@dynamic-labs-sdk/client 1.6.0 → 1.8.0

package/android/src/test/java/xyz/dynamic/client/keychain/KeyStoreKeyManagerTest.kt

@@ -0,0 +1,288 @@
+package xyz.dynamic.client.keychain
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import io.mockk.every
+import io.mockk.mockk
+import io.mockk.mockkStatic
+import io.mockk.slot
+import io.mockk.unmockkAll
+import io.mockk.verify
+import java.security.KeyPair
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.Signature
+import java.security.spec.ECGenParameterSpec
+import java.util.Base64
+import org.junit.After
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+// SECURITY CAVEAT (mirrors SecureEnclaveKeyManagerTests.swift): these tests use
+// MockK to stand in for the AndroidKeyStore JCA provider, which is hardware
+// (TEE/StrongBox) and does not exist under Robolectric. They verify that
+// KeyStoreKeyManager calls the right APIs with the right arguments and handles
+// the returned values correctly — they do NOT verify the KeyStore hardware
+// itself. A manual on-device smoke test of generateKeyPair and sign remains
+// required before release. The base64url and SEC1-extraction logic, by
+// contrast, is exercised for real (android.util.Base64 runs under Robolectric).
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class KeyStoreKeyManagerTest {
+
+    private val androidKeyStore = "AndroidKeyStore"
+
+    // A genuine P-256 keypair generated on the JVM, used as the fixture the
+    // mocked AndroidKeyStore "returns". Generated BEFORE any mockkStatic call
+    // so the real SunEC provider is still in place.
+    private lateinit var realKeyPair: KeyPair
+    private lateinit var manager: KeyStoreKeyManager
+
+    @Before
+    fun setUp() {
+        val kpg = KeyPairGenerator.getInstance("EC")
+        kpg.initialize(ECGenParameterSpec("secp256r1"))
+        realKeyPair = kpg.generateKeyPair()
+        manager = KeyStoreKeyManager()
+    }
+
+    @After
+    fun tearDown() {
+        unmockkAll()
+    }
+
+    // Independent oracle for the manager's base64url encoding (last 65 bytes of
+    // the X.509 SubjectPublicKeyInfo = the uncompressed SEC1 point).
+    private fun expectedEncodedPublicKey(): String {
+        val x509 = realKeyPair.public.encoded
+        val sec1 = x509.copyOfRange(x509.size - 65, x509.size)
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(sec1)
+    }
+
+    // region base64url
+
+    @Test
+    fun base64urlDecode_decodesUrlAlphabetWithoutPadding() {
+        // "-_-_AA" is base64url for FB FF BF 00 — exercises the - and _
+        // substitutions and the stripped padding (same vector as the iOS test).
+        val decoded = KeyStoreKeyManager.base64urlDecode("-_-_AA")
+        assertArrayEquals(byteArrayOf(0xFB.toByte(), 0xFF.toByte(), 0xBF.toByte(), 0x00), decoded)
+    }
+
+    @Test
+    fun base64urlDecode_roundTripsArbitraryBytes() {
+        val original = byteArrayOf(0x04, 0xAB.toByte(), 0xCD.toByte(), 0x00, 0x7F)
+        val encoded = Base64.getUrlEncoder().withoutPadding().encodeToString(original)
+        assertArrayEquals(original, KeyStoreKeyManager.base64urlDecode(encoded))
+    }
+
+    // endregion
+
+    // region isAvailable
+
+    @Test
+    fun isAvailable_trueWhenKeyStoreLoads() {
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
+        assertTrue(manager.isAvailable(null))
+    }
+
+    @Test
+    fun isAvailable_falseWhenKeyStoreThrows() {
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } throws RuntimeException("no provider")
+        assertFalse(manager.isAvailable(null))
+    }
+
+    @Test
+    fun isAvailable_trueWithStrongBoxFeature() {
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
+        val context = mockk<Context>(relaxed = true)
+        every { context.packageManager.hasSystemFeature(any()) } returns true
+        assertTrue(manager.isAvailable(context))
+    }
+
+    // endregion
+
+    // region hasKey / deleteKey
+
+    @Test
+    fun hasKey_reflectsContainsAlias() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.containsAlias("present") } returns true
+        every { keyStore.containsAlias("absent") } returns false
+
+        assertTrue(manager.hasKey("present"))
+        assertFalse(manager.hasKey("absent"))
+    }
+
+    @Test
+    fun deleteKey_deletesEntryForAlias() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+
+        manager.deleteKey("doomed")
+
+        verify { keyStore.deleteEntry("doomed") }
+    }
+
+    // endregion
+
+    // region getPublicKey
+
+    @Test
+    fun getPublicKey_nullWhenEntryMissing() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.getEntry("missing", null) } returns null
+
+        assertNull(manager.getPublicKey("missing"))
+    }
+
+    @Test
+    fun getPublicKey_returnsBase64urlSec1PointForPrivateKeyEntry() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
+        every { entry.certificate.publicKey.encoded } returns realKeyPair.public.encoded
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.getEntry("tag", null) } returns entry
+
