@dynamic-labs-sdk/client 1.6.0 → 1.8.0

package/android/src/main/java/xyz/dynamic/client/keychain/KeyStoreKeyManager.kt

@@ -0,0 +1,147 @@
+package xyz.dynamic.client.keychain
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.Signature
+import java.security.spec.ECGenParameterSpec
+
+/**
+ * Android KeyStore key manager backed by hardware TEE/StrongBox.
+ * Provides P-256 key generation, signing, and management.
+ * All public keys are returned in uncompressed SEC1 format (65 bytes: 04 || x || y).
+ * All binary data uses base64url encoding (RFC 4648 S5, no padding).
+ */
+class KeyStoreKeyManager {
+
+    fun isAvailable(context: Context?): Boolean {
+        return try {
+            val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+            keyStore.load(null)
+            val hasStrongBox = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && context != null) {
+                context.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
+            } else {
+                false
+            }
+            // Even without StrongBox, Android KeyStore provides TEE-backed keys on most devices
+            hasStrongBox || Build.VERSION.SDK_INT >= Build.VERSION_CODES.M
+        } catch (e: Exception) {
+            false
+        }
+    }
+
+    fun hasKey(alias: String): Boolean {
+        val keyStore = loadKeyStore()
+        return keyStore.containsAlias(alias)
+    }
+
+    fun generateKeyPair(alias: String): String {
+        require(!hasKey(alias)) { "Key already exists for alias: $alias" }
+
+        val specBuilder = KeyGenParameterSpec.Builder(
+            alias,
+            KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
+        )
+            .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
+            .setDigests(KeyProperties.DIGEST_SHA256)
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+            specBuilder.setIsStrongBoxBacked(true)
+        }
+
+        val keyPair = try {
+            val kpg = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, ANDROID_KEYSTORE)
+            kpg.initialize(specBuilder.build())
+            kpg.generateKeyPair()
+        } catch (e: Exception) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && e is StrongBoxUnavailableException) {
+                // Fallback: retry without StrongBox on TEE
+                specBuilder.setIsStrongBoxBacked(false)
+                val kpg = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, ANDROID_KEYSTORE)
+                kpg.initialize(specBuilder.build())
+                kpg.generateKeyPair()
+            } else {
+                throw e
+            }
+        }
+
+        val publicKeyBytes = extractUncompressedPublicKey(keyPair.public.encoded)
+        return base64urlEncode(publicKeyBytes)
+    }
+
+    fun getPublicKey(alias: String): String? {
+        val keyStore = loadKeyStore()
+        val entry = keyStore.getEntry(alias, null)
+
+        if (entry == null || entry !is KeyStore.PrivateKeyEntry) {
+            return null
+        }
+
+        val publicKeyBytes = extractUncompressedPublicKey(entry.certificate.publicKey.encoded)
+        return base64urlEncode(publicKeyBytes)
+    }
+
+    fun sign(alias: String, payload: ByteArray): String {
+        val keyStore = loadKeyStore()
+        val entry = keyStore.getEntry(alias, null)
+
+        require(entry != null && entry is KeyStore.PrivateKeyEntry) { "Key not found: $alias" }
+
+        val signature = Signature.getInstance("SHA256withECDSA")
+        signature.initSign(entry.privateKey)
+        signature.update(payload)
+        val signatureBytes = signature.sign()
+
+        return base64urlEncode(signatureBytes)
+    }
+
+    fun deleteKey(alias: String) {
+        val keyStore = loadKeyStore()
+        keyStore.deleteEntry(alias)
+    }
+
+    // region Private helpers
+
+    private fun loadKeyStore(): KeyStore {
+        val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+        keyStore.load(null)
+        return keyStore
+    }
+
+    /**
+     * Extract uncompressed SEC1 public key (65 bytes: 04 || x || y)
+     * from X.509 SubjectPublicKeyInfo DER encoding.
+     */
+    private fun extractUncompressedPublicKey(x509Encoded: ByteArray): ByteArray {
+        val uncompressedPointLength = 65
+        return x509Encoded.copyOfRange(
+            x509Encoded.size - uncompressedPointLength,
+            x509Encoded.size
+        )
+    }
+
+    private fun base64urlEncode(data: ByteArray): String {
+        return android.util.Base64.encodeToString(
+            data,
+            android.util.Base64.URL_SAFE or android.util.Base64.NO_WRAP or android.util.Base64.NO_PADDING
+        )
+    }
+
+    companion object {
+        private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+
+        fun base64urlDecode(input: String): ByteArray {
+            return android.util.Base64.decode(
+                input,
+                android.util.Base64.URL_SAFE or android.util.Base64.NO_WRAP or android.util.Base64.NO_PADDING
+            )
+        }
+    }
+
+    // endregion
+}

