@rakomi/react-native 0.0.0 → 0.2.0

package/dist/native/index.cjs

@@ -0,0 +1,646 @@
+'use strict';
+
+var sdkCore = require('@rakomi/sdk-core');
+
+// src/native/bare-rn-example.ts
+function createBareRnAdapter(options) {
+  const servicePrefix = options.keychainServicePrefix ?? "rakomi";
+  const crypto = {
+    getRandomBytes: async (length) => new Uint8Array(options.quickCrypto.randomBytes(length)),
+    digestSha256: async (input) => new Uint8Array(options.quickCrypto.createHash("sha256").update(input).digest())
+  };
+  const storage = {
+    getItem: async (key, opts) => {
+      const result = await options.keychain.getGenericPassword({
+        service: `${servicePrefix}.${key}`,
+        ...opts?.requireAuthentication ? { authenticationPrompt: { title: opts.authenticationPrompt ?? "Authenticate" } } : {}
+      });
+      return result ? result.password : null;
+    },
+    setItem: async (key, value, opts) => {
+      await options.keychain.setGenericPassword("rakomi", value, {
+        service: `${servicePrefix}.${key}`,
+        accessible: opts?.keychainAccessible ?? "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY"
+      });
+    },
+    removeItem: async (key) => {
+      await options.keychain.resetGenericPassword({ service: `${servicePrefix}.${key}` });
+    }
+  };
+  const browser = {
+    openAuthSession: async (authUrl, redirectUri, opts) => {
+      const available = await options.inAppBrowser.isAvailable();
+      if (!available) return { type: "locked" };
+      const result = await options.inAppBrowser.openAuth(authUrl, redirectUri, {
+        ephemeralWebSession: opts?.preferEphemeralSession ?? true
+      });
+      if (result.type === "success" && result.url) return { type: "success", url: result.url };
+      if (result.type === "cancel") return { type: "cancel" };
+      return { type: "dismiss" };
+    }
+  };
+  const deepLink = {
+    getInitialUrl: () => options.linking.getInitialURL(),
+    addListener: (listener) => options.linking.addEventListener("url", (e) => listener(e.url))
+  };
+  const biometric = {
+    isAvailable: async () => {
+      const sensor = await options.biometrics.isSensorAvailable();
+      return sensor.available;
+    },
+    authenticate: async ({ promptMessage }) => {
+      const result = await options.biometrics.simplePrompt({ promptMessage });
+      if (result.success) return { success: true };
+      return { success: false, reason: "cancelled" };
+    }
+  };
+  const appLifecycle = {
+    addStateChangeListener: (listener) => options.appState.addEventListener("change", listener),
+    getCurrent: () => options.appState.currentState
+  };
+  const connectivity = {
+    isConnected: async () => {
+      const state = await options.netInfo.fetch();
+      return state.isConnected === true;
+    },
+    addListener: (listener) => {
+      const unsub = options.netInfo.addEventListener((state) => listener(state.isConnected === true));
+      return { remove: unsub };
+    }
+  };
+  return {
+    crypto,
+    storage,
+    browser,
+    deepLink,
+    biometric,
+    appLifecycle,
+    connectivity
+  };
+}
+
+// src/native/dpop-prover.ts
+function createNativeDpopProver(options) {
+  const mod = options.module;
+  return {
+    async createProof(input) {
+      const proof = await mod.createDpopProof(input.htm, input.htu, input.nonce ?? null);
+      if (typeof proof !== "string" || proof.length === 0) {
+        throw new Error("native DPoP signer returned an empty proof");
+      }
+      return proof;
+    },
+    async jktHint() {
+      return mod.dpopJktThumbprint();
+    }
+  };
+}
+
+// src/native/expo-adapter.ts
+function createDefaultExpoAdapter(options = {}) {
+  const crypto = createExpoCrypto();
+  const storage = createExpoSecureStore({ tokenCache: options.tokenCache });
+  const browser = createExpoBrowser();
+  const deepLink = createExpoDeepLink();
+  const biometric = createExpoBiometricGate();
+  const appLifecycle = createRnAppLifecycle();
+  const connectivity = createNetInfoConnectivity();
+  return {
+    crypto,
+    storage,
+    browser,
+    deepLink,
+    biometric,
+    appLifecycle,
+    connectivity
+  };
+}
+function createExpoCrypto() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-crypto').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-crypto is required for the default adapter. Install it (Expo-managed) or pass a custom nativeAdapter (bare RN)."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getRandomBytes: async (n) => {
+      const m = await load();
+      const result = await m.getRandomBytesAsync(n);
+      return new Uint8Array(result);
+    },
+    digestSha256: async (input) => {
+      const m = await load();
+      let str = "";
+      for (let i = 0; i < input.length; i++) str += String.fromCharCode(input[i]);
+      const hex = await m.digestStringAsync(
+        m.CryptoDigestAlgorithm.SHA256,
+        str,
+        { encoding: m.CryptoEncoding.HEX }
+      );
