@chainberry/trust-wallet-core 2.0.0 → 2.5.1

package/android/src/main/java/com/chainberry/trustwalletcore/ChainberryTrustWalletCoreModule.kt

@@ -0,0 +1,227 @@
+package com.chainberry.trustwalletcore
+
+import android.app.AlertDialog
+import android.util.Log
+import androidx.fragment.app.FragmentActivity
+import expo.modules.kotlin.exception.CodedException
+import expo.modules.kotlin.functions.Coroutine
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.suspendCancellableCoroutine
+import wallet.core.jni.HDWallet
+import java.util.UUID
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+
+// Mnemonic/private-key material never crosses back to JS except `exportMnemonic` — an
+// explicit, biometric/device-credential-gated backup flow. Every other method returns only
+// walletIds, addresses, or signed transaction bytes/hex.
+class ChainberryTrustWalletCoreModule : Module() {
+  companion object {
+    init {
+      // Must be loaded once before any JNI calls
+      System.loadLibrary("TrustWalletCore")
+    }
+
+    // Global, not per-walletId: createWallet/importWallet/deleteWallet all read-modify-write the
+    // *entire* metadata map, so two concurrent calls touching different wallet ids would still
+    // race each other on that shared blob — a per-id lock wouldn't protect against that. See
+    // docs/adr/0002. A single companion-object Mutex (rather than an instance property) keeps
+    // this a true process-wide lock even if more than one module instance is ever created.
+    private val lifecycleMutex = Mutex()
+  }
+
+  private val context get() = appContext.reactContext
+    ?: throw CodedException("NoContext", "React context unavailable", null)
+
+  private val activity: FragmentActivity
+    get() = appContext.currentActivity as? FragmentActivity
+      ?: throw CodedException("NoActivity", "No foreground FragmentActivity to host the biometric prompt", null)
+
+  /**
+   * Serializes the whole body — including the biometric/device-credential prompt, not just the
+   * store writes — against every other lifecycle-mutating call, so at most one is ever touching
+   * the shared metadata store at a time (see docs/adr/0002). Also forecloses a second, separate
+   * bug: two concurrent `BiometricPrompt` invocations racing each other.
+   *
+   * [rejectIfBusy] chooses the policy for a caller that finds the lock already held:
+   * `createWallet`/`importWallet` reject immediately (`ERR_WALLET_OPERATION_IN_PROGRESS`) so a
+   * double-tap can never mint two wallets; `deleteWallet` queues instead, since two distinct
+   * deletes are both legitimate and should both eventually happen.
+   */
+  private suspend fun <T> withLifecycleLock(rejectIfBusy: Boolean, body: suspend () -> T): T {
+    if (rejectIfBusy) {
+      if (!lifecycleMutex.tryLock()) {
+        throw CodedException(
+          "ERR_WALLET_OPERATION_IN_PROGRESS",
+          "Another wallet operation is already in progress",
+          null,
+        )
+      }
+    } else {
+      lifecycleMutex.lock()
+    }
+    try {
+      return body()
+    } finally {
+      lifecycleMutex.unlock()
+    }
+  }
+
+  override fun definition() = ModuleDefinition {
+    Name("TrustWalletCore")
+
+    // Runs once, right after module init, before any of the AsyncFunctions below can be
+    // reached from JS — so nothing can legitimately be mid-operation yet, which is exactly what
+    // makes a one-shot pass here sufficient (no lock/grace-period needed against an in-flight
+    // call). This is the actual crash-safety mechanism for an interrupted create/delete; see
+    // CONTEXT.md and docs/adr/0001. Never allowed to block or crash startup.
+    OnCreate {
+      val reactContext = appContext.reactContext
+      if (reactContext == null) {
+        Log.w("TrustWalletCoreModule", "reconciliation: react context unavailable at module init, skipping")
+      } else {
+        NativeWalletStore.reconcileOrphans(reactContext)
+      }
+    }
+
+    // strength 128 = 12 words, 256 = 24 words. Returns { walletId, addresses }.
+    // No BIP-39 passphrase support: signTransaction always reconstructs the wallet with an
+    // empty passphrase, so accepting one here would derive addresses from a seed different
+    // from the one actually used to sign — always pass "" to stay consistent with that.
+    // isTestnet selects the address format for BTC/LTC/BCH (see ChainSigner.addressForChain) —
+    // every other chain's address is the same on mainnet and testnet.
+    AsyncFunction("createWallet") Coroutine { strength: Int, isTestnet: Boolean ->
+      val wallet = HDWallet(strength, "")
+      persistNewWallet(wallet, isTestnet)
+    }
+
+    // One-time mnemonic exposure from JS, at import only — never retained after this call.
+    // Returns { walletId, addresses }. No BIP-39 passphrase support (see `createWallet`).
+    AsyncFunction("importWallet") Coroutine { mnemonic: String, isTestnet: Boolean ->
+      val wallet = HDWallet(mnemonic, "") // throws on invalid mnemonic
+      persistNewWallet(wallet, isTestnet)
+    }
+
+    // Reads only the ungated metadata store — no biometric prompt.
+    AsyncFunction("listWallets") {
+      NativeWalletStore.loadMetadata(context).map { (walletId, addresses) ->
+        mapOf("walletId" to walletId, "addresses" to addresses)
+      }
+    }
+
+    // Irreversible — requires a fresh biometric/device-credential confirmation before
+    // anything is deleted, same gate as `signTransaction`/`exportMnemonic`. A
+    // compromised/malicious JS caller can still invoke this directly (there's no UI call
+    // site today), so the gate must live here rather than in JS.
