@umutcansu/react-native-pinvault 0.0.0-stage → 2.3.2

package/ios/Core/ResultMapper.swift

@@ -0,0 +1,163 @@
+// Native results → plain dictionaries for JS (the Swift twin of ResultMapper.kt;
+// same keys). `type` is the Kotlin sealed subclass in lowerCamel, enum values are
+// the Kotlin constant names (= Swift raw values). Every free-text field passes
+// through VaultTokenStore.redact; vault content appears only in `unlocked`
+// (after the native prompt) and in `loadFile`, never in a download result or an event.
+import Foundation
+import PinVault
+
+public final class ResultMapper {
+    public static let utf8 = "utf8"
+    public static let base64 = "base64"
+
+    private let tokens: VaultTokenStore
+
+    public init(tokens: VaultTokenStore) { self.tokens = tokens }
+
+    private func text(_ s: String?) -> Any { tokens.redact(s) ?? NSNull() }
+    private func opt(_ v: Any?) -> Any { v ?? NSNull() }
+
+    public static func checkEncoding(_ encoding: String) throws -> String {
+        guard encoding == utf8 || encoding == base64 else { throw BridgeInputError("encoding: must be 'utf8' or 'base64'") }
+        return encoding
+    }
+
+    public static func encode(_ data: Data, _ encoding: String) -> String {
+        encoding == base64 ? data.base64EncodedString() : String(decoding: data, as: UTF8.self)
+    }
+
+    /// The Kotlin exception class name and message (`PinVaultError.exceptionName`).
+    public func exception(_ error: (any Error)?) -> Any {
+        guard let error else { return NSNull() }
+        if let e = error as? PinVaultError {
+            return ["name": e.exceptionName, "message": text(e.message)]
+        }
+        if let e = error as? BridgeInputError {
+            return ["name": "IllegalArgumentException", "message": text(e.message)]
+        }
+        let ns = error as NSError
+        let name = ns.domain == NSURLErrorDomain ? "URLError(\(ns.code))" : String(describing: type(of: error))
+        return ["name": name, "message": text(ns.localizedDescription)]
+    }
+
+    public func initResult(_ r: InitResult) -> [String: Any] {
+        switch r {
+        case .ready(let version): return ["type": "ready", "version": version]
+        case .failed(let reason, let e): return ["type": "failed", "reason": text(reason), "exception": exception(e)]
+        }
+    }
+
+    public func update(_ r: UpdateResult) -> [String: Any] {
+        switch r {
+        case .updated(let v): return ["type": "updated", "newVersion": v]
+        case .alreadyCurrent: return ["type": "alreadyCurrent"]
+        case .failed(let reason, let e): return ["type": "failed", "reason": text(reason), "exception": exception(e)]
+        }
+    }
+
+    public func enrollment(_ r: ClientCertEnrollmentResult) -> [String: Any] {
+        switch r {
+        case .enrolled(let already, let level):
+            return ["type": "enrolled", "alreadyEnrolled": already, "keySecurityLevel": opt(level?.rawValue)]
+        case .refused(let reason, let status, let serverError, let message):
+            return [
+                "type": "refused", "reason": reason.rawValue, "httpStatus": status,
+                "serverError": text(serverError), "message": text(message),
+            ]
+        case .pending(let requestId, let clientId, let message, let retryAfter, let code):
+            return [
+                "type": "pending", "requestId": requestId, "clientId": opt(clientId), "message": text(message),
+                "retryAfterSeconds": opt(retryAfter), "verificationCode": opt(code),
+            ]
+        case .failed(let message, let cause):
+            return ["type": "failed", "message": text(message), "cause": exception(cause)]
+        }
+    }
+
+    public func vaultFile(_ r: VaultFileResult) -> [String: Any] {
+        switch r {
+        // No bytes: the content is read with loadFile / unlockFile, on purpose.
