@genation/bridge-peer 0.1.0

package/react-native/generated/swift/GenationBridgeCryptoMobileFFI.modulemap

@@ -0,0 +1,7 @@
+module GenationBridgeCryptoMobileFFI {
+    header "GenationBridgeCryptoMobileFFI.h"
+    export *
+    use "Darwin"
+    use "_Builtin_stdbool"
+    use "_Builtin_stdint"
+}

package/react-native/ios/GenationBridgePeer.m

@@ -0,0 +1,14 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(GenationBridgePeer, NSObject)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(loadOrCreateIdentity:(NSString *)projectId peerId:(NSString *)peerId)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(signConnectionProof:(NSString *)handle inputJson:(NSString *)inputJson)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(createInitiator:(NSString *)handle prologue:(NSString *)prologue responderPublicKey:(NSString *)publicKey)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(createResponder:(NSString *)handle prologue:(NSString *)prologue initiatorPublicKey:(NSString *)publicKey)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(beginHandshake:(NSString *)handle)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(finishHandshake:(NSString *)handle message:(NSString *)message)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(acceptHandshake:(NSString *)handle message:(NSString *)message)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(encrypt:(NSString *)handle aad:(NSString *)aad plaintext:(NSString *)plaintext)
+RCT_EXTERN__BLOCKING_SYNCHRONOUS_METHOD(decrypt:(NSString *)handle aad:(NSString *)aad ciphertext:(NSString *)ciphertext)
+RCT_EXTERN_METHOD(closeSession:(NSString *)handle)
+@end

