@tokamakdev/plugin-secure-storage 0.1.0-beta.96 → 0.1.0-beta.98

package/README.md

@@ -25,9 +25,6 @@ const value = await secureStorage.get("identity/encryption", {
 
 await secureStorage.delete("identity/encryption");
 
-// string[], sorted
-const names = await secureStorage.keys();
-
 await secureStorage.clear();
 ```
 
@@ -47,6 +44,10 @@ decrypted until the device owner authenticates:
 | `biometrics` | Face ID, Touch ID or fingerprint | Readable |
 | `currentBiometrics` | Face ID, Touch ID or fingerprint enrolled when the value was stored | Permanently unreadable |
 
+On iOS, the system reports a read of a `currentBiometrics` value after an
+enrolment change as failed authentication, so `get` rejects with
+`NotAllowedError` rather than `NotReadableError`.
+
 `prompt` is the reason shown in the system authentication prompt. Without it,
 the platform's default prompt is shown.
 
@@ -64,9 +65,6 @@ the platform's default prompt is shown.
 
 `get` resolves `null` when the name has no stored value.
 
-Names are not protected like values: `keys()` lists them whenever the device
-has been unlocked since it started, without authentication.
-
 ## Platforms
 
 - **iOS:** Keychain items, which survive deleting and reinstalling the app.

package/android/SecureStoragePlugin.kt

@@ -72,7 +72,6 @@ class TokamakSecureStoragePlugin(
                 delete(requireObject(arguments).requireString("name"))
                 reply(Result.success(null))
             }
-            "keys" -> execute(reply) { reply(Result.success(keys())) }
             "clear" -> execute(reply) {
                 clear()
                 reply(Result.success(null))
@@ -115,7 +114,7 @@ class TokamakSecureStoragePlugin(
         val previousAlias = read(file)?.let { alias(it.keyId) }
         val publicKey = generatePublicKey(spec)
         try {
-            write(file, seal(name, keyId, value, publicKey).encode())
+            write(file, seal(keyId, value, publicKey).encode())
         } catch (error: Throwable) {
             keyStore.deleteEntry(alias(keyId))
             throw error
@@ -147,7 +146,7 @@ class TokamakSecureStoragePlugin(
             .generatePublic(X509EncodedKeySpec(keyPair.public.encoded))
     }
 
-    private fun seal(name: String, keyId: ByteArray, value: String, publicKey: PublicKey): StoredValue {
+    private fun seal(keyId: ByteArray, value: String, publicKey: PublicKey): StoredValue {
         val dataKey = KeyGenerator.getInstance("AES").apply { init(DATA_KEY_SIZE) }.generateKey()
         val iv = ByteArray(IV_SIZE).also(random::nextBytes)
         val sealed =
@@ -158,7 +157,7 @@ class TokamakSecureStoragePlugin(
             Cipher.getInstance(WRAP)
                 .apply { init(Cipher.ENCRYPT_MODE, publicKey, OAEP) }
                 .doFinal(dataKey.encoded)
-        return StoredValue(name, keyId, wrapped, iv, sealed)
+        return StoredValue(keyId, wrapped, iv, sealed)
     }
 
     private fun get(request: JSONObject, reply: TokamakPluginReply) {
@@ -218,13 +217,6 @@ class TokamakSecureStoragePlugin(
         keyStore.deleteEntry(alias(stored.keyId))
     }
 
-    /** AtomicFile's in-progress and backup files carry a suffix; value files have none. */
-    private fun keys(): List<String> =
-        directory.listFiles { file -> '.' !in file.name }
-            .orEmpty()
-            .mapNotNull { read(it)?.name }
-            .sorted()
-
     private fun clear() {
         directory.deleteRecursively()
         keyStore.aliases().toList()
@@ -321,9 +313,8 @@ private const val KEY_ID_SIZE = 16
 private const val WRAPPED_KEY_SIZE = KEY_SIZE / 8
 private const val IV_SIZE = 12
 
-/** A value's file: its name, key ID, wrapped data key, IV, then sealed value. */
+/** A value's file: an unused string, then the key ID, wrapped data key, IV and sealed value. */
 private class StoredValue(
-    val name: String,
     val keyId: ByteArray,
     val wrappedKey: ByteArray,
     val iv: ByteArray,
@@ -332,7 +323,7 @@ private class StoredValue(
     fun encode(): ByteArray {
         val bytes = ByteArrayOutputStream()
         DataOutputStream(bytes).run {
-            writeUTF(name)
+            writeUTF("")
             write(keyId)
             write(wrappedKey)
             write(iv)
@@ -344,8 +335,8 @@ private class StoredValue(
     companion object {
         fun decode(bytes: ByteArray): StoredValue =
             DataInputStream(bytes.inputStream()).run {
+                readUTF()
                 StoredValue(
-                    name = readUTF(),
                     keyId = readExactly(KEY_ID_SIZE),
                     wrappedKey = readExactly(WRAPPED_KEY_SIZE),
                     iv = readExactly(IV_SIZE),

package/apple/SecureStoragePlugin.swift

@@ -9,12 +9,7 @@ import Security
 final class TokamakSecureStoragePlugin: TokamakPlugin {
   let id = "secure-storage"
 
-  /// Holds each value under a random ID.
