@explorins/pers-sdk-react-native 2.3.6 → 2.3.8

package/src/providers/rn-dpop-provider.ts

@@ -1,190 +1,190 @@
-import { Platform } from 'react-native';
-import { Buffer } from 'buffer';
-import { DPoPCryptoProvider, DPoPKeyPair } from '@explorins/pers-sdk/core';
-
-// Lazy-loaded crypto module - initialized on first use to avoid native module timing issues
-let _crypto: any = null;
-let _cryptoInitialized = false;
-
-/**
- * Lazily load the crypto module.
- * 
- * Supports customer pre-initialization via global.__QuickCrypto for environments
- * where native module timing is unpredictable (e.g., certain React Native setups).
- * 
- * @returns The crypto module or null if unavailable
- */
-function getCrypto(): any {
-  if (_cryptoInitialized) {
-    return _crypto;
-  }
-  
-  _cryptoInitialized = true;
-  
-  if (Platform.OS === 'web') {
-    // On Web, we shouldn't be using this provider (Core SDK has WebDPoPProvider)
-    _crypto = {
-      generateKeyPair: () => { throw new Error('ReactNativeDPoPProvider not supported on Web'); },
-      randomUUID: () => globalThis.crypto?.randomUUID?.() || `${Date.now()}-${Math.random()}`
-    };
-    return _crypto;
-  }
-  
-  // Check for customer pre-initialized global (for native module timing issues)
-  if (typeof global !== 'undefined' && (global as any).__QuickCrypto) {
-    _crypto = (global as any).__QuickCrypto;
-    return _crypto;
-  }
-  
-  // Standard lazy load
-  try {
-    _crypto = require('react-native-quick-crypto').default || require('react-native-quick-crypto');
-  } catch (e) {
-    console.warn('ReactNativeDPoPProvider: Failed to load react-native-quick-crypto.', e);
-    console.warn('Tip: If you encounter timing issues, pre-initialize in index.js: global.__QuickCrypto = require("react-native-quick-crypto")');
-    _crypto = null;
-  }
-  
-  return _crypto;
-}
-
-export class ReactNativeDPoPProvider implements DPoPCryptoProvider {
-  /**
-   * Generates a new key pair (ES256 recommended)
-   * 
-   * Uses WebCrypto API (crypto.subtle) for cross-platform compatibility.
-   * Falls back to Node.js crypto API on iOS if needed.
-   */
-  async generateKeyPair(options?: { extractable?: boolean }): Promise<DPoPKeyPair> {
-    const crypto = getCrypto();
-    if (!crypto) {
-      throw new Error('Crypto module not available. Install react-native-quick-crypto or pre-initialize global.__QuickCrypto');
-    }
-    
-    // Try WebCrypto API first (works on both iOS and Android)
-    if (crypto.subtle) {
-      try {
-        const keyPair = await crypto.subtle.generateKey(
-          { name: 'ECDSA', namedCurve: 'P-256' },
-          true, // extractable - required for JWK export
-          ['sign', 'verify']
-        );
-
-        const publicKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);
-        const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-
-        return {
-          publicKey: publicKeyJwk,
-          privateKey: privateKeyJwk
-        };
-      } catch (err) {
-        console.warn('[DPoP] WebCrypto API failed, trying Node.js crypto API', err);
-      }
-    }
-
-    // Fallback: Node.js crypto API (works on iOS)
-    return new Promise((resolve, reject) => {
-      crypto.generateKeyPair('ec', { namedCurve: 'P-256' }, (err: any, publicKey: any, privateKey: any) => {
-        if (err) return reject(err);
-        try {
-          const pJwk = publicKey.export({ format: 'jwk' });
-          const prJwk = privateKey.export({ format: 'jwk' });
-          resolve({ publicKey: pJwk, privateKey: prJwk });
-        } catch (exportErr) {
-          reject(exportErr);
-        }
-      });
-    });
-  }
-
-  async signProof(payload: Record<string, any>, keyPair: DPoPKeyPair): Promise<string> {
-    const crypto = getCrypto();
-    if (!crypto) {
-      throw new Error('Crypto module not available for signing');
-    }
-    
-    // 1. Construct Header
-    const header = {
-      typ: 'dpop+jwt',
-      alg: 'ES256',
-      jwk: keyPair.publicKey
-    };
-
-    // 2. Add Claims (iat/jti)
-    const finalPayload = {
-      ...payload,
-      iat: payload.iat || Math.floor(Date.now() / 1000),
-      jti: payload.jti || (crypto.randomUUID?.() || `${Date.now()}-${Math.random()}`)
-    };
-
-    // 3. Encode
-    const b64Header = this.base64Url(JSON.stringify(header));
