@doko/react-native-yubikit 0.0.2

package/android/src/main/java/com/yubikit/YubikitCoreModule.kt

@@ -0,0 +1,142 @@
+package com.yubikit
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableArray
+import com.yubico.yubikit.android.transport.nfc.NfcConfiguration
+import com.yubico.yubikit.android.transport.nfc.NfcNotAvailable
+import com.yubico.yubikit.android.transport.usb.UsbConfiguration
+import com.yubico.yubikit.core.fido.FidoConnection
+import com.yubico.yubikit.core.otp.OtpConnection
+import com.yubico.yubikit.core.smartcard.SmartCardConnection
+import com.yubikit.YubiKitManagerHolder.deviceToBundle
+import com.yubikit.utils.YubikitUtils.base64Decode
+import com.yubikit.utils.YubikitUtils.base64Encode
+import com.yubikit.utils.YubikitUtils.toWritableMap
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.io.IOException
+
+@Suppress("unused")
+class YubikitCoreModule(reactContext: ReactApplicationContext) :
+  NativeYubikitCoreSpec(reactContext) {
+
+  private val moduleScope = CoroutineScope(Dispatchers.IO)
+
+  init {
+    YubiKitManagerHolder.setEventHandler { params -> emitOnYubiKeyEvent(params) }
+  }
+
+  override fun getName(): String = NAME
+
+  override fun startUsbDiscovery(config: ReadableMap?) {
+    YubiKitManagerHolder.initialize(reactApplicationContext)
+    val usbConfig = UsbConfiguration()
+    config?.let {
+      if (it.hasKey("handlePermissions") && !it.isNull("handlePermissions")) {
+        usbConfig.handlePermissions(it.getBoolean("handlePermissions"))
+      }
+    }
+    YubiKitManagerHolder.setUsbConfiguration(usbConfig)
+    YubiKitManagerHolder.startUsbDiscovery()
+  }
+
+  override fun stopUsbDiscovery() {
+    YubiKitManagerHolder.stopUsbDiscovery()
+  }
+
+  override fun startNfcDiscovery(config: ReadableMap?) {
+    YubiKitManagerHolder.initialize(reactApplicationContext)
+    val nfcConfig = NfcConfiguration()
+    config?.let {
+      if (it.hasKey("timeout") && !it.isNull("timeout")) {
+        nfcConfig.timeout(it.getInt("timeout"))
+      }
+      if (it.hasKey("disableNfcDiscoverySound") && !it.isNull("disableNfcDiscoverySound")) {
+        nfcConfig.disableNfcDiscoverySound(it.getBoolean("disableNfcDiscoverySound"))
+      }
+      if (it.hasKey("skipNdefCheck") && !it.isNull("skipNdefCheck")) {
+        nfcConfig.skipNdefCheck(it.getBoolean("skipNdefCheck"))
+      }
+      if (it.hasKey("handleUnavailableNfc") && !it.isNull("handleUnavailableNfc")) {
+        nfcConfig.handleUnavailableNfc(it.getBoolean("handleUnavailableNfc"))
+      }
+    }
+    YubiKitManagerHolder.setNfcConfiguration(nfcConfig)
+    val activity = reactApplicationContext.currentActivity
+      ?: throw IllegalStateException("No current Activity for NFC discovery")
+    YubiKitManagerHolder.startNfcDiscovery(activity)
+  }
+
+  override fun stopNfcDiscovery() {
+    val activity = reactApplicationContext.currentActivity
+      ?: throw IllegalStateException("No current Activity for NFC discovery")
+    YubiKitManagerHolder.stopNfcDiscovery(activity)
+  }
+
+  override fun requestConnection(deviceHandle: String, connectionType: String, promise: Promise) {
+    moduleScope.launch {
+      try {
+        val clazz = when (connectionType) {
+          "SmartCardConnection" -> SmartCardConnection::class.java
+          "OtpConnection" -> OtpConnection::class.java
+          "FidoConnection" -> FidoConnection::class.java
+          else -> throw IllegalArgumentException("Unknown connection type: $connectionType")
+        }
+        var result: Result<Pair<String, com.yubico.yubikit.core.YubiKeyConnection>>? = null
+        YubiKitManagerHolder.requestConnection(deviceHandle, clazz) { res ->
+          result = res
+        }
+        // Wait briefly for callback (requestConnection callback is typically synchronous-ish)
+        withContext(Dispatchers.IO) {
+          var waited = 0
+          while (result == null && waited < 5000) {
+            Thread.sleep(50)
+            waited += 50
+          }
+        }
+        val pair = result?.getOrThrow()
+          ?: throw IOException("Timeout waiting for connection")
+        promise.resolve(pair.first)
+      } catch (e: Exception) {