+      const bytes = new Uint8Array(hex.length / 2);
+      for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      }
+      return bytes;
+    }
+  };
+}
+function createExpoSecureStore(opts) {
+  if (opts.tokenCache) {
+    const tc = opts.tokenCache;
+    return {
+      getItem: (key) => tc.getToken(key),
+      setItem: async (key, value) => {
+        await tc.saveToken(key, value);
+      },
+      removeItem: (key) => tc.clearToken(key)
+    };
+  }
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-secure-store').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-secure-store is required for the default adapter. Install it (Expo-managed) or pass `tokenCache` / a custom nativeAdapter."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getItem: async (key, options) => {
+      const m = await load();
+      return m.getItemAsync(key, {
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    setItem: async (key, value, options) => {
+      const m = await load();
+      const accessibility = mapKeychainAccessible(
+        m,
+        options?.keychainAccessible ?? "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY"
+      );
+      await m.setItemAsync(key, value, {
+        keychainAccessible: accessibility,
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    removeItem: async (key) => {
+      const m = await load();
+      await m.deleteItemAsync(key);
+    }
+  };
+}
+function mapKeychainAccessible(m, level) {
+  switch (level) {
+    case "WHEN_UNLOCKED":
+      return m.WHEN_UNLOCKED;
+    case "AFTER_FIRST_UNLOCK":
+      return m.AFTER_FIRST_UNLOCK;
+    case "WHEN_UNLOCKED_THIS_DEVICE_ONLY":
+      return m.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+    case "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY":
+      return m.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY;
+    case "WHEN_PASSCODE_SET_THIS_DEVICE_ONLY":
+      return m.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY;
+  }
+}
+function createExpoBrowser() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-web-browser').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-web-browser is required for OAuth flows.");
+      }
+    }
+    return mod;
+  }
+  return {
+    openAuthSession: async (authUrl, redirectUri, options) => {
+      const m = await load();
+      const result = await m.openAuthSessionAsync(authUrl, redirectUri, {
+        preferEphemeralSession: options?.preferEphemeralSession ?? true
+      });
+      if (result.type === "success" && result.url) {
+        return { type: "success", url: result.url };
+      }
+      if (result.type === "cancel") return { type: "cancel" };
+      if (result.type === "dismiss") return { type: "dismiss" };
+      if (result.type === "locked") return { type: "locked" };
+      return { type: "cancel" };
+    }
+  };
+}
+function createExpoDeepLink() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-linking').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-linking is required for OAuth deep-link callback.");
+      }
+    }
+    return mod;
+  }
+  return {
+    getInitialUrl: async () => {
+      const m = await load();
+      return m.getInitialURL();
+    },
+    addListener: (listener) => {
+      let sub = null;
+      void load().then((m) => {
+        sub = m.addEventListener("url", (event) => listener(event.url));
+      });
+      return {
+        remove: () => {
+          sub?.remove();
+        }
+      };
+    }
+  };
+}
+function createExpoBiometricGate() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = await import('expo-local-authentication');
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isAvailable: async () => {
+      const m = await load();
+      if (!m) return false;
+      const has = await m.hasHardwareAsync();
+      if (!has) return false;
+      const enrolled = await m.isEnrolledAsync();
+      return enrolled;
+    },
+    authenticate: async ({ promptMessage, strict = false }) => {
+      const m = await load();
+      if (!m) return { success: false, reason: "unavailable" };
+      const result = await m.authenticateAsync({
+        promptMessage,
+        disableDeviceFallback: strict,
+        fallbackLabel: "Use passcode"
+      });
+      if (result.success) return { success: true };
+      switch (result.error) {
+        case "user_cancel":
+        case "system_cancel":
+        case "app_cancel":
+          return { success: false, reason: "cancelled" };
+        case "lockout":
+        case "lockout_permanent":
+          return { success: false, reason: "lockout" };
+        case "not_enrolled":
+          return { success: false, reason: "not_enrolled" };
+        case "not_available":
+        case "no_space":
+          return { success: false, reason: "unavailable" };
+        default:
+          return { success: false, reason: "unknown" };
+      }
+    }
+  };
+}
+function createRnAppLifecycle() {
+  let rn = null;
+  let pending = null;
+  async function ensure() {