-    const b64Payload = this.base64Url(JSON.stringify(finalPayload));
-    const signingInput = `${b64Header}.${b64Payload}`;
-
-    // 4. Sign - try WebCrypto first, fallback to Node.js crypto
-    if (crypto.subtle) {
-      try {
-        const privateKey = await crypto.subtle.importKey(
-          'jwk',
-          keyPair.privateKey,
-          { name: 'ECDSA', namedCurve: 'P-256' },
-          false,
-          ['sign']
-        );
-
-        const signatureBuffer = await crypto.subtle.sign(
-          { name: 'ECDSA', hash: 'SHA-256' },
-          privateKey,
-          Buffer.from(signingInput)
-        );
-
-        // WebCrypto returns signature in IEEE P1363 format (r || s), which is what we need for JWT
-        return `${signingInput}.${this.base64UrlBuffer(Buffer.from(signatureBuffer))}`;
-      } catch (err) {
-        console.warn('[DPoP] WebCrypto sign failed, trying Node.js crypto', err);
-      }
-    }
-
-    // Fallback: Node.js crypto API
-    const sign = crypto.createSign('SHA256');
-    sign.update(signingInput);
-    const privateKeyObj = crypto.createPrivateKey({ key: keyPair.privateKey as any, format: 'jwk' });
-    const signature = sign.sign(privateKeyObj);
-
-    return `${signingInput}.${this.base64UrlBuffer(signature)}`;
-  }
-
-  async hashAccessToken(accessToken: string): Promise<string> {
-    const crypto = getCrypto();
-    if (!crypto) {
-      throw new Error('Crypto module not available for hashing');
-    }
-    
-    // Try WebCrypto first
-    if (crypto.subtle) {
-      try {
-        const hashBuffer = await crypto.subtle.digest('SHA-256', Buffer.from(accessToken));
-        return this.base64UrlBuffer(Buffer.from(hashBuffer));
-      } catch (err) {
-        // Fallback to Node.js crypto
-      }
-    }
-
-    const hash = crypto.createHash('sha256').update(accessToken).digest();
-    return this.base64UrlBuffer(hash);
-  }
-
-  // --- Helpers ---
-  private base64Url(str: string): string {
-    return this.base64UrlBuffer(Buffer.from(str));
-  }
-
-  private base64UrlBuffer(buf: Buffer | Uint8Array): string {
-    const buffer = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
-    return buffer.toString('base64')
-      .replace(/=/g, '')
-      .replace(/\+/g, '-')
-      .replace(/\//g, '_');
-  }
-}
+import { Platform } from 'react-native';
+import { Buffer } from 'buffer';
+import { DPoPCryptoProvider, DPoPKeyPair } from '@explorins/pers-sdk/core';
+
+// Lazy-loaded crypto module - initialized on first use to avoid native module timing issues
+let _crypto: any = null;
+let _cryptoInitialized = false;
+
+/**
+ * Lazily load the crypto module.
+ * 
+ * Supports customer pre-initialization via global.__QuickCrypto for environments
+ * where native module timing is unpredictable (e.g., certain React Native setups).
+ * 
+ * @returns The crypto module or null if unavailable
+ */
+function getCrypto(): any {
+  if (_cryptoInitialized) {
+    return _crypto;
+  }
+  
+  _cryptoInitialized = true;
+  
+  if (Platform.OS === 'web') {
+    // On Web, we shouldn't be using this provider (Core SDK has WebDPoPProvider)
+    _crypto = {
+      generateKeyPair: () => { throw new Error('ReactNativeDPoPProvider not supported on Web'); },
+      randomUUID: () => globalThis.crypto?.randomUUID?.() || `${Date.now()}-${Math.random()}`
+    };
+    return _crypto;
+  }
+  
+  // Check for customer pre-initialized global (for native module timing issues)
+  if (typeof global !== 'undefined' && (global as any).__QuickCrypto) {
+    _crypto = (global as any).__QuickCrypto;
+    return _crypto;
+  }
+  
+  // Standard lazy load
+  try {
+    _crypto = require('react-native-quick-crypto').default || require('react-native-quick-crypto');
+  } catch (e) {
+    console.warn('ReactNativeDPoPProvider: Failed to load react-native-quick-crypto.', e);
+    console.warn('Tip: If you encounter timing issues, pre-initialize in index.js: global.__QuickCrypto = require("react-native-quick-crypto")');
+    _crypto = null;
+  }
+  
+  return _crypto;
+}
+
+export class ReactNativeDPoPProvider implements DPoPCryptoProvider {
+  /**
+   * Generates a new key pair (ES256 recommended)
+   * 
+   * Uses WebCrypto API (crypto.subtle) for cross-platform compatibility.
+   * Falls back to Node.js crypto API on iOS if needed.