+        case .updated(let key, let version, _): return ["type": "updated", "key": key, "version": version]
+        case .alreadyCurrent(let key, let version): return ["type": "alreadyCurrent", "key": key, "version": version]
+        case .failed(let key, let reason, let e, let code):
+            return ["type": "failed", "key": key, "reason": text(reason), "code": code, "exception": exception(e)]
+        }
+    }
+
+    public func unlock(_ r: VaultFileUnlockResult, encoding: String) -> [String: Any] {
+        switch r {
+        case .unlocked(let key, let version, let bytes):
+            return ["type": "unlocked", "key": key, "version": version, "content": Self.encode(bytes, encoding), "encoding": encoding]
+        case .notFound(let key): return ["type": "notFound", "key": key]
+        case .cancelled(let key): return ["type": "cancelled", "key": key]
+        case .invalidated(let key): return ["type": "invalidated", "key": key]
+        case .stale(let key): return ["type": "stale", "key": key]
+        case .failed(let key, let reason, let e):
+            return ["type": "failed", "key": key, "reason": text(reason), "exception": exception(e)]
+        }
+    }
+
+    public func attestation(_ s: AttestationStatus) -> [String: Any] {
+        [
+            "configApiId": s.configApiId,
+            "result": s.result.rawValue,
+            "arc": opt(s.arc),
+            "rejectionReasons": s.rejectionReasons,
+            "warnings": s.warnings,
+            "tokenExpiresAt": opt(s.tokenExpiresAt),
+            "lastAttestedAt": opt(s.lastAttestedAt),
+            "nextAttestAt": opt(s.nextAttestAt),
+            "clockSkewMs": opt(s.clockSkewMs),
+            "lastError": text(s.lastError),
+            "policyVersion": opt(s.policyVersion),
+        ]
+    }
+
+    public func attestationToken(_ r: AttestationTokenResult) -> [String: Any] {
+        switch r {
+        case .token(let value, let expiresAt): return ["type": "token", "value": value, "expiresAt": expiresAt]
+        case .rejected(let status): return ["type": "rejected", "status": attestation(status)]
+        case .failed(let message): return ["type": "failed", "message": text(message)]
+        case .unsupported: return ["type": "unsupported"]
+        }
+    }
+
+    public func signing(_ s: SigningStatus) -> [String: Any] {
+        [
+            "configApiId": s.configApiId,
+            "trustedKeyIds": s.trustedKeyIds,
+            "requiredSignatures": s.requiredSignatures,
+            "keySetVersion": s.keySetVersion,
+            "recoveryKeyIds": s.recoveryKeyIds,
+            "lastConfigSignedBy": s.lastConfigSignedBy,
+        ]
+    }
+
+    /// Connection telemetry. The library puts no token in events; free text is redacted anyway.
+    public func event(_ e: PinVaultConnectionEvent) -> [String: Any] {
+        switch e {
+        case let .connection(hostname, success, pinVersion, manufacturer, model, actualPin, expectedPins):
+            return [
+                "type": "connection", "hostname": hostname, "success": success, "pinVersion": pinVersion,
+                "deviceManufacturer": manufacturer, "deviceModel": model, "actualPin": actualPin, "expectedPins": expectedPins,
+            ]
+        case let .configUpdate(status, newVersion, manufacturer, model, failureReason):
+            return [
+                "type": "configUpdate", "status": status.rawValue, "newVersion": newVersion,
+                "deviceManufacturer": manufacturer, "deviceModel": model, "failureReason": text(failureReason),
+            ]
+        case let .clientCertRenewal(status, notAfter, via, configApiId, manufacturer, model, failureReason):
+            return [
+                "type": "clientCertRenewal", "status": status.rawValue, "notAfterEpochMs": notAfter, "via": opt(via?.rawValue),
+                "configApiId": configApiId, "deviceManufacturer": manufacturer, "deviceModel": model,
+                "failureReason": text(failureReason),
+            ]
+        case let .attestation(configApiId, status, arc, reasons, warnings, tokenExpiresAt, manufacturer, model, failureReason):
+            return [
+                "type": "attestation", "configApiId": configApiId, "status": status.rawValue, "arc": opt(arc),
+                "rejectionReasons": reasons, "warnings": warnings, "tokenExpiresAt": opt(tokenExpiresAt),
+                "deviceManufacturer": manufacturer, "deviceModel": model, "failureReason": text(failureReason),
+            ]
+        }
+    }
+}

package/ios/Core/StrictJSON.swift

@@ -0,0 +1,214 @@
+// Strict JSON for bridge input (the Swift twin of StrictJson.kt).
+//
+// JSON from JS → Foundation values; `Fields` reads an object key by key and
+// `finish()` refuses every key nobody read. Nothing is coerced: a "1" is not a
+// number, a 1 is not a boolean (JSONSerialization hands both out as NSNumber;
+// the CFBoolean type id tells them apart).
