@oxy.so/services 1.0.0

package/android/build.gradle

@@ -0,0 +1,21 @@
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = 'so.oxy.identity'
+version = '0.1.0'
+
+android {
+  namespace "so.oxy.identity"
+  defaultConfig {
+    versionCode 1
+    versionName "0.1.0"
+  }
+}
+
+dependencies {
+  // Hardware-backed EncryptedSharedPreferences (MasterKey AES256_GCM) for the
+  // cross-app shared identity keypair.
+  implementation "androidx.security:security-crypto:1.1.0-alpha06"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,10 @@
+<manifest>
+  <!--
+    Intentionally empty. The signature-protected <permission> and the
+    <provider> that hosts the shared identity are declared per-app by the
+    Commons config plugin (`withSharedIdentityProvider.js`), NOT here — only
+    Commons (the identity vault) should host the provider, and its authority is
+    the app's own ${applicationId}.identity. Reader apps add only the matching
+    <uses-permission> via `withSharedIdentityReader.js`.
+  -->
+</manifest>

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt

@@ -0,0 +1,178 @@
+package so.oxy.devicesession
+
+import android.content.Context
+import android.net.Uri
+import android.os.Bundle
+import expo.modules.kotlin.exception.Exceptions
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+/**
+ * JS bridge for the shared DeviceSession credential.
+ *
+ * - `read` resolves the credential this DEVICE holds, from the sibling providers
+ *   first and this app's own store second (see [readShared] for why that order).
+ * - `write` publishes into this app's own store only, and reports whether a
+ *   read-back confirmed it.
+ * - `clear` drops this app's copy.
+ *
+ * ## `read` returns a STATUS, not a nullable value
+ *
+ * The three answers "here it is", "there is none" and "I could not tell" are
+ * genuinely different, and only the second one authorises the JS side to seed the
+ * slot. A nullable return would merge the last two, and the merged value reads as
+ * "fresh device" — which is exactly how a locked or broken keystore ends up
+ * overwriting a live session. So every path here reports its status explicitly,
+ * and never degrades a failure into an absence.
+ *
+ * Return shapes:
+ * ```
+ * { "status": "present", "deviceId": "...", "deviceSecret": "..." }
+ * { "status": "absent" }
+ * { "status": "unavailable", "reason": "<ExceptionClassName>" }
+ * ```
+ *
+ * Plain scalars in, a plain `Map` out — never an Expo `Record`. This package
+ * ships as SOURCE that each consuming app compiles, so the annotation processing
+ * a `Record` needs to become introspectable does not necessarily run in the
+ * consumer's build; the one `Record` this package ever had failed to convert on a
+ * real device and stored nothing, silently. See the long note in
+ * `so.oxy.session.OxyBackgroundSessionModule` before reaching for one here.
+ */
+class OxyDeviceSessionModule : Module() {
+  private val context: Context
+    get() = appContext.reactContext ?: throw Exceptions.ReactContextLost()
+
+  override fun definition() = ModuleDefinition {
+    Name("OxyDeviceSession")
+
+    AsyncFunction("read") {
+      readShared()
+    }
+
+    AsyncFunction("write") { deviceId: String, deviceSecret: String ->
+      if (deviceId.isEmpty() || deviceSecret.isEmpty()) {
+        return@AsyncFunction false
+      }
+      OxyDeviceSessionStore.write(context, deviceId, deviceSecret)
+    }
+
+    AsyncFunction("clear") {
+      OxyDeviceSessionStore.clear(context)
+    }
+  }
+
+  /**
+   * Providers FIRST, this app's own store second.
+   *
+   * Under `android:sharedUserId="so.oxy.shared"` every Oxy app sees one data
+   * directory, so for a UID member the local file IS the group's file and the
+   * order changes nothing. It matters for a same-signature app OUTSIDE the UID:
+   * there the local file is a private mirror of whatever that app itself last
+   * wrote, so reading it first would shadow the group's real credential forever.
+   *
+   * `unavailable` is sticky across the whole sweep: if ANY source could not be
+   * read and none produced a credential, the answer is `unavailable`, not
+   * `absent`. The pessimistic merge is the point — the optimistic one authorises
+   * a write.
+   */
+  private fun readShared(): Map<String, String> {
+    var unavailableReason: String? = null
+
+    for (authority in PROVIDER_AUTHORITIES) {
