@pyrocancode/react-native-vk-auth 1.0.2 → 1.1.0

package/README.md

@@ -181,6 +181,28 @@ VK.initialize(
 );
 ```
 
+#### Режим `authFlow`
+
+По умолчанию после входа на устройстве доступен **access token** (`payload.accessToken`, `payload.userId`).
+
+Если нужно обменять код на своём бэкенде (PKCE + `code` / `device_id` / `state` / `code_verifier`), передайте при инициализации:
+
+```tsx
+VK.initialize(
+  {
+    credentials: {
+      clientId: 'YOUR_CLIENT_ID',
+      clientSecret: 'YOUR_CLIENT_SECRET',
+    },
+    mode: VK.Mode.DEBUG,
+    authFlow: 'authorizationCode',
+  },
+  vkid
+);
+```
+
+В `onAuthorized` тогда придёт `payload.authorizationCode` с полями `code`, `codeVerifier`, `state`, `deviceId`, `isCompletion` (без `accessToken` в этом потоке). Поддерживается на **iOS и Android**.
+
 ### 2. Подписка на авторизацию и выход
 
 ```tsx

package/android/src/main/java/com/vkauth/vkid/AuthDelegate.kt

@@ -12,8 +12,10 @@ import com.vk.id.VKIDAuthFail
 import com.vk.id.auth.AuthCodeData
 import com.vk.id.auth.VKIDAuthCallback
 import com.vk.id.auth.VKIDAuthParams
+import com.vk.id.auth.VKIDAuthUiParams
 import com.vk.id.logout.VKIDLogoutCallback
 import com.vk.id.logout.VKIDLogoutFail
+import java.util.UUID
 
 class AuthDelegate(private val reactContext: ReactApplicationContext) {
 
@@ -21,6 +23,11 @@ class AuthDelegate(private val reactContext: ReactApplicationContext) {
     private const val TAG = "VkAuth"
   }
 
+  /** Для потока authorization code: переданы в authorize() и нужны бэкенду вместе с [AuthCodeData]. */
+  private var pendingCodeVerifier: String? = null
+  private var pendingState: String? = null
+  private var authorizationCodeEmitted: Boolean = false
+
   init {
     VKID.logsEnabled = true
   }
@@ -32,6 +39,27 @@ class AuthDelegate(private val reactContext: ReactApplicationContext) {
       emitAuthFail("No activity")
       return
     }
+
+    authorizationCodeEmitted = false
+    pendingCodeVerifier = null
+    pendingState = null
+
+    val params =
+      VKIDAuthParams.Builder().apply {
+        if (VkAuthConfig.useAuthorizationCodeFlow) {
+          val verifier = Pkce.generateVerifier()
+          val challenge = Pkce.challengeS256(verifier)
+          val state = UUID.randomUUID().toString()
+          pendingCodeVerifier = verifier
+          pendingState = state
+          codeChallenge = challenge
+          this.state = state
+        }
+        if (VkAuthConfig.scopes.isNotEmpty()) {
+          scopes = VkAuthConfig.scopes
+        }
+      }.build()
+
     VKID.instance.authorize(
       activity,
       object : VKIDAuthCallback {
@@ -44,18 +72,96 @@ class AuthDelegate(private val reactContext: ReactApplicationContext) {
         }
 
         override fun onAuthCode(data: AuthCodeData, isCompletion: Boolean) {
-          Log.d(TAG, "VKID onAuthCode: isCompletion=$isCompletion code=${data.code} deviceId=${data.deviceId}")
+          dispatchAuthCode(data, isCompletion)
         }
 
         override fun onFail(fail: VKIDAuthFail) {
           Log.e(TAG, "VKID onFail: $fail")
+          pendingCodeVerifier = null
+          pendingState = null
+          authorizationCodeEmitted = false
           emitAuthFail(fail.toString())
         }
       },
-      VKIDAuthParams.Builder().build(),
+      params,
     )
   }
 
