@qntx/wallet-native 0.0.0-stage → 0.5.2

package/android/build.gradle

@@ -0,0 +1,177 @@
+buildscript {
+  repositories {
+    google()
+    mavenCentral()
+  }
+  dependencies {
+
+    classpath "com.android.tools.build:gradle:9.2.1"
+  }
+}
+
+def reactNativeArchitectures() {
+  def value = rootProject.getProperties().get("reactNativeArchitectures")
+  return value ? value.split(",") : ["x86", "x86_64", "armeabi-v7a", "arm64-v8a"]
+}
+
+def isNewArchitectureEnabled() {
+  return rootProject.hasProperty("newArchEnabled") && rootProject.getProperty("newArchEnabled") == "true"
+}
+
+apply plugin: "com.android.library"
+apply plugin: 'org.jetbrains.kotlin.android'
+apply from: '../nitrogen/generated/android/WalletNative+autolinking.gradle'
+
+if (isNewArchitectureEnabled()) {
+  apply plugin: "com.facebook.react"
+
+
+}
+
+def getExtOrDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : project.properties["WalletNative_" + name]
+}
+
+def getExtOrIntegerDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : (project.properties["WalletNative_" + name]).toInteger()
+}
+
+android {
+  namespace = "com.margelo.nitro.qntxwallet"
+
+  ndkVersion = getExtOrDefault("ndkVersion")
+  compileSdkVersion = getExtOrIntegerDefault("compileSdkVersion")
+
+  defaultConfig {
+    // WD-024: per-use Keystore keys that accept a biometric or the device
+    // credential through BiometricPrompt need API 30.
+    minSdkVersion = 30
+    targetSdkVersion = getExtOrIntegerDefault("targetSdkVersion")
+
+    consumerProguardFiles "consumer-rules.pro"
+
+    externalNativeBuild {
+      cmake {
+        cppFlags "-frtti -fexceptions -Wall -Wextra -fstack-protector-all"
+        // The consuming app's react-native root — resolved through node module
+        // resolution from the app project (as RN's own settings.gradle does);
+        // compile-kernel.mjs then resolves hermesc through it.
+        arguments "-DANDROID_STL=c++_shared", "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON",
+            // The consuming app's react-native dir, resolved through node
+            // module resolution from the app project — a library cannot reach
+            // it by walking up from its own tree.
+            "-DQNTX_REACT_NATIVE_PATH=" + providers.exec {
+                workingDir = rootProject.projectDir
+                commandLine "node", "-p", "require('path').dirname(require.resolve('react-native/package.json'))"
+            }.standardOutput.asText.get().trim(),
+            // The app's @qntx/spark-native dir (header + per-ABI libqntx_spark.so),
+            // resolved the same way.
+            "-DQNTX_SPARK_NATIVE_PATH=" + providers.exec {
+                workingDir = rootProject.projectDir
+                commandLine "node", "-p", "require('path').dirname(require.resolve('@qntx/spark-native/package.json'))"
+            }.standardOutput.asText.get().trim()
+        abiFilters (*reactNativeArchitectures())
+        buildTypes {
+          debug {
+            cppFlags "-O1 -g"
+          }
+          release {
+            cppFlags "-O2"
+          }
+        }
+      }
+    }
+  }
+
+  externalNativeBuild {
+    cmake {
+      path = file("CMakeLists.txt")
+    }
+  }
+
+  packagingOptions {
+    excludes = [
+      "META-INF",
+      "META-INF/**",
+      "**/libNitroModules.so",
+      "**/libc++_shared.so",
+      "**/libfbjni.so",
+      "**/libjsi.so",
+      "**/libfolly_json.so",
+      "**/libfolly_runtime.so",
+      "**/libglog.so",
+      "**/libhermes.so",
+      "**/libhermes-executor-debug.so",
+      "**/libhermes_executor.so",
+      "**/libreactnative.so",
+      "**/libreactnativejni.so",
+      "**/libturbomodulejsijni.so",
+      "**/libreact_nativemodule_core.so",
+      "**/libjscexecutor.so",
+      // Linked, not bundled — @qntx/spark-native packages it from its jniLibs.
+      "**/libqntx_spark.so"
+    ]
+  }
+
+  buildFeatures {
+    buildConfig = true
+    prefab = true
+  }
+
+  buildTypes {
+    release {
+      minifyEnabled = false
+    }
+  }
+
+  lintOptions {
+    disable "GradleCompatible"
+  }
+
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_1_8
+    targetCompatibility JavaVersion.VERSION_1_8
+  }
+
+  sourceSets {
+    main {
+      if (isNewArchitectureEnabled()) {
+        java.srcDirs += [
+          "${project.buildDir}/generated/source/codegen/java"
+        ]
+      }
+    }
+  }
+}
+
+dependencies {
+  // For > 0.71, this is replaced by `com.facebook.react:react-android:$version` by the React
+  // gradle plugin — it supplies the fbjni/ReactAndroid prefab packages the generated CMake
+  // autolinking file finds with find_package.
+  //noinspection GradleDynamicVersion
+  implementation "com.facebook.react:react-native:+"
+
+  // Hermes engine prefab — the kernel runtime links hermesvm/libhermes
+  implementation "com.facebook.react:hermes-android"
+
+  // NitroModules core (provides the react-native-nitro-modules prefab + HybridObject runtime)
+  implementation project(":react-native-nitro-modules")
+  implementation project(":qntx_nostr-native")
+
+  // ProcessLifecycleOwner for the background lock (W7) — the version the app
+  // already resolves for androidx.lifecycle.
+  implementation "androidx.lifecycle:lifecycle-process:2.6.2"
+
+  // BiometricPrompt + CryptoObject for the hardware vault factor (W5).
+  implementation "androidx.biometric:biometric:1.1.0"
+
+  // Credential Manager for native passkeys (W6); the Play services provider
+  // backs Google Password Manager.
+  implementation "androidx.credentials:credentials:1.6.0"
+  implementation "androidx.credentials:credentials-play-services-auth:1.6.0"
+}
+
+repositories {
+  mavenCentral()
+  google()
+}