+   */
+  async generateKeyPair(options?: { extractable?: boolean }): Promise<DPoPKeyPair> {
+    const crypto = getCrypto();
+    if (!crypto) {
+      throw new Error('Crypto module not available. Install react-native-quick-crypto or pre-initialize global.__QuickCrypto');
+    }
+    
+    // Try WebCrypto API first (works on both iOS and Android)
+    if (crypto.subtle) {
+      try {
+        const keyPair = await crypto.subtle.generateKey(
+          { name: 'ECDSA', namedCurve: 'P-256' },
+          true, // extractable - required for JWK export
+          ['sign', 'verify']
+        );
+
+        const publicKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);
+        const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
+
+        return {
+          publicKey: publicKeyJwk,
+          privateKey: privateKeyJwk
+        };
+      } catch (err) {
+        console.warn('[DPoP] WebCrypto API failed, trying Node.js crypto API', err);
+      }
+    }
+
+    // Fallback: Node.js crypto API (works on iOS)
+    return new Promise((resolve, reject) => {
+      crypto.generateKeyPair('ec', { namedCurve: 'P-256' }, (err: any, publicKey: any, privateKey: any) => {
+        if (err) return reject(err);
+        try {
+          const pJwk = publicKey.export({ format: 'jwk' });
+          const prJwk = privateKey.export({ format: 'jwk' });
+          resolve({ publicKey: pJwk, privateKey: prJwk });
+        } catch (exportErr) {
+          reject(exportErr);
+        }
+      });
+    });
+  }
+
+  async signProof(payload: Record<string, any>, keyPair: DPoPKeyPair): Promise<string> {
+    const crypto = getCrypto();
+    if (!crypto) {
+      throw new Error('Crypto module not available for signing');
+    }
+    
+    // 1. Construct Header
+    const header = {
+      typ: 'dpop+jwt',
+      alg: 'ES256',
+      jwk: keyPair.publicKey
+    };
+
+    // 2. Add Claims (iat/jti)
+    const finalPayload = {
+      ...payload,
+      iat: payload.iat || Math.floor(Date.now() / 1000),
+      jti: payload.jti || (crypto.randomUUID?.() || `${Date.now()}-${Math.random()}`)
+    };
+
+    // 3. Encode
+    const b64Header = this.base64Url(JSON.stringify(header));
+    const b64Payload = this.base64Url(JSON.stringify(finalPayload));
+    const signingInput = `${b64Header}.${b64Payload}`;
+
+    // 4. Sign - try WebCrypto first, fallback to Node.js crypto
+    if (crypto.subtle) {
+      try {
+        const privateKey = await crypto.subtle.importKey(
+          'jwk',
+          keyPair.privateKey,
+          { name: 'ECDSA', namedCurve: 'P-256' },
+          false,
+          ['sign']
+        );
+
+        const signatureBuffer = await crypto.subtle.sign(
+          { name: 'ECDSA', hash: 'SHA-256' },
+          privateKey,
+          Buffer.from(signingInput)
+        );
+
+        // WebCrypto returns signature in IEEE P1363 format (r || s), which is what we need for JWT
+        return `${signingInput}.${this.base64UrlBuffer(Buffer.from(signatureBuffer))}`;
+      } catch (err) {
+        console.warn('[DPoP] WebCrypto sign failed, trying Node.js crypto', err);
+      }
+    }
+
+    // Fallback: Node.js crypto API
+    const sign = crypto.createSign('SHA256');
+    sign.update(signingInput);
+    const privateKeyObj = crypto.createPrivateKey({ key: keyPair.privateKey as any, format: 'jwk' });
+    const signature = sign.sign(privateKeyObj);
+
+    return `${signingInput}.${this.base64UrlBuffer(signature)}`;
+  }
+
+  async hashAccessToken(accessToken: string): Promise<string> {
+    const crypto = getCrypto();
+    if (!crypto) {
+      throw new Error('Crypto module not available for hashing');
+    }
+    
+    // Try WebCrypto first
+    if (crypto.subtle) {
+      try {
+        const hashBuffer = await crypto.subtle.digest('SHA-256', Buffer.from(accessToken));
+        return this.base64UrlBuffer(Buffer.from(hashBuffer));
+      } catch (err) {
+        // Fallback to Node.js crypto
+      }
+    }
+
+    const hash = crypto.createHash('sha256').update(accessToken).digest();
+    return this.base64UrlBuffer(hash);
+  }
+
+  // --- Helpers ---
+  private base64Url(str: string): string {
+    return this.base64UrlBuffer(Buffer.from(str));
+  }
+
+  private base64UrlBuffer(buf: Buffer | Uint8Array): string {
+    const buffer = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
+    return buffer.toString('base64')
+      .replace(/=/g, '')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_');
+  }
+}