@oxyhq/services 19.1.3 → 19.2.0

package/android/build.gradle

@@ -0,0 +1,21 @@
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = 'so.oxy.identity'
+version = '0.1.0'
+
+android {
+  namespace "so.oxy.identity"
+  defaultConfig {
+    versionCode 1
+    versionName "0.1.0"
+  }
+}
+
+dependencies {
+  // Hardware-backed EncryptedSharedPreferences (MasterKey AES256_GCM) for the
+  // cross-app shared identity keypair.
+  implementation "androidx.security:security-crypto:1.1.0-alpha06"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,10 @@
+<manifest>
+  <!--
+    Intentionally empty. The signature-protected <permission> and the
+    <provider> that hosts the shared identity are declared per-app by the
+    Commons config plugin (`withSharedIdentityProvider.js`), NOT here — only
+    Commons (the identity vault) should host the provider, and its authority is
+    the app's own ${applicationId}.identity. Reader apps add only the matching
+    <uses-permission> via `withSharedIdentityReader.js`.
+  -->
+</manifest>

package/android/src/main/java/so/oxy/identity/OxyIdentityModule.kt

@@ -0,0 +1,84 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.net.Uri
+import android.os.Bundle
+import expo.modules.kotlin.exception.Exceptions
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+/**
+ * JS bridge for the cross-app shared Oxy identity.
+ *
+ * - `putShared` persists the keypair into THIS app's own hardware-backed
+ *   EncryptedSharedPreferences (only Commons calls this).
+ * - `getShared` resolves the keypair from the LOCAL store first (Commons reading
+ *   itself), then from the Commons ContentProvider — prod authority, then the
+ *   dev-variant authority. The `signature` permission on the provider means only
+ *   apps signed with the shared Oxy release key can resolve it.
+ * - `hasShared` / `clearShared` are the check + local teardown helpers.
+ *
+ * Every failure resolves to null / no-op so the JS layer degrades to the app's
+ * normal interactive sign-in path.
+ */
+class OxyIdentityModule : Module() {
+  private val context: Context
+    get() = appContext.reactContext ?: throw Exceptions.ReactContextLost()
+
+  override fun definition() = ModuleDefinition {
+    Name("OxyIdentity")
+
+    AsyncFunction("getShared") {
+      readShared()
+    }
+
+    AsyncFunction("putShared") { privateKey: String, publicKey: String ->
+      OxyIdentityStore.write(context, privateKey, publicKey)
+    }
+
+    AsyncFunction("hasShared") {
+      readShared() != null
+    }
+
+    AsyncFunction("clearShared") {
+      OxyIdentityStore.clear(context)
+    }
+  }
+
+  /**
+   * Local EncryptedSharedPreferences first, then the Commons provider (prod
+   * authority, then dev). Returns null on any failure.
+   */
+  private fun readShared(): Map<String, String>? {
+    runCatching { OxyIdentityStore.read(context) }.getOrNull()?.let { (priv, pub) ->
+      return mapOf("privateKey" to priv, "publicKey" to pub)
+    }
+
+    for (authority in PROVIDER_AUTHORITIES) {
+      val result = runCatching { callProvider(authority) }.getOrNull()
+      if (result != null) return result
+    }
+    return null
+  }
+
+  private fun callProvider(authority: String): Map<String, String>? {
+    val uri = Uri.parse("content://$authority")
+    val bundle: Bundle = context.contentResolver.call(uri, METHOD_GET_SHARED, null, null)
+      ?: return null
+    val priv = bundle.getString(OxyIdentityStore.KEY_PRIVATE) ?: return null
+    val pub = bundle.getString(OxyIdentityStore.KEY_PUBLIC) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return mapOf("privateKey" to priv, "publicKey" to pub)
+  }
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+
+    // Commons hosts the provider at "${applicationId}.identity". Try the prod
+    // app id first, then the dev variant ("so.oxy.commons.dev").
+    private val PROVIDER_AUTHORITIES = listOf(
+      "so.oxy.commons.identity",
+      "so.oxy.commons.dev.identity"
+    )
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityProvider.kt

