@doko/react-native-yubikit 0.0.2

package/src/piv.ts

@@ -0,0 +1,193 @@
+import NativeYubikitPiv from './specs/NativeYubikitPiv';
+import type {
+  Base64String,
+  PivBioMetadata,
+  PivKeyType,
+  PivManagementKeyMetadata,
+  PivManagementKeyType,
+  PivPinMetadata,
+  PivPinPolicy,
+  PivSlot,
+  PivSlotMetadata,
+  PivTouchPolicy,
+} from './types';
+
+export function reset(deviceHandle: string): Promise<void> {
+  return NativeYubikitPiv.reset(deviceHandle);
+}
+
+export function getSerialNumber(deviceHandle: string): Promise<number> {
+  return NativeYubikitPiv.getSerialNumber(deviceHandle);
+}
+
+export function authenticate(
+  deviceHandle: string,
+  managementKey: Base64String
+): Promise<void> {
+  return NativeYubikitPiv.authenticate(deviceHandle, managementKey);
+}
+
+export function setManagementKey(
+  deviceHandle: string,
+  keyType: PivManagementKeyType,
+  managementKey: Base64String,
+  requireTouch: boolean
+): Promise<void> {
+  return NativeYubikitPiv.setManagementKey(
+    deviceHandle,
+    keyType,
+    managementKey,
+    requireTouch
+  );
+}
+
+export function verifyPin(deviceHandle: string, pin: string): Promise<void> {
+  return NativeYubikitPiv.verifyPin(deviceHandle, pin);
+}
+
+export function getPinAttempts(deviceHandle: string): Promise<number> {
+  return NativeYubikitPiv.getPinAttempts(deviceHandle);
+}
+
+export function changePin(
+  deviceHandle: string,
+  oldPin: string,
+  newPin: string
+): Promise<void> {
+  return NativeYubikitPiv.changePin(deviceHandle, oldPin, newPin);
+}
+
+export function changePuk(
+  deviceHandle: string,
+  oldPuk: string,
+  newPuk: string
+): Promise<void> {
+  return NativeYubikitPiv.changePuk(deviceHandle, oldPuk, newPuk);
+}
+
+export function unblockPin(
+  deviceHandle: string,
+  puk: string,
+  newPin: string
+): Promise<void> {
+  return NativeYubikitPiv.unblockPin(deviceHandle, puk, newPin);
+}
+
+export function setPinAttempts(
+  deviceHandle: string,
+  pinAttempts: number,
+  pukAttempts: number
+): Promise<void> {
+  return NativeYubikitPiv.setPinAttempts(
+    deviceHandle,
+    pinAttempts,
+    pukAttempts
+  );
+}
+
+export function getPinMetadata(deviceHandle: string): Promise<PivPinMetadata> {
+  return NativeYubikitPiv.getPinMetadata(
+    deviceHandle
+  ) as Promise<PivPinMetadata>;
+}
+
+export function getPukMetadata(deviceHandle: string): Promise<PivPinMetadata> {
+  return NativeYubikitPiv.getPukMetadata(
+    deviceHandle
+  ) as Promise<PivPinMetadata>;
+}
+
+export function getManagementKeyMetadata(
+  deviceHandle: string
+): Promise<PivManagementKeyMetadata> {
+  return NativeYubikitPiv.getManagementKeyMetadata(
+    deviceHandle
+  ) as Promise<PivManagementKeyMetadata>;
+}
+
+export function getSlotMetadata(
+  deviceHandle: string,
+  slot: PivSlot
+): Promise<PivSlotMetadata> {
+  return NativeYubikitPiv.getSlotMetadata(
+    deviceHandle,
+    slot
+  ) as Promise<PivSlotMetadata>;
+}
+
+export function getCertificate(
+  deviceHandle: string,
+  slot: PivSlot
+): Promise<Base64String> {
+  return NativeYubikitPiv.getCertificate(deviceHandle, slot);
+}
+
+export function putCertificate(
+  deviceHandle: string,
+  slot: PivSlot,
+  certificate: Base64String,
+  compress?: boolean
+): Promise<void> {
+  return NativeYubikitPiv.putCertificate(
+    deviceHandle,
+    slot,
+    certificate,
+    compress
+  );
+}
+
+export function deleteCertificate(
+  deviceHandle: string,
+  slot: PivSlot
+): Promise<void> {
+  return NativeYubikitPiv.deleteCertificate(deviceHandle, slot);
+}
+
+export function attestKey(
+  deviceHandle: string,
+  slot: PivSlot
+): Promise<Base64String> {
+  return NativeYubikitPiv.attestKey(deviceHandle, slot);
+}
+
+export function generateKey(
+  deviceHandle: string,
+  slot: PivSlot,
+  keyType: PivKeyType,
+  pinPolicy: PivPinPolicy,
+  touchPolicy: PivTouchPolicy
+): Promise<Base64String> {
+  return NativeYubikitPiv.generateKey(
+    deviceHandle,
+    slot,
+    keyType,
+    pinPolicy,
+    touchPolicy
+  );
+}
+
+export function deleteKey(deviceHandle: string, slot: PivSlot): Promise<void> {
+  return NativeYubikitPiv.deleteKey(deviceHandle, slot);
+}
+
+export function rawSignOrDecrypt(
+  deviceHandle: string,
+  slot: PivSlot,
+  keyType: PivKeyType,
+  payload: Base64String
+): Promise<Base64String> {
+  return NativeYubikitPiv.rawSignOrDecrypt(
+    deviceHandle,
+    slot,
+    keyType,
+    payload
+  );
+}
+
+export function getBioMetadata(deviceHandle: string): Promise<PivBioMetadata> {
+  return NativeYubikitPiv.getBioMetadata(
+    deviceHandle
+  ) as Promise<PivBioMetadata>;
+}
+
+export { NativeYubikitPiv };

