@umutcansu/react-native-pinvault 0.0.0-stage → 2.4.0

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/ResultMapper.kt

@@ -0,0 +1,188 @@
+package io.github.umutcansu.pinvault.reactnative
+
+import io.github.umutcansu.pinvault.api.PinVaultConnectionEvent
+import io.github.umutcansu.pinvault.model.AttestationStatus
+import io.github.umutcansu.pinvault.model.AttestationTokenResult
+import io.github.umutcansu.pinvault.model.ClientCertEnrollmentResult
+import io.github.umutcansu.pinvault.model.InitResult
+import io.github.umutcansu.pinvault.model.SigningStatus
+import io.github.umutcansu.pinvault.model.UpdateResult
+import io.github.umutcansu.pinvault.model.VaultFileResult
+import io.github.umutcansu.pinvault.model.VaultFileUnlockResult
+import okio.ByteString.Companion.toByteString
+
+/**
+ * Native results → plain maps for JS. `type` is the sealed subclass in
+ * lowerCamel (`Ready` → `ready`), every other key is the Kotlin property name.
+ * Every free-text field goes through [VaultTokenStore.redact]; vault file
+ * content appears only in `unlocked` (after the native prompt) and in
+ * `loadFile`, never in a download result or an event.
+ */
+internal class ResultMapper(private val tokens: VaultTokenStore) {
+
+    private fun text(s: String?): String? = tokens.redact(s)
+
+    fun exception(e: Throwable?): Map<String, Any?>? = e?.let {
+        mapOf("name" to it.javaClass.simpleName.ifEmpty { "Exception" }, "message" to text(it.message))
+    }
+
+    fun init(r: InitResult): Map<String, Any?> = when (r) {
+        is InitResult.Ready -> mapOf("type" to "ready", "version" to r.version)
+        is InitResult.Failed -> mapOf("type" to "failed", "reason" to text(r.reason), "exception" to exception(r.exception))
+    }
+
+    fun update(r: UpdateResult): Map<String, Any?> = when (r) {
+        is UpdateResult.Updated -> mapOf("type" to "updated", "newVersion" to r.newVersion)
+        UpdateResult.AlreadyCurrent -> mapOf("type" to "alreadyCurrent")
+        is UpdateResult.Failed -> mapOf("type" to "failed", "reason" to text(r.reason), "exception" to exception(r.exception))
+    }
+
+    fun enrollment(r: ClientCertEnrollmentResult): Map<String, Any?> = when (r) {
+        is ClientCertEnrollmentResult.Enrolled -> mapOf(
+            "type" to "enrolled",
+            "alreadyEnrolled" to r.alreadyEnrolled,
+            "keySecurityLevel" to r.keySecurityLevel?.name,
+        )
+        is ClientCertEnrollmentResult.Refused -> mapOf(
+            "type" to "refused",
+            "reason" to r.reason.name,
+            "httpStatus" to r.httpStatus,
+            "serverError" to text(r.serverError),
+            "message" to text(r.message),
+        )
+        is ClientCertEnrollmentResult.Pending -> mapOf(
+            "type" to "pending",
+            "requestId" to r.requestId,
+            "clientId" to r.clientId,
+            "message" to text(r.message),
+            "retryAfterSeconds" to r.retryAfterSeconds,
+            "verificationCode" to r.verificationCode,
+        )
+        is ClientCertEnrollmentResult.Failed -> mapOf(
+            "type" to "failed",
+            "message" to text(r.message),
+            "cause" to exception(r.cause),
+        )
+    }
+
+    fun vaultFile(r: VaultFileResult): Map<String, Any?> = when (r) {
+        // No bytes: the content is read with loadFile / unlockFile, on purpose.