+    if (rn) return rn;
+    if (!pending) {
+      pending = import('react-native').then((m) => {
+        rn = m.default ?? m;
+        return rn;
+      });
+    }
+    return pending;
+  }
+  void ensure().catch(() => void 0);
+  return {
+    addStateChangeListener: (listener) => {
+      let sub = null;
+      void ensure().then((r) => {
+        sub = r.AppState.addEventListener("change", (next) => {
+          listener(coerceAppState(next));
+        });
+      });
+      return { remove: () => sub?.remove() };
+    },
+    getCurrent: () => rn ? coerceAppState(rn.AppState.currentState) : "unknown"
+  };
+}
+function coerceAppState(value) {
+  if (value === "active" || value === "background" || value === "inactive") return value;
+  return "unknown";
+}
+function createNetInfoConnectivity() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = (await import('@react-native-community/netinfo')).default ?? null;
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isConnected: async () => {
+      const m = await load();
+      if (!m) return true;
+      const state = await m.fetch();
+      return state.isConnected ?? true;
+    },
+    addListener: (listener) => {
+      let unsubscribe = null;
+      void load().then((m) => {
+        if (!m) return;
+        unsubscribe = m.addEventListener((state) => listener(state.isConnected ?? true));
+      });
+      return { remove: () => unsubscribe?.() };
+    }
+  };
+}
+
+// src/native/passkey-envelope.ts
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var RULES = {
+  registration: {
+    required: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    base64url: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    requiredStringArray: ["response.transports"],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: [
+      "clientDataJSON",
+      "attestationObject",
+      "authenticatorData",
+      "publicKey",
+      "publicKeyAlgorithm"
+    ],
+    keepStringArrayInResponse: ["transports"]
+  },
+  assertion: {
+    required: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature"
+    ],
+    base64url: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature",
+      "response.userHandle"
+    ],
+    requiredStringArray: [],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: ["clientDataJSON", "authenticatorData", "signature", "userHandle"],
+    keepStringArrayInResponse: []
+  }
+};
+var CredentialEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialEnvelopeError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readPath(envelope, path) {
+  const dot = path.indexOf(".");
+  if (dot === -1) return envelope[path];
+  const parent = envelope[path.slice(0, dot)];
+  return isRecord(parent) ? parent[path.slice(dot + 1)] : void 0;
+}
+function assertW3cCredentialEnvelope(kind, parsed) {
+  if (!isRecord(parsed)) {
+    throw new CredentialEnvelopeError(
+      `the native module returned a ${parsed === null ? "null" : typeof parsed}; the contract is a JSON object`
+    );
+  }
+  if (parsed["type"] !== "public-key") {
+    throw new CredentialEnvelopeError(`'type' must be the string "public-key" (W3C WebAuthn L3)`);
+  }
+  if (!isRecord(parsed["response"])) {
+    throw new CredentialEnvelopeError(`'response' is missing or is not an object`);
+  }
+  const rule = RULES[kind];
+  for (const path of rule.required) {
+    const value = readPath(parsed, path);
+    if (typeof value !== "string" || value.length === 0) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be a non-empty string (W3C WebAuthn L3 JSON serialization)`
+      );
+    }
+  }
+  for (const path of rule.requiredStringArray) {
+    const value = readPath(parsed, path);
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an array of strings (W3C WebAuthn L3). The server stores it and replays it into allowCredentials \u2014 omitting it silently breaks cross-device sign-in later, on another device.`
+      );
+    }
+  }
+  for (const path of rule.requiredObject) {
+    const value = readPath(parsed, path);
+    if (!isRecord(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an object (an empty object is fine)`
+      );
+    }
+  }
+  for (const path of rule.base64url) {
+    const value = readPath(parsed, path);
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" || !BASE64URL.test(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is not unpadded base64url (RFC 4648 \xA75). On iOS, Data.base64EncodedString() emits standard base64 (RFC 4648 \xA74, with '+', '/' and '=' padding) \u2014 use the URL-safe, unpadded variant.`
+      );
+    }
+  }
+}
+function sanitizeCredentialEnvelope(kind, parsed) {
+  assertW3cCredentialEnvelope(kind, parsed);
+  const envelope = parsed;
+  const source = envelope["response"];
+  const rule = RULES[kind];
+  const response = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keepInResponse) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") response[key] = value;
+  }
+  for (const key of rule.keepStringArrayInResponse) {
