@dynamic-labs-sdk/client 1.8.1 → 1.8.2

package/android/src/test/java/xyz/dynamic/client/keychain/KeyStoreKeyManagerTest.kt

@@ -1,288 +0,0 @@
-package xyz.dynamic.client.keychain
-
-import android.content.Context
-import android.security.keystore.KeyGenParameterSpec
-import android.security.keystore.KeyProperties
-import android.security.keystore.StrongBoxUnavailableException
-import io.mockk.every
-import io.mockk.mockk
-import io.mockk.mockkStatic
-import io.mockk.slot
-import io.mockk.unmockkAll
-import io.mockk.verify
-import java.security.KeyPair
-import java.security.KeyPairGenerator
-import java.security.KeyStore
-import java.security.Signature
-import java.security.spec.ECGenParameterSpec
-import java.util.Base64
-import org.junit.After
-import org.junit.Assert.assertArrayEquals
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertThrows
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-// SECURITY CAVEAT (mirrors SecureEnclaveKeyManagerTests.swift): these tests use
-// MockK to stand in for the AndroidKeyStore JCA provider, which is hardware
-// (TEE/StrongBox) and does not exist under Robolectric. They verify that
-// KeyStoreKeyManager calls the right APIs with the right arguments and handles
-// the returned values correctly — they do NOT verify the KeyStore hardware
-// itself. A manual on-device smoke test of generateKeyPair and sign remains
-// required before release. The base64url and SEC1-extraction logic, by
-// contrast, is exercised for real (android.util.Base64 runs under Robolectric).
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class KeyStoreKeyManagerTest {
-
-    private val androidKeyStore = "AndroidKeyStore"
-
-    // A genuine P-256 keypair generated on the JVM, used as the fixture the
-    // mocked AndroidKeyStore "returns". Generated BEFORE any mockkStatic call
-    // so the real SunEC provider is still in place.
-    private lateinit var realKeyPair: KeyPair
-    private lateinit var manager: KeyStoreKeyManager
-
-    @Before
-    fun setUp() {
-        val kpg = KeyPairGenerator.getInstance("EC")
-        kpg.initialize(ECGenParameterSpec("secp256r1"))
-        realKeyPair = kpg.generateKeyPair()
-        manager = KeyStoreKeyManager()
-    }
-
-    @After
-    fun tearDown() {
-        unmockkAll()
-    }
-
-    // Independent oracle for the manager's base64url encoding (last 65 bytes of
-    // the X.509 SubjectPublicKeyInfo = the uncompressed SEC1 point).
-    private fun expectedEncodedPublicKey(): String {
-        val x509 = realKeyPair.public.encoded
-        val sec1 = x509.copyOfRange(x509.size - 65, x509.size)
-        return Base64.getUrlEncoder().withoutPadding().encodeToString(sec1)
-    }
-
-    // region base64url
-
-    @Test
-    fun base64urlDecode_decodesUrlAlphabetWithoutPadding() {
-        // "-_-_AA" is base64url for FB FF BF 00 — exercises the - and _
-        // substitutions and the stripped padding (same vector as the iOS test).
