@umutcansu/react-native-pinvault 0.0.0-stage → 2.4.0

package/ios/PinVaultBridge.swift

@@ -0,0 +1,424 @@
+// The Swift side of the TurboModule (RNPinVault.mm forwards every method here).
+// It calls PinVault.shared and nothing else: no pinning, key handling or vault
+// decryption happens in this file. Inputs are parsed by Core/ConfigParser and
+// Core/PinnedFetch, results mapped by Core/ResultMapper.
+import Foundation
+import PinVault
+#if canImport(UIKit)
+import UIKit
+#endif
+
+@objc(RNPinVaultBridge)
+public final class PinVaultBridge: NSObject {
+    public typealias Resolve = (Any?) -> Void
+    public typealias Reject = (String, String, [String: Any]?) -> Void
+
+    // Process-wide, like the library: a JS reload makes a new module, not a new PinVault.
+    private static let tokens = VaultTokenStore()
+    private static let lock = NSLock()
+    private static var startedInProcess = false
+    private static var jsGuard: JSEnvironmentGuard?
+    private static weak var current: PinVaultBridge?
+    private static let startQueue = StartQueue()
+    private static var rnMaxResponseBytes = ReactNetworking.defaultMaxResponseBytes
+
+    private let mapper = ResultMapper(tokens: PinVaultBridge.tokens)
+
+    @objc public var emitConnectionEvent: (([String: Any]) -> Void)?
+    @objc public var emitGuardRequest: (([String: Any]) -> Void)?
+    /// RNPinVault.mm: whether RCTNetworking hands an https request to
+    /// RNPinVaultURLRequestHandler (true), to another handler (false), or nil = unknown.
+    @objc public var reactNetworkingIsPinned: (() -> NSNumber?)?
+
+    /// `PinVault.shared.registerBackgroundTask()` for the app's AppDelegate (before launch ends):
+    /// the app target does not link the PinVault package itself.
+    @objc public static func registerBackgroundTask() -> Bool {
+        PinVault.shared.registerBackgroundTask()
+    }
+
+    @objc public override init() {
+        super.init()
+        Self.lock.lock()
+        Self.current = self
+        Self.lock.unlock()
+    }
+
+    private static func locked<T>(_ body: () -> T) -> T {
+        lock.lock(); defer { lock.unlock() }
+        return body()
+    }
+
+    private static var started: Bool {
+        lock.lock(); defer { lock.unlock() }
+        return startedInProcess
+    }
+
+    /// For the React Native request handler: `start` has run (a failed start
+    /// leaves the library's sessions refusing every request).
+    static var isStarted: Bool { started }
+
+    /// `ios.reactNativeMaxResponseBytes` of the last start.
+    static var reactNativeMaxResponseBytes: Int64 { locked { rnMaxResponseBytes } }
+
+    /// An error → (exception name, message) for JS, tokens redacted.
+    static let describe: @Sendable (any Error) -> (String, String) = { error in
+        let mapped = ResultMapper(tokens: tokens).exception(error) as? [String: Any] ?? [:]
+        return ((mapped["name"] as? String) ?? "Error", (mapped["message"] as? String) ?? "")
+    }
+
+    /// Runs a library call with the JS guard's verdicts on `operations` asked
+    /// beforehand, so the library's synchronous guard check holds no thread.
+    private static func guarded<T>(_ operations: [GuardedOperation], _ body: () async throws -> T) async rethrows -> T {
+        guard let g = locked({ jsGuard }) else { return try await body() }
+        return try await g.withVerdicts(operations, body)
+    }
+
+    // MARK: helpers
+
+    private func run(_ resolve: @escaping Resolve, _ reject: @escaping Reject, _ body: @escaping () async throws -> Any?) {
+        Task.detached {
+            do {
+                resolve(try await body() ?? NSNull())
+            } catch let e as BridgeInputError {
+                reject("E_INVALID_ARGUMENT", Self.tokens.redact(e.message) ?? "", nil)
+            } catch {
+                reject("E_NATIVE", Self.tokens.redact("\(error)") ?? "", self.exceptionInfo(error))
+            }
+        }
+    }
+
+    private func exceptionInfo(_ error: any Error) -> [String: Any] {
+        let mapped = mapper.exception(error) as? [String: Any] ?? [:]
+        return ["exceptionName": mapped["name"] ?? "Error", "exceptionMessage": mapped["message"] ?? NSNull()]
+    }
+
+    /// A vault file key: the library's rule (it names the stored copy's file).