+        assertEquals(expectedEncodedPublicKey(), manager.getPublicKey("tag"))
+    }
+
+    // endregion
+
+    // region sign
+
+    @Test
+    fun sign_throwsWhenKeyMissing() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.getEntry("missing", null) } returns null
+
+        val ex = assertThrows(IllegalArgumentException::class.java) {
+            manager.sign("missing", byteArrayOf(1, 2, 3))
+        }
+        assertEquals("Key not found: missing", ex.message)
+    }
+
+    @Test
+    fun sign_usesEcdsaSha256AndReturnsBase64urlSignature() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
+        every { entry.privateKey } returns realKeyPair.private
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.getEntry("tag", null) } returns entry
+
+        val signatureBytes = byteArrayOf(0xDE.toByte(), 0xAD.toByte())
+        val signature = mockk<Signature>(relaxed = true)
+        every { signature.sign() } returns signatureBytes
+        mockkStatic(Signature::class)
+        every { Signature.getInstance("SHA256withECDSA") } returns signature
+
+        val payload = byteArrayOf(0x01, 0x02)
+        val result = manager.sign("tag", payload)
+
+        assertEquals(
+            Base64.getUrlEncoder().withoutPadding().encodeToString(signatureBytes),
+            result,
+        )
+        verify { signature.initSign(realKeyPair.private) }
+        verify { signature.update(payload) }
+    }
+
+    // endregion
+
+    // region generateKeyPair
+
+    private fun stubKeyStoreWithoutAlias(): KeyStore {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.containsAlias(any()) } returns false
+        return keyStore
+    }
+
+    @Test
+    fun generateKeyPair_throwsWhenAliasAlreadyExists() {
+        val keyStore = mockk<KeyStore>(relaxed = true)
+        mockkStatic(KeyStore::class)
+        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
+        every { keyStore.containsAlias("dupe") } returns true
+
+        val ex = assertThrows(IllegalArgumentException::class.java) {
+            manager.generateKeyPair("dupe")
+        }
+        assertEquals("Key already exists for alias: dupe", ex.message)
+    }
+
+    @Test
+    fun generateKeyPair_initializesSpecWithExpectedShape() {
+        stubKeyStoreWithoutAlias()
+        val kpg = mockk<KeyPairGenerator>(relaxed = true)
+        every { kpg.generateKeyPair() } returns realKeyPair
+        mockkStatic(KeyPairGenerator::class)
+        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
+
+        val specSlot = slot<java.security.spec.AlgorithmParameterSpec>()
+        every { kpg.initialize(capture(specSlot)) } returns Unit
+
+        val encoded = manager.generateKeyPair("mytag")
+
+        val spec = specSlot.captured as KeyGenParameterSpec
+        assertEquals("mytag", spec.keystoreAlias)
+        assertEquals(
+            KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY,
+            spec.purposes,
+        )
+        assertTrue(spec.digests.contains(KeyProperties.DIGEST_SHA256))
+        assertEquals(
+            "secp256r1",
+            (spec.algorithmParameterSpec as ECGenParameterSpec).name,
+        )
+        // On API >= P the first attempt requests StrongBox backing.
+        assertTrue(spec.isStrongBoxBacked)
+        assertEquals(expectedEncodedPublicKey(), encoded)
+    }
+
+    @Test
+    fun generateKeyPair_fallsBackToSoftwareWhenStrongBoxUnavailable() {
+        stubKeyStoreWithoutAlias()
+        val kpg = mockk<KeyPairGenerator>(relaxed = true)
+        // First (StrongBox) attempt fails; second (software) attempt succeeds.
+        every { kpg.generateKeyPair() } throws StrongBoxUnavailableException() andThen realKeyPair
+        mockkStatic(KeyPairGenerator::class)
+        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
+
+        val specSlots = mutableListOf<java.security.spec.AlgorithmParameterSpec>()
+        every { kpg.initialize(capture(specSlots)) } returns Unit
+
+        val encoded = manager.generateKeyPair("mytag")
+
+        assertEquals(2, specSlots.size)
+        assertTrue((specSlots[0] as KeyGenParameterSpec).isStrongBoxBacked)
+        assertFalse((specSlots[1] as KeyGenParameterSpec).isStrongBoxBacked)
+        assertEquals(expectedEncodedPublicKey(), encoded)
+    }
+
+    // endregion
+}

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewClientTest.kt

@@ -0,0 +1,196 @@
+package xyz.dynamic.client.webview
+
+import android.net.Uri
+import android.webkit.WebResourceError
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebView
+import androidx.webkit.WebViewFeature
+import io.mockk.every
+import io.mockk.mockk
+import io.mockk.mockkStatic
+import io.mockk.unmockkAll
+import io.mockk.verify
+import org.junit.After
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+// Exercises the WebViewClient → host delegation in isolation: the host is a
+// MockK mock so no Activity/WebView runtime is needed. Runs under Robolectric
+// because DynamicWebViewClient extends the framework WebViewClient (whose
+// android.jar stub constructor throws off-device) and the tests parse Uris.