+        promise.reject("CONNECTION_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun sendApdu(connectionHandle: String, apdu: String, promise: Promise) {
+    moduleScope.launch {
+      try {
+        val connection = YubiKitManagerHolder.getConnection(connectionHandle)
+        if (connection !is SmartCardConnection) {
+          throw IllegalArgumentException("sendApdu requires a SmartCardConnection")
+        }
+        val data = base64Decode(apdu) ?: byteArrayOf()
+        val response = connection.sendAndReceive(data)
+        promise.resolve(base64Encode(response))
+      } catch (e: Exception) {
+        promise.reject("APDU_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun closeConnection(connectionHandle: String) {
+    YubiKitManagerHolder.removeConnection(connectionHandle)
+  }
+
+  override fun getDiscoveredDevices(): WritableArray {
+    val array = Arguments.createArray()
+    YubiKitManagerHolder.listDevices().forEach { (handle, device) ->
+      array.pushMap(deviceToBundle(handle, device).toWritableMap())
+    }
+    return array
+  }
+
+  companion object {
+    const val NAME = "YubikitCore"
+  }
+}

package/android/src/main/java/com/yubikit/YubikitFidoModule.kt

@@ -0,0 +1,418 @@
+package com.yubikit
+
+import android.util.Base64
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableMap
+import com.yubico.yubikit.core.YubiKeyConnection
+import com.yubico.yubikit.core.fido.FidoConnection
+import com.yubico.yubikit.core.smartcard.SmartCardConnection
+import com.yubico.yubikit.fido.client.Ctap2Client
+import com.yubico.yubikit.fido.client.CredentialManager
+import com.yubico.yubikit.fido.client.WebAuthnClient
+import com.yubico.yubikit.fido.client.clientdata.ClientDataProvider
+import com.yubico.yubikit.fido.ctap.Ctap2Session
+import com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse
+import com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse
+import com.yubico.yubikit.fido.webauthn.AuthenticatorSelectionCriteria
+import com.yubico.yubikit.fido.webauthn.Extensions
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredential
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialParameters
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialRequestOptions
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialRpEntity
+import com.yubico.yubikit.fido.webauthn.PublicKeyCredentialUserEntity
+import com.yubikit.utils.YubikitUtils.base64Decode
+import com.yubikit.utils.YubikitUtils.base64Encode
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import org.json.JSONObject
+
+@Suppress("unused")
+class YubikitFidoModule(reactContext: ReactApplicationContext) :
+  NativeYubikitFidoSpec(reactContext) {
+
+  private val moduleScope = CoroutineScope(Dispatchers.IO)
+
+  override fun getName(): String = NAME
+
+  // NfcYubiKeyDevice only ever supports SmartCardConnection, so hardcoding
+  // FidoConnection here would break every CTAP2/FIDO2 operation over NFC.
+  // Ctap2Session accepts either connection type, so prefer FidoConnection (USB)
+  // and fall back to SmartCardConnection (NFC and USB devices without CCID).
+  private val ctap2ConnectionOrder = listOf(
+    FidoConnection::class.java as Class<out YubiKeyConnection>,
+    SmartCardConnection::class.java
+  )
+
+  private fun openCtap2Session(connection: YubiKeyConnection): Ctap2Session {
+    return when (connection) {
+      is FidoConnection -> Ctap2Session(connection)
+      is SmartCardConnection -> Ctap2Session(connection)
+      else -> throw IllegalArgumentException("Unsupported connection type for CTAP2: $connection")
+    }
+  }
+
+  private inline fun <R> withFidoConnection(
+    deviceHandle: String,
+    promise: Promise,
+    crossinline block: (YubiKeyConnection) -> R
+  ) {
+    moduleScope.launch {
+      try {
+        val result = YubiKitManagerHolder.withAnyConnection(deviceHandle, ctap2ConnectionOrder) { connection -> block(connection) }
+        when (result) {
+          is Unit -> promise.resolve(null)
+          else -> promise.resolve(result)
+        }
+      } catch (e: Exception) {
+        promise.reject("FIDO_ERROR", e.message, e)
+      }
+    }
+  }
+
+  /**
+   * The SDK only accepts a pre-built clientDataJSON hash, so the standard WebAuthn
+   * clientDataJSON must be constructed here from the JS-supplied challenge.