+  /**
+   * Параметры One Tap / UI при потоке authorization code: PKCE (code_challenge) и state,
+   * как в [startAuth] с [VKIDAuthParams].
+   */
+  fun buildAuthorizationCodeUiParams(): VKIDAuthUiParams? {
+    if (!VkAuthConfig.useAuthorizationCodeFlow) {
+      return null
+    }
+    authorizationCodeEmitted = false
+    pendingCodeVerifier = null
+    pendingState = null
+    val verifier = Pkce.generateVerifier()
+    val challenge = Pkce.challengeS256(verifier)
+    val state = UUID.randomUUID().toString()
+    pendingCodeVerifier = verifier
+    pendingState = state
+    return VKIDAuthUiParams.Builder().apply {
+      codeChallenge = challenge
+      this.state = state
+      scopes = VkAuthConfig.scopes
+    }.build()
+  }
+
+  /**
+   * [VKIDAuthUiParams] для One Tap: PKCE при authorization code, иначе только [scopes] (как в
+   * [документации One Tap](https://id.vk.com/about/business/go/docs/ru/vkid/latest/vk-id/connection/elements/onetap-button/onetap-android)).
+   */
+  fun buildOneTapAuthUiParams(): VKIDAuthUiParams? {
+    if (VkAuthConfig.useAuthorizationCodeFlow) {
+      return buildAuthorizationCodeUiParams()
+    }
+    if (VkAuthConfig.scopes.isEmpty()) {
+      return null
+    }
+    return VKIDAuthUiParams.Builder().apply {
+      scopes = VkAuthConfig.scopes
+    }.build()
+  }
+
+  /** Общая обработка [AuthCodeData] для [startAuth] и One Tap. */
+  fun dispatchAuthCode(data: AuthCodeData, isCompletion: Boolean) {
+    Log.d(
+      TAG,
+      "VKID onAuthCode: isCompletion=$isCompletion code=${data.code} deviceId=${data.deviceId}",
+    )
+    if (!VkAuthConfig.useAuthorizationCodeFlow) {
+      return
+    }
+    // SDK может сначала вызвать с isCompletion=false (промежуточный код), затем с true — обмен на бэкенде нужен только по финальному.
+    if (!isCompletion) {
+      Log.d(TAG, "onAuthCode: skip non-final code, wait for isCompletion=true")
+      return
+    }
+    if (authorizationCodeEmitted) {
+      return
+    }
+    val verifier = pendingCodeVerifier
+    val state = pendingState
+    if (verifier == null || state == null) {
+      Log.e(TAG, "onAuthCode: missing PKCE state")
+      emitAuthFail("PKCE state lost")
+      return
+    }
+    emitAuthAuthorizationCode(
+      code = data.code,
+      deviceId = data.deviceId,
+      state = state,
+      codeVerifier = verifier,
+      isCompletion = isCompletion,
+    )
+    authorizationCodeEmitted = true
+    pendingCodeVerifier = null
+    pendingState = null
+  }
+
   fun closeAuth() {
     // VK ID SDK не требует явного закрытия веб-view из нативного модуля.
   }
@@ -82,7 +188,6 @@ class AuthDelegate(private val reactContext: ReactApplicationContext) {
   }
 
   fun accessTokenChangedSuccess(token: String, userId: Int) {
-    // Старый поток silent token; оставлено для совместимости с JS до миграции приложения.
     Log.d(TAG, "accessTokenChangedSuccess (legacy): userId=$userId")
   }
 
@@ -110,7 +215,28 @@ class AuthDelegate(private val reactContext: ReactApplicationContext) {
     promise.resolve(VkAuthPayload.profileForJs(token.userID, token.userData))
   }
 
