@qntx/wallet-native 0.0.0-stage → 0.5.2

package/android/src/main/java/com/margelo/nitro/qntxwallet/Passkey.kt

@@ -0,0 +1,147 @@
+package com.margelo.nitro.qntxwallet
+
+import android.os.CancellationSignal
+import android.util.Log
+import androidx.annotation.Keep
+import androidx.core.content.ContextCompat
+import androidx.credentials.CreateCredentialResponse
+import androidx.credentials.CreatePublicKeyCredentialRequest
+import androidx.credentials.CreatePublicKeyCredentialResponse
+import androidx.credentials.CredentialManager
+import androidx.credentials.CredentialManagerCallback
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.GetCredentialResponse
+import androidx.credentials.GetPublicKeyCredentialOption
+import androidx.credentials.PublicKeyCredential
+import androidx.credentials.exceptions.CreateCredentialCancellationException
+import androidx.credentials.exceptions.CreateCredentialException
+import androidx.credentials.exceptions.CreateCredentialNoCreateOptionException
+import androidx.credentials.exceptions.CreateCredentialProviderConfigurationException
+import androidx.credentials.exceptions.CreateCredentialUnsupportedException
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+import androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException
+import androidx.credentials.exceptions.publickeycredential.GetPublicKeyCredentialDomException
+import androidx.fragment.app.FragmentActivity
+import com.facebook.proguard.annotations.DoNotStrip
+import com.margelo.nitro.NitroModules
+
+/**
+ * Android passkey authenticator (W6): Credential Manager with the kernel's
+ * WebAuthn JSON. Requests and responses stay JSON — the kernel builds the
+ * options (PRF eval included) and parses the response itself, so this object
+ * only runs the system ceremony. The C++ host calls [create] and [get] with a
+ * completion token and receives the outcome through [nativeComplete].
+ */
+@DoNotStrip
+@Keep
+object Passkey {
+  // Status codes shared with PasskeyAndroid.cpp.
+  private const val OK = 0
+  private const val CANCELLED = 1
+  private const val UNAVAILABLE = 3
+  private const val FAILED = 4
+  // The exception type only — never the message, which can name the account.
+  private const val TAG = "QntxPasskey"
+
+  @Volatile private var signal: CancellationSignal? = null
+
+  @JvmStatic
+  fun create(token: Long, requestJson: String) {
+    val activity = foregroundActivity() ?: return nativeComplete(token, UNAVAILABLE, null)
+    val cancel = CancellationSignal().also { signal = it }
+    CredentialManager.create(activity).createCredentialAsync(
+      activity,
+      CreatePublicKeyCredentialRequest(requestJson),
+      cancel,
+      ContextCompat.getMainExecutor(activity),
+      object : CredentialManagerCallback<CreateCredentialResponse, CreateCredentialException> {
+        override fun onResult(result: CreateCredentialResponse) {
+          signal = null
+          val response = result as? CreatePublicKeyCredentialResponse
+          nativeComplete(
+            token,
+            if (response == null) FAILED else OK,
+            response?.registrationResponseJson,
+          )
+        }
+
+        override fun onError(e: CreateCredentialException) {
+          signal = null
+          Log.w(TAG, "create failed: ${e.type}")
+          nativeComplete(token, statusOf(e), null)
+        }
+      },
+    )
+  }
+
+  @JvmStatic
+  fun get(token: Long, requestJson: String) {
+    val activity = foregroundActivity() ?: return nativeComplete(token, UNAVAILABLE, null)
+    val cancel = CancellationSignal().also { signal = it }
+    CredentialManager.create(activity).getCredentialAsync(
+      activity,
+      GetCredentialRequest(listOf(GetPublicKeyCredentialOption(requestJson))),
+      cancel,
+      ContextCompat.getMainExecutor(activity),
+      object : CredentialManagerCallback<GetCredentialResponse, GetCredentialException> {
+        override fun onResult(result: GetCredentialResponse) {
+          signal = null
+          val credential = result.credential as? PublicKeyCredential
+          nativeComplete(
+            token,
+            if (credential == null) FAILED else OK,
+            credential?.authenticationResponseJson,
+          )
+        }
+
+        override fun onError(e: GetCredentialException) {
+          signal = null
+          Log.w(TAG, "get failed: ${e.type}")
+          nativeComplete(token, statusOf(e), null)
+        }
+      },
+    )
+  }
+
+  @JvmStatic
+  fun cancel() {
+    signal?.cancel()
+  }
+
+  private fun foregroundActivity(): FragmentActivity? =
+    NitroModules.applicationContext?.currentActivity as? FragmentActivity
+
+  // NotAllowedError is what the platform reports when the user dismisses or
+  // times out the sheet; SecurityError means the RP id is not associated
+  // with this app (assetlinks), i.e. passkeys are unavailable here.
+  private fun statusOf(e: CreateCredentialException): Int = when (e) {
+    is CreateCredentialCancellationException -> CANCELLED
+    is CreateCredentialNoCreateOptionException,
+    is CreateCredentialProviderConfigurationException,
+    is CreateCredentialUnsupportedException -> UNAVAILABLE
+    is CreatePublicKeyCredentialDomException -> domStatus(e.type)
+    else -> FAILED
+  }
+
+  private fun statusOf(e: GetCredentialException): Int = when (e) {
+    is GetCredentialCancellationException -> CANCELLED
+    is NoCredentialException,
+    is GetCredentialProviderConfigurationException,
+    is GetCredentialUnsupportedException -> UNAVAILABLE
+    is GetPublicKeyCredentialDomException -> domStatus(e.type)
+    else -> FAILED
+  }
+
+  private fun domStatus(type: String): Int = when {
+    type.endsWith("NotAllowedError") -> CANCELLED
+    type.endsWith("SecurityError") || type.endsWith("NotSupportedError") -> UNAVAILABLE
+    else -> FAILED
+  }
+
+  @JvmStatic
+  private external fun nativeComplete(token: Long, status: Int, responseJson: String?)
+}