package/android/src/main/java/xyz/dynamic/client/keychain/KeychainModule.kt

@@ -0,0 +1,85 @@
+package xyz.dynamic.client.keychain
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.facebook.react.module.annotations.ReactModule
+import xyz.dynamic.client.NativeKeychainSpec
+
+@ReactModule(name = KeychainModule.NAME)
+class KeychainModule(reactContext: ReactApplicationContext) :
+    NativeKeychainSpec(reactContext) {
+
+    private val keyManager = KeyStoreKeyManager()
+
+    companion object {
+        const val NAME = "DynamicClientKeychain"
+    }
+
+    override fun getName(): String = NAME
+
+    override fun isAvailable(promise: Promise) {
+        try {
+            val context = reactApplicationContext
+            promise.resolve(keyManager.isAvailable(context))
+        } catch (e: Exception) {
+            promise.resolve(false)
+        }
+    }
+
+    override fun hasKey(key: String, promise: Promise) {
+        try {
+            promise.resolve(keyManager.hasKey(key))
+        } catch (e: Exception) {
+            promise.reject("ERR_KEYCHAIN", "Failed to check key: ${e.message}", e)
+        }
+    }
+
+    override fun generateKeyPair(key: String, promise: Promise) {
+        try {
+            val publicKey = keyManager.generateKeyPair(key)
+            val result: WritableMap = Arguments.createMap()
+            result.putString("publicKey", publicKey)
+            promise.resolve(result)
+        } catch (e: Exception) {
+            promise.reject("ERR_KEYCHAIN", "Failed to generate key pair: ${e.message}", e)
+        }
+    }
+
+    override fun getPublicKey(key: String, promise: Promise) {
+        try {
+            val publicKey = keyManager.getPublicKey(key)
+            if (publicKey == null) {
+                promise.resolve(null)
+            } else {
+                val result: WritableMap = Arguments.createMap()
+                result.putString("publicKey", publicKey)
+                promise.resolve(result)
+            }
+        } catch (e: Exception) {
+            promise.reject("ERR_KEYCHAIN", "Failed to get public key: ${e.message}", e)
+        }
+    }
+
+    override fun sign(key: String, payload: String, promise: Promise) {
+        try {
+            val payloadData = KeyStoreKeyManager.base64urlDecode(payload)
+            val signature = keyManager.sign(key, payloadData)
+            val result: WritableMap = Arguments.createMap()
+            result.putString("signature", signature)
+            promise.resolve(result)
+        } catch (e: Exception) {
+            promise.reject("ERR_KEYCHAIN", "Failed to sign: ${e.message}", e)
+        }
+    }
+
+    override fun deleteKey(key: String, promise: Promise) {
+        try {
+            keyManager.deleteKey(key)
+            promise.resolve(null)
+        } catch (e: Exception) {
+            promise.reject("ERR_KEYCHAIN", "Failed to delete key: ${e.message}", e)
+        }
+    }
+}

package/android/src/main/java/xyz/dynamic/client/manifest/ReactNativeManifestModule.kt