+   */
+  private fun base64UrlEncode(bytes: ByteArray): String {
+    return Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_PADDING or Base64.NO_WRAP)
+  }
+
+  private fun buildClientData(type: String, challenge: ByteArray, effectiveDomain: String): ClientDataProvider {
+    val json = JSONObject().apply {
+      put("type", type)
+      put("challenge", base64UrlEncode(challenge))
+      put("origin", "https://$effectiveDomain")
+      put("crossOrigin", false)
+    }
+    return ClientDataProvider.fromClientDataJson(json.toString().toByteArray(Charsets.UTF_8))
+  }
+
+  private fun mapToPublicKeyCredential(cred: PublicKeyCredential): WritableMap {
+    return Arguments.createMap().apply {
+      putString("id", base64Encode(cred.rawId))
+      putString("rawId", base64Encode(cred.rawId))
+      putString("type", "public-key")
+      putMap("response", Arguments.createMap().apply {
+        val response = cred.response
+        putString("clientDataJSON", base64Encode(response.clientDataJson))
+        when (response) {
+          is AuthenticatorAttestationResponse -> {
+            putString("authenticatorData", base64Encode(response.authenticatorData.bytes))
+            putString("attestationObject", base64Encode(response.attestationObject))
+          }
+          is AuthenticatorAssertionResponse -> {
+            putString("authenticatorData", base64Encode(response.authenticatorData))
+            putString("signature", base64Encode(response.signature))
+            response.userHandle?.let { putString("userHandle", base64Encode(it)) }
+          }
+        }
+      })
+    }
+  }
+
+  private fun mapCtap2Info(info: Ctap2Session.InfoData): WritableMap {
+    return Arguments.createMap().apply {
+      val versions = Arguments.createArray()
+      info.versions.forEach { versions.pushString(it) }
+      putArray("versions", versions)
+      putString("aaguid", base64Encode(info.aaguid))
+      val extensions = Arguments.createArray()
+      info.extensions.forEach { extensions.pushString(it) }
+      putArray("extensions", extensions)
+      val optsMap = Arguments.createMap()
+      info.options.forEach { (k, v) -> if (v is Boolean) optsMap.putBoolean(k, v) }
+      putMap("options", optsMap)
+      putInt("maxMsgSize", info.maxMsgSize)
+      val protos = Arguments.createArray()
+      info.pinUvAuthProtocols.forEach { protos.pushInt(it) }
+      putArray("pinUvAuthProtocols", protos)
+      info.maxCredentialCountInList?.let { putInt("maxCredentialCountInList", it) }
+      info.maxCredentialIdLength?.let { putInt("maxCredentialIdLength", it) }
+      val transports = Arguments.createArray()
+      info.transports.forEach { transports.pushString(it) }
+      putArray("transports", transports)
+      val algorithms = Arguments.createArray()
+      info.algorithms.forEach { alg ->
+        algorithms.pushMap(Arguments.createMap().apply {
+          putString("type", alg.type)
+          putInt("alg", alg.alg)
+        })
+      }
+      putArray("algorithms", algorithms)
+      putInt("maxLargeBlob", info.maxSerializedLargeBlobArray)
+      putInt("minPinLength", info.minPinLength)
+      putInt("maxCredBlobLength", info.maxCredBlobLength)
+      putInt("maxRpidsForMinPinLength", info.maxRpidsForSetMinPinLength)
+      info.preferredPlatformUvAttempts?.let { putInt("preferredPlatformUvAttempts", it) }
+      putInt("uvModality", info.uvModality)
+      val certsMap = Arguments.createMap()
+      info.certifications.forEach { (k, v) -> if (v is Int) certsMap.putInt(k, v) }
+      putMap("certifications", certsMap)
+      info.remainingDiscoverableCredentials?.let { putInt("remainingDiscoverableCredentials", it) }
+      info.vendorPrototypeConfigCommands?.let { cmds ->
+        val arr = Arguments.createArray()
+        cmds.forEach { arr.pushInt(it) }
+        putArray("vendorPrototypeConfigCommands", arr)
+      }
+    }
+  }
+
+  override fun getInfo(deviceHandle: String, promise: Promise) {
+    withFidoConnection(deviceHandle, promise) { connection ->
+      openCtap2Session(connection).use { session ->
+        mapCtap2Info(session.info)
+      }
+    }
+  }
+
+  override fun makeCredential(
+    deviceHandle: String,
+    options: ReadableMap,
+    effectiveDomain: String,
+    pin: String?,
+    enterpriseAttestation: Double?,
+    promise: Promise
+  ) {
+    moduleScope.launch {
+      try {
+        val credential = YubiKitManagerHolder.withAnyConnection(deviceHandle, ctap2ConnectionOrder) { connection ->
+          WebAuthnClient.create(connection, null, null).use { client ->
+            val rpMap = options.getMap("rp")!!