+import Foundation
+
+/// A refusal of bridge input; the message names the path (`config.configApis[0].url`).
+public struct BridgeInputError: Error, CustomStringConvertible, Equatable {
+    public let message: String
+    public init(_ message: String) { self.message = message }
+    public var description: String { message }
+}
+
+public enum StrictJSON {
+    public static let maxInputChars = 256 * 1024
+    static let maxDepth = 8
+
+    public static func parseObject(_ json: String, path: String, maxChars: Int = maxInputChars) throws -> Fields {
+        if json.utf16.count > maxChars { throw BridgeInputError("\(path): larger than \(maxChars) characters") }
+        // Before the parser, as on Android: refuse deep nesting without letting a parser recurse into it.
+        if nestingDepth(json) > maxDepth + 1 { throw BridgeInputError("\(path): nested too deeply") }
+        let value: Any
+        do {
+            value = try JSONSerialization.jsonObject(with: Data(json.utf8), options: [])
+        } catch {
+            throw BridgeInputError("\(path): not valid JSON")
+        }
+        guard let object = value as? [String: Any] else { throw BridgeInputError("\(path): must be an object") }
+        try checkDepth(object, path: path, depth: 0)
+        return Fields(path: path, map: object)
+    }
+
+    /// The deepest `[` / `{` nesting of `json`, strings skipped; stops counting past the limit.
+    static func nestingDepth(_ json: String, stopAt: Int = maxDepth + 2) -> Int {
+        var depth = 0, deepest = 0
+        var inString = false, escaped = false
+        for c in json.utf8 {
+            if inString {
+                if escaped { escaped = false } else if c == UInt8(ascii: "\\") { escaped = true } else if c == UInt8(ascii: "\"") { inString = false }
+                continue
+            }
+            switch c {
+            case UInt8(ascii: "\""): inString = true
+            case UInt8(ascii: "["), UInt8(ascii: "{"):
+                depth += 1
+                if depth > deepest {
+                    deepest = depth
+                    if deepest >= stopAt { return deepest }
+                }
+            case UInt8(ascii: "]"), UInt8(ascii: "}"):
+                if depth > 0 { depth -= 1 }
+            default: break
+            }
+        }
+        return deepest
+    }
+
+    private static func checkDepth(_ value: Any, path: String, depth: Int) throws {
+        if depth > maxDepth { throw BridgeInputError("\(path): nested too deeply") }
+        if let object = value as? [String: Any] {
+            for (k, v) in object { try checkDepth(v, path: "\(path).\(k)", depth: depth + 1) }
+        } else if let array = value as? [Any] {
+            for (i, v) in array.enumerated() { try checkDepth(v, path: "\(path)[\(i)]", depth: depth + 1) }
+        }
+    }
+
+    static func isBool(_ value: Any) -> Bool {
+        guard let n = value as? NSNumber else { return false }
+        return CFGetTypeID(n) == CFBooleanGetTypeID()
+    }
+}
+
+/// One JSON object; every accessor marks its key as known. JSON `null` counts as absent.
+public final class Fields {
+    public let path: String
+    private let map: [String: Any]
+    private var known = Set<String>()
+
+    init(path: String, map: [String: Any]) {
+        self.path = path
+        self.map = map
+    }
+
+    private func raw(_ key: String) -> Any? {
+        known.insert(key)
+        guard let v = map[key], !(v is NSNull) else { return nil }
+        return v
+    }
+
+    /// Refuses every key no accessor asked for.