package/src/specs/NativeYubikitCore.ts

@@ -0,0 +1,68 @@
+import {
+  TurboModuleRegistry,
+  type TurboModule,
+  type CodegenTypes,
+} from 'react-native';
+
+interface UsbConfiguration {
+  handlePermissions?: boolean;
+}
+
+interface NfcConfiguration {
+  timeout?: number;
+  disableNfcDiscoverySound?: boolean;
+  skipNdefCheck?: boolean;
+  handleUnavailableNfc?: boolean;
+}
+
+interface YubiKeyDevice {
+  handle: string;
+  transport: 'usb' | 'nfc';
+  supportedConnections: string[];
+}
+
+// Codegen doesn't support discriminated union payloads, so every variant's
+// fields are optional here; consumers get the narrower YubiKeyEvent union
+// via Core.addYubiKeyListener instead of calling this event directly.
+interface YubiKeyEventPayload {
+  type: 'attached' | 'detached' | 'error';
+  device?: YubiKeyDevice;
+  handle?: string;
+  error?: string;
+}
+
+export interface Spec extends TurboModule {
+  /** Start listening for USB YubiKeys. */
+  startUsbDiscovery(config?: UsbConfiguration): void;
+  /** Stop listening for USB YubiKeys. */
+  stopUsbDiscovery(): void;
+  /** Start listening for NFC YubiKeys. */
+  startNfcDiscovery(config?: NfcConfiguration): void;
+  /** Stop listening for NFC YubiKeys. */
+  stopNfcDiscovery(): void;
+
+  /**
+   * Request a connection to a discovered device. The promise resolves with a
+   * connection handle that can be passed to session modules.
+   */
+  requestConnection(
+    deviceHandle: string,
+    connectionType: string
+  ): Promise<string>;
+
+  /**
+   * Send a raw APDU over a SmartCardConnection and receive the response.
+   */
+  sendApdu(connectionHandle: string, apdu: string): Promise<string>;
+
+  /** Close an opened connection. */
+  closeConnection(connectionHandle: string): void;
+
+  /** List devices currently held by the manager. */
+  getDiscoveredDevices(): YubiKeyDevice[];
+
+  /** Fires on device attach/detach and discovery-connection failures. */
+  readonly onYubiKeyEvent: CodegenTypes.EventEmitter<YubiKeyEventPayload>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('YubikitCore');