+      when (val read = callProvider(authority)) {
+        is DeviceSessionRead.Present -> return present(read)
+        is DeviceSessionRead.Unavailable -> unavailableReason = unavailableReason ?: read.reason
+        // Absent, or no provider there at all (not installed, refused, threw) —
+        // neither is evidence about the other sources, so keep looking.
+        else -> Unit
+      }
+    }
+
+    when (val local = OxyDeviceSessionStore.read(context)) {
+      is DeviceSessionRead.Present -> return present(local)
+      is DeviceSessionRead.Unavailable -> unavailableReason = unavailableReason ?: local.reason
+      is DeviceSessionRead.Absent -> Unit
+    }
+
+    val reason = unavailableReason
+    return if (reason != null) {
+      mapOf(
+        OxyDeviceSessionProvider.KEY_STATUS to OxyDeviceSessionProvider.STATUS_UNAVAILABLE,
+        OxyDeviceSessionProvider.KEY_REASON to reason,
+      )
+    } else {
+      mapOf(OxyDeviceSessionProvider.KEY_STATUS to OxyDeviceSessionProvider.STATUS_ABSENT)
+    }
+  }
+
+  private fun present(read: DeviceSessionRead.Present): Map<String, String> = mapOf(
+    OxyDeviceSessionProvider.KEY_STATUS to OxyDeviceSessionProvider.STATUS_PRESENT,
+    OxyDeviceSessionStore.KEY_DEVICE_ID to read.deviceId,
+    OxyDeviceSessionStore.KEY_DEVICE_SECRET to read.deviceSecret,
+  )
+
+  /**
+   * Call one sibling provider. `null` means "nothing to learn from this one" —
+   * the app is not installed, package visibility hid it, the permission was
+   * refused, or the call threw. A provider that answered but could not read its
+   * own store returns [DeviceSessionRead.Unavailable], which the sweep keeps.
+   */
+  private fun callProvider(authority: String): DeviceSessionRead? = runCatching {
+    val uri = Uri.parse("content://$authority")
+    val bundle: Bundle = context.contentResolver.call(
+      uri,
+      OxyDeviceSessionProvider.METHOD_READ,
+      null,
+      null,
+    ) ?: return@runCatching null
+
+    when (bundle.getString(OxyDeviceSessionProvider.KEY_STATUS)) {
+      OxyDeviceSessionProvider.STATUS_PRESENT -> {
+        val deviceId = bundle.getString(OxyDeviceSessionStore.KEY_DEVICE_ID)
+        val deviceSecret = bundle.getString(OxyDeviceSessionStore.KEY_DEVICE_SECRET)
+        if (deviceId.isNullOrEmpty() || deviceSecret.isNullOrEmpty()) {
+          // A `present` verdict with an incomplete payload is a broken peer, not
+          // an empty device.
+          DeviceSessionRead.Unavailable("IncompleteProviderPayload")
+        } else {
+          DeviceSessionRead.Present(deviceId, deviceSecret)
+        }
+      }
+      OxyDeviceSessionProvider.STATUS_ABSENT -> DeviceSessionRead.Absent
+      OxyDeviceSessionProvider.STATUS_UNAVAILABLE ->
+        DeviceSessionRead.Unavailable(
+          bundle.getString(OxyDeviceSessionProvider.KEY_REASON) ?: "PeerUnavailable",
+        )
+      // An older sibling that predates this protocol. It said something we do not
+      // understand, so we have learned nothing — never read that as "absent".
+      else -> DeviceSessionRead.Unavailable("UnrecognisedProviderStatus")
+    }
+  }.getOrNull()
+
+  companion object {
+    /**
+     * Sibling authorities to sweep, in order. Each official Oxy Android app hosts
+     * the provider at `${applicationId}.devicesession` via the
+     * `withSharedDeviceSession` config plugin, and both the prod and `.dev`
+     * variants are listed so a developer build can join a device too.
+     *
+     * MAINTAINED LIST, and the constraint on it is specific: every entry must be
+     * an app inside the `so.oxy.shared` UID. UID members all serve ONE file, so
+     * the sweep is deterministic no matter which of them answers first. Adding an
+     * app that is same-signature but NOT in the UID would put a second,
+     * independent copy of "the shared credential" into the sweep and make the
+     * winner depend on list order.
+     *
+     * The same authorities must also be added to the `<queries>` block in
+     * `withSharedDeviceSession.js`, or Android 11+ package-visibility filtering
+     * hides them from `ContentResolver.call` and the sweep silently finds nothing.
+     */
+    private val PROVIDER_AUTHORITIES = listOf(
+      "so.oxy.accounts.devicesession",
+      "so.oxy.accounts.dev.devicesession",
+      "so.oxy.commons.devicesession",
+      "so.oxy.commons.dev.devicesession",
+    )
+  }
+}