package/android/consumer-rules.pro

@@ -0,0 +1,4 @@
+# Called from native code over JNI or bound to JNI by method-name mangling;
+# R8 would otherwise strip or rename them (the classes have no direct Java
+# call sites inside the app).
+-keep class com.margelo.nitro.qntxwallet.** { *; }

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+</manifest>

package/android/src/main/cpp/cpp-adapter.cpp

@@ -0,0 +1,29 @@
+#include "WalletNativeOnLoad.hpp"
+#include "host/VaultDirectory.hpp"
+#include "runtime/platform/KernelPbkdf2.hpp"
+#include <fbjni/fbjni.h>
+#include <jni.h>
+
+namespace qntx {
+void kernelVaultDirectoryInit(facebook::jni::alias_ref<jclass> clazz);
+void kernelLifecycleInit(facebook::jni::alias_ref<jclass> clazz);
+void kernelKeystoreInit(facebook::jni::alias_ref<jclass> clazz);
+void kernelPasskeyInit(facebook::jni::alias_ref<jclass> clazz);
+}
+
+JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void*) {
+  return facebook::jni::initialize(vm, []() {
+    qntx::kernelVaultDirectoryInit(
+        facebook::jni::findClassLocal("com/margelo/nitro/qntxwallet/VaultDirectory"));
+    qntx::kernelLifecycleInit(
+        facebook::jni::findClassLocal("com/margelo/nitro/qntxwallet/AppLifecycle"));
+    qntx::kernelKeystoreInit(
+        facebook::jni::findClassLocal("com/margelo/nitro/qntxwallet/Keystore"));
+    qntx::kernelPasskeyInit(
+        facebook::jni::findClassLocal("com/margelo/nitro/qntxwallet/Passkey"));
+    margelo::nitro::qntxwallet::registerAllNatives();
+    qntx::kernelPbkdf2OnLoad(
+        facebook::jni::Environment::current(),
+        "com/margelo/nitro/qntxwallet/KernelPbkdf2");
+  });
+}

package/android/src/main/java/com/margelo/nitro/qntxwallet/AppLifecycle.kt

@@ -0,0 +1,35 @@
+package com.margelo.nitro.qntxwallet
+
+import android.os.Handler
+import android.os.Looper
+import androidx.annotation.Keep
+import androidx.lifecycle.DefaultLifecycleObserver
+import androidx.lifecycle.LifecycleOwner
+import androidx.lifecycle.ProcessLifecycleOwner
+import com.facebook.proguard.annotations.DoNotStrip
+
+/**
+ * Process-wide lifecycle: the C++ host calls [install] once (fbjni, first
+ * KernelHost.start); the observer forwards app background/foreground
+ * transitions to the native dispatcher on the main looper.
+ */
+@DoNotStrip
+@Keep
+object AppLifecycle {
+
+    @JvmStatic
+    fun install() {
+        Handler(Looper.getMainLooper()).post {
+            ProcessLifecycleOwner.get().lifecycle.addObserver(object : DefaultLifecycleObserver {
+                override fun onStop(owner: LifecycleOwner) = onAppBackground()
+                override fun onStart(owner: LifecycleOwner) = onAppForeground()
+            })
+        }
+    }
+
+    @JvmStatic
+    private external fun onAppBackground()
+
+    @JvmStatic
+    private external fun onAppForeground()
+}