+    private static func checkKey(_ key: String) throws {
+        let allowed = key.utf8.allSatisfy { byte in
+            (byte >= 0x30 && byte <= 0x39) || (byte >= 0x41 && byte <= 0x5A) || (byte >= 0x61 && byte <= 0x7A) ||
+                byte == 0x2E || byte == 0x5F || byte == 0x2D
+        }
+        if key.isEmpty || key.utf8.count > 64 || !allowed || key.allSatisfy({ $0 == "." }) {
+            throw BridgeInputError("key: must match [A-Za-z0-9._-]{1,64} and not be only dots")
+        }
+    }
+
+    private static func checkToken(_ token: String?) throws {
+        if let token, token.count > 4096 { throw BridgeInputError("token: longer than 4096 characters") }
+    }
+
+    // MARK: start / config
+
+    @objc public func start(_ json: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        Task.detached {
+            await Self.startQueue.run {
+                let parsed: ParsedConfig
+                var newGuard: JSEnvironmentGuard?
+                do {
+                    #if DEBUG
+                    let release = false
+                    #else
+                    let release = true
+                    #endif
+                    parsed = try ConfigParser.parse(
+                        json, tokens: Self.tokens,
+                        guardFactory: { timeout in
+                            let g = JSEnvironmentGuard(timeoutMs: timeout) { requestId, operation in
+                                let bridge = Self.locked { Self.current }
+                                bridge?.emitGuardRequest?(["requestId": requestId, "operation": operation])
+                            }
+                            newGuard = g
+                            return g
+                        },
+                        listener: { event in
+                            let bridge = Self.locked { Self.current }
+                            guard let bridge else { return }
+                            bridge.emitConnectionEvent?(bridge.mapper.event(event))
+                        },
+                        native: try NativeSecurity.load(),
+                        release: release,
+                        noFileAllowed: NativeSecurity.noFileAllowed(),
+                        reactNetworkingEnabled: PinVaultReactNetworking.enabled
+                    )
+                } catch let e as BridgeInputError {
+                    // The guard of the running config stays: a refused config changes nothing.
+                    reject("E_INVALID_CONFIG", Self.tokens.redact(e.message) ?? "", nil)
+                    return
+                } catch {
+                    let message = (error as? PinVaultError)?.message ?? "\(error)"
+                    reject("E_INVALID_CONFIG", Self.tokens.redact(message) ?? "", nil)
+                    return
+                }
+                let pinned = self.reactNetworkingIsPinned?()?.boolValue
+                if pinned != true {
+                    let why = !PinVaultReactNetworking.enabled
+                        ? "Info.plist PinVaultPinReactNativeNetworking is NO"
+                        : pinned == nil ? "RCTNetworking's handler could not be checked"
+                        : "RCTNetworking hands https to another RCTURLRequestHandler"
+                    NSLog("PinVault: React Native's own fetch / XMLHttpRequest / images may NOT be pinned (\(why)); README, \"Networking\"")
+                    if parsed.requirePinnedReactNativeNetworking {
+                        reject("E_NETWORKING_NOT_PINNED", "requirePinnedReactNativeNetworking: \(why)", nil)
+                        return
+                    }
+                }
+                Self.locked {
+                    Self.jsGuard = newGuard
+                    Self.rnMaxResponseBytes = parsed.reactNativeMaxResponseBytes
+                }
+                // A second start applies the new config: the library keeps the
+                // first one otherwise (the samples restart the same way).
+                if Self.started { PinVault.shared.reset() }
+                // INIT, and ENROLL for a pending enrollment the start picks up.
+                let result = await Self.guarded([.start, .enroll]) { await PinVault.shared.start(config: parsed.config) }
+                Self.locked { Self.startedInProcess = true }
+                // Says whether the anchors came from the native security file (README "Native security file").