@@ -0,0 +1,77 @@
+package so.oxy.identity
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.content.pm.PackageManager
+import android.database.Cursor
+import android.net.Uri
+import android.os.Bundle
+
+/**
+ * Cross-process read surface for the shared Oxy identity, hosted ONLY by Commons
+ * (declared per-app by the `withSharedIdentityProvider` config plugin with a
+ * `signature`-level permission, authority `${applicationId}.identity`).
+ *
+ * `call("getShared")` returns the keypair from Commons's own
+ * EncryptedSharedPreferences — but ONLY after verifying the caller is signed
+ * with the SAME certificate. That signature check is belt-and-suspenders on top
+ * of the manifest's `signature` permission: even if the permission gate were
+ * ever misconfigured, a differently-signed caller still gets null.
+ *
+ * All standard CRUD operations are no-ops; this provider exists solely for the
+ * `call()` channel.
+ */
+class OxyIdentityProvider : ContentProvider() {
+  override fun onCreate(): Boolean = true
+
+  override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
+    if (method != METHOD_GET_SHARED) return null
+    val ctx = context ?: return null
+    if (!callerSignatureMatches(ctx)) return null
+
+    val pair = runCatching { OxyIdentityStore.read(ctx) }.getOrNull() ?: return null
+    return Bundle().apply {
+      putString(OxyIdentityStore.KEY_PRIVATE, pair.first)
+      putString(OxyIdentityStore.KEY_PUBLIC, pair.second)
+    }
+  }
+
+  /**
+   * True when the calling package shares this app's signing certificate. Uses
+   * `checkSignatures` (deprecated but still the simplest correct cross-package
+   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
+   */
+  private fun callerSignatureMatches(ctx: Context): Boolean {
+    val caller = callingPackage ?: return false
+    return runCatching {
+      @Suppress("DEPRECATION")
+      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
+    }.getOrDefault(false)
+  }
+
+  override fun query(
+    uri: Uri,
+    projection: Array<out String>?,
+    selection: String?,
+    selectionArgs: Array<out String>?,
+    sortOrder: String?
+  ): Cursor? = null
+
+  override fun getType(uri: Uri): String? = null
+
+  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+  override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+  override fun update(
+    uri: Uri,
+    values: ContentValues?,
+    selection: String?,
+    selectionArgs: Array<out String>?
+  ): Int = 0
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityStore.kt

@@ -0,0 +1,76 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.content.SharedPreferences
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+
+/**
+ * Shared accessor for the hardware-backed EncryptedSharedPreferences that holds
+ * the cross-app Oxy identity keypair.
+ *
+ * Used by BOTH [OxyIdentityModule] (the JS bridge / local read + write) and
+ * [OxyIdentityProvider] (the cross-process read surface) so the store name and
+ * the AES256 encryption scheme can never drift between the two halves.
+ *
+ * ## Single memoized instance (CRITICAL)
+ *
+ * `EncryptedSharedPreferences.create()` must be called AT MOST ONCE per file per
+ * process. It is NOT safe to re-instantiate: when a second instance is created
+ * for the same file while another is live (e.g. the JS write thread and a Binder
+ * thread serving [OxyIdentityProvider.call] concurrently), Tink's keyset load
+ * races and the next decrypt throws `AEADBadTagException` — which silently turned
+ * every cross-app read into "no shared identity". So the instance is created once,
+ * lazily, under a lock, keyed on the process-global application context, and
+ * reused for all reads/writes/provider calls.
+ */
+internal object OxyIdentityStore {
+  const val PREFS_NAME = "oxy_shared_identity"
+  const val KEY_PRIVATE = "priv"
+  const val KEY_PUBLIC = "pub"
+
+  @Volatile private var cachedPrefs: SharedPreferences? = null
+
+  private fun prefs(context: Context): SharedPreferences {
+    cachedPrefs?.let { return it }
+    return synchronized(this) {
+      cachedPrefs ?: run {
+        val appContext = context.applicationContext
+        val masterKey = MasterKey.Builder(appContext)
+          .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+          .build()
+        val created = EncryptedSharedPreferences.create(
+          appContext,
+          PREFS_NAME,
+          masterKey,
+          EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+          EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+        cachedPrefs = created
+        created
+      }
+    }
+  }
+
+  /** Read the stored keypair as (privateKey, publicKey), or null when absent/blank. */
+  fun read(context: Context): Pair<String, String>? {
+    val p = prefs(context)
+    val priv = p.getString(KEY_PRIVATE, null) ?: return null
+    val pub = p.getString(KEY_PUBLIC, null) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return priv to pub
+  }
+
+  fun write(context: Context, priv: String, pub: String) {
+    // commit() (synchronous) so a cross-process reader that fires immediately
+    // after the write is guaranteed to see the flushed value.
+    prefs(context).edit()
+      .putString(KEY_PRIVATE, priv)
+      .putString(KEY_PUBLIC, pub)
+      .commit()
+  }
+
+  fun clear(context: Context) {
+    prefs(context).edit().clear().commit()
+  }
+}