+            val userMap = options.getMap("user")!!
+            val challenge = base64Decode(options.getString("challenge")) ?: byteArrayOf()
+            val clientData = buildClientData("webauthn.create", challenge, effectiveDomain)
+
+            val pubKeyCredParams = options.getArray("pubKeyCredParams")!!.let { arr ->
+              (0 until arr.size()).map { i ->
+                val m = arr.getMap(i)!!
+                PublicKeyCredentialParameters(
+                  m.getString("type") ?: "public-key",
+                  m.getInt("alg")
+                )
+              }
+            }
+
+            val rp = PublicKeyCredentialRpEntity(
+              rpMap.getString("name") ?: rpMap.getString("id") ?: effectiveDomain,
+              rpMap.getString("id") ?: effectiveDomain
+            )
+            val user = PublicKeyCredentialUserEntity(
+              userMap.getString("name") ?: "",
+              base64Decode(userMap.getString("id")) ?: byteArrayOf(),
+              userMap.getString("displayName") ?: ""
+            )
+
+            val excludeCredentials = options.getArray("excludeCredentials")?.let { arr ->
+              (0 until arr.size()).map { i ->
+                val m = arr.getMap(i)!!
+                PublicKeyCredentialDescriptor(
+                  m.getString("type") ?: "public-key",
+                  base64Decode(m.getString("id")) ?: byteArrayOf(),
+                  m.getArray("transports")?.toArrayList()?.map { it.toString() }
+                )
+              }
+            }
+
+            val authenticatorSelection = options.getMap("authenticatorSelection")?.let { sel ->
+              AuthenticatorSelectionCriteria(
+                sel.getString("authenticatorAttachment"),
+                sel.getString("residentKey"),
+                sel.getString("userVerification")
+              )
+            }
+
+            val extensions = options.getMap("extensions")?.toHashMap()?.let { Extensions.fromMap(it) }
+
+            val creationOptions = PublicKeyCredentialCreationOptions(
+              rp,
+              user,
+              challenge,
+              pubKeyCredParams,
+              if (options.hasKey("timeout") && !options.isNull("timeout")) options.getDouble("timeout").toLong() else null,
+              excludeCredentials,
+              authenticatorSelection,
+              options.getString("attestation"),
+              extensions
+            )
+
+            client.makeCredential(
+              clientData,
+              creationOptions,
+              effectiveDomain,
+              pin?.toCharArray(),
+              enterpriseAttestation?.toInt(),
+              null
+            )
+          }
+        }
+        promise.resolve(mapToPublicKeyCredential(credential))
+      } catch (e: Exception) {
+        promise.reject("FIDO_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun getAssertion(
+    deviceHandle: String,
+    options: ReadableMap,
+    effectiveDomain: String,
+    pin: String?,
+    promise: Promise
+  ) {
+    moduleScope.launch {
+      try {
+        val credential = YubiKitManagerHolder.withAnyConnection(deviceHandle, ctap2ConnectionOrder) { connection ->
+          WebAuthnClient.create(connection, null, null).use { client ->
+            val challenge = base64Decode(options.getString("challenge")) ?: byteArrayOf()
+            val clientData = buildClientData("webauthn.get", challenge, effectiveDomain)
+            val rpId = options.getString("rpId") ?: effectiveDomain
+
+            val allowCredentials = options.getArray("allowCredentials")?.let { arr ->
+              (0 until arr.size()).map { i ->
+                val m = arr.getMap(i)!!