+    public func finish() throws {
+        let unknown = map.keys.filter { !known.contains($0) }.sorted()
+        if !unknown.isEmpty {
+            throw BridgeInputError(
+                "\(path): unknown key\(unknown.count > 1 ? "s" : "") \(unknown.map { "'\($0)'" }.joined(separator: ", "))"
+            )
+        }
+    }
+
+    private static func badChar(_ c: Unicode.Scalar, multiline: Bool) -> Bool {
+        (c.value < 0x20 || c.value == 0x7f) && !(multiline && (c == "\n" || c == "\r"))
+    }
+
+    public func string(_ key: String, maxLength: Int = 2048, allowEmpty: Bool = false, multiline: Bool = false) throws -> String? {
+        guard let v = raw(key) else { return nil }
+        guard let s = v as? String else { throw BridgeInputError("\(path).\(key): must be a string") }
+        if s.count > maxLength { throw BridgeInputError("\(path).\(key): longer than \(maxLength) characters") }
+        if !allowEmpty && s.isEmpty { throw BridgeInputError("\(path).\(key): must not be empty") }
+        if s.unicodeScalars.contains(where: { Fields.badChar($0, multiline: multiline) }) {
+            throw BridgeInputError("\(path).\(key): control characters are not allowed")
+        }
+        return s
+    }
+
+    public func requireString(_ key: String, maxLength: Int = 2048) throws -> String {
+        guard let s = try string(key, maxLength: maxLength) else { throw BridgeInputError("\(path).\(key): required") }
+        return s
+    }
+
+    /// Free text (a request body): any characters, bounded length.
+    public func text(_ key: String, maxLength: Int) throws -> String? {
+        guard let v = raw(key) else { return nil }
+        guard let s = v as? String else { throw BridgeInputError("\(path).\(key): must be a string") }
+        if s.utf16.count > maxLength { throw BridgeInputError("\(path).\(key): longer than \(maxLength) characters") }
+        return s
+    }
+
+    public func bool(_ key: String) throws -> Bool? {
+        guard let v = raw(key) else { return nil }
+        guard StrictJSON.isBool(v), let n = v as? NSNumber else { throw BridgeInputError("\(path).\(key): must be a boolean") }
+        return n.boolValue
+    }
+
+    public func int64(_ key: String, min: Int64, max: Int64) throws -> Int64? {
+        guard let v = raw(key) else { return nil }
+        guard !StrictJSON.isBool(v), let n = v as? NSNumber else { throw BridgeInputError("\(path).\(key): must be a number") }
+        let d = n.doubleValue
+        if d != d.rounded() { throw BridgeInputError("\(path).\(key): must be a whole number") }
+        if d < Double(min) || d > Double(max) { throw BridgeInputError("\(path).\(key): must be between \(min) and \(max)") }
+        return Int64(d)
+    }
+
+    public func int(_ key: String, min: Int, max: Int) throws -> Int? {
+        try int64(key, min: Int64(min), max: Int64(max)).map { Int($0) }
+    }
+
+    public func double(_ key: String, min: Double, max: Double) throws -> Double? {
+        guard let v = raw(key) else { return nil }
+        guard !StrictJSON.isBool(v), let n = v as? NSNumber else { throw BridgeInputError("\(path).\(key): must be a number") }
+        let d = n.doubleValue
+        if d < min || d > max { throw BridgeInputError("\(path).\(key): must be between \(min) and \(max)") }
+        return d
+    }
+
+    public func stringList(_ key: String, maxItems: Int = 64, maxLength: Int = 2048, multiline: Bool = false) throws -> [String]? {
+        guard let v = raw(key) else { return nil }
+        guard let list = v as? [Any] else { throw BridgeInputError("\(path).\(key): must be a list of strings") }
+        if list.count > maxItems { throw BridgeInputError("\(path).\(key): more than \(maxItems) items") }
+        return try list.enumerated().map { i, item in
+            guard let s = item as? String else { throw BridgeInputError("\(path).\(key)[\(i)]: must be a string") }
+            if s.isEmpty || s.count > maxLength {
+                throw BridgeInputError("\(path).\(key)[\(i)]: must be 1 to \(maxLength) characters")
+            }
+            if s.unicodeScalars.contains(where: { Fields.badChar($0, multiline: multiline) }) {
+                throw BridgeInputError("\(path).\(key)[\(i)]: control characters are not allowed")
+            }
+            return s
+        }
+    }
+
+    public func object(_ key: String) throws -> Fields? {
+        guard let v = raw(key) else { return nil }
+        guard let o = v as? [String: Any] else { throw BridgeInputError("\(path).\(key): must be an object") }
+        return Fields(path: "\(path).\(key)", map: o)
+    }
+
+    public func objectList(_ key: String, maxItems: Int) throws -> [Fields]? {
+        guard let v = raw(key) else { return nil }
+        guard let list = v as? [Any] else { throw BridgeInputError("\(path).\(key): must be a list of objects") }
+        if list.count > maxItems { throw BridgeInputError("\(path).\(key): more than \(maxItems) items") }
+        return try list.enumerated().map { i, item in
+            guard let o = item as? [String: Any] else { throw BridgeInputError("\(path).\(key)[\(i)]: must be an object") }
+            return Fields(path: "\(path).\(key)[\(i)]", map: o)
+        }
+    }
+
+    /// A string → string map (`ios.resolve`, request headers).
