@tokamakdev/plugin-secure-storage 0.1.0-beta.107 → 0.1.0-beta.114

package/apple/SecureStoragePlugin.swift

@@ -18,6 +18,10 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     self.host = host
   }
 
+  func executor(for method: String) -> DispatchQueue {
+    ["get", "replace", "set"].contains(method) ? .main : queue
+  }
+
   #if os(macOS)
     /// macOS grants the data protection keychain only to apps whose provisioning
     /// profile provides an application identifier.
@@ -32,16 +36,19 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     method: String,
     arguments: Any,
     reply: @escaping TokamakPluginReply
-  ) {
+  ) -> (() -> Void)? {
     let arguments = arguments as? [String: Any] ?? [:]
     let prompting =
-      isUnlocked ? Result { () throws(TokamakPluginError) in try host.requireUI() } : nil
+      ["get", "replace", "set"].contains(method) && isUnlocked
+      ? Result { () throws(TokamakPluginError) in try host.requireUI() } : nil
+    let authentication = LAContext()
     queue.async {
       reply(
         Result { () throws(TokamakPluginError) in
-          try self.perform(method, arguments, prompting: prompting)
+          try self.perform(method, arguments, prompting: prompting, authentication: authentication)
         })
     }
+    return { authentication.invalidate() }
   }
 
   /// Whether the device's protected data is available, which it is not while
@@ -60,7 +67,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
   private func perform(
     _ method: String,
     _ arguments: [String: Any],
-    prompting: Result<Void, TokamakPluginError>?
+    prompting: Result<Void, TokamakPluginError>?,
+    authentication: LAContext
   ) throws(TokamakPluginError) -> Any? {
     #if os(macOS)
       // Unentitled reads report errSecItemNotFound rather than a missing entitlement.
@@ -80,7 +88,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
           group: group,
           stored(arguments),
           prompt: optionalString(arguments, "prompt"),
-          prompting: prompting
+          prompting: prompting,
+          authentication: authentication
         ))
       return nil
     case "set":
@@ -91,7 +100,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
         group: group,
         stored,
         prompt: optionalString(arguments, "prompt"),
-        prompting: prompting
+        prompting: prompting,
+        authentication: authentication
       )
       try check(status == errSecItemNotFound ? add(name, group: group, stored) : status)
       return nil
@@ -100,7 +110,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
         requiredString(arguments, "name"),
         group: group,
         prompt: optionalString(arguments, "prompt"),
-        prompting: prompting
+        prompting: prompting,
+        authentication: authentication
       )
     case "delete":
       let name = try requiredString(arguments, "name")
@@ -141,14 +152,15 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     group: String?,
     _ stored: [CFString: Any],
     prompt: String?,
-    prompting: Result<Void, TokamakPluginError>?
+    prompting: Result<Void, TokamakPluginError>?,
+    authentication: LAContext
   ) throws(TokamakPluginError) -> OSStatus {
     var item = query(name, group: group)
     item[kSecUseAuthenticationContext] = Self.contextWithoutUI()
     let status = SecItemUpdate(item as CFDictionary, stored as CFDictionary)
     guard status == errSecInteractionNotAllowed, let prompting else { return status }
     try prompting.get()
-    item[kSecUseAuthenticationContext] = Self.context(prompt: prompt)
+    item[kSecUseAuthenticationContext] = Self.context(authentication, prompt: prompt)
     return SecItemUpdate(item as CFDictionary, stored as CFDictionary)
   }
 
@@ -158,7 +170,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     _ name: String,
     group: String?,
     prompt: String?,
-    prompting: Result<Void, TokamakPluginError>?
+    prompting: Result<Void, TokamakPluginError>?,
+    authentication: LAContext
   ) throws(TokamakPluginError) -> String {
     var item = query(name, group: group)
     item[kSecReturnData] = true
@@ -167,7 +180,7 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     var status = SecItemCopyMatching(item as CFDictionary, &data)
     if status == errSecInteractionNotAllowed, let prompting {
       try prompting.get()
-      item[kSecUseAuthenticationContext] = Self.context(prompt: prompt)
+      item[kSecUseAuthenticationContext] = Self.context(authentication, prompt: prompt)
       status = SecItemCopyMatching(item as CFDictionary, &data)
       // The first read found the value, so it exists but the system can no longer decrypt it.
       if status == errSecItemNotFound {
@@ -192,11 +205,9 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     return context
   }
 