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionProvider.kt

@@ -0,0 +1,99 @@
+package so.oxy.devicesession
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.content.pm.PackageManager
+import android.database.Cursor
+import android.net.Uri
+import android.os.Bundle
+
+/**
+ * Cross-process READ surface for the shared DeviceSession credential, declared
+ * per-app by the `withSharedDeviceSession` config plugin at authority
+ * `${applicationId}.devicesession` behind a `signature`-level permission.
+ *
+ * The signature check below is belt-and-suspenders on top of that permission:
+ * even if the manifest gate were ever misconfigured, a differently-signed caller
+ * still gets nothing. Same-signature is the whole trust boundary — an
+ * incorrectly-signed app cannot read this slot, and there is no other way in.
+ *
+ * READ-ONLY across the process boundary, deliberately. A caller may join the
+ * device's session; it may not seed or overwrite another app's. Writes happen
+ * only in-process via [OxyDeviceSessionModule], against this app's own store.
+ *
+ * What crosses the boundary is a session credential — never the identity
+ * keypair, which lives behind `so.oxy.identity.OxyIdentityProvider` under a
+ * different permission. That separation is the point.
+ *
+ * All standard CRUD operations are no-ops; this provider exists solely for the
+ * `call()` channel.
+ */
+class OxyDeviceSessionProvider : ContentProvider() {
+  override fun onCreate(): Boolean = true
+
+  override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
+    if (method != METHOD_READ) return null
+    val ctx = context ?: return null
+    if (!callerSignatureMatches(ctx)) return null
+
+    return when (val read = OxyDeviceSessionStore.read(ctx)) {
+      is DeviceSessionRead.Present -> Bundle().apply {
+        putString(KEY_STATUS, STATUS_PRESENT)
+        putString(OxyDeviceSessionStore.KEY_DEVICE_ID, read.deviceId)
+        putString(OxyDeviceSessionStore.KEY_DEVICE_SECRET, read.deviceSecret)
+      }
+      is DeviceSessionRead.Absent -> Bundle().apply { putString(KEY_STATUS, STATUS_ABSENT) }
+      // Reported, not swallowed. A null here would be indistinguishable from
+      // "this app has no credential", and the caller would go on to treat the
+      // device as fresh.
+      is DeviceSessionRead.Unavailable -> Bundle().apply {
+        putString(KEY_STATUS, STATUS_UNAVAILABLE)
+        putString(KEY_REASON, read.reason)
+      }
+    }
+  }
+
+  /**
+   * True when the calling package shares this app's signing certificate. Uses
+   * `checkSignatures` (deprecated but still the simplest correct cross-package
+   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
+   */
+  private fun callerSignatureMatches(ctx: Context): Boolean {
+    val caller = callingPackage ?: return false
+    return runCatching {
+      @Suppress("DEPRECATION")
+      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
+    }.getOrDefault(false)
+  }
+
+  override fun query(
+    uri: Uri,
+    projection: Array<out String>?,
+    selection: String?,
+    selectionArgs: Array<out String>?,
+    sortOrder: String?
+  ): Cursor? = null
+
+  override fun getType(uri: Uri): String? = null
+
+  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+  override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+  override fun update(
+    uri: Uri,
+    values: ContentValues?,
+    selection: String?,
+    selectionArgs: Array<out String>?
+  ): Int = 0
+
+  companion object {
+    const val METHOD_READ = "read"
+    const val KEY_STATUS = "status"
+    const val KEY_REASON = "reason"
+    const val STATUS_PRESENT = "present"
+    const val STATUS_ABSENT = "absent"
+    const val STATUS_UNAVAILABLE = "unavailable"
+  }
+}