package/android/src/main/java/com/margelo/nitro/qntxwallet/KernelPbkdf2.java

@@ -0,0 +1,59 @@
+package com.margelo.nitro.qntxwallet;
+
+import java.security.GeneralSecurityException;
+import java.util.Arrays;
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+/**
+ * PBKDF2 for the kernel runtime, called from C++ over JNI on the dedicated KDF worker thread.
+ *
+ * Byte-exact RFC 8018 derivation over javax.crypto.Mac — there is no SecretKeyFactory/PBEKeySpec
+ * path, because chars decoded from the password's UTF-8 bytes are provider-specific. All
+ * intermediate arrays the VM hands back (u, t, out) are wiped. Note that SecretKeySpec and JCA
+ * provider internals retain their own non-wipeable copies of the key material; the caller-side
+ * buffers are still zeroed by JniByteArray after return.
+ */
+public final class KernelPbkdf2 {
+  private KernelPbkdf2() {}
+
+  public static byte[] derive(String hmacAlgorithm, byte[] password, byte[] salt, int iterations, int length)
+      throws GeneralSecurityException {
+    SecretKeySpec key = new SecretKeySpec(password, hmacAlgorithm);
+    Mac mac = Mac.getInstance(hmacAlgorithm);
+    mac.init(key);
+    int blockSize = mac.getMacLength();
+    int blocks = (length + blockSize - 1) / blockSize;
+    byte[] out = new byte[blocks * blockSize];
+    byte[] index = new byte[4];
+    int offset = 0;
+    try {
+      for (int block = 1; block <= blocks; block++) {
+        index[0] = (byte) (block >>> 24);
+        index[1] = (byte) (block >>> 16);
+        index[2] = (byte) (block >>> 8);
+        index[3] = (byte) block;
+        mac.update(salt);
+        byte[] u = mac.doFinal(index);
+        byte[] t = u.clone();
+        for (int j = 1; j < iterations; j++) {
+          byte[] next = mac.doFinal(u);
+          Arrays.fill(u, (byte) 0);
+          u = next;
+          for (int k = 0; k < u.length; k++) {
+            t[k] ^= u[k];
+          }
+        }
+        System.arraycopy(t, 0, out, offset, blockSize);
+        offset += blockSize;
+        Arrays.fill(u, (byte) 0);
+        Arrays.fill(t, (byte) 0);
+      }
+      return Arrays.copyOf(out, length);
+    } finally {
+      Arrays.fill(out, (byte) 0);
+      Arrays.fill(index, (byte) 0);
+      Arrays.fill(password, (byte) 0);
+    }
+  }
+}