+  private fun emitAuthAuthorizationCode(
+    code: String,
+    deviceId: String,
+    state: String,
+    codeVerifier: String,
+    isCompletion: Boolean,
+  ) {
+    val map = VkAuthPayload.fromAuthorizationCode(
+      code = code,
+      deviceId = deviceId,
+      state = state,
+      codeVerifier = codeVerifier,
+      isCompletion = isCompletion,
+    )
+    sendEvent("onAuth", map)
+  }
+
   fun emitAuthSuccess(accessToken: com.vk.id.AccessToken) {
+    if (VkAuthConfig.useAuthorizationCodeFlow && authorizationCodeEmitted) {
+      Log.d(TAG, "emitAuthSuccess: skipped, authorization code already emitted")
+      return
+    }
     val map = VkAuthPayload.fromAccessToken(accessToken)
     map.putMap("profile", VkAuthPayload.profileForJs(accessToken.userID, accessToken.userData))
     sendEvent("onAuth", map)

package/android/src/main/java/com/vkauth/vkid/InitDelegate.kt

@@ -3,14 +3,19 @@ package com.vkauth.vkid
 import android.util.Log
 import com.facebook.react.bridge.ReactApplicationContext
 import com.vkauth.vkid.jsinput.App
+import com.vkauth.vkid.jsinput.AuthFlow
 import com.vkauth.vkid.jsinput.VKID
 
 class InitDelegate(
   @Suppress("unused") private val context: ReactApplicationContext,
 ) {
   fun initialize(app: App, vkid: VKID) {
-    // Конфигурация клиента — через manifest placeholders (VKIDClientID и т.д.) и VKID.init в Application.
-    Log.d(TAG, "initialize mode=${app.mode} appName=${vkid.appName}")
+    VkAuthConfig.useAuthorizationCodeFlow = app.authFlow == AuthFlow.AUTHORIZATION_CODE
+    VkAuthConfig.scopes = app.scopes
+    Log.d(
+      TAG,
+      "initialize mode=${app.mode} appName=${vkid.appName} authFlow=${app.authFlow} scopes=${app.scopes.size}",
+    )
   }
 
   private companion object {

package/android/src/main/java/com/vkauth/vkid/Pkce.kt

@@ -0,0 +1,21 @@
+package com.vkauth.vkid
+
+import android.util.Base64
+import java.security.MessageDigest
+import java.security.SecureRandom
+
+/** RFC 7636 PKCE для обмена кода на бэкенде (см. VKIDAuthParams.codeChallenge). */
+internal object Pkce {
+  fun generateVerifier(): String {
+    val random = SecureRandom()
+    val bytes = ByteArray(32)
+    random.nextBytes(bytes)
+    return Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING)
+  }
+
+  fun challengeS256(verifier: String): String {
+    val digest =
+      MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray(Charsets.US_ASCII))
+    return Base64.encodeToString(digest, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING)
+  }
+}

package/android/src/main/java/com/vkauth/vkid/VkAuthConfig.kt

@@ -0,0 +1,10 @@
+package com.vkauth.vkid
+
+/** Задаётся в [InitDelegate] из JS (`authFlow`, `scopes`). */
+object VkAuthConfig {
+  @JvmField
+  var useAuthorizationCodeFlow: Boolean = false
+
+  @JvmField
+  var scopes: Set<String> = emptySet()
+}

package/android/src/main/java/com/vkauth/vkid/VkAuthPayload.kt

@@ -11,6 +11,23 @@ import com.vk.id.VKIDUser
  */
 internal object VkAuthPayload {
 
+  fun fromAuthorizationCode(
+    code: String,
+    deviceId: String,
+    state: String,
+    codeVerifier: String,
+    isCompletion: Boolean,
+  ): WritableMap {
+    val map = Arguments.createMap()
+    map.putString("type", "authorization_code")
+    map.putString("code", code)
+    map.putString("deviceId", deviceId)
+    map.putString("state", state)
+    map.putString("codeVerifier", codeVerifier)
+    map.putBoolean("isCompletion", isCompletion)
+    return map
+  }
+
   fun fromAccessToken(token: AccessToken): WritableMap {
     val map = Arguments.createMap()
     map.putString("type", "authorized")

package/android/src/main/java/com/vkauth/vkid/jsinput/App.kt

@@ -1,17 +1,48 @@
 package com.vkauth.vkid.jsinput
 
+import com.facebook.react.bridge.ReadableArray
 import com.facebook.react.bridge.ReadableMap
 