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionStore.kt

@@ -0,0 +1,115 @@
+package so.oxy.devicesession
+
+import android.content.Context
+import android.content.SharedPreferences
+import so.oxy.storage.OxyEncryptedPrefs
+import so.oxy.storage.RecoveryPolicy
+
+/**
+ * What a read of the shared slot found.
+ *
+ * THREE outcomes, and the difference between the last two is the entire safety
+ * property of this file. An EMPTY slot authorises a write (seed the device
+ * session); a slot that could not be READ must authorise nothing, because it may
+ * hold a live session belonging to someone still signed in. Collapsing them —
+ * which a plain nullable return would do — is how a locked or broken keystore
+ * gets mistaken for a fresh device.
+ */
+internal sealed interface DeviceSessionRead {
+  data class Present(val deviceId: String, val deviceSecret: String) : DeviceSessionRead
+  object Absent : DeviceSessionRead
+  /** [reason] is an exception CLASS NAME only — never a message, never a value. */
+  data class Unavailable(val reason: String) : DeviceSessionRead
+}
+
+/**
+ * The cross-app DeviceSession credential — `deviceId` + `deviceSecret`, and
+ * nothing else.
+ *
+ * This is NOT the identity keypair. `so.oxy.identity.OxyIdentityStore` holds the
+ * self-custody private key that signs identity approvals and cannot be
+ * re-created; this file holds an ordinary session credential the server can
+ * revoke and any signed-in app can re-publish. They are separate files behind
+ * separate providers with separate permissions precisely so an app that only
+ * needs a session is never handed the key.
+ *
+ * Under `android:sharedUserId="so.oxy.shared"` every Oxy app sees ONE data
+ * directory, so this file is literally shared between them — that is the primary
+ * transport, and [OxyDeviceSessionProvider] extends the same bytes to a
+ * same-signature app outside the UID.
+ */
+internal object OxyDeviceSessionStore {
+  /**
+   * Global (not package-suffixed) on purpose — the opposite choice from
+   * `oxy_background_session`, and for the opposite reason. That store is
+   * per-app precisely so one app cannot touch another's widget credential. This
+   * one EXISTS to be one value shared by every app in the UID; scoping it per
+   * package would give each app its own copy and defeat the whole point.
+   */
+  const val PREFS_NAME = "oxy_shared_device_session"
+  const val KEY_DEVICE_ID = "deviceId"
+  const val KEY_DEVICE_SECRET = "deviceSecret"
+
+  /**
+   * [RecoveryPolicy.RebuildFileOnly] — this store must NEVER escalate to a
+   * UID-shared master-key reset.
+   *
+   * What it holds is DERIVED: every signed-in app re-publishes the credential
+   * from its own durable copy, so losing this file costs at most one interactive
+   * sign-in on a device that has no other Oxy app installed. A master-key reset
+   * would wipe every other Oxy store sharing the alias — including the
+   * self-custody identity keypair, which is IRREPLACEABLE. Trading someone's
+   * unrecoverable identity to save a credential we can simply re-publish is never
+   * the right trade, so the escalation is not merely discouraged here, it is
+   * unreachable.
+   *
+   * Consequence worth stating: a stage-1 heal WIPES this file. That surfaces as
+   * `Absent`, which is honest — after the wipe the slot really is empty, and the
+   * next successful mint in any app re-seeds it.
+   */
+  private fun prefs(context: Context): SharedPreferences =
+    OxyEncryptedPrefs.open(context, PREFS_NAME, RecoveryPolicy.RebuildFileOnly)
+
+  /**
+   * Read the credential. A thrown open (the keyset is unreadable and the policy
+   * above refuses to escalate) is reported as [DeviceSessionRead.Unavailable] —
+   * never as absent.
+   */
+  fun read(context: Context): DeviceSessionRead =
+    runCatching {
+      val p = prefs(context)
+      val deviceId = p.getString(KEY_DEVICE_ID, null)
+      val deviceSecret = p.getString(KEY_DEVICE_SECRET, null)
+      if (deviceId.isNullOrEmpty() || deviceSecret.isNullOrEmpty()) {
+        DeviceSessionRead.Absent
+      } else {
+        DeviceSessionRead.Present(deviceId, deviceSecret)
+      }
+    }.getOrElse { DeviceSessionRead.Unavailable(it.javaClass.simpleName) }
+
+  /**
+   * Replace the credential, returning whether a read-back confirmed it landed.
+   *
+   * The read-back is the contract JS relies on: a fresh install adopts whatever
+   * is in this slot, so publishing a value that did not actually persist would
+   * send it into a mint that can never succeed.
+   *
+   * `commit()` (synchronous) so a cross-process reader firing immediately after
+   * the write sees the flushed value.
+   */
+  fun write(context: Context, deviceId: String, deviceSecret: String): Boolean =
+    runCatching {
+      val p = prefs(context)
+      p.edit()
+        .putString(KEY_DEVICE_ID, deviceId)
+        .putString(KEY_DEVICE_SECRET, deviceSecret)
+        .commit()
+      p.getString(KEY_DEVICE_ID, null) == deviceId &&
+        p.getString(KEY_DEVICE_SECRET, null) == deviceSecret
+    }.getOrDefault(false)
+
+  /** Drop the shared credential. Best-effort; safe to call when already empty. */
+  fun clear(context: Context) {
+    runCatching { prefs(context).edit().clear().commit() }
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityModule.kt