package/src/specs/NativeYubikitFido.ts

@@ -0,0 +1,149 @@
+import { TurboModuleRegistry, type TurboModule } from 'react-native';
+
+interface PublicKeyCredentialRpEntity {
+  id: string;
+  name: string;
+}
+
+interface PublicKeyCredentialUserEntity {
+  id: string;
+  name: string;
+  displayName: string;
+}
+
+interface PublicKeyCredentialParameters {
+  type: string;
+  alg: number;
+}
+
+interface PublicKeyCredentialCreationOptions {
+  rp: PublicKeyCredentialRpEntity;
+  user: PublicKeyCredentialUserEntity;
+  challenge: string;
+  pubKeyCredParams: PublicKeyCredentialParameters[];
+  timeout?: number;
+  excludeCredentials?: Array<{
+    id: string;
+    type: string;
+    transports?: string[];
+  }>;
+  authenticatorSelection?: {
+    authenticatorAttachment?: string;
+    residentKey?: string;
+    userVerification?: string;
+  };
+  attestation?: string;
+  extensions?: { [key: string]: unknown };
+}
+
+interface PublicKeyCredentialRequestOptions {
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: Array<{
+    id: string;
+    type: string;
+    transports?: string[];
+  }>;
+  userVerification?: string;
+  extensions?: { [key: string]: unknown };
+}
+
+interface PublicKeyCredential {
+  id: string;
+  rawId: string;
+  type: 'public-key';
+  response: {
+    clientDataJSON: string;
+    authenticatorData?: string;
+    attestationObject?: string;
+    signature?: string;
+    userHandle?: string;
+  };
+}
+
+interface Ctap2Info {
+  versions: string[];
+  extensions?: string[];
+  aaguid?: string;
+  options?: { [key: string]: boolean };
+  maxMsgSize?: number;
+  pinUvAuthProtocols?: number[];
+  maxCredentialCountInList?: number;
+  maxCredentialIdLength?: number;
+  transports?: string[];
+  algorithms?: Array<{ type: string; alg: number }>;
+  maxLargeBlob?: number;
+  minPinLength?: number;
+  firmwareVersion?: number;
+  maxCredBlobLength?: number;
+  maxRpidsForMinPinLength?: number;
+  preferredPlatformUvAttempts?: number;
+  uvModality?: number;
+  certifications?: { [key: string]: number };
+  remainingDiscoverableCredentials?: number;
+  vendorPrototypeConfigCommands?: number[];
+}
+
+interface FidoCredentialDescriptor {
+  id: string;
+  type: string;
+}
+
+interface FidoCredentialUserEntity {
+  id: string;
+  name: string;
+  displayName: string;
+}
+
+export interface Spec extends TurboModule {
+  /** Get CTAP2 authenticator info. */
+  getInfo(deviceHandle: string): Promise<Ctap2Info>;
+
+  /** Perform a WebAuthn registration (makeCredential). */
+  makeCredential(
+    deviceHandle: string,
+    options: PublicKeyCredentialCreationOptions,
+    effectiveDomain: string,
+    pin?: string,
+    enterpriseAttestation?: number
+  ): Promise<PublicKeyCredential>;
+
+  /** Perform a WebAuthn authentication (getAssertion). */
+  getAssertion(
+    deviceHandle: string,
+    options: PublicKeyCredentialRequestOptions,
+    effectiveDomain: string,
+    pin?: string
+  ): Promise<PublicKeyCredential>;
+
+  /** Reset the authenticator. */
+  reset(deviceHandle: string): Promise<void>;
+
+  /** Credential management operations (requires PIN). */
+  getCredentialCount(deviceHandle: string, pin: string): Promise<number>;
+  getRpIdList(deviceHandle: string, pin: string): Promise<string[]>;
+  getCredentials(
+    deviceHandle: string,
+    rpId: string,
+    pin: string
+  ): Promise<
+    Array<{
+      credential: FidoCredentialDescriptor;
+      user: FidoCredentialUserEntity;
+    }>
+  >;
+  deleteCredential(
+    deviceHandle: string,
+    credential: FidoCredentialDescriptor,
+    pin: string
+  ): Promise<void>;
+  updateUserInformation(
+    deviceHandle: string,
+    credential: FidoCredentialDescriptor,
+    user: FidoCredentialUserEntity,
+    pin: string
+  ): Promise<void>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('YubikitFido');