package/android/src/main/java/com/margelo/nitro/qntxwallet/VaultDirectory.kt

@@ -0,0 +1,28 @@
+package com.margelo.nitro.qntxwallet
+
+import androidx.annotation.Keep
+import com.facebook.proguard.annotations.DoNotStrip
+import com.margelo.nitro.NitroModules
+import java.io.File
+
+/**
+ * Vault directory hook: `<noBackupFilesDir>/qntx-wallet`, pulled from C++
+ * through fbjni — `noBackupFilesDir` needs a Context, which Nitro hands us once
+ * its TurboModule is constructed (before any `createHybridObject("KernelHost")`).
+ */
+object VaultDirectory {
+  @JvmStatic
+  @DoNotStrip
+  @Keep
+  fun resolve(): String {
+    val context = NitroModules.applicationContext
+        ?: throw IllegalStateException(
+            "vault directory: NitroModules.applicationContext is not set")
+    val dir = File(context.noBackupFilesDir, "qntx-wallet")
+    dir.mkdirs()
+    if (!dir.isDirectory) {
+      throw IllegalStateException("vault directory: mkdirs failed")
+    }
+    return dir.absolutePath
+  }
+}

package/android/src/main/java/com/margelo/nitro/qntxwallet/WalletNativePackage.java

@@ -0,0 +1,30 @@
+package com.margelo.nitro.qntxwallet;
+
+import androidx.annotation.Nullable;
+
+import com.facebook.react.bridge.NativeModule;
+import com.facebook.react.bridge.ReactApplicationContext;
+import com.facebook.react.module.model.ReactModuleInfoProvider;
+import com.facebook.react.BaseReactPackage;
+
+import java.util.HashMap;
+
+public class WalletNativePackage extends BaseReactPackage {
+  @Nullable
+  @Override
+  public NativeModule getModule(String name, ReactApplicationContext reactContext) {
+    return null;
+  }
+
+  @Override
+  public ReactModuleInfoProvider getReactModuleInfoProvider() {
+    return () -> {
+        return new HashMap<>();
+    };
+  }
+
+  static {
+    WalletNativeOnLoad.initializeNative();
+  }
+
+}

package/cpp/host/HybridKernelHost.cpp

@@ -0,0 +1,162 @@
+#include "HybridKernelHost.hpp"
+
+#include "kernel.hpp"
+#include "VaultDirectory.hpp"
+
+#if defined(__ANDROID__)
+#include <android/log.h>
+#elif defined(__APPLE__)
+#include <os/log.h>
+#endif
+
+namespace margelo::nitro::qntxwallet {
+
+namespace {
+
+// A kernel crash reaches JS only as "crashed"; the reason goes to the system
+// log so field reports and device runs can tell causes apart. Kernel error
+// messages are static strings that never echo input or secrets.
+void logKernelCrash(const std::string& reason) {
+#if defined(__ANDROID__)
+  __android_log_print(ANDROID_LOG_ERROR, "QntxKernel", "kernel runtime crashed: %s", reason.c_str());
+#elif defined(__APPLE__)
+  os_log_error(OS_LOG_DEFAULT, "qntx kernel runtime crashed: %{public}s", reason.c_str());
+#else
+  (void)reason;
+#endif
+}
+
+} // namespace
+
+HybridKernelHost::~HybridKernelHost() {
+  std::shared_ptr<qntx::KernelRuntime> runtime;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    runtime = std::move(runtime_);
+  }
+  if (runtime) {
+    runtime->destroy();
+  }
+}
+
+void HybridKernelHost::start(double backgroundLockSeconds) {
+  // Compare as doubles before converting: casting NaN or an out-of-range value
+  // to int is undefined behaviour.
+  if (backgroundLockSeconds != 0 && backgroundLockSeconds != 60 &&
+      backgroundLockSeconds != 300 && backgroundLockSeconds != 900) {
+    throw std::runtime_error("backgroundLockSeconds must be one of 0, 60, 300, 900");
+  }
+  const int seconds = static_cast<int>(backgroundLockSeconds);
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (runtime_ || exited_) {
