@pagopa/io-react-native-jwt 0.4.1

package/LICENSE

@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) 2023 PagoPa
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,145 @@
+# ⚡️ @pagopa/io-react-native-jwt
+
+A fast implementation of `jwt` module.
+Provides much greater performance for decoding, signing and verifying JWTs!
+
+🚀 Use only native functions via the following libraries:
+- 🤖 [nimbus-jose-jwt](https://github.com/felx/nimbus-jose-jwt/) on Android
+- 📱 [JOSESwift](https://github.com/airsidemobile/JOSESwift/) on iOS
+
+
+
+
+## Installation
+
+```sh
+npm install @pagopa/io-react-native-jwt
+```
+
+## Usage
+
+For detailed documentation go [here](/docs/modules/index.md)
+
+### Decode a JWT
+
+```js
+import { decode } from '@pagopa/io-react-native-jwt';
+
+// ...
+const jwt = "eyJ0eXAiOiJlbnRpdHktc3.....";
+const result = await decode(jwt);
+console.log(result);
+```
+
+### Verify JWT
+
+```js
+import { verify } from '@pagopa/io-react-native-jwt';
+
+// ...
+const pubJwk = {
+    crv: 'P-256',
+    kty: 'EC',
+    x: 'qrJrj.....',
+    y: '1H0cW.....',
+  };
+const jwt = "eyJ0eXAiOiJlbnRpdHktc3.....";
+const options = {
+    typ: 'jwt',
+    requiredClaims: ['iss', 'sub'],
+}
+const {protectedHeader, payload} = await verify(jwt, pubJwk, options);
+console.log(protectedHeader, payload)
+```
+
+
+### Verify a JWT signature (JWS)
+
+```js
+import { isSignatureValid } from '@pagopa/io-react-native-jwt';
+
+// ...
+const pubJwk = {
+    crv: 'P-256',
+    kty: 'EC',
+    x: 'qrJrj.....',
+    y: '1H0cW.....',
+  };
+const jwt = "eyJ0eXAiOiJlbnRpdHktc3.....";
+
+const isValid = await isSignatureValid(jwt, pubJwk);
+
+if isValid {
+    console.log("Signature of JWT is valid!");
+} else {
+    console.log("Signature of JWT is NOT valid!");
+}
+```
+
+### Create and sign a JWT with a JWS
+
+```js
+// Create unsecured jwt
+let jwtToSign = new SignJWT({ metadata: 'demo' })
+  .setProtectedHeader({ alg: 'ES256', typ: 'JWT' })
+  .setAudience('demo')
+  .setExpirationTime('1h')
+  .setIssuedAt()
+  .toSign();
+
+// Create signature
+let signature = signWithMyCustomFunction(jwtToSign);
+
+// Create signed JWT
+let signedJwt = await SignJWT.appendSignature(jwtToSign, signature);
+
+console.log(signedJwt)
+```
+
+### JWK thumbprint
+
+```js
+import { thumbprint } from '@pagopa/io-react-native-jwt';
+
+// ...
+const pubJwk = {
+    crv: 'P-256',
+    kty: 'EC',
+    x: 'qrJrj.....',
+    y: '1H0cW.....',
+  };
+const thumbprint = await thumbprint(pubJwk);
+console.log(thumbprint)
+```
+
+##  Signature format
+
+For an ECDSA signature it is required that this is in ASN.1/DER encoded format.
+The same format supported by Secure Enclave (TEE).
+Transcoding is done automatically via the following function:
+
+```js
+derToJose = async (
+  asn1Signature: string,
+  alg: string
+): Promise<string>
+```
+
+Refs: [RFC7515](https://datatracker.ietf.org/doc/html/rfc7515#appendix-A.3.1)
+
+## Example
+
+You can use the [sample app](example) to test and understand how to use the library.
+
+```sh
+cd example
+
+yarn install
+
+# To use iOS
+yarn ios
+
+# To use Android
+yarn android
+
+```