@@ -0,0 +1,84 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.net.Uri
+import android.os.Bundle
+import expo.modules.kotlin.exception.Exceptions
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+/**
+ * JS bridge for the cross-app shared Oxy identity.
+ *
+ * - `putShared` persists the keypair into THIS app's own hardware-backed
+ *   EncryptedSharedPreferences (only Commons calls this).
+ * - `getShared` resolves the keypair from the LOCAL store first (Commons reading
+ *   itself), then from the Commons ContentProvider — prod authority, then the
+ *   dev-variant authority. The `signature` permission on the provider means only
+ *   apps signed with the shared Oxy release key can resolve it.
+ * - `hasShared` / `clearShared` are the check + local teardown helpers.
+ *
+ * Every failure resolves to null / no-op so the JS layer degrades to the app's
+ * normal interactive sign-in path.
+ */
+class OxyIdentityModule : Module() {
+  private val context: Context
+    get() = appContext.reactContext ?: throw Exceptions.ReactContextLost()
+
+  override fun definition() = ModuleDefinition {
+    Name("OxyIdentity")
+
+    AsyncFunction("getShared") {
+      readShared()
+    }
+
+    AsyncFunction("putShared") { privateKey: String, publicKey: String ->
+      OxyIdentityStore.write(context, privateKey, publicKey)
+    }
+
+    AsyncFunction("hasShared") {
+      readShared() != null
+    }
+
+    AsyncFunction("clearShared") {
+      OxyIdentityStore.clear(context)
+    }
+  }
+
+  /**
+   * Local EncryptedSharedPreferences first, then the Commons provider (prod
+   * authority, then dev). Returns null on any failure.
+   */
+  private fun readShared(): Map<String, String>? {
+    runCatching { OxyIdentityStore.read(context) }.getOrNull()?.let { (priv, pub) ->
+      return mapOf("privateKey" to priv, "publicKey" to pub)
+    }
+
+    for (authority in PROVIDER_AUTHORITIES) {
+      val result = runCatching { callProvider(authority) }.getOrNull()
+      if (result != null) return result
+    }
+    return null
+  }
+
+  private fun callProvider(authority: String): Map<String, String>? {
+    val uri = Uri.parse("content://$authority")
+    val bundle: Bundle = context.contentResolver.call(uri, METHOD_GET_SHARED, null, null)
+      ?: return null
+    val priv = bundle.getString(OxyIdentityStore.KEY_PRIVATE) ?: return null
+    val pub = bundle.getString(OxyIdentityStore.KEY_PUBLIC) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return mapOf("privateKey" to priv, "publicKey" to pub)
+  }
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+
+    // Commons hosts the provider at "${applicationId}.identity". Try the prod
+    // app id first, then the dev variant ("so.oxy.commons.dev").
+    private val PROVIDER_AUTHORITIES = listOf(
+      "so.oxy.commons.identity",
+      "so.oxy.commons.dev.identity"
+    )
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityProvider.kt