package/react-native/ios/GenationBridgePeer.swift

@@ -0,0 +1,234 @@
+import CryptoKit
+import Foundation
+import React
+import Security
+
+private struct StoredIdentity: Codable {
+  let connectionPrivateKey: Data
+  let connectionPublicKey: Data
+  let noiseStaticPrivateKey: Data
+  let noiseStaticPublicKey: Data
+}
+
+private enum NativeSession {
+  case initiator(MobileInitiator)
+  case responder(MobileResponder)
+}
+
+@objc(GenationBridgePeer)
+final class GenationBridgePeer: NSObject {
+  private let lock = NSLock()
+  private var identities: [String: StoredIdentity] = [:]
+  private var sessions: [String: NativeSession] = [:]
+  private let service = "com.genation.bridge.peer.identity.v1"
+
+  @objc static func requiresMainQueueSetup() -> Bool { false }
+
+  private func base64url(_ data: Data) -> String {
+    data.base64EncodedString().replacingOccurrences(of: "+", with: "-")
+      .replacingOccurrences(of: "/", with: "_")
+      .replacingOccurrences(of: "=", with: "")
+  }
+
+  private func decode64(_ value: String) throws -> Data {
+    var encoded = value.replacingOccurrences(of: "-", with: "+")
+      .replacingOccurrences(of: "_", with: "/")
+    encoded += String(repeating: "=", count: (4 - encoded.count % 4) % 4)
+    guard let data = Data(base64Encoded: encoded) else { throw NativeError.invalid }
+    return data
+  }
+
+  private func identityKey(_ projectId: String, _ peerId: String) -> String {
+    let digest = SHA256.hash(data: Data("\(projectId)\u{0}\(peerId)".utf8))
+    return digest.map { String(format: "%02x", $0) }.joined()
+  }
+
+  private func readIdentity(_ key: String) throws -> StoredIdentity? {
+    let query: [CFString: Any] = [
+      kSecClass: kSecClassGenericPassword,
+      kSecAttrService: service,
+      kSecAttrAccount: key,
+      kSecReturnData: true,
+      kSecMatchLimit: kSecMatchLimitOne,
+    ]
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &result)
+    if status == errSecItemNotFound { return nil }
+    guard status == errSecSuccess, let data = result as? Data else {
+      throw NativeError.storage
+    }
+    return try JSONDecoder().decode(StoredIdentity.self, from: data)
+  }
+
+  private func createIdentity(_ key: String) throws -> StoredIdentity {
+    let generated = try generateMobileIdentity()
+    let identity = StoredIdentity(
+      connectionPrivateKey: generated.connectionPrivateKey,
+      connectionPublicKey: generated.connectionPublicKey,
+      noiseStaticPrivateKey: generated.noiseStaticPrivateKey,
+      noiseStaticPublicKey: generated.noiseStaticPublicKey
+    )
+    let encoded = try JSONEncoder().encode(identity)
+    let query: [CFString: Any] = [
+      kSecClass: kSecClassGenericPassword,
+      kSecAttrService: service,
+      kSecAttrAccount: key,
+      kSecAttrAccessible: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
+      kSecValueData: encoded,
+    ]
+    let status = SecItemAdd(query as CFDictionary, nil)
+    if status == errSecDuplicateItem, let existing = try readIdentity(key) { return existing }
+    guard status == errSecSuccess else { throw NativeError.storage }
+    return identity
+  }
+
+  private func identity(_ handle: String) throws -> StoredIdentity {
+    guard let value = identities[handle] else { throw NativeError.invalid }
+    return value
+  }
+
+  @objc func loadOrCreateIdentity(
+    _ projectId: String,
+    peerId: String
+  ) -> NSDictionary {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let handle = "identity:\(identityKey(projectId, peerId))"
+      let key = String(handle.dropFirst("identity:".count))
+      let value = try readIdentity(key) ?? createIdentity(key)
+      identities[handle] = value
+      return [
+        "identityHandle": handle,
+        "connectionPublicKey": base64url(value.connectionPublicKey),
+        "noiseStaticPublicKey": base64url(value.noiseStaticPublicKey),
+      ]
+    } catch { return [:] }
+  }
+
+  @objc func signConnectionProof(_ handle: String, inputJson: String) -> String {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let value = try identity(handle)
+      guard
+        let input = try JSONSerialization.jsonObject(with: Data(inputJson.utf8)) as? [String: Any],
+        let grant = input["grant"] as? String,
+        let expiresAt = input["challengeExpiresAt"] as? Double
+      else { throw NativeError.invalid }
+      let now = Int(Date().timeIntervalSince1970)
+      let payload: [String: Any] = [
+        "version": "proof.v1",
+        "projectId": input["projectId"]!,
+        "peerId": input["peerId"]!,
+        "connectionId": input["connectionId"]!,
+        "challenge": input["challenge"]!,
+        "grantSha256": base64url(Data(SHA256.hash(data: Data(grant.utf8)))),
+        "issuedAt": now,
+        "expiresAt": min(now + 15, Int(expiresAt / 1000)),
+      ]
+      let header = base64url(Data("{\"alg\":\"EdDSA\"}".utf8))
+      let body = base64url(try JSONSerialization.data(withJSONObject: payload))
+      let signingInput = Data("\(header).\(body)".utf8)
+      let signature = try signMobileEd25519(
+        privateKey: value.connectionPrivateKey,
+        message: signingInput
+      )
+      return "\(header).\(body).\(base64url(signature))"
+    } catch { return "" }
+  }
+
+  @objc func createInitiator(
+    _ identityHandle: String,
+    prologue: String,
+    responderPublicKey: String
+  ) -> String {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let value = try identity(identityHandle)
+      let handle = "session:\(UUID().uuidString)"
+      sessions[handle] = .initiator(try MobileInitiator(
+        prologue: decode64(prologue),
+        localPrivateKey: value.noiseStaticPrivateKey,
+        responderPublicKey: decode64(responderPublicKey)
+      ))
+      return handle
+    } catch { return "" }
+  }
+
+  @objc func createResponder(
+    _ identityHandle: String,
+    prologue: String,
+    initiatorPublicKey: String
+  ) -> String {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let value = try identity(identityHandle)
+      let handle = "session:\(UUID().uuidString)"
+      sessions[handle] = .responder(try MobileResponder(
+        prologue: decode64(prologue),
+        localPrivateKey: value.noiseStaticPrivateKey,
+        initiatorPublicKey: decode64(initiatorPublicKey)
+      ))
+      return handle
+    } catch { return "" }
+  }
+
+  @objc func beginHandshake(_ handle: String) -> String {
+    lock.lock(); defer { lock.unlock() }
+    guard case .initiator(let session) = sessions[handle] else { return "" }
+    return (try? base64url(session.beginHandshake())) ?? ""
+  }
+
+  @objc func finishHandshake(_ handle: String, message: String) -> Bool {
+    lock.lock(); defer { lock.unlock() }
+    guard case .initiator(let session) = sessions[handle] else { return false }
+    do {
+      try session.finishHandshake(message: decode64(message))
+      return true
+    } catch {
+      sessions.removeValue(forKey: handle)
+      try? session.closeSession()
+      return false
+    }
+  }
+
+  @objc func acceptHandshake(_ handle: String, message: String) -> String {
+    lock.lock(); defer { lock.unlock() }
+    guard case .responder(let session) = sessions[handle] else { return "" }
+    return (try? base64url(session.acceptHandshake(message: decode64(message)))) ?? ""
+  }
+
+  @objc func encrypt(_ handle: String, aad: String, plaintext: String) -> String {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let aadData = try decode64(aad); let plainData = try decode64(plaintext)
+      switch sessions[handle] {
+      case .initiator(let value): return base64url(try value.encrypt(aad: aadData, plaintext: plainData))
+      case .responder(let value): return base64url(try value.encrypt(aad: aadData, plaintext: plainData))
+      case .none: return ""
+      }
+    } catch { return "" }
+  }
+
+  @objc func decrypt(_ handle: String, aad: String, ciphertext: String) -> String {
+    lock.lock(); defer { lock.unlock() }
+    do {
+      let aadData = try decode64(aad); let cipherData = try decode64(ciphertext)
+      switch sessions[handle] {
+      case .initiator(let value): return base64url(try value.decrypt(aad: aadData, ciphertext: cipherData))
+      case .responder(let value): return base64url(try value.decrypt(aad: aadData, ciphertext: cipherData))
+      case .none: return ""
+      }
+    } catch { return "" }
+  }
+
+  @objc func closeSession(_ handle: String) {
+    lock.lock(); defer { lock.unlock() }
+    switch sessions.removeValue(forKey: handle) {
+    case .initiator(let value): try? value.closeSession()
+    case .responder(let value): try? value.closeSession()
+    case .none: break
+    }
+  }
+}
+
+private enum NativeError: Error { case invalid, storage }