+    //
+    // Removes the metadata entry *before* the secret (mnemonic file + Keystore key) — the
+    // reverse of the old ordering. If this is interrupted between the two steps, the wallet is
+    // already gone from `listWallets` and only an orphaned secret-side resource is left behind,
+    // which the next app launch's reconciliation pass cleans up (see docs/adr/0001) — never a
+    // metadata record still pointing at a secret that's already gone.
+    AsyncFunction("deleteWallet") Coroutine { walletId: String ->
+      withLifecycleLock(rejectIfBusy = false) {
+        val id = NativeWalletStore.validateWalletId(walletId)
+        NativeWalletStore.confirmIdentity(activity, context, "Delete wallet")
+        val metadata = NativeWalletStore.loadMetadata(context).toMutableMap()
+        metadata.remove(id)
+        NativeWalletStore.saveMetadata(context, metadata)
+        NativeWalletStore.deleteMnemonic(context, id)
+      }
+    }
+
+    // Triggers the native biometry/device-credential prompt, then signs entirely in-process.
+    // Returns { signedTx, meta? }. isTestnet must match whatever `createWallet`/`importWallet`
+    // used — see ChainSigner.keyForChain (a mismatch signs with the wrong key for BTC/LTC).
+    AsyncFunction("signTransaction") Coroutine { walletId: String, chain: String, unsignedTx: Map<String, Any>, isTestnet: Boolean ->
+      val id = NativeWalletStore.validateWalletId(walletId)
+      val chainKey = ChainKey.fromJs(chain)
+      confirmTransaction(chainKey, unsignedTx)
+      val cipher = NativeWalletStore.authenticateForExistingWallet(activity, context, id, "Sign transaction")
+      val mnemonic = NativeWalletStore.loadMnemonic(context, id, cipher)
+      val wallet = HDWallet(mnemonic, "")
+      // Backfill any addresses missing from metadata (chains added after wallet was created).
+      // Runs silently after the biometric gate — no extra prompt needed.
+      val metadata = NativeWalletStore.loadMetadata(context).toMutableMap()
+      @Suppress("UNCHECKED_CAST")
+      val storedAddresses = (metadata[id] as? Map<String, String>)?.toMutableMap()
+      if (storedAddresses != null) {
+        var changed = false
+        for (chainEntry in ChainKey.entries) {
+          val key = chainEntry.name.lowercase()
+          if (!storedAddresses.containsKey(key)) {
+            storedAddresses[key] = ChainSigner.addressForChain(wallet, chainEntry, isTestnet)
+            changed = true
+          }
+        }
+        if (changed) {
+          metadata[id] = storedAddresses
+          runCatching { NativeWalletStore.saveMetadata(context, metadata) }
+        }
+      }
+      val result = ChainSigner.sign(chainKey, wallet, unsignedTx, isTestnet)
+      val response = mutableMapOf<String, Any>("signedTx" to result.signedTx)
+      result.meta?.let { response["meta"] = it }
+      response
+    }
+
+    // The one sanctioned mnemonic exposure — explicit backup flow only.
+    AsyncFunction("exportMnemonic") Coroutine { walletId: String ->
+      val id = NativeWalletStore.validateWalletId(walletId)
+      val cipher = NativeWalletStore.authenticateForExistingWallet(activity, context, id, "Reveal recovery phrase")
+      NativeWalletStore.loadMnemonic(context, id, cipher)
+    }
+  }
+
+  /// Shows a native AlertDialog with decoded tx details before biometric auth fires.
+  /// The user must tap "Confirm & Sign" — cancelling throws UserCancelled.
+  private suspend fun confirmTransaction(chain: ChainKey, unsignedTx: Map<String, Any>) {
+    val message = ChainSigner.buildSummary(chain, unsignedTx)
+    suspendCancellableCoroutine<Unit> { continuation ->
+      activity.runOnUiThread {
+        AlertDialog.Builder(activity)
+          .setTitle("Confirm Transaction")
+          .setMessage(message)
+          .setPositiveButton("Confirm & Sign") { _, _ -> continuation.resume(Unit) }
+          .setNegativeButton("Cancel") { _, _ ->
+            continuation.resumeWithException(
+              CodedException("UserCancelled", "Transaction cancelled by user", null)
+            )
+          }
+          .setOnCancelListener {
+            continuation.resumeWithException(
+              CodedException("UserCancelled", "Transaction cancelled by user", null)
+            )
+          }
+          .show()
+      }
+    }
+  }
+
+  private suspend fun persistNewWallet(wallet: HDWallet, isTestnet: Boolean): Map<String, Any> {
+    val walletId = UUID.randomUUID().toString()
+    val addresses = ChainKey.entries.associate { chain ->
+      chain.name.lowercase() to ChainSigner.addressForChain(wallet, chain, isTestnet)
+    }
+
+    val cipher = NativeWalletStore.authenticateForNewWallet(activity, context, walletId, "Secure your new wallet")
+    NativeWalletStore.saveMnemonic(context, walletId, wallet.mnemonic(), cipher)
+
+    try {
+      val metadata = NativeWalletStore.loadMetadata(context).toMutableMap()
+      metadata[walletId] = addresses
+      NativeWalletStore.saveMetadata(context, metadata)
+    } catch (e: Exception) {
+      // The mnemonic/key is already persisted but has no metadata pointer — compensate by
+      // best-effort deleting it rather than leaving a permanent, invisible orphan. If this
+      // rollback delete also fails, there's nothing more useful to do than propagate the
+      // original error; the wallet is at least no worse off than before this call.
+      runCatching { NativeWalletStore.deleteMnemonic(context, walletId) }
+      throw e
+    }
+
+    return mapOf("walletId" to walletId, "addresses" to addresses)
+  }
+}