@tokamakdev/plugin-secure-storage 0.1.0-beta.101 → 0.1.0-beta.102

package/README.md

@@ -30,7 +30,7 @@ await secureStorage.replace("identity/encryption", base64Value, {
 // Replaces the value, or creates it when the name has none.
 await secureStorage.set("identity/encryption", base64Value, options);
 
-// string | null
+// get, delete and clear reject with ItemNotFoundError when there is no value.
 const value = await secureStorage.get("identity/encryption", {
   prompt: "Confirm it's you to link a new device",
 });
@@ -75,7 +75,7 @@ screen. Android replaces values without asking.
 |---|---|
 | `NotSupportedError` | The platform, build or device cannot enforce the options |
 | `DuplicateItemError` | `create` was given a name that has a value |
-| `ItemNotFoundError` | `replace` was given a name that has no value |
+| `ItemNotFoundError` | `replace`, `get` or `delete` was given a name that has no value, or `clear` found no values |
 | `MissingEntitlementError` | `keychainGroup` is not one of the app's keychain access groups |
 | `InvalidStateError` | The requested authentication is not set up on the device |
 | `NotAllowedError` | The user cancelled or failed authentication, or the device is locked |
@@ -84,8 +84,6 @@ screen. Android replaces values without asking.
 | `TypeError` | An argument is missing or has an unsupported value |
 | `OperationError` | The platform reported another failure |
 
-`get` resolves `null` when the name has no stored value.
-
 ## Keychain access groups
 
 On Apple platforms an app can store values in each keychain access group its

package/android/SecureStoragePlugin.kt

@@ -134,7 +134,7 @@ class TokamakSecureStoragePlugin(
             throw TokamakPluginError("DuplicateItemError", "A value is already stored under this name")
         }
         if (previous == null && mode == Write.REPLACE) {
-            throw TokamakPluginError("ItemNotFoundError", "No value is stored under this name")
+            throw itemNotFound()
         }
         val previousAlias = previous?.let { alias(it.keyId) }
         val publicKey = generatePublicKey(spec)
@@ -188,11 +188,7 @@ class TokamakSecureStoragePlugin(
     private fun get(request: JSONObject, reply: TokamakPluginReply) {
         val name = request.requireString("name")
         val prompt = request.optionalString("prompt")
-        val stored = read(file(name))
-        if (stored == null) {
-            reply(Result.success(null))
-            return
-        }
+        val stored = read(file(name)) ?: throw itemNotFound()
         val privateKey =
             keyStore.getKey(alias(stored.keyId), null) as? PrivateKey
                 ?: throw notReadable()
@@ -237,16 +233,22 @@ class TokamakSecureStoragePlugin(
 
     private fun delete(name: String) {
         val file = file(name)
-        val stored = read(file) ?: return
+        val stored = read(file) ?: throw itemNotFound()
         AtomicFile(file).delete()
         keyStore.deleteEntry(alias(stored.keyId))
     }
 
+    /** Deletes every value, and any key an interrupted write left behind. */
     private fun clear() {
+        // An interrupted first write leaves only a `.new` file, which [read] ignores.
+        val hadValues = directory.list().orEmpty().any { !it.endsWith(".new") }
         directory.deleteRecursively()
         keyStore.aliases().toList()
             .filter { it.startsWith(ALIAS_PREFIX) }
             .forEach(keyStore::deleteEntry)
+        if (!hadValues) {
+            throw TokamakPluginError("ItemNotFoundError", "No values are stored")
+        }
     }
 
     private fun read(file: File): StoredValue? =
@@ -324,6 +326,8 @@ class TokamakSecureStoragePlugin(
         fun notReadable() =
             TokamakPluginError("NotReadableError", "The stored value can no longer be decrypted")
 
+        fun itemNotFound() = TokamakPluginError("ItemNotFoundError", "No value is stored under this name")
+
         fun pluginError(error: Throwable): Throwable =
             when (error) {
                 is KeyPermanentlyInvalidatedException,

package/apple/SecureStoragePlugin.swift

@@ -103,10 +103,11 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
         prompting: prompting
       )
     case "delete":
-      try deleteItems(query(requiredString(arguments, "name"), group: group))
+      let name = try requiredString(arguments, "name")
+      try check(SecItemDelete(query(name, group: group) as CFDictionary))
       return nil
     case "clear":
-      try deleteItems(serviceQuery(group: group))
+      try check(SecItemDelete(serviceQuery(group: group) as CFDictionary))
       return nil
     default:
       throw .notSupported("\(id).\(method) is not supported")
@@ -158,15 +159,12 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     group: String?,
     prompt: String?,
     prompting: Result<Void, TokamakPluginError>?
-  ) throws(TokamakPluginError) -> String? {
+  ) throws(TokamakPluginError) -> String {
     var item = query(name, group: group)
     item[kSecReturnData] = true
     item[kSecUseAuthenticationContext] = Self.contextWithoutUI()
     var data: CFTypeRef?
     var status = SecItemCopyMatching(item as CFDictionary, &data)
-    if status == errSecItemNotFound {
-      return nil
-    }
     if status == errSecInteractionNotAllowed, let prompting {
       try prompting.get()
       item[kSecUseAuthenticationContext] = Self.context(prompt: prompt)
@@ -186,13 +184,6 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     return String(decoding: data, as: UTF8.self)
   }
 
-  private func deleteItems(_ query: [CFString: Any]) throws(TokamakPluginError) {
-    let status = SecItemDelete(query as CFDictionary)
-    if status != errSecItemNotFound {
-      try check(status)
-    }
-  }
-
   /// A context in which keychain calls that need authentication fail with
   /// `errSecInteractionNotAllowed` rather than show the system prompt.
   private static func contextWithoutUI() -> LAContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamakdev/plugin-secure-storage",
-  "version": "0.1.0-beta.101",
+  "version": "0.1.0-beta.102",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mantty/tokamak.git",
@@ -11,7 +11,7 @@
     ".": "./src/index.ts"
   },
   "peerDependencies": {
-    "@tokamakdev/plugin": "0.1.0-beta.101"
+    "@tokamakdev/plugin": "0.1.0-beta.102"
   },
   "files": [
     "android",

package/src/index.ts

@@ -64,15 +64,17 @@ class SecureStorage extends Plugin {
     return this.call("set", { ...stored(name, value, options), prompt: options.prompt ?? null });
   }
 
-  get(name: string, options: GetOptions = {}): Promise<string | null> {
+  /** Reads the value; rejects with `ItemNotFoundError` when `name` has none. */
+  get(name: string, options: GetOptions = {}): Promise<string> {
     return this.call("get", { name, prompt: options.prompt ?? null, keychainGroup: options.keychainGroup ?? null });
   }
 
+  /** Deletes the value; rejects with `ItemNotFoundError` when `name` has none. */
   delete(name: string, options: DeleteOptions = {}): Promise<void> {
     return this.call("delete", { name, keychainGroup: options.keychainGroup ?? null });
   }
 
-  /** Deletes every stored value. */
+  /** Deletes every stored value; rejects with `ItemNotFoundError` when there are none. */
   clear(options: DeleteOptions = {}): Promise<void> {
     return this.call("clear", { keychainGroup: options.keychainGroup ?? null });
   }