package/android/src/main/java/com/margelo/nitro/qntxwallet/Keystore.kt

@@ -0,0 +1,280 @@
+package com.margelo.nitro.qntxwallet
+
+import android.app.KeyguardManager
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.LocaleList
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyPermanentlyInvalidatedException
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import androidx.annotation.Keep
+import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
+import androidx.biometric.BiometricManager.Authenticators.DEVICE_CREDENTIAL
+import androidx.biometric.BiometricPrompt
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.FragmentActivity
+import androidx.lifecycle.DefaultLifecycleObserver
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.LifecycleOwner
+import com.facebook.proguard.annotations.DoNotStrip
+import com.margelo.nitro.NitroModules
+import java.security.KeyStore
+import java.util.concurrent.Executor
+import java.security.UnrecoverableKeyException
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+/**
+ * Android keystore (W5): one AndroidKeyStore AES-256-GCM key per vault factor
+ * (`qntx-wallet.vault.<factor id>`), StrongBox-backed when present. Every use
+ * needs a fresh BiometricPrompt (strong biometric or device credential) bound
+ * to the cipher through a CryptoObject; the key survives biometric enrollment
+ * changes and dies with the lock screen. The C++ host calls these entry points
+ * with a completion token and receives the result through [nativeComplete].
+ * Sealed bytes are `iv(12) ‖ ciphertext ‖ tag(16)`.
+ */
+@DoNotStrip
+@Keep
+object Keystore {
+  private const val PREFIX = "qntx-wallet.vault."
+  private const val PROVIDER = "AndroidKeyStore"
+  private const val TRANSFORMATION = "AES/GCM/NoPadding"
+  private const val IV_BYTES = 12
+  private const val TAG_BITS = 128
+
+  // Status codes shared with KeystoreAndroid.cpp.
+  private const val OK = 0
+  private const val CANCELLED = 1
+  private const val INVALIDATED = 2
+  private const val UNAVAILABLE = 3
+  private const val FAILED = 4
+
+  @Volatile private var current: BiometricPrompt? = null
+
+  @JvmStatic
+  fun locale(): String = LocaleList.getDefault()[0]?.toLanguageTag() ?: "en"
+
+  @JvmStatic
+  fun seal(token: Long, id: String, secret: ByteArray, title: String, description: String) {
+    val activity = foregroundActivity()
+    if (activity == null || !deviceSecure(activity)) {
+      secret.fill(0)
+      return nativeComplete(token, UNAVAILABLE, null)
+    }
+    val alias = PREFIX + id
+    val cipher = try {
+      keyStore().deleteEntry(alias)
+      Cipher.getInstance(TRANSFORMATION).apply { init(Cipher.ENCRYPT_MODE, generate(alias, activity)) }
+    } catch (e: Exception) {
+      secret.fill(0)
+      return nativeComplete(token, UNAVAILABLE, null)
+    }
+    prompt(activity, title, description, BiometricPrompt.CryptoObject(cipher)) { status, crypto ->
+      try {
+        val authenticated = crypto?.cipher
+        if (status != OK || authenticated == null) {
+          keyStore().deleteEntry(alias)
+          nativeComplete(token, if (status == OK) FAILED else status, null)
+        } else {
+          nativeComplete(token, OK, authenticated.iv + authenticated.doFinal(secret))
+        }
+      } catch (e: Exception) {
+        keyStore().deleteEntry(alias)
+        nativeComplete(token, FAILED, null)
+      } finally {
+        secret.fill(0)
+      }
+    }
+  }
+
+  @JvmStatic
+  fun open(token: Long, id: String, sealed: ByteArray, title: String, description: String) {
+    val activity = foregroundActivity() ?: return nativeComplete(token, UNAVAILABLE, null)
+    if (sealed.size <= IV_BYTES + TAG_BITS / 8) {
+      return nativeComplete(token, FAILED, null)
+    }
+    val alias = PREFIX + id
+    val key = try {
+      keyStore().getKey(alias, null) as? SecretKey
+    } catch (e: UnrecoverableKeyException) {
+      null
+    } ?: return nativeComplete(token, INVALIDATED, null)
+    val cipher = try {
+      Cipher.getInstance(TRANSFORMATION).apply {
+        init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(TAG_BITS, sealed, 0, IV_BYTES))
+      }
+    } catch (e: KeyPermanentlyInvalidatedException) {
+      keyStore().deleteEntry(alias)
+      return nativeComplete(token, INVALIDATED, null)
+    } catch (e: Exception) {
+      return nativeComplete(token, FAILED, null)
+    }
+    prompt(activity, title, description, BiometricPrompt.CryptoObject(cipher)) { status, crypto ->
+      val authenticated = crypto?.cipher
+      if (status != OK || authenticated == null) {
+        nativeComplete(token, if (status == OK) FAILED else status, null)
+        return@prompt
+      }
+      val plain = try {
+        authenticated.doFinal(sealed, IV_BYTES, sealed.size - IV_BYTES)
+      } catch (e: Exception) {
+        return@prompt nativeComplete(token, FAILED, null)
+      }
+      try {
+        nativeComplete(token, OK, plain)
+      } finally {
+        plain.fill(0)
+      }
+    }
+  }
+
+  @JvmStatic
+  fun authenticate(token: Long, title: String, description: String) {