@@ -0,0 +1,77 @@
+package so.oxy.identity
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.content.pm.PackageManager
+import android.database.Cursor
+import android.net.Uri
+import android.os.Bundle
+
+/**
+ * Cross-process read surface for the shared Oxy identity, hosted ONLY by Commons
+ * (declared per-app by the `withSharedIdentityProvider` config plugin with a
+ * `signature`-level permission, authority `${applicationId}.identity`).
+ *
+ * `call("getShared")` returns the keypair from Commons's own
+ * EncryptedSharedPreferences — but ONLY after verifying the caller is signed
+ * with the SAME certificate. That signature check is belt-and-suspenders on top
+ * of the manifest's `signature` permission: even if the permission gate were
+ * ever misconfigured, a differently-signed caller still gets null.
+ *
+ * All standard CRUD operations are no-ops; this provider exists solely for the
+ * `call()` channel.
+ */
+class OxyIdentityProvider : ContentProvider() {
+  override fun onCreate(): Boolean = true
+
+  override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
+    if (method != METHOD_GET_SHARED) return null
+    val ctx = context ?: return null
+    if (!callerSignatureMatches(ctx)) return null
+
+    val pair = runCatching { OxyIdentityStore.read(ctx) }.getOrNull() ?: return null
+    return Bundle().apply {
+      putString(OxyIdentityStore.KEY_PRIVATE, pair.first)
+      putString(OxyIdentityStore.KEY_PUBLIC, pair.second)
+    }
+  }
+
+  /**
+   * True when the calling package shares this app's signing certificate. Uses
+   * `checkSignatures` (deprecated but still the simplest correct cross-package
+   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
+   */
+  private fun callerSignatureMatches(ctx: Context): Boolean {
+    val caller = callingPackage ?: return false
+    return runCatching {
+      @Suppress("DEPRECATION")
+      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
+    }.getOrDefault(false)
+  }
+
+  override fun query(
+    uri: Uri,
+    projection: Array<out String>?,
+    selection: String?,
+    selectionArgs: Array<out String>?,
+    sortOrder: String?
+  ): Cursor? = null
+
+  override fun getType(uri: Uri): String? = null
+
+  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+  override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+  override fun update(
+    uri: Uri,
+    values: ContentValues?,
+    selection: String?,
+    selectionArgs: Array<out String>?
+  ): Int = 0
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityStore.kt

@@ -0,0 +1,65 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.content.SharedPreferences
+import so.oxy.storage.OxyEncryptedPrefs
+import so.oxy.storage.RecoveryPolicy
+
+/**
+ * Shared accessor for the hardware-backed EncryptedSharedPreferences that holds
+ * the cross-app Oxy identity keypair.
+ *
+ * Used by BOTH [OxyIdentityModule] (the JS bridge / local read + write) and
+ * [OxyIdentityProvider] (the cross-process read surface) so the store name and
+ * the encryption scheme can never drift between the two halves.
+ *
+ * Opening the file — the single-memoized-instance rule and the two-stage keyset
+ * self-heal, both load-bearing and non-obvious — lives in [OxyEncryptedPrefs],
+ * which is shared with the background-session store. Read its documentation
+ * before changing anything about how this file is opened.
+ *
+ * One consequence worth restating here: an open can legitimately return an EMPTY
+ * file (the self-heal wipes a keyset it cannot read). That is safe for this slot
+ * specifically because it is a DERIVED copy — Commons re-populates it from the
+ * primary self-custody identity on the next boot (`migrateToSharedIdentity`), and
+ * that primary lives in expo-secure-store under a different file and different
+ * keystore aliases, untouched by any recovery here.
+ */
+internal object OxyIdentityStore {
+  const val PREFS_NAME = "oxy_shared_identity"
+  const val KEY_PRIVATE = "priv"
+  const val KEY_PUBLIC = "pub"
+
+  /**
+   * [RecoveryPolicy.RegenerateSharedMasterKey] preserves this store's original
+   * behaviour: when its keyset cannot be rebuilt, the master key is regenerated.
+   * That is defensible HERE and nowhere else so far, because this slot going dead
+   * already breaks cross-app "Sign in with Oxy" for every Oxy app on the device —
+   * the collateral is not worse than the failure it recovers from — and because
+   * this slot is itself re-populated from the primary identity on the next boot.
+   */
+  private fun prefs(context: Context): SharedPreferences =
+    OxyEncryptedPrefs.open(context, PREFS_NAME, RecoveryPolicy.RegenerateSharedMasterKey)
+
+  /** Read the stored keypair as (privateKey, publicKey), or null when absent/blank. */
+  fun read(context: Context): Pair<String, String>? {
+    val p = prefs(context)
+    val priv = p.getString(KEY_PRIVATE, null) ?: return null
+    val pub = p.getString(KEY_PUBLIC, null) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return priv to pub
+  }
+
+  fun write(context: Context, priv: String, pub: String) {
+    // commit() (synchronous) so a cross-process reader that fires immediately
+    // after the write is guaranteed to see the flushed value.
+    prefs(context).edit()
+      .putString(KEY_PRIVATE, priv)
+      .putString(KEY_PUBLIC, pub)
+      .commit()
+  }
+
+  fun clear(context: Context) {
+    prefs(context).edit().clear().commit()
+  }
+}