+        is VaultFileResult.Updated -> mapOf("type" to "updated", "key" to r.key, "version" to r.version)
+        is VaultFileResult.AlreadyCurrent -> mapOf("type" to "alreadyCurrent", "key" to r.key, "version" to r.version)
+        is VaultFileResult.Failed -> mapOf(
+            "type" to "failed",
+            "key" to r.key,
+            "reason" to text(r.reason),
+            "code" to r.code,
+            "exception" to exception(r.exception),
+        )
+    }
+
+    fun unlock(r: VaultFileUnlockResult, encoding: String): Map<String, Any?> = when (r) {
+        is VaultFileUnlockResult.Unlocked -> mapOf(
+            "type" to "unlocked",
+            "key" to r.key,
+            "version" to r.version,
+            "content" to encode(r.bytes, encoding),
+            "encoding" to encoding,
+        )
+        is VaultFileUnlockResult.NotFound -> mapOf("type" to "notFound", "key" to r.key)
+        is VaultFileUnlockResult.Cancelled -> mapOf("type" to "cancelled", "key" to r.key)
+        is VaultFileUnlockResult.Invalidated -> mapOf("type" to "invalidated", "key" to r.key)
+        is VaultFileUnlockResult.Stale -> mapOf("type" to "stale", "key" to r.key)
+        is VaultFileUnlockResult.Failed -> mapOf(
+            "type" to "failed",
+            "key" to r.key,
+            "reason" to text(r.reason),
+            "exception" to exception(r.exception),
+        )
+    }
+
+    fun attestation(s: AttestationStatus): Map<String, Any?> = mapOf(
+        "configApiId" to s.configApiId,
+        "result" to s.result.name,
+        "arc" to s.arc,
+        "rejectionReasons" to s.rejectionReasons,
+        "warnings" to s.warnings,
+        "tokenExpiresAt" to s.tokenExpiresAt,
+        "lastAttestedAt" to s.lastAttestedAt,
+        "nextAttestAt" to s.nextAttestAt,
+        "clockSkewMs" to s.clockSkewMs,
+        "lastError" to text(s.lastError),
+        "policyVersion" to s.policyVersion,
+    )
+
+    fun attestationToken(r: AttestationTokenResult): Map<String, Any?> = when (r) {
+        is AttestationTokenResult.Token -> mapOf("type" to "token", "value" to r.value, "expiresAt" to r.expiresAt)
+        is AttestationTokenResult.Rejected -> mapOf("type" to "rejected", "status" to attestation(r.status))
+        is AttestationTokenResult.Failed -> mapOf("type" to "failed", "message" to text(r.message))
+        AttestationTokenResult.Unsupported -> mapOf("type" to "unsupported")
+    }
+
+    fun signing(s: SigningStatus): Map<String, Any?> = mapOf(
+        "configApiId" to s.configApiId,
+        "trustedKeyIds" to s.trustedKeyIds,
+        "requiredSignatures" to s.requiredSignatures,
+        "keySetVersion" to s.keySetVersion,
+        "recoveryKeyIds" to s.recoveryKeyIds,
+        "lastConfigSignedBy" to s.lastConfigSignedBy,
+    )
+
+    /** Connection telemetry. The library puts no token in events; free text is redacted anyway. */
+    fun event(e: PinVaultConnectionEvent): Map<String, Any?> = when (e) {
+        is PinVaultConnectionEvent.Connection -> mapOf(
+            "type" to "connection",
+            "hostname" to e.hostname,
+            "success" to e.success,
+            "pinVersion" to e.pinVersion,
+            "deviceManufacturer" to e.deviceManufacturer,
+            "deviceModel" to e.deviceModel,
+            "actualPin" to e.actualPin,
+            "expectedPins" to e.expectedPins,
+        )
+        is PinVaultConnectionEvent.ConfigUpdate -> mapOf(
+            "type" to "configUpdate",
+            "status" to e.status.name,
+            "newVersion" to e.newVersion,
+            "deviceManufacturer" to e.deviceManufacturer,
+            "deviceModel" to e.deviceModel,
+            "failureReason" to text(e.failureReason),
+        )
+        is PinVaultConnectionEvent.ClientCertRenewal -> mapOf(
+            "type" to "clientCertRenewal",
+            "status" to e.status.name,
+            "notAfterEpochMs" to e.notAfterEpochMs,
+            "via" to e.via?.name,
+            "configApiId" to e.configApiId,
+            "deviceManufacturer" to e.deviceManufacturer,
+            "deviceModel" to e.deviceModel,
+            "failureReason" to text(e.failureReason),
+        )
+        is PinVaultConnectionEvent.Attestation -> mapOf(
+            "type" to "attestation",
+            "configApiId" to e.configApiId,
+            "status" to e.status.name,
+            "arc" to e.arc,
+            "rejectionReasons" to e.rejectionReasons,
+            "warnings" to e.warnings,
+            "tokenExpiresAt" to e.tokenExpiresAt,
+            "deviceManufacturer" to e.deviceManufacturer,
+            "deviceModel" to e.deviceModel,
+            "failureReason" to text(e.failureReason),
+        )
+    }
+
+    companion object {
+        const val UTF8 = "utf8"
+        const val BASE64 = "base64"
+
+        fun checkEncoding(encoding: String): String {
+            if (encoding != UTF8 && encoding != BASE64) throw BridgeInputException("encoding: must be 'utf8' or 'base64'")
+            return encoding
+        }
+
+        fun encode(bytes: ByteArray, encoding: String): String =
+            // Okio, not android.util.Base64: it also runs in JVM unit tests (and java.util.Base64 needs API 26).