+                var answer = self.mapper.initResult(result)
+                answer["nativeSecurityApplied"] = parsed.nativeSecurityApplied
+                resolve(answer)
+            }
+        }
+    }
+
+    @objc public func updateNow(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.update(await PinVault.shared.updateNow()) }
+    }
+
+    @objc public func currentVersion(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.currentVersion() }
+    }
+
+    @objc public func hostPinVersions(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.hostPinVersions() }
+    }
+
+    @objc public func pinsForHost(_ hostname: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { ["pins": PinVault.shared.pinsForHost(hostname) ?? NSNull()] as [String: Any] }
+    }
+
+    @objc public func signingStatus(_ configApiId: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.signingStatus(configApiId: configApiId).map(self.mapper.signing) }
+    }
+
+    @objc public func isForceUpdate(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.isForceUpdate() }
+    }
+
+    @objc public func reset(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.reset(); return nil }
+    }
+
+    @objc public func schedulePeriodicUpdates(_ intervalHours: NSNumber?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            guard Self.started else { return false }
+            if let h = intervalHours?.int64Value, h < 1 || h > 24 * 30 {
+                throw BridgeInputError("intervalHours: must be between 1 and 720")
+            }
+            return PinVault.shared.schedulePeriodicUpdates(intervalHours: intervalHours?.int64Value)
+        }
+    }
+
+    @objc public func cancelPeriodicUpdates(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.cancelPeriodicUpdates(); return nil }
+    }
+
+    @objc public func enableDebugLogging(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            #if DEBUG
+            PinVault.enableDebugLogging()
+            return true
+            #else
+            return false
+            #endif
+        }
+    }
+
+    // MARK: pinned HTTP
+
+    @objc public func fetch(_ json: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        Task.detached {
+            let request: FetchRequest
+            do {
+                request = try PinnedFetch.parse(json)
+            } catch let e as BridgeInputError {
+                reject("E_INVALID_ARGUMENT", Self.tokens.redact(e.message) ?? "", nil)
+                return
+            } catch {
+                reject("E_INVALID_ARGUMENT", Self.tokens.redact("\(error)") ?? "", nil)
+                return
+            }
+            guard Self.started else {
+                reject("E_NOT_STARTED", "PinVault has not started: call start() first", nil)
+                return
+            }
+            let session = request.settings.map { PinVault.shared.session(settings: $0) } ?? PinVault.shared.session()
+            do {
+                resolve(try await PinnedFetch.execute(session, request))
+            } catch {
+                let info = self.exceptionInfo(error)
+                let name = info["exceptionName"] as? String ?? "Error"
+                let message = info["exceptionMessage"] as? String ?? ""
+                reject("E_FETCH", "\(name): \(message)", info)
+            }
+        }
+    }
+
+    // MARK: enrollment
+
+    @objc public func deviceId(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            #if canImport(UIKit)
+            return await MainActor.run { UIDevice.current.identifierForVendor?.uuidString.lowercased() }
+            #else
+            return nil
+            #endif
+        }
+    }
+
+    @objc public func enrollForResult(_ token: String, label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            if token.isEmpty || token.count > 4096 { throw BridgeInputError("token: must be 1 to 4096 characters") }
+            return await Self.tokens.withTransientSecret(token) {
+                self.mapper.enrollment(await Self.guarded([.enroll]) { await PinVault.shared.enrollForResult(token: token, label: label) })
+            }
+        }
+    }
+
+    @objc public func autoEnrollForResult(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.enrollment(await Self.guarded([.enroll]) { await PinVault.shared.autoEnrollForResult() }) }
+    }
+
+    @objc public func checkPendingEnrollment(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.enrollment(await Self.guarded([.enroll]) { await PinVault.shared.checkPendingEnrollment() }) }
+    }
+
+    @objc public func isEnrolled(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.isEnrolled(label: label) }
+    }
+
+    @objc public func isEnrollmentPending(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.isEnrollmentPending(label: label) }
+    }
+
+    @objc public func enrollmentVerificationCode(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.enrollmentVerificationCode(label: label) }
+    }
+
+    @objc public func enrolledClientCN(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.enrolledClientCN(label: label) }
+    }
+
+    @objc public func enrolledClientNotAfter(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.enrolledClientNotAfter(label: label) }
+    }
+
+    @objc public func unenroll(_ label: String?, wipeVaultFiles: Bool, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.unenroll(label: label, wipeVaultFiles: wipeVaultFiles); return nil }
+    }
+
+    @objc public func identityKeySecurityLevel(_ label: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { PinVault.shared.identityKeySecurityLevel(label: label)?.rawValue }
+    }
+
+    // MARK: vault files
+
+    @objc public func setVaultToken(_ key: String, token: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            try Self.checkKey(key)
+            try Self.checkToken(token)
+            Self.tokens.put(key, token)
+            return nil
+        }
+    }
+
+    @objc public func clearVaultTokens(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { Self.tokens.clear() }
+    }
+
+    @objc public func fetchFile(_ key: String, token: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            try Self.checkKey(key)
+            try Self.checkToken(token)
+            if let token { Self.tokens.put(key, token) }
+            return self.mapper.vaultFile(await Self.guarded([.fetchFile]) { await PinVault.shared.fetchFile(key) })
+        }
+    }
+
+    @objc public func loadFile(_ key: String, encoding: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            try Self.checkKey(key)
+            let enc = try ResultMapper.checkEncoding(encoding)
+            return await Self.guarded([.loadFile]) { PinVault.shared.loadFile(key) }.map { ResultMapper.encode($0, enc) }
+        }
+    }
+
+    @objc public func fileStatus(_ key: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { try Self.checkKey(key); return PinVault.shared.fileStatus(key).rawValue }
+    }
+
+    @objc public func unlockFile(_ key: String, prompt json: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) {
+            try Self.checkKey(key)
+            let (prompt, encoding) = try ConfigParser.unlockPrompt(json)
+            // LAContext's Face ID / passcode prompt is the library's.
