@hxa-rn/rnaa 8.1.0

package/src/index.js

@@ -0,0 +1,596 @@
+import NativeRNAppAuth from './specs/v1/NativeRNAppAuth';
+import { AppState, DeviceEventEmitter, Platform } from 'react-native';
+import base64 from 'react-native-base64';
+
+export const CONFIGURATION_ERROR_CODE = 'configuration_error';
+
+const assertConfig = (condition, message) => {
+  if (!condition) {
+    const error = new Error(message);
+    error.code = CONFIGURATION_ERROR_CODE;
+    throw error;
+  }
+};
+
+const validateIssuer = issuer => typeof issuer === 'string' && issuer.length > 0;
+const hasServiceEndpoints = serviceConfiguration =>
+  serviceConfiguration &&
+  typeof serviceConfiguration.authorizationEndpoint === 'string' &&
+  serviceConfiguration.authorizationEndpoint.length > 0 &&
+  typeof serviceConfiguration.tokenEndpoint === 'string' &&
+  serviceConfiguration.tokenEndpoint.length > 0;
+const validateIssuerOrServiceConfigurationEndpoints = (issuer, serviceConfiguration) => {
+  assertConfig(
+    validateIssuer(issuer) || hasServiceEndpoints(serviceConfiguration),
+    'Config error: you must provide either an issuer or a service endpoints'
+  );
+};
+const validateIssuerOrServiceConfigurationRegistrationEndpoint = (issuer, serviceConfiguration) =>
+  assertConfig(
+    validateIssuer(issuer) ||
+      (serviceConfiguration &&
+        typeof serviceConfiguration.registrationEndpoint === 'string' &&
+        serviceConfiguration.registrationEndpoint.length > 0),
+    'Config error: you must provide either an issuer or a registration endpoint'
+  );
+const validateIssuerOrServiceConfigurationRevocationEndpoint = (issuer, serviceConfiguration) =>
+  assertConfig(
+    validateIssuer(issuer) ||
+      (serviceConfiguration &&
+        typeof serviceConfiguration.revocationEndpoint === 'string' &&
+        serviceConfiguration.revocationEndpoint.length > 0),
+    'Config error: you must provide either an issuer or a revocation endpoint'
+  );
+const validateIssuerOrServiceConfigurationEndSessionEndpoint = (issuer, serviceConfiguration) =>
+  assertConfig(
+    validateIssuer(issuer) ||
+      (serviceConfiguration &&
+        typeof serviceConfiguration.endSessionEndpoint === 'string' &&
+        serviceConfiguration.endSessionEndpoint.length > 0),
+    'Config error: you must provide either an issuer or an end session endpoint'
+  );
+const validateClientId = clientId =>
+  assertConfig(typeof clientId === 'string', 'Config error: clientId must be a string');
+const validateRedirectUrl = redirectUrl =>
+  assertConfig(typeof redirectUrl === 'string', 'Config error: redirectUrl must be a string');
+
+const validateHeaders = headers => {
+  if (!headers) {
+    return;
+  }
+  const customHeaderTypeErrorMessage =
+    'Config error: customHeaders type must be { token?: { [key: string]: string }, authorize?: { [key: string]: string }, register: { [key: string]: string }}';
+
+  const authorizedKeys = ['token', 'authorize', 'register'];
+  const keys = Object.keys(headers);
+  const correctKeys = keys.filter(key => authorizedKeys.includes(key));
+  assertConfig(
+    keys.length <= authorizedKeys.length &&
+      correctKeys.length > 0 &&
+      correctKeys.length === keys.length,
+    customHeaderTypeErrorMessage
+  );
+
+  Object.values(headers).forEach(value => {
+    assertConfig(typeof value === 'object', customHeaderTypeErrorMessage);
+    assertConfig(
+      Object.values(value).filter(key => typeof key !== 'string').length === 0,
+      customHeaderTypeErrorMessage
+    );
+  });
+};
+
+const validateAdditionalHeaders = headers => {
+  if (!headers) {
+    return;
+  }
+
+  const errorMessage = 'Config error: additionalHeaders must be { [key: string]: string }';
+
+  assertConfig(typeof headers === 'object', errorMessage);
+  assertConfig(
+    Object.values(headers).filter(key => typeof key !== 'string').length === 0,
+    errorMessage
+  );
+};
+
+const validateConnectionTimeoutSeconds = timeout => {
+  if (!timeout) {
+    return;
+  }
+
+  assertConfig(typeof timeout === 'number', 'Config error: connectionTimeoutSeconds must be a number');
+};
+
+export const SECOND_IN_MS = 1000;
+export const DEFAULT_TIMEOUT_IOS = 60;
+export const DEFAULT_TIMEOUT_ANDROID = 15;
+
+const convertTimeoutForPlatform = (
+  platform,
+  connectionTimeout = Platform.OS === 'ios' ? DEFAULT_TIMEOUT_IOS : DEFAULT_TIMEOUT_ANDROID
+) =>
+  platform === 'android' || platform === 'harmony'
+    ? connectionTimeout * SECOND_IN_MS
+    : connectionTimeout;
+
+// --- HarmonyOS browser-redirect bridge ---
+// RNOH emits a 'url' device event when the app is re-opened via a custom
+// scheme redirect (UIAbility.onNewWant -> RNInstance -> emitDeviceEvent('url')).