package/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["apple", "android"],
+  "apple": {
+    "modules": ["OxyIdentityModule"]
+  },
+  "android": {
+    "modules": ["so.oxy.identity.OxyIdentityModule"]
+  }
+}

package/ios/OxyIdentity.podspec

@@ -0,0 +1,28 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name           = 'OxyIdentity'
+  s.version        = package['version']
+  s.summary        = package['description']
+  s.description    = package['description']
+  s.license        = package['license']
+  s.author         = package['author']
+  s.homepage       = package['homepage']
+  s.platforms      = {
+    :ios => '16.4',
+    :tvos => '16.4'
+  }
+  s.swift_version  = '5.9'
+  s.source         = { git: 'https://github.com/oxyhq/sdk.git' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+
+  s.source_files = "**/*.{h,m,mm,swift}"
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+end

package/ios/OxyIdentityModule.swift

@@ -0,0 +1,33 @@
+import ExpoModulesCore
+
+/**
+ * iOS no-op implementation of the shared Oxy identity bridge.
+ *
+ * On Apple platforms the cross-app identity share is handled directly by
+ * `@oxyhq/core`'s `KeyManager` via the Keychain Access Group
+ * (`group.so.oxy.shared`) — there is no ContentProvider equivalent to wrap. So
+ * every function here resolves to `nil` / no-op, which makes the JS
+ * `loadSharedIdentityBridge()` seam a pass-through on iOS: `KeyManager`'s iOS
+ * branches keep using `expo-secure-store` with the keychain group untouched.
+ */
+public class OxyIdentityModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("OxyIdentity")
+
+    AsyncFunction("getShared") { () -> [String: String]? in
+      return nil
+    }
+
+    AsyncFunction("putShared") { (_ privateKey: String, _ publicKey: String) in
+      // No-op on iOS: the keychain-access-group path in KeyManager owns writes.
+    }
+
+    AsyncFunction("hasShared") { () -> Bool in
+      return false
+    }
+
+    AsyncFunction("clearShared") { () in
+      // No-op on iOS.
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "19.1.3",
+  "version": "19.2.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -60,12 +60,20 @@
       },
       "default": "./lib/module/ui/server.js"
     },
+    "./plugins/*": "./plugins/*.js",
+    "./expo-module.config.json": "./expo-module.config.json",
     "./package.json": "./package.json"
   },
   "files": [
     "src",
     "lib",
-    "assets"
+    "assets",
+    "android/build.gradle",
+    "android/src",
+    "ios/OxyIdentityModule.swift",
+    "ios/OxyIdentity.podspec",
+    "plugins",
+    "expo-module.config.json"
   ],
   "keywords": [
     "react-native",
@@ -122,7 +130,7 @@
     "color": "^4.2.3"
   },
   "devDependencies": {
-    "@oxyhq/core": "9.2.3",
+    "@oxyhq/core": "9.2.4",
     "nativewind": "5.0.0-preview.3",
     "react-native-css": "^3.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
@@ -176,6 +184,7 @@
     "@types/react": "*",
     "@types/react-native": "*",
     "expo": ">=56.0.0",
+    "expo-modules-core": "*",
     "expo-document-picker": ">=56.0.0",
     "expo-file-system": ">=56.0.0",
     "expo-font": ">=13.0.0",
@@ -199,6 +208,9 @@
     "nativewind": {
       "optional": true
     },
+    "expo-modules-core": {
+      "optional": true
+    },
     "@expo/vector-icons": {
       "optional": true
     },