+enum class AuthFlow {
+  /** Токен на устройстве (по умолчанию). */
+  ACCESS_TOKEN,
+
+  /** PKCE + код → обмен на бэкенде; см. VKIDAuthParams.codeChallenge. */
+  AUTHORIZATION_CODE,
+}
+
 data class App(
   val credentials: Credentials,
-  val mode: Mode
+  val mode: Mode,
+  val authFlow: AuthFlow = AuthFlow.ACCESS_TOKEN,
+  val scopes: Set<String> = emptySet(),
 ) {
   companion object {
     fun fromMap(map: ReadableMap): App {
+      val flowStr = if (map.hasKey("authFlow")) map.getString("authFlow") else null
+      val authFlow =
+        when (flowStr) {
+          "authorizationCode" -> AuthFlow.AUTHORIZATION_CODE
+          else -> AuthFlow.ACCESS_TOKEN
+        }
       return App(
         credentials = Credentials.fromMap(map.getMap("credentials")!!),
-        mode = Mode.fromString(map.getString("mode")!!)
+        mode = Mode.fromString(map.getString("mode")!!),
+        authFlow = authFlow,
+        scopes = parseScopes(map),
       )
     }
+
+    private fun parseScopes(map: ReadableMap): Set<String> {
+      if (!map.hasKey("scopes")) {
+        return emptySet()
+      }
+      val arr: ReadableArray = map.getArray("scopes") ?: return emptySet()
+      val out = LinkedHashSet<String>()
+      for (i in 0 until arr.size()) {
+        arr.getString(i)?.trim()?.takeIf { it.isNotEmpty() }?.let { out.add(it) }
+      }
+      return out
+    }
   }
 }

package/android/src/main/java/com/vkauth/vkid/onetapbutton/OneTapButtonManager.kt

@@ -7,6 +7,7 @@ import com.facebook.react.uimanager.SimpleViewManager
 import com.facebook.react.uimanager.ThemedReactContext
 import com.facebook.react.uimanager.annotations.ReactProp
 import com.vk.id.onetap.xml.OneTap
+import com.vkauth.vkid.VkAuthConfig
 import com.vkauth.vkid.VkAuthServiceHolder
 
 /**
@@ -18,13 +19,19 @@ class OneTabButtonManager : SimpleViewManager<OneTap>() {
 
   override fun createViewInstance(context: ThemedReactContext): OneTap {
     val view = OneTap(context)
+    val delegate = VkAuthServiceHolder.authDelegate
+    delegate?.buildOneTapAuthUiParams()?.let { view.authParams = it }
     view.setCallbacks(
       onAuth = { _, accessToken ->
-        VkAuthServiceHolder.authDelegate?.emitAuthSuccess(accessToken)
+        delegate?.emitAuthSuccess(accessToken)
       },
       onFail = { _, fail ->
         Log.e(TAG, "OneTap onFail: $fail")
-        VkAuthServiceHolder.authDelegate?.emitAuthFail(fail.toString())
+        delegate?.emitAuthFail(fail.toString())
+        delegate?.buildOneTapAuthUiParams()?.let { view.authParams = it }
+      },
+      onAuthCode = { data, isCompletion ->
+        delegate?.dispatchAuthCode(data, isCompletion)
       },
     )
     return view

package/ios/VkAuth.swift

@@ -23,12 +23,14 @@ fileprivate func vkAuthTopViewController() -> UIViewController? {
     return top
 }
 