-        val decoded = KeyStoreKeyManager.base64urlDecode("-_-_AA")
-        assertArrayEquals(byteArrayOf(0xFB.toByte(), 0xFF.toByte(), 0xBF.toByte(), 0x00), decoded)
-    }
-
-    @Test
-    fun base64urlDecode_roundTripsArbitraryBytes() {
-        val original = byteArrayOf(0x04, 0xAB.toByte(), 0xCD.toByte(), 0x00, 0x7F)
-        val encoded = Base64.getUrlEncoder().withoutPadding().encodeToString(original)
-        assertArrayEquals(original, KeyStoreKeyManager.base64urlDecode(encoded))
-    }
-
-    // endregion
-
-    // region isAvailable
-
-    @Test
-    fun isAvailable_trueWhenKeyStoreLoads() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
-        assertTrue(manager.isAvailable(null))
-    }
-
-    @Test
-    fun isAvailable_falseWhenKeyStoreThrows() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } throws RuntimeException("no provider")
-        assertFalse(manager.isAvailable(null))
-    }
-
-    @Test
-    fun isAvailable_trueWithStrongBoxFeature() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
-        val context = mockk<Context>(relaxed = true)
-        every { context.packageManager.hasSystemFeature(any()) } returns true
-        assertTrue(manager.isAvailable(context))
-    }
-
-    // endregion
-
-    // region hasKey / deleteKey
-
-    @Test
-    fun hasKey_reflectsContainsAlias() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias("present") } returns true
-        every { keyStore.containsAlias("absent") } returns false
-
-        assertTrue(manager.hasKey("present"))
-        assertFalse(manager.hasKey("absent"))
-    }
-
-    @Test
-    fun deleteKey_deletesEntryForAlias() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-
-        manager.deleteKey("doomed")
-
-        verify { keyStore.deleteEntry("doomed") }
-    }
-
-    // endregion
-
-    // region getPublicKey
-
-    @Test
-    fun getPublicKey_nullWhenEntryMissing() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("missing", null) } returns null
-
-        assertNull(manager.getPublicKey("missing"))
-    }
-
-    @Test
-    fun getPublicKey_returnsBase64urlSec1PointForPrivateKeyEntry() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
-        every { entry.certificate.publicKey.encoded } returns realKeyPair.public.encoded
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("tag", null) } returns entry
-
-        assertEquals(expectedEncodedPublicKey(), manager.getPublicKey("tag"))
-    }
-
-    // endregion
-
-    // region sign
-
-    @Test
-    fun sign_throwsWhenKeyMissing() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("missing", null) } returns null
-
-        val ex = assertThrows(IllegalArgumentException::class.java) {
-            manager.sign("missing", byteArrayOf(1, 2, 3))
-        }
-        assertEquals("Key not found: missing", ex.message)
-    }
-
-    @Test
-    fun sign_usesEcdsaSha256AndReturnsBase64urlSignature() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
-        every { entry.privateKey } returns realKeyPair.private
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("tag", null) } returns entry
-
-        val signatureBytes = byteArrayOf(0xDE.toByte(), 0xAD.toByte())
-        val signature = mockk<Signature>(relaxed = true)
-        every { signature.sign() } returns signatureBytes
-        mockkStatic(Signature::class)
-        every { Signature.getInstance("SHA256withECDSA") } returns signature
-
-        val payload = byteArrayOf(0x01, 0x02)
-        val result = manager.sign("tag", payload)
-
-        assertEquals(
-            Base64.getUrlEncoder().withoutPadding().encodeToString(signatureBytes),
-            result,
-        )
-        verify { signature.initSign(realKeyPair.private) }
-        verify { signature.update(payload) }
-    }
-
-    // endregion
-
-    // region generateKeyPair
-
-    private fun stubKeyStoreWithoutAlias(): KeyStore {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias(any()) } returns false
-        return keyStore
-    }
-
-    @Test
-    fun generateKeyPair_throwsWhenAliasAlreadyExists() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias("dupe") } returns true
-
-        val ex = assertThrows(IllegalArgumentException::class.java) {
-            manager.generateKeyPair("dupe")
-        }
-        assertEquals("Key already exists for alias: dupe", ex.message)
-    }
-
-    @Test
-    fun generateKeyPair_initializesSpecWithExpectedShape() {
-        stubKeyStoreWithoutAlias()
-        val kpg = mockk<KeyPairGenerator>(relaxed = true)
-        every { kpg.generateKeyPair() } returns realKeyPair
-        mockkStatic(KeyPairGenerator::class)
-        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
-
-        val specSlot = slot<java.security.spec.AlgorithmParameterSpec>()
-        every { kpg.initialize(capture(specSlot)) } returns Unit
-
-        val encoded = manager.generateKeyPair("mytag")
-
-        val spec = specSlot.captured as KeyGenParameterSpec
-        assertEquals("mytag", spec.keystoreAlias)
-        assertEquals(
-            KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY,
-            spec.purposes,
-        )
-        assertTrue(spec.digests.contains(KeyProperties.DIGEST_SHA256))
-        assertEquals(
-            "secp256r1",
-            (spec.algorithmParameterSpec as ECGenParameterSpec).name,
-        )
-        // On API >= P the first attempt requests StrongBox backing.
