try recordKey(session)), record.walletId == wallet.id else {
             throw WalletError(.needsRestore)
         }
+        if currentShare && record.shareVersion != wallet.shareVersion { throw WalletError(.needsRestore) }
         return (record, wallet)
     }
 
@@ -647,7 +652,7 @@ struct WalletOps {
     /// Revokes a device with a request signed by this device's key.
     func revokeDevice(_ session: String, deviceId: String) async throws {
         guard !deviceId.isEmpty else { throw WalletError(.invalidRequest, "deviceId required") }
-        let (record, _) = try await requireLocal(session)
+        let (record, _) = try await requireLocal(session, currentShare: false)
         try await ctx.api.revokeDevice(session, deviceId: deviceId, proof: try await deviceProof(session, record))
         if record.deviceId == deviceId { try ctx.store.delete(try recordKey(session)) }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authon/react-native-wallet",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Authon embedded wallet for React Native (Expo native module wrapping the Swift and Kotlin wallet SDKs)",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",