package/react-native/native/GenationBridgeCryptoMobile.xcframework/Info.plist

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>AvailableLibraries</key>
+	<array>
+		<dict>
+			<key>BinaryPath</key>
+			<string>libgenation_bridge_crypto_uniffi.a</string>
+			<key>HeadersPath</key>
+			<string>Headers</string>
+			<key>LibraryIdentifier</key>
+			<string>ios-arm64_x86_64-simulator</string>
+			<key>LibraryPath</key>
+			<string>libgenation_bridge_crypto_uniffi.a</string>
+			<key>SupportedArchitectures</key>
+			<array>
+				<string>arm64</string>
+				<string>x86_64</string>
+			</array>
+			<key>SupportedPlatform</key>
+			<string>ios</string>
+			<key>SupportedPlatformVariant</key>
+			<string>simulator</string>
+		</dict>
+		<dict>
+			<key>BinaryPath</key>
+			<string>libgenation_bridge_crypto_uniffi.a</string>
+			<key>HeadersPath</key>
+			<string>Headers</string>
+			<key>LibraryIdentifier</key>
+			<string>ios-arm64</string>
+			<key>LibraryPath</key>
+			<string>libgenation_bridge_crypto_uniffi.a</string>
+			<key>SupportedArchitectures</key>
+			<array>
+				<string>arm64</string>
+			</array>
+			<key>SupportedPlatform</key>
+			<string>ios</string>
+		</dict>
+	</array>
+	<key>CFBundlePackageType</key>
+	<string>XFWK</string>
+	<key>XCFrameworkFormatVersion</key>
+	<string>1.0</string>
+</dict>
+</plist>