-  private let values = "tokamak.secure-storage"
-  /// Holds each name's record: the ID of its value. Records have no access
-  /// control, so `keys()` needs no authentication; on a device, reading even the
-  /// attributes of an item saved with access control does.
-  private let names = "tokamak.secure-storage.names"
+  private let service = "tokamak.secure-storage"
   /// Keychain calls block while the system authentication prompt is shown.
   private let queue = DispatchQueue(label: "tokamak.secure-storage")
   private let host: TokamakHost
@@ -92,21 +87,20 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
         prompting: prompting
       )
     case "delete":
-      try delete(requiredString(arguments, "name"))
+      try deleteItems(query(requiredString(arguments, "name")))
       return nil
-    case "keys":
-      return try keys()
     case "clear":
-      try deleteItems(serviceQuery(values))
-      try deleteItems(serviceQuery(names))
+      try deleteItems(serviceQuery())
       return nil
     default:
       throw .notSupported("\(id).\(method) is not supported")
     }
   }
 
-  /// Stores the value under a new ID before pointing the name's record at it, so
-  /// a failed write leaves the previous value readable.
+  /// Replaces an existing value by deleting it and adding the new one, because
+  /// updating an item saved with access control needs authentication and
+  /// deleting it does not. Invalid options fail before the existing value is
+  /// deleted.
   private func set(
     _ name: String,
     value: String,
@@ -115,57 +109,19 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     authentication: String?
   ) throws(TokamakPluginError) {
     let accessibility = try accessibility(readable, thisDeviceOnly: thisDeviceOnly)
-    let id = UUID().uuidString
-    var item = query(values, id)
+    var item = query(name)
     item[kSecValueData] = Data(value.utf8)
     if let authentication {
       item[kSecAttrAccessControl] = try accessControl(accessibility, authentication)
     } else {
       item[kSecAttrAccessible] = accessibility
     }
-    let previous = try valueID(name)
-    try check(SecItemAdd(item as CFDictionary, nil))
-    do throws(TokamakPluginError) {
-      try point(name, at: id, thisDeviceOnly: thisDeviceOnly)
-    } catch {
-      SecItemDelete(query(values, id) as CFDictionary)
-      throw error
-    }
-    if let previous {
-      try deleteItems(query(values, previous))
-    }
-  }
-
-  /// Points `name`'s record at `id`. Records are readable after the first
-  /// unlock, so `keys()` works while the device is locked.
-  private func point(
-    _ name: String,
-    at id: String,
-    thisDeviceOnly: Bool
-  ) throws(TokamakPluginError) {
-    let record: [CFString: Any] = [
-      kSecValueData: Data(id.utf8),
-      kSecAttrAccessible: thisDeviceOnly
-        ? kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly : kSecAttrAccessibleAfterFirstUnlock,
-    ]
-    var status = SecItemUpdate(query(names, name) as CFDictionary, record as CFDictionary)
-    if status == errSecItemNotFound {
-      status = SecItemAdd(query(names, name).merging(record) { _, new in new } as CFDictionary, nil)
-    }
-    try check(status)
-  }
-
-  /// The ID of `name`'s value, or nil when `name` has no value.
-  private func valueID(_ name: String) throws(TokamakPluginError) -> String? {
-    var read = query(names, name)
-    read[kSecReturnData] = true
-    var data: CFTypeRef?
-    let status = SecItemCopyMatching(read as CFDictionary, &data)
-    if status == errSecItemNotFound {
-      return nil
+    var status = SecItemAdd(item as CFDictionary, nil)
+    if status == errSecDuplicateItem {
+      try deleteItems(query(name))
+      status = SecItemAdd(item as CFDictionary, nil)
     }
     try check(status)
-    return (data as? Data).map { String(decoding: $0, as: UTF8.self) }
   }
 
   /// Reads without UI first, so only a value saved with authentication needs
@@ -175,12 +131,14 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     prompt: String?,
     prompting: Result<Void, TokamakPluginError>?