+    public func stringMap(_ key: String, maxItems: Int, maxKeyLength: Int, maxValueLength: Int) throws -> [String: String]? {
+        guard let v = raw(key) else { return nil }
+        guard let o = v as? [String: Any] else { throw BridgeInputError("\(path).\(key): must be an object") }
+        if o.count > maxItems { throw BridgeInputError("\(path).\(key): more than \(maxItems) entries") }
+        var out: [String: String] = [:]
+        for (name, value) in o {
+            if name.isEmpty || name.count > maxKeyLength {
+                throw BridgeInputError("\(path).\(key): key '\(name.prefix(40))' has a bad length")
+            }
+            guard let s = value as? String else { throw BridgeInputError("\(path).\(key).\(name): must be a string") }
+            if s.count > maxValueLength { throw BridgeInputError("\(path).\(key).\(name): longer than \(maxValueLength) characters") }
+            out[name] = s
+        }
+        return out
+    }
+
+    /// An enum by its raw value (= the Kotlin constant name).
+    public func enumValue<E: RawRepresentable & CaseIterable>(_ key: String, _ type: E.Type) throws -> E? where E.RawValue == String {
+        guard let s = try string(key, maxLength: 64) else { return nil }
+        guard let e = E(rawValue: s) else {
+            throw BridgeInputError("\(path).\(key): '\(s)' is not one of \(E.allCases.map(\.rawValue).joined(separator: ", "))")
+        }
+        return e
+    }
+}

package/ios/Core/VaultTokenStore.swift

@@ -0,0 +1,66 @@
+// Vault access tokens (and the enrollment token of a running call), in memory
+// only: never written to disk or the Keychain, gone with the process. The
+// vault files' `accessToken { … }` providers read from here on every download.
+// Every string that goes back to JS passes through `redact`.
+import Foundation
+
+public final class VaultTokenStore: @unchecked Sendable {
+    public static let minRedactLength = 6
+    public static let maxMessage = 1000
+
+    private let lock = NSLock()
+    private var tokens: [String: String] = [:]
+    private var transient: [String: Int] = [:]
+
+    public init() {}
+
+    public func put(_ key: String, _ token: String?) {
+        lock.lock(); defer { lock.unlock() }
+        if let token, !token.isEmpty { tokens[key] = token } else { tokens.removeValue(forKey: key) }
+    }
+
+    /// Empty when there is none: the server refuses that as an invalid token.
+    public func get(_ key: String) -> String {
+        lock.lock(); defer { lock.unlock() }
+        return tokens[key] ?? ""
+    }
+
+    @discardableResult
+    public func clear() -> Int {
+        lock.lock(); defer { lock.unlock() }
+        let n = tokens.count
+        tokens.removeAll()
+        return n
+    }
+
+    /// A secret that is not stored but must still be redacted while a call runs.
+    public func withTransientSecret<T>(_ secret: String, _ body: () async throws -> T) async rethrows -> T {
+        addTransient(secret)
+        defer { removeTransient(secret) }
+        return try await body()
+    }
+
+    private func addTransient(_ secret: String) {
+        guard secret.count >= Self.minRedactLength else { return }
+        lock.lock(); defer { lock.unlock() }
+        transient[secret, default: 0] += 1
+    }
+
+    private func removeTransient(_ secret: String) {
+        lock.lock(); defer { lock.unlock() }
+        if let n = transient[secret] {
+            if n <= 1 { transient.removeValue(forKey: secret) } else { transient[secret] = n - 1 }
+        }
+    }
+
+    public func redact(_ text: String?) -> String? {
+        guard var out = text else { return nil }
+        lock.lock()
+        let secrets = Array(tokens.values) + Array(transient.keys)
+        lock.unlock()
+        for secret in secrets where secret.count >= Self.minRedactLength {
+            out = out.replacingOccurrences(of: secret, with: "***")
+        }
+        return out.count > Self.maxMessage ? String(out.prefix(Self.maxMessage)) + "…" : out
+    }
+}