+// We forward it to the native handleRedirect() so the pending authorize/logout
+// Promise completes. handleRedirect() validates the state and returns false for
+// unrelated URLs (e.g. the app's own deep links), so a single always-on listener
+// is safe.
+let harmonyUrlListenerRegistered = false;
+const registerHarmonyUrlListener = () => {
+  if (Platform.OS !== 'harmony' || harmonyUrlListenerRegistered) {
+    return;
+  }
+  harmonyUrlListenerRegistered = true;
+  DeviceEventEmitter.addListener('url', event => {
+    if (event && typeof event.url === 'string') {
+      NativeRNAppAuth.handleRedirect(event.url);
+    }
+  });
+};
+
+// --- HarmonyOS user-cancel fallback ---
+// When the user closes the browser without authorizing, no 'url' event is
+// emitted and the native Promise would hang. On app foreground (AppState active)
+// we wait a short window for a matching redirect; if none arrives we ask the
+// native side to reject the pending flow with access_denied (mirrors Android's
+// onActivityResult cancelled result).
+let harmonyPendingCancelFlow = null;
+const registerHarmonyCancelFallback = () => {
+  if (Platform.OS !== 'harmony') {
+    return;
+  }
+  harmonyPendingCancelFlow = setTimeout(() => {
+    harmonyPendingCancelFlow = null;
+    NativeRNAppAuth.cancelPendingFlow();
+  }, 1000);
+};
+
+const registerHarmonyAppStateListener = () => {
+  if (Platform.OS !== 'harmony' || harmonyAppStateListenerRegistered) {
+    return;
+  }
+  harmonyAppStateListenerRegistered = true;
+  AppState.addEventListener('change', nextAppState => {
+    if (nextAppState === 'active' && harmonyPendingCancelFlow != null) {
+      setTimeout(() => {
+        if (harmonyPendingCancelFlow != null) {
+          clearTimeout(harmonyPendingCancelFlow);
+          harmonyPendingCancelFlow = null;
+          NativeRNAppAuth.cancelPendingFlow();
+        }
+      }, 500);
+    }
+  });
+};
+
+let harmonyAppStateListenerRegistered = false;
+
+const OAUTH_ERROR_SEPARATOR = '::';
+
+const KNOWN_OAUTH_ERROR_CODES = new Set([
+  'access_denied',
+  'invalid_request',
+  'invalid_client',
+  'invalid_grant',
+  'unauthorized_client',
+  'unsupported_grant_type',
+  'invalid_scope',
+  'invalid_redirect_uri',
+  'invalid_client_metadata',
+  'service_configuration_fetch_error',
+  'authentication_failed',
+  'token_refresh_failed',
+  'token_exchange_failed',
+  'registration_failed',
+  'end_session_failed',
+  'authentication_error',
+  'run_time_exception',
+  'configuration_error',
+]);
+
+/**
+ * Normalize a native rejection into AppAuthError shape { code, message }.
+ * Harmony TurboModule may only forward Error.message; native OAuthError embeds
+ * "code::message" in message for bridge compatibility with Android/iOS.