+      return;
+    }
+  }
+  // The platform observer installs once; this host registers its deadline so
+  // the dispatcher can stamp or lock it on background/foreground transitions.
+  qntx::installLifecycleObserver();
+  qntx::KernelLifecycleDispatcher::shared().registerHost(
+      std::dynamic_pointer_cast<HybridKernelHost>(shared_from_this()), seconds);
+  // Resolved once here: a platform failure rejects start() for the JS caller
+  // instead of surfacing later as a store error inside the kernel.
+  const std::string vaultDirectory = qntx::platformVaultDirectory();
+
+  std::weak_ptr<HybridKernelHost> weak =
+      std::dynamic_pointer_cast<HybridKernelHost>(shared_from_this());
+  qntx::KernelRuntime::Hooks hooks;
+  hooks.onPost = [weak](std::vector<uint8_t> bytes) {
+    if (const auto self = weak.lock()) {
+      std::function<void(const std::shared_ptr<ArrayBuffer>&)> listener;
+      {
+        std::lock_guard<std::mutex> lock(self->mutex_);
+        listener = self->messageListener_;
+      }
+      if (listener) {
+        listener(ArrayBuffer::copy(bytes.data(), bytes.size()));
+      }
+    }
+  };
+  hooks.onError = [weak](std::string reason) {
+    logKernelCrash(reason);
+    if (const auto self = weak.lock()) {
+      self->exit(KernelExitReason::CRASHED);
+    }
+  };
+  hooks.onIntegrity = [weak] {
+    if (const auto self = weak.lock()) {
+      self->exit(KernelExitReason::INTEGRITY);
+    }
+  };
+
+  const auto script = qntx::KernelScript{
+      qntx::KernelScript::Kind::bytecode,
+      std::make_shared<const std::vector<uint8_t>>(
+          qntx::KERNEL_BYTECODE, qntx::KERNEL_BYTECODE + qntx::KERNEL_BYTECODE_SIZE)};
+  const auto runtime =
+      qntx::KernelRuntime::start(script, std::move(hooks), vaultDirectory);
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (exited_) {
+      // An exit (integrity hash check raced a lock) already fired — drop the
+      // fresh runtime instead of resurrecting a dead host.
+      runtime->destroy();
+      return;
+    }
+    runtime_ = runtime;
+  }
+}
+
+void HybridKernelHost::post(const std::shared_ptr<ArrayBuffer>& frame) {
+  if (frame->size() > kMaxFrameBytes) {
+    exit(KernelExitReason::INTEGRITY);
+    return;
+  }
+  std::shared_ptr<qntx::KernelRuntime> runtime;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    runtime = runtime_;
+  }
+  if (runtime) {
+    const auto* data = static_cast<const uint8_t*>(frame->data());
+    runtime->post(std::vector<uint8_t>(data, data + frame->size()));
+  }
+}
+
+void HybridKernelHost::onMessage(
+    const std::function<void(const std::shared_ptr<ArrayBuffer>&)>& listener) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  messageListener_ = listener;
+}
+
+void HybridKernelHost::onExit(const std::function<void(KernelExitReason)>& listener) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  exitListener_ = listener;
+}
+
+void HybridKernelHost::lock() {
+  exit(KernelExitReason::LOCKED);
+}
+
+void HybridKernelHost::exit(KernelExitReason reason) {
+  std::shared_ptr<qntx::KernelRuntime> runtime;
+  std::function<void(KernelExitReason)> listener;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (exited_) {
+      return;
+    }
+    exited_ = true;
+    runtime = std::move(runtime_);
+    listener = exitListener_;
+  }
+  if (runtime) {
+    runtime->destroy();
+  }
+  qntx::KernelLifecycleDispatcher::shared().unregister(this);
+  if (listener) {
+    listener(reason);
+  }
+}
+
+} // namespace margelo::nitro::qntxwallet