+                PublicKeyCredentialDescriptor(
+                  m.getString("type") ?: "public-key",
+                  base64Decode(m.getString("id")) ?: byteArrayOf(),
+                  m.getArray("transports")?.toArrayList()?.map { it.toString() }
+                )
+              }
+            }
+
+            val extensions = options.getMap("extensions")?.toHashMap()?.let { Extensions.fromMap(it) }
+
+            val requestOptions = PublicKeyCredentialRequestOptions(
+              challenge,
+              if (options.hasKey("timeout") && !options.isNull("timeout")) options.getDouble("timeout").toLong() else null,
+              rpId,
+              allowCredentials,
+              options.getString("userVerification"),
+              extensions
+            )
+
+            client.getAssertion(clientData, requestOptions, effectiveDomain, pin?.toCharArray(), null)
+          }
+        }
+        promise.resolve(mapToPublicKeyCredential(credential))
+      } catch (e: Exception) {
+        promise.reject("FIDO_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun reset(deviceHandle: String, promise: Promise) {
+    withFidoConnection(deviceHandle, promise) { connection ->
+      openCtap2Session(connection).use { it.reset(null) }
+    }
+  }
+
+  private fun withCredentialManager(
+    deviceHandle: String,
+    pin: String,
+    promise: Promise,
+    block: (CredentialManager) -> Any?
+  ) {
+    moduleScope.launch {
+      try {
+        val result = YubiKitManagerHolder.withAnyConnection(deviceHandle, ctap2ConnectionOrder) { connection ->
+          Ctap2Client(openCtap2Session(connection)).use { client ->
+            val manager = client.getCredentialManager(pin.toCharArray())
+            block(manager)
+          }
+        }
+        when (result) {
+          is Unit -> promise.resolve(null)
+          else -> promise.resolve(result)
+        }
+      } catch (e: Exception) {
+        promise.reject("FIDO_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun getCredentialCount(deviceHandle: String, pin: String, promise: Promise) {
+    withCredentialManager(deviceHandle, pin, promise) { it.credentialCount }
+  }
+
+  override fun getRpIdList(deviceHandle: String, pin: String, promise: Promise) {
+    withCredentialManager(deviceHandle, pin, promise) {
+      val list = it.rpIdList
+      val arr = Arguments.createArray()
+      list.forEach { rpId -> arr.pushString(rpId) }
+      arr
+    }
+  }
+
+  override fun getCredentials(
+    deviceHandle: String,
+    rpId: String,
+    pin: String,
+    promise: Promise
+  ) {
+    withCredentialManager(deviceHandle, pin, promise) { manager ->
+      val creds = manager.getCredentials(rpId)
+      val arr = Arguments.createArray()
+      creds.forEach { (descriptor, user) ->
+        arr.pushMap(Arguments.createMap().apply {
+          putMap("credential", Arguments.createMap().apply {
+            putString("id", base64Encode(descriptor.id))
+            putString("type", descriptor.type)
+          })
+          putMap("user", Arguments.createMap().apply {
+            putString("id", base64Encode(user.id))
+            putString("name", user.name)
+            putString("displayName", user.displayName)
+          })
+        })
+      }
+      arr
+    }
+  }
+
+  override fun deleteCredential(
+    deviceHandle: String,
+    credential: ReadableMap,
+    pin: String,
+    promise: Promise
+  ) {
+    withCredentialManager(deviceHandle, pin, promise) { manager ->
+      manager.deleteCredential(
+        PublicKeyCredentialDescriptor(
+          credential.getString("type") ?: "public-key",
+          base64Decode(credential.getString("id")) ?: byteArrayOf()
+        )
+      )
+    }
+  }
+
+  override fun updateUserInformation(
+    deviceHandle: String,
+    credential: ReadableMap,
+    user: ReadableMap,
+    pin: String,
+    promise: Promise
+  ) {
+    withCredentialManager(deviceHandle, pin, promise) { manager ->
+      manager.updateUserInformation(
+        PublicKeyCredentialDescriptor(
+          credential.getString("type") ?: "public-key",
+          base64Decode(credential.getString("id")) ?: byteArrayOf()
+        ),
+        PublicKeyCredentialUserEntity(
+          user.getString("name") ?: "",
+          base64Decode(user.getString("id")) ?: byteArrayOf(),
+          user.getString("displayName") ?: ""
+        )
+      )
+    }
+  }
+
+  companion object {
+    const val NAME = "YubikitFido"
+  }
+}

package/android/src/main/java/com/yubikit/YubikitManagementModule.kt

@@ -0,0 +1,132 @@
+package com.yubikit
+
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableMap
+import com.yubico.yubikit.core.YubiKeyConnection
+import com.yubico.yubikit.core.fido.FidoConnection
+import com.yubico.yubikit.core.otp.OtpConnection
+import com.yubico.yubikit.core.smartcard.SmartCardConnection
+import com.yubico.yubikit.management.ManagementSession
+import com.yubico.yubikit.core.UsbInterface
+import com.yubikit.utils.YubikitUtils.base64Decode
+import com.yubikit.utils.YubikitUtils.deviceInfoToMap
+import com.yubikit.utils.YubikitUtils.parseDeviceConfig
+import com.yubikit.utils.YubikitUtils.parseUsbMode
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+
+@Suppress("unused")
+class YubikitManagementModule(reactContext: ReactApplicationContext) :
+  NativeYubikitManagementSpec(reactContext) {
+
+  private val moduleScope = CoroutineScope(Dispatchers.IO)
+
+  // ManagementSession supports SmartCard, Otp and Fido connections; hardcoding
+  // SmartCardConnection breaks OTP-only and FIDO-only-mode devices (e.g. a YubiKey
+  // with CCID disabled via USB mode config).