+ */
+const readableMessage = err => {
+  if (err == null) {
+    return 'Unknown error';
+  }
+  if (typeof err === 'string') {
+    return err;
+  }
+  if (typeof err.message === 'string' && err.message.length > 0 && err.message !== '[object Object]') {
+    return err.message;
+  }
+  try {
+    const jsonText = JSON.stringify(err);
+    if (jsonText && jsonText !== '{}' && jsonText !== 'null') {
+      return jsonText;
+    }
+  } catch (_ignored) {
+  }
+  const fallback = String(err);
+  return fallback === '[object Object]' ? 'Network request failed' : fallback;
+};
+
+export const normalizeOAuthError = err => {
+  if (err == null) {
+    const normalized = new Error('Unknown error');
+    normalized.code = 'run_time_exception';
+    return normalized;
+  }
+  if (typeof err === 'string') {
+    const normalized = new Error(err);
+    normalized.code = KNOWN_OAUTH_ERROR_CODES.has(err) ? err : 'run_time_exception';
+    return normalized;
+  }
+
+  const message = readableMessage(err);
+  const sepIndex = typeof message === 'string' ? message.indexOf(OAUTH_ERROR_SEPARATOR) : -1;
+  if (sepIndex > 0) {
+    const code = message.slice(0, sepIndex);
+    const detail = message.slice(sepIndex + OAUTH_ERROR_SEPARATOR.length);
+    err.code = code;
+    err.message = detail.length > 0 ? detail : code;
+    return err;
+  }
+
+  if (typeof err.code === 'string' && err.code.length > 0 && err.message !== '[object Object]') {
+    return err;
+  }
+
+  if (KNOWN_OAUTH_ERROR_CODES.has(message)) {
+    err.code = message;
+    err.message = message;
+    return err;
+  }
+
+  err.code = typeof err.code === 'string' && err.code.length > 0 ? err.code : 'run_time_exception';
+  err.message = message;
+  return err;
+};
+
+const wrapHarmonyNative = promise =>
+  Platform.OS === 'harmony'
+    ? promise.catch(err => Promise.reject(normalizeOAuthError(err)))
+    : promise;
+
+export const prefetchConfiguration = async ({
+  warmAndPrefetchChrome = false,
+  issuer,
+  redirectUrl,
+  clientId,
+  scopes,
+  serviceConfiguration,
+  dangerouslyAllowInsecureHttpRequests = false,
+  customHeaders,
+  connectionTimeoutSeconds,
+}) => {
+  if (Platform.OS === 'android' || Platform.OS === 'harmony') {
+    validateIssuerOrServiceConfigurationEndpoints(issuer, serviceConfiguration);
+    validateClientId(clientId);
+    validateRedirectUrl(redirectUrl);
+    validateHeaders(customHeaders);
+    validateConnectionTimeoutSeconds(connectionTimeoutSeconds);
+
+    const nativeMethodArguments = [
+      warmAndPrefetchChrome,
+      issuer,
+      redirectUrl,
+      clientId,
+      scopes,
+      serviceConfiguration,
+      dangerouslyAllowInsecureHttpRequests,
+      customHeaders,
+      convertTimeoutForPlatform(Platform.OS, connectionTimeoutSeconds),
+    ];
+
+    return wrapHarmonyNative(
+      NativeRNAppAuth.prefetchConfiguration(...nativeMethodArguments)
+    );
+  }
+  return undefined;
+};
+
+export const register = ({
+  issuer,
+  redirectUrls,
+  responseTypes,
+  grantTypes,
+  subjectType,
+  tokenEndpointAuthMethod,
+  additionalParameters,
+  serviceConfiguration,
+  dangerouslyAllowInsecureHttpRequests = false,
+  customHeaders,
+  additionalHeaders,
+  connectionTimeoutSeconds,
+}) => {
+  validateIssuerOrServiceConfigurationRegistrationEndpoint(issuer, serviceConfiguration);
+  validateHeaders(customHeaders);
+  validateAdditionalHeaders(additionalHeaders);
+  validateConnectionTimeoutSeconds(connectionTimeoutSeconds);
+
+  assertConfig(
+    Array.isArray(redirectUrls) && redirectUrls.every(url => typeof url === 'string'),
+    'Config error: redirectUrls must be an Array of strings'
+  );
+  assertConfig(
+    responseTypes == null ||
+      (Array.isArray(responseTypes) && responseTypes.every(rt => typeof rt === 'string')),
+    'Config error: if provided, responseTypes must be an Array of strings'
+  );
+  assertConfig(
+    grantTypes == null ||
+      (Array.isArray(grantTypes) && grantTypes.every(gt => typeof gt === 'string')),
+    'Config error: if provided, grantTypes must be an Array of strings'
+  );
+  assertConfig(