package/cpp/host/HybridKernelHost.hpp

@@ -0,0 +1,49 @@
+#pragma once
+
+#include "HybridKernelHostSpec.hpp"
+
+#include <functional>
+#include <memory>
+#include <mutex>
+
+#include "host/Lifecycle.hpp"
+
+#include "../runtime/KernelRuntime.hpp"
+
+namespace margelo::nitro::qntxwallet {
+
+// The only Nitro-registered object: drives one kernel runtime. `start`
+// verifies the embedded bytecode's SHA-256 before loading; `post` enforces the
+// 1 MiB frame cap (the inbound queue cap lives inside KernelRuntime::post and
+// reports through the same integrity exit); `lock` destroys the runtime. Exit
+// reasons reach JS through the `onExit` listener, at most once.
+class HybridKernelHost final : public HybridKernelHostSpec,
+                               public qntx::LifecycleLockTarget {
+ public:
+  HybridKernelHost() : HybridObject(TAG) {}
+  ~HybridKernelHost() override;
+
+  void start(double backgroundLockSeconds) override;
+  // The platform's lifecycle dispatcher locks through here (main thread).
+  void lockForBackground() override { exit(KernelExitReason::BACKGROUND); }
+  void post(const std::shared_ptr<ArrayBuffer>& frame) override;
+  void onMessage(const std::function<void(const std::shared_ptr<ArrayBuffer>&)>& listener)
+      override;
+  void onExit(const std::function<void(KernelExitReason)>& listener) override;
+  void lock() override;
+
+ private:
+  static constexpr size_t kMaxFrameBytes = 1024 * 1024;
+
+  // Reports `reason` through onExit once, then tears the runtime down unless
+  // the exit was itself the lock report (the runtime is already gone).
+  void exit(KernelExitReason reason);
+
+  std::mutex mutex_;
+  std::shared_ptr<qntx::KernelRuntime> runtime_;
+  std::function<void(const std::shared_ptr<ArrayBuffer>&)> messageListener_;
+  std::function<void(KernelExitReason)> exitListener_;
+  bool exited_ = false;
+};
+
+} // namespace margelo::nitro::qntxwallet