+    val activity = foregroundActivity()
+    if (activity == null || !deviceSecure(activity)) {
+      return nativeComplete(token, UNAVAILABLE, null)
+    }
+    prompt(activity, title, description, null) { status, _ -> nativeComplete(token, status, null) }
+  }
+
+  @JvmStatic
+  fun clear(token: Long) {
+    val status = try {
+      val store = keyStore()
+      store.aliases().toList().filter { it.startsWith(PREFIX) }.forEach(store::deleteEntry)
+      OK
+    } catch (e: Exception) {
+      FAILED
+    }
+    nativeComplete(token, status, null)
+  }
+
+  @JvmStatic
+  fun cancel() {
+    val activity = foregroundActivity() ?: return
+    ContextCompat.getMainExecutor(activity).execute { current?.cancelAuthentication() }
+  }
+
+  private fun foregroundActivity(): FragmentActivity? =
+    NitroModules.applicationContext?.currentActivity as? FragmentActivity
+
+  private fun deviceSecure(context: Context): Boolean =
+    context.getSystemService(KeyguardManager::class.java)?.isDeviceSecure == true
+
+  private fun keyStore(): KeyStore = KeyStore.getInstance(PROVIDER).apply { load(null) }
+
+  private fun generate(alias: String, context: Context): SecretKey {
+    val strongBox = context.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
+    return try {
+      generate(alias, strongBox)
+    } catch (e: StrongBoxUnavailableException) {
+      generate(alias, false)
+    }
+  }
+
+  private fun generate(alias: String, strongBox: Boolean): SecretKey {
+    val spec = KeyGenParameterSpec.Builder(
+      alias,
+      KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+    )
+      .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+      .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+      .setKeySize(256)
+      .setUserAuthenticationRequired(true)
+      .setUserAuthenticationParameters(
+        0,
+        KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL,
+      )
+      .setUnlockedDeviceRequired(true)
+      .setInvalidatedByBiometricEnrollment(false)
+      .setIsStrongBoxBacked(strongBox)
+      .build()
+    return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, PROVIDER)
+      .apply { init(spec) }
+      .generateKey()
+  }
+
+  /** Shows one system verification on the main thread; [done] runs there with the outcome. */
+  private fun prompt(
+    activity: FragmentActivity,
+    title: String,
+    description: String,
+    crypto: BiometricPrompt.CryptoObject?,
+    done: (Int, BiometricPrompt.CryptoObject?) -> Unit,
+  ) {
+    val executor = ContextCompat.getMainExecutor(activity)
+    executor.execute { whenResumed(activity) { show(activity, executor, title, description, crypto, done) } }
+  }
+
+  // A prompt started while the activity is not resumed — e.g. right after a
+  // Credential Manager sheet finishes and before our activity is back on top —
+  // is cancelled by the framework at once. Start it on the next ON_RESUME.
+  private fun whenResumed(activity: FragmentActivity, action: () -> Unit) {
+    val lifecycle = activity.lifecycle
+    if (lifecycle.currentState.isAtLeast(Lifecycle.State.RESUMED)) {
+      action()
+      return
+    }
+    lifecycle.addObserver(object : DefaultLifecycleObserver {
+      override fun onResume(owner: LifecycleOwner) {
+        lifecycle.removeObserver(this)
+        action()
+      }
+    })
+  }
+
+  private fun show(
+    activity: FragmentActivity,
+    executor: Executor,
+    title: String,
+    description: String,
+    crypto: BiometricPrompt.CryptoObject?,
+    done: (Int, BiometricPrompt.CryptoObject?) -> Unit,
+  ) {
+    val info = BiometricPrompt.PromptInfo.Builder()
+      .setTitle(title)
+      .setDescription(description)
+      .setAllowedAuthenticators(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)
+      .build()
+    val biometricPrompt = BiometricPrompt(
+      activity,
+      executor,
+      object : BiometricPrompt.AuthenticationCallback() {
+        override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+          current = null
+          done(OK, result.cryptoObject)
+        }
+
+        override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+          current = null
+          done(statusOf(errorCode), null)
+        }
+      },
+    )
+    current = biometricPrompt
+    try {
+      if (crypto == null) biometricPrompt.authenticate(info) else biometricPrompt.authenticate(info, crypto)
+    } catch (e: Exception) {
+      current = null
+      done(FAILED, null)
+    }
+  }
+
+  private fun statusOf(errorCode: Int): Int = when (errorCode) {
+    BiometricPrompt.ERROR_USER_CANCELED,
+    BiometricPrompt.ERROR_NEGATIVE_BUTTON,
+    BiometricPrompt.ERROR_CANCELED,
+    BiometricPrompt.ERROR_TIMEOUT -> CANCELLED
+    BiometricPrompt.ERROR_NO_DEVICE_CREDENTIAL,
+    BiometricPrompt.ERROR_HW_UNAVAILABLE,
+    BiometricPrompt.ERROR_HW_NOT_PRESENT,
+    BiometricPrompt.ERROR_NO_BIOMETRICS -> UNAVAILABLE
+    else -> FAILED
+  }
+
+  @JvmStatic
+  private external fun nativeComplete(token: Long, status: Int, bytes: ByteArray?)
+}