   ) throws(TokamakPluginError) -> String? {
-    guard let id = try valueID(name) else { return nil }
-    var item = query(values, id)
+    var item = query(name)
     item[kSecReturnData] = true
     item[kSecUseAuthenticationContext] = Self.contextWithoutUI()
     var data: CFTypeRef?
     var status = SecItemCopyMatching(item as CFDictionary, &data)
+    if status == errSecItemNotFound {
+      return nil
+    }
     if status == errSecInteractionNotAllowed, let prompting {
       try prompting.get()
       item[kSecUseAuthenticationContext] = prompt.flatMap { prompt -> LAContext? in
@@ -190,12 +148,13 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
         return context
       }
       status = SecItemCopyMatching(item as CFDictionary, &data)
-    }
-    if status == errSecItemNotFound {
-      throw TokamakPluginError(
-        name: "NotReadableError",
-        message: "The stored value can no longer be read"
-      )
+      // The first read found the value, so it exists but the system can no longer decrypt it.
+      if status == errSecItemNotFound {
+        throw TokamakPluginError(
+          name: "NotReadableError",
+          message: "The stored value can no longer be read"
+        )
+      }
     }
     try check(status)
     guard let data = data as? Data else {
@@ -204,29 +163,6 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     return String(decoding: data, as: UTF8.self)
   }
 
-  /// Deletes the value before its record, so a failure leaves the name listed.
-  private func delete(_ name: String) throws(TokamakPluginError) {
-    guard let id = try valueID(name) else { return }
-    try deleteItems(query(values, id))
-    try deleteItems(query(names, name))
-  }
-
-  private func keys() throws(TokamakPluginError) -> [String] {
-    var records = serviceQuery(names)
-    records[kSecReturnAttributes] = true
-    records[kSecMatchLimit] = kSecMatchLimitAll
-    var attributes: CFTypeRef?
-    let status = SecItemCopyMatching(records as CFDictionary, &attributes)
-    if status == errSecItemNotFound {
-      return []
-    }
-    try check(status)
-    let names = (attributes as? [[String: Any]] ?? []).compactMap {
-      $0[kSecAttrAccount as String] as? String
-    }
-    return names.sorted()
-  }
-
   private func deleteItems(_ query: [CFString: Any]) throws(TokamakPluginError) {
     let status = SecItemDelete(query as CFDictionary)
     if status != errSecItemNotFound {
@@ -242,9 +178,9 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     return context
   }
 
-  /// All of the plugin's items in `service`. The data protection keychain is
-  /// the only keychain on iOS; macOS needs a team-signed build to use it.
-  private func serviceQuery(_ service: String) -> [CFString: Any] {
+  /// All of the plugin's items. The data protection keychain is the only
+  /// keychain on iOS; macOS needs a team-signed build to use it.
+  private func serviceQuery() -> [CFString: Any] {
     [
       kSecClass: kSecClassGenericPassword,
       kSecAttrService: service,
@@ -252,8 +188,8 @@ final class TokamakSecureStoragePlugin: TokamakPlugin {
     ]
   }
 
-  private func query(_ service: String, _ account: String) -> [CFString: Any] {
-    serviceQuery(service).merging([kSecAttrAccount: account]) { _, account in account }
+  private func query(_ name: String) -> [CFString: Any] {
+    serviceQuery().merging([kSecAttrAccount: name]) { _, name in name }
   }
 
   /// `ThisDeviceOnly` items restore only to the device they were stored on.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamakdev/plugin-secure-storage",
-  "version": "0.1.0-beta.96",
+  "version": "0.1.0-beta.98",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mantty/tokamak.git",
@@ -11,7 +11,7 @@
     ".": "./src/index.ts"
   },
   "peerDependencies": {
-    "@tokamakdev/plugin": "0.1.0-beta.96"
+    "@tokamakdev/plugin": "0.1.0-beta.98"
   },
   "files": [
     "android",

package/src/index.ts

@@ -45,11 +45,6 @@ class SecureStorage extends Plugin {
     return this.call("delete", { name });
   }
 
-  /** The names of all stored values, sorted. */
-  keys(): Promise<string[]> {
-    return this.call("keys");
-  }
-
   /** Deletes every stored value. */
   clear(): Promise<void> {
     return this.call("clear");