package/cpp/host/KernelFile.cpp

@@ -0,0 +1,120 @@
+#include "KernelFile.hpp"
+
+#include <cerrno>
+#include <cstring>
+#include <stdexcept>
+
+#if defined(_WIN32)
+#error "KernelFile has no Windows implementation"
+#else
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif
+
+namespace qntx {
+namespace {
+
+[[noreturn]] void fail(const char* what) {
+  const int saved = errno;
+  throw std::runtime_error(
+      std::string(what) + ": " + std::strerror(saved) + " (errno " + std::to_string(saved) + ")");
+}
+
+void fsyncOrFail(int fd, const char* what, bool full = false) {
+  // Files: on Apple the documented durable barrier is fcntl(F_FULLFSYNC).
+  // Directories: plain fsync everywhere (F_FULLFSYNC is for files only).
+  const int rc =
+#if defined(__APPLE__)
+      full ? ::fcntl(fd, F_FULLFSYNC) : ::fsync(fd);
+#else
+      (::fsync(fd));
+#endif
+  if (rc != 0) {
+    fail(what);
+  }
+}
+
+std::string pathFor(const std::string& directory, const char* leaf) {
+  return directory + "/" + leaf;
+}
+
+} // namespace
+
+std::optional<std::vector<uint8_t>> kernelFileRead(const std::string& directory) {
+  const std::string path = pathFor(directory, "vault.cbor");
+  const int fd = ::open(path.c_str(), O_RDONLY);
+  if (fd < 0) {
+    if (errno == ENOENT) {
+      return std::nullopt;
+    }
+    fail("open vault file");
+  }
+  std::vector<uint8_t> bytes;
+  uint8_t chunk[65536];
+  for (;;) {
+    const ssize_t n = ::read(fd, chunk, sizeof(chunk));
+    if (n < 0) {
+      const int saved = errno;
+      ::close(fd);
+      errno = saved;
+      fail("read vault file");
+    }
+    if (n == 0) {
+      break;
+    }
+    bytes.insert(bytes.end(), chunk, chunk + n);
+  }
+  ::close(fd);
+  return bytes;
+}
+
+void kernelFileWrite(const std::string& directory, const std::vector<uint8_t>& bytes) {
+  const std::string tmp = pathFor(directory, "vault.cbor.tmp");
+  const std::string final = pathFor(directory, "vault.cbor");
+  const int fd = ::open(tmp.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  if (fd < 0) {
+    fail("open temp vault file");
+  }
+  size_t off = 0;
+  while (off < bytes.size()) {
+    const ssize_t n = ::write(fd, bytes.data() + off, bytes.size() - off);
+    if (n <= 0) {
+      const int saved = errno;
+      ::close(fd);
+      ::unlink(tmp.c_str());
+      errno = saved;
+      fail("write temp vault file");
+    }
+    off += static_cast<size_t>(n);
+  }
+  try {
+    fsyncOrFail(fd, "fsync temp vault file", /*full=*/true);
+  } catch (...) {
+    ::close(fd);
+    ::unlink(tmp.c_str());
+    throw;
+  }
+  if (::close(fd) != 0) {
+    ::unlink(tmp.c_str());
+    fail("close temp vault file");
+  }
+  if (::rename(tmp.c_str(), final.c_str()) != 0) {
+    ::unlink(tmp.c_str());
+    fail("rename vault file");
+  }
+  const int dirFd = ::open(directory.c_str(), O_RDONLY);
+  if (dirFd < 0) {
+    fail("open vault directory");
+  }
+  try {
+    fsyncOrFail(dirFd, "fsync vault directory");
+  } catch (...) {
+    ::close(dirFd);
+    throw;
+  }
+  ::close(dirFd);
+}
+
+} // namespace qntx