+            return self.mapper.unlock(
+                await Self.guarded([.unlockFile]) { await PinVault.shared.unlockFile(key: key, prompt: prompt) }, encoding: encoding
+            )
+        }
+    }
+
+    @objc public func isFileLocked(_ key: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { try Self.checkKey(key); return PinVault.shared.isFileLocked(key) }
+    }
+
+    @objc public func hasFile(_ key: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { try Self.checkKey(key); return PinVault.shared.hasFile(key) }
+    }
+
+    @objc public func fileVersion(_ key: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { try Self.checkKey(key); return PinVault.shared.fileVersion(key) }
+    }
+
+    @objc public func clearFile(_ key: String, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { try Self.checkKey(key); PinVault.shared.clearFile(key); return nil }
+    }
+
+    @objc public func syncAllFiles(resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { (await Self.guarded([.fetchFile]) { await PinVault.shared.syncAllFiles() }).mapValues(self.mapper.vaultFile) }
+    }
+
+    // MARK: attestation
+
+    @objc public func attestNow(_ configApiId: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.attestation(await PinVault.shared.attestNow(configApiId: configApiId)) }
+    }
+
+    @objc public func fetchAttestationToken(_ host: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.attestationToken(await PinVault.shared.fetchAttestationToken(host: host)) }
+    }
+
+    @objc public func attestationStatus(_ configApiId: String?, resolve: @escaping Resolve, reject: @escaping Reject) {
+        run(resolve, reject) { self.mapper.attestation(PinVault.shared.attestationStatus(configApiId: configApiId)) }
+    }
+
+    // MARK: environmentGuard
+
+    @objc public func answerGuard(_ requestId: String, allowed: Bool) {
+        let g = Self.locked { Self.jsGuard }
+        g?.answer(requestId, allowed: allowed)
+    }
+}
+
+/// Serialises `start` calls (a second start resets and starts again).
+private actor StartQueue {
+    private var tail: Task<Void, Never>?
+
+    func run(_ body: @escaping @Sendable () async -> Void) async {
+        let previous = tail
+        let task = Task {
+            await previous?.value
+            await body()
+        }
+        tail = task
+        await task.value
+    }
+}

package/ios/PinVaultReactNetworking.swift

@@ -0,0 +1,47 @@
+// The Swift side of RNPinVaultURLRequestHandler.mm: React Native's https
+// requests (fetch, XMLHttpRequest, <Image>) through PinVault's pinned session.
+// The rules live in Core/ReactNetworking.swift.
+import Foundation
+import PinVault
+
+@objc(RNPinVaultReactNetworking)
+public final class PinVaultReactNetworking: NSObject {
+
+    /// Info.plist `PinVaultPinReactNativeNetworking` = NO hands https back to
+    /// React Native's own (unpinned) handler — a native opt-out, which a JS
+    /// bundle cannot flip. Default: on.
+    @objc public static let enabled: Bool =
+        (Bundle.main.object(forInfoDictionaryKey: "PinVaultPinReactNativeNetworking") as? Bool) ?? true
+
+    @objc public static func canHandle(_ request: URLRequest) -> Bool {
+        enabled && ReactNetworking.handles(request)
+    }
+
+    /// The request token for RN; nothing reaches the blocks before `resume()`.
+    @objc public static func prepare(
+        _ request: URLRequest,
+        didSendData: @escaping (Int64) -> Void,
+        didReceiveResponse: @escaping (URLResponse) -> Void,
+        didReceiveData: @escaping (Data) -> Void,
+        didComplete: @escaping (NSError?) -> Void
+    ) -> ReactNetworkingTask {
+        var send: ReactNetworking.Send?
+        if PinVaultBridge.isStarted {
+            send = { (request: URLRequest, limit: Int64) async throws -> (Data, URLResponse) in
+                try await PinVault.shared.session().data(for: request, maxResponseBytes: limit)
+            }
+        }
+        return ReactNetworking.prepare(
+            request,
+            send: send,
+            maxResponseBytes: PinVaultBridge.reactNativeMaxResponseBytes,
+            describe: PinVaultBridge.describe,
+            callbacks: ReactNetworking.Callbacks(
+                didSendData: didSendData,
+                didReceiveResponse: didReceiveResponse,
+                didReceiveData: didReceiveData,
+                didComplete: { didComplete($0.map { $0 as NSError }) }
+            )
+        )
+    }
+}

package/ios/RNPinVault.h

@@ -0,0 +1,7 @@
+// RNPinVault — the ObjC++ shell of the TurboModule. It conforms to the
+// codegen protocol and forwards every call to the Swift bridge
+// (PinVaultBridge.swift), which calls PinVault.shared.
+#import <RNPinVaultSpec/RNPinVaultSpec.h>
+
+@interface RNPinVault : NativePinVaultSpecBase <NativePinVaultSpec>
+@end