package/android/build.gradle

@@ -0,0 +1,97 @@
+buildscript {
+  // Buildscript is evaluated before everything else so we can't use getExtOrDefault
+  def kotlin_version = rootProject.ext.has("kotlinVersion") ? rootProject.ext.get("kotlinVersion") : project.properties["IoReactNativeJwt_kotlinVersion"]
+
+  repositories {
+    google()
+    mavenCentral()
+  }
+
+  dependencies {
+    classpath "com.android.tools.build:gradle:7.2.1"
+    // noinspection DifferentKotlinGradleVersion
+    classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+  }
+}
+
+def isNewArchitectureEnabled() {
+  return rootProject.hasProperty("newArchEnabled") && rootProject.getProperty("newArchEnabled") == "true"
+}
+
+apply plugin: "com.android.library"
+apply plugin: "kotlin-android"
+
+
+def appProject = rootProject.allprojects.find { it.plugins.hasPlugin('com.android.application') }
+
+if (isNewArchitectureEnabled()) {
+  apply plugin: "com.facebook.react"
+}
+
+def getExtOrDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : project.properties["IoReactNativeJwt_" + name]
+}
+
+def getExtOrIntegerDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : (project.properties["IoReactNativeJwt_" + name]).toInteger()
+}
+
+def isAGPVersionGreaterThan(version) {
+  def agpVersion = com.android.Version.ANDROID_GRADLE_PLUGIN_VERSION.tokenize('.')[0].toInteger()
+  return agpVersion > version
+}
+
+android {
+  if (isAGPVersionGreaterThan(7)) {
+    namespace "com.pagopa.ioreactnativejwt"
+  }
+
+  compileSdkVersion getExtOrIntegerDefault("compileSdkVersion")
+
+  defaultConfig {
+    minSdkVersion getExtOrIntegerDefault("minSdkVersion")
+    targetSdkVersion getExtOrIntegerDefault("targetSdkVersion")
+    buildConfigField "boolean", "IS_NEW_ARCHITECTURE_ENABLED", isNewArchitectureEnabled().toString()
+  }
+  buildTypes {
+    release {
+      minifyEnabled false
+    }
+  }
+
+  lintOptions {
+    disable "GradleCompatible"
+  }
+
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_1_8
+    targetCompatibility JavaVersion.VERSION_1_8
+  }
+
+}
+
+repositories {
+  mavenCentral()
+  google()
+}
+
+def kotlin_version = getExtOrDefault("kotlinVersion")
+
+dependencies {
+  // For < 0.71, this will be from the local maven repo
+  // For > 0.71, this will be replaced by `com.facebook.react:react-android:$version` by react gradle plugin
+  //noinspection GradleDynamicVersion
+  implementation "com.facebook.react:react-native:+"
+  implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+  implementation 'com.nimbusds:nimbus-jose-jwt:8.0'
+  implementation 'org.bouncycastle:bcprov-jdk15on:[1.56,)'
+
+}
+
+if (isNewArchitectureEnabled()) {
+  react {
+    jsRootDir = file("../src/")
+    libraryName = "IoReactNativeJwt"
+    codegenJavaPackageName = "com.pagopa.ioreactnativejwt"
+  }
+}

package/android/gradle.properties

@@ -0,0 +1,5 @@
+IoReactNativeJwt_kotlinVersion=1.7.0
+IoReactNativeJwt_minSdkVersion=21
+IoReactNativeJwt_targetSdkVersion=31
+IoReactNativeJwt_compileSdkVersion=31
+IoReactNativeJwt_ndkversion=21.4.7075529

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,4 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.pagopa.ioreactnativejwt">
+
+</manifest>

package/android/src/main/java/com/pagopa/ioreactnativejwt/IoReactNativeJwtModule.kt

