@chipmobilesdk/rn-auth 0.3.1 → 0.5.0

package/src/tokens/secureStore.ts

@@ -4,10 +4,14 @@
  * Refresh tokens and the session-restore artifact persist ONLY through this
  * port, backed by platform secure storage (iOS Keychain / Android Keystore).
  * Access tokens are never written here — they stay in memory (see accessToken).
- * The default adapter lazily requires the native module so unit tests that
- * inject a fake never load native code.
+ * The default adapter loads the native module on its first read or write, so
+ * creating it, and unit tests that inject a fake, load no native code.
  */
 
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+
+import { AuthConfigError } from '../diagnostics/errors';
+
 /** Single key under which the persisted session artifact is stored. */
 export const AUTH_STORAGE_KEY = '@chipmobilesdk/rn-auth/session';
 
@@ -29,23 +33,53 @@ export interface KeychainSecureStoreOptions {
 export function createKeychainSecureStore(
 	options: KeychainSecureStoreOptions = {},
 ): SecureTokenStore {
-	// Lazy require: only loaded when the default adapter is actually used.
-	const Keychain = require('react-native-keychain');
-	const accessible = options.accessible ?? Keychain.ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+	// The native module loads on the first read or write, never at startup (PERF-05).
+	const accessible = () =>
+		options.accessible ?? keychain().ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
 
 	return {
 		async getItem(key) {
-			const result = await Keychain.getGenericPassword({ service: key });
+			const result = await keychain().getGenericPassword({ service: key });
 			return result ? result.password : null;
 		},
 		async setItem(key, value) {
-			await Keychain.setGenericPassword('token', value, {
+			await keychain().setGenericPassword('token', value, {
 				service: key,
-				accessible,
+				accessible: accessible(),
 			});
 		},
 		async removeItem(key) {
-			await Keychain.resetGenericPassword({ service: key });
+			await keychain().resetGenericPassword({ service: key });
 		},
 	};
 }
+
+interface KeychainModule {
+	ACCESSIBLE?: { WHEN_UNLOCKED_THIS_DEVICE_ONLY?: string };
+	getGenericPassword(options: { service: string }): Promise<false | { password: string }>;
+	setGenericPassword(
+		username: string,
+		password: string,
+		options: { service: string; accessible: string | undefined },
+	): Promise<unknown>;
+	resetGenericPassword(options: { service: string }): Promise<unknown>;
+}
+
+const keychainPeer = lazyPeer('react-native-keychain', () => {
+	// Inside `try`, so Metro bundles an app that leaves this optional peer out.
+	try {
+		return require('react-native-keychain') as KeychainModule;
+	} catch (cause) {
+		throw cause;
+	}
+});
+
+function keychain(): KeychainModule {
+	return keychainPeer.require(
+		peer =>
+			new AuthConfigError(
+				'auth.error.configuration',
+				`${peer} is not installed or its native module is not linked`,
+			),
+	);
+}