+    subjectType == null || typeof subjectType === 'string',
+    'Config error: if provided, subjectType must be a string'
+  );
+  assertConfig(
+    tokenEndpointAuthMethod == null || typeof tokenEndpointAuthMethod === 'string',
+    'Config error: if provided, tokenEndpointAuthMethod must be a string'
+  );
+
+  const nativeMethodArguments = [
+    issuer,
+    redirectUrls,
+    responseTypes,
+    grantTypes,
+    subjectType,
+    tokenEndpointAuthMethod,
+    additionalParameters,
+    serviceConfiguration,
+    convertTimeoutForPlatform(Platform.OS, connectionTimeoutSeconds),
+  ];
+
+  if (Platform.OS === 'android' || Platform.OS === 'harmony') {
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(customHeaders);
+  }
+
+  if (Platform.OS === 'ios') {
+    nativeMethodArguments.push(additionalHeaders);
+  }
+
+  return wrapHarmonyNative(NativeRNAppAuth.register(...nativeMethodArguments));
+};
+
+export const authorize = ({
+  issuer,
+  redirectUrl,
+  clientId,
+  clientSecret,
+  scopes,
+  useNonce = true,
+  usePKCE = true,
+  additionalParameters,
+  serviceConfiguration,
+  clientAuthMethod = 'basic',
+  dangerouslyAllowInsecureHttpRequests = false,
+  customHeaders,
+  additionalHeaders,
+  skipCodeExchange = false,
+  iosCustomBrowser = null,
+  androidAllowCustomBrowsers = null,
+  androidTrustedWebActivity = false,
+  connectionTimeoutSeconds,
+  iosPrefersEphemeralSession = false,
+}) => {
+  validateIssuerOrServiceConfigurationEndpoints(issuer, serviceConfiguration);
+  validateClientId(clientId);
+  validateRedirectUrl(redirectUrl);
+  validateHeaders(customHeaders);
+  validateAdditionalHeaders(additionalHeaders);
+  validateConnectionTimeoutSeconds(connectionTimeoutSeconds);
+  // TODO: validateAdditionalParameters
+
+  const nativeMethodArguments = [
+    issuer,
+    redirectUrl,
+    clientId,
+    clientSecret,
+    scopes,
+    additionalParameters,
+    serviceConfiguration,
+    skipCodeExchange,
+    convertTimeoutForPlatform(Platform.OS, connectionTimeoutSeconds),
+  ];
+
+  if (Platform.OS === 'android') {
+    nativeMethodArguments.push(useNonce);
+    nativeMethodArguments.push(usePKCE);
+    nativeMethodArguments.push(clientAuthMethod);
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(customHeaders);
+    nativeMethodArguments.push(androidAllowCustomBrowsers);
+    nativeMethodArguments.push(androidTrustedWebActivity);
+  }
+
+  if (Platform.OS === 'harmony') {
+    // Harmony keeps Android argument semantics minus the Chrome Custom Tab
+    // specific params (androidAllowCustomBrowsers / androidTrustedWebActivity)
+    // and iOS-only params (additionalHeaders / iosCustomBrowser / iosPrefersEphemeralSession).
+    nativeMethodArguments.push(useNonce);
+    nativeMethodArguments.push(usePKCE);
+    nativeMethodArguments.push(clientAuthMethod);
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(customHeaders);
+    registerHarmonyUrlListener();
+    registerHarmonyAppStateListener();
+    registerHarmonyCancelFallback();
+  }
+
+  if (Platform.OS === 'ios') {
+    nativeMethodArguments.push(additionalHeaders);
+    nativeMethodArguments.push(useNonce);
+    nativeMethodArguments.push(usePKCE);
+    nativeMethodArguments.push(iosCustomBrowser);
+    nativeMethodArguments.push(iosPrefersEphemeralSession);
+  }
+
+  return wrapHarmonyNative(NativeRNAppAuth.authorize(...nativeMethodArguments));
+};
+
+export const refresh = (
+  {
+    issuer,
+    redirectUrl,
+    clientId,
+    clientSecret,
+    scopes,
+    additionalParameters = {},
+    serviceConfiguration,
+    clientAuthMethod = 'basic',
+    dangerouslyAllowInsecureHttpRequests = false,
+    customHeaders,
+    additionalHeaders,
+    iosCustomBrowser = null,
+    androidAllowCustomBrowsers = null,
+    connectionTimeoutSeconds,
+  },
+  { refreshToken }
+) => {
+  validateIssuerOrServiceConfigurationEndpoints(issuer, serviceConfiguration);
+  validateClientId(clientId);
+  validateRedirectUrl(redirectUrl);
+  validateHeaders(customHeaders);
+  validateAdditionalHeaders(additionalHeaders);