+            if (encoding == BASE64) bytes.toByteString().base64() else bytes.toString(Charsets.UTF_8)
+    }
+}

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/StrictJson.kt

@@ -0,0 +1,225 @@
+package io.github.umutcansu.pinvault.reactnative
+
+import org.json.JSONArray
+import org.json.JSONException
+import org.json.JSONObject
+import org.json.JSONTokener
+
+/**
+ * A refusal of bridge input: unknown key, wrong type, value out of range,
+ * oversized input. Its message names the path (`config.configApis[0].url`).
+ */
+class BridgeInputException(message: String) : IllegalArgumentException(message)
+
+/**
+ * Strict JSON for bridge input. JSON from JS → plain Kotlin values (Map, List,
+ * String, Boolean, Number, null); then [Fields] reads an object key by key and
+ * refuses every key it did not read ([Fields.finish]). Nothing is silently
+ * ignored and nothing is coerced (a "1" is not a number, a 1 is not a boolean).
+ */
+internal object StrictJson {
+
+    const val MAX_INPUT_CHARS = 256 * 1024
+    const val MAX_DEPTH = 8
+
+    fun parseObject(json: String, path: String, maxChars: Int = MAX_INPUT_CHARS): Fields {
+        if (json.length > maxChars) throw BridgeInputException("$path: larger than $maxChars characters")
+        // Before the parser: org.json's tokener recurses once per level, and a
+        // StackOverflowError is no Exception the bridge would catch.
+        if (nestingDepth(json) > MAX_DEPTH + 1) throw BridgeInputException("$path: nested too deeply")
+        val value = try {
+            JSONTokener(json).nextValue()
+        } catch (e: JSONException) {
+            throw BridgeInputException("$path: not valid JSON")
+        } catch (e: StackOverflowError) {
+            throw BridgeInputException("$path: nested too deeply")
+        }
+        if (value !is JSONObject) throw BridgeInputException("$path: must be an object")
+        @Suppress("UNCHECKED_CAST")
+        return Fields(path, toKotlin(value, path, 0) as Map<String, Any?>)
+    }
+
+    /**
+     * The deepest `[` / `{` nesting of [json], strings skipped; stops counting
+     * past the limit. Malformed text is left to the parser.
+     */
+    fun nestingDepth(json: String, stopAt: Int = MAX_DEPTH + 2): Int {
+        var depth = 0
+        var deepest = 0
+        var inString = false
+        var escaped = false
+        for (c in json) {
+            if (inString) {
+                when {
+                    escaped -> escaped = false
+                    c == '\\' -> escaped = true
+                    c == '"' -> inString = false
+                }
+                continue
+            }
+            when (c) {
+                '"' -> inString = true
+                '[', '{' -> {
+                    depth++
+                    if (depth > deepest) {
+                        deepest = depth
+                        if (deepest >= stopAt) return deepest
+                    }
+                }
+                ']', '}' -> if (depth > 0) depth--
+            }
+        }
+        return deepest
+    }
+
+    private fun toKotlin(value: Any?, path: String, depth: Int): Any? {
+        if (depth > MAX_DEPTH) throw BridgeInputException("$path: nested too deeply")
+        return when (value) {
+            null, JSONObject.NULL -> null
+            is JSONObject -> {
+                val out = LinkedHashMap<String, Any?>()
+                val keys = value.keys()
+                while (keys.hasNext()) {
+                    val k = keys.next()
+                    out[k] = toKotlin(value.opt(k), "$path.$k", depth + 1)
+                }
+                out
+            }
+            is JSONArray -> (0 until value.length()).map { toKotlin(value.opt(it), "$path[$it]", depth + 1) }
+            is String, is Boolean -> value
+            is Number -> {
+                val d = value.toDouble()
+                if (d.isNaN() || d.isInfinite()) throw BridgeInputException("$path: not a finite number")
+                value
+            }
+            else -> throw BridgeInputException("$path: unsupported value")
+        }
+    }
+}
+
+/** One JSON object; every accessor marks its key as known. JSON `null` counts as absent. */