-        assertTrue(spec.isStrongBoxBacked)
-        assertEquals(expectedEncodedPublicKey(), encoded)
-    }
-
-    @Test
-    fun generateKeyPair_fallsBackToSoftwareWhenStrongBoxUnavailable() {
-        stubKeyStoreWithoutAlias()
-        val kpg = mockk<KeyPairGenerator>(relaxed = true)
-        // First (StrongBox) attempt fails; second (software) attempt succeeds.
-        every { kpg.generateKeyPair() } throws StrongBoxUnavailableException() andThen realKeyPair
-        mockkStatic(KeyPairGenerator::class)
-        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
-
-        val specSlots = mutableListOf<java.security.spec.AlgorithmParameterSpec>()
-        every { kpg.initialize(capture(specSlots)) } returns Unit
-
-        val encoded = manager.generateKeyPair("mytag")
-
-        assertEquals(2, specSlots.size)
-        assertTrue((specSlots[0] as KeyGenParameterSpec).isStrongBoxBacked)
-        assertFalse((specSlots[1] as KeyGenParameterSpec).isStrongBoxBacked)
-        assertEquals(expectedEncodedPublicKey(), encoded)
-    }
-
-    // endregion
-}

package/android/src/test/java/xyz/dynamic/client/webview/DynamicWebViewClientTest.kt

@@ -1,196 +0,0 @@
-package xyz.dynamic.client.webview
-
-import android.net.Uri
-import android.webkit.WebResourceError
-import android.webkit.WebResourceRequest
-import android.webkit.WebResourceResponse
-import android.webkit.WebView
-import androidx.webkit.WebViewFeature
-import io.mockk.every
-import io.mockk.mockk
-import io.mockk.mockkStatic
-import io.mockk.unmockkAll
-import io.mockk.verify
-import org.junit.After
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-// Exercises the WebViewClient → host delegation in isolation: the host is a
-// MockK mock so no Activity/WebView runtime is needed. Runs under Robolectric
-// because DynamicWebViewClient extends the framework WebViewClient (whose
-// android.jar stub constructor throws off-device) and the tests parse Uris.
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class DynamicWebViewClientTest {
-
-    private lateinit var host: DynamicWebViewHost
-    private lateinit var client: DynamicWebViewClient
-
-    @Before
-    fun setUp() {
-        host = mockk(relaxed = true)
-        client = DynamicWebViewClient(host)
-        // WebViewFeature is a static facade over the device WebView; stub it so
-        // the tests are deterministic. Default: document-start scripts
-        // unsupported (so onPageStarted falls back to injecting the bridge).
-        mockkStatic(WebViewFeature::class)
-        every { WebViewFeature.isFeatureSupported(any()) } returns false
-    }
-
-    @After
-    fun tearDown() {
-        unmockkAll()
-    }
-
-    // region navigation pinning
-
-    private fun mainFrameRequestTo(target: String): WebResourceRequest =
-        mockk {
-            every { isForMainFrame } returns true
-            every { url } returns Uri.parse(target)
-        }
-
-    @Test
-    fun shouldOverrideUrlLoading_blocksCrossOriginMainFrameNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-
-        val handled = client.shouldOverrideUrlLoading(
-            null,
-            mainFrameRequestTo("https://evil.example.com/phish"),
-        )
-
-        // true == "we handled it" == the WebView does NOT perform the navigation.