-/// Публичный клиент + PKCE внутри SDK. Для обмена кода на бэкенде позже можно сменить на `confidentialClientFlow`.
-fileprivate func vkAuthMakeConfiguration() -> AuthConfiguration {
-    AuthConfiguration(
-        flow: .publicClientFlow(),
-        scope: Scope([])
-    )
+/// Обмен кода на бэкенде: параметры уходят в JS; `finishFlow` завершает UI SDK (см. `AuthCodeHandler`).
+private final class RnAuthorizationCodeHandler: NSObject, AuthCodeHandler {
+    weak var emitter: VkAuth?
+
+    func exchange(_ code: AuthorizationCode, finishFlow: @escaping () -> Void) {
+        emitter?.sendAuthorizationCodePayload(code)
+        finishFlow()
+    }
 }
 
 /// React Native мост для VK ID SDK. См. https://id.vk.com/about/business/go/docs/ru/vkid/latest/vk-id/connection/migration/ios/migration-ios
@@ -36,6 +38,10 @@ fileprivate func vkAuthMakeConfiguration() -> AuthConfiguration {
 final class VkAuth: RCTEventEmitter {
     fileprivate static weak var _sharedEmitter: VkAuth?
 
+    private let authorizationCodeHandler = RnAuthorizationCodeHandler()
+    private var useAuthorizationCodeFlow = false
+    private var requestedScopes: [String] = []
+
     @objc(initialize:vkid:)
     func initialize(_ app: NSDictionary, vkid: NSDictionary) {
         guard
@@ -47,6 +53,20 @@ final class VkAuth: RCTEventEmitter {
             return
         }
 
+        if let flow = app["authFlow"] as? String, flow == "authorizationCode" {
+            useAuthorizationCodeFlow = true
+        } else {
+            useAuthorizationCodeFlow = false
+        }
+
+        if let scopes = app["scopes"] as? [String] {
+            requestedScopes = scopes
+        } else if let scopes = app["scopes"] as? [Any] {
+            requestedScopes = scopes.compactMap { $0 as? String }
+        } else {
+            requestedScopes = []
+        }
+
         do {
             try VKID.shared.set(
                 config: Configuration(
@@ -57,6 +77,7 @@ final class VkAuth: RCTEventEmitter {
                 )
             )
             VkAuth._sharedEmitter = self
+            authorizationCodeHandler.emitter = self
             VKID.shared.add(observer: self)
         } catch {
             os_log("VKID initialization failed: %{public}@", type: .error, error.localizedDescription)
@@ -69,13 +90,48 @@ final class VkAuth: RCTEventEmitter {
         _ = VKID.shared.open(url: url)
     }
 
+    fileprivate func makeScope() -> Scope {
+        guard !requestedScopes.isEmpty else {
+            return Scope([])
+        }
+        return Scope(requestedScopes)
+    }
+
+    fileprivate func makeAuthConfiguration() -> AuthConfiguration {
+        if useAuthorizationCodeFlow {
+            return AuthConfiguration(
+                flow: .confidentialClientFlow(
+                    codeExchanger: authorizationCodeHandler,
+                    pkce: nil
+                ),
+                scope: makeScope()
+            )
+        }
+        return AuthConfiguration(
+            flow: .publicClientFlow(),
+            scope: makeScope()
+        )
+    }
+
+    fileprivate func sendAuthorizationCodePayload(_ code: AuthorizationCode) {
+        let body: [String: Any] = [
+            "type": "authorization_code",
+            "code": code.code,
+            "deviceId": code.deviceId,
+            "state": code.state,
+            "codeVerifier": code.codeVerifier ?? "",
+            "isCompletion": true,
+        ]
+        sendEvent(withName: "onAuth", body: body)
+    }
+
     @objc func startAuth() {
         guard let presenter = vkAuthTopViewController() else {
             os_log("No presenter for VKID authorize", type: .error)
             return
         }
         VKID.shared.authorize(
-            with: vkAuthMakeConfiguration(),
+            with: makeAuthConfiguration(),
             using: .uiViewController(presenter)
         ) { _ in }
     }
@@ -143,13 +199,16 @@ final class VkAuth: RCTEventEmitter {
 