@@ -0,0 +1,25 @@
+package xyz.dynamic.client.manifest
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.facebook.react.module.annotations.ReactModule
+import xyz.dynamic.client.BuildConfig
+import xyz.dynamic.client.NativeReactNativeManifestSpec
+
+@ReactModule(name = ReactNativeManifestModule.NAME)
+class ReactNativeManifestModule(reactContext: ReactApplicationContext) :
+    NativeReactNativeManifestSpec(reactContext) {
+
+    companion object {
+        const val NAME = "DynamicClientManifest"
+    }
+
+    override fun getName(): String = NAME
+
+    override fun getManifest(): WritableMap {
+        val manifest = Arguments.createMap()
+        manifest.putString("sdkVersion", BuildConfig.DYNAMIC_SDK_VERSION)
+        return manifest
+    }
+}

package/android/src/main/java/xyz/dynamic/client/webview/DynamicWebViewClient.kt

@@ -0,0 +1,83 @@
+package xyz.dynamic.client.webview
+
+import android.graphics.Bitmap
+import android.os.Build
+import android.webkit.RenderProcessGoneDetail
+import android.webkit.WebResourceError
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import androidx.annotation.RequiresApi
+import androidx.webkit.WebViewFeature
+
+internal class DynamicWebViewClient(
+    private val host: DynamicWebViewHost,
+) : WebViewClient() {
+
+    // Pin navigation to the instance's origin. The WaaS page is a single-origin
+    // SPA, so any MAIN-FRAME navigation to a different origin (open redirect,
+    // injected link, scripted location change) is blocked — the bridge must never
+    // be re-exposed to an attacker origin. Subframe navigations are left alone.
+    // Not invoked for the initial loadUrl, which open() already origin-validated.
+    override fun shouldOverrideUrlLoading(
+        view: WebView?,
+        request: WebResourceRequest?,
+    ): Boolean {
+        val req = request ?: return false
+        if (!req.isForMainFrame) return false
+        val expected = host.expectedOrigin ?: return false
+        // Returning true means "handled" → the WebView does not perform the load.
+        return originOf(req.url) != expected
+    }
+
+    override fun onPageStarted(view: WebView?, url: String?, favicon: Bitmap?) {
+        // When DOCUMENT_START_SCRIPT is available the host injects the bridge glue
+        // before any page script runs (see DynamicWebViewHost). Only fall back to
+        // onPageStarted injection on older WebView. The script is idempotent
+        // (`__dynamicBridgeInstalled` guard), so a redundant inject is harmless.
+        if (!WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)) {
+            view?.evaluateJavascript(BRIDGE_USER_SCRIPT, null)
+        }
+    }
+
+    override fun onPageCommitVisible(view: WebView?, url: String?) {
+        // Android analog to iOS's `didCommit`: first paint after the response
+        // committed. Resolves the pending open promise — deferred host-side so a
+        // same-pass HTTP error can claim the promise first.
+        host.onCommitVisible()
+    }
+
+    @RequiresApi(Build.VERSION_CODES.M)
+    override fun onReceivedError(
+        view: WebView?,
+        request: WebResourceRequest?,
+        error: WebResourceError?,
+    ) {
+        if (request?.isForMainFrame != true) return
+        host.onNavigationFailed(error?.description?.toString())
+    }
+
+    @RequiresApi(Build.VERSION_CODES.M)
+    override fun onReceivedHttpError(
+        view: WebView?,
+        request: WebResourceRequest?,
+        errorResponse: WebResourceResponse?,
+    ) {
+        if (request?.isForMainFrame != true) return
+        val status = errorResponse?.statusCode ?: return
+        if (status < 400) return
+        host.onHttpError(status)
+    }
+
+    @RequiresApi(Build.VERSION_CODES.O)
+    override fun onRenderProcessGone(
+        view: WebView?,
+        detail: RenderProcessGoneDetail?,
+    ): Boolean {
+        host.onRenderProcessGone()
+        // Returning true tells the framework we've handled the crash. Returning
+        // false would crash the host process.
+        return true
+    }
+}