package/src/specs/NativeYubikitManagement.ts

@@ -0,0 +1,78 @@
+import { TurboModuleRegistry, type TurboModule } from 'react-native';
+
+interface Version {
+  major: number;
+  minor: number;
+  micro: number;
+}
+
+interface DeviceConfig {
+  enabledCapabilities?: {
+    usb?: number;
+    nfc?: number;
+  };
+  autoEjectTimeout?: number;
+  challengeResponseTimeout?: number;
+  nfcRestricted?: boolean;
+  deviceFlags?: number;
+}
+
+interface DeviceInfo {
+  config?: DeviceConfig;
+  serialNumber?: number;
+  version: Version;
+  versionName: string;
+  formFactor:
+    | 'UNKNOWN'
+    | 'USB_A_KEYCHAIN'
+    | 'USB_A_NANO'
+    | 'USB_C_KEYCHAIN'
+    | 'USB_C_NANO'
+    | 'USB_C_LIGHTNING'
+    | 'USB_A_BIO'
+    | 'USB_C_BIO';
+  supportedCapabilities: {
+    usb?: number;
+    nfc?: number;
+  };
+  hasTransportUsb: boolean;
+  hasTransportNfc: boolean;
+  isLocked: boolean;
+  isFips: boolean;
+  isSky: boolean;
+  partNumber?: string;
+  fipsCapable: number;
+  fipsApproved: number;
+  pinComplexity: boolean;
+  resetBlocked: number;
+  fpsVersion?: Version;
+  stmVersion?: Version;
+  versionQualifier?: string;
+}
+
+export interface Spec extends TurboModule {
+  /** Read metadata from a YubiKey. */
+  getDeviceInfo(deviceHandle: string): Promise<DeviceInfo>;
+
+  /** Update device configuration. */
+  updateDeviceConfig(
+    deviceHandle: string,
+    config: DeviceConfig,
+    reboot: boolean,
+    currentLockCode?: string,
+    newLockCode?: string
+  ): Promise<void>;
+
+  /** Set the USB interface mode. */
+  setMode(
+    deviceHandle: string,
+    mode: string,
+    chalrespTimeout: number,
+    autoejectTimeout: number
+  ): Promise<void>;
+
+  /** Reset the device to factory defaults. */
+  deviceReset(deviceHandle: string): Promise<void>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('YubikitManagement');

package/src/specs/NativeYubikitOath.ts

@@ -0,0 +1,110 @@
+import { TurboModuleRegistry, type TurboModule } from 'react-native';
+
+interface Credential {
+  id: string;
+  oathType: 'HOTP' | 'TOTP';
+  issuer?: string;
+  accountName: string;
+  period: number;
+  touchRequired: boolean;
+}
+
+interface Code {
+  value: string;
+  validFrom: number;
+  validUntil: number;
+}
+
+interface CredentialData {
+  accountName: string;
+  oathType: 'HOTP' | 'TOTP';
+  hashAlgorithm: 'SHA1' | 'SHA256' | 'SHA512';
+  secret: string;
+  digits: number;
+  period: number;
+  counter: number;
+  issuer?: string;
+}
+
+interface OathCredentialsResult {
+  credentials: Credential[];
+}
+
+interface OathCodesResult {
+  codes: Array<{ credential: Credential; code?: Code }>;
+}
+
+export interface Spec extends TurboModule {
+  /** Get a stable ID for the OATH application on this device. */
+  getDeviceId(deviceHandle: string): Promise<string>;
+
+  /** Reset the OATH application. */
+  reset(deviceHandle: string): Promise<void>;
+
+  /** True if an access key/password is configured. */
+  isAccessKeySet(deviceHandle: string): Promise<boolean>;
+
+  /** True if the session is locked and needs unlock. */
+  isLocked(deviceHandle: string): Promise<boolean>;
+
+  /** Unlock with a password. */
+  unlockWithPassword(deviceHandle: string, password: string): Promise<boolean>;
+
+  /** Unlock with a raw access key. */
+  unlockWithAccessKey(
+    deviceHandle: string,
+    accessKey: string
+  ): Promise<boolean>;
+
+  /** Set or change the password used to derive the access key. */
+  setPassword(deviceHandle: string, password: string): Promise<void>;
+
+  /** Set the raw access key directly. */
+  setAccessKey(deviceHandle: string, accessKey: string): Promise<void>;
+
+  /** Remove access key protection. */
+  deleteAccessKey(deviceHandle: string): Promise<void>;
+
+  /** List stored credentials. */
+  getCredentials(deviceHandle: string): Promise<OathCredentialsResult>;
+
+  /** Calculate all TOTP codes for the current time. */
+  calculateCodes(
+    deviceHandle: string,
+    timestamp?: number
+  ): Promise<OathCodesResult>;
+
+  /** Calculate a HOTP response for a credential. */
+  calculateResponse(
+    deviceHandle: string,
+    credentialId: string,
+    challenge: string
+  ): Promise<string>;
+
+  /** Calculate a single TOTP/HOTP code. */
+  calculateCode(
+    deviceHandle: string,
+    credentialId: string,
+    timestamp?: number
+  ): Promise<Code>;
+
+  /** Add a new credential. */
+  putCredential(
+    deviceHandle: string,
+    credentialData: CredentialData,
+    requireTouch: boolean
+  ): Promise<Credential>;
+
+  /** Delete a credential by ID. */
+  deleteCredential(deviceHandle: string, credentialId: string): Promise<void>;
+
+  /** Rename a credential by ID. */
+  renameCredential(
+    deviceHandle: string,
+    credentialId: string,
+    newAccountName: string,
+    newIssuer?: string
+  ): Promise<Credential>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('YubikitOath');