-  /// A context whose system prompt shows `prompt`, or nil for the default prompt.
-  private static func context(prompt: String?) -> LAContext? {
-    guard let prompt, !prompt.isEmpty else { return nil }
-    let context = LAContext()
-    context.localizedReason = prompt
+  /// The invocation's authentication context, with the requested prompt.
+  private static func context(_ context: LAContext, prompt: String?) -> LAContext {
+    if let prompt, !prompt.isEmpty { context.localizedReason = prompt }
     return context
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamakdev/plugin-secure-storage",
-  "version": "0.1.0-beta.107",
+  "version": "0.1.0-beta.114",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mantty/tokamak.git",
@@ -8,10 +8,11 @@
   },
   "type": "module",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./android": "./android/bindings.ts"
   },
   "peerDependencies": {
-    "@tokamakdev/plugin": "0.1.0-beta.107"
+    "@tokamakdev/plugin": "0.1.0-beta.114"
   },
   "files": [
     "android",

package/src/index.ts

@@ -1,4 +1,4 @@
-import { Plugin } from "@tokamakdev/plugin";
+import { Plugin, type TokamakContext } from "@tokamakdev/plugin";
 
 /** When a stored value can be read. */
 export type Readable = "whenUnlocked" | "afterFirstUnlock";
@@ -45,8 +45,8 @@ export interface DeleteOptions {
 }
 
 class SecureStorage extends Plugin {
-  constructor() {
-    super("secure-storage");
+  constructor(ctx: TokamakContext) {
+    super(ctx, "secure-storage");
   }
 
   /** Stores a new value; rejects with `DuplicateItemError` when `name` has one. */
@@ -91,4 +91,4 @@ function stored(name: string, value: string, options: CreateOptions) {
   };
 }
 
-export const secureStorage = new SecureStorage();
+export function secureStorage(ctx: TokamakContext): SecureStorage { return new SecureStorage(ctx); }

package/tokamak-plugin.json

@@ -1,20 +1,61 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "id": "secure-storage",
+  "bindings": {
+    "android": {
+      "sdk": 35,
+      "modules": [
+        "android.security.keystore",
+        "java.security.KeyStore",
+        "javax.crypto.Cipher",
+        "javax.crypto.KeyGenerator"
+      ]
+    }
+  },
   "platforms": {
     "macos": {
       "class": "TokamakSecureStoragePlugin",
-      "sources": ["apple/SecureStoragePlugin.swift"]
+      "sources": [
+        "apple/SecureStoragePlugin.swift"
+      ]
     },
     "ios": {
       "class": "TokamakSecureStoragePlugin",
-      "sources": ["apple/SecureStoragePlugin.swift"],
+      "sources": [
+        "apple/SecureStoragePlugin.swift"
+      ],
       "plist": "apple/Info.plist"
     },
     "android": {
       "class": "com.tokamak.plugins.securestorage.TokamakSecureStoragePlugin",
-      "sources": ["android/SecureStoragePlugin.kt"],
+      "sources": [
+        "android/SecureStoragePlugin.kt"
+      ],
       "manifest": "android/AndroidManifest.xml"
     }
+  },
+  "api": {
+    "module": "src/index.ts",
+    "export": "secureStorage"
+  },
+  "operations": {
+    "get": {
+      "foreground": [
+        "ios",
+        "android"
+      ]
+    },
+    "replace": {
+      "foreground": [
+        "ios",
+        "android"
+      ]
+    },
+    "set": {
+      "foreground": [
+        "ios",
+        "android"
+      ]
+    }
   }
 }