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [35])
+class DynamicWebViewClientTest {
+
+    private lateinit var host: DynamicWebViewHost
+    private lateinit var client: DynamicWebViewClient
+
+    @Before
+    fun setUp() {
+        host = mockk(relaxed = true)
+        client = DynamicWebViewClient(host)
+        // WebViewFeature is a static facade over the device WebView; stub it so
+        // the tests are deterministic. Default: document-start scripts
+        // unsupported (so onPageStarted falls back to injecting the bridge).
+        mockkStatic(WebViewFeature::class)
+        every { WebViewFeature.isFeatureSupported(any()) } returns false
+    }
+
+    @After
+    fun tearDown() {
+        unmockkAll()
+    }
+
+    // region navigation pinning
+
+    private fun mainFrameRequestTo(target: String): WebResourceRequest =
+        mockk {
+            every { isForMainFrame } returns true
+            every { url } returns Uri.parse(target)
+        }
+
+    @Test
+    fun shouldOverrideUrlLoading_blocksCrossOriginMainFrameNavigation() {
+        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
+
+        val handled = client.shouldOverrideUrlLoading(
+            null,
+            mainFrameRequestTo("https://evil.example.com/phish"),
+        )
+
+        // true == "we handled it" == the WebView does NOT perform the navigation.
+        assertTrue(handled)
+    }
+
+    @Test
+    fun shouldOverrideUrlLoading_allowsSameOriginMainFrameNavigation() {
+        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
+
+        val handled = client.shouldOverrideUrlLoading(
+            null,
+            mainFrameRequestTo("https://app.dynamicauth.com/waas-v1/abc"),
+        )
+
+        assertFalse(handled)
+    }
+
+    @Test
+    fun shouldOverrideUrlLoading_ignoresSubframeNavigation() {
+        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
+        val request = mockk<WebResourceRequest> {
+            every { isForMainFrame } returns false
+            every { url } returns Uri.parse("https://evil.example.com/x")
+        }
+
+        // Subframe loads are left to the WebView regardless of origin.
+        assertFalse(client.shouldOverrideUrlLoading(null, request))
+    }
+
+    @Test
+    fun shouldOverrideUrlLoading_allowsWhenOriginNotYetPinned() {
+        every { host.expectedOrigin } returns null
+
+        assertFalse(
+            client.shouldOverrideUrlLoading(
+                null,
+                mainFrameRequestTo("https://anything.example.com"),
+            ),
+        )
+    }
+
+    // endregion
+
+    // region bridge-glue injection
+
+    @Test
+    fun onPageStarted_injectsBridgeScriptWhenDocumentStartUnsupported() {
+        every {
+            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
+        } returns false
+        val view = mockk<WebView>(relaxed = true)
+
+        client.onPageStarted(view, "https://app.dynamicauth.com", null)
+
+        verify { view.evaluateJavascript(BRIDGE_USER_SCRIPT, null) }
+    }
+
+    @Test
+    fun onPageStarted_skipsInjectionWhenDocumentStartSupported() {
+        every {
+            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
+        } returns true
+        val view = mockk<WebView>(relaxed = true)
+
+        client.onPageStarted(view, "https://app.dynamicauth.com", null)
+
+        verify(exactly = 0) { view.evaluateJavascript(any(), any()) }
+    }
+
+    // endregion
+
+    // region error / lifecycle routing
+
+    @Test
+    fun onPageCommitVisible_notifiesHost() {
+        client.onPageCommitVisible(null, "https://app.dynamicauth.com")
+        verify { host.onCommitVisible() }
+    }
+
+    @Test
+    fun onReceivedError_mainFrame_reportsNavigationFailed() {
+        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
+        val error = mockk<WebResourceError> { every { description } returns "net::ERR_FAILED" }
+
+        client.onReceivedError(null, request, error)
+
+        verify { host.onNavigationFailed("net::ERR_FAILED") }
+    }
+
+    @Test
+    fun onReceivedError_subFrame_isIgnored() {
+        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns false }
+        val error = mockk<WebResourceError>(relaxed = true)
+
+        client.onReceivedError(null, request, error)
+
+        verify(exactly = 0) { host.onNavigationFailed(any()) }
+    }
+
+    @Test
+    fun onReceivedHttpError_mainFrame4xx_reportsHttpError() {
+        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
+        val response = mockk<WebResourceResponse> { every { statusCode } returns 404 }
+
+        client.onReceivedHttpError(null, request, response)
+
+        verify { host.onHttpError(404) }
+    }
+
+    @Test
+    fun onReceivedHttpError_below400_isIgnored() {
+        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
+        val response = mockk<WebResourceResponse> { every { statusCode } returns 302 }
+
+        client.onReceivedHttpError(null, request, response)
+
+        verify(exactly = 0) { host.onHttpError(any()) }
+    }
+
+    @Test
+    fun onRenderProcessGone_notifiesHostAndHandlesCrash() {
+        val handled = client.onRenderProcessGone(null, null)
+
+        // Returning true tells the framework the crash is handled, preventing a
+        // host-process crash.
+        assertTrue(handled)
+        verify { host.onRenderProcessGone() }
+    }
+
+    // endregion
+}