package/plugins/withSharedIdentityProvider.js

@@ -0,0 +1,83 @@
+/**
+ * Config plugin: withSharedIdentityProvider (Commons only).
+ *
+ * Commons is the identity vault — the ONE app that HOSTS the cross-app shared
+ * identity. This plugin wires the Android side of `@oxyhq/services`:
+ *
+ *  - Defines a `signature`-level permission `so.oxy.shared.permission.READ_IDENTITY`.
+ *    `signature` means only apps signed with the SAME certificate (the shared
+ *    Oxy release keystore) can hold it — the trust boundary is the signing key,
+ *    not the deprecated `sharedUserId`.
+ *  - Requests that same permission (`<uses-permission>`) so Commons can also
+ *    read cross-authority (e.g. prod ⇆ dev variant) through the provider.
+ *  - Declares the `OxyIdentityProvider` at authority `${applicationId}.identity`
+ *    (AGP substitutes `${applicationId}` at build → `so.oxy.commons.identity`,
+ *    or `so.oxy.commons.dev.identity` for the dev variant), guarded by that
+ *    permission.
+ *  - Adds a `<queries>` entry for the provider authorities so package-visibility
+ *    filtering (Android 11+) never hides the sibling provider from the resolver.
+ *
+ * Reader apps (accounts, Mention, …) use the companion `withSharedIdentityReader`
+ * plugin, which only requests the permission + queries — they never host the
+ * provider.
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const READ_IDENTITY_PERMISSION = 'so.oxy.shared.permission.READ_IDENTITY';
+const PROVIDER_CLASS = 'so.oxy.identity.OxyIdentityProvider';
+const PROVIDER_AUTHORITIES = ['so.oxy.commons.identity', 'so.oxy.commons.dev.identity'];
+
+module.exports = function withSharedIdentityProvider(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    // 1. Define the signature-level permission.
+    manifest['permission'] = manifest['permission'] ?? [];
+    if (!manifest['permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
+      manifest['permission'].push({
+        $: {
+          'android:name': READ_IDENTITY_PERMISSION,
+          'android:protectionLevel': 'signature',
+        },
+      });
+    }
+
+    // 2. Request it (Commons reads cross-authority too).
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
+      manifest['uses-permission'].push({ $: { 'android:name': READ_IDENTITY_PERMISSION } });
+    }
+
+    // 3. Make the sibling provider authorities visible under package filtering.
+    manifest['queries'] = manifest['queries'] ?? [];
+    if (manifest['queries'].length === 0) {
+      manifest['queries'].push({});
+    }
+    const queries = manifest['queries'][0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of PROVIDER_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    // 4. Host the provider.
+    const app = manifest.application?.[0];
+    if (!app) {
+      throw new Error('withSharedIdentityProvider: AndroidManifest has no <application>');
+    }
+    app.provider = app.provider ?? [];
+    if (!app.provider.some((p) => p.$['android:name'] === PROVIDER_CLASS)) {
+      app.provider.push({
+        $: {
+          'android:name': PROVIDER_CLASS,
+          'android:authorities': '${applicationId}.identity',
+          'android:exported': 'true',
+          'android:permission': READ_IDENTITY_PERMISSION,
+        },
+      });
+    }
+
+    return modConfig;
+  });
+};

package/plugins/withSharedIdentityReader.js

@@ -0,0 +1,46 @@
+/**
+ * Config plugin: withSharedIdentityReader (reader RPs — accounts, etc.).
+ *
+ * Reader apps do NOT host the shared identity — they only READ it from the
+ * Commons-hosted `OxyIdentityProvider` to enable silent "Sign in with Oxy".
+ * This plugin wires the minimal Android side of `@oxyhq/services`:
+ *
+ *  - Requests the `signature`-level permission `so.oxy.shared.permission.READ_IDENTITY`
+ *    (defined by Commons). Because it is `signature`, it is only granted when
+ *    this app is signed with the SAME certificate as Commons (the shared Oxy
+ *    release keystore) — that is the entire trust boundary.
+ *  - Adds a `<queries>` entry for the Commons provider authorities so
+ *    package-visibility filtering (Android 11+) never hides the provider from
+ *    `ContentResolver.call`.
+ *
+ * The provider itself is declared only in Commons (`withSharedIdentityProvider`).
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const READ_IDENTITY_PERMISSION = 'so.oxy.shared.permission.READ_IDENTITY';
+const PROVIDER_AUTHORITIES = ['so.oxy.commons.identity', 'so.oxy.commons.dev.identity'];
+
+module.exports = function withSharedIdentityReader(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
+      manifest['uses-permission'].push({ $: { 'android:name': READ_IDENTITY_PERMISSION } });
+    }
+
+    manifest['queries'] = manifest['queries'] ?? [];
+    if (manifest['queries'].length === 0) {
+      manifest['queries'].push({});
+    }
+    const queries = manifest['queries'][0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of PROVIDER_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    return modConfig;
+  });
+};