+    const value = source[key];
+    if (Array.isArray(value)) response[key] = value.filter((entry) => typeof entry === "string");
+  }
+  const projected = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keep) {
+    const value = envelope[key];
+    if (value !== void 0) projected[key] = value;
+  }
+  projected["response"] = response;
+  return projected;
+}
+
+// src/native/passkey-adapter.ts
+var NATIVE_CODE_TO_KIND = Object.assign(/* @__PURE__ */ Object.create(null), {
+  PASSKEY_CANCELLED: "cancelled",
+  PASSKEY_UNSUPPORTED: "unsupported",
+  PASSKEY_NO_CREDENTIAL: "cancelled"
+});
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeNativeRejection(err) {
+  const code = isRecord2(err) ? err["code"] : void 0;
+  if (typeof code === "string") {
+    const kind = NATIVE_CODE_TO_KIND[code];
+    if (kind !== void 0) {
+      throw new sdkCore.PasskeyCeremonyError(kind);
+    }
+  }
+  throw err;
+}
+function assertNever(value) {
+  throw new sdkCore.PasskeyCeremonyError("failed", `unhandled ceremony-error kind: ${String(value)}`);
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "cancelled":
+      return "the user dismissed the passkey sheet";
+    case "unsupported":
+      return "this platform cannot run a passkey ceremony";
+    case "failed":
+      return "the passkey ceremony failed";
+    default:
+      return assertNever(kind);
+  }
+}
+function createNativePasskeyAdapter(options) {
+  const mod = options.module;
+  let inFlight = null;
+  const candidate = mod;
+  const missing = ["isPasskeySupported", "createPasskey", "getPasskey"].filter(
+    (method) => typeof candidate?.[method] !== "function"
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `native passkey module is missing: ${missing.join(", ")} \u2014 it does not satisfy NativePasskeyModuleSpec`
+    );
+  }
+  async function runCeremony(kind, requestJson, ceremonyOptions) {
+    const signal = ceremonyOptions?.signal;
+    if (signal?.aborted === true) {
+      throw new sdkCore.PasskeyCeremonyError("cancelled", describeKind("cancelled"));
+    }
+    const ticket = /* @__PURE__ */ Symbol("passkey-ceremony");
+    inFlight = ticket;
+    const onAbort = () => {
+      if (inFlight !== ticket) return;
+      try {
+        void Promise.resolve(mod.cancelPasskeyRequest?.()).catch(() => void 0);
+      } catch {
+      }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let raw;
+    try {
+      raw = await (kind === "registration" ? mod.createPasskey(requestJson) : mod.getPasskey(requestJson));
+    } catch (err) {
+      normalizeNativeRejection(err);
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+      if (inFlight === ticket) inFlight = null;
+    }
+    if (typeof raw !== "string") {
+      throw new CredentialEnvelopeError(
+        `the native module returned ${raw === null ? "null" : `a ${typeof raw}`}; the contract is a JSON string \u2014 wrap a module with an object API so it stringifies its argument and its result`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new CredentialEnvelopeError(
+        "the native module returned a string that is not valid JSON (a double-encoded response does this)"
+      );
+    }
+    return sanitizeCredentialEnvelope(kind, parsed);
+  }
+  async function ceremonyOrMalformed(kind, requestJson, ceremonyOptions) {
+    try {
+      return await runCeremony(kind, requestJson, ceremonyOptions);
+    } catch (err) {
+      if (err instanceof CredentialEnvelopeError) {
+        return { rakomiEnvelopeViolation: err.message };
+      }
+      throw err;
+    }
+  }
+  return {
+    async isSupported() {
+      try {
+        return await mod.isPasskeySupported() === true;
+      } catch {
+        return false;
+      }
+    },
+    hasPlatformAuthenticator() {
+      return probePlatformAuthenticator(mod);
+    },
+    createCredential(creationOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "registration",
+        JSON.stringify(creationOptions),
+        ceremonyOptions
+      );
+    },
+    getCredential(requestOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "assertion",
+        JSON.stringify(requestOptions),
+        ceremonyOptions
+      );
+    }
+  };
+}
+async function probePlatformAuthenticator(mod) {
+  if (typeof mod.isPlatformAuthenticatorAvailable !== "function") return null;
+  try {
+    const available = await mod.isPlatformAuthenticatorAvailable();
+    return typeof available === "boolean" ? available : null;
+  } catch {
+    return null;
+  }
+}
+
+exports.CredentialEnvelopeError = CredentialEnvelopeError;
+exports.assertW3cCredentialEnvelope = assertW3cCredentialEnvelope;
+exports.createBareRnAdapter = createBareRnAdapter;
+exports.createDefaultExpoAdapter = createDefaultExpoAdapter;
+exports.createNativeDpopProver = createNativeDpopProver;
+exports.createNativePasskeyAdapter = createNativePasskeyAdapter;
+exports.probePlatformAuthenticator = probePlatformAuthenticator;
+exports.sanitizeCredentialEnvelope = sanitizeCredentialEnvelope;