 extension VkAuth: VKIDObserver {
     func vkid(_ vkid: VKID, didCompleteAuthWith result: AuthResult, in oAuth: OAuthProvider) {
-        do {
-            let session = try result.get()
+        switch result {
+        case .success(let session):
             send(event: .onAuth(userSession: session))
-        } catch AuthError.cancelled {
+        case .failure(AuthError.authCodeExchangedOnYourBackend):
+            // Код уже отправлен в JS из RnAuthorizationCodeHandler.exchange
+            break
+        case .failure(AuthError.cancelled):
             os_log("VKID auth cancelled", type: .info)
-        } catch {
-            os_log("VKID auth failed: %{public}@", type: .error, error.localizedDescription)
+        case .failure(let error):
+            os_log("VKID auth failed: %{public}@", type: .error, String(describing: error))
         }
     }
 
@@ -177,13 +236,17 @@ final class OneTapButtonManager: RCTViewManager {
             return UIView()
         }
 
+        guard let emitter = VkAuth._sharedEmitter else {
+            return UIView()
+        }
+
         let button = OneTapButton(
             layout: .regular(
                 height: .medium(.h44),
                 cornerRadius: 8
             ),
             presenter: .uiViewController(root),
-            authConfiguration: vkAuthMakeConfiguration(),
+            authConfiguration: emitter.makeAuthConfiguration(),
             onCompleteAuth: nil
         )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyrocancode/react-native-vk-auth",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Тонкая обёртка над VK ID SDK для React Native: OAuth 2.1, нативные модули iOS и Android.",
   "main": "src/index.tsx",
   "module": "src/index.tsx",

package/src/index.tsx

@@ -63,9 +63,19 @@ export class VK {
 }
 
 export namespace VK {
+  /**
+   * `authorizationCode` — PKCE на клиенте, в JS придёт `code` + `codeVerifier` + `state` + `deviceId`
+   * (Android: VKIDAuthParams.codeChallenge; iOS: confidential client flow + AuthCodeHandler).
+   * По умолчанию — готовый access token на устройстве.
+   */
+  export type AuthFlowMode = 'accessToken' | 'authorizationCode';
+
   export interface App {
     mode: Mode;
     credentials: Credentials;
+    authFlow?: AuthFlowMode;
+    /** Запрашиваемые доступы, например `phone`, `email` (включите их в кабинете VK ID для приложения). */
+    scopes?: string[];
   }
 
   export enum Mode {
@@ -90,6 +100,28 @@ function parseOnAuthPayload(
     };
   }
 
+  if (raw.type === 'authorization_code') {
+    if (
+      typeof raw.code === 'string' &&
+      typeof raw.codeVerifier === 'string' &&
+      typeof raw.state === 'string'
+    ) {
+      return {
+        kind: 'ok',
+        payload: {
+          authorizationCode: {
+            code: raw.code,
+            codeVerifier: raw.codeVerifier,
+            state: raw.state,
+            deviceId: typeof raw.deviceId === 'string' ? raw.deviceId : '',
+            isCompletion: Boolean(raw.isCompletion),
+          },
+        },
+      };
+    }
+    return { kind: 'error', message: 'Invalid authorization_code payload' };
+  }
+
   if (raw.type === 'authorized') {
     const vkid = raw.vkid as Record<string, unknown> | undefined;
     if (vkid && typeof vkid.accessToken === 'string') {
@@ -240,11 +272,19 @@ export namespace VKID {
 
   /** Успешная авторизация VK ID (OAuth 2.1): access token и id пользователя VK. */
   export interface AuthSuccessPayload {
-    accessToken: string;
-    userId: string;
+    accessToken?: string;
+    userId?: string;
     profile?: UserProfile;
     /** Android: полный ответ VK ID SDK (отладка). */
     vkidNative?: Record<string, unknown>;
+    /** Поток обмена кода на бэкенде (`authFlow: 'authorizationCode'`). */
+    authorizationCode?: {
+      code: string;
+      codeVerifier: string;
+      state: string;
+      deviceId: string;
+      isCompletion: boolean;
+    };
   }
 
   export interface AuthChangedCallback {