+internal class Fields(val path: String, private val map: Map<String, Any?>) {
+
+    private val known = mutableSetOf<String>()
+
+    private fun raw(key: String): Any? {
+        known += key
+        return map[key]
+    }
+
+    fun has(key: String): Boolean {
+        known += key
+        return map[key] != null
+    }
+
+    /** Refuses every key no accessor asked for. */
+    fun finish() {
+        val unknown = map.keys.filter { it !in known }
+        if (unknown.isNotEmpty()) {
+            throw BridgeInputException(
+                "$path: unknown key${if (unknown.size > 1) "s" else ""} ${unknown.joinToString { "'$it'" }}"
+            )
+        }
+    }
+
+    fun string(key: String, maxLength: Int = 2048, allowEmpty: Boolean = false, multiline: Boolean = false): String? {
+        val v = raw(key) ?: return null
+        if (v !is String) throw BridgeInputException("$path.$key: must be a string")
+        if (v.length > maxLength) throw BridgeInputException("$path.$key: longer than $maxLength characters")
+        if (!allowEmpty && v.isEmpty()) throw BridgeInputException("$path.$key: must not be empty")
+        if (v.any { badChar(it, multiline) }) throw BridgeInputException("$path.$key: control characters are not allowed")
+        return v
+    }
+
+    /** Free text (a request body): any characters, bounded length. */
+    fun text(key: String, maxLength: Int): String? {
+        val v = raw(key) ?: return null
+        if (v !is String) throw BridgeInputException("$path.$key: must be a string")
+        if (v.length > maxLength) throw BridgeInputException("$path.$key: longer than $maxLength characters")
+        return v
+    }
+
+    private fun badChar(c: Char, multiline: Boolean): Boolean =
+        (c.code < 0x20 || c.code == 0x7f) && !(multiline && (c == '\n' || c == '\r'))
+
+    fun requireString(key: String, maxLength: Int = 2048): String =
+        string(key, maxLength) ?: throw BridgeInputException("$path.$key: required")
+
+    fun bool(key: String): Boolean? {
+        val v = raw(key) ?: return null
+        if (v !is Boolean) throw BridgeInputException("$path.$key: must be a boolean")
+        return v
+    }
+
+    fun long(key: String, min: Long, max: Long): Long? {
+        val v = raw(key) ?: return null
+        if (v !is Number) throw BridgeInputException("$path.$key: must be a number")
+        val d = v.toDouble()
+        if (d != Math.floor(d)) throw BridgeInputException("$path.$key: must be a whole number")
+        if (d < min || d > max) throw BridgeInputException("$path.$key: must be between $min and $max")
+        return d.toLong()
+    }
+
+    fun int(key: String, min: Int, max: Int): Int? = long(key, min.toLong(), max.toLong())?.toInt()
+
+    fun double(key: String, min: Double, max: Double): Double? {
+        val v = raw(key) ?: return null
+        if (v !is Number) throw BridgeInputException("$path.$key: must be a number")
+        val d = v.toDouble()
+        if (d < min || d > max) throw BridgeInputException("$path.$key: must be between $min and $max")
+        return d
+    }
+
+    fun stringList(key: String, maxItems: Int = 64, maxLength: Int = 2048, multiline: Boolean = false): List<String>? {
+        val v = raw(key) ?: return null
+        if (v !is List<*>) throw BridgeInputException("$path.$key: must be a list of strings")
+        if (v.size > maxItems) throw BridgeInputException("$path.$key: more than $maxItems items")
+        return v.mapIndexed { i, item ->
+            if (item !is String) throw BridgeInputException("$path.$key[$i]: must be a string")
+            if (item.isEmpty() || item.length > maxLength) {
+                throw BridgeInputException("$path.$key[$i]: must be 1 to $maxLength characters")
+            }
+            if (item.any { badChar(it, multiline) }) throw BridgeInputException("$path.$key[$i]: control characters are not allowed")
+            item
+        }
+    }
+
+    fun obj(key: String): Fields? {
+        val v = raw(key) ?: return null
+        if (v !is Map<*, *>) throw BridgeInputException("$path.$key: must be an object")
+        @Suppress("UNCHECKED_CAST")