@@ -0,0 +1,114 @@
+package com.pagopa.ioreactnativejwt
+
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReactContextBaseJavaModule
+import com.facebook.react.bridge.ReactMethod
+import com.facebook.react.bridge.Promise
+
+import android.util.Base64
+import android.util.Base64.DEFAULT
+import com.nimbusds.jose.JWSHeader
+import com.nimbusds.jose.crypto.RSASSASigner
+import com.nimbusds.jose.crypto.bc.BouncyCastleProviderSingleton
+import com.nimbusds.jose.jwk.RSAKey
+import com.nimbusds.jose.jwk.ECKey
+import com.nimbusds.jwt.JWTClaimsSet
+import com.nimbusds.jwt.SignedJWT
+import com.facebook.react.bridge.ReadableMap
+import org.json.JSONObject
+import com.nimbusds.jose.crypto.RSASSAVerifier
+import com.nimbusds.jose.crypto.ECDSAVerifier
+import com.facebook.react.bridge.WritableNativeMap
+import com.nimbusds.jose.crypto.impl.RSA_OAEP
+import com.pagopa.ioreactnativejwt.Utils.convertJsonToMap
+import com.nimbusds.jose.crypto.impl.ECDSA.transcodeSignatureToConcat
+import java.security.MessageDigest
+
+class IoReactNativeJwtModule(reactContext: ReactApplicationContext) :
+  ReactContextBaseJavaModule(reactContext) {
+
+  override fun getName(): String {
+    return NAME
+  }
+
+  fun isECKey(jwk: JSONObject):Boolean {
+    return jwk.get("kty") == "EC";
+  }
+
+  @ReactMethod
+  fun verify(token: String, jwk: ReadableMap, promise: Promise) {
+    try {
+      val signedJWT = SignedJWT.parse(token)
+      val jwkJson = JSONObject(jwk.toHashMap())
+      var isValid = false
+
+      if (isECKey(jwkJson)) {
+        val internalJwk = ECKey.parse(jwkJson.toString())
+        val verifier = ECDSAVerifier(internalJwk)
+        verifier.jcaContext.provider = BouncyCastleProviderSingleton.getInstance()
+        isValid = signedJWT.verify(verifier)
+      } else {
+        val internalJwk = RSAKey.parse(jwkJson.toString())
+        val verifier = RSASSAVerifier(internalJwk)
+        verifier.jcaContext.provider = BouncyCastleProviderSingleton.getInstance()
+        isValid = signedJWT.verify(verifier)
+      }
+      promise.resolve(isValid)
+
+    } catch (ex: Exception) {
+      promise.reject(ex)
+    }
+  }
+
+  @ReactMethod
+  fun thumbprint(jwk: ReadableMap, promise: Promise) {
+    try {
+      val jwkJson = JSONObject(jwk.toHashMap())
+      var thumbprint = ""
+      if (isECKey(jwkJson)) {
+        val internalJwk = ECKey.parse(jwkJson.toString())
+        thumbprint = internalJwk.computeThumbprint().toString();
+      } else {
+        val internalJwk = RSAKey.parse(jwkJson.toString())
+        thumbprint = internalJwk.computeThumbprint().toString();
+      }
+      if (thumbprint != "") {
+        promise.resolve(thumbprint)
+      } else {
+        promise.reject(Exception("Unable to create thumbprint"))
+      }
+
+    } catch (ex: Exception) {
+      promise.reject(ex)
+    }
+  }
+
+  @ReactMethod
+  fun unpackBerEncodedASN1(asn1Signature: String, coordinateOctetLength: Int, promise: Promise) {
+    try {
+      val decodedBytes = Base64.decode(asn1Signature, DEFAULT)
+      val transcoded = transcodeSignatureToConcat(decodedBytes, coordinateOctetLength)
+      val signature = Base64.encodeToString(transcoded, DEFAULT)
+      promise.resolve(signature)
+    } catch (ex: Exception) {
+      promise.reject(ex)
+    }
+  }
+
+  @ReactMethod
+  fun sha256(toHash: String, promise: Promise) {
+    try {
+      val digest = MessageDigest.getInstance("SHA-256")
+      val hashBytes = digest.digest(toHash.toByteArray(Charsets.UTF_8))
+      val base64String = Base64.encodeToString(hashBytes, Base64.NO_WRAP)
+      promise.resolve(base64String)
+    } catch (ex: Exception) {
+      promise.reject(ex)
+    }
+  }
+
+
+  companion object {
+    const val NAME = "IoReactNativeJwt"
+  }
+}

package/android/src/main/java/com/pagopa/ioreactnativejwt/IoReactNativeJwtPackage.kt