+  private val managementConnectionOrder = listOf(
+    SmartCardConnection::class.java as Class<out YubiKeyConnection>,
+    OtpConnection::class.java,
+    FidoConnection::class.java
+  )
+
+  private fun openManagementSession(connection: YubiKeyConnection): ManagementSession {
+    return when (connection) {
+      is SmartCardConnection -> ManagementSession(connection)
+      is OtpConnection -> ManagementSession(connection)
+      is FidoConnection -> ManagementSession(connection)
+      else -> throw IllegalArgumentException("Unsupported connection type for Management: $connection")
+    }
+  }
+
+  override fun getName(): String = NAME
+
+  override fun getDeviceInfo(deviceHandle: String, promise: Promise) {
+    moduleScope.launch {
+      try {
+        val info = YubiKitManagerHolder.withAnyConnection(deviceHandle, managementConnectionOrder) { connection ->
+          openManagementSession(connection).use { session ->
+            session.deviceInfo
+          }
+        }
+        promise.resolve(deviceInfoToMap(info))
+      } catch (e: Exception) {
+        promise.reject("MANAGEMENT_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun updateDeviceConfig(
+    deviceHandle: String,
+    config: ReadableMap,
+    reboot: Boolean,
+    currentLockCode: String?,
+    newLockCode: String?,
+    promise: Promise
+  ) {
+    moduleScope.launch {
+      try {
+        val deviceConfig = parseDeviceConfig(config)
+        YubiKitManagerHolder.withAnyConnection(deviceHandle, managementConnectionOrder) { connection ->
+          openManagementSession(connection).use { session ->
+            session.updateDeviceConfig(
+              deviceConfig,
+              reboot,
+              base64Decode(currentLockCode),
+              base64Decode(newLockCode)
+            )
+          }
+        }
+        promise.resolve(null)
+      } catch (e: Exception) {
+        promise.reject("MANAGEMENT_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun setMode(
+    deviceHandle: String,
+    mode: String,
+    chalrespTimeout: Double,
+    autoejectTimeout: Double,
+    promise: Promise
+  ) {
+    moduleScope.launch {
+      try {
+        YubiKitManagerHolder.withAnyConnection(deviceHandle, managementConnectionOrder) { connection ->
+          openManagementSession(connection).use { session ->
+            session.setMode(
+              parseUsbMode(mode),
+              chalrespTimeout.toInt().toByte(),
+              autoejectTimeout.toInt().toShort()
+            )
+          }
+        }
+        promise.resolve(null)
+      } catch (e: Exception) {
+        promise.reject("MANAGEMENT_ERROR", e.message, e)
+      }
+    }
+  }
+
+  override fun deviceReset(deviceHandle: String, promise: Promise) {
+    moduleScope.launch {
+      try {
+        YubiKitManagerHolder.withAnyConnection(deviceHandle, managementConnectionOrder) { connection ->
+          openManagementSession(connection).use { session ->
+            session.deviceReset()
+          }
+        }
+        promise.resolve(null)
+      } catch (e: Exception) {
+        promise.reject("MANAGEMENT_ERROR", e.message, e)
+      }
+    }
+  }
+
+  companion object {
+    const val NAME = "YubikitManagement"
+  }
+}