+        return Fields("$path.$key", v as Map<String, Any?>)
+    }
+
+    fun objList(key: String, maxItems: Int): List<Fields>? {
+        val v = raw(key) ?: return null
+        if (v !is List<*>) throw BridgeInputException("$path.$key: must be a list of objects")
+        if (v.size > maxItems) throw BridgeInputException("$path.$key: more than $maxItems items")
+        return v.mapIndexed { i, item ->
+            if (item !is Map<*, *>) throw BridgeInputException("$path.$key[$i]: must be an object")
+            @Suppress("UNCHECKED_CAST")
+            Fields("$path.$key[$i]", item as Map<String, Any?>)
+        }
+    }
+
+    /** A string → string map (`ios.resolve`, request headers). */
+    fun stringMap(key: String, maxItems: Int, maxKeyLength: Int, maxValueLength: Int): Map<String, String>? {
+        val v = raw(key) ?: return null
+        if (v !is Map<*, *>) throw BridgeInputException("$path.$key: must be an object")
+        if (v.size > maxItems) throw BridgeInputException("$path.$key: more than $maxItems entries")
+        return v.entries.associate { (k, value) ->
+            val name = k as String
+            if (name.isEmpty() || name.length > maxKeyLength) throw BridgeInputException("$path.$key: key '${name.take(40)}' has a bad length")
+            if (value !is String) throw BridgeInputException("$path.$key.$name: must be a string")
+            if (value.length > maxValueLength) throw BridgeInputException("$path.$key.$name: longer than $maxValueLength characters")
+            name to value
+        }
+    }
+
+    /** `enum` by its Kotlin constant name. */
+    fun <E : Enum<E>> enum(key: String, values: Array<E>): E? {
+        val v = string(key, 64) ?: return null
+        return values.firstOrNull { it.name == v }
+            ?: throw BridgeInputException("$path.$key: '$v' is not one of ${values.joinToString { it.name }}")
+    }
+}

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/VaultTokenStore.kt

@@ -0,0 +1,63 @@
+package io.github.umutcansu.pinvault.reactnative
+
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Vault access tokens and the enrollment token of a running call, in memory
+ * only: never written to disk, gone with the process. The vault files'
+ * `accessToken { … }` providers read from here on every download. Every
+ * string that goes back to JS is passed through [redact], so a token that a
+ * native message happens to echo never reaches JS.
+ */
+internal class VaultTokenStore {
+
+    private val tokens = ConcurrentHashMap<String, String>()
+    private val transient = ConcurrentHashMap.newKeySet<String>()
+
+    fun put(key: String, token: String?) {
+        if (token.isNullOrEmpty()) tokens.remove(key) else tokens[key] = token
+    }
+
+    /** Empty when there is none: the server refuses that as an invalid token. */
+    fun get(key: String): String = tokens[key] ?: ""
+
+    fun clear(): Int {
+        val n = tokens.size
+        tokens.clear()
+        return n
+    }
+
+    /** A secret that is not stored but must still be redacted while a call runs (enrollment token). */
+    fun <T> withTransientSecret(secret: String, block: () -> T): T {
+        if (secret.length >= MIN_REDACT_LENGTH) transient += secret
+        try {
+            return block()
+        } finally {
+            transient -= secret
+        }
+    }
+
+    suspend fun <T> withTransientSecretSuspend(secret: String, block: suspend () -> T): T {
+        if (secret.length >= MIN_REDACT_LENGTH) transient += secret
+        try {
+            return block()
+        } finally {
+            transient -= secret
+        }
+    }
+
+    fun redact(text: String?): String? {
+        if (text == null) return null
+        var out: String = text
+        for (secret in tokens.values + transient) {
+            if (secret.length >= MIN_REDACT_LENGTH) out = out.replace(secret, "***")
+        }
+        return if (out.length > MAX_MESSAGE) out.take(MAX_MESSAGE) + "…" else out
+    }
+
+    companion object {
+        /** Shorter values would redact ordinary words. */
+        const val MIN_REDACT_LENGTH = 6
+        const val MAX_MESSAGE = 1000
+    }
+}