@@ -0,0 +1,17 @@
+package com.pagopa.ioreactnativejwt
+
+import com.facebook.react.ReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.uimanager.ViewManager
+
+
+class IoReactNativeJwtPackage : ReactPackage {
+  override fun createNativeModules(reactContext: ReactApplicationContext): List<NativeModule> {
+    return listOf(IoReactNativeJwtModule(reactContext))
+  }
+
+  override fun createViewManagers(reactContext: ReactApplicationContext): List<ViewManager<*, *>> {
+    return emptyList()
+  }
+}

package/android/src/main/java/com/pagopa/ioreactnativejwt/Utils.kt

@@ -0,0 +1,95 @@
+package com.pagopa.ioreactnativejwt
+
+import com.facebook.react.bridge.*
+import org.json.JSONException
+import org.json.JSONObject
+import org.json.JSONArray
+
+object Utils {
+    @Throws(JSONException::class)
+    fun convertJsonToMap(jsonObject: JSONObject): WritableMap {
+        val map = WritableNativeMap()
+
+        val iterator = jsonObject.keys()
+        while (iterator.hasNext()) {
+            val key = iterator.next()
+            val value = jsonObject.get(key)
+            if (value is JSONObject) {
+                map.putMap(key, convertJsonToMap(value))
+            } else if (value is JSONArray) {
+                map.putArray(key, convertJsonToArray(value))
+            } else if (value is Boolean) {
+                map.putBoolean(key, value)
+            } else if (value is Int) {
+                map.putInt(key, value)
+            } else if (value is Double) {
+                map.putDouble(key, value)
+            } else if (value is String) {
+                map.putString(key, value)
+            } else {
+                map.putString(key, value.toString())
+            }
+        }
+        return map
+    }
+
+    @Throws(JSONException::class)
+    fun convertJsonToArray(jsonArray: JSONArray): WritableArray {
+        val array = WritableNativeArray()
+
+        for (i in 0 until jsonArray.length()) {
+            val value = jsonArray.get(i)
+            if (value is JSONObject) {
+                array.pushMap(convertJsonToMap(value))
+            } else if (value is JSONArray) {
+                array.pushArray(convertJsonToArray(value))
+            } else if (value is Boolean) {
+                array.pushBoolean(value)
+            } else if (value is Int) {
+                array.pushInt(value)
+            } else if (value is Double) {
+                array.pushDouble(value)
+            } else if (value is String) {
+                array.pushString(value)
+            } else {
+                array.pushString(value.toString())
+            }
+        }
+        return array
+    }
+
+    @Throws(JSONException::class)
+    fun convertMapToJson(readableMap: ReadableMap): JSONObject {
+        val `object` = JSONObject()
+        val iterator = readableMap.keySetIterator()
+        while (iterator.hasNextKey()) {
+            val key = iterator.nextKey()
+            when (readableMap.getType(key)) {
+                ReadableType.Null -> `object`.put(key, JSONObject.NULL)
+                ReadableType.Boolean -> `object`.put(key, readableMap.getBoolean(key))
+                ReadableType.Number -> `object`.put(key, readableMap.getDouble(key))
+                ReadableType.String -> `object`.put(key, readableMap.getString(key))
+                ReadableType.Map -> `object`.put(key, convertMapToJson(readableMap.getMap(key)!!))
+                ReadableType.Array -> `object`.put(key, convertArrayToJson(readableMap.getArray(key)!!))
+            }
+        }
+        return `object`
+    }
+
+    @Throws(JSONException::class)
+    fun convertArrayToJson(readableArray: ReadableArray): JSONArray {
+        val array = JSONArray()
+        for (i in 0 until readableArray.size()) {
+            when (readableArray.getType(i)) {
+                ReadableType.Null -> {
+                }
+                ReadableType.Boolean -> array.put(readableArray.getBoolean(i))
+                ReadableType.Number -> array.put(readableArray.getDouble(i))
+                ReadableType.String -> array.put(readableArray.getString(i))
+                ReadableType.Map -> array.put(convertMapToJson(readableArray.getMap(i)!!))
+                ReadableType.Array -> array.put(convertArrayToJson(readableArray.getArray(i)!!))
+            }
+        }
+        return array
+    }
+}