-        assertTrue(handled)
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_allowsSameOriginMainFrameNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-
-        val handled = client.shouldOverrideUrlLoading(
-            null,
-            mainFrameRequestTo("https://app.dynamicauth.com/waas-v1/abc"),
-        )
-
-        assertFalse(handled)
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_ignoresSubframeNavigation() {
-        every { host.expectedOrigin } returns "https://app.dynamicauth.com"
-        val request = mockk<WebResourceRequest> {
-            every { isForMainFrame } returns false
-            every { url } returns Uri.parse("https://evil.example.com/x")
-        }
-
-        // Subframe loads are left to the WebView regardless of origin.
-        assertFalse(client.shouldOverrideUrlLoading(null, request))
-    }
-
-    @Test
-    fun shouldOverrideUrlLoading_allowsWhenOriginNotYetPinned() {
-        every { host.expectedOrigin } returns null
-
-        assertFalse(
-            client.shouldOverrideUrlLoading(
-                null,
-                mainFrameRequestTo("https://anything.example.com"),
-            ),
-        )
-    }
-
-    // endregion
-
-    // region bridge-glue injection
-
-    @Test
-    fun onPageStarted_injectsBridgeScriptWhenDocumentStartUnsupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
-        } returns false
-        val view = mockk<WebView>(relaxed = true)
-
-        client.onPageStarted(view, "https://app.dynamicauth.com", null)
-
-        verify { view.evaluateJavascript(BRIDGE_USER_SCRIPT, null) }
-    }
-
-    @Test
-    fun onPageStarted_skipsInjectionWhenDocumentStartSupported() {
-        every {
-            WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)
-        } returns true
-        val view = mockk<WebView>(relaxed = true)
-
-        client.onPageStarted(view, "https://app.dynamicauth.com", null)
-
-        verify(exactly = 0) { view.evaluateJavascript(any(), any()) }
-    }
-
-    // endregion
-
-    // region error / lifecycle routing
-
-    @Test
-    fun onPageCommitVisible_notifiesHost() {
-        client.onPageCommitVisible(null, "https://app.dynamicauth.com")
-        verify { host.onCommitVisible() }
-    }
-
-    @Test
-    fun onReceivedError_mainFrame_reportsNavigationFailed() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val error = mockk<WebResourceError> { every { description } returns "net::ERR_FAILED" }
-
-        client.onReceivedError(null, request, error)
-
-        verify { host.onNavigationFailed("net::ERR_FAILED") }
-    }
-
-    @Test
-    fun onReceivedError_subFrame_isIgnored() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns false }
-        val error = mockk<WebResourceError>(relaxed = true)
-
-        client.onReceivedError(null, request, error)
-
-        verify(exactly = 0) { host.onNavigationFailed(any()) }
-    }
-
-    @Test
-    fun onReceivedHttpError_mainFrame4xx_reportsHttpError() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val response = mockk<WebResourceResponse> { every { statusCode } returns 404 }
-
-        client.onReceivedHttpError(null, request, response)
-
-        verify { host.onHttpError(404) }
-    }
-
-    @Test
-    fun onReceivedHttpError_below400_isIgnored() {
-        val request = mockk<WebResourceRequest> { every { isForMainFrame } returns true }
-        val response = mockk<WebResourceResponse> { every { statusCode } returns 302 }
-
-        client.onReceivedHttpError(null, request, response)
-
-        verify(exactly = 0) { host.onHttpError(any()) }
-    }
-
-    @Test
-    fun onRenderProcessGone_notifiesHostAndHandlesCrash() {
-        val handled = client.onRenderProcessGone(null, null)
-
-        // Returning true tells the framework the crash is handled, preventing a
-        // host-process crash.
-        assertTrue(handled)
-        verify { host.onRenderProcessGone() }
-    }
-
-    // endregion
-}