package/cpp/host/KernelFile.hpp

@@ -0,0 +1,24 @@
+#pragma once
+
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace qntx {
+
+// The vault image file lives in a platform-provided directory
+// (platformVaultDirectory()): <directory>/vault.cbor.
+//
+// The whole file, or nullopt when it does not exist. Throws std::runtime_error
+// naming the failing step and errno — the file store turns that into a typed
+// rejection and never silently treats it as an empty vault.
+std::optional<std::vector<uint8_t>> kernelFileRead(const std::string& directory);
+
+// Atomic replace of vault.cbor in `directory`: write vault.cbor.tmp in the
+// same directory, fsync it, rename it over the target, then fsync the
+// directory so the rename itself is durable. Throws std::runtime_error naming
+// the failing step and errno; a failed write leaves the previous file intact
+// and unlinks the temp file.
+void kernelFileWrite(const std::string& directory, const std::vector<uint8_t>& bytes);
+
+} // namespace qntx

package/cpp/host/Keystore.hpp

@@ -0,0 +1,70 @@
+#pragma once
+
+#include <functional>
+#include <string>
+#include <vector>
+
+#include "../runtime/KernelBuffer.hpp"
+
+namespace qntx {
+
+// The platform keystore behind `__qntx.keystore` (W5): a hardware key per
+// vault factor that seals and opens the factor's KEK behind a system user
+// verification. iOS: Secure Enclave P-256 + ECIES; Android: Keystore
+// AES-256-GCM behind BiometricPrompt. Each function has exactly one strong
+// definition per platform (KeystoreIos.mm, KeystoreAndroid.cpp); host tests
+// link a fake.
+
+struct KeystorePrompt {
+  std::string title;
+  std::string description;
+};
+
+// How a keystore call ended. The binding maps each status to the kernel's
+// error code: cancelled → "cancelled", invalidated → "factor-invalidated",
+// unavailable → "factor-unavailable", failed → "unavailable". The values are
+// part of the Android JNI contract (Keystore.kt).
+enum class KeystoreStatus { ok = 0, cancelled = 1, invalidated = 2, unavailable = 3, failed = 4 };
+
+struct KeystoreResult {
+  KeystoreStatus status = KeystoreStatus::failed;
+  // seal: the platform ciphertext; open: the KEK; empty otherwise.
+  SecretBytes bytes;
+};
+
+// Completion callbacks run exactly once, on any thread.
+using KeystoreDone = std::function<void(KeystoreResult)>;
+
+// Creates the hardware key for vault factor `id` and encrypts `secret` under
+// it. Android prompts (encryption needs the authenticated cipher); iOS does
+// not (ECIES encrypts with the public key).
+void keystoreSeal(
+    const std::string& id,
+    SecretBytes secret,
+    KeystorePrompt prompt,
+    KeystoreDone done);
+
+// Decrypts `sealed` with factor `id`'s key after a fresh system verification
+// that shows `prompt`. A key the system removed (lock screen disabled,
+// device restored) completes `invalidated`.
+void keystoreOpen(
+    const std::string& id,
+    std::vector<uint8_t> sealed,
+    KeystorePrompt prompt,
+    KeystoreDone done);
+
+// A device-owner check with no key involved (vault reset, WD-055).
+void keystoreAuthenticate(KeystorePrompt prompt, KeystoreDone done);
+
+// Deletes every vault key this app created.
+void keystoreClear(KeystoreDone done);
+
+// Dismisses the system prompt of an in-flight call, if any; that call still
+// completes (normally `cancelled`). Called when a kernel runtime tears down.
+void keystoreCancel();
+
+// The platform's preferred language as a BCP 47 tag, read natively so the
+// main runtime cannot choose the prompt language.
+std::string keystoreLocale();
+
+} // namespace qntx