+  validateConnectionTimeoutSeconds(connectionTimeoutSeconds);
+  assertConfig(refreshToken, 'Please pass in a refresh token');
+  // TODO: validateAdditionalParameters
+
+  const nativeMethodArguments = [
+    issuer,
+    redirectUrl,
+    clientId,
+    clientSecret,
+    refreshToken,
+    scopes,
+    additionalParameters,
+    serviceConfiguration,
+    convertTimeoutForPlatform(Platform.OS, connectionTimeoutSeconds),
+  ];
+
+  if (Platform.OS === 'android') {
+    nativeMethodArguments.push(clientAuthMethod);
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(customHeaders);
+    nativeMethodArguments.push(androidAllowCustomBrowsers);
+  }
+
+  if (Platform.OS === 'harmony') {
+    nativeMethodArguments.push(clientAuthMethod);
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(customHeaders);
+  }
+
+  if (Platform.OS === 'ios') {
+    nativeMethodArguments.push(additionalHeaders);
+    nativeMethodArguments.push(iosCustomBrowser);
+  }
+
+  return wrapHarmonyNative(NativeRNAppAuth.refresh(...nativeMethodArguments));
+};
+
+export const revoke = async (
+  { clientId, issuer, serviceConfiguration, clientSecret },
+  { tokenToRevoke, sendClientId = false, includeBasicAuth = false }
+) => {
+  assertConfig(tokenToRevoke, 'Please include the token to revoke');
+  validateClientId(clientId);
+  validateIssuerOrServiceConfigurationRevocationEndpoint(issuer, serviceConfiguration);
+
+  let revocationEndpoint;
+  if (serviceConfiguration && serviceConfiguration.revocationEndpoint) {
+    revocationEndpoint = serviceConfiguration.revocationEndpoint;
+  } else {
+    const response = await fetch(`${issuer}/.well-known/openid-configuration`);
+    const openidConfig = await response.json();
+
+    assertConfig(
+      openidConfig.revocation_endpoint,
+      'The openid config does not specify a revocation endpoint'
+    );
+
+    revocationEndpoint = openidConfig.revocation_endpoint;
+  }
+
+  const headers = {
+    'Content-Type': 'application/x-www-form-urlencoded',
+  };
+  if (includeBasicAuth) {
+    headers.Authorization = `Basic ${base64.encode(`${clientId}:${clientSecret}`)}`;
+  }
+  /**
+    Identity Server insists on client_id being passed in the body,
+    but Google does not. According to the spec, Google is right
+    so defaulting to no client_id
+    https://tools.ietf.org/html/rfc7009#section-2.1
+  **/
+  return await fetch(revocationEndpoint, {
+    method: 'POST',
+    headers,
+    body: `token=${tokenToRevoke}${sendClientId ? `&client_id=${clientId}` : ''}`,
+  }).catch(error => {
+    const err = new Error('Failed to revoke token');
+    err.code = 'token_revocation_failed';
+    if (error) {
+      err.cause = error;
+    }
+    throw err;
+  });
+};
+
+export const logout = (
+  {
+    issuer,
+    serviceConfiguration,
+    additionalParameters,
+    dangerouslyAllowInsecureHttpRequests = false,
+    iosCustomBrowser = null,
+    iosPrefersEphemeralSession = false,
+    androidAllowCustomBrowsers = null,
+  },
+  { idToken, postLogoutRedirectUrl }
+) => {
+  validateIssuerOrServiceConfigurationEndSessionEndpoint(issuer, serviceConfiguration);
+  validateRedirectUrl(postLogoutRedirectUrl);
+  assertConfig(idToken, 'Please pass in the ID token');
+
+  const nativeMethodArguments = [
+    issuer,
+    idToken,
+    postLogoutRedirectUrl,
+    serviceConfiguration,
+    additionalParameters,
+  ];
+
+  if (Platform.OS === 'android') {
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    nativeMethodArguments.push(androidAllowCustomBrowsers);
+  }
+
+  if (Platform.OS === 'harmony') {
+    nativeMethodArguments.push(dangerouslyAllowInsecureHttpRequests);
+    registerHarmonyUrlListener();
+    registerHarmonyAppStateListener();
+    registerHarmonyCancelFallback();
+  }
+
+  if (Platform.OS === 'ios') {
+    nativeMethodArguments.push(iosCustomBrowser);
+    nativeMethodArguments.push(iosPrefersEphemeralSession);
+  }
+
+  return wrapHarmonyNative(NativeRNAppAuth.logout(...nativeMethodArguments));
+};

package/src/specs/v1/.gitkeep

@@ -0,0 +1 @@
+# This